Network security compliance intelligent inspection system and method based on front-end and back-end cooperation and AI recognition

Abstract

This invention discloses a cybersecurity compliance intelligent inspection system and method based on front-end and back-end collaboration and AI recognition, belonging to the field of cybersecurity compliance detection technology. It includes: an initial screening module that extracts suspected violation areas based on compliance scores and dynamic baselines; a feature separation module that generates deep semantic feature vectors and desensitized thumbnails; a verification module that combines a large model, page structure information, and interface context to output verification results; and a collaborative update module that generates gradient compensation parameter packages and forms an audit report. In this invention, through front-end dynamic initial screening, privacy feature separation, back-end cross-verification, and false positive targeted feedback, business images do not need to carry the original sensitive content across platforms. Violation judgment can be verified by combining semantic features, page structure, and business interface context. False positive samples can reversely correct the front-end screening weights, reducing the risk of privacy leakage, false positive rate, and manual verification burden, thereby improving the accuracy of compliance inspections, continuous adaptability, and audit traceability.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity compliance detection technology, and in particular to a cybersecurity compliance intelligent inspection system and method based on front-end and back-end collaboration and AI recognition. Background Technology

[0002] The field of cybersecurity compliance testing technology involves business content identification, page screenshot inspection, interface behavior recording, permission status verification, server configuration comparison, access log analysis, compliance clause matching, risk result review, and evidence retention. Its methods typically involve collecting business images, page content, interface URLs, response status codes, access paths, business interface types, request time periods, configuration key values, operation logs, and compliance clause numbers, and comparing them with content compliance rule tables, page structure constraint tables, interface call condition tables, configuration baseline tables, and historical inspection records. Traditional network security compliance intelligent inspection systems refer to systems that conduct compliance checks on image content, page content, interface return content, server configuration content, and access records for government and enterprise intranets, edge gateways, and business systems. The technical items targeted by this system include local images, page screenshots, image feature vectors, object bounding boxes, text coordinates, interface URLs, access paths, business interface types, configuration key values, and compliance clause numbers. The traditional approach typically involves the front-end node reading image hash values, color histograms, edge contour points, and text recognition results for initial screening, and then the back-end reading image blocks, object bounding boxes, text coordinates, interface return fields, access context, and configuration key value fields for verification and comparison to generate inspection records.

[0003] Current cybersecurity compliance checks typically rely on centralized backend identification or manual review, with the frontend only handling collection and forwarding. It lacks the ability to dynamically screen business images and locate suspected violation areas based on historical scoring status, leading to a large amount of irrelevant image content entering the backend review process, increasing backend computational pressure and the burden on manual review. Simultaneously, business images are often transmitted across platforms in their raw form, easily expanding the exposure of private information such as text, faces, and account identifiers, posing a risk of sensitive content leakage. When backend models lack collaborative verification of layout structure information, interface context, and business interface types, they easily identify page differences, layout differences, or object differences in normal business scenarios as violation features. Furthermore, false positives are difficult to promptly feed back to the frontend and use to correct screening weights, resulting in inaccurate suspected violation location, high review pressure, delayed false positive correction, fragmented audit evidence, and insufficient efficiency in compliance loop updates. Summary of the Invention

[0004] The purpose of this invention is to provide a network security compliance intelligent inspection system and method based on front-end and back-end collaboration and AI recognition. This system enables suspected violations to be dynamically screened and regionally extracted at the front-end node during the network security compliance inspection process. Through privacy feature separation, back-end cross-verification, and false alarm targeted feedback updates, a collaborative inspection mechanism is formed. This allows compliance verification to be completed by combining violation semantics, layout structure, and interface context even when business images are transferred across terminals without fully carrying the original sensitive content. Furthermore, it enables targeted correction of false alarm samples to the front-end initial screening network.

[0005] To achieve the above objectives, the present invention provides a cybersecurity compliance intelligent inspection system based on front-end and back-end collaboration and AI recognition, including an initial screening module, a feature separation module, a review module, and a collaborative update module.

[0006] The initial screening module is deployed on the front-end node and is used to input business images into the lightweight initial screening network to extract multi-dimensional compliance scores, calculate the moving average of historical scores to construct a dynamic baseline; when the weighted distance between the multi-dimensional compliance score and the dynamic baseline exceeds a preset threshold, suspected violation areas are extracted.

[0007] The feature separation module is used to apply feature masks to the suspected violation area, extract deep semantic feature vectors that retain the violation semantics and filter out privacy information, and simultaneously perform pixel blur replacement on the text and facial features within the area to generate a desensitized thumbnail.

[0008] The verification module is deployed on the backend and is used to input the received deep semantic feature vector into the compliance classification model, and perform cross-validation by combining the layout structure information of the de-identified thumbnail with the interface context, and output verification results including confirmation of violations or false alarms.

