Dynamic risk assessment management method and system based on business risk control

Abstract

The embodiment of the invention provides a dynamic risk assessment management method and system based on business risk control, and belongs to the technical field of business risk monitoring. Comprising the following steps: acquiring behavior data of a user, and performing statistical feature extraction on the behavior data; constructing a dynamic Bayesian network according to the statistical characteristics of the behavior data; performing incremental updating on a conditional probability table of a dynamic Bayesian network according to the real-time behavior data; constructing and training an LSTM model and a random forest model by adopting the behavior data; acquiring a current comprehensive risk assessment result according to the real-time behavior data, the dynamic Bayesian network, the LSTM model and the random forest model; a multi-model fusion mode is adopted, so that the risk assessment precision can be effectively improved; and finally, an adversarial sample is constructed, and the dynamic Bayesian network and the LSTM model are trained offline according to the adversarial sample, so that the generalization ability for an unknown attack mode can be improved, and the security is higher.

Description

Technical Field

[0001] The present invention relates to the technical field of business risk monitoring, and in particular to a dynamic risk assessment management method and system based on business risk control. Background Art

[0002] With the rapid development of the internet and the continuous advancement of network technology, more and more internet business applications are being used. How to ensure the normal operation of business while effectively controlling business risks is a real problem and difficulty faced by all internet companies today.

[0003] Traditional enterprise business risk control systems are typically based on static rules, meaning they use fixed rules to monitor user behavior within the risk control system. However, this static rule-based approach can only monitor and manage fixed behaviors, and is difficult to adapt to dynamically changing user behavior and business environments. Consequently, the risk control system suffers from poor reliability and security.

[0004] During the process of realizing the present invention, the inventors of the present application discovered that the above-mentioned solutions in the prior art have the defects of poor reliability and low security of the risk control system. Summary of the Invention

[0005] The purpose of the embodiments of the present invention is to provide a dynamic risk assessment management method and system based on business risk control, which has the functions of good reliability and high security of the business risk control system.

[0006] To achieve the above objectives, an embodiment of the present invention provides a dynamic risk assessment management method based on business risk control, comprising: Obtaining user behavior data and performing statistical feature extraction on the behavior data; constructing a dynamic Bayesian network based on the statistical characteristics of the behavioral data; Incrementally updating the conditional probability table of the dynamic Bayesian network according to the real-time behavioral data; Build and train an LSTM model and a random forest model using the behavioral data; Obtaining a current comprehensive risk assessment result based on the real-time behavioral data and the dynamic Bayesian network, the LSTM model, and the random forest model, including: According to formula (1), the comprehensive risk assessment result is obtained. , (1) in, is the comprehensive risk assessment result, is the risk probability of the dynamic Bayesian network, is the sequence anomaly score of the LSTM model, is the classification probability of the random forest model, is the fusion weight of the dynamic Bayesian network, is the fusion weight of the LSTM model, is the fusion weight of the random forest model; Determine the current business risk level based on the comprehensive risk assessment results; Construct adversarial samples and train the dynamic Bayesian network and the LSTM model offline.

[0007] Optionally, extracting statistical features from the behavior data includes: Preset the size of the sliding window; dividing the behavior data according to the sliding window; Obtain statistical features within the sliding window.

[0008] Optionally, constructing a dynamic Bayesian network according to the statistical characteristics of the behavior data includes: Get the mutual information value between the data in the sliding window; Determining whether the mutual information value is greater than a preset threshold; When it is determined that the mutual information value is greater than a preset threshold, a dependency edge across time slices is established to dynamically adjust the network structure.

[0009] Optionally, constructing a dynamic Bayesian network based on the statistical characteristics of the behavioral data further includes: According to formula (2), the Bayesian information criterion score is obtained. , (2) in, Score the Bayesian Information Criterion, is the number of data samples, is the number of model parameters, is the maximum log-likelihood estimate of the model, is the structural stability weight, For the The number of edge changes in the time window, is the time decay rate, is the window number, is the maximum window number; The optimal network structure is obtained according to the Bayesian Information Criterion score.

[0010] Optionally, incrementally updating the conditional probability table of the dynamic Bayesian network according to the real-time behavior data includes: Constructing new samples based on the real-time behavioral data; Update the conditional probability table of the dynamic Bayesian network according to formula (3), , (3) in, is the incrementally updated conditional probability estimate, is the conditional probability estimate of historical data, is the conditional probability estimate of the new data, is the number of historical samples, is the number of new samples, For the forgetting factor.

