Risk early warning method and system based on tree structure

Abstract

The invention discloses a risk early warning method and system based on a tree structure, belongs to the technical field of risk data management, and aims to solve the technical problem of how to efficiently manage the index hierarchical relationship of complex data and realize efficient and accurate alarm response. Defining information, early warning rules, monitoring frequency and data sources of risk indexes through the risk index tree, and constructing a data resource directory according to fields and labels for managing data resources; a right and left tree planting structure is utilized to construct a right and left tree planting structure, nodes of the risk index tree are divided into different right and left value ranges into different right and left value ranges, and each area corresponds to different user right levels; risk factors are abstracted into a tree structure, dominance of risk propagation paths is achieved through hierarchical management, and step-by-step alarm aggregation and drill-down analysis are conducted from root nodes representing macroscopic risks to leaf nodes representing specific indexes and events.

Description

Technical Field

[0001] The present invention relates to the technical field of risk data management, and in particular to a tree-structure-based risk early warning method and system. Background Art

[0002] In today's digital management landscape, whether it's enterprise operations management, financial risk monitoring, or performance monitoring of various complex systems, processing massive amounts of indicator data is often necessary. These indicators collectively form a vast and complex monitoring network, providing real-time insights into the operational status of systems, businesses, or processes. However, in actual management, these systems face two particularly challenging challenges: the occurrence of numerous duplicate alerts and the risk of missing important indicators.

[0003] A large number of duplicate alerts not only distracts managers, drowning out truly critical alerts amidst the deluge, increasing their anxiety and workload, but can also obscure the true nature of the problem, leading to misjudgment and delayed resolution. Missing important indicators can have even more serious consequences, potentially preventing significant risks from being detected in a timely manner, resulting in immeasurable losses.

[0004] In today's complex information systems and network environments, the processing and management of alarm information is becoming increasingly important. The alarm tree, a data structure for organizing and presenting alarm information, is widely used in various monitoring systems, security systems, and fault diagnosis systems. It clearly displays the hierarchical relationships and associated information between alarms, helping operations and maintenance personnel quickly locate and resolve issues.

[0005] However, as the system continues to expand and the number of alarms increases dramatically, traditional alarm tree query methods are facing inefficiencies. When processing large amounts of alarm data, traditional methods may need to traverse the entire alarm tree structure, resulting in excessive query time and failing to meet real-time and efficiency requirements.

[0006] Therefore, how to efficiently manage the hierarchical relationship of indicators of complex data and achieve efficient and accurate alarm response is a technical problem that needs to be solved urgently. Summary of the Invention

[0007] The technical task of the present invention is to provide a risk warning method and system based on a tree structure to solve the problem of how to efficiently manage the hierarchical relationship of indicators of complex data and achieve efficient and accurate alarm response.

[0008] The technical task of the present invention is achieved in the following manner: a risk early warning method based on a tree structure, the method is as follows:

[0009] Collect data resources, define risk indicator information, warning rules, monitoring frequency, and data sources through the risk indicator tree, and build a data resource directory based on fields and tags to manage data resources. Maintain data through manual entry, Excel import, and docking with the big data platform.

[0010] The permission model is constructed using the left-right tree planting structure, and the nodes of the risk indicator tree are divided into different permission areas according to the left-right value range. Each area corresponds to a different user permission level.

[0011] Risk factors are abstracted into a tree structure, and the risk propagation path is made explicit through hierarchical management. From the root node representing macro-risk to the leaf nodes representing specific indicators and events, step-by-step alarm aggregation and drill-down analysis are carried out to clearly display the hierarchical relationship of risk indicators.

[0012] Preferably, each node in the risk indicator tree has an administrator and an ordinary user. The administrator can edit and view the nodes of the risk indicator tree, while the ordinary user can only view the nodes. When the role is the administrator or ordinary user of a node, the ordinary user can see all the child nodes of the corresponding node and the ancestor nodes of the corresponding node.

[0013] Preferably, the nodes of the risk indicator tree include risk nodes and indicator nodes;

[0014] The indicator node is associated with the data resource directory. When the data in the data resource directory is updated, the indicator node associated with the corresponding data resource directory obtains the updated data.