[0009] The collaborative update module is used to calculate the difference between the classification boundary in the feature space of the deep semantic feature vector that caused the false alarm and the confirmed violation vector corresponding to the confirmed violation result when the review result is determined to be a false alarm. Based on this, a gradient compensation parameter package is generated and sent out to update the initial screening network weights of the front-end node that generated the false alarm in a targeted manner, and an audit report is generated based on the review result.

[0010] As a progressive constraint on the front-end dynamic initial screening process, the initial screening module includes a score extraction submodule, a baseline construction submodule, and a region extraction submodule. The score extraction submodule acquires the image block brightness distribution, edge density, layout partitioning, and sensitive object confidence of the business image, and inputs these data into the lightweight initial screening network to generate the multidimensional compliance score. The baseline construction submodule reads the historical score sequence formed by the same front-end node within a set time window, performs a moving average on the historical score sequence, and removes abnormal scores exceeding a discrete threshold to generate the dynamic baseline. The region extraction submodule compares the multidimensional compliance score with the dynamic baseline using a weighted distance. When the weighted distance exceeds a suspected violation threshold, it locates the image block boundary based on the score dimension with the largest deviation from the dynamic baseline and extracts the suspected violation region.

[0011] Furthermore, the dynamic baseline generation process includes: acquiring the front-end node identifier, business interface identifier, and image layout category; using the front-end node identifier, business interface identifier, and image layout category together as the reading index for the historical scoring sequence; filtering historical scores that meet the index consistency condition according to the collection time order; setting sliding weights for historical scores that meet the index consistency condition according to the time decreasing relationship, with the sliding weight being higher the closer the historical score is to the collection time of the business image; performing a weighted average of the historical scores according to the sliding weight to generate a node-level dynamic baseline; and determining the node-level dynamic baseline as the dynamic baseline; when the number of historical scores that meet the index consistency condition is lower than the minimum sample size threshold, calling the global historical scores under the same business interface identifier and the same image layout category, performing a sliding average processing on the global historical scores to generate a compensated dynamic baseline, and determining the compensated dynamic baseline as the dynamic baseline.

[0012] As a progressive constraint on the privacy feature separation process, the feature separation module includes a mask generation submodule, a semantic extraction submodule, and a desensitization generation submodule. The mask generation submodule acquires the texture boundary, object outline, and candidate privacy location of the suspected violation area, and assigns occlusion weights to the texture boundary and object outline based on the candidate privacy location to generate the feature mask. The semantic extraction submodule inputs the suspected violation area and the feature mask into a deep feature extraction network, suppresses the pixel channels marked by the occlusion weights, and retains the semantic channels corresponding to the violation object outline, violation layout relationship, and abnormal texture distribution, outputting the deep semantic feature vector. The desensitization generation submodule identifies text pixel blocks and face pixel blocks within the suspected violation area, performs pixel blurring replacement on the text pixel blocks and face pixel blocks, and retains the layout outline boundary of the suspected violation area to generate the desensitized thumbnail.

[0013] Furthermore, the feature mask generation process includes: obtaining the text character boxes, face key region boxes, and account identifier region boxes corresponding to the candidate privacy locations, and determining the overlap state between the text character boxes, face key region boxes, and account identifier region boxes and the object contour; when any text character box, face key region box, or account identifier region box overlaps with the object contour, the overlapping area is set as a semantically preserved region, and the candidate privacy locations outside the overlapping area are set as privacy-suppressing regions; a two-layer mask relationship is generated based on the semantically preserved region and the privacy-suppressing region, the pixel channel corresponding to the semantically preserved region is set as the preserved channel, and the pixel channel corresponding to the privacy-suppressing region is set as the suppressed channel, thereby generating the feature mask.

[0014] As a progressive constraint on the backend review process, the review module includes a feature receiving submodule, a model classification submodule, and a cross-validation submodule. The feature receiving submodule receives the deep semantic feature vector, the anonymized thumbnail, and the interface context, and verifies the consistency between the deep semantic feature vector and the region identifiers carried by the anonymized thumbnail, generating a review input object. The model classification submodule reads the deep semantic feature vector from the review input object, inputs the deep semantic feature vector into the compliance classification model, determines candidate review categories based on the violation category range and confidence threshold, and generates candidate classification results including the candidate review categories. The cross-validation submodule compares the candidate classification results with the layout structure information of the anonymized thumbnail, the access path in the interface context, and the business interface type. When the consistency comparison meets the review confirmation conditions, it outputs a confirmed violation result; when the consistency comparison does not meet the review confirmation conditions, it outputs a false alarm result, and determines the confirmed violation result or the false alarm result as the review result.

[0015] Furthermore, the consistency comparison process includes: obtaining the layout structure constraint table corresponding to the candidate review category; reading the access path, request time period, and business interface type from the interface context; determining the access path, request time period, and business interface type as context verification parameters; matching the layout partition position, object adjacency relationship, and area size ratio in the de-identified thumbnail with the layout structure constraint table to generate a layout matching state; when the layout structure constraint corresponding to the candidate review category is consistent with the layout matching state, and the context verification parameters meet the interface call conditions corresponding to the candidate review category, generating a review confirmation state, and using the review confirmation state as the review confirmation condition for outputting the confirmation result of violation.

