Information system production event analysis system, method, device, equipment, storage medium and program product

Abstract

The embodiment of the invention provides an information system production event analysis system, method, device and equipment, a storage medium and a program product, and relates to the field of financial science and technology or other related fields. The system comprises a data acquisition module used for determining an event feature demand corresponding to a target event type when an event of any target event type is acquired, and acquiring a target event feature set of the event based on the event feature demand; the data preprocessing module is used for converting the target event feature set into a target event feature vector according to a target feature variable assignment rule corresponding to the target event feature set; the target feature variable assignment rule is used for indicating the current weight of each event feature, and the current weight is dynamically adjusted based on an adaptive weight algorithm; and the event level analysis module is used for analyzing the target event feature vector based on the target analysis model to obtain an analysis result. According to the system, the accuracy of information system production event analysis is improved.

Description

Technical Field

[0001] The present application relates to the field of financial technology or other related fields, and in particular to an information system production event analysis system, method, device, equipment, storage medium and program product. Background Art

[0002] An information system production incident refers to a situation that causes or may cause service interruption or degradation in service quality during the operation of an information system. For example, situations that affect or may affect the normal and effective operation of business applications, system environment, network communications, machinery and equipment, and computer room facilities.

[0003] Currently, production incidents in banking information systems are primarily identified based on regulatory documents and practical experience, using descriptive text to list the different levels of production incidents. In practice, personnel manually determine the level of the incident by comparing the descriptions of each level. This approach, which relies on manual experience and rule matching, can, to a certain extent, ensure that the classification results meet regulatory requirements.

[0004] However, due to the large number of level description items and trivial content, it is difficult to cover all items in actual work, which can easily lead to low accuracy of event analysis results. Summary of the Invention

[0005] The present application provides an information system production event analysis system, method, apparatus, device, storage medium and program product to address the low accuracy defect of information system production event analysis in known technologies.

[0006] In a first aspect, the present application provides an information system production event analysis system, the system comprising:

[0007] A data acquisition module is configured to, when a production event of any target event type is acquired through the user interface of the information system, determine the event feature requirements corresponding to the target event type, and acquire a target event feature set of the production event based on the event feature requirements;

[0008] a data preprocessing module, configured to obtain the target event type and the target event feature set, and convert the target event feature set into a target event feature vector according to a target feature variable assignment rule corresponding to the target event type; the target feature variable assignment rule is configured to indicate a current weight of each event feature included in the target event feature set, and the current weight is dynamically adjusted based on an adaptive weight algorithm;

[0009] An event level analysis module is used to obtain a target analysis model of the target event type and the target event feature vector, and analyze the target event feature vector based on the target analysis model to obtain an analysis result; the analysis result is used to indicate the event impact level of the production event.

[0010] In a second aspect, the present application provides an information system production event analysis method, the method comprising:

[0011] When a production event of any target event type is obtained through the user interface of the information system, an event feature requirement corresponding to the target event type is determined, and a target event feature set of the production event is obtained based on the event feature requirement;

[0012] Converting the target event feature set into a target event feature vector according to a target feature variable assignment rule corresponding to the target event feature set; the target feature variable assignment rule is used to indicate the current weight of each event feature included in the target event feature set, and the current weight is dynamically adjusted based on an adaptive weight algorithm;

[0013] The target event feature vector is analyzed based on the target analysis model of the target event type to obtain an analysis result; the analysis result is used to indicate the event impact level of the production event.

[0014] In a third aspect, the present application provides an information system production event analysis device, the device comprising:

[0015] a determination module configured to, when a production event of any target event type is obtained through a user interface of the information system, determine an event feature requirement corresponding to the target event type, and obtain a target event feature set of the production event based on the event feature requirement;

[0016] a conversion module, configured to convert the target event feature set into a target event feature vector according to a target feature variable assignment rule corresponding to the target event feature set; the target feature variable assignment rule is configured to indicate a current weight of each event feature included in the target event feature set, the current weight being dynamically adjusted based on an adaptive weight algorithm;

[0017] An analysis module is used to analyze the target event feature vector based on a target analysis model of the target event type to obtain an analysis result; the analysis result is used to indicate the event impact level of the production event.

[0018] In a fourth aspect, the present application provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the processor;

[0019] The memory stores computer-executable instructions;

[0020] The at least one processor executes the computer-executable instructions stored in the memory to implement the method as described in any one of the second aspects.

[0021] In a fifth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method as described in any one of the second aspects.

[0022] In a sixth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method as described in any one of the second aspects.