[0011] Optionally, obtaining a current comprehensive risk assessment result based on the real-time behavioral data and the dynamic Bayesian network, the LSTM model, and the random forest model includes: Obtaining the risk probability output by the dynamic Bayesian network; Obtaining a sequence anomaly score output by the LSTM model; Obtaining the classification probability output by the random forest model; Obtain the average F1 scores of the dynamic Bayesian network, the LSTM model, and the random forest model in K sliding windows respectively; Obtaining corresponding fusion weights according to the average F1 scores of the dynamic Bayesian network, the LSTM model, and the random forest model; A comprehensive risk assessment result is obtained based on the risk probability, the sequence anomaly score, the classification probability, and the corresponding average F1 score.

[0012] Optionally, obtaining corresponding fusion weights according to average F1 scores of the dynamic Bayesian network, the LSTM model, and the random forest model includes: According to formula (4), the fusion weight of the model is obtained. , (4) in, For the The fusion weight of the model, For the The average F1 score of the models, is an integer number, ,and , For the dynamic Bayesian network, For the LSTM model, is the random forest model.

[0013] Optionally, determining the current business risk level according to the current comprehensive risk assessment result includes: Obtaining the current business risk level threshold of the sliding window and initializing the accumulated value, wherein the business risk level threshold includes a relatively large risk basic threshold and a severe risk basic threshold; Determining whether the comprehensive risk assessment result of the current sliding window is greater than or equal to a large risk basic threshold; If it is determined that the comprehensive risk assessment result of the current sliding window is greater than or equal to the large risk basic threshold, determining whether the comprehensive risk assessment result of the current sliding window is less than the severe risk basic threshold; When it is determined that the comprehensive risk assessment result of the current sliding window is less than the severe risk basic threshold, obtaining the business risk level corresponding to the previous adjacent sliding window; Determining whether the business risk level corresponding to the previous adjacent sliding window is greater than or equal to a large risk basic threshold and less than a severe risk basic threshold; If it is determined that the business risk level corresponding to the previous adjacent sliding window is greater than or equal to the larger risk base threshold and less than the severe risk base threshold, the accumulated value is increased by one, and the business risk level corresponding to the previous adjacent sliding window is returned; When it is determined that the business risk level corresponding to the previous adjacent sliding window is less than the larger risk basic threshold or greater than or equal to the severe risk basic threshold, obtaining the current cumulative value; According to formula (5), the optimized comprehensive risk assessment value of the current sliding window is obtained. , (5) in, is the optimized comprehensive risk assessment value of the current sliding window, is the comprehensive risk assessment result of the current sliding window, is the risk enhancement factor, and , is the current cumulative value; Determining whether the optimized comprehensive risk assessment value is greater than or equal to a severe risk basic threshold; If it is determined that the optimized comprehensive risk assessment value is greater than or equal to the severe risk basic threshold, the behavior data of the current sliding window user is determined to be high risk; If it is determined that the optimized comprehensive risk assessment value is less than the severe risk basic threshold, the behavior data of the current sliding window user is determined to be low risk; If it is determined that the comprehensive risk assessment result of the current sliding window is greater than or equal to the severe risk basic threshold, the behavior data of the user in the current sliding window is determined to be high risk; When it is determined that the comprehensive risk assessment result of the current sliding window is less than the larger risk basic threshold, the behavior data of the user in the current sliding window is determined to be low risk.

[0014] Optionally, obtaining the dynamic risk enhancement coefficient may include calculating according to formula (13): , (13) in, The cumulative value is The dynamic risk enhancement coefficient when The preset maximum limit threshold for the accumulated value.

[0015] Optionally, constructing an adversarial sample and re-offlining the dynamic Bayesian network and the LSTM model includes: According to formulas (6) to (7), we can obtain adversarial samples. , (6) , (7) in, is the perturbation vector added to the input sample, is the disturbance intensity, is the input sample, For input For the loss function The gradient, is the sample label, is a symbolic function, is the adversarial sample; Acquire a mixed training sample based on the adversarial sample and the real behavior data; Offline training of the dynamic Bayesian network and the LSTM model according to the mixed training samples; Update the model's loss function according to formula (8), , (8) in, is the loss function of the model, is the cross entropy loss, To counter the loss weight, is the KL divergence, The model output probability distribution for normal data, Output probability distribution for the model under adversarial data.

