Data security risk detection method, system and device based on knowledge graph and large language model, and medium

Abstract

The application discloses a data security risk detection method and system based on a knowledge graph and a large language model, equipment and a medium, mainly relates to the technical field of security risk detection, in order to solve the problem that the existing static detection method depends on known attack characteristics and is difficult to identify constantly evolving attacks, the risk prevention and control idea based on historical cases lacks deep mining of the correlation between multiple objects in complex business scenarios. It includes: generating a data security judgment description corresponding detection process, obtaining a risk model DSL file corresponding to the detection process; wherein, when the calling parameter of the graph operation operator is a business object associated with the business object, the corresponding business object knowledge graph is called to obtain the associated business object; the risk model DSL file is executed through the risk model execution engine, based on the order of the calculation nodes in the DSL file, the graph operation operators corresponding to the calculation nodes are executed in turn, and finally the preset suspected risk object and the associated evidence chain data are obtained.

Description

Technical Field

[0001] This application relates to the field of security risk detection technology, and in particular to a data security risk detection method, system, device and medium based on knowledge graph and large language model. Background Technology

[0002] In the current field of data security protection, static detection methods remain one of the mainstream technical approaches. These methods primarily rely on known attack signature databases, comparing network traffic, system operations, and other data with entries in the database to identify potential security risks. Meanwhile, with the increasing frequency of data security incidents, the industry has gradually formed a risk prevention and control approach based on reviewing historical cases: conducting in-depth analysis and tracing of past data security risk incidents, extracting risk behavior patterns, building corresponding model libraries, and then using these as a basis to discover and identify potential risk targets. This has become a core business direction for data security governance.

[0003] However, existing technologies have significant limitations. Static detection methods rely on known attack characteristics, and when faced with constantly evolving internal threats and covert attacks, they often fail to identify them due to outdated feature databases, leading to the missed detection of numerous new risks. Risk prevention strategies based on historical cases are often summaries of experience from single cases, lacking in-depth analysis of the relationships between multiple objects in complex business scenarios. They are ill-equipped to handle complex risk behaviors that are interconnected across multiple business processes and stages, resulting in insufficient accuracy and comprehensiveness in risk prediction. Summary of the Invention

[0004] This application provides a data security risk detection method, system, device, and medium based on knowledge graphs and large language models to solve the problems of existing static detection methods that rely on known attack characteristics, making it difficult to identify constantly evolving attacks, risk prevention and control ideas based on historical cases, and lacking in-depth mining of multi-object relationships in complex business scenarios.

[0005] Firstly, this application provides a data security risk detection method based on knowledge graphs and large language models, the method comprising: Based on the relationships between business objects in the data warehouse, a business object knowledge graph is constructed; based on the relationships between technical metadata in the data warehouse, a metadata knowledge graph is constructed; wherein, business objects contain technical metadata; Obtain the data security judgment description input by the user, and use LLM to extract preset key model features, risk judgment rules, and rule order from the data security judgment description; Based on the graph operation operators corresponding to the risk assessment rules, the technical metadata corresponding to the preset key model features, and the rule order, the detection process corresponding to the data security assessment description is generated using the metadata knowledge graph and the preset graph operator library, and the risk model DSL file corresponding to the detection process is obtained; among them, when the calling parameter of the graph operation operator is the business object associated with the business object, the corresponding business object knowledge graph is called to obtain the associated business object. The risk model DSL file is executed by the risk model execution engine. Based on the order of the computation nodes in the risk model DSL file, the graph operation operators corresponding to the computation nodes are executed sequentially to finally obtain the preset suspected risk objects and the associated evidence chain data.

[0006] In one implementation of this application, after finally obtaining the preset suspected risk object and associated evidence chain data, the method further includes: The large language model is invoked, and the output data of the preset suspected risk objects and associated evidence chains are semantically compared with the risk judgment rules to obtain the verification and detection results. The verification result will be directly pushed to the early warning module; For results that fail validation, obtain the matching discrepancies and error reasons from the large language model, generate error details containing the matching discrepancies and error reasons, and feed them back to the risk model execution engine to trigger the automatic correction and reorganization process of the model logic.

[0007] In one implementation of this application, after directly pushing the verification result to the early warning module, the method further includes: For the results of successful verification, the front-end interface will issue a warning for the pre-set suspected risk objects and related evidence chain data, and simultaneously render the topology diagram of the risk model execution engine.

[0008] In one implementation of this application, a business object knowledge graph is constructed based on the relationships between business objects in the data warehouse; a metadata knowledge graph is constructed based on the relationships between technical metadata in the data warehouse, specifically including: Extract entity nodes corresponding to business objects from the data warehouse; wherein, the entity nodes corresponding to business objects include at least: personnel, equipment terminals, storage media, carriers, network nodes, organizational structures, file entities, behavioral operations, system logs, security events, and network traffic; extract the relationships between business objects from the data warehouse, and treat the relationships as edges between entity nodes; wherein, the edges corresponding to business objects are at least divided into: subordinate relationships, ownership relationships, and related reference relationships. Construct a business object knowledge graph based on the entity nodes and edges corresponding to the business objects; Extract the technical metadata corresponding to each business object from the data warehouse and abstract it into entity nodes corresponding to the technical metadata; the entity nodes corresponding to the technical metadata include at least: data table nodes, field nodes, business term nodes, data domain nodes, indicator nodes, and dictionary nodes; Extract the relationships between technical metadata from the data warehouse and treat these relationships as edges between entity nodes; the edges corresponding to technical metadata are at least divided into: structural relationships, lineage relationships, and semantic relationships; A metadata knowledge graph is constructed based on the entity nodes and edges corresponding to the technical metadata.