[0016] As a progressive constraint on the targeted feedback update process for false alarms, the collaborative update module includes a difference calculation submodule, a compensation generation submodule, a node update submodule, and an audit output submodule. When the review result is determined to be a false alarm, the difference calculation submodule obtains the deep semantic feature vector that caused the false alarm, the deep semantic feature vector corresponding to the confirmed violation result, and the corresponding front-end node identifier, and calculates the classification boundary difference based on the category interval direction in the feature space. The compensation generation submodule determines the feature channel to be compensated and the compensation intensity level based on the classification boundary difference, and generates the gradient compensation parameter package. The node update submodule sends the gradient compensation parameter package to the front-end node corresponding to the front-end node identifier and updates the weights of the lightweight initial screening network accordingly. The audit output submodule records the source of the false alarm, the compensation parameter version, and the weight update result, and generates the audit report.

[0017] Furthermore, the calculation process of the classification boundary difference includes: obtaining the false alarm category position of the deep semantic feature vector that caused the false alarm in the feature space, and obtaining the violation category center position of the deep semantic feature vectors corresponding to multiple confirmed violation results in the same feature space; comparing the distance direction, channel offset degree and category interval state between the false alarm category position and the violation category center position to determine the boundary offset parameter; when the boundary offset parameter reaches the false alarm correction threshold, the feature channel corresponding to the boundary offset parameter is determined as the feature channel to be compensated, and the classification boundary difference is generated based on the feature channel to be compensated; when the boundary offset parameter does not reach the false alarm correction threshold, an uncompensated identifier is written into the classification boundary difference, and the initial screening network weights remain unchanged.

[0018] This invention also provides a cybersecurity compliance intelligent inspection method based on front-end and back-end collaboration and AI recognition, executed by the aforementioned system, comprising the following steps: inputting a business image into a lightweight initial screening network to extract a multi-dimensional compliance score; calculating the moving average of historical scores to construct a dynamic baseline; when the weighted distance between the multi-dimensional compliance score and the dynamic baseline exceeds a preset threshold, truncating a suspected violation area; applying a feature mask to the suspected violation area to extract a deep semantic feature vector that retains the violation semantics while filtering out privacy information; simultaneously performing pixel blurring replacement on the text and facial features within the suspected violation area to generate... The de-identified thumbnail is used to input the deep semantic feature vector into the compliance classification model. Cross-validation is then performed using the layout structure information of the de-identified thumbnail and the interface context. The output includes a review result confirming either a violation or a false alarm. If the review result determines it to be a false alarm, the difference in classification boundaries between the deep semantic feature vector that caused the false alarm and the deep semantic feature vector corresponding to the confirmed violation result is calculated in the feature space. A gradient compensation parameter package is generated and distributed based on this difference, and the initial screening network weights of the front-end node that generated the false alarm are updated accordingly. An audit report is then generated based on the review result.

[0019] The present invention has the following beneficial effects: 1. In this invention, by performing lightweight compliance scoring on business images at the front-end node and combining it with the historical score moving average to form a dynamic baseline, abnormal fluctuation identification and suspected violation area interception can be completed before the image enters the back-end, so that subsequent processing focuses on high-risk areas, reduces the transmission of irrelevant image content, and reduces the pressure of centralized review.

[0020] 2. In this invention, by performing feature masking on suspected violation areas, deep semantic feature vectors that retain the violation semantics and filter out privacy information are extracted, and pixel blurring replacement is performed on the text and facial features within the area. This can reduce the risk of exposure of the original sensitive content during transmission, storage, and review while maintaining the integrity of the violation identification basis.

[0021] 3. In this invention, by using deep semantic feature vectors, desensitized thumbnail layout structure information, and interface context together for backend cross-validation, and calculating the classification boundary difference between semantic features and confirmed violation vectors when false alarms occur, a gradient compensation parameter package is generated to update the corresponding frontend weights in a targeted manner, which can improve the accuracy of cross-scenario judgment, the efficiency of false alarm correction, and the completeness of the audit closed loop. Attached Figure Description

[0022] Figure 1 This is the main flowchart of the intelligent network security compliance check of this invention; Figure 2 This is a data flow diagram of front-end dynamic baseline construction and region capture in this invention; Figure 3 This is a logic diagram of the feature masking and desensitization processing of the present invention; Figure 4 This is the back-end cross-verification logic diagram of the present invention; Figure 5 This is a closed-loop diagram for the false alarm-oriented update feedback of the present invention. Detailed Implementation

