A graph rag-based ship network security specification knowledge graph construction and question and answer method and system

Abstract

The application provides a kind of ship network security specification knowledge graph construction and question and answer method and system based on GraphRAG, belongs to knowledge graph construction and natural language processing technical field.The method includes: text cleaning, format standardization and semantic block processing are carried out to ship network security specification document;Adopt field customization prompt word template to call large language model to carry out entity relationship joint extraction, and construct knowledge graph;The knowledge graph is stored in graph database, constructs vector similarity index and inverted index, and adopts Leiden algorithm to carry out community division and abstract generation;Receive user query, execute local subgraph retrieval, global abstract retrieval or multi-hop reasoning retrieval;The retrieval result is input into large language model to generate explainable answer with reference annotation.The application solves the problems of low processing efficiency of multi-source heterogeneous knowledge, large model illusion, insufficient reasoning ability of traditional RAG and high maintenance cost of knowledge graph in the prior art through field customization GraphRAG framework.

Description

Technical Field

[0001] This invention relates to the fields of knowledge graph construction and natural language processing technology, and more particularly to a method and system for constructing and answering questions based on a GraphRAG-based knowledge graph of ship cybersecurity specifications. Background Technology

[0002] Ship cybersecurity has become a core issue in the modern shipping industry. With the increasing automation and intelligence of ships, the interconnection between shipboard control systems (such as ECDIS, AIS, VDR, etc.) and shore-based systems and the internet is deepening, leading to increasingly complex cybersecurity threats. Authoritative organizations such as the International Maritime Organization (IMO) and the International Association of Classification Societies (IACS) have successively released numerous cybersecurity standards, including IACS UR E26 / E27, the IEC 62443 series standards, and the "Guideline for Maritime Cyber ​​Risk Management." These standards are not only numerous and frequently updated, but also have complex cross-references, covering cybersecurity requirements throughout the entire lifecycle of ship design, construction, and operation. Traditional manual review methods are insufficient to meet the demands of managing this multi-source, heterogeneous, and dynamically updated knowledge.

[0003] Existing technologies have significant limitations in processing knowledge related to ship cybersecurity regulations. Traditional text retrieval systems rely on keyword matching or vector similarity retrieval, failing to understand semantic relationships and logical reasoning, resulting in poor cross-document query performance. While vector-based RAG methods can improve the efficiency of single-document fragment retrieval, they lack the ability to model the global document structure and cross-text entity relationships. General-purpose large language models are prone to factual errors in specialized fields and cannot provide the interpretability required for compliance reviews. Existing knowledge graph technologies largely rely on manually constructed ontologies, resulting in high construction costs and delayed updates, making them unsuitable for the frequent revisions of regulations. In particular, existing technologies have not yet proposed effective automated processing solutions for the unique clause hierarchy structure, normative terminology patterns, and cross-standard reference relationships of ship cybersecurity regulations. Summary of the Invention

[0004] To address the aforementioned technical challenges in existing knowledge management and intelligent question answering systems for ship cybersecurity, including difficulties in efficiently processing multi-source heterogeneous knowledge, the existence of illusions and uninterpretability in specialized domains with general-purpose models, insufficient traditional RAG retrieval and reasoning capabilities, low automation and high maintenance costs in knowledge graph construction, and a lack of integrated intelligent tools for multiple roles throughout the ship's lifecycle, this invention provides a method and system for constructing and answering ship cybersecurity regulatory knowledge graphs based on GraphRAG. This invention primarily utilizes domain-customized prompt word templates for joint entity relation extraction, the Leiden algorithm for hierarchical community partitioning and community summary generation, and a multi-mode retrieval mechanism that integrates local subgraph retrieval and global summary retrieval. This significantly improves knowledge representation and structuring capabilities, enhances complex query processing capabilities, increases the efficiency of automated knowledge graph construction, strengthens answer credibility and traceability, and achieves integrated intelligent services for multiple roles including shipyards, shipowners, crew members, and classification societies.

[0005] The technical means employed in this invention are as follows: A GraphRAG-based method for constructing a knowledge graph of ship cybersecurity specifications and for question answering includes: S1. Perform text cleaning, format standardization, and semantic segmentation on the input ship network security specification document to obtain standardized text units; S2. Based on the obtained normalized text units, a domain-customized prompt word template is used to call the large language model to jointly extract entity relations, resulting in knowledge graph data containing entity nodes, relation edges, and attributes. S3. Store the constructed knowledge graph in a graph database, build a vector similarity index and an inverted index, and use a community detection algorithm to divide the knowledge graph into communities, generate community-level summary descriptions, and form a global knowledge summary index. S4. Receive user queries, determine the results based on the query type, call the global knowledge summary index, and execute at least one of the following search modes: local subgraph search, global summary search, or multi-hop reasoning search, to obtain structured search results. S5. The obtained structured search results are used as context input to the large language model to generate an interpretable answer with citation annotations, and output through an OpenAI-compatible API interface.

[0006] Further, step S1 includes: S11. Collect multi-source heterogeneous document data in the field of ship cybersecurity, including international regulations, classification society rules, operation manuals, case libraries and emergency response guidelines; S12. Perform deduplication, noise removal, and format standardization on the collected multi-source heterogeneous document data to unify the encoding format and paragraph structure of documents from different sources. S13. The cleaned text is divided into blocks using a sliding window strategy. The window size and overlap length are set to ensure the semantic continuity of clauses at the boundaries and form standardized text units. S14. Perform structured transformation on the standardized text units after segmentation, and extract document metadata information, including standard name, version number, chapter number and clause level, to provide standardized input with source identifier for subsequent entity relationship extraction.

