Risk early warning method and system and electronic equipment

Abstract

The invention relates to the technical field of risk management and early warning, and discloses a risk early warning method comprising the following steps: collecting multi-source data including structured data, unstructured data and time series data; the invention provides a risk early warning system, which is used for performing cleaning, standardization processing and fusion on multi-source data to generate a unified data set for analysis, and comprises a data acquisition module used for acquiring the multi-source data including structured data, unstructured data and time sequence data; the data processing module is used for carrying out cleaning, standardization processing and fusion on the multi-source data and generating a unified data set, the electronic equipment comprises a memory, a processor and a communication module, and the processor implements the risk early warning method during execution. Through multi-source data fusion, a dynamic threshold model and deep learning analysis, the risk is accurately identified, the method adapts to the dynamic environment in real time, false alarms and missing alarms are reduced, and the long-term monitoring adaptability is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of risk management and early warning, and specifically to a risk early warning method, system and electronic device. Background Art

[0002] With the in-depth promotion of the development of information technology and digitalization, enterprises' dependence on data centers, cloud computing platforms and key IT infrastructure is increasing day by day. These systems not only carry a large amount of data flow, but also support the operation of the core business of enterprises. Therefore, ensuring the stable operation of these systems is crucial for business continuity and service quality.

[0003] The prior art has made certain progress in the field of risk early warning. For example, traditional monitoring methods based on a single data source can trigger alarms through fixed thresholds, so as to achieve the detection of certain significant anomalies. In addition, simple statistical analysis and rule-based risk judgment technologies also provide certain monitoring capabilities for certain specific scenarios. The advantages of these methods are simple implementation, low application cost, and certain practicability in a relatively stable operating environment.

[0004] However, the prior art still has significant deficiencies in dealing with complex risk scenarios, which limit its effect and scope in practical applications; firstly, existing methods usually only rely on a single data source for analysis, it is difficult to comprehensively reflect the system operation status, and it is easy to miss the deep association features between multi-source data; secondly, the traditional static threshold model cannot adapt to the dynamically changing business environment, resulting in frequent false alarms or serious missed alarms; in addition, shallow analysis means lack the ability to identify complex risk patterns, and it is difficult to capture hidden multi-modal features or potential risks spreading across systems; finally, existing technologies usually lack dynamic optimization capabilities during long-term operation, and cannot adjust the model according to historical data, resulting in poor system adaptability and difficulty in meeting the requirements of the constantly changing environment. Summary of the Invention

[0005] In view of the deficiencies of the prior art, the present invention provides a risk early warning method, system and electronic device, which solves the problems in the prior art that single data source monitoring cannot comprehensively reflect the system operation status, static threshold models are difficult to adapt to dynamic environmental changes, shallow analysis means cannot identify complex risk patterns, and the lack of dynamic optimization capabilities of the model leads to poor adaptability.

[0006] To achieve the above object, the present invention is realized through the following technical solutions: A risk early warning method, including the following steps: collecting multi-source data, including structured data, unstructured data and time series data; cleaning, standardizing and fusing the multi-source data to generate a unified data set for analysis; Extract features from a unified dataset based on a deep learning model to generate risk feature vectors; Construct a risk knowledge graph and perform semantic association analysis based on the knowledge graph to determine risk factors; Establish a dynamic threshold model and calculate the dynamic threshold based on time series data and real-time environmental factors; Combine the risk feature vectors with the dynamic threshold to detect whether the real-time monitoring data deviates from the risk index range; Calculate the risk score according to the detection result and trigger warnings of corresponding levels; Record the warning trigger results and perform model iterative optimization in combination with historical data.

[0007] Preferably, the collection of multi-source data includes: Structured data, collected from system performance indicators, network traffic logs, and monitoring instrument data; Unstructured data, collected from alarm logs, fault reports, and email records; Time series data, collected from historical alarm trends and real-time health status data.

[0008] Preferably, the generation of a unified dataset for analysis includes: Perform noise removal on multi-source data and remove data beyond the set range based on statistical analysis methods; Align and interpolate data with different timestamps to ensure consistency in the time dimension; Use the modal balance fusion algorithm to unify the features of structured data and unstructured data into a vector space.

[0009] Preferably, the extraction of features from the unified dataset to generate risk feature vectors includes: Use a long short-term memory network to perform dynamic feature extraction on time series data; Use a text embedding model to generate semantic feature vectors for unstructured text data; Fuse structured features, time series features, and unstructured features through an attention mechanism to generate multi-modal risk features.

[0010] Preferably, the construction of the risk knowledge graph includes: Risk entities, including device nodes, system modules, and business processes; Risk relationships, including dependency relationships and impact relationships; Attribute information, including risk levels and key factors.

[0011] Preferably, the establishment of the dynamic threshold model includes: Within a fixed time interval, the dynamic threshold calculates the basic predicted value through a time series prediction model; Adjust the basic prediction value in combination with real-time environmental factors to generate the final dynamic threshold.

[0012] Preferably, the operations of the risk detection include: Compare the real-time monitoring data with the dynamic threshold and calculate the deviation degree; Judge whether there is a potential risk according to the deviation degree and the preset risk threshold range.

[0013] Preferably, the operations of recording the early warning trigger result include: Record the real-time health status changes and historical alarm trends in the time series data; Generate an information log including risk score, deviation degree and trigger time based on the specific situation of the early warning trigger; Conduct correlation analysis on the triggered early warning result and the historical alarm trend, and extract the behavior patterns of specific risk factors; Transfer the parameters required in the model iteration optimization process to the optimization module according to the recorded health status data and risk patterns.