[0023] The following combination Figures 1 to 5The technical solutions described in this invention will be further explained below. The following embodiments illustrate a network security compliance intelligent inspection system and its execution method based on front-end / back-end collaboration and AI recognition. Business image refers to the image to be inspected collected by the front-end node; multi-dimensional compliance score refers to the score set formed by lightweight initial screening network processing of image block brightness distribution, edge density, layout partitioning, and sensitive object confidence; dynamic baseline refers to the comparison benchmark obtained based on the moving average of historical scores; suspected violation area refers to the image area cropped after the score deviates from the dynamic baseline and exceeds a preset threshold; deep semantic feature vector refers to the feature expression that retains the semantics of violation after suppressing privacy pixel channels; desensitized thumbnail refers to a thumbnail formed by pixel blurring replacement of text pixel blocks and face pixel blocks while retaining the layout boundary. The following modules, sub-modules, data items, and result names are all based on the technical solutions described in the application documents.

[0024] Example 1, please refer to Figures 1 to 5 This embodiment provides a cybersecurity compliance intelligent inspection system based on front-end and back-end collaboration and AI recognition. The system includes an initial screening module, a feature separation module, a verification module, and a collaborative update module. The initial screening module is deployed on the front-end node to perform lightweight initial screening of business images and extract suspected violation areas; the feature separation module converts suspected violation areas into deep semantic feature vectors and de-identified thumbnails; the verification module is deployed on the back-end to output verification results by combining model classification, layout structure, and interface context; the collaborative update module generates gradient compensation parameter packages when the verification result is a false positive, and updates the initial screening network weights of the corresponding front-end node accordingly, while also generating an audit report.

[0025] The initial screening module includes a score extraction submodule, a baseline construction submodule, and a region extraction submodule. The score extraction submodule receives a 1920×1080 resolution business image and obtains the image patch brightness distribution, edge density, layout partitioning, and sensitive object confidence scores (e.g., scores of 0.85, 0.72, 0.91, and 0.88 after extraction). This data is then input into a lightweight initial screening network to generate a multi-dimensional compliance score. The baseline construction submodule reads historical score sequences based on the front-end node identifier, business interface identifier, and image layout category. Historical scores that meet the index consistency condition are weighted according to a time-decreasing relationship and weighted averaged to form a node-level dynamic baseline. When the number of historical scores is lower than the minimum sample size threshold (set to 1000 samples), global historical scores under the same business interface identifier and the same image layout category are retrieved to generate a compensated dynamic baseline. Both the node-level dynamic baseline and the compensated dynamic baseline are output as dynamic baselines to the region extraction submodule.

[0026] After receiving the multidimensional compliance score and dynamic baseline, the region capture submodule calculates the weighted distance between the two, specifically using the Mahalanobis distance formula: ; in, Representing the present Multidimensional compliance scoring vector (including scoring vectors for four dimensions: brightness, edge, layout, and sensitive objects). This represents the dynamic baseline mean vector calculated from historical samples. The matrix representing the inverse of the covariance matrix of the historical multidimensional score sequence. Indicates vector transpose; The formula effectively eliminates the correlation between different scoring dimensions by introducing a covariance matrix, thus more accurately measuring the degree of anomaly in the current feature's deviation from the overall distribution. When the weighted distance does not exceed the suspected violation threshold (set to 2.5), the region cropping submodule does not crop the suspected violation region and records a non-triggered review status. When the weighted distance exceeds the suspected violation threshold, the region cropping submodule locates the image patch boundary based on the scoring dimension with the largest deviation from the dynamic baseline and crops the suspected violation region (usually a 256×256 pixel image patch). The suspected violation region carries a region identifier, which is used for subsequent consistency verification between the deep semantic feature vector and the desensitized thumbnail.

[0027] The feature separation module includes a mask generation submodule, a semantic extraction submodule, and a desensitization generation submodule. After receiving a suspected violation area, the mask generation submodule obtains the texture boundary, object outline, and candidate privacy locations for that area. Candidate privacy locations include text character boxes, facial key region boxes, and account identifier region boxes. The mask generation submodule determines the overlap between the text character boxes, facial key region boxes, account identifier region boxes, and object outlines; when overlap exists, the overlapping area is set as a semantically preserved region, and the candidate privacy locations outside the overlapping area are set as privacy-suppressed regions. Subsequently, the mask generation submodule generates a two-layer mask relationship based on the semantically preserved region and the privacy-suppressed region, setting the pixel channels corresponding to the semantically preserved region as preserved channels and the pixel channels corresponding to the privacy-suppressed region as suppressed channels (in the deep network's total of 512 pixel feature channels, 128 privacy-strongly related channels are suppressed, and the remaining 384 semantically preserved channels are retained), forming a feature mask.