[0009] In one implementation of this application, a data security judgment description input by the user is obtained, and a preset key model feature, risk judgment rule, and rule order are extracted from the data security judgment description using an LLM (Local Level Modeling) method. Specifically, this includes: LLM performs semantic parsing on the data security judgment description and extracts technical metadata from the data security judgment description as preset key model features; Based on preset key model features, LLM matches a preset risk assessment rule template library and identifies risk assessment rules with a matching degree greater than a preset threshold by calculating the semantic similarity and matching degree with the risk assessment rules. Among them, the risk assessment rules and graph operation operators have a preset binding relationship. Obtain the preset logical dependencies and preset execution constraints between risk assessment rules, and generate the rule order.

[0010] In one implementation of this application, based on the graph operation operators corresponding to the risk assessment rules, the technical metadata corresponding to the preset key model features, and the rule order, a detection process corresponding to the data security assessment description is generated using the metadata knowledge graph and the preset graph operator library, and a risk model DSL file corresponding to the detection process is obtained, specifically including: Based on the binding relationship between the preset risk judgment rules and the graph operation operators, the extracted preset key model features are mapped to the corresponding entity nodes in the metadata knowledge graph; combined with the execution constraints defined in the rule sequence, the graph operation operator sequence is dynamically assembled to form a preliminary directed acyclic graph structure as the detection process; using the logical skeleton of the detection process, a structured operator chain is obtained; wherein, the operator chain carries metadata entity identifiers and parameter context. Based on the operator chain, the standardized interface in the preset graph operator library is called to convert each operator into a serializable instruction unit and embed the rule sequence; All instruction units are encoded into a process description in structured JSON format to form a risk model DSL file.

[0011] In one implementation of this application, a risk model DSL file is executed through a risk model execution engine. Based on the order of the computation nodes in the risk model DSL file, the graph operation operators corresponding to the computation nodes are executed sequentially to ultimately obtain preset suspected risk objects and associated evidence chain data, specifically including: The risk model execution engine loads the risk model DSL file, parses the operator chain in the structure, and calls the corresponding preset graph operation operators one by one according to the order of the calculation nodes and the parameter context in the operator chain. The risk model execution engine obtains the entity nodes bound to the preset key model features involved in each operator, and uses the business object knowledge graph to form a preliminary metadata association path; when the operator parameter points to a business object, the engine automatically switches to the business object knowledge graph and locates the associated entity nodes through edge relationships. After completing the single-node graph operation, the engine aggregates the intermediate results output by each operator in a rule-based order to construct a data stream with temporal and semantic consistency. The risk model execution engine clusters all intermediate results according to preset risk patterns, and identifies preset suspected risk objects that meet preset judgment rules. At the same time, the risk model execution engine automatically binds each preset suspected risk object with the triggered graph operation, the associated technical metadata entity node, the business object entity node, and the execution timestamp to form a chain of evidence data.

[0012] Secondly, this application provides a data security risk detection system based on knowledge graphs and large language models, the system comprising: The building module is used to construct a business object knowledge graph based on the relationships between business objects in the data warehouse; and to construct a metadata knowledge graph based on the relationships between technical metadata in the data warehouse; wherein, business objects contain technical metadata; The extraction module is used to obtain the data security judgment description input by the user, and use LLM to extract preset key model features, risk judgment rules, and rule order from the data security judgment description; The acquisition module is used to generate a detection process corresponding to the data security judgment description based on the graph operation operators corresponding to the risk judgment rules, the technical metadata corresponding to the preset key model features, and the rule order, using the metadata knowledge graph and the preset graph operator library, and to obtain the risk model DSL file corresponding to the detection process; wherein, when the calling parameter of the graph operation operator is the business object associated with the business object, the corresponding business object knowledge graph is called to obtain the associated business object. The execution module is used to execute the risk model DSL file through the risk model execution engine. Based on the order of the computing nodes in the risk model DSL file, it sequentially executes the graph operation operators corresponding to the computing nodes to finally obtain the preset suspected risk objects and related evidence chain data.

[0013] Thirdly, this application provides a data security risk detection device based on knowledge graphs and large language models, the device comprising: processor; And a memory containing executable code, which, when executed, causes the processor to perform a data security risk detection method based on knowledge graphs and large language models, as described above.

[0014] Fourthly, this application provides a non-volatile computer storage medium storing computer instructions, which, when executed, implement a data security risk detection method based on knowledge graphs and large language models as described above.