[0014] The present invention also provides a risk early warning system, including: A data acquisition module for acquiring multi-source data, including structured data, unstructured data and time series data; a data processing module for cleaning, standardizing and fusing the multi-source data to generate a unified data set; A risk analysis module for extracting features from the unified data set based on a deep learning model, constructing a risk knowledge graph, and determining risk factors; A dynamic threshold module for generating a dynamic threshold based on time series data and real-time environmental factors; A risk detection module for detecting the deviation between the real-time monitoring data and the dynamic threshold and calculating the risk score; An early warning trigger module for triggering early warnings of corresponding levels according to the risk score; A model optimization module for recording the early warning trigger result and iteratively optimizing the risk analysis module in combination with historical data.

[0015] The present invention also provides an electronic device, including a memory, a processor and a communication module, and the processor realizes the risk early warning method when executed.

[0016] The present invention provides a risk early warning method, system and electronic device. It has the following beneficial effects: 1. Through the collection and fusion technology of multi-source data, the present invention comprehensively covers structured, unstructured, and time-series data, not only improving the data quality but also laying a solid foundation for subsequent analysis. Compared with the existing technology that relies on a single data source, the present invention solves the problems of single data and incomplete information, realizing the possibility of multi-dimensional risk analysis.

[0017] 2. The present invention adopts a dynamic threshold model, combines time-series data and real-time environmental factors, and generates a threshold adapted to the current state in real time to accurately capture system anomalies. Compared with the traditional technical solution that relies on a fixed threshold, the present invention effectively reduces false alarms and missed alarms, providing higher sensitivity for system monitoring in a dynamic environment.

[0018] 3. Through the combination of a deep learning model and a risk knowledge graph, the present invention deeply mines the hidden risk patterns in complex data, accurately identifies key risk factors and their propagation paths. Different from the shallow analysis means of the existing technology, the present invention breaks through the bottleneck of incomplete identification of complex risk scenarios, greatly improving the accuracy and comprehensiveness of risk identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is the flowchart of the method of the present invention; Figure 2 is the system structure diagram of the present invention; Figure 3 is the processing diagram of the electronic device of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the specification of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0021] Please refer to the attached Figure 1 , the embodiments of the present invention provide a risk warning method, including the following steps: S1. Multi-source data collection: Collect multi-source data, including structured data, unstructured data, and time series data. This step involves the acquisition and preliminary classification of multi-source data, laying a foundation for subsequent data processing, analysis, and risk detection. The types of multi-source data cover a wide range, including but not limited to structured data, unstructured data, and time series data. As an option, the collection method of multi-source data needs to combine sources such as system performance indicators, network log streams, and device alarm records, ensuring both the richness of data types and meeting the complex requirements in the system operating environment. Specifically, the data collection process needs to ensure the integrity and quality of data from multiple dimensions; The collected data is mainly divided into: Structured data, including but not limited to performance indicator data (such as CPU load, memory usage rate), network traffic logs, and monitoring instrument data; Unstructured data, including alarm logs, fault reports, and email records, etc. These data usually exist in text form and cannot be directly processed, and semantic conversion is required; Time series data, including historical alarm trends, real-time health status, etc., which change with time as an index and can reflect the dynamic behavior of system operation.

[0022] As an option, the collection of log data can be implemented through file collection tools. Specifically, log files are extracted and transmitted to the data storage module in real time through predefined interfaces. In each record of the extracted log data, it usually includes a timestamp, data source identifier, data content, and anomaly flag, ensuring that subsequent steps can accurately analyze the data.

[0023] In a possible implementation, system performance indicators and network traffic logs are collected in real time through API interfaces in the monitoring system. These data usually contain the following characteristics: timestamp t, metric name, metric value v t , identifier ID of the collection source. In a specific implementation, performance indicator data is classified and stored through the following formula:

[0024] where: t represents the time point of data collection; v t represents the performance indicator value at the corresponding time point; ID represents the identifier of the data source; are the sets of all time points, metric values, and identifiers respectively; For the collection of unstructured data, in this embodiment, an OCR tool is used to extract text content from scanned fault reports or handwritten records. Text parsing techniques (such as natural language processing tools based on spaCy or NLTK) further perform semantic conversion on the text data. As an option, the extracted text content is tokenized and mapped into a vector representation, for example, weighted modeling is performed through the TF-IDF method: TF-IDF(t, d) = TF(t, d) × IDF(t)

[0025] Among them: TF(t, d) represents the term frequency of term t in document d; IDF(t) represents the inverse document frequency of the term, which is used to reduce the weight of high-frequency words; the result is stored as a feature vector for subsequent processing.

[0026] The acquisition of time series data depends on a real-time monitoring system. As an implementation method, the system will record historical trends and real-time changes through sensors or monitoring instruments. For example, certain sensors can record the device temperature, pressure, or current value in real time. These data are indexed by timestamps and stored as a time series data set:

[0027] Among them: t represents the timestamp, and v t represents the value of the time series data at time point t, and v t is the collected metric value or status value, representing a specific metric of the system at time point t. t is the timestamp of the data, representing the specific time point of data acquisition, and D time represents the set of all time series data in the system; Generally, the acquisition period of performance metric data is configured according to actual requirements. For example, CPU load and memory occupancy are usually collected per minute, while network traffic logs may need to be collected at the second level. In addition, the extraction of alarm logs and fault reports can be dynamically updated in the way of event triggering; In a possible implementation method, the acquisition module will automatically adjust the acquisition frequency according to the importance of the data. For example, when the system running state is close to high load, the acquisition module will increase the data acquisition frequency to ensure data integrity in high-risk states; As an extension, the data acquisition module can also work in cooperation with edge computing devices. After preliminary data filtering and aggregation are implemented in the edge device, only key information is transmitted to the central storage module. This method can reduce the pressure of network transmission and improve the overall efficiency of the acquisition system at the same time; S2. Data cleaning and fusion: Clean, standardize, and fuse multi-source data to generate a unified data set for analysis; To make this data available and consistent, this step performs cleaning, standardization, and fusion operations on the data to generate a unified data set for subsequent analysis. Generally, data cleaning is a necessary processing step to improve data quality, while standardization and data fusion are used to solve the format differences and information distribution problems of multi-source data. As an option, the data fusion method used in this step can dynamically adapt to the characteristics of different data sources and provide high-quality input for subsequent deep learning models.