[0028] The semantic extraction submodule inputs the suspected violation area and feature mask into the deep feature extraction network. The deep feature extraction network suppresses the pixel channels marked by occluded weights while preserving the semantic channels corresponding to the outline of the violation object, the relationship between the violation layout and the abnormal texture distribution, outputting a deep semantic feature vector (e.g., a one-dimensional floating-point feature vector of size 1×384). The desensitization generation submodule identifies text and face pixel blocks within the suspected violation area, performs pixel blurring replacement on these blocks, and preserves the layout boundary of the suspected violation area, generating a desensitized thumbnail (e.g., a 64×64 resolution desensitized thumbnail with a scaling ratio of 1:4). Both the deep semantic feature vector and the desensitized thumbnail carry region identifiers, and the desensitized thumbnail provides layout structure information such as layout partition location, object adjacency relationships, and region size ratios.

[0029] The review module comprises a feature receiving submodule, a model classification submodule, and a cross-validation submodule. The feature receiving submodule receives deep semantic feature vectors, de-identified thumbnails, and interface context, and verifies whether the deep semantic feature vectors match the region identifiers carried in the de-identified thumbnails. If the region identifiers match, a review input object is generated; if the region identifiers do not match, the violation confirmation process is skipped, and the abnormal reception status is recorded. The interface context includes the access path (“api / v1 / user / upload”), the request time period (“02:00-03:00”), and the business interface type (“UGC content publishing”), used to subsequently determine whether the candidate review category matches the business interface context.

[0030] The model classification submodule reads deep semantic feature vectors from the input objects for review, inputs these vectors into the compliance classification model, and determines candidate review categories based on the violation category range and a confidence threshold (e.g., setting the confidence threshold to be greater than or equal to 0.85), generating candidate classification results. These candidate classification results are not directly used as the final review results but are instead sent to the cross-validation submodule.

[0031] The cross-validation submodule retrieves the layout structure constraint table corresponding to the candidate review categories and reads the access path, request time period, and business interface type from the interface context, determining them as context validation parameters. The cross-validation submodule matches the layout partition position, object adjacency, and area size ratio in the anonymized thumbnail with the layout structure constraint table to generate a layout matching status. When the candidate review category matches the layout matching status, and the context validation parameters meet the interface call conditions corresponding to the candidate review category, the cross-validation submodule outputs a confirmed violation result; when the candidate review category does not match the layout matching status, or the context validation parameters do not meet the corresponding interface call conditions, the cross-validation submodule outputs a false alarm result. Both confirmed violation results and false alarm results are output as review results to the collaborative update module.

[0032] The collaborative update module includes a difference calculation submodule, a compensation generation submodule, a node update submodule, and an audit output submodule. When the review result is a false positive, the difference calculation submodule obtains the deep semantic feature vector that caused the false positive, the deep semantic feature vector corresponding to the confirmed violation result, and the corresponding front-end node identifier. The difference calculation submodule determines the false positive category position of the deep semantic feature vector that caused the false positive in the same feature space, and determines the violation category center position of the deep semantic feature vectors corresponding to multiple confirmed violation results. Then, it compares the distance direction, channel offset degree, and category interval state between the false positive category position and the violation category center position to determine the boundary offset parameter. The chi-square distance formula is used to quantify the offset degree of each feature channel. ; in, This represents the calculated boundary offset parameter. This represents the deep semantic feature vector that causes false positives. The vector representing the center position of the violation category in the deep semantic feature vector corresponding to the confirmed violation result. The total number of channels representing the feature vector (384 dimensions in this example). and They represent the two in the first place. Response values ​​on each feature channel Represents a minimal constant to prevent the denominator from being zero (with values...) ); When measuring the offset of deep channels with sparse non-negative properties, the formula is more sensitive to capturing the relative probability distribution differences of each small-value feature channel than the conventional Euclidean distance, and accurately determines the differences in classification boundaries.

[0033] When the boundary offset parameter reaches the false alarm correction threshold (e.g., set to 0.15), the difference calculation submodule identifies the feature channel corresponding to the boundary offset parameter as the feature channel to be compensated and generates a classification boundary difference based on this feature channel. The compensation generation submodule determines the feature channel to be compensated and the compensation intensity level based on the classification boundary difference, and generates a gradient compensation parameter package (a lightweight parameter update package with a file size of approximately 1.5MB). The node update submodule distributes the gradient compensation parameter package to the front-end node corresponding to the front-end node identifier and updates the weights of the lightweight initial screening network of that front-end node. When the boundary offset parameter does not reach the false alarm correction threshold, the difference calculation submodule writes an uncompensated identifier into the classification boundary difference and keeps the initial screening network weights unchanged.

[0034] The audit output submodule records the source of false alarms, the version of compensation parameters, and the weight update results, and generates an audit report based on the review results. The source of a false alarm corresponds to the front-end node identifier, the region identifier, and the deep semantic feature vector that triggered the false alarm; the version of the compensation parameters corresponds to the gradient compensation parameter package; and the weight update results correspond to the update status of the node update submodule. The audit report is used to record the traceability relationship between confirmed violation results, false alarm results, compensation parameter versions, weight update results, and corresponding region identifiers.