[0007] Further, step S2 includes: S21. Predefine the entity type system and relationship type system in the field of ship cybersecurity, wherein the entity types include system entities, requirement entities, standard entities, functional entities, risk entities and control measure entities, and the relationship types include reference relationships, dependency relationships, implementation relationships, inclusion relationships and association relationships; S22. Configure a prompt word template specifically for the field of ship cybersecurity. The prompt word template includes: The expert role is defined as a security architecture analyst in the fields of industrial cybersecurity and marine system security. Introduce a few-shot example that conforms to IEC 62443 and is associated with the safety functions of the shipboard computer system; the constraint output language is Chinese. The entity type is limited to a predefined entity type system, and the relation type is limited to a predefined relation type system; S23. Call the large language model and, based on the configured prompt word template, perform joint entity-relation extraction on each normalized text unit to produce entity data and relation data. The entity data includes entity name, entity type and entity description, and the relation data is represented in the form of a quadruple, including source entity, target entity, relation description and strength score. S24. When the same entity is repeatedly extracted in multiple normalized text units, the large language model is called to merge the multiple descriptions to generate a unified entity description, while retaining the source of the entity in each normalized text. S25. Store the merged entity data and relation data in a structured format to form a complete knowledge graph data, and record the original specification source and clause number corresponding to each entity and relation.

[0008] Further, step S3 includes: S31. Import the constructed knowledge graph data into the graph database. Each entity node stores the entity type, entity name, entity description, entity attributes, original text fragment, name of the specification document, version number and clause number attributes. Each relation edge stores the relation type, relation description, strength score, confidence score and extraction source attributes. S32. The text description of each entity node is vectorized and encoded, and a semantic vector is generated through an embedding model. A vector similarity index is established to support entity retrieval based on semantic similarity and supplementary retrieval of related text fragments. S33. Build an inverted index for clause number, keywords, entity name and specification document name, and support retrieval queries based on exact matching and Boolean combination; S34. The Leiden algorithm is used to divide the knowledge graph into hierarchical communities. Community level parameters are set to generate multiple communities distributed across multiple levels. Each community contains a set of closely related entity nodes and their connection relationships. The higher the community level, the coarser the community granularity. S35. For each community, call the large language model to generate a structured community report. The structured community report includes the community number, community level, community title, community summary, importance score and importance description fields. The importance score indicates the degree of criticality of the community in the ship network security knowledge system, and the importance description field explains the basis for the association between the community and the industrial network security standards. S36. Vectorize and index the community summary content of all generated structured community reports to form a global knowledge summary index, supporting global information query based on community semantics and cross-community knowledge association retrieval.

[0009] Further, step S4 includes: S41. Receive natural language queries input by users, perform intent recognition, key entity extraction and query type determination on the query through a large language model, and output structured query parsing results. The query types include local fact queries, global comprehensive queries and multi-hop reasoning queries. S42. Based on the output query type, determine the result and distribute the query to the corresponding retrieval path. The retrieval path includes the local subgraph retrieval path, the global summary retrieval path, and the multi-hop inference retrieval path. S43. When the query type is a local fact query, the query text is encoded using an embedding model and matched with the established vector similarity index to locate the most relevant query semantics. One entity node; using the located entity node as a seed, in the knowledge graph... Skip graph traversal to extract local subgraphs containing directly related entity nodes, relation edges, and text attributes of adjacent nodes; simultaneously, utilize vector similarity indexing to... The relevant text fragments are supplemented to assemble the local subgraph structure information, relation table and text fragments into structured search results; S44. When the query type is a global comprehensive query, the map-reduce strategy is adopted. In the map phase, the query is combined with all community reports generated at the specified level, and the large language model is called to generate a list of key points for each community. In the reduce phase, the list of key points of each community is merged, and the large language model generates a comprehensive answer to form a global summary context as a structured search result. S45. When the query type is a multi-hop reasoning query, an iterative graph traversal strategy is adopted to gradually expand the retrieval scope along the relational path in the knowledge graph. In each iteration, the traversal is carried outward along the relational edge of the current node. Information of each node on the reasoning chain and corresponding normative original text fragments are collected to form a structured retrieval result containing a complete reasoning path and evidence chain.

[0010] Furthermore, step S4 also includes a fusion retrieval mode: sequentially calling local subgraph retrieval and global summary retrieval, merging the local answer produced by local subgraph retrieval with the global answer produced by global summary retrieval, and generating a comprehensive answer that has both precise details and a global perspective.

[0011] Further, step S5 includes: S51. Assemble the obtained structured search results into an enhanced context. The enhanced context includes an entity table, a relation table, original text fragments, and relevant community reports. The entity table lists the entity name, entity type, and entity description in the search results, and the relation table lists the source entity, target entity, relation type, and relation description. S52. Input the assembled enhanced context into the large language model, and the large language model will perform reasoning based on the enhanced context to generate a natural language answer. The natural language answer covers the specific terms and conditions involved in the query, related security functions, and compliance operation suggestions. S53. Include citation annotations in the generated natural language answers. The citation annotations adopt a structured format and point to the graph elements supporting the answers and the original source of the specifications, including the specification document name, version number, clause number, chapter number and reasoning path information, so that users can directly verify the original specification basis. S54. Output the final answer in a structured response body through an OpenAI-compatible API interface, supporting streaming segmented return or non-streaming complete return. The structured response body includes the answer text, a list of citation annotations, and a search mode identifier.