[0028] Specifically, this step includes operations such as noise removal, time alignment, and modal balance fusion of data. These operations not only ensure data integrity but also solve the problems brought about by the heterogeneity of data sources. In one possible implementation, different data types are processed separately and then fused into a unified data vector space, enabling structured data, unstructured data, and time series data to participate in subsequent analysis collaboratively.

[0029] Generally, there are outliers and noise interferences in data collection. As a possible implementation, the collected data is cleaned through statistical analysis methods. Specifically, the noise removal uses the standard score method to screen outliers in the data. The calculation formula for the standard score is as follows:

[0030] where: z is the standard score; x is the value of the data point; μ is the mean of the data set; σ is the standard deviation of the data set.

[0031] Generally, when x > 3, it is considered that this data point is an outlier and is removed from the data set. This method can effectively remove extreme abnormal data caused by sensor failures or network fluctuations.

[0032] In some embodiments, for the missing values in time series data, an interpolation algorithm can be used to fill them. Specifically, the linear interpolation method is used to predict the values of the missing points. The interpolation calculation formula is as follows:

[0033] where: v missing represents the predicted value of the missing time point; respectively represent the values of the known data points adjacent to the missing point; t missing , t1, and t2 respectively represent the missing time point and its adjacent known time points.

[0034] This interpolation method is applicable to scenarios where the data changes relatively smoothly, such as filling the data recorded by temperature sensors. In other embodiments, more complex interpolation algorithms can be selected according to the business scenario, such as spline interpolation or moving average interpolation.

[0035] The standardization processing of data is mainly used to convert data from different sources into a unified scale for subsequent fusion operations. As an option, standardization can be achieved through min-max scaling or Z-Score standardization.

[0036] In one possible implementation, the min-max scaling method is used to map the values of all data to the interval [0, 1]. The calculation formula is as follows:

[0037] Where: x' represents the data after standardization; x represents the original data point; min(x) and max(x) respectively represent the minimum and maximum values of the data set.

[0038] In another implementation, Z-Score standardization is used to process the data; After completing data cleaning and standardization processing, it is necessary to perform a fusion operation on structured data, unstructured data, and time series data to generate a unified data set.

[0039] As an option, structured data and time series data can be directly input as numerical features. Unstructured data needs to be mapped to a vector space after feature extraction. For example, the TF-IDF method can be used to weight text data, and its calculation formula is:

[0040] Where: TF(t, d) represents the term frequency of term t in document d; N represents the total number of documents; DF(t) represents the number of documents containing term t.

[0041] Specifically, the extracted text features can participate in feature fusion together with structured data and time series data. To achieve modal balance fusion, the weighted average method is used in this embodiment to integrate different data modalities, and the calculation formula is as follows: F = w1·F struct + w2·F text + w3·F time

[0042] Where: F represents the finally fused feature vector; F struct , F text , F time respectively represent the feature vectors of structured data, unstructured data, and time series data; w1, w2, and w3 are the weights of different data modalities respectively. The weight values can be dynamically adjusted according to the importance of the data. For example, in the scenario of equipment fault diagnosis, the weight w2 of unstructured text is usually higher; To improve the efficiency of data processing, structured data can be stored in partitions and the parallel processing method can be adopted. Specifically, a distributed computing framework (such as Hadoop or Spark) can be used to batch process the data. The cleaning and interpolation of time series data can be completed at the edge node, thereby reducing the data transmission delay.

[0043] In addition, in some scenarios, the fused data set can also be appended with context information (such as the acquisition time period or data source) to optimize specific scenarios for subsequent analysis.

[0044] S3. Feature extraction: Extract features from the unified data set based on a deep learning model to generate a risk feature vector; In this step, the data is processed by a deep learning model to extract key features and generate a risk feature vector for risk analysis. Generally, feature extraction needs to take into account the diversity and specificity of the data. Therefore, the present invention adopts a multi-modal feature extraction design. Specifically, different types of data are processed by corresponding deep learning models respectively, and then a unified feature vector is generated by using a fusion mechanism.

[0045] As an option, time series data is modeled using a long short-term memory network (LSTM) to capture the dynamic changes in the system operation. Unstructured text data generates semantic feature vectors through a natural language processing model (such as BERT), while structured data undergoes feature transformation through a fully connected layer. In a possible implementation, the multi-modal feature vectors are fused through an attention mechanism to finally generate a risk feature vector, providing high-quality input for subsequent risk detection and scoring.

[0046] Time series data is a dynamic reflection of the system operation state, and its features have temporal continuity and dependence. To fully capture these characteristics, this embodiment uses a long short-term memory network (LSTM) to model the time series data. Generally, LSTM can effectively retain the long-term dependence relationship in the time series through its built-in memory unit and gating mechanism.

[0047] Specifically, the time series data is input into the LSTM network in a sequence form and outputs the feature vector of the time series after multiple layers of calculations. Assuming the input time series is , then the calculation formula of LSTM is as follows: f t =σ(W f ·[h t-1 , x t +b f ) i t =σ(W i ·[h t-1 , x t +b i ) o t =σ(W o ·[h t-1 , t +b o ) h t =o t ·tanh(Ct )

[0048] Where: f t : The activation value of the forget gate, used to determine whether to retain the previous state information at the current moment; i t : The activation value of the input gate, used to control the update of the memory cell by the current input; Candidate memory cell state; C t : Memory cell state, used to retain long-term dependency information in the time series; O t : The activation value of the output gate, used to control the output of the hidden state; h t : Hidden state, representing the feature vector at time step t; W f , W i , W C , W o : Weight matrices, corresponding to the forget gate, input gate, memory cell, and output gate respectively; b f , b i , b C , b o : Bias terms; σ activation function; tanh: Hyperbolic tangent function.