[0016] Optionally, the dynamic risk assessment management method further includes: Get the business type and risk weight corresponding to the current sliding window; According to formula (10), the critical risk threshold of the current sliding window is obtained. , (10) in, is the critical risk threshold of the current sliding window, is the risk weight of the business type corresponding to the current sliding window, is the basic threshold of the current sliding window; According to formula (11), the cumulative effect risk threshold is obtained: , (11) in, is the cumulative effect risk threshold of the current sliding window, which is also the optimized severe risk base threshold. is the cumulative value, is the threshold compression coefficient.

[0017] Optionally, the dynamic risk assessment management method further includes: Obtain risk diagnosis accuracy, false positive rate, and missed negative rate within a preset time period; Obtain the corresponding feedback factor based on the false alarm rate and missed alarm rate; According to formula (12), the feedback adjustment threshold is obtained: , (12) in, is the feedback adjustment threshold, is the feedback factor.

[0018] On the other hand, the present invention also provides a dynamic risk assessment and management system based on business risk control, comprising: A data collection module, connected to the business system, for collecting behavioral data in the business system; The control module is connected to the data acquisition module and is used to execute any of the dynamic risk assessment management methods described above.

[0019] Through the above technical solution, the dynamic risk assessment management method and system based on business risk control provided by the present invention obtains user behavior data and extracts statistical features from the user behavior data to construct a dynamic Bayesian network. At the same time, the conditional probability table of the dynamic Bayesian network is incrementally updated based on the real-time behavior data. The method of constructing the dynamic Bayesian network using statistical features can effectively capture the temporal changes of the behavior data. Incremental online learning can ensure that the model parameters of the dynamic Bayesian network are adaptively adjusted as the behavior data changes. Then, based on the behavior data, an LSTM model and a random forest model are constructed and trained. The current real-time behavior data are respectively input into the dynamic Bayesian network, the LSTM model, and the random forest model to obtain the corresponding predicted risk. Based on the predicted risk, the current comprehensive risk assessment result can be obtained. Based on the comprehensive risk assessment result, the current business risk level can be determined. The use of multi-model fusion can effectively improve the accuracy of risk assessment. Finally, an adversarial sample is constructed. Based on the adversarial sample, the dynamic Bayesian network and the LSTM model are trained offline, which can improve the generalization ability of unknown attack patterns and provide higher security.

[0020] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following detailed description, they are used to explain the embodiments of the present invention, but do not constitute a limitation of the embodiments of the present invention. In the accompanying drawings: Figure 1 is a flow chart of a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention; Figure 2 This is a flowchart of extracting statistical features in a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention; Figure 3 is a flowchart of constructing a dynamic Bayesian network in a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention; Figure 4 is a flowchart of network incremental learning in a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention; Figure 5 This is a flowchart of obtaining comprehensive risk assessment results in a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention; Figure 6 This is a flowchart for adding adversarial samples to a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention; Figure 7 This is a flowchart of determining user behavior data risk in a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention; Figure 8 This is a flowchart of obtaining a cumulative effect risk threshold in a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention; Figure 9 This is a flowchart of obtaining feedback adjustment thresholds in a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The following describes the specific implementation of the embodiment of the present invention in detail with reference to the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the embodiment of the present invention and is not used to limit the embodiment of the present invention.

[0023] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of laws and regulations. In the embodiments of this application, certain software, components, models, and other existing solutions in the industry may be mentioned. These should be considered as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use such solutions.

[0024] Figure 1 This is a flow chart of a dynamic risk assessment management method based on business risk control according to an embodiment of the present invention. Figure 1 In the present invention, the dynamic risk assessment management method may include: In step S10, the user's behavior data is obtained and statistical features are extracted from the behavior data. The user's behavior data can be monitored and obtained from the business system, and can be divided in a sliding window / time window manner to divide the user's behavior data into continuous time windows. Specifically, the steps for extracting statistical features of the behavior data may include: Figure 2 Specifically, Figure 2 In the step of extracting the statistical features, the step may include: In step S100, the size of the sliding window is preset. This sliding window is also known as a time window and can be a fixed duration, such as 5 minutes. The division of the sliding window directly affects the input data range for incremental learning. The window size needs to match the time series change rate of the business scenario. For example, high-frequency trading scenarios use a second-level window.