[0012] This invention also provides a GraphRAG-based system for constructing and answering ship cybersecurity specification knowledge graphs based on the aforementioned GraphRAG-based method for constructing and answering question-and-answer questions. The system includes: a document preprocessing module, a knowledge graph construction module, a graph storage and indexing module, a multi-modal retrieval module, and an intelligent question-and-answer service module, wherein: The document preprocessing module is used to perform text cleaning, format standardization, and semantic segmentation on the input ship network security specification document to obtain standardized text units; The knowledge graph construction module is used to extract entity relations jointly by calling a large language model based on the obtained normalized text units and using domain-customized prompt word templates to obtain knowledge graph data containing entity nodes, relation edges and attributes. The graph storage and indexing module is used to store the constructed knowledge graph in a graph database, construct a vector similarity index and an inverted index, and use a community detection algorithm to divide the knowledge graph into communities, generate community-level summary descriptions, and form a global knowledge summary index. The multi-mode retrieval module is used to receive user queries, determine the results based on the query type, call the global knowledge summary index, and execute at least one retrieval mode among local subgraph retrieval, global summary retrieval, or multi-hop reasoning retrieval to obtain structured retrieval results. The intelligent question-answering service module is used to input the obtained structured search results as context into the large language model, generate an interpretable answer with citation annotations, and output it through an OpenAI-compatible API interface.

[0013] Compared with the prior art, the present invention has the following advantages: 1. The GraphRAG-based knowledge graph construction and question answering method for ship cybersecurity regulations provided by this invention organizes ship cybersecurity regulations knowledge in the form of a knowledge graph, captures the hierarchical structure, logical dependencies and cross-document reference relationships between regulations clauses, and achieves a significant improvement in knowledge representation capabilities. Compared with flat document storage methods, the degree of knowledge structuring and relevance is greatly improved, laying the foundation for complex semantic queries.

[0014] 2. The knowledge graph construction and question-answering method for ship cybersecurity specifications based on GraphRAG provided by this invention enhances the ability to process complex queries through three modes: local subgraph retrieval, global summary retrieval, and fusion retrieval. For queries that require comprehensive analysis of multiple specifications such as IACS UR E26 and E27, the completeness and accuracy of the answers are significantly improved.

[0015] 3. The GraphRAG-based knowledge graph construction and question-answering method for ship cybersecurity specifications provided by this invention improves the efficiency of automated knowledge graph construction through domain-customized prompt word templates and few-shot examples. Compared with manual construction methods, it significantly shortens the knowledge graph construction cycle, reduces labor costs, and ensures the timeliness of the knowledge base through an incremental update mechanism.

[0016] 4. The knowledge graph construction and question-answering method for ship cybersecurity regulations based on GraphRAG provided by this invention includes an answer generation mechanism with reference annotation. By pointing to the graph elements supporting the answer and the original source of the regulation in the answer, the credibility and traceability of the answer are enhanced. Users can directly verify the original regulatory basis, which solves the problem of unreliable answers caused by the illusion generation of large language models and meets the needs of application scenarios with high requirements for answer reliability, such as compliance review.

[0017] 5. The GraphRAG-based knowledge graph construction and question-answering method for ship cybersecurity specifications provided by this invention, through the integration of Neo4j graph database, 3D interactive visualization and OpenAI compatible API interface, achieves the technical effect of wide applicability, scalability and strong engineering deployment capability. It is not only applicable to the specifications of China Classification Society, but also can be extended to ship cybersecurity specifications issued by other organizations such as IMO and DNV.

[0018] In summary, by applying the technical solution of this invention, the shortcomings of existing technologies, such as the inability of traditional text retrieval systems to understand semantic and logical relationships, the lack of multi-hop reasoning and relational understanding capabilities in vector-based RAG methods, the susceptibility of general-purpose large language models to factual errors in specialized fields and the inability to provide authoritative source tracing, and the low degree of automation in general knowledge graph construction and its lack of deep integration with GraphRAG, are addressed through the innovative aspects of domain-customized GraphRAG knowledge graph construction, multi-modal fusion retrieval, and interpretable answer generation proposed in this invention. Therefore, the technical solution of this invention solves the problems of inefficient processing of multi-source heterogeneous knowledge, the existence of illusions and uninterpretability in specialized fields by general-purpose large models, the insufficient retrieval and reasoning capabilities of traditional RAG, the low degree of automation and high maintenance costs of knowledge graph construction, and the lack of integrated intelligent tools for multiple roles throughout the entire lifecycle of a ship.

[0019] Based on the above reasons, this invention can be widely applied in fields such as ship cybersecurity compliance review, intelligent Q&A service, emergency response guidance, PSC inspection checklist generation, crew training and drills, shipyard design review, and classification society inspection and certification. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a technical roadmap for the method of the present invention.

[0022] Figure 2 This is a flowchart of the GraphRAG retrieval process of the present invention.

[0023] Figure 3 This is a schematic diagram of the overall system architecture of the present invention.

[0024] Figure 4 This is a partial example diagram of the knowledge graph of the present invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification, claims and accompanying drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product or device.

[0027] This invention provides a method for constructing and question-answering a knowledge graph of ship cybersecurity specifications based on GraphRAG, including: S1. Perform text cleaning, format standardization, and semantic segmentation on the input ship network security specification document to obtain standardized text units; S2. Based on the obtained normalized text units, a domain-customized prompt word template is used to call the large language model to jointly extract entity relations, resulting in knowledge graph data containing entity nodes, relation edges, and attributes. S3. Store the constructed knowledge graph in a graph database, build a vector similarity index and an inverted index, and use a community detection algorithm to divide the knowledge graph into communities, generate community-level summary descriptions, and form a global knowledge summary index. S4. Receive user queries, determine the results based on the query type, call the global knowledge summary index, and execute at least one of the following search modes: local subgraph search, global summary search, or multi-hop reasoning search, to obtain structured search results. S5. The obtained structured search results are used as context input to the large language model to generate an interpretable answer with citation annotations, and output through an OpenAI-compatible API interface.