[0035] Example 2, please refer to Figures 1 to 5 This embodiment provides a cybersecurity compliance intelligent inspection method based on front-end and back-end collaboration and AI recognition. The difference between this embodiment and Embodiment 1 is that this embodiment describes the system execution process with method steps, while the data source, processing rules, output results, and anomaly boundaries remain consistent with the corresponding modules in Embodiment 1.

[0036] S1 inputs the business image into a lightweight initial screening network to extract a multi-dimensional compliance score. It calculates the moving average of historical scores to construct a dynamic baseline. When the weighted distance between the multi-dimensional compliance score and the dynamic baseline exceeds a preset threshold, suspected violation areas are cropped. In S1, the front-end node acquires the image block brightness distribution, edge density, layout partitioning, and sensitive object confidence of the business image (a high-definition business image with a resolution of 1920×1080), and generates a multi-dimensional compliance score. Simultaneously, it reads the historical score sequence based on the front-end node identifier, business interface identifier, and image layout category, and forms a dynamic baseline through moving average processing. When the number of historical scores is insufficient (i.e., less than 1000 samples), it calls the global historical scores under the same business interface identifier and the same image layout category to generate a compensating dynamic baseline. When the weighted distance between the current multi-dimensional compliance score and the dynamic baseline exceeds a preset threshold (the distance calculated using the Mahalanobis distance formula exceeds 2.5), it locates the image block boundary based on the score dimension with the largest deviation and crops the suspected violation area (a 256×256 pixel area); if it does not exceed the threshold, it records a state where no review has been triggered.

[0037] S2 applies a feature mask to suspected violation areas, extracting deep semantic feature vectors that preserve the semantic meaning of the violation while filtering out privacy information. Simultaneously, it performs pixel blurring replacement on text and facial features within the suspected violation areas, generating desensitized thumbnails. In S2, the texture boundaries, object outlines, and candidate privacy locations of the suspected violation areas are first obtained. Then, the overlap status of text character boxes, facial key region boxes, account identifier region boxes, and object outlines is determined. When candidate privacy locations overlap with object outlines, the overlapping area is set as a semantically preserved region, and candidate privacy locations outside the overlapping area are set as privacy-suppressed regions. Subsequently, a feature mask is generated based on the semantically preserved region and the privacy-suppressed region. The suspected violation areas and feature masks are input into the deep feature extraction network, outputting a deep semantic feature vector (a 384-dimensional floating-point vector retained after filtering the privacy channel). Simultaneously, pixel blurring replacement is performed on text and facial pixel blocks to generate desensitized thumbnails (64×64 resolution images).

[0038] S3 inputs the deep semantic feature vector into the compliance classification model and performs cross-validation with the layout structure information of the anonymized thumbnail and the interface context, outputting a review result including confirmed violations or false alarms. In S3, it first verifies whether the region identifiers carried by the deep semantic feature vector and the anonymized thumbnail are consistent; if consistent, a review input object is generated; if inconsistent, an abnormal reception status is recorded. Then, the deep semantic feature vector is input into the compliance classification model, generating candidate classification results based on the violation category range and a confidence threshold (e.g., setting a confidence level ≥ 0.85). During cross-validation, the layout structure constraint table corresponding to the candidate review categories is obtained, and the access path (“api / v1 / user / upload”), request time period (“02:00-03:00”), and business interface type (“UGC content publishing”) in the interface context are read; then, the layout partition position, object adjacency relationship, and region size ratio in the anonymized thumbnail are matched with the layout structure constraint table to form a layout matching status. If the candidate review category matches the layout, and the access path, request time period, and business interface type meet the corresponding interface call conditions, then the confirmed violation result will be output; otherwise, the false alarm result will be output.

[0039] S4, when the review result is determined to be a false alarm, calculates the difference in classification boundaries in the feature space between the deep semantic feature vector that caused the false alarm and the deep semantic feature vector corresponding to the confirmed violation result. Based on this difference, a gradient compensation parameter package is generated and distributed to update the initial screening network weights of the front-end node that caused the false alarm. An audit report is then generated based on the review result. In S4, the false alarm category position in the feature space of the deep semantic feature vector that caused the false alarm, and the violation category center position in the same feature space of the deep semantic feature vectors corresponding to multiple confirmed violation results, are first determined. Then, the distance direction, channel offset degree, and category interval state between the two are compared to obtain the boundary offset parameter (using the aforementioned chi-square distance formula to sensitively capture the distribution differences of channel features). When the boundary offset parameter reaches the false alarm correction threshold (i.e....), the error is corrected. When the false positive error occurs, the corresponding feature channel is identified as the feature channel to be compensated, a classification boundary difference is generated, and a gradient compensation parameter package (approximately 1.5MB of lightweight weight update file) is generated accordingly. The gradient compensation parameter package is then distributed to the corresponding front-end node to update the weights of its lightweight initial screening network. When the boundary offset parameter does not reach the false positive correction threshold, an uncompensated flag is written, and the initial screening network weights remain unchanged. Finally, the source of the false positive, the compensation parameter version, and the weight update results are recorded, and an audit report is generated.