[0025] In step S101, the behavior data is divided according to sliding windows, wherein the behavior data can be divided into multiple windows of continuous time according to fixed time lengths.

[0026] In step S102, statistical features within the sliding window are obtained, wherein the features extracted from each window may include Markov transition probability, access frequency variance, path transition entropy, etc.

[0027] In step S11, a dynamic Bayesian network is constructed based on the statistical features of the behavioral data. This involves expanding the static Bayesian network into a dynamic structure, introducing time dependencies, and dynamically updating the network connectivity based on the statistical features extracted within the window to capture temporal changes in behavioral patterns / behavioral data.

[0028] In step S12, the conditional probability table of the dynamic Bayesian network is incrementally updated based on the real-time behavioral data. Considering the possibility of sudden changes in the behavior patterns and behavior data of users within the business system, the conditional probability table (CPT) can be updated in real time using incremental likelihood estimation to ensure that the model quickly adapts to the current behavior patterns.

[0029] In step S13, the behavioral data is used to construct and train an LSTM model and a random forest model. Considering that traditional approaches often rely on isolated risk estimation models, the generalization capabilities of single models are insufficient, and their performance is limited in complex attack scenarios. Therefore, the LSTM and random forest models are constructed simultaneously to form a multi-model risk prediction framework with a dynamic Bayesian network. Specifically, the LSTM model excels at analyzing time series patterns, while the random forest model is highly resistant to noise.

[0030] In step S14, the current comprehensive risk assessment results are obtained based on the real-time behavioral data and the dynamic Bayesian network, LSTM model, and random forest model. Integrating the dynamic Bayesian network, LSTM model, and random forest model for risk prediction can produce the corresponding predicted risk. Combining the predicted risks of multiple models can effectively improve the accuracy of risk assessments of user behavior in the current business system.

[0031] In step S15, the current business risk level is determined based on the current comprehensive risk assessment result. Business risk levels can be predefined, and the thresholds between different risk levels can include a greater risk base threshold and a severe risk base threshold. Specifically, if the comprehensive risk assessment result of the current sliding window is less than the greater risk base threshold, it indicates that the user's current behavior data has a low risk, also known as low risk, and can be continuously monitored. If the comprehensive risk assessment result of the current sliding window is greater than or equal to the greater risk base threshold but less than the severe risk base threshold, it indicates that the user's current behavior data has a greater risk, also known as medium risk, and falls within the range where risk determination is more difficult, requiring focused monitoring. If the comprehensive risk assessment result of the current sliding window is greater than or equal to the severe risk base threshold, it indicates that the user's current behavior data has a severe risk, also known as high risk, and certain measures need to be taken to suppress / prevent the occurrence of high-risk user behavior, such as triggering permission downgrade, access restriction, or an alarm mechanism. Therefore, the business risk level of the current user's behavior data can be determined based on the comprehensive risk assessment result of the current sliding window, and corresponding measures can be taken based on the business risk level to protect the security and reliability of the business system.

[0032] In step S16, adversarial examples are constructed and the dynamic Bayesian network and LSTM model are trained offline. By generating adversarial examples that simulate attacks from the black and gray markets (such as abnormally high-frequency access and path hopping), injecting adversarial examples during offline training and optimizing model parameters, the generalization capability to unknown attack patterns can be enhanced.

[0033] In steps S10 to S16, user behavior data from the business system is first collected, including historical and real-time behavior data. Historical behavior data can be used to train the model. The behavior data is divided into time windows, and statistical features are extracted for each window. A dynamic Bayesian network is constructed based on these statistical features. Simultaneously, incremental online learning is used to update the conditional probability table of the dynamic Bayesian network, thereby updating the model parameters of the dynamic Bayesian network, enabling it to quickly adapt to changes in behavioral patterns. An LSTM model and a random forest model are simultaneously constructed and trained to form a multi-risk prediction model in conjunction with the dynamic Bayesian network. The predicted risks of these three models are aggregated to produce a comprehensive risk assessment result, which is used to determine the business risk level for a particular service. This business risk level reflects the risk profile of the current user behavior, and corresponding security measures can be determined based on this business risk level. Furthermore, adversarial examples can be constructed and used to train the dynamic Bayesian network and LSTM model offline to further optimize model parameters and enhance generalization capabilities against unknown attack patterns.