[0023] In the information system production event analysis system provided by this application, when the data acquisition module obtains an event of any target event type through the user interface of the information system, it determines the target event feature set corresponding to the target event type. The data preprocessing module converts the target event feature set into a target event feature vector based on the target feature variable assignment rules corresponding to the target event feature set. The event level analysis module analyzes the target event feature vector based on the target analysis model corresponding to the target event type to obtain the analysis results. In this process, on the one hand, the manual analysis link is completely abandoned, avoiding evaluation bias caused by subjective judgment, experience differences, and missed judgments, thereby ensuring the objectivity and consistency of the analysis results. Through an algorithm-driven standardized process, the system significantly shortens the event processing cycle while maintaining high accuracy. On the other hand, the system uses an adaptive algorithm to adjust the weight of each feature in real time. For each type of event, it can automatically identify the core features and enhance their weights, while suppressing the interference of irrelevant or redundant features, thereby effectively improving the system's adaptability to unknown event patterns and thus also helping to improve accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0025] Figure 1 A schematic diagram of an application scenario of an information system production event analysis system provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of the structure of an information system production event analysis system provided in an embodiment of the present application Figure 1 ;

[0027] Figure 3 A schematic diagram of the structure of an information system production event analysis system provided in an embodiment of the present application Figure 2 ;

[0028] Figure 4 A flowchart of a method for analyzing information system production events provided in an embodiment of the present application;

[0029] Figure 5 A schematic diagram of the structure of an information system production event analysis device provided in an embodiment of the present application;

[0030] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0031] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0032] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0033] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0034] It should be noted that the information system production event analysis system, method, device, equipment, storage medium and program product provided in this application can be used in the field of financial technology, and can also be used in any field other than financial technology. The application field of the information system production event analysis system, method, device, equipment, storage medium and program product in this application is not limited.

[0035] For ease of understanding, each key term or important term involved in the present invention is explained below:

[0036] Information system production incidents: refers to situations that cause or may cause service interruption or degradation of service quality during the operation of information systems. For example, situations that affect or may affect the normal and effective operation of business applications, system environment, network communications, machinery and equipment, and computer room facilities;

[0037] Supervised machine learning, also known as supervised learning, is an important method in machine learning. Its core idea is to train a model by providing it with a dataset of known inputs and corresponding outputs (i.e., labels), enabling it to learn the mapping patterns from inputs to outputs. In supervised learning, each training example consists of an input object (such as an image, text, or a number) and a desired output value (also known as a label or target value).

[0038] Linear regression is a statistical method used to predict the linear relationship between one or more independent variables (also called explanatory variables or features) and a dependent variable (also called the response variable or target variable). The target variable’s value is predicted by fitting a straight line (in the case of a single independent variable) or a hyperplane (in the case of multiple independent variables).

[0039] In addition, the terms "first," "second," etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. In the description of the following embodiments, "plurality" means more than two, unless otherwise specifically defined.

[0040] Information system production incidents refer to abnormal conditions during information system operations that cause or could cause service interruptions or significant degradations in service levels. These can include business application failures, network communication interruptions, equipment anomalies, and more. These incidents can have a direct impact on business operations and user experience, and in severe cases, can even lead to significant financial losses and reputational damage. Therefore, accurate analysis and classification of these incidents is crucial.

[0041] Currently, analysis of information system production incidents primarily relies on rule-based matching and expert systems. On the one hand, companies develop detailed incident classification rules based on regulatory requirements and historical experience, manually comparing incident characteristics against these rules to complete preliminary analysis and classification. On the other hand, some companies have introduced expert systems that integrate industry expert knowledge with historical event data to assist staff in incident diagnosis and classification. Additionally, some companies are experimenting with simple quantitative indicators, such as the duration of service disruptions and the number of affected users, to initially categorize incidents.

[0042] Among many industries, the banking industry's analysis and classification of information system production incidents is typical. In banking scenarios, information system production incidents are primarily based on regulatory documents, combined with practical experience, using descriptive text to list different levels of production incidents. For example, one bank explicitly classifies "core business system outages exceeding 30 minutes and impacting over 100,000 customers" as a Level 1 incident. In practice, staff manually determine the level of the incident by comparing the descriptions of each level. This approach, which relies on manual experience and rule matching, can, to a certain extent, ensure that the classification results meet regulatory requirements.

[0043] However, existing analysis and grading methods still have significant drawbacks. For one thing, the level descriptions are numerous and fragmented, making it difficult to cover all of them in practice and prone to missing new or complex event scenarios. For example, with the rise of open banking, third-party interface security incidents are frequent, but traditional grading rules lack corresponding scenario descriptions, resulting in low accuracy in the analysis of such incidents. Furthermore, manual rule matching relies on staff experience and understanding of the rules, which is highly subjective and can easily lead to different grading results for the same incident. For example, the operations department may consider a network delay incident to be of a lower level, while the business department, based on customer complaints, may determine it to be of a higher level.

[0044] Therefore, the present application provides an information system production event analysis system, which aims to solve the above technical problems of the known technology. Specifically, the system includes a data acquisition module, a data preprocessing module, and an event level analysis module. When the data acquisition module captures any target event type through the user interface, it automatically extracts the key features corresponding to the event. Subsequently, the data preprocessing module converts these features into standardized feature vectors based on the preset feature variable assignment rules. Finally, the event level analysis module uses the analysis model that matches the event type to quantitatively evaluate the feature vector and output the analysis results of the event impact level.

[0045] It should be understood that the information system in this application can be an information system in the banking field or an information system in other fields, and this application is not limited to this. As an example, Figure 1 This is a schematic diagram of an application scenario of an information system production event analysis system provided in an embodiment of the present application. Figure 1 As shown, the information system production event analysis system of the present application can be used in a banking business system.