[0028] In this embodiment, as Figure 1 As shown, this technical approach unfolds from top to bottom in the following order: "multi-source heterogeneous data acquisition, text preprocessing, automated knowledge graph construction, GraphRAG graph community detection and summary generation, hybrid retrieval enhanced generation and reasoning, multi-role application and closed-loop update".

[0029] First, authoritative data such as IACS UR E26 / E27, IEC 62443, IMO guidelines, classification society regulations, and ship operation data are collected. Then, through deduplication and cleaning, structured transformation, semantic segmentation, and overlapping window settings, standardized input is provided for graph construction. In the knowledge construction phase, the system extracts entities, relationships, and attributes based on domain-specific instruction templates, performs entity alignment, knowledge fusion, and domain ontology construction, and finally writes the data into the Neo4j graph database. In the GraphRAG phase, the Leiden algorithm is used to perform graph clustering and community discovery, generating community-level summaries and establishing vector indexes. In the retrieval and reasoning phase, graph path retrieval and vector semantic retrieval are combined to perform dual-path evidence aggregation and conflict resolution, outputting interpretable answers with regulatory sources, clause numbers, and reasoning paths. This technical approach ultimately provides compliance Q&A, design review, emergency response, PSC inspection checklist generation, and training exercise support for shipyards, shipowners, crew members, and classification societies. It also triggers incremental graph updates through regulatory change monitoring, achieving continuous iteration and dynamic maintenance of the knowledge base.

[0030] In a specific implementation, as a preferred embodiment of the present invention, step S1 includes: S11. Collect multi-source heterogeneous document data in the field of ship cybersecurity, including international regulations, classification society rules, operation manuals, case libraries and emergency response guidelines; S12. Perform deduplication, noise removal, and format standardization on the collected multi-source heterogeneous document data to unify the encoding format and paragraph structure of documents from different sources. S13. The cleaned text is divided into blocks using a sliding window strategy. The window size and overlap length are set to ensure the semantic continuity of clauses at the boundaries and form standardized text units. S14. Perform structured transformation on the standardized text units after segmentation, and extract document metadata information, including standard name, version number, chapter number and clause level, to provide standardized input with source identifier for subsequent entity relationship extraction.

[0031] In a specific implementation, as a preferred embodiment of the present invention, step S2 includes: S21. Predefine the entity type system and relationship type system in the field of ship cybersecurity, wherein the entity types include system entities, requirement entities, standard entities, functional entities, risk entities and control measure entities, and the relationship types include reference relationships, dependency relationships, implementation relationships, inclusion relationships and association relationships; S22. Configure a prompt word template specifically for the field of ship cybersecurity. The prompt word template includes: The expert role is defined as a security architecture analyst in the fields of industrial cybersecurity and marine system security. Introduce a few-shot example that conforms to IEC 62443 and is associated with the safety functions of the shipboard computer system; the constraint output language is Chinese. The entity type is limited to a predefined entity type system, and the relation type is limited to a predefined relation type system; S23. Call the large language model and, based on the configured prompt word template, perform joint entity-relation extraction on each normalized text unit to produce entity data and relation data. The entity data includes entity name, entity type and entity description, and the relation data is represented in the form of a quadruple, including source entity, target entity, relation description and strength score. S24. When the same entity is repeatedly extracted in multiple normalized text units, the large language model is called to merge the multiple descriptions to generate a unified entity description, while retaining the source of the entity in each normalized text. S25. Store the merged entity data and relation data in a structured format to form a complete knowledge graph data, and record the original specification source and clause number corresponding to each entity and relation.

[0032] In a specific implementation, as a preferred embodiment of the present invention, step S3 includes: S31. Import the constructed knowledge graph data into the graph database. Each entity node stores the entity type, entity name, entity description, entity attributes, original text fragment, name of the specification document, version number and clause number attributes. Each relation edge stores the relation type, relation description, strength score, confidence score and extraction source attributes. S32. The text description of each entity node is vectorized and encoded, and a semantic vector is generated through an embedding model. A vector similarity index is established to support entity retrieval based on semantic similarity and supplementary retrieval of related text fragments. S33. Build an inverted index for clause number, keywords, entity name and specification document name, and support retrieval queries based on exact matching and Boolean combination; S34. The Leiden algorithm is used to divide the knowledge graph into hierarchical communities. Community level parameters are set to generate multiple communities distributed across multiple levels. Each community contains a set of closely related entity nodes and their connection relationships. The higher the community level, the coarser the community granularity. S35. For each community, call the large language model to generate a structured community report. The structured community report includes the community number, community level, community title, community summary, importance score and importance description fields. The importance score indicates the degree of criticality of the community in the ship network security knowledge system, and the importance description field explains the basis for the association between the community and the industrial network security standards. S36. Vectorize and index the community summary content of all generated structured community reports to form a global knowledge summary index, supporting global information query based on community semantics and cross-community knowledge association retrieval.