[0034] Traditional enterprise business risk control systems are usually based on static rules, that is, a fixed rule is used to monitor the risk of user behavior in the risk control system. However, this static rule approach can only monitor and manage the risk of fixed behaviors, and it is difficult to adapt to dynamically changing user behaviors and business environments, resulting in poor reliability and low security of the risk control system. Moreover, a single isolated model is often used, and the generalization ability is insufficient. In this embodiment of the present invention, a dynamic Bayesian network and an incremental update CPT method are used to enable the model parameters to be adaptively adjusted as the behavior pattern changes, and the adaptability is stronger; at the same time, a dynamic Bayesian network, an LSTM model and a random forest model are used to form a multi-modal risk prediction method, which makes up for the limitations of a single model in complex scenarios and improves the accuracy of risk prediction; the method of constructing adversarial samples can optimize the dynamic Bayesian network and the LSTM model to enhance the generalization ability of unknown attacks.

[0035] In this embodiment of the present invention, after obtaining the statistical characteristics of the behavior data, a dynamic Bayesian network can be constructed according to the statistical characteristics. The steps for constructing the dynamic Bayesian network can be as follows: Figure 3 Specifically, Figure 3 In the network construction step, the network construction step may include: In step S110, the mutual information value between the data in the sliding window is obtained. Based on the sliding window data, the mutual information between variables can be calculated in real time. This mutual information reflects the correlation between the variables, and the network structure can be dynamically adjusted based on the mutual information value. Specifically, the data between the sliding windows can include variables between any two windows.

[0036] In step S111 , it is determined whether the mutual information value is greater than a preset threshold.

[0037] In step S112, if the mutual information value is greater than a preset threshold, dependency edges across time slices are established to dynamically adjust the network structure. If the mutual information value is greater than the corresponding preset threshold and the temporal correlation is significant, dependency edges across time slices can be established to obtain multiple network structures.

[0038] In step S113, the Bayesian Information Criterion score is obtained according to formula (2): , (2) in, Score the Bayesian Information Criterion, is the number of data samples, is the number of parameters of the dynamic Bayesian network model (including the number of network edges + conditional probability parameters), is the maximum log-likelihood estimate of the model, is the structural stability weight, and Including 0.1 to control the penalty strength of edge changes; It is the time decay rate, with a value of 0.05-0.3, which is used to control the weight decay rate of the historical window. The contribution of the historical window decays exponentially. For the The number of edge changes in a time window, the number of historical windows Because the historical window weight is less than 1, it is weakened, thereby suppressing frequent structural jitter. Specifically, the historical window weight can be obtained as shown in formula (14): , (14) in, For the time window weights, where is the window number, and , which is an integer number, is the maximum window number, Corresponding to the latest window, weight No attenuation, with As increases, the weight of the historical window decreases monotonically. Specifically, when hour, Weight , Weight , which not only retains sufficient historical information but also reflects significant attenuation.

[0039] In step S114, the optimal network structure is obtained according to the Bayesian Information Criterion score. Generally speaking, the smaller the Bayesian Information Criterion score, the better the network structure.

[0040] In steps S110 to S114, the mutual information values ​​between the variables in the sliding window are first calculated. Based on the comparison between the mutual information values ​​and the corresponding preset thresholds, cross-time slice dependency edges are established when the mutual information values ​​are greater than the corresponding preset thresholds. The Bayesian Information Criterion score for each network structure is then calculated, and the optimal network structure is determined based on the Bayesian Information Criterion scores.

[0041] In this embodiment of the present invention, considering the continuous changes in user behavior patterns, it is also necessary to perform incremental online learning on the dynamic Bayesian network to incrementally update the model parameters of the dynamic Bayesian network. Specifically, the step of incrementally updating the network model parameters may include the following steps: Figure 4 Specifically, Figure 4 In the step of incrementally updating the network model parameters, the step may include: In step S120 , a new sample is constructed based on the real-time behavior data.