[0046] Specifically, in this scenario, the banking business system and the information system production event analysis system are deployed independently and interact with each other via wired or wireless means. The data acquisition module acquires events through the banking business system's user interface. Upon acquiring an event of any target event type, it determines the event feature requirements corresponding to the target event type. The data preprocessing module obtains the target event feature set from the data acquisition module and converts it into a target event feature vector based on the corresponding target feature variable assignment rules. The event-level analysis module obtains the target event feature set from the data preprocessing module and analyzes it based on the corresponding target analysis model to obtain analysis results.

[0047] In the above process, since the target feature variable assignment rules adopted by the data preprocessing module indicate the current weight of each event feature, and the current weight is dynamically adjusted based on the adaptive weight algorithm, it is conducive to accurately adapting to the differences in feature importance of different event scenarios, thereby effectively improving the analysis accuracy when facing complex events or new events.

[0048] It is understandable that, in actual applications, the information system production event analysis system can also be deployed inside the information system, which is not limited in this application.

[0049] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0050] This application provides an information system production event analysis system. This system is described in detail below, using its application to a banking business system as an example. It is worth noting that in this embodiment, the bank's business systems and the information system production event analysis system are deployed independently. This independent deployment architecture adheres to the financial industry's security standard of isolating production systems from operations and maintenance systems. Figure 2 A schematic diagram of the structure of an information system production event analysis system provided in an embodiment of the present application Figure 1 ,like Figure 2 As shown, the system of this embodiment includes a data acquisition module, a data preprocessing module, and an event level analysis module.

[0051] like Figure 2As shown, in this embodiment, the data acquisition module directly interacts with the information system as the input of the information system production event analysis system. When a production event of any target event type is acquired through the information system user interface, the module determines the event feature requirements corresponding to the target event type and, based on the event feature requirements, acquires the target event feature set for the production event.

[0052] In this embodiment, for a banking system, production events include event types such as business processing, account balance, posting time, service information, and other. A production event of any target event type is specifically a production event of any of these types. Accordingly, the event feature requirements corresponding to an event type specifically indicate the event features to be considered when analyzing production events of that event type. The target event feature set includes event features corresponding to a production event.

[0053] Specifically, for business processing-related production events, the target event feature set indicated by the event feature requirements includes: affected application systems, number of affected applications, impact scope, affected partitions, affected time periods, impact levels, and affected branches. For account balance-related production events, the target event feature set indicated by the event feature requirements includes: amount involved / loss, number of customers involved. For account entry time-related production events, the target event feature set indicated by the event feature requirements includes: amount involved, number of customers involved. For service information-related production events, the target event feature set indicated by the event feature requirements includes: number of mis-sent messages. For other types of production events, the event feature requirements include business impact, etc.

[0054] It is understandable that in actual applications, the classification of production event types of banking business systems can also be based on other methods, such as classification by technical architecture level (such as network layer, application layer, data layer events), classification by risk level (such as high / medium / low risk events), classification by business process link (such as account opening, transaction, clearing events) or classification by regulatory compliance requirements (such as anti-money laundering, data security events). This is not limited in this embodiment. In addition, the event characteristics contained in each production event are not limited, as long as they contain characteristics that affect whether the production event occurs. It should be understood that the same is true for other information systems.

[0055] In this embodiment, when the data acquisition module monitors the occurrence of any target event type of production event in the user interface of the information system, it obtains the event feature requirements of the target event type through a preset mapping relationship table between event types and event feature requirements. It can also obtain the event feature requirements of the target event type through a preset mapping relationship table between production events and event feature requirements. This is not limited in this embodiment.

[0056] Furthermore, the data acquisition module sequentially or in parallel acquires the target event feature set contained in the production event according to the event feature requirements. Specifically, the module acquires the values ​​of each event feature in the target event feature set. For example, when acquiring an account balance production event, the data acquisition module determines the event feature requirements corresponding to the account balance type and then acquires the values ​​of the amount involved / loss and number of customers involved contained in the account balance production event.

[0057] In actual applications, the data acquisition module may also obtain event feature requirements corresponding to the target event type by interacting with the user, or even determine the event feature requirements by combining user interaction with a preset mapping relationship table, which is not limited in this embodiment.

[0058] Furthermore, in this embodiment, the data acquisition module determines that a production event of any target event type has been acquired through the information system user interface upon detecting an abnormality in the user interface, and / or upon receiving an event log automatically reported by the system, and / or upon acquiring an event trigger signal through the API interface. When multiple production events of different event types are acquired simultaneously, the multiple production events are processed in parallel or sequentially according to their respective processing priorities.

[0059] like Figure 2 As shown, in this embodiment, the data processing module is connected to the data acquisition module and is configured to obtain the target event type and target event feature set from the data acquisition module. The data processing module is further configured to convert the target event feature set into a target event feature vector based on the target feature variable assignment rule corresponding to the target event type. The target feature variable assignment rule is used to indicate the current weight of each target event feature set, and the current weight is dynamically adjusted based on an adaptive weighting algorithm.