[0015] As a preference, the rationality of the hierarchy of the risk indicator tree, that is, the rationality of the relationship between risks, is ensured by maintaining the nodes of the risk indicator tree and dragging and moving the nodes. When the position of the node in the left and right value trees is modified by dragging, the left and right value trees are maintained, as follows:

[0016] Get the current node information and query the node's subtree based on the characteristics of the left and right value trees;

[0017] The width of the subtree is determined by the left and right values ​​of the current node. For the new parent node of the node, the new parent node is inserted into the entire subtree after the node moves, and the left and right values ​​are updated according to the width of the subtree;

[0018] Calculate the change in the left and right values ​​of the moved node, add the obtained change to the left and right values ​​of the subtree to get the left and right values ​​of the subtree after moving;

[0019] Repair the space left after the subtree is moved and obtain the risk indicator tree after dragging and maintenance.

[0020] As a preferred method, this method adopts a bottom-up data update method to ensure that risk data information is updated in a timely manner after indicators are collected, as follows:

[0021] When the index value of a leaf node changes, the value of the ancestor node is updated. When the value of a non-leaf node is updated, the current value and current weight value of the corresponding child node are cached for each node to ensure the efficiency of the update.

[0022] When a leaf node changes, the path from the leaf node to the root node is determined through the left and right value trees, and the risk value is updated in turn.

[0023] As a preference, when the risk value of each node is updated, the node generates an alarm according to the change in the risk value, generates an alarm according to different combinations of the risk values ​​of the child nodes, and generates an alarm according to the number of alarms of the child nodes;

[0024] Alarms are classified into three levels: urgent, important, and general, based on their severity and impact. Corresponding processing procedures are developed for each level of alarm. When an alarm is generated, notifications are sent to designated personnel in a timely manner, such as via SMS, email, or pop-up windows.

[0025] More preferably, the method tracks the progress and results of alarm processing in real time by establishing an alarm processing status monitoring mechanism, making it easier for managers and system administrators to understand the overall situation of the alarm;

[0026] After the alarm processing is completed, management personnel are required to promptly feedback the processing results and lessons learned, and through analysis and summary of the alarm processing situation, continuously optimize the alarm notification method and response mechanism to improve stability and reliability.

[0027] A risk early warning system based on a tree structure, the system comprising:

[0028] The risk model maintenance module is used to dynamically maintain the addition and update of risk indicator tree nodes, adjust the depth and breadth of the tree structure according to needs, and move and maintain branch subtrees;

[0029] The authority control module is used to maintain the administrators and ordinary users of each node, and to achieve different visibility of the tree model for different users and the maintenance authority of the tree structure for different users;

[0030] The risk data reporting module is used to report risk data. After the leaf nodes of the risk indicator tree report the alarm data, the risk values ​​of the affected nodes are updated in a timely manner based on the ability of the left and right value trees to locate ancestor nodes and subtrees, combined with the node risk value caching capability.

[0031] The alarm trigger module is used to trigger alarms of different risk levels when the node value is updated based on the current node risk value, sub-node risk value and alarm frequency, and send notifications of the alarm information to designated personnel via SMS, email and pop-up windows.

[0032] Preferably, when the position of a node in the left and right value trees is modified by dragging, the system maintains the left and right value trees, as follows:

[0033] (1) Move nodes by dragging;

[0034] (2) Get the current node information and query the node's subtree based on the characteristics of the left and right value trees;

[0035] (3) Determine the width of the subtree by the left and right values ​​of the current node;

[0036] (4) For the new parent node of the node, after the node moves, the new parent node is inserted into the entire subtree, and the left and right values ​​are updated according to the width of the subtree;

[0037] (5) Calculate the change in the left and right values ​​of the moved node;

[0038] (6) Add the left and right values ​​of the subtree to the obtained change to obtain the left and right values ​​of the subtree after it moves;

[0039] (7) Repair the vacant position after the subtree is moved and obtain the risk indicator tree after dragging and maintenance.