[0015] As can be seen from the above technical solutions, this application has the following advantages: By constructing a two-tiered structure of business object knowledge graph and metadata knowledge graph, a systematic modeling of multi-dimensional entities and their relationships in data security risks is achieved. Compared to traditional static models based on single-case experience, this structure can dynamically capture cross-business and cross-system object linkage paths, enabling risk identification to extend beyond feature matching of isolated events to the business logic chain driven by technical metadata. This graph-based representation addresses the core deficiency of existing technologies—the lack of in-depth mining of multi-object relationships in complex business scenarios—and enhances the structured expression capability of risk behavior patterns.

[0016] By leveraging Large Language Models (LLM), the system automatically parses user-input natural language case descriptions, extracts pre-defined key model features, risk assessment rules, and their execution order, achieving efficient transformation from unstructured semantics to structured detection logic. This mechanism abandons the rigid mode of traditional manually written rules or fixed feature libraries, making the risk detection model construction process highly configurable and adaptable to various scenarios. Through LLM's contextual understanding capabilities, the system can accurately map the judgment logic of human experts to graph operation operator sequences, thereby quickly generating detection processes for new types of cases without reprogramming, improving the iteration efficiency and coverage of the risk model.

[0017] By generating a risk model DSL file and having a dedicated execution engine sequentially call graph operation operators, the detection process is automated, reusable, and traceable. When operator parameters involve business object associations, the system automatically links to the business object knowledge graph for cross-graph queries, forming a closed-loop reasoning path from the metadata layer to the business layer. This mechanism not only ensures the logical consistency of the detection process but also synchronously generates complete data on suspected risk objects and related evidence chains in the output results. This provides a structured and verifiable decision-making basis for subsequent manual review, liability determination, and compliance audits, overcoming the bottlenecks of traditional methods such as "fragmented evidence and difficulty in tracing the source." Attached Figure Description

[0018] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a data security risk detection method based on knowledge graphs and large language models provided in an embodiment of this application.

[0020] Figure 2 This is a schematic diagram of a data security risk detection process based on knowledge graphs and large language models provided in an embodiment of this application.

[0021] Figure 3 This is a schematic diagram of the internal structure of a data security risk detection system based on knowledge graphs and large language models provided in an embodiment of this application.

[0022] Figure 4 This is a schematic diagram of the internal structure of a data security risk detection device based on knowledge graphs and large language models, provided in an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Those skilled in the art should understand that the embodiments described below are merely preferred embodiments of this disclosure and do not imply that this disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely used to explain the technical principles of this disclosure and are not intended to limit the scope of protection of this disclosure. Based on the preferred embodiments provided by this disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of this disclosure.

[0025] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0026] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0027] The embodiment provides a data security risk detection method based on knowledge graphs and large language models, such as Figure 1 As shown in the embodiments of this application, the method mainly includes the following steps: Step 110: Based on the relationships between business objects in the data warehouse, construct a business object knowledge graph; based on the relationships between technical metadata in the data warehouse, construct a metadata knowledge graph.

[0028] The business object contains technical metadata.

[0029] In some embodiments, the specific components include: Extract entity nodes corresponding to business objects from the data warehouse; the entity nodes corresponding to business objects include at least: personnel, equipment terminals, storage media, carriers, network nodes, organizational structures, file entities, behavioral operations, system logs, security events, and network traffic; extract the relationships between business objects from the data warehouse, and treat the relationships as edges between entity nodes; the edges corresponding to business objects are at least divided into: subordinate relationships, ownership relationships, and related reference relationships.

[0030] As an example, the business object graph layer is used to realistically recreate entity interactions in business scenarios, and it contains the following graph elements: Entity nodes: Covering various business entities, including but not limited to personnel, equipment terminals, storage media, carriers, network nodes, organizations, file entities, behavioral operations, system logs, security events, network traffic, etc.

[0031] Node attributes: Store comprehensive data describing each business object, enabling refined management of "one file per object".

[0032] Relationship edges: Describe the dynamic interactions between business objects, including subordinate relationships, ownership relationships, occurrence relationships, and related reference relationships.

[0033] Semantic Indexing Layer: For each of the above business objects, natural language description text is generated and transformed into high-dimensional semantic vectors (Embedding) to build a semantic index library, thereby supporting semantic retrieval and reasoning based on graph augmented retrieval generation (GraphRAG) technology.

[0034] Construct a business object knowledge graph based on the entity nodes and edges corresponding to the business objects; Extract the technical metadata corresponding to each business object from the data warehouse and abstract it into entity nodes corresponding to the technical metadata; the entity nodes corresponding to the technical metadata include at least: data table nodes, field nodes, business term nodes, data domain nodes, indicator nodes, and dictionary nodes; Extract the relationships between technical metadata from the data warehouse and treat these relationships as edges between entity nodes; the edges corresponding to technical metadata are at least divided into: structural relationships, lineage relationships, and semantic relationships; A metadata knowledge graph is constructed based on the entity nodes and edges corresponding to the technical metadata.

[0035] As an example, the metadata knowledge graph layer is used to map the technical and business views of data assets, and it contains the following graph elements: Entity Nodes: Data table node: Attributes include database name, table name, business comments, responsible person, creation time, row count, storage size, etc.