[0060] In this embodiment, the data processing module obtains the target feature variable assignment rules corresponding to the target event type through a preset mapping relationship table between event types and feature variable assignment rules. Alternatively, the module can obtain the target feature variable assignment rules through a preset mapping relationship table between production events and feature variable assignment rules, which is not limited in this embodiment. The feature variable assignment rules are specifically used to map the raw value of each event feature to a standardized risk value, and then calculate the final target event feature vector based on the current weights of each event feature.

[0061] As an example, for production events related to accounting time, if the event feature set obtained by the data acquisition module includes the amount involved being "5 million yuan" and the number of customers involved being "100 people", then according to the preset threshold rules (such as the risk value below 1 million is 0.1, linearly increasing from 1 million to 5 million, and the risk value above 5 million is 0.8), it is mapped to a risk value of 0.8; according to the threshold rules (such as the risk value below 20 people is 0.1, and linearly increasing to 0.6 for 20-200 people), it is mapped to a risk value of 0.35.

[0062] Furthermore, assuming that the adaptive algorithm currently calculates the amount feature weight as 0.6 (due to the increased risk of large transactions in recent times) and the customer number weight as 0.4 (the current event type is less sensitive to the number of people), the final target event feature vector is [0.8×0.6, 0.35×0.4], or [0.48, 0.14].

[0063] In this embodiment, the feature variable assignment rules support flexible adjustment of mapping logic. For example, when banking business rules are updated, thresholds can be modified (e.g., adjusting the risk value for accounts above 5 million to 0.9) or weighting strategies (e.g., increasing the weight to 0.5 when the number of customers exceeds 100) to dynamically adapt to regulatory requirements or business scenario changes, ensuring the accuracy and timeliness of event analysis.

[0064] It should be understood that the target event feature vector obtained by the above process can be applied to the subsequent event level analysis module for comprehensive evaluation.

[0065] like Figure 2 As shown, in this embodiment, the event-level analysis module is connected to the data processing module and is configured to obtain a target event feature vector through the data processing module. The event-level analysis module is also configured to obtain a target analysis model for the target event type and analyze the target event feature vector based on the target analysis model to obtain an analysis result. The analysis result indicates the event impact level of the event.

[0066] Specifically, in this embodiment, the event-level analysis module obtains a target analysis model for the target event type by mapping event types to analysis models, or by mapping production events to analysis models. The event-level analysis module then inputs the target event feature vector obtained through the aforementioned process into the target analysis model to obtain the corresponding analysis results.

[0067] More specifically, in this embodiment, the target analysis model can use the following methods to determine the event impact level: ① Threshold classification method: A fixed threshold is preset for each event type. For example, when the comprehensive score of the target event feature vector exceeds 0.7, it is judged as a high-level event, 0.4-0.7 as a medium-level event, and below 0.4 as a low-level event. ② Machine learning model: Utilizes a trained classification model (such as a random forest or neural network) to directly classify the target event feature vector and output an event level prediction result. ③ Rule engine matching: Define a series of rule templates, such as "When the risk value of the amount involved is greater than 0.8 and the impact period is during peak trading hours, it is judged as a high-level event," and determine the event level through rule matching.

[0068] In this embodiment, the event level analysis module supports multi-dimensional event level classification, for example: classification according to the degree of impact into serious, major, large, and general; classification according to processing priority into urgent, high, medium, and low; classification according to recovery time requirements into real-time recovery, within 2 hours, within 24 hours, and within 72 hours. This is not limited in this embodiment.

[0069] In addition, in this embodiment, the analysis model supports incremental learning based on historical event samples. When new event patterns appear, the system automatically updates the model parameters to ensure analysis accuracy.

[0070] In the information system production event analysis system provided by this embodiment, the data acquisition module accurately extracts key features (such as amount, number of customers) according to the event type, and the data processing module adjusts the feature importance in real time through a dynamic weight algorithm (such as increasing the weight of the amount feature for large transactions), thereby avoiding the recognition bias of traditional fixed rules for new events, which is conducive to the system maintaining analysis accuracy when banking business rules are updated or new risks emerge.

[0071] The system of this embodiment effectively solves the problems of fixed feature weights and poor model adaptability in traditional event analysis, thereby improving the accuracy of information system production event analysis, especially in complex financial scenarios (such as cross-system failures and AI-driven fraud), showing higher event recognition accuracy and response efficiency.

[0072] As a further design, Figure 3 A schematic diagram of the structure of an information system production event analysis system provided in an embodiment of the present application Figure 2 ,like Figure 3 As shown, the system of this embodiment also includes a configuration management module and a model library.

[0073] like Figure 3As shown, the data preprocessing module is connected to the configuration management module and is used to obtain the target feature variable assignment rules from the configuration management module. Specifically, the configuration management module is used to store the feature variable assignment rules of the production event of each event type.

[0074] In this embodiment, the configuration management module is also used to: for each event type, determine the weights of each event feature contained in the event type according to the event type; based on the adaptive weight algorithm, update the weights of each event feature according to at least one of the following items to obtain the current weight: real-time data related to the event type, analysis results of associated events of the production events of the event type, and historical misjudgment information corresponding to the event type; the associated events of the production events of the event type are determined based on the industry knowledge graph.