[0040] The system modules, method steps, data items, judgment conditions, output results, and feedback relationships described in the above embodiments are used to illustrate the possible implementations of the present invention and should not be construed as limiting the present invention to the specific embodiments described above. Without departing from the technical solutions described in the present invention and the scope of the application documents, any equivalent substitutions, equivalent modifications, equivalent combinations, order adjustments, module-to-module replacements, equivalent transformations of field names, equivalent inheritance of execution entities, or equivalent changes in carrier forms that can be conceived by those skilled in the art should fall within the scope of protection of this patent; however, the substantive correspondence between technical objects may not be altered through changes in name or number.

Claims

1. A cybersecurity compliance intelligent inspection system based on front-end and back-end collaboration and AI recognition, characterized in that: include: The initial screening module, deployed on the front-end node, is used to input business images into the lightweight initial screening network to extract multi-dimensional compliance scores, calculate the moving average of historical scores to construct a dynamic baseline, and when the weighted distance between the multi-dimensional compliance score and the dynamic baseline exceeds a preset threshold, suspected violation areas are extracted. The feature separation module is used to apply feature masks to the suspected violation area, extract deep semantic feature vectors that retain the violation semantics and filter out privacy information, and at the same time perform pixel blur replacement on the text and face features in the area to generate a desensitized thumbnail. The review module, deployed on the backend, is used to input the received deep semantic feature vector into the compliance classification model, and perform cross-validation by combining the layout structure information of the de-identified thumbnail with the interface context, and output the review result including confirmation of violation or false alarm. The collaborative update module is used to calculate the difference between the deep semantic feature vector that caused the false alarm and the confirmed violation vector corresponding to the confirmed violation result in the classification boundary in the feature space when the review result is determined to be a false alarm. Based on this, a gradient compensation parameter package is generated and distributed to update the initial screening network weights of the front-end node that generated the false alarm in a targeted manner, and an audit report is generated based on the review result.

2. The system according to claim 1, characterized in that, The initial screening module includes a score extraction submodule, a baseline construction submodule, and a region extraction submodule; The scoring extraction submodule obtains the image block brightness distribution, edge density, layout partitioning, and sensitive object confidence of the business image, and inputs the image block brightness distribution, edge density, layout partitioning, and sensitive object confidence into the lightweight initial screening network to generate the multidimensional compliance score; The baseline construction submodule reads the historical scoring sequence formed by the same front-end node within a set time window, performs a moving average on the historical scoring sequence and removes abnormal scores that exceed the discrete threshold, and generates the dynamic baseline. The region capture submodule compares the multidimensional compliance score with the dynamic baseline using a weighted distance. When the weighted distance exceeds the suspected violation threshold, it locates the image block boundary based on the score dimension with the largest deviation from the dynamic baseline and captures the suspected violation region.

3. The system according to claim 2, characterized in that, The process of generating the dynamic baseline includes: Obtain the front-end node identifier, business interface identifier, and image layout category. Use the front-end node identifier, business interface identifier, and image layout category together as the reading index for the historical scoring sequence, and filter historical scores that meet the index consistency condition according to the collection time order. Historical scores that meet the index consistency condition are assigned sliding weights according to a time-decreasing relationship. Historical scores that are closer to the acquisition time of the business image correspond to higher sliding weights. The historical scores are weighted and averaged according to the sliding weights to generate a node-level dynamic baseline, and the node-level dynamic baseline is determined as the dynamic baseline. When the number of historical scores that meet the index consistency condition is lower than the minimum sample size threshold, the global historical scores under the same business interface identifier and the same image layout category are called, the global historical scores are processed by moving average, a compensated dynamic baseline is generated, and the compensated dynamic baseline is determined as the dynamic baseline.

4. The system according to claim 1, characterized in that, The feature separation module includes a mask generation submodule, a semantic extraction submodule, and a desensitization generation submodule; The mask generation submodule obtains the texture boundary, object outline, and candidate privacy location of the suspected violation area, and assigns occlusion weights to the texture boundary and object outline based on the candidate privacy location to generate the feature mask. The semantic extraction submodule inputs the suspected violation area and the feature mask into the deep feature extraction network, suppresses the pixel channels marked by the occluded weights, and retains the semantic channels corresponding to the outline of the violation object, the relationship between the violation layout and the abnormal texture distribution, and outputs the deep semantic feature vector. The desensitization generation submodule identifies text pixel blocks and face pixel blocks within the suspected violation area, performs pixel blurring replacement on the text pixel blocks and face pixel blocks, and preserves the layout outline boundary of the suspected violation area to generate the desensitized thumbnail.