[0036] Field node: Attributes include field name, data type, length constraint, primary / foreign key identifier, NOT NULL constraint, default value, field comments, etc.

[0037] Business terminology node: Attributes include standard term name, definition, business domain, responsible person, synonym mapping, etc.

[0038] Data domain node: Attributes include data classification and grading type, value range constraints, validation rule logic, etc.

[0039] Metric node: Attributes include metric name, statistical scope, calculation logic formula, dependency table / field path, analysis dimension, etc.

[0040] Dictionary node: Attributes include dictionary encoding, dictionary item value, and description of business meaning.

[0041] Edges: Structural relationships: including "table-contains-field" and "field-belongs to-table".

[0042] Lineage relationships: including "table-lineage dependency-table" (upstream / downstream) and "field-mapping-field" (ETL transformation logic).

[0043] Semantic associations include "field-association-dictionary", "table-association-business terminology", "field-association-data domain", and "metric-dependency-table / field".

[0044] Step 120: Obtain the data security judgment description input by the user, and use LLM to extract the preset key model features, risk judgment rules, and rule order from the data security judgment description.

[0045] In some embodiments, the specific components include: LLM performs semantic parsing on the data security judgment description and extracts technical metadata from the data security judgment description as preset key model features; Based on preset key model features, LLM matches a preset risk assessment rule template library and identifies risk assessment rules with a matching degree greater than a preset threshold by calculating the semantic similarity and matching degree with the risk assessment rules. Among them, the risk assessment rules and graph operation operators have a preset binding relationship. Obtain the preset logical dependencies and preset execution constraints between risk assessment rules, and generate the rule order.

[0046] It should be further explained that when LLM performs semantic parsing on the user-input data security judgment description, it uses a BERT-based pre-trained language model. Through word segmentation and named entity recognition (NER) modules, it extracts entities directly related to technical metadata from the text, such as "access log timestamps," "file permission change records," and "database query field names," and maps them to a predefined metadata dictionary to form a structured feature set. Subsequently, LLM performs semantic matching between the extracted feature set and a risk judgment rule template library. The template library consists of more than 200 rule templates, each containing keyword patterns, semantic slots, and logical expressions. The matching process uses residual... The string similarity calculation takes the feature set and the embedded representation of the template semantic vector as input, and sets the similarity threshold to 0.72, retaining only rules with a matching degree higher than this value. Each rule has a one-to-one binding relationship with a graph operation operator, such as the rule "detecting abnormal file export" being bound to the "GetFileAccessPath" operator. Finally, based on the preset logical dependencies between rules (represented by a directed acyclic graph) and execution constraints (such as "must be executed after identity verification check"), the system generates an ordered rule execution sequence through a topological sorting algorithm, ensuring that the detection process conforms to the causal constraints of the business logic, and outputs a linear instruction chain that can be directly read by the DSL parser.

[0047] Step 130: Based on the graph operation operators corresponding to the risk judgment rules, the technical metadata corresponding to the preset key model features, and the rule order, use the metadata knowledge graph and the preset graph operator library to generate the detection process corresponding to the data security judgment description, and obtain the risk model DSL file corresponding to the detection process.

[0048] Specifically, when the calling parameter of the graph operation operator is the business object associated with the business object, the corresponding business object knowledge graph is called to obtain the associated business object.

[0049] It should be further explained that operators are functional encapsulations of atomic operations such as querying, traversing, filtering, and computation at the underlying level of the knowledge graph. Operator metadata structure: Each operator maintained in the library contains a standardized metadata description, specifically including: operator name, functional definition, input / output data type constraints, parameter list and default values, parameter value range, pre- and post-dependencies, standard calling examples, executable script template, and runtime environment requirements. The operator library is configured to dynamically inject the above operator metadata as context into the large language model during the automatic orchestration phase of the risk model. This allows the large language model to perform logical deduction based on explicit "tool definitions" and "input / output constraints," rather than blindly generating text.

[0050] In some embodiments, based on the graph operation operators corresponding to the risk assessment rules, the technical metadata corresponding to the preset key model features, and the rule order, a detection process corresponding to the data security assessment description is generated using the metadata knowledge graph and the preset graph operator library, and a risk model DSL file corresponding to the detection process is obtained, specifically including: Based on the binding relationship between the preset risk judgment rules and the graph operation operators, the extracted preset key model features are mapped to the corresponding entity nodes in the metadata knowledge graph; combined with the execution constraints defined in the rule sequence, the graph operation operator sequence is dynamically assembled to form a preliminary directed acyclic graph structure as the detection process; using the logical skeleton of the detection process, a structured operator chain is obtained; wherein, the operator chain carries metadata entity identifiers and parameter context. Based on the operator chain, the standardized interface in the preset graph operator library is called to convert each operator into a serializable instruction unit and embed the rule sequence; All instruction units are encoded into a process description in structured JSON format to form a risk model DSL file.