[0049] In a possible implementation, the final output H = {h1, h2,..., h T} of the LSTM is used as the feature representation of the time series. These features can not only reflect the current system state but also contain the contextual understanding of the historical state; Unstructured text data usually comes from alarm logs, fault reports, or emails, and its data form has the characteristics of non-linearity and context correlation. For this reason, this embodiment adopts a deep learning-based text embedding model (such as BERT) to extract text semantic features. Generally, the BERT model encodes text data through a bidirectional Transformer structure to generate context-related embedding vectors.

[0050] Specifically, the input text is first tokenized into a series of tokens, denoted as {w1, w2,..., w N}, and after being encoded by multiple layers of the Transformer of the BERT model, a semantic vector E = {e1, e2,..., e N} is generated. The core calculation formula of the model is as follows:

[0051] Where: Q, K, V: Represent the matrices of query, key, and value respectively; d k : The dimension of the key vector; Softmax: Used to calculate the weight distribution.

[0052] In a possible implementation, the text embedding vector E is pooled into a global semantic feature representation e, which can describe the risk information implicit in the text.

[0053] After extracting the time series features and text semantic features, it is necessary to fuse these features with the features of the structured data to generate a unified risk feature vector. As an option, this embodiment uses an attention mechanism to perform weighted fusion on different modality features, and the calculation formula is as follows:

[0054] Where: F risk : The fused risk feature vector; F i : Feature vectors of different modalities, including time series features, text semantic features, and structured data features; α i : Attention weights, calculated by the following formula:

[0055] Where e j represents the importance score of the feature F i ; α i represents the weight of the i-th feature vector F i in the fusion; exp represents the exponential operation on the feature score e j to amplify the differences between scores; represents the sum of the exponential values of all feature scores, used for normalization calculation; N represents the total number of feature vectors to be fused; S4. Knowledge graph construction: Construct a risk knowledge graph and perform semantic association analysis based on the knowledge graph to determine risk factors; In this step, by constructing a risk knowledge graph and combining semantic association analysis, risk factors and their relationships are determined. Generally, a knowledge graph is a graphical structure used to represent entities and their relationships, and can reveal hidden risk patterns through the associations between entities. As an option, the knowledge graph can describe device nodes, business modules, system dependencies, and their key attributes, and is particularly suitable for cross-system and cross-module risk analysis.

[0056] Specifically, this step includes two main links: the construction of the knowledge graph and semantic association analysis. In the knowledge graph construction link, risk-related entities, relationships, and attributes are represented in the form of triples and stored in a graph database. In the semantic association analysis link, a graph neural network (GNN) is used to perform in-depth analysis on the knowledge graph to discover potential risk factors and key paths. In a possible implementation, through the dynamic update of the knowledge graph, the system can adapt to environmental changes and continuously improve the accuracy of risk identification.

[0057] Generally, the construction of a knowledge graph requires extracting entities, relationships, and attributes from multi-source data. In this embodiment, a rule-based entity relationship extraction technology and text analysis technology are adopted to generate triples containing risk-related information.

[0058] As an option, device nodes and performance metrics can be directly extracted from structured data. For example, for performance logs, the host name or module name in the log can be extracted as an entity, and the performance metric value in the log can be used as an attribute of the entity. In addition, for unstructured text data (such as alarm records and fault reports), through named entity recognition (NER) and relationship extraction (RE) technologies, entities and their relationships are identified. Specifically, the alarm log "The CPU usage rate of server A has increased abnormally" can be parsed into the following triple: (Server A, CPU usage rate abnormal, increased abnormally)

[0059] In a possible implementation, the generated triples are formalized as: (E i , R ij , E j )

[0060] Where: E i , E j represents an entity, such as "Server A" or "CPU usage rate"; R ij represents the relationship between entities, such as "abnormal" or "dependent"; through multiple rounds of parsing, a relationship network reflecting the risk propagation path can be dynamically constructed.

[0061] After construction, all triples will be stored in a graph database (such as Neo4j or ArangoDB) to support dynamic querying and updating.

[0062] Through the constructed knowledge graph, the relationships between entities can be deeply analyzed to identify potential risk factors and their propagation paths. Generally, semantic association analysis can be achieved through a graph neural network (GNN). A GNN is a deep learning model that can capture the relationships between nodes in a graph structure and is particularly suitable for semantic analysis of knowledge graphs.

[0063] In a possible implementation, the nodes and edges in the knowledge graph are transformed into the input of the graph neural network, and the feature embeddings of each node are calculated through the GNN model, and then the importance of the nodes and the weights of the edges are inferred. The update formula of the GNN is as follows: Where: The feature vector of node v at the k-th layer; The set of neighbor nodes of node v; c vu: The normalization factor for node v and its neighbor node u, used to eliminate the influence of the number of node connections; W (k) , are the weight matrices of the neighbor node and the target node respectively; σ: activation function (such as ReLU function).

[0064] Through multi-layer propagation, GNN can aggregate context information into the feature representation of the target node. For example, in risk analysis, through the calculation of the graph neural network, it can be found that the abnormal state of server A may spread to server B through dependencies, thereby affecting the entire business module.

[0065] To adapt to the changes in the system environment, the knowledge graph needs to be able to be dynamically updated. For example, when a new device node is added or a new risk event occurs, the graph will automatically add new nodes and relationships. In some embodiments, through the analysis of real-time monitoring data, the entity attributes in the graph can be dynamically updated. For example, when the memory occupancy rate of a certain server exceeds the threshold, the node attribute in the graph will be marked as "high risk".