5. The system according to claim 4, characterized in that, The process of generating the feature mask includes: Obtain the text character box, face key region box, and account identifier region box corresponding to the candidate privacy location, and determine the overlap state between the text character box, face key region box, and account identifier region box and the object outline, respectively; When any text character box, face key area box, or account identifier area box overlaps with the object outline, the overlapping area is set as a semantically preserved area, and the candidate privacy location outside the overlapping area is set as a privacy-suppressing area. A two-layer mask relationship is generated based on the semantically preserved region and the privacy-suppressed region. The pixel channel corresponding to the semantically preserved region is set as the preserved channel, and the pixel channel corresponding to the privacy-suppressed region is set as the suppressed channel to generate the feature mask.

6. The system according to claim 1, characterized in that, The verification module includes a feature receiving submodule, a model classification submodule, and a cross-validation submodule; The feature receiving submodule receives the deep semantic feature vector, the desensitized thumbnail, and the interface context, and verifies the consistency between the deep semantic feature vector and the region identifier carried by the desensitized thumbnail, and generates a verification input object; The model classification submodule reads the deep semantic feature vector from the review input object, inputs the deep semantic feature vector into the compliance classification big model, determines the candidate review category based on the violation category interval and confidence threshold, and generates candidate classification results including the candidate review categories; The cross-validation submodule performs a consistency comparison between the candidate classification results and the layout structure information of the de-identified thumbnail, the access path in the interface context, and the business interface type. When the consistency comparison meets the verification and confirmation conditions, it outputs a confirmed violation result; when the consistency comparison does not meet the verification and confirmation conditions, it outputs a false alarm result and determines the confirmed violation result or the false alarm result as the verification result.

7. The system according to claim 6, characterized in that, The consistency comparison process includes: Obtain the layout structure constraint table corresponding to the candidate review category, read the access path, request time period and business interface type from the interface context, and determine the access path, request time period and business interface type as context verification parameters; The layout partition positions, object adjacency relationships, and region size ratios in the desensitized thumbnails are matched with the layout structure constraint table to generate a layout matching state. When the candidate review category matches the layout and the context verification parameters meet the interface call conditions corresponding to the candidate review category, a review confirmation status is generated, and the review confirmation status is used as the review confirmation condition for outputting the confirmation result of violation.

8. The system according to claim 1, characterized in that, The collaborative update module includes a difference calculation submodule, a compensation generation submodule, a node update submodule, and an audit output submodule. When the review result is determined to be a false alarm, the difference calculation submodule obtains the deep semantic feature vector that caused the false alarm, confirms the deep semantic feature vector corresponding to the violation result and the corresponding front-end node identifier, and calculates the classification boundary difference based on the category interval direction in the feature space. The compensation generation submodule determines the feature channels to be compensated and the compensation intensity level based on the classification boundary differences, and generates the gradient compensation parameter package; The node update submodule sends the gradient compensation parameter package to the front-end node corresponding to the front-end node identifier and updates the weights of the lightweight initial screening network accordingly. The audit output submodule records the source of false alarms, the version of compensation parameters, and the weight update results, and generates the audit report.

9. The system according to claim 8, characterized in that, The calculation process for the difference in classification boundaries includes: Obtain the false alarm category position of the deep semantic feature vector that caused the false alarm in the feature space, and obtain the violation category center position of the deep semantic feature vectors corresponding to multiple confirmed violation results in the same feature space; By comparing the distance direction, channel offset degree, and category interval status between the location of the false alarm category and the center location of the violation category, the boundary offset parameters are determined. When the boundary offset parameter reaches the false alarm correction threshold, the feature channel corresponding to the boundary offset parameter is determined as the feature channel to be compensated, and the classification boundary difference is generated based on the feature channel to be compensated. When the boundary offset parameter does not reach the false alarm correction threshold, the no-compensation flag is written into the classification boundary difference, and the initial screening network weight remains unchanged.

10. A cybersecurity compliance intelligent inspection method based on front-end and back-end collaboration and AI recognition, characterized in that: The system according to any one of claims 1-9 is executed, comprising the following steps: The business image is input into a lightweight screening network to extract a multidimensional compliance score. The moving average of the historical scores is calculated to construct a dynamic baseline. When the weighted distance between the multidimensional compliance score and the dynamic baseline exceeds a preset threshold, the suspected violation area is cropped. A feature mask is applied to the suspected violation area to extract a deep semantic feature vector that retains the violation semantics while filtering out privacy information. At the same time, the text and facial features in the suspected violation area are pixel-blurred and replaced to generate a desensitized thumbnail. The deep semantic feature vector is input into the compliance classification model, and cross-validation is performed by combining the layout structure information of the de-identified thumbnail with the interface context, and the output includes the verification result of confirming violation or false alarm. When the review result is determined to be a false alarm, the difference between the deep semantic feature vector that caused the false alarm and the deep semantic feature vector corresponding to the confirmed violation result in the classification boundary in the feature space is calculated. A gradient compensation parameter package is generated and distributed based on the difference in classification boundary. The initial screening network weights of the front-end node that generated the false alarm are updated in a targeted manner. An audit report is generated based on the review result.

Images