[0051] It should be further explained that, based on the binding relationship between the preset risk assessment rules and the graph operation operators, the system maps the preset key model features extracted in step 120 to the corresponding entity nodes in the metadata knowledge graph. Each entity node is defined by a unique identifier (e.g., node_id: "log_access_timestamp_001") and attribute key-value pairs (e.g., {"type": "timestamp", "source": "syslog", "format": "ISO8601"}). The system dynamically assembles the graph operation operator sequence in a directed acyclic graph (DAG) structure according to the execution constraints defined in the rule sequence (e.g., "must be executed after the authentication node"). Each operator node carries input / output type constraints from its metadata; for example, the GetFileAccessPath operator requires the input to be file_id (type: string) and the output to be path_list (type: string array). This DAG structure serves as the logical skeleton of the detection process, forming a structured operator chain, where each operator node is accompanied by a parameter context, including field values ​​inherited from the metadata entity and constant values ​​bound when matching rules.

[0052] Based on the operator chain, the system calls the standardized interface of the preset graph operator library to convert each operator into a serializable instruction unit. Each instruction unit is a JSON object containing the following fields: "operator_id" (e.g., "GetFileAccessPath"), "inputs" (key-value pair mapping, e.g., {"file_id": "node_123"}), "outputs" (expected output variable names, e.g., "path_result"), "depends_on" (a list of preceding operator IDs, e.g., ["VerifyUserAuth"]), and "template" (an executable script template, e.g., "MATCH (f:File)-[r:ACCESS]->(u:User) WHERE f.id = $file_id RETURN r.path"). Parameter value ranges and default values ​​are validated by the operator metadata when the instruction unit is generated. For example, if the "max_depth" parameter is not specified, a default value is automatically filled in. Logical dependencies in the rule order are explicitly expressed through the depends_on field, ensuring that the execution order conforms to business causal constraints.

[0053] When the operator's calling parameter is a business object associated with a business object (such as "user_id"), the system detects that this parameter has no direct entity in the metadata knowledge graph. Instead, it queries the pre-defined cross-graph association mapping table, which defines the association path between metadata entities and business object entities (such as "user_id" → "User" → "employee_id"). The system then triggers the query interface of the business object knowledge graph, performs graph traversal with "employee_id" as the key, retrieves the associated business object instances (such as "employee_name": "Zhang San", "department": "R&D Department"), and injects the results as parameter context into the "inputs" of the current operator. Finally, all instruction units are arranged in the order of the rules, encapsulated into a JSON array, with the root field being "steps", and appended with "version": "1.2" and "case_id": "SEC-2026-0414-001", forming a complete risk model DSL file. The structure conforms to the JSON Schema validation specification and can be directly parsed and run by the stateless execution engine.

[0054] Step 140: Execute the risk model DSL file through the risk model execution engine. Based on the order of the computation nodes in the risk model DSL file, execute the graph operation operators corresponding to the computation nodes in sequence to finally obtain the preset suspected risk objects and related evidence chain data.

[0055] In some embodiments, the specific components include: The risk model execution engine loads the risk model DSL file, parses the operator chain in the structure, and calls the corresponding preset graph operation operators one by one according to the order of the calculation nodes and the parameter context in the operator chain. The risk model execution engine obtains the entity nodes bound to the preset key model features involved in each operator, and uses the business object knowledge graph to form a preliminary metadata association path; when the operator parameter points to a business object, the engine automatically switches to the business object knowledge graph and locates the associated entity nodes through edge relationships. After completing the single-node graph operation, the engine aggregates the intermediate results output by each operator in a rule-based order to construct a data stream with temporal and semantic consistency. The risk model execution engine clusters all intermediate results according to preset risk patterns, and identifies preset suspected risk objects that meet preset judgment rules. At the same time, the risk model execution engine automatically binds each preset suspected risk object with the triggered graph operation, the associated technical metadata entity node, the business object entity node, and the execution timestamp to form a chain of evidence data.

[0056] It should be noted that after the risk model execution engine loads the risk model DSL file, it first parses the "steps" array in the JSON structure and traverses each instruction unit in sequence. The "operator_id" of each instruction unit is used to load the corresponding executable script template and input constraints from the preset graph operation operator library. The engine performs type validation and value range validation on the parameters in "inputs". If the parameter is a variable name (such as "path_result"), it looks up the corresponding intermediate result in the "outputs" of the previous operator; if the parameter is a constant, it is directly bound. When the parameter is identified as a business object association field (such as "user_id"), the engine locates its target entity type (such as "Employee") in the business object knowledge graph based on the cross-graph association mapping table built in step 130, and performs graph traversal with "employee_id" as the key to obtain the associated business object attributes (such as "department" and "job_title"), and injects the result into the input context of the current operator. All graph queries are executed through the graph database's native API (such as Neo4j Cypher or JanusGraph Gremlin), and the query results are returned in structured JSON format to ensure data consistency.