[0066] As a possible implementation, the update rule can be defined by the following logical expression: where: Metric(E i ): The metric value of entity E i (such as CPU usage rate or memory occupancy rate); Threshold, LowerThreshold: The upper and lower threshold values of the risk level.

[0067] Through the above dynamic update rule, a rapid response to new risk scenarios can be achieved; S5, Dynamic Threshold Modeling: Establish a dynamic threshold model and calculate the dynamic threshold based on time series data and real-time environmental factors; In this step, by constructing a dynamic threshold model and combining time series data and real-time environmental factors, the threshold suitable for the current scenario is calculated. Generally, traditional static threshold models are difficult to cope with the complex dynamic changes of the system, which may lead to false alarms or missed alarms. As an improvement, the dynamic threshold model of the present invention adjusts the threshold range in real time on the basis of fully considering historical trends and real-time environmental factors to enhance the sensitivity and accuracy of anomaly detection.

[0068] Specifically, in this step, a time series prediction model (such as ARIMA or Prophet) is used to analyze the trend of historical data and calculate the basic threshold. At the same time, by introducing real-time environmental factors (such as load, resource utilization rate or seasonal fluctuations), the threshold range is further adjusted so that the dynamic threshold can more accurately adapt to the current system state. In a possible implementation, the dynamic threshold is generated by a weighted combination of the basic prediction value and the environmental factor, and upper and lower limits are set to avoid extreme changes.

[0069] In general, the change trend of time - series data is the core basis for determining the dynamic threshold. In this embodiment, an autoregressive integrated moving average model (ARIMA) is used to model the time series. Specifically, the ARIMA model can capture the trend, periodicity, and random volatility of the time series by integrating three parts: autoregressive (AR), differencing (I), and moving average (MA).

[0070] In a possible implementation, the prediction process of the ARIMA model includes the following calculation formula: X t = φ1X t-1 + φ2X t-2 +…+ φ p X t-p + ∈ t + θ1∈ t-1 +…+ θ q ∈ t-q where: X t : The observed value at time t; φ1, φ2, …, φ p : The coefficients of the autoregressive terms; p: The order of the autoregressive terms; ∈ t : The random error at time t; θ1, …, θ q : The coefficients of the moving - average terms; q: The order of the moving - average terms.

[0071] As an option, for time - series data with obvious periodicity, the Prophet model is used for prediction. This model combines trend, periodicity, and holiday effects for modeling, and its prediction formula is: y(t)= g(t)) + s(t)+ h(t)+ ∈ t

[0072] where: y(t): The predicted value at time t; g(t): The trend function, used to represent the long - term change trend; s(t): The periodic function, used to capture short - term fluctuations; h(t): The holiday - effect function, used to describe the impact of external events on the data; ∈ t : The random error term.

[0073] Through the above - mentioned time - series prediction model, the basic threshold of the time series can be generated to reflect the normal fluctuation range of historical data.

[0074] In general, real - time environmental factors can reflect the dynamic changes of the current system state. In this embodiment, the real - time environmental factors include, but are not limited to, the following categories: System load, such as CPU usage rate, memory occupancy rate; Network traffic, such as bandwidth utilization rate, packet loss rate; Seasonal factors, such as a surge in traffic during peak hours.

[0075] As an option, the real-time environmental factor can be expressed by the following formula:

[0076] where: EnvFactor: real-time environmental factor; F i : real-time value of the i-th environmental variable; w i : weight corresponding to the environmental variable; N: number of environmental variables.

[0077] In a possible implementation, the weights are dynamically adjusted according to the correlation in historical data. For example, when the system load has a greater impact on anomaly detection, the weights of load-related variables can be increased; After calculating the base threshold and the environmental factor, the dynamic threshold is generated through weighted combination, and the specific formula is: where: Threshold(t): dynamic threshold at time t; Base prediction value at time t, generated by a time series prediction model; EnvFactor: real-time environmental factor; α, β: weighting coefficients used to balance the influence of the base prediction value and the environmental factor.

[0078] As an extension, upper and lower limits can be set for the dynamic threshold to avoid the threshold being too large or too small due to short-term fluctuations. The calculation formulas for the upper and lower limits are: LowerBound(t) = Threshold(t) - γ·σ UpperBound(t) = Threshold(t) + γ·σ where: LowerBound(t), UpperBound(t): lower and upper limits of the threshold at time t; σ: standard deviation of historical data, used to represent the normal fluctuation range of the data; γ: upper and lower limit adjustment factor; Generally, the dynamic threshold model can adapt to the real-time changes in system operation and has high flexibility. For example, when the network traffic suddenly increases, the dynamic threshold model will automatically adjust the threshold range to avoid false alarms. As a possible implementation, the parameters of the dynamic threshold model can be further optimized through machine learning algorithms, such as adjusting the weights α and β using historical anomaly data.

[0079] In addition, for a system with complex dependencies, independent dynamic thresholds can be set for different modules or nodes. For example, in a distributed system, the threshold of the master node may need to consider the state changes of the slave nodes. This hierarchical dynamic threshold design can improve the accuracy of anomaly detection in the system.

[0080] S6, Risk detection: Combine the risk feature vector with the dynamic threshold to detect whether the real-time monitoring data deviates from the risk indicator range; The goal of this step is to combine the dynamic threshold generated in the previous step with the multi-modal risk feature vector to detect whether the real-time monitoring data deviates from the normal range, so as to identify potential risk states. Generally, the real-time monitoring data is a direct reflection of the system operating state. By comparing it with the dynamic threshold, it can be judged whether there are abnormal phenomena. However, since a single data source may not fully characterize the system state, the present invention further combines the multi-modal risk feature vector to correct and optimize the detection result to ensure the accuracy and comprehensiveness of anomaly detection.