[0040] Preferably, the leaf nodes of the risk indicator tree report the following alarm data:

[0041] (1) When a leaf node reports data, it obtains the ancestor node based on the left and right value trees;

[0042] (2) Cache node value;

[0043] (3) Determine whether it is the root node:

[0044] ①If yes, jump to step (8);

[0045] ②If not, proceed to step (4);

[0046] (4) Transfer to the upper node;

[0047] (5) Obtain data cached by other nodes;

[0048] (6) Determine whether the cached data of a child node is empty:

[0049] ①If yes, jump to step (8);

[0050] ②If not, go to step (7);

[0051] (7) Calculate the node value and execute step (2);

[0052] (8)End.

[0053] The tree-structure-based risk warning method and system of the present invention have the following advantages:

[0054] (1) The early warning model based on the left-right value tree of the present invention achieves efficient and scalable anomaly detection capabilities through structured interval partitioning. Its core value lies in balancing real-time performance and accuracy. It is particularly suitable for complex systems that need to quickly locate the root cause of anomalies. At the same time, the model introduces multi-user permission control and personalized views, and uses the left-right value tree to quickly identify user-related nodes.

[0055] (2) The present invention achieves efficient management of complex indicator hierarchical relationships, flexible authority control, and accurate alarm response through efficient query and structured interval partitioning of left and right value trees, and achieves rapid abnormality location and timely response to alarms after an alarm occurs;

[0056] (3) The present invention implements authority control and alarm response of the risk indicator tree through the left and right value trees, which can efficiently manage complex indicator hierarchical relationships and achieve flexible authority control and efficient and accurate alarm response;

[0057] (4) The present invention implements multi-user permission control and personalized views, providing a personalized user experience while ensuring data security. It uses a left-right value tree approach to meet the need for fast querying of subtrees and ancestor nodes, avoiding the use of recursive queries, ensuring stable performance, and guaranteeing permission control functionality.

[0058] (5) The tree structure of the present invention is particularly suitable for managing a risk indicator system with a hierarchical relationship and has significant advantages. In terms of display, it can intuitively present a clear subordinate relationship between risk indicators. In terms of organization, it is easy to classify related indicators according to different categories, making the chaotic risk indicators clear and organized.

[0059] (6) The present invention is highly flexible and supports the dynamic addition, modification, and dragging of indicator nodes to adapt to ever-changing risk management needs. In addition, it can quickly locate specific indicators and their associated indicators, greatly improving the efficiency of risk identification and analysis.

[0060] (7) The present invention implements node authority control based on the ability to search for subtrees and ancestor nodes in the left and right value trees, and by dividing different nodes into management members and ordinary members, enables personalized viewing of the model by different users, and maintains and manages the model;

[0061] (8) When the value of a leaf node is updated, the present invention uses the left and right value trees and node cache mechanism to promptly update the risk value of the relevant nodes and generate alarms according to the various alarm conditions of each node. After the alarm occurs, the alarm information is notified to the relevant members of the node through various methods, which can effectively reduce the impact of the alarm and minimize losses.

[0062] (9) The present invention optimizes the efficiency of authority control, data reporting and alarm triggering, ensuring the efficient and stable operation of the alarm system. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The present invention will be further described below with reference to the accompanying drawings.

[0064] Attachment Figure 1 This is a schematic diagram of the implementation principle of the left and right value trees;

[0065] Attachment Figure 2 This is a structural diagram of a risk warning system based on a tree structure;

[0066] Attachment Figure 3 A flowchart for moving nodes in the left and right value trees;

[0067] Attachment Figure 4 This is a flowchart of the leaf node data reporting process. DETAILED DESCRIPTION

[0068] The tree-structure-based risk warning method and system of the present invention are described in detail below with reference to the accompanying drawings and specific embodiments.

[0069] Example 1:

[0070] This embodiment provides a risk warning method based on a tree structure, which is specifically as follows:

[0071] S1. Collect data resources and define risk indicator information, warning rules, monitoring frequency, and data sources through the risk indicator tree. Build a data resource directory by field and label to manage data resources. Maintain data through manual entry, Excel import, and big data platform docking.