[0033] In a specific implementation, as a preferred embodiment of the present invention, step S4 includes: S41. Receive natural language queries input by users, perform intent recognition, key entity extraction and query type determination on the query through a large language model, and output structured query parsing results. The query types include local fact queries, global comprehensive queries and multi-hop reasoning queries. S42. Based on the output query type, determine the result and distribute the query to the corresponding retrieval path. The retrieval path includes the local subgraph retrieval path, the global summary retrieval path, and the multi-hop inference retrieval path. S43. When the query type is a local fact query, the query text is encoded using an embedding model and matched with the established vector similarity index to locate the most relevant query semantics. One entity node; using the located entity node as a seed, in the knowledge graph... Skip graph traversal to extract local subgraphs containing directly related entity nodes, relation edges, and text attributes of adjacent nodes; simultaneously, utilize vector similarity indexing to... The relevant text fragments are supplemented to assemble the local subgraph structure information, relation table and text fragments into structured search results; S44. When the query type is a global comprehensive query, the map-reduce strategy is adopted. In the map phase, the query is combined with all community reports generated at the specified level, and the large language model is called to generate a list of key points for each community. In the reduce phase, the list of key points of each community is merged, and the large language model generates a comprehensive answer to form a global summary context as a structured search result. S45. When the query type is a multi-hop reasoning query, an iterative graph traversal strategy is adopted to gradually expand the retrieval scope along the relational path in the knowledge graph. In each iteration, the traversal is carried outward along the relational edge of the current node. Information of each node on the reasoning chain and corresponding normative original text fragments are collected to form a structured retrieval result containing a complete reasoning path and evidence chain.

[0034] In a specific implementation, as a preferred embodiment of the present invention, step S4 further includes a fusion retrieval mode: sequentially calling local subgraph retrieval and global summary retrieval, merging the local answer produced by local subgraph retrieval with the global answer produced by global summary retrieval, and generating a comprehensive answer that has both precise details and a global perspective.

[0035] In this embodiment, as Figure 2 As shown, this process implements query intent recognition, local subgraph traversal retrieval, global community summary retrieval, and multi-hop reasoning path extraction, ultimately aggregating structured subgraphs and text fragments to form enhanced search results. User-inputted natural language queries first enter the query analysis node, which uses a large language model to perform intent recognition, key entity extraction, and query type determination, outputting structured query parsing results.

[0036] After the query analysis is completed, the system determines the node's judgment result based on the query type and distributes the query to three parallel retrieval paths: The first path is a local fact query path. For local fact queries, the system executes... Jump graph retrieval locates nodes related to the query entity within the knowledge graph, starting from the query entity. The graph is traversed to extract local subgraphs containing directly related entity nodes and relational edges. At the same time, vector similarity is used to supplement relevant text fragments, forming a retrieval result that combines local subgraphs and vector fragments.

[0037] The second path is the global comprehensive query path. For global queries that require integrating information from multiple chapters and specifications, the system calls the community summary index generated based on the Leiden community partitioning algorithm, retrieves multiple community summaries most relevant to the query semantics through vector retrieval, and forms a global summary context after aggregating the content from multiple communities.

[0038] The third path is the multi-hop reasoning query path. For multi-hop reasoning queries, the system adopts an iterative graph traversal strategy, gradually expanding the search scope along the relational paths in the knowledge graph, collecting information of each node in the reasoning chain and corresponding original text fragments, forming a context containing the complete reasoning path.

[0039] In a specific implementation, as a preferred embodiment of the present invention, step S5 includes: S51. Assemble the obtained structured search results into an enhanced context. The enhanced context includes an entity table, a relation table, original text fragments, and relevant community reports. The entity table lists the entity name, entity type, and entity description in the search results, and the relation table lists the source entity, target entity, relation type, and relation description. S52. Input the assembled enhanced context into the large language model, and the large language model will perform reasoning based on the enhanced context to generate a natural language answer. The natural language answer covers the specific terms and conditions involved in the query, related security functions, and compliance operation suggestions. S53. Include citation annotations in the generated natural language answers. The citation annotations adopt a structured format and point to the graph elements supporting the answers and the original source of the specifications, including the specification document name, version number, clause number, chapter number and reasoning path information, so that users can directly verify the original specification basis. S54. Output the final answer in a structured response body through an OpenAI-compatible API interface, supporting streaming segmented return or non-streaming complete return. The structured response body includes the answer text, a list of citation annotations, and a search mode identifier.

[0040] like Figure 3 As shown, this embodiment of the invention provides a GraphRAG-based system for constructing and answering ship cybersecurity specification knowledge graphs based on the aforementioned GraphRAG-based method for constructing and answering ship cybersecurity specification knowledge graphs. The system includes: a document preprocessing module, a knowledge graph construction module, a graph storage and indexing module, a multi-modal retrieval module, and an intelligent question-answering service module, wherein: The document preprocessing module is used to perform text cleaning, format standardization, and semantic segmentation on the input ship network security specification document to obtain standardized text units; The knowledge graph construction module is used to extract entity relations jointly by calling a large language model based on the obtained normalized text units and using domain-customized prompt word templates to obtain knowledge graph data containing entity nodes, relation edges and attributes. The graph storage and indexing module is used to store the constructed knowledge graph in a graph database, construct a vector similarity index and an inverted index, and use a community detection algorithm to divide the knowledge graph into communities, generate community-level summary descriptions, and form a global knowledge summary index. The multi-mode retrieval module is used to receive user queries, determine the results based on the query type, call the global knowledge summary index, and execute at least one retrieval mode among local subgraph retrieval, global summary retrieval, or multi-hop reasoning retrieval to obtain structured retrieval results. The intelligent question-answering service module is used to input the obtained structured search results as context into the large language model, generate an interpretable answer with citation annotations, and output it through an OpenAI-compatible API interface.

[0041] The embodiments of the present invention are described simply because they correspond to those in the embodiments above. For any similarities, please refer to the descriptions in the embodiments above, which will not be elaborated here.

[0042] In this embodiment, as Figure 4 As shown, the partial structure of the knowledge graph and corresponding community metadata generated by the system of the present invention after performing knowledge extraction and community division on the IACS UR E27 specification document are illustrated, with the audit log entity node as the center.