[0081] Specifically, this step includes two parts: First, based on the direct comparison between the real-time monitoring data and the dynamic threshold, the deviation degree is calculated; Second, the risk feature vector is used to perform weighted adjustment on the deviation result to generate a comprehensive deviation score. In a possible implementation, the system determines whether the current monitoring state is abnormal by setting a threshold for the deviation score and classifies the type of anomaly.

[0082] Generally, the dynamic threshold model provides the normal fluctuation range of the monitoring data. In this embodiment, the real-time monitoring data calculates the deviation degree by directly comparing with the dynamic threshold range. The calculation formula is as follows: Where: ΔR: Deviation degree, indicating the degree to which the real-time monitoring data V t deviates from the dynamic threshold; V t : Real-time monitoring data at time t; Threshold(t): Dynamic threshold at time t, generated by the dynamic threshold model in step S5.

[0083] As an option, the calculation method of the deviation degree can be adjusted according to different types of monitoring data. For example, for indicators with obvious upper and lower limits (such as CPU usage rate), upper and lower limit constraints can be set for the deviation degree to avoid excessive deviation results caused by noise.

[0084] Specifically, when the deviation degree ΔR exceeds the preset risk threshold, mark this time point as a potential abnormal state. In addition, in the scenario of multi-source data analysis, the deviation degrees of different data sources can be calculated separately to form a multi-dimensional deviation result; after completing the comparison between the real-time data and the dynamic threshold, this embodiment further combines the multi-modal risk feature vector to perform weighted adjustment on the deviation result to generate a comprehensive deviation score.

[0085] The calculation formula of the comprehensive deviation score is:

[0086] Where: R score : Comprehensive deviation score, used to characterize the overall abnormal degree of the current system state; w i : Weight of the i-th data modality; ΔR i : Deviation degree of the i-th data modality; N: Number of data modalities.

[0087] In a possible implementation, the weight w i is dynamically adjusted according to the feature importance. For example, for key performance indicators (such as network latency), a higher weight can be assigned to highlight its impact on the comprehensive score. In addition, the weight can be optimized through machine learning algorithms to further improve the accuracy of the comprehensive score; As an extension, each dimension feature of the risk feature vector can also participate in the score adjustment. Assuming the feature vector is , then the comprehensive deviation score can be further expressed as: where: v j : the weight of the j-th feature in the feature vector; f j : the value of the j-th feature in the feature vector; R score : used to characterize the overall abnormality degree of the current monitoring state.

[0088] After calculating the comprehensive deviation score, the abnormal state can be classified according to the score range. Generally, the rule of abnormal classification can be expressed as: where: R1, R2: score thresholds, corresponding to the demarcation points of low, medium, and high risks respectively; Category: abnormal classification result.

[0089] As an option, different response strategies can be set for each type of abnormal state. For example, for low-risk abnormalities, only log records are made, while for high-risk abnormalities, an alarm is immediately triggered and a detailed report is generated.

[0090] Generally, the detection and scoring method of this step can adapt to the complex characteristics of multi-modal data. For example, for time series data, the deviation degree can be calculated separately and corrected in combination with historical trends. For unstructured data, the comprehensive score can be indirectly affected through the risk feature vector; In addition, the scoring method of this embodiment also supports real-time analysis. In a high-frequency monitoring scenario, the system can dynamically update the comprehensive score at a fixed time interval and output the detection results in real time. This design is particularly suitable for real-time monitoring environments with high concurrency and large data volumes, S7. Risk scoring and warning: Calculate the risk score according to the detection results and trigger warnings of corresponding levels; This step includes the following links: calculation of the comprehensive risk score, grading and mapping of the risk score, and trigger mechanism of corresponding warnings. In a possible implementation, the risk score is calculated by integrating multi-dimensional features and historical trend information to maximize the accuracy and interpretability of the score, and at the same time, the score value is used to trigger warning information to notify relevant personnel or execute automated responses; Generally, the comprehensive risk score is the quantitative result of the system's current risk level. In this embodiment, the comprehensive risk score is based on the deviation score and the weighted calculation formula of the risk feature vector is as follows: Where: S risk : The comprehensive risk score, used to represent the current risk level of the system; R score : The comprehensive deviation score, indicating the degree of deviation between the real-time data and the dynamic threshold; F = {f1, f2,..., f k}: The risk feature vector, representing the risk features extracted from multi-modal data; v j : The weight of the j-th feature in the risk feature F; α, β: The weighting coefficients, respectively used to adjust the influence of the deviation score and the risk feature on the comprehensive score; As an option, the values of α and β can be optimized through historical data. For example, in some specific scenarios, the influence of the deviation score may be greater, and at this time, the weight of α can be increased to make the score more in line with the actual scenario requirements.

[0091] Specifically, the risk score calculated by the above formula can reflect the multi-dimensional information of the current system risk, rather than relying solely on a single data source, thereby greatly improving the accuracy of the risk score; To facilitate the triggering of early warnings, in this embodiment, the comprehensive risk score S risk is mapped to discrete risk levels. Generally, the risk levels are defined by dividing the score range. In this embodiment, the classification formula of the risk levels is as follows: Where: Level: The risk level, divided into low risk, medium risk, and high risk; T1, T2: The thresholds of the risk score, respectively used to divide low risk, medium risk, and high risk.

[0092] In one possible implementation, the thresholds T1 and T2 can be set through historical data and expert experience. For example, in system performance monitoring, the thresholds can be set according to the distribution of historical abnormal data to make the classification of the risk score more referential.

[0093] As an extension, the number of risk levels can be further increased to more finely distinguish the system risk. For example, the risk levels can be divided into five levels, including no risk, low risk, medium-low risk, high risk, and severe risk.