[0072] S2. Use the left and right tree planting structure to build a permission model, as shown in the attached Figure 1 As shown in the figure, the nodes of the risk indicator tree are divided into different permission areas according to the left and right value ranges. Each area corresponds to a different user permission level. For example, high-level operation and maintenance personnel can be granted the permission to access the entire alarm tree or a larger subtree; while ordinary operation and maintenance personnel are only granted the permission to access a specific small subtree.

[0073] S3. Abstract risk factors into a tree structure and make the risk propagation path explicit through hierarchical management. From the root node representing macro-risk to the leaf nodes representing specific indicators and events, step-by-step alarm aggregation and drill-down analysis are carried out to clearly display the hierarchical relationship of risk indicators.

[0074] In this embodiment, each node in the risk indicator tree has an administrator and an ordinary user. The administrator can edit and view the nodes of the risk indicator tree, while the ordinary user can only view the nodes. When the role is the administrator or ordinary user of a node, the ordinary user can see all the child nodes of the corresponding node and the ancestor nodes of the corresponding node.

[0075] The nodes of the risk indicator tree in this embodiment include risk nodes and indicator nodes;

[0076] The indicator node is associated with the data resource directory. When the data in the data resource directory is updated, the indicator node associated with the corresponding data resource directory obtains the updated data.

[0077] As attached Figure 3 As shown, this embodiment ensures the hierarchical rationality of the risk indicator tree, that is, the rationality of the relationship between risks, by maintaining the risk indicator tree nodes and dragging and moving the nodes. When the position of the node in the left and right value trees is modified by dragging, the left and right value trees are maintained, as follows:

[0078] ① Get the current node information and query the node's subtree based on the characteristics of the left and right value trees;

[0079] ② Determine the width of the subtree by the left and right values ​​of the current node. For the new parent node of the node, the new parent node is inserted into the entire subtree after the node moves, and the left and right values ​​are updated according to the width of the subtree;

[0080] ③Calculate the change in the left and right values ​​of the moved node, and add the obtained change to the left and right values ​​of the subtree to get the left and right values ​​of the subtree after moving;

[0081] ④ Repair the vacant space after the subtree is moved, and obtain the risk indicator tree after dragging and maintenance.

[0082] This embodiment adopts a bottom-up data update method to ensure that risk data information is updated in a timely manner after indicators are collected. The details are as follows:

[0083] When the index value of a leaf node changes, the value of the ancestor node is updated. When the value of a non-leaf node is updated, the current value and current weight value of the corresponding child node are cached for each node to ensure the efficiency of the update.

[0084] When a leaf node changes, the path from the leaf node to the root node is determined through the left and right value trees, and the risk value is updated in turn.

[0085] In this embodiment, when the risk value of each node is updated, the node generates an alarm based on the change in risk value, generates an alarm based on different combinations of risk values ​​of child nodes, and generates an alarm based on the number of alarms of child nodes;

[0086] Alarms are classified into three levels: urgent, important, and general, based on their severity and impact. Corresponding processing procedures are developed for each level of alarm. When an alarm is generated, notifications are sent to designated personnel in a timely manner, such as via SMS, email, or pop-up windows.

[0087] This embodiment establishes an alarm processing status monitoring mechanism to track the alarm processing progress and results in real time, making it easier for managers and system administrators to understand the overall situation of the alarm;

[0088] After the alarm processing is completed, management personnel are required to promptly feedback the processing results and lessons learned, and through analysis and summary of the alarm processing situation, continuously optimize the alarm notification method and response mechanism to improve stability and reliability.

[0089] Example 2:

[0090] As attached Figure 2 As shown, this embodiment provides a risk warning system based on a tree structure, which includes:

[0091] The risk model maintenance module is used to dynamically maintain the addition and update of risk indicator tree nodes, adjust the depth and breadth of the tree structure according to needs, and move and maintain branch subtrees;

[0092] The authority control module is used to maintain the administrators and ordinary users of each node, and to achieve different visibility of the tree model for different users and the maintenance authority of the tree structure for different users;

[0093] The risk data reporting module is used to report risk data. After the leaf nodes of the risk indicator tree report the alarm data, the risk values ​​of the affected nodes are updated in a timely manner based on the ability of the left and right value trees to locate ancestor nodes and subtrees, combined with the node risk value caching capability.