[0043] I. Local Subgraph Structure of Knowledge Graph like Figure 4 As shown, with the audit log as the core entity node, through... The relationship edges radiate outwards to connect the following nine related entity nodes: mobile device control, malicious code protection, code verification, timestamp, session locking, audit storage capacity, audit accessibility, audit failure response, and system resilience. Each relationship edge is labeled as follows: The type indicates that all of the above security function entities have a discovery association with the audit log, meaning that the audit log plays a core role in tracking and recording within the system's security functions. The specific association semantics are as follows: The correlation between audit logs and mobile device control is reflected in tracking device usage behavior; the correlation with malicious code protection is reflected in recording malicious code protection activities; the correlation with code verification is reflected in recording code verification operations; the correlation with timestamps is reflected in including precise time records; the correlation with session locking is reflected in recording illegal activity locking events; the correlation with audit storage capacity is reflected in managing capacity to prevent overwriting; the correlation with audit accessibility is reflected in ensuring that only authorized access is granted; the correlation with audit failure response is reflected in triggering incident response upon failure; and the correlation with system resilience is reflected in recording system resilience-related events.

[0044] II. Community Metadata Metadata of the community to which the above local subgraph belongs, such as Figure 4As shown, the specific fields are as follows: Community ID (community) is 11, Node Unique Identifier (id) is 97043263-9bda-4ed6-91aa-37fe8d7101a1, Community Level (level) is 1, Community Importance Score (rank) is 9.5, Importance Description (rank_explanation) indicates that this text is highly relevant to industrial network security and system security, especially based on the integration requirements of audit logs and security functions in the IEC 62443 standard, Community Title (title) describes the relationship between security functions and audit logs, and Community Summary (summary) shows that this community focuses on security functions, with particular emphasis on audit logs and their relationship with other security functions. Audit logs, as a core entity, are closely related to multiple security functions such as mobile device control, session locking, and code verification. They are used to track and record critical security events to ensure system security and compliance.

[0045] Example 1: Automatic Construction of Ship Cybersecurity Knowledge Graph Based on IACS UR E27 Standard Step 1: Document chunking preprocessing The system divides the input document into blocks according to GraphRAG's sliding window strategy, with a window size of 1200 tokens and an overlap length of 100 tokens to ensure semantic continuity of terms at boundaries. The E27 document, after being divided into blocks, forms 8 text units. This serves as the basic unit for subsequent entity relationship extraction.

[0046] Step 2: Domain-Customized Entity and Relation Extraction The system calls the qwen-plus large language model to perform joint entity relation extraction. The extraction process uses a prompt word template customized for the marine cybersecurity domain, which has the following improvements compared to the default GraphRAG template: The expert role is defined as a security architecture analyst in the fields of industrial cybersecurity and marine system security. The few-shot example has been replaced with a real-world case related to the safety functions of shipboard systems under IEC 62443 clauses; The output language constraint is Chinese to ensure consistency between entity names and descriptions. Each chunk, after being extracted by LLM, produces two types of structured data: Entity: Each entity contains a name (entity name), a type (a type label inferred by the LLM from the context, such as SYSTEM, REQUIREMENT, STANDARD, etc.), and a description (natural language description). Relationships: Each relationship is represented as a quadruple (source entity, target entity, relationship description, strength score), where the relationship description is in free text form, and the strength score ranges from 1 to 10, indicating the degree of association between the two entities. For example, after extracting the text of the clauses related to audit logs in Section 4.1 of E27, the system generates a set of entities centered on audit logs and establishes associations between them and entities such as mobile device control, malicious code protection, code verification, timestamps, session locking, audit storage capacity, audit accessibility, audit failure response, and system resilience. Each relationship is accompanied by a natural language description (such as audit log recording session locking events) and a strength score.

[0047] For cases where the same entity is repeatedly extracted in multiple chunks, the system uses... The prompt words invoked LLM to summarize and merge multiple descriptions, ensuring consistency in entity descriptions. After full processing, a total of 213 entities and 242 relationships were extracted from the E27 document.

[0048] Step 3: Community Testing and Community Report Generation For the constructed entity relationship graph, the system uses the Leiden algorithm to perform hierarchical community partitioning, resulting in 46 communities distributed across two levels. Subsequently, for each community, LLM is called to generate a structured community report, with each report containing fields such as title, summary, importance score (rank), and importance description.

[0049] For example, several entities clustered around the audit log are grouped into the same community, which has an importance score of 9.5 and is titled "Relationship between Security Functions and Audit Logs." The summary points out the relationship between the audit log as a core entity and multiple security functions, which are used to track and record critical security events to ensure system compliance.

[0050] Step 4: Persistence and Visualization of the Graph The system extracts entity, relation, and community reports and stores them in Parquet format on the inputs / artifacts / directory. Simultaneously, the graph data is imported into the Neo4j graph database using the utils / neo4jTest.py script, establishing a graph storage structure of nodes and relation edges for easy subsequent graph queries. Furthermore, the utils / graphrag3dknowledge.py module, based on NetworkX and Plotly, builds a 3D interactive visualization interface that uses different colors to distinguish entity types and node size to represent degree centrality, supporting intuitive exploration of the graph structure.

[0051] Example 2: Standardized Question-Answer Query Processing Based on Multi-Modal Retrieval This example demonstrates the system's processing flow for the same user query across three search modes. The system provides services externally through an OpenAI-compatible interface, routing to different search modes via the `model` field in the request.