[0057] After a single operator is executed, the engine aggregates the output results in a time-series manner according to the "depends_on" dependency relationship and rule order, forming a continuous data stream. Each intermediate result is accompanied by a unique identifier, an execution timestamp (accurate to milliseconds), and the source operator ID. After all operators have been executed, the engine matches the final output set of entities with a preset risk pattern. This pattern is a set of logical expressions that define the combination conditions between multiple technical metadata entities and business object entities (e.g., "there are 3 file exports outside of working hours and associated with R&D department employees"). Entity combinations that meet the conditions are marked as preset suspected risk objects, and a unique risk instance ID is generated for them. At the same time, the engine automatically constructs evidence chain data, binding each suspected risk object with the triggered operator sequence, the associated technical metadata node ID, business object node ID, execution timestamp, parameter value, and graph query path to form a structured evidence record, which is stored as a JSON object with fields including "risk_id", "triggered_operators", "metadata_nodes", "business_nodes", "timestamps", and "query_paths" for subsequent auditing or review.

[0058] In some embodiments, after finally obtaining the preset suspected risk object and associated chain of evidence data, the method further includes: The large language model is invoked, and the output data of the preset suspected risk objects and associated evidence chains are semantically compared with the risk judgment rules to obtain the verification and detection results. The verification result will be directly pushed to the early warning module; For results that fail validation, obtain the matching discrepancies and error reasons from the large language model, generate error details containing the matching discrepancies and error reasons, and feed them back to the risk model execution engine to trigger the automatic correction and reorganization process of the model logic.

[0059] In some embodiments, after directly pushing the verification result to the early warning module, the method further includes: For the results of successful verification, the front-end interface will issue a warning for the pre-set suspected risk objects and related evidence chain data, and simultaneously render the topology diagram of the risk model execution engine.

[0060] Based on the preceding description, such as Figure 2 As shown, this embodiment can be specifically described as follows: Phase 1: Data Foundation and Two-Layer Knowledge Graph Construction (Steps 0-6): Step 0 (Data Preparation): Based on a data warehouse that has undergone data governance, ensure that the data resources are formatted in a standardized manner, with clear and complete catalogs, serving as the basic input for the system.

[0061] Step 1 (Object Characterization): For business entities such as people, places, things, organizations, events, and logs, gather multi-dimensional attribute data to create a holographic characterization; construct an object relationship network based on the associations between entities, and generate natural language descriptions and high-dimensional semantic vectors for business objects.

[0062] Steps 2-3 (Business Graph Construction): Construct a business object knowledge graph. This graph uses business objects as entity nodes and object relationships as edges, and embeds semantic index data to achieve graph-structured storage and retrieval of business data.

[0063] Steps 4-6 (Metadata Graph Construction): Extract technical metadata such as table structure, field definition, dictionary code value, and statistical indicators from the data warehouse and associate them with resource catalog information; construct a metadata knowledge graph, which not only stores data warehouse metadata and its topological relationships, but also maps the data structure and relational logic of business objects, forming a "technology-business" mapping layer.

[0064] Phase Two: Intent Understanding and Automated Model Orchestration (Steps 7-11): Step 7 (Requirement Input): Receive natural language descriptions from users (such as descriptions of data security judgments), and the system will analyze their intent to discover potential risk objects and build a complete chain of risk evidence.

[0065] Steps 8-9 (Rule Extraction): Utilizing the powerful semantic understanding capabilities of Large Language Models (LLM), key model features and risk assessment rules are automatically extracted from the case description and structured into a model description data file.

[0066] Steps 10-11 (Automatic Orchestration): Based on the extracted rules, the model orchestration engine jointly queries the metadata knowledge graph (to obtain data paths) and the graph operator library (to obtain computational logic), automatically generates and orchestrates the detection process, and finally outputs an executable risk model DSL (domain-specific language) file.

[0067] Phase 3: Model Execution and Intelligent Verification Closed Loop (Steps 12-17): Steps 12-14 (Engine Execution): The risk model execution engine loads the DSL file and operator library (including operator descriptions and execution script templates), performs topological sorting on the computing nodes, executes the graph operation operators in sequence, and finally outputs the suspected risk objects and their associated evidence chain data.

[0068] Step 15 (Semantic Verification): Call the large language model again to semantically compare the output risk object and evidence chain data with the initial model rules to verify the logical correctness of the detection results.

[0069] Steps 16-17 (Feedback and Correction): Establish a dynamic feedback mechanism.

[0070] Positive feedback: Results that pass the verification are directly pushed to the early warning module.

[0071] Negative feedback: For results that fail the validation, the system automatically generates error details including "matching differences" and "suspected error reasons", and feeds them back to the model orchestration engine to trigger automatic correction and reorganization of the model logic.

[0072] Phase Four: Visualization and Risk Management (Steps 18-19) Step 18 (Visual Warning): For risky objects that pass the verification, a warning is issued on the front-end interface, and the topology diagram of the model execution is rendered simultaneously to realize the "white-box" explanation of the detection logic, making it easier for users to understand.

[0073] Step 19 (Business Processing): Provides closed-loop processing functionality, allowing users to directly initiate verification work orders or trigger OA approval processes based on alert results, completing the last mile of risk control.

[0074] In addition, this application Figure 3 This application provides a data security risk detection system based on knowledge graphs and large language models. For example... Figure 3 As shown, the system provided in this application embodiment mainly includes: Module 210 is used to construct a business object knowledge graph based on the relationships between business objects in the data warehouse; and to construct a metadata knowledge graph based on the relationships between technical metadata in the data warehouse; wherein, business objects contain technical metadata.