[0075] Specifically, when the configuration management module obtains the current weight based on the real-time data related to the event type, it is specifically used to: calculate the statistical indicators of each event feature of the event type according to the real-time data related to the event type, increase the weight corresponding to the event feature with abnormal statistical indicators, and obtain the current weight of the event feature with abnormal statistical indicators; and / or, calculate the change rate of each event feature of the event type according to the real-time data related to the event type, increase the weight corresponding to the event feature with a change rate greater than the preset change rate, and obtain the current weight of the event feature with a change rate greater than the preset change rate; and / or, calculate the correlation coefficient between the event features of the event type according to the real-time data related to the event type, determine the redundant features between the event features, and reduce the weight of the redundant features to obtain the current weight of the redundant features.

[0076] When the configuration management module obtains the current weight based on the analysis results of the associated events of the production event of the event type, it is specifically used to: determine the relevant features in the event type according to the associated events; adjust the weights of the relevant features according to the analysis results of the associated events to obtain the current weights of the relevant features; the more serious the impact level of the production event indicated by the analysis results, the more the weights of the relevant features increase.

[0077] When the configuration management module determines the current weight based on the historical misjudgment information corresponding to the event type, it is specifically used to: determine the misjudgment feature in the event type according to the historical misjudgment information, and the number of misjudgment features exceeds the preset number; the misjudgment feature is determined based on the contribution of each event feature to the prediction error; reduce the weight of the misjudgment feature to obtain the current weight of the misjudgment feature.

[0078] More specifically, for the first method mentioned above, the configuration management module continuously calculates statistical indicators such as the daily month-on-month growth rate and standard deviation for each event feature (such as the "amount involved") based on real-time data related to the event type; when the fluctuation range of the indicator of a certain event feature exceeds the preset threshold (such as a 50% daily month-on-month increase), the weight adjustment process is triggered; among which, the adjustment range is set according to the volatility level (such as mild fluctuation: weight increase by 20%; severe fluctuation: weight increase by 50%).

[0079] More specifically, for the second method mentioned above, the configuration management module builds an event association network based on the industry knowledge graph (such as "system response timeout" → "transaction failure" → "customer complaint"); when a target event is detected, it automatically queries its associated event set and extracts key features in the associated events; for features that are strongly correlated with the associated events (such as "impact period" in the "system response timeout" event), its weight is increased.

[0080] More specifically, for the third method mentioned above, the configuration management module maintains a historical misjudgment event library and analyzes the characteristic factors that lead to misjudgment; for features that frequently lead to misjudgment (such as the "number of customers" having too low a weight in credit card fraud events), its initial weight is gradually reduced; among them, the correction amplitude is dynamically adjusted according to the misjudgment frequency (for example, when the misjudgment frequency is >30%, the weight is reduced by 0.1-0.3).

[0081] In this embodiment, the configuration management module specifically weights and fuses the adjustment results of the above three dimensions to obtain temporary weights for each event feature. It should be understood that the sum of the various temporary weights should be 1. In actual applications, the configuration management module may also combine any one or two of these dimensions to determine the current weight of each event feature, which is not limited in this embodiment. In addition, the configuration management module may also combine other dimensions to adaptively adjust the current weight of each event feature, which is also not limited in this embodiment.

[0082] The above-mentioned adaptive weight updating method can demonstrate significant advantages in current banking business scenarios: it can dynamically capture abnormal features (such as a sudden increase in the amount of large transactions) based on real-time data fluctuations, and combine knowledge graph association analysis to explore potential risk chains (such as the linkage effect of system failures and transaction failures). Then, it continuously optimizes weight distribution through historical misjudgment feedback, enabling the system to more accurately identify key event characteristics when facing the ever-changing risk patterns in banking business, improve the accuracy and timeliness of event analysis, and enhance the adaptability to new risks and changes in business rules, without the need for frequent manual adjustments to maintain efficient event analysis capabilities.

[0083] As another design, in this embodiment, the configuration management module is further configured to store a first mapping relationship between event types and analysis models, as well as a second mapping relationship between event impact values ​​and event impact levels. Based on this, the event level analysis module is specifically configured to: determine the target analysis model corresponding to the event type by accessing the first mapping relationship; input the target event feature vector into the target analysis model to obtain the event impact value output by the target analysis model; and, by accessing the second mapping relationship, search and obtain the event impact level corresponding to the event impact value to obtain the analysis result.

[0084] Specifically, in this embodiment, the analysis model specifically adopts the multivariate linear regression equation: Y=a0+a1X1+a2X2+…+anXn, where Y is used to represent the numerical value of the event impact; X1-Xn are respectively used to represent the n event characteristic values ​​(such as the amount risk value, the customer quantity risk value) contained in the production event corresponding to the event type, which are obtained from the corresponding event characteristic vector; a0 is the constant term, and a1-an are respectively used to represent the regression coefficients of each event characteristic.