[0094] After completing the classification of the risk score, in this embodiment, the corresponding level of early warning information is generated through the triggering mechanism. Generally, the early warning trigger includes two links: the generation and sending of early warning information.

[0095] Specifically, the early warning information includes the following content: Risk level: The risk level marked based on the classification result of the risk score; Risk source: Specify the specific risk factor or abnormal indicator; Timestamp: Mark the specific time when the warning is triggered; Scope of impact: Describe the system modules or business processes that may be affected; Suggested measures: Provide preliminary handling suggestions.

[0096] As an option, the warning information can be sent to relevant personnel or system modules through multiple channels, such as email, text message, instant messaging tool, or system log recording. For high-risk warnings, an automated response mechanism can also be triggered, such as shutting down abnormal devices or switching to backup systems.

[0097] In a possible implementation, the warning trigger mechanism is implemented using a rule engine, and it determines whether to trigger a warning through predefined rule conditions. For example:

[0098] Where: Trigger Condition Indicates whether a warning needs to be triggered currently, S risk Indicates the risk level of the current system, and the comprehensive deviation score R score And the contribution of the risk feature vector F are calculated, and T2 represents the threshold for triggering a high-risk warning; When the trigger condition is True, the system will generate a high-risk warning and take corresponding measures; Generally, the design of the warning mechanism not only needs to respond to anomalies quickly but also needs to avoid excessive false alarms. In this embodiment, by dynamically adjusting the thresholds T1 and T2, the false alarm rate can be significantly reduced. In addition, for high-frequency warning scenarios, a cooling time mechanism can be introduced to limit the repeated triggering of warnings within a short period to avoid frequent alarms caused by noisy data.

[0099] As an extension, the warning mechanism can also be combined with a knowledge graph to predict the risk propagation path based on the dependency relationships in the knowledge graph. For example, when a high-risk warning is triggered for a certain node, the potential risks of its associated nodes can be automatically inferred, thereby generating more comprehensive warning information; S8. Recording and optimization: Record the warning trigger result and perform model iteration optimization in combination with historical data; In this step, the triggered warning information and relevant historical data are integrated to form a complete risk log record, and the model is iteratively optimized in combination with these data. Generally, recording the warning result is an important basis for subsequent model optimization and strategy adjustment, and in-depth analysis of historical data can further improve the system's adaptability to complex risk scenarios.

[0100] Specifically, this step includes two main links: one is the recording and storage of the early warning trigger results, including key information such as timestamps, trigger conditions, risk scores, and risk levels; the other is the model optimization based on the recorded data, and the optimization content includes the adjustment of the dynamic threshold model, the update of the risk feature weights, and the improvement of the algorithm parameters. In a possible implementation, clustering analysis is performed on historical data in combination with machine learning methods, which can identify long-term trends and adjust model parameters, thereby improving the long-term performance of the system.

[0101] Generally, the recording of the early warning trigger results needs to ensure the comprehensiveness and accuracy of the data. In this embodiment, the early warning trigger results include the following core information: Timestamp (t): Records the specific time when the early warning occurs; Trigger condition (Trigger Condition ): Marks the specific logical condition for triggering the early warning; Risk score (S risk ): Records the comprehensive risk score that triggers the early warning; Risk level (Level): The early warning level mapped according to the risk score; Risk source (Source): Marks the specific module, device, or business process that triggers the early warning; Suggested response (Response): Records the suggested measures provided by the system.

[0102] As an option, these recorded information are formatted and stored in the database for subsequent retrieval and analysis. Specifically, each record can be represented by a multi-dimensional vector: R = {t, Trigger Condition , S risk , Level, Source, Response} where: R: Represents a single risk record.

[0103] In a possible implementation, these records are organized in the form of a time series, which is convenient for subsequent analysis of the time evolution characteristics of historical data. For example, by analyzing the risk records in different time periods, the concentrated outbreak time periods of high-risk events can be identified.

[0104] Generally, historical data contains the operating states of the system at different time points and scenarios, which is of great significance for model optimization. In this embodiment, the model parameters are dynamically adjusted through the mining and analysis of historical data, thereby improving the long-term performance of the system.

[0105] Specifically, the model optimization based on historical data mainly includes the following content: The threshold range of the dynamic threshold model needs to be updated according to historical data to adapt to the long-term changes in the system environment. As a possible implementation, the threshold range is dynamically adjusted by calculating the distribution of risk scores in historical data. Assume that the mean of the risk scores in historical data is μ S , and the standard deviation is σ S , then the dynamically adjusted threshold range can be expressed as: T′1 = μ S-k ·σ S , T′2 = μ S + k·σ S where: T′1, T′2: the adjusted low-risk and high-risk thresholds; k: the adjustment factor, usually taking values of 1 or 2.

[0106] Update of risk feature weights By analyzing the contributions of different features to the risk score in historical records, the risk feature weights can be dynamically adjusted. For example, if a certain feature frequently appears in high-risk warnings, its weight can be increased , and the optimized weight update formula is: where: v′ j : the optimized feature weight; v j : the initial feature weight; η: the learning rate, used to control the amplitude of weight update; Freq(f j ): the frequency of feature f j appearing in historical data.

[0107] Optimization of algorithm parameters Based on the annotation information of historical data, supervised learning or unsupervised learning methods are used to optimize the model parameters. For example, by clustering historical data, risk patterns with similar features can be identified, and the hyperparameters of the model can be adjusted for these patterns.

[0108] After completing the parameter optimization, this embodiment dynamically updates the model through an iterative mechanism. Generally, each iteration includes the following steps: Extract high-risk events from historical records; Update the dynamic threshold range; Adjust the risk feature weights; Retrain the deep learning model and verify its performance on historical data.