[0075] The extraction module 220 is used to obtain the data security judgment description input by the user, and to extract preset key model features, risk judgment rules, and rule order from the data security judgment description using LLM.

[0076] The module 230 is used to generate a detection process corresponding to the data security judgment description based on the graph operation operator corresponding to the risk judgment rule, the technical metadata corresponding to the preset key model features, and the rule order, using the metadata knowledge graph and the preset graph operator library, and to obtain the risk model DSL file corresponding to the detection process; wherein, when the calling parameter of the graph operation operator is the business object associated with the business object, the corresponding business object knowledge graph is called to obtain the associated business object.

[0077] The execution module 240 is used to execute the risk model DSL file through the risk model execution engine. Based on the order of the computing nodes in the risk model DSL file, the graph operation operators corresponding to the computing nodes are executed sequentially to finally obtain the preset suspected risk objects and the associated evidence chain data.

[0078] The above are method embodiments of this application. Based on the same inventive concept, this application also provides a data security risk detection device based on knowledge graphs and large language models. Figure 4 As shown, the device includes: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform a data security risk detection method based on knowledge graphs and large language models as described in the above embodiments.

[0079] Specifically, the server constructs a business object knowledge graph based on the relationships between business objects in the data warehouse; it also constructs a metadata knowledge graph based on the relationships between technical metadata in the data warehouse, where business objects contain technical metadata. The server obtains user-inputted data security judgment descriptions and uses an LLM (Local Level Management) system to extract preset key model features, risk judgment rules, and rule order from these descriptions. Based on the graph operation operators corresponding to the risk judgment rules, the technical metadata corresponding to the preset key model features, and the rule order, the server uses the metadata knowledge graph and a preset graph operator library to generate a detection process corresponding to the data security judgment description, obtaining a risk model DSL file corresponding to the detection process. When the calling parameter of the graph operation operator is a business object associated with a business object, the corresponding business object knowledge graph is invoked to obtain the associated business object. The risk model DSL file is executed through the risk model execution engine. Based on the order of the computation nodes in the risk model DSL file, the graph operation operators corresponding to the computation nodes are executed sequentially, ultimately obtaining preset suspected risk objects and associated evidence chain data.

[0080] In addition, this application embodiment also provides a non-volatile computer storage medium storing executable instructions, which, when executed, implement the data security risk detection method based on knowledge graph and large language model as described above.

[0081] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data security risk detection method based on knowledge graphs and large language models, characterized in that, The method includes: Based on the relationships between business objects in the data warehouse, a business object knowledge graph is constructed; based on the relationships between technical metadata in the data warehouse, a metadata knowledge graph is constructed; wherein, business objects contain technical metadata; Obtain the data security judgment description input by the user, and use LLM to extract preset key model features, risk judgment rules, and rule order from the data security judgment description; Based on the graph operation operators corresponding to the risk assessment rules, the technical metadata corresponding to the preset key model features, and the rule order, the detection process corresponding to the data security assessment description is generated using the metadata knowledge graph and the preset graph operator library, and the risk model DSL file corresponding to the detection process is obtained; among them, when the calling parameter of the graph operation operator is the business object associated with the business object, the corresponding business object knowledge graph is called to obtain the associated business object. The risk model DSL file is executed by the risk model execution engine. Based on the order of the computation nodes in the risk model DSL file, the graph operation operators corresponding to the computation nodes are executed sequentially to finally obtain the preset suspected risk objects and the associated evidence chain data.

2. The data security risk detection method based on knowledge graphs and large language models according to claim 1, characterized in that, After finally obtaining the pre-defined suspected risk objects and related evidence chain data, the method further includes: The large language model is invoked, and the output data of the preset suspected risk objects and associated evidence chains are semantically compared with the risk judgment rules to obtain the verification and detection results. The verification result will be directly pushed to the early warning module; For results that fail validation, obtain the matching discrepancies and error reasons from the large language model, generate error details containing the matching discrepancies and error reasons, and feed them back to the risk model execution engine to trigger the automatic correction and reorganization process of the model logic.

3. The data security risk detection method based on knowledge graphs and large language models according to claim 2, characterized in that, After directly pushing the verified result to the early warning module, the method further includes: For the results of successful verification, the front-end interface will issue a warning for the pre-set suspected risk objects and related evidence chain data, and simultaneously render the topology diagram of the risk model execution engine.

4. The data security risk detection method based on knowledge graphs and large language models according to claim 1, characterized in that, Based on the relationships between business objects in the data warehouse, a business object knowledge graph is constructed; based on the relationships between technical metadata in the data warehouse, a metadata knowledge graph is constructed, specifically including: Extract entity nodes corresponding to business objects from the data warehouse; wherein, the entity nodes corresponding to business objects include at least: personnel, equipment terminals, storage media, carriers, network nodes, organizational structures, file entities, behavioral operations, system logs, security events, and network traffic; extract the relationships between business objects from the data warehouse, and treat the relationships as edges between entity nodes; wherein, the edges corresponding to business objects are at least divided into: subordinate relationships, ownership relationships, and related reference relationships; Construct a business object knowledge graph based on the entity nodes and edges corresponding to the business objects; Extract the technical metadata corresponding to each business object from the data warehouse and abstract it into entity nodes corresponding to the technical metadata; the entity nodes corresponding to the technical metadata include at least: data table nodes, field nodes, business term nodes, data domain nodes, indicator nodes, and dictionary nodes; Extract the relationships between technical metadata from the data warehouse and treat these relationships as edges between entity nodes; the edges corresponding to technical metadata are at least divided into: structural relationships, lineage relationships, and semantic relationships; A metadata knowledge graph is constructed based on the entity nodes and edges corresponding to the technical metadata.