[0085] It should be understood that the analytical model is specifically based on a sample of historical production events (e.g., 100,000 annotated event data points) and uses the least squares method to solve for regression coefficients, minimizing the mean squared error between the predicted value and the actual impact. For example, for "account balance" events, the training data includes the feature vectors [X1 (amount risk value), X2 (customer number risk value)] and the corresponding impact Y. Solving this equation yields the equation Y = 0.1 + 0.6X1 + 0.4X2.

[0086] In this embodiment, the event level analysis module inputs the target event feature vector into the target analysis model to obtain the corresponding event impact value. Furthermore, the event impact value is divided into fixed intervals based on the second mapping relationship, for example: Y ≥ 0.7 → "Severe" level; 0.4 ≤ Y < 0.7 → "Major" level; 0.2 ≤ Y < 0.4 → "Fair" level; Y < 0.2 → "Minor" level.

[0087] In the above process, the system leverages the interpretability and stability of the multivariate linear regression model to accurately determine the impact level of an event. In practical applications, other analytical models can also be used, such as nonlinear models like random forests and neural networks, or expert systems based on rule engines, to adapt to the analysis needs of different event types. The coefficients of the multivariate linear regression model directly reflect the importance of each feature (for example, a coefficient of 0.6 for the monetary amount feature is higher than a coefficient of 0.4 for the number of customers), making it easier for operations personnel to understand risk drivers while also minimizing the model's computational complexity.

[0088] As a preferred embodiment, the first mapping relationship is further used to indicate the affected objects corresponding to the event type. Based on this, the event level analysis module is further used to: determine the affected objects corresponding to the event type by accessing the first mapping relationship; and generate prompt information based on the affected objects and the analysis results.

[0089] Specifically, affected objects refer to the parts of the banking system that will be impacted when a production event of this event type occurs. In this embodiment, the first mapping relationship can further indicate the priority of the affected objects based on their degree of impact or importance. Based on this, when the event level analysis module generates prompt information based on the affected objects and analysis results, the prompt information not only indicates the affected parts but also indicates the priority level.

[0090] Through the above settings, the system can accurately and tieredly push risk information based on the mapping between event type and the priority of the affected objects. In banking scenarios, when a production event occurs, the event level analysis module quickly locates the affected critical business systems (such as core transaction systems), customer groups (such as VIP customers), or branches, and generates differentiated alerts based on the event's impact level. For example, for "critical" events affecting "core transaction systems" (high-priority objects), the system will issue both pop-up notifications and SMS messages, requiring operations personnel to address them immediately. Meanwhile, for "normal" events affecting ordinary customers (low-priority objects), only a brief internal notification will be pushed. This priority-based alert mechanism not only improves the targeted and timely nature of risk response, but also helps the bank's operations team allocate resources more effectively, reduces the probability of decision-making errors caused by information overload, and effectively ensures business continuity and customer service quality.

[0091] In addition, if Figure 3 As shown, the system of the present application also includes a model library, which includes an analysis model for each event type; on this basis, the event-level analysis module is specifically used to: search and obtain the target analysis model by accessing the model library; the target analysis model is a multivariate regression model obtained based on the event characteristics contained in the production event of the target event type.

[0092] Specifically, independent namespaces are divided according to event types (such as "account balance class" and "service information class"). Each space stores the multivariate regression model parameters (regression coefficient matrix and constant term) of the corresponding event. For example, the "account balance class" model is stored as {"a0": 0.1, "a1": 0.6, "a2": 0.4}, corresponding to the equation Y=0.1+0.6X1+0.4X2.

[0093] Specifically, in this embodiment, the event-level analysis module quickly locates model files using event type codes (e.g., "ACC001"). Furthermore, the method for obtaining the analysis models corresponding to each event type can be found in the previous embodiments and will not be further elaborated here. As a preferred design, in this embodiment, when the number of newly added event samples reaches 10,000, incremental model training is triggered. More specifically, the stochastic gradient descent algorithm is used to update the regression coefficients to maintain the continuity of the historical model. During the validation phase, the mean squared error of the new and old models is compared on the test set, and an automatic rollback is performed if the error increase exceeds 5%.

[0094] Through the above setup, the system has built a complete and adaptive event analysis model management system. This system significantly improves the efficiency and accuracy of production event analysis through the coordinated efforts of three mechanisms: tiered storage, fast retrieval, and incremental updates. The tiered storage mechanism isolates and manages model parameters for different event types, the fast retrieval mechanism directly locates the target model based on event encoding, and the incremental training mechanism continuously optimizes regression coefficients using small batches of data. Together, these three mechanisms provide financial institutions with an efficient and scalable risk monitoring solution.

[0095] The present application also provides an information system production event analysis method. Figure 4 This is a flow chart of an information system production event analysis method provided in an embodiment of the present application. Figure 4 As shown, the information system production event analysis method of the present application includes:

[0096] S401 , when an event of any target event type is acquired through the user interface of the information system, an event feature requirement corresponding to the target event type is determined, and a target event feature set of the event is acquired based on the event feature requirement.

[0097] S402 : Convert the target event feature set into a target event feature vector according to a target feature variable assignment rule corresponding to the target event feature set.