[0052] A user asked: "What are the requirements for audit logs and audit records in E27? What types of events need to be logged?" Mode A: Local search (model=graphrag-local-search:latest) The system first encodes the query text using an embedding model and performs similarity matching with the entity vector index stored in LanceDB to locate the most semantically relevant entity. Individual entities (e.g., audit logs, audit records, computer systems, etc.). Then, using these entities as seeds, their one-hop neighbor entities and connections are retrieved from the knowledge graph, and from... The system retrieves the original text fragments associated with these entities, assembles them into a structured context (including entity tables, relation tables, original text fragments, and related community reports), and sends it to the LLM to generate the answer.

[0053] This pattern generates answers centered around the core entity of the audit log, listing directly related event types (access control, operating system events, backup and recovery events, configuration changes, communication interruptions, etc.) and including GraphRAG standard reference format [Data: Entities(x), Relationships(y), Sources(z)], pointing to the graph elements supporting the answer. This pattern is suitable for query scenarios requiring precise facts.

[0054] Mode B: Global Search (model=graphrag-global-search:latest) The system employs a map-reduce strategy: the map phase divides the query into three parts and one part at a specified level (…). The process combines all community reports and calls upon the LLM to generate a list of key points for each community; the reduce phase merges the key points from each community, and the LLM generates a comprehensive answer.

[0055] This approach does not focus on a specific entity, but rather synthesizes key points from multiple relevant communities (such as the community on the relationship between security features and audit logs, and the community on system monitoring and auditing) from a holistic perspective, providing a complete picture of audit-related requirements throughout E27. This approach is suitable for global queries that require integrating information from multiple chapters.

[0056] Mode C: Fusion Search (model=full-model:latest) This mode sequentially calls the retrieval processes of Mode A and Mode B, merging the answers produced by both into the final response. First, a local retrieval is triggered with the same query, yielding a local answer L; then a global retrieval is triggered, yielding a global answer G; finally, L and G are concatenated in a structured format in the response body and returned segment by segment through a streaming interface.

[0057] For the aforementioned query, the fusion search output includes both the details of the audit event types provided by Mode A (a specific list of access control events, configuration change events, etc.) and the positioning of the audit requirements in the overall E27 security system provided by Mode B (their relationship with other security domains such as identity authentication, system integrity, and malicious code protection). The accuracy and breadth of the answer are guaranteed at the same time.

[0058] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing and question-answering a knowledge graph of ship cybersecurity specifications based on GraphRAG, characterized in that, include: S1. Perform text cleaning, format standardization, and semantic segmentation on the input ship network security specification document to obtain standardized text units; S2. Based on the obtained normalized text units, a domain-customized prompt word template is used to call the large language model to jointly extract entity relations, resulting in knowledge graph data containing entity nodes, relation edges, and attributes. S3. Store the constructed knowledge graph in a graph database, build a vector similarity index and an inverted index, and use a community detection algorithm to divide the knowledge graph into communities, generate community-level summary descriptions, and form a global knowledge summary index. S4. Receive user queries, determine the results based on the query type, call the global knowledge summary index, and execute at least one of the following search modes: local subgraph search, global summary search, or multi-hop reasoning search, to obtain structured search results. S5. The obtained structured search results are used as context input to the large language model to generate an interpretable answer with citation annotations, and output through an OpenAI-compatible API interface.

2. The method for constructing and answering a knowledge graph of ship cybersecurity specifications based on GraphRAG according to claim 1, characterized in that, Step S1 includes: S11. Collect multi-source heterogeneous document data in the field of ship cybersecurity, including international regulations, classification society rules, operation manuals, case libraries and emergency response guidelines; S12. Perform deduplication, noise removal, and format standardization on the collected multi-source heterogeneous document data to unify the encoding format and paragraph structure of documents from different sources. S13. The cleaned text is divided into blocks using a sliding window strategy. The window size and overlap length are set to ensure the semantic continuity of clauses at the boundaries and form standardized text units. S14. Perform structured transformation on the standardized text units after segmentation, and extract document metadata information, including standard name, version number, chapter number and clause level, to provide standardized input with source identifier for subsequent entity relationship extraction.

3. The method for constructing and answering questions based on a GraphRAG-based knowledge graph of ship cybersecurity standards according to claim 1, characterized in that, Step S2 includes: S21. Predefine the entity type system and relationship type system in the field of ship cybersecurity, wherein the entity types include system entities, requirement entities, standard entities, functional entities, risk entities and control measure entities, and the relationship types include reference relationships, dependency relationships, implementation relationships, inclusion relationships and association relationships; S22. Configure a prompt word template specifically for the field of ship cybersecurity. The prompt word template includes: The expert role is defined as a security architecture analyst in the fields of industrial cybersecurity and marine system security. Introduce a few-shot example that conforms to IEC 62443 and is associated with the safety functions of the shipboard computer system; the constraint output language is Chinese. The entity type is limited to a predefined entity type system, and the relation type is limited to a predefined relation type system; S23. Call the large language model and, based on the configured prompt word template, perform joint entity-relation extraction on each normalized text unit to produce entity data and relation data. The entity data includes entity name, entity type and entity description, and the relation data is represented in the form of a quadruple, including source entity, target entity, relation description and strength score. S24. When the same entity is repeatedly extracted in multiple normalized text units, the large language model is called to merge the multiple descriptions to generate a unified entity description, while retaining the source of the entity in each normalized text. S25. Store the merged entity data and relation data in a structured format to form a complete knowledge graph data, and record the original specification source and clause number corresponding to each entity and relation.