[0042] In step S121, the conditional probability table of the dynamic Bayesian network is updated according to formula (3): , (3) in, is the incrementally updated conditional probability estimate, is the conditional probability estimate of historical data, is the conditional probability estimate of new data / new samples, is the number of historical samples, is the number of new samples, is the forgetting factor, and Including 0.9, which is used to control the decay rate of historical data. The smaller the forgetting factor value, the faster the forgetting.

[0043] In step S120 to step S121, based on the forgetting factor The conditional probability table (CPT) of the dynamic Bayesian network can be updated in real time to balance the weights of historical and new data. Furthermore, for abnormal data, the Mahalanobis distance can be introduced to detect new data outliers. If the value exceeds the confidence interval, updates are suspended to avoid noise interference, thereby ensuring the model's rapid response in data streaming scenarios (latency < 50ms).

[0044] In this embodiment of the present invention, in order to avoid the limitations of a single model in complex scenarios, multiple models can be constructed to obtain a comprehensive risk assessment result with high accuracy. The steps for obtaining the comprehensive risk assessment result can be as follows: Figure 5 Specifically, Figure 5 In the process of obtaining the comprehensive risk assessment results, the steps may include: In step S140, the risk probability output by the dynamic Bayesian network is obtained, wherein the real-time behavior data is input into the dynamic Bayesian network to output the risk probability of the current real-time behavior data.

[0045] In step S141, the sequence anomaly score output by the LSTM model is obtained. The LSTM model generates a sequence anomaly score by analyzing the long-term dependencies of the behavior sequence, such as abnormal path jumps, and normalizes it to 0-1.

[0046] In step S142, the classification probability output by the random forest model is obtained. The random forest model outputs the classification probability based on statistical features, such as access frequency variance.

[0047] In step S143, the average F1 score of the dynamic Bayesian network, LSTM model, and random forest model in K sliding windows is obtained, where F1 is the average F1 score of each model in the most recent K time windows, specifically, K=5.

[0048] In step S144, the corresponding fusion weight is obtained according to the average F1 score of the dynamic Bayesian network, the LSTM model and the random forest model. The attention mechanism dynamically assigns weights according to the F1 scores of each model in the latest K windows. Specifically, the specific method for the fusion weight of each model may include: obtaining the fusion weight of the model according to formula (4), , , (4) in, For the The fusion weight of the model, For the The average F1 score of the models, is an integer number, and . Specifically, When , is a dynamic Bayesian network; When , It is an LSTM model; When , is a random forest model. Specifically, the allocation of fusion weights can include , , .also, It can also be expressed as .

[0049] In step S145, a comprehensive risk assessment result is obtained based on the risk probability, sequence anomaly score, classification probability, and the corresponding average F1 score. The method for obtaining the comprehensive risk assessment result may include: obtaining the comprehensive risk assessment result according to formula (1), , (1) in, is the comprehensive risk assessment result, which can also be expressed as , Current user behavior data Risk Category The probability of is the risk probability, is the sequence anomaly score, is the classification probability. Specifically, the overall accuracy of the comprehensive risk assessment results is increased to 92%, which is 15% higher than that of the single model. For risk categories, that is, comprehensive risk assessment results, can be used to determine the risk level. , a probability range can be given to more clearly divide the risk levels, such as For low risk, For medium risk, For high risk.

[0050] In steps S140 through S145, the risk probability, sequence anomaly score, and classification probability output by the three models are obtained. The corresponding fusion weights are then determined based on the average F1 scores of the three models over the most recent K time windows. Based on the fusion weights and corresponding output values ​​of the three models, a final comprehensive risk assessment result is obtained, from which the corresponding business risk level is determined.

[0051] In this embodiment of the present invention, considering the generalization ability of the business system to unknown attacks, adversarial samples can be added to the offline batch training of the model to improve the robustness of the model. The specific steps can be as follows: Figure 6 Specifically, Figure 6 In , the training steps of the adversarial example may include: In step S160, the adversarial sample is obtained according to formulas (6) to (7), , (6) , (7) in, is the perturbation vector added to the input sample, is the disturbance intensity, , used to control the degree of deviation of adversarial samples, is the input sample, For input 、 For the loss function The gradient of is used to guide the generation direction of adversarial samples. is the sample label, such as normal / risk, is a sign function used to determine the perturbation direction so that the generated adversarial samples can effectively interfere with the judgment of the model. When the gradient is positive, Returns 1, indicating that increasing the disturbance in this direction will shift the model output toward the risk category. When the gradient is negative, Returns -1, indicating that decreasing the corresponding value in that direction would shift the model output toward the risk category. Specifically, adversarial behavior data is generated based on FGSM (Fast Gradient Sign Method), which involves adding small perturbations to make normal access paths mistakenly judged as high-risk.