[0098] The target feature variable assignment rule is used to indicate the current weight of each event feature contained in the target event feature set, and the current weight is dynamically adjusted based on the adaptive weight algorithm.

[0099] S403: Analyze the target event feature vector based on the target analysis model of the target event type to obtain an analysis result.

[0100] The analysis result is used to indicate the event impact level of the event.

[0101] It should be understood that the method of this embodiment is executed by any electronic device. In the method provided in this embodiment, the electronic device identifies production events by real-time monitoring of abnormal prompts on the user interface, receiving event logs automatically reported by the system, or obtaining event trigger signals through the API interface. If an event is detected, the feature requirements corresponding to the target event type are quickly matched through the preset event type and event feature requirement mapping relationship table; if there is no corresponding record in the mapping table, the requirements are supplemented by interacting with the user, or feature requirements are automatically generated in combination with historical similar events. For example, when an "account amount type" event is monitored, the system automatically obtains features such as the amount involved and the number of customers involved.

[0102] Furthermore, the electronic device normalizes the raw values ​​of each event feature based on the target feature variable assignment rules for the target event type. This is combined with the current weights dynamically adjusted by the adaptive weighting algorithm to calculate the target event feature vector. The adaptive weighting algorithm automatically updates the weights every five minutes based on real-time data fluctuations (for example, increasing the weight when the dollar value feature exceeds a threshold on a daily basis), analysis of related events (adjusted based on the knowledge graph), and historical misjudgment information (reducing the weight of features with high-frequency misjudgments), ensuring that the feature vector accurately reflects event risk.

[0103] Finally, the electronic device accesses the first mapping relationship between event types and analysis models to obtain the multivariate linear regression model corresponding to the target event type as the target analysis model. The target event feature vector is input into the target analysis model to calculate the event impact value. The event impact value is then mapped to the corresponding level through the second mapping relationship between the event impact value and the event impact level, and the analysis result is finally output.

[0104] Through the method of this embodiment, the automation and intelligence of the entire process from event capture, feature processing to impact assessment are achieved. Compared with traditional methods, it effectively solves the problems of low efficiency and high misjudgment rate of production event analysis in banking business systems, and provides an accurate and efficient decision-making basis for risk management.

[0105] The above embodiment introduces an information system production event analysis method from the perspective of method flow, and the following embodiment introduces an information system production event analysis device from the perspective of a virtual module or virtual unit. Please refer to the following embodiment for details.

[0106] The present invention provides an information system production event analysis device. Figure 5 A schematic diagram of the structure of an information system production event analysis device provided in an embodiment of the present application is shown as follows: Figure 5 As shown, the device includes:

[0107] A determination module 51 is configured to, when a production event of any target event type is obtained through the user interface of the information system, determine an event feature requirement corresponding to the target event type, and obtain a target event feature set of the production event based on the event feature requirement;

[0108] A conversion module 52 is configured to convert the target event feature set into a target event feature vector according to a target feature variable assignment rule corresponding to the target event feature set; the target feature variable assignment rule is configured to indicate the current weight of each event feature included in the target event feature set, and the current weight is dynamically adjusted based on an adaptive weight algorithm;

[0109] The analysis module 53 is used to analyze the target event feature vector based on the target analysis model of the target event type to obtain an analysis result; the analysis result is used to indicate the event impact level of the production event.

[0110] An information system production event analysis device provided in an embodiment of the present application is applicable to the method embodiment of the above-mentioned information system production event analysis method, which will not be described in detail here.

[0111] An electronic device is provided in an embodiment of the present application. Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, Figure 6 The electronic device shown includes a processor 61 and a memory 62. The processor 61 and the memory 62 are connected, for example, via a bus 63. Optionally, the electronic device may further include a transceiver 64. It should be noted that in actual applications, the number of transceivers 64 is not limited to one, and the structure of the electronic device does not constitute a limitation on the embodiments of the present application.

[0112] The processor 61 may be a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor 61 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0113] The bus 63 may include a path for transmitting information between the above components. The bus 63 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus 63 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus 63 or one type of bus 63.

[0114] The memory 62 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0115] The memory 62 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 61. The processor 61 is used to execute the application code stored in the memory 62 to implement the content shown in the above method embodiment.

[0116] The present application also provides a computer-readable storage medium, which may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program code. Specifically, the computer-readable storage medium stores program instructions, and the program instructions are used to implement the methods in the above embodiments.

[0117] A computer program product is also provided in an embodiment of the present application, including a computer program. When the computer program is executed by a processor, the technical solution of the above-mentioned method embodiment is implemented. Its implementation principle and technical effect are similar and will not be repeated here.

[0118] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered merely as exemplary, and the true scope and spirit of the present application are indicated by the claims.