[0094] The alarm trigger module is used to trigger alarms of different risk levels when the node value is updated based on the current node risk value, sub-node risk value and alarm frequency, and send notifications of the alarm information to designated personnel via SMS, email and pop-up windows.

[0095] As attached Figure 3 As shown, in this embodiment, when the position of a node in the left and right value trees is modified by dragging, the left and right value trees are maintained, as follows:

[0096] (1) Move nodes by dragging;

[0097] (2) Get the current node information and query the node's subtree based on the characteristics of the left and right value trees;

[0098] (3) Determine the width of the subtree by the left and right values ​​of the current node;

[0099] (4) For the new parent node of the node, after the node moves, the new parent node is inserted into the entire subtree, and the left and right values ​​are updated according to the width of the subtree;

[0100] (5) Calculate the change in the left and right values ​​of the moved node;

[0101] (6) Add the left and right values ​​of the subtree to the obtained change to obtain the left and right values ​​of the subtree after it moves;

[0102] (7) Repair the vacant position after the subtree is moved and obtain the risk indicator tree after dragging and maintenance.

[0103] As attached Figure 4 As shown, the leaf nodes of the risk indicator tree in this embodiment report the following alarm data:

[0104] (1) When a leaf node reports data, it obtains the ancestor node based on the left and right value trees;

[0105] (2) Cache node value;

[0106] (3) Determine whether it is the root node:

[0107] ①If yes, jump to step (8);

[0108] ②If not, proceed to step (4);

[0109] (4) Transfer to the upper node;

[0110] (5) Obtain data cached by other nodes;

[0111] (6) Determine whether the cached data of a child node is empty:

[0112] ①If yes, jump to step (8);

[0113] ②If not, go to step (7);

[0114] (7) Calculate the node value and execute step (2);

[0115] (8)End.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A risk warning method based on a tree structure, characterized in that: The method is as follows: Collect data resources, define risk indicator information, warning rules, monitoring frequency, and data sources through the risk indicator tree, and build a data resource directory based on fields and tags to manage data resources. Maintain data through manual entry, Excel import, and docking with the big data platform. The permission model is constructed using the left-right tree planting structure, and the nodes of the risk indicator tree are divided into different permission areas according to the left-right value range. Each area corresponds to a different user permission level. Risk factors are abstracted into a tree structure, and the risk propagation path is made explicit through hierarchical management. From the root node representing macro-risk to the leaf nodes representing specific indicators and events, step-by-step alarm aggregation and drill-down analysis are carried out to clearly display the hierarchical relationship of risk indicators.

2. The tree-structure-based risk warning method according to claim 1, characterized in that: Each node in the risk indicator tree has administrators and ordinary users. Administrators can edit and view the nodes of the risk indicator tree, while ordinary users can only view the nodes. When the role is an administrator or ordinary user of a node, ordinary users can see all child nodes of the corresponding node and the ancestor nodes of the corresponding node.

3. The tree-structure-based risk warning method and system according to claim 1, characterized in that: The nodes of the risk indicator tree include risk nodes and indicator nodes; The indicator node is associated with the data resource directory. When the data in the data resource directory is updated, the indicator node associated with the corresponding data resource directory obtains the updated data.

4. The tree-structure-based risk warning method according to claim 1, characterized in that: The rationality of the risk indicator tree hierarchy, that is, the rationality of the relationships between risks, is ensured by maintaining the risk indicator tree nodes and dragging and moving the nodes. When modifying the position of a node in the left and right value trees by dragging, the left and right value trees are maintained, as follows: Get the current node information and query the node's subtree based on the characteristics of the left and right value trees; The width of the subtree is determined by the left and right values ​​of the current node. For the new parent node of the node, the new parent node is inserted into the entire subtree after the node moves, and the left and right values ​​are updated according to the width of the subtree; Calculate the change in the left and right values ​​of the moved node, add the obtained change to the left and right values ​​of the subtree to get the left and right values ​​of the subtree after moving; Repair the space left after the subtree is moved and obtain the risk indicator tree after dragging and maintenance.