[0109] As an option, the iterative update can adopt a batch update mode at fixed time intervals. For example, the model is comprehensively optimized every week to ensure that the model can follow the changes in the system operating environment.

[0110] Generally, the goal of model optimization is to improve the detection accuracy and adaptability of the system. However, in some special scenarios, model optimization can also be used to predict future risks. For example, through a time series prediction model, combined with optimized historical data, future high-risk events can be predicted and measures can be taken in advance.

[0111] In addition, the results of model optimization can be used to generate reports to help managers more intuitively understand the system operation status. For example, by visualizing the analysis results of historical data, the main causes and changing trends of high-risk events can be identified, providing a basis for formulating management strategies.

[0112] The risk warning system described below can be correspondingly referred to the risk warning method described above.

[0113] Please refer to the appendix Figure 2 The present invention also provides a risk warning system, including: A data acquisition module for acquiring multi-source data, including structured data, unstructured data, and time series data; a data processing module for cleaning, standardizing, and fusing the multi-source data to generate a unified data set; A risk analysis module for extracting features from the unified data set based on a deep learning model, constructing a risk knowledge graph, and determining risk factors; A dynamic threshold module for generating a dynamic threshold based on time series data and real-time environmental factors; A risk detection module for detecting the deviation between real-time monitoring data and the dynamic threshold and calculating a risk score; An early warning trigger module for triggering an early warning of a corresponding level according to the risk score; A model optimization module for recording the early warning trigger result and iteratively optimizing the risk analysis module in combination with historical data.

[0114] The system of this embodiment can be used to execute the method embodiment above, and its principle and technical effect are similar, which will not be elaborated here.

[0115] An electronic device described below can be correspondingly referred to the risk warning method described above.

[0116] Please refer to the appendix Figure 3 The present invention also provides an electronic device, including a memory, a processor, and a communication module, and the processor implements the risk warning method when executed.

[0117] The electronic device of this embodiment can be used to execute the method embodiment above, and its principle and technical effect are similar, which will not be elaborated here.

[0118] Although embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A risk early warning method, characterized in that: The following steps are involved: Collect multi-source data, including structured data, unstructured data, and time series data; Cleaning, standardizing and fusing the multi-source data to generate a unified data set for analysis; Extract features from the unified data set based on the deep learning model and generate risk feature vectors; Constructing a risk knowledge graph, and performing semantic association analysis based on the knowledge graph to determine risk factors; Establish a dynamic threshold model to calculate dynamic thresholds based on time series data and real-time environmental factors; Combining the risk feature vector with the dynamic threshold, detecting whether the real-time monitoring data deviates from the risk indicator range; Calculate risk scores based on test results and trigger warnings of corresponding levels; Record the warning trigger results and perform iterative model optimization based on historical data.

2. The risk warning method according to claim 1, characterized in that: The collecting of multi-source data includes: Structured data, collected from system performance indicators, network traffic logs, and monitoring instrument data; Unstructured data, collected from alarm logs, fault reports, and email records; Time series data collected from historical alarm trends and real-time health status data.

3. The risk early warning method according to claim 1 is characterized in that: The generating of a unified data set for analysis includes: Perform noise elimination on multi-source data and remove data that exceeds the set range based on statistical analysis methods; Align and interpolate data with different timestamps to ensure consistency in time dimensions; Using the modal balance fusion algorithm, the structured data and unstructured data features are unified into a vector space.

4. The risk warning method according to claim 1, characterized in that: Extracting features from the unified data set and generating a risk feature vector comprises: Use long short-term memory networks to extract dynamic features from time series data; Generate semantic feature vectors for unstructured text data using text embedding models; The structured features, time series features and unstructured features are fused through the attention mechanism to generate multimodal risk features.

5. The risk early warning method according to claim 1, characterized in that: The construction of the risk knowledge graph includes: Risk entities, including device nodes, system modules, and business processes; Risk relationships, including dependency relationships and impact relationships; Attribute information, including risk level and key factors.

6. The risk early warning method according to claim 1, characterized in that: The establishment of the dynamic threshold model comprises: In a fixed time interval, the dynamic threshold calculates the basic forecast value through the time series forecasting model; The basic prediction value is adjusted in combination with real-time environmental factors to generate the final dynamic threshold.

7. The risk early warning method according to claim 1, characterized in that: The risk detection operation includes: Compare the real-time monitoring data with the dynamic threshold and calculate the deviation; Determine whether there is potential risk based on the degree of deviation and the preset risk threshold range.

8. The risk early warning method according to claim 1, characterized in that: The operation of recording the warning trigger result includes: Record real-time health status changes and historical alarm trends in time series data; Generate an information log containing risk score, deviation and trigger time based on the specific circumstances of the warning trigger; Conduct correlation analysis between the triggered warning results and historical alarm trends to extract the behavior patterns of specific risk factors; According to the recorded health status data and risk patterns, the parameters required in the iterative optimization process of the model are passed to the optimization module.

9. Risk early warning system, characterized in that: The risk early warning method according to any one of claims 1 to 7 comprises: Data collection module, used to collect multi-source data, including structured data, unstructured data and time series data; A data processing module, used to clean, standardize and fuse the multi-source data to generate a unified data set; The risk analysis module is used to extract features from a unified data set based on a deep learning model, build a risk knowledge graph, and determine risk factors; Dynamic threshold module, used to generate dynamic thresholds based on time series data and real-time environmental factors; The risk detection module is used to detect the deviation of real-time monitoring data from dynamic thresholds and calculate the risk score; The warning trigger module is used to trigger warnings of corresponding levels according to risk scores; The model optimization module is used to record the warning trigger results and iteratively optimize the risk analysis module in combination with historical data.

10. An electronic device, characterized in that: It includes a memory, a processor and a communication module, and when the processor is executed, it implements the risk warning method described in any one of claims 1 to 7.

Images