[0119] It should be understood that the present application is not limited to the exact structure described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. An information system production event analysis system, characterized in that: The system comprises: A data acquisition module is configured to, when a production event of any target event type is acquired through the user interface of the information system, determine the event feature requirements corresponding to the target event type, and acquire a target event feature set of the production event based on the event feature requirements; a data preprocessing module, configured to obtain the target event type and the target event feature set, and convert the target event feature set into a target event feature vector according to a target feature variable assignment rule corresponding to the target event type; the target feature variable assignment rule is configured to indicate a current weight of each event feature included in the target event feature set, and the current weight is dynamically adjusted based on an adaptive weight algorithm; An event level analysis module is used to obtain a target analysis model of the target event type and the target event feature vector, and analyze the target event feature vector based on the target analysis model to obtain an analysis result; the analysis result is used to indicate the event impact level of the production event.

2. The system according to claim 1, wherein: The system further includes a configuration management module, which is used to store characteristic variable assignment rules for production events of each event type; the configuration management module is also used to: For each event type, determining the weight of each event feature included in the event type according to the event type; Based on the adaptive weight algorithm, the weight of each event feature is updated according to at least one of the following items to obtain the current weight: real-time data related to the event type, analysis results of associated events of production events of the event type, and historical misjudgment information corresponding to the event type; associated events of production events of the event type are determined based on the industry knowledge graph.

3. The system according to claim 2, characterized in that The configuration management module is specifically used to: Calculating statistical indicators of each event feature of the event type based on real-time data related to the event type, increasing the weight corresponding to the event feature with abnormal statistical indicators, and obtaining the current weight of the event feature with abnormal statistical indicators; and / or, calculating the rate of change of each event feature of the event type based on real-time data related to the event type, increasing the weight corresponding to the event feature having a rate of change greater than a preset rate of change, and obtaining the current weight of the event feature having a rate of change greater than the preset rate of change; And / or, based on real-time data related to the event type, calculate the correlation coefficient between each event feature of the event type, determine the redundant features between the event features, and reduce the weight of the redundant features to obtain the current weight of the redundant features.

4. The system according to claim 2 or 3, characterized in that The configuration management module is specifically used to: Determining relevant features in the event type according to the associated event; The weight of the relevant feature is adjusted according to the analysis result of the associated event to obtain the current weight of the relevant feature; the more serious the impact level of the production event indicated by the analysis result is, the more the weight of the relevant feature increases.

5. The system according to claim 2 or 3, characterized in that The configuration management module is specifically used to: Determining, based on the historical misjudgment information, a misjudgment feature in the event type, wherein the number of misjudgments of the misjudgment feature exceeds a preset number; and determining the misjudgment feature based on the contribution of each event feature to the prediction error; The weight of the misjudgment feature is reduced to obtain the current weight of the misjudgment feature.

6. The system according to any one of claims 1 to 3, characterized in that: The system further includes a model library, which includes an analysis model for each event type; the event level analysis module is specifically configured to: The target analysis model is searched and obtained by accessing the model library; the target analysis model is a multiple regression model obtained based on event features contained in production events of the target event type.

7. The system according to any one of claims 1 to 3, characterized in that: The configuration management module is further configured to store a first mapping relationship between the event type and the analysis model, and a second mapping relationship between the event impact value and the event impact level; the event level analysis module is specifically configured to: Determining a target analysis model corresponding to the event type by accessing the first mapping relationship; Inputting the target event feature vector into the target analysis model to obtain the event impact value output by the target analysis model; The event impact level of the event impact value is searched and acquired by accessing the second mapping relationship to obtain the analysis result.

8. The system according to claim 7, characterized in that The first mapping relationship is further used to indicate an affected object corresponding to the event type; and the event level analysis module is further used to: Determine the affected object corresponding to the event type by accessing the first mapping relationship; Prompt information is generated according to the affected object and the analysis result.

9. A method for analyzing production events in an information system, characterized in that: The method comprises: When a production event of any target event type is obtained through the user interface of the information system, an event feature requirement corresponding to the target event type is determined, and a target event feature set of the production event is obtained based on the event feature requirement; Converting the target event feature set into a target event feature vector according to a target feature variable assignment rule corresponding to the target event feature set; the target feature variable assignment rule is used to indicate the current weight of each event feature included in the target event feature set, and the current weight is dynamically adjusted based on an adaptive weight algorithm; The target event feature vector is analyzed based on the target analysis model of the target event type to obtain an analysis result; the analysis result is used to indicate the event impact level of the production event.

10. An information system production event analysis device, characterized in that: The device comprises: a determination module configured to, when a production event of any target event type is obtained through a user interface of the information system, determine an event feature requirement corresponding to the target event type, and obtain a target event feature set of the production event based on the event feature requirement; a conversion module, configured to convert the target event feature set into a target event feature vector according to a target feature variable assignment rule corresponding to the target event feature set; the target feature variable assignment rule is configured to indicate a current weight of each event feature included in the target event feature set, the current weight being dynamically adjusted based on an adaptive weight algorithm; An analysis module is used to analyze the target event feature vector based on a target analysis model of the target event type to obtain an analysis result; the analysis result is used to indicate the event impact level of the production event.

11. An electronic device, characterized in that: include: at least one processor, and a memory communicatively coupled to the processor; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory to implement the method according to claim 9.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to claim 9 when executed by a processor.

13. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to claim 9 when the computer program is executed by a processor.

Images