4. The method for constructing and answering questions based on a GraphRAG-based knowledge graph of ship cybersecurity standards according to claim 1, characterized in that, Step S3 includes: S31. Import the constructed knowledge graph data into the graph database. Each entity node stores the entity type, entity name, entity description, entity attributes, original text fragment, name of the specification document, version number and clause number attributes. Each relation edge stores the relation type, relation description, strength score, confidence score and extraction source attributes. S32. The text description of each entity node is vectorized and encoded, and a semantic vector is generated through an embedding model. A vector similarity index is established to support entity retrieval based on semantic similarity and supplementary retrieval of related text fragments. S33. Build an inverted index for clause number, keywords, entity name and specification document name, and support retrieval queries based on exact matching and Boolean combination; S34. The Leiden algorithm is used to divide the knowledge graph into hierarchical communities. Community level parameters are set to generate multiple communities distributed across multiple levels. Each community contains a set of closely related entity nodes and their connection relationships. The higher the community level, the coarser the community granularity. S35. For each community, call the large language model to generate a structured community report. The structured community report includes the community number, community level, community title, community summary, importance score and importance description fields. The importance score indicates the degree of criticality of the community in the ship network security knowledge system, and the importance description field explains the basis for the association between the community and the industrial network security standards. S36. Vectorize and index the community summary content of all generated structured community reports to form a global knowledge summary index, supporting global information query based on community semantics and cross-community knowledge association retrieval.

5. The method for constructing and answering questions based on a GraphRAG-based knowledge graph of ship cybersecurity standards according to claim 1, characterized in that, Step S4 includes: S41. Receive natural language queries input by users, perform intent recognition, key entity extraction and query type determination on the query through a large language model, and output structured query parsing results. The query types include local fact queries, global comprehensive queries and multi-hop reasoning queries. S42. Based on the output query type, determine the result and distribute the query to the corresponding retrieval path. The retrieval path includes the local subgraph retrieval path, the global summary retrieval path, and the multi-hop inference retrieval path. S43. When the query type is a local fact query, the query text is encoded using an embedding model and matched with the established vector similarity index to locate the most relevant query semantics. One entity node; using the located entity node as a seed, in the knowledge graph... Skip graph traversal to extract local subgraphs containing directly related entity nodes, relational edges, and text attributes of adjacent nodes; simultaneously utilize vector similarity indexing from... The relevant text fragments are supplemented to assemble the local subgraph structure information, relation table, and text fragments into structured search results; S44. When the query type is a global comprehensive query, the map-reduce strategy is adopted. In the map phase, the query is combined with all community reports generated at the specified level, and the large language model is called to generate a list of key points for each community. In the reduce phase, the list of key points of each community is merged, and the large language model generates a comprehensive answer to form a global summary context as a structured search result. S45. When the query type is a multi-hop reasoning query, an iterative graph traversal strategy is adopted to gradually expand the retrieval scope along the relational path in the knowledge graph. In each iteration, the traversal is carried outward along the relational edge of the current node. Information of each node on the reasoning chain and corresponding normative original text fragments are collected to form a structured retrieval result containing a complete reasoning path and evidence chain.

6. The method for constructing and answering a knowledge graph of ship cybersecurity specifications based on GraphRAG according to claim 5, characterized in that, Step S4 also includes a fusion retrieval mode: sequentially calling local subgraph retrieval and global summary retrieval, merging the local answer produced by local subgraph retrieval with the global answer produced by global summary retrieval, and generating a comprehensive answer that has both precise details and a global perspective.

7. The method for constructing and answering a knowledge graph of ship cybersecurity specifications based on GraphRAG according to claim 1, characterized in that, Step S5 includes: S51. Assemble the obtained structured search results into an enhanced context. The enhanced context includes an entity table, a relation table, original text fragments, and relevant community reports. The entity table lists the entity name, entity type, and entity description in the search results, and the relation table lists the source entity, target entity, relation type, and relation description. S52. Input the assembled enhanced context into the large language model, and the large language model will perform reasoning based on the enhanced context to generate a natural language answer. The natural language answer covers the specific terms and conditions involved in the query, related security functions, and compliance operation suggestions. S53. Include citation annotations in the generated natural language answers. The citation annotations adopt a structured format and point to the graph elements supporting the answers and the original source of the specifications, including the specification document name, version number, clause number, chapter number and reasoning path information, so that users can directly verify the original specification basis. S54. Output the final answer in a structured response body through an OpenAI-compatible API interface, supporting streaming segmented return or non-streaming complete return. The structured response body includes the answer text, a list of citation annotations, and a search mode identifier.

8. A system for constructing and answering a knowledge graph of ship cybersecurity regulations based on GraphRAG, implemented using the GraphRAG-based knowledge graph construction and question-answering method for ship cybersecurity regulations as described in any one of claims 1-7, characterized in that, include: The module comprises a document preprocessing module, a knowledge graph construction module, a knowledge graph storage and indexing module, a multi-modal retrieval module, and an intelligent question answering service module, among which: The document preprocessing module is used to perform text cleaning, format standardization, and semantic segmentation on the input ship network security specification document to obtain standardized text units; The knowledge graph construction module is used to extract entity relations jointly by calling a large language model based on the obtained normalized text units and using domain-customized prompt word templates to obtain knowledge graph data containing entity nodes, relation edges and attributes. The graph storage and indexing module is used to store the constructed knowledge graph in a graph database, construct a vector similarity index and an inverted index, and use a community detection algorithm to divide the knowledge graph into communities, generate community-level summary descriptions, and form a global knowledge summary index. The multi-mode retrieval module is used to receive user queries, determine the results based on the query type, call the global knowledge summary index, and execute at least one retrieval mode among local subgraph retrieval, global summary retrieval, or multi-hop reasoning retrieval to obtain structured retrieval results. The intelligent question-answering service module is used to input the obtained structured search results as context into the large language model, generate an interpretable answer with citation annotations, and output it through an OpenAI-compatible API interface.

Images