5. The tree-structure-based risk warning method according to claim 1, characterized in that: This method adopts a bottom-up data update method to ensure that risk data information is updated in a timely manner after indicators are collected. The details are as follows: When the index value of a leaf node changes, the value of the ancestor node is updated. When the value of a non-leaf node is updated, the current value and current weight value of the corresponding child node are cached for each node to ensure the efficiency of the update. When a leaf node changes, the path from the leaf node to the root node is determined through the left and right value trees, and the risk value is updated in turn.

6. The tree-structure-based risk warning method according to claim 1, characterized in that: When the risk value of each node is updated, the node generates an alarm based on the change in risk value, generates an alarm based on different combinations of risk values ​​of sub-nodes, and generates an alarm based on the number of alarms of sub-nodes; According to the severity and impact of the alarm, the alarm is divided into three different levels: urgent, important, and general. According to the different levels of alarm, the corresponding processing procedures are formulated; After the alarm is generated, a notification is sent to the designated person in a timely manner through SMS, email, or pop-up window.

7. The tree-structured risk warning method according to any one of claims 1 to 6, characterized in that: This method tracks the progress and results of alarm processing in real time by establishing an alarm processing status monitoring mechanism, making it easier for managers and system administrators to understand the overall situation of alarms. After the alarm processing is completed, management personnel are required to promptly feedback the processing results and lessons learned, and through analysis and summary of the alarm processing situation, continuously optimize the alarm notification method and response mechanism to improve stability and reliability.

8. A risk warning system based on a tree structure, characterized in that: The system includes: The risk model maintenance module is used to dynamically maintain the addition and update of risk indicator tree nodes, adjust the depth and breadth of the tree structure according to needs, and move and maintain branch subtrees; The authority control module is used to maintain the administrators and ordinary users of each node, and to achieve different visibility of the tree model for different users and the maintenance authority of the tree structure for different users; The risk data reporting module is used to report risk data. After the leaf nodes of the risk indicator tree report the alarm data, the risk values ​​of the affected nodes are updated in a timely manner based on the ability of the left and right value trees to locate ancestor nodes and subtrees, combined with the node risk value caching capability. The alarm trigger module is used to trigger alarms of different risk levels when the node value is updated based on the current node risk value, sub-node risk value and alarm frequency, and send notifications of the alarm information to designated personnel via SMS, email and pop-up windows.

9. The tree-structured risk warning system according to claim 8, characterized in that: When the system modifies the position of a node in the left and right value trees by dragging and dropping, it maintains the left and right value trees as follows: (1) Move nodes by dragging; (2) Get the current node information and query the node's subtree based on the characteristics of the left and right value trees; (3) Determine the width of the subtree by the left and right values ​​of the current node; (4) For the new parent node of the node, after the node moves, the new parent node is inserted into the entire subtree, and the left and right values ​​are updated according to the width of the subtree; (5) Calculate the change in the left and right values ​​of the moved node; (6) Add the left and right values ​​of the subtree to the obtained change to obtain the left and right values ​​of the subtree after it moves; (7) Repair the vacant position after the subtree is moved and obtain the risk indicator tree after dragging and maintenance.

10. The tree-structured risk warning system according to claim 8 or 9, characterized in that: The leaf nodes of the risk indicator tree report alarm data as follows: (1) When a leaf node reports data, it obtains the ancestor node based on the left and right value trees; (2) Cache node value; (3) Determine whether it is the root node: ①If yes, jump to step (8); ②If not, proceed to step (4); (4) Transfer to the upper node; (5) Obtain data cached by other nodes; (6) Determine whether the cached data of a child node is empty: ①If yes, jump to step (8); ②If not, go to step (7); (7) Calculate the node value and execute step (2); (8)End.

Images