[0052] In step S161, a mixed training sample is obtained based on the adversarial sample and the real behavioral data. The adversarial sample and the real data are mixed in a ratio of 1:3 to form a mixed training sample. Specifically, the real data may include historical real data.

[0053] In step S162, the dynamic Bayesian network and the LSTM model are trained offline based on the mixed training samples.

[0054] In step S163, the loss function of the model is updated according to formula (8): , (8) in, is the loss function of the model, that is, the Bayesian network and LSTM model, is the cross entropy loss, which measures the classification error of the model on normal data. To counter the loss weight, , balancing classification and robustness objectives, is the KL divergence, which constrains the output distribution consistency of adversarial samples and normal samples. The model output probability distribution for normal data, Output probability distribution for the model under adversarial data. It is used to determine the diffusion of two probability distributions, also known as the KL divergence. The larger the KL divergence, the greater the difference between the two probability distributions, and the smaller the KL divergence, the closer the two probability distributions are. Specifically, the purpose of implementing data judgment between two probability distributions is to: first, determine whether the model is susceptible to adversarial samples by comparing the output probability distributions of normal data and adversarial data; second, by minimizing the difference between the two output probability distributions, the model's performance under adversarial samples is closer to that under normal data, thereby improving the model's resistance to unknown attacks; third, by introducing adversarial loss terms (such as KL divergence) into the loss function, the model has stronger robustness while maintaining classification accuracy.

[0055] In steps S160 to S163, adversarial sample generation modules are used, such as forging high-frequency access paths based on FGSM or GAN, to inject adversarial data into the training set, optimize the loss functions of the Bayesian network and LSTM, and enhance the model's generalization ability against unknown attacks. The model parameters after adversarial training are updated in real time through an incremental learning mechanism to improve resistance to "malicious probing." Adversarial samples are used for sample training offline and are not synchronized with the model in real time. The trained samples need to be verified before they can be used in practical models. At the same time, the multi-model fusion module uses more robust sub-models to improve the overall decision reliability. Specifically, by injecting mixed training sets / training samples and optimizing the KL divergence loss function, the model's detection rate for unknown attacks is increased by 35% and the false alarm rate is reduced by 20%.

[0056] In this embodiment of the present invention, the 90% percentile of the comprehensive risk assessment result within the current sliding window can be obtained and used as the comprehensive risk assessment result of the current sliding window. The current sliding window can be divided into multiple time series at equal intervals (e.g., if the sliding window is 5 minutes, it can be divided into 1-minute intervals), and the comprehensive risk assessment results within each time series can be obtained to form a comprehensive risk assessment result sequence within the sliding window. The 90% percentile of the comprehensive risk assessment result of the sliding window is selected and compared with the severe risk base threshold of the sliding window. This can effectively improve the accuracy of the evaluation of the comprehensive risk assessment result within the current sliding window and avoid the impact of abnormal fluctuations on risk judgment. Specifically, if the 90% percentile is greater than the severe risk base threshold of the sliding window, it means that the comprehensive risk assessment result of the current sliding window is large and the user behavior risk is large.

[0057] Specifically, the 90% quantile of the comprehensive risk assessment results within the current sliding window can be obtained according to formula (9): , (9) in, is the comprehensive risk assessment result sequence within the sliding window, is the 90% quantile of the comprehensive risk assessment results within the sliding window. Specifically, the comprehensive risk assessment result sequence may include ,in, is the number of equal divisions within the sliding window.

[0058] In this embodiment of the present invention, taking into account the different business types, different serious risk basic thresholds can be selected according to different business types. After obtaining the comprehensive risk assessment results of the current sliding window, it is further considered that multiple comprehensive risk assessment results in consecutive sliding windows will continue to be large, but none of them exceed the pre-set serious risk basic threshold, that is, they continue to be between the large risk basic threshold and the serious risk basic threshold, and there is also a more serious risk at this time. At the same time, in order to further effectively identify and diagnose user behaviors between the large risk