5. The data security risk detection method based on knowledge graphs and large language models according to claim 1, characterized in that, Obtain the user-input data security assessment description, and use LLM to extract preset key model features, risk assessment rules, and rule order from the data security assessment description, specifically including: LLM performs semantic parsing on the data security judgment description and extracts technical metadata from the data security judgment description as preset key model features; Based on preset key model features, LLM matches a preset risk assessment rule template library and identifies risk assessment rules with a matching degree greater than a preset threshold by calculating the semantic similarity and matching degree with the risk assessment rules. Among them, the risk assessment rules and graph operation operators have a preset binding relationship. Obtain the preset logical dependencies and preset execution constraints between risk assessment rules, and generate the rule order.

6. The data security risk detection method based on knowledge graphs and large language models according to claim 1, characterized in that, Based on the graph operation operators corresponding to the risk assessment rules, the technical metadata corresponding to the preset key model features, and the rule order, the detection process corresponding to the data security assessment description is generated using the metadata knowledge graph and the preset graph operator library. This yields the risk model DSL file corresponding to the detection process, specifically including: Based on the binding relationship between the preset risk judgment rules and the graph operation operators, the extracted preset key model features are mapped to the corresponding entity nodes in the metadata knowledge graph; combined with the execution constraints defined in the rule sequence, the graph operation operator sequence is dynamically assembled to form a preliminary directed acyclic graph structure as the detection process; using the logical skeleton of the detection process, a structured operator chain is obtained; wherein, the operator chain carries metadata entity identifiers and parameter context. Based on the operator chain, the standardized interface in the preset graph operator library is called to convert each operator into a serializable instruction unit and embed the rule sequence; All instruction units are encoded into a process description in structured JSON format to form a risk model DSL file.

7. The data security risk detection method based on knowledge graphs and large language models according to claim 1, characterized in that, The risk model DSL file is executed through the risk model execution engine. Based on the order of the computation nodes in the risk model DSL file, the graph operation operators corresponding to the computation nodes are executed sequentially to finally obtain the preset suspected risk objects and associated evidence chain data, specifically including: The risk model execution engine loads the risk model DSL file, parses the operator chain in the structure, and calls the corresponding preset graph operation operators one by one according to the order of the calculation nodes and the parameter context in the operator chain. The risk model execution engine obtains the entity nodes bound to the preset key model features involved in each operator, and uses the business object knowledge graph to form a preliminary metadata association path; when the operator parameter points to a business object, the engine automatically switches to the business object knowledge graph and locates the associated entity nodes through edge relationships. After completing the single-node graph operation, the engine aggregates the intermediate results output by each operator in a rule-based order to construct a data stream with temporal and semantic consistency. The risk model execution engine clusters all intermediate results according to preset risk patterns, and identifies preset suspected risk objects that meet preset judgment rules. At the same time, the risk model execution engine automatically binds each preset suspected risk object with the triggered graph operation, the associated technical metadata entity node, the business object entity node, and the execution timestamp to form a chain of evidence data.

8. A data security risk detection system based on knowledge graphs and large language models, characterized in that, The system includes: The building module is used to construct a business object knowledge graph based on the relationships between business objects in the data warehouse; and to construct a metadata knowledge graph based on the relationships between technical metadata in the data warehouse; wherein, business objects contain technical metadata; The extraction module is used to obtain the data security judgment description input by the user, and use LLM to extract preset key model features, risk judgment rules, and rule order from the data security judgment description; The acquisition module is used to generate a detection process corresponding to the data security judgment description based on the graph operation operators corresponding to the risk judgment rules, the technical metadata corresponding to the preset key model features, and the rule order, using the metadata knowledge graph and the preset graph operator library, and to obtain the risk model DSL file corresponding to the detection process; wherein, when the calling parameter of the graph operation operator is the business object associated with the business object, the corresponding business object knowledge graph is called to obtain the associated business object. The execution module is used to execute the risk model DSL file through the risk model execution engine. Based on the order of the computing nodes in the risk model DSL file, it sequentially executes the graph operation operators corresponding to the computing nodes to finally obtain the preset suspected risk objects and related evidence chain data.

9. A data security risk detection device based on knowledge graphs and large language models, characterized in that, The device includes: processor; And a memory having executable code stored thereon, which, when executed, causes the processor to perform a data security risk detection method based on knowledge graphs and large language models as described in any one of claims 1-7.

10. A non-volatile computer storage medium, characterized in that, It stores computer instructions, which, when executed, implement a data security risk detection method based on knowledge graphs and large language models as described in any one of claims 1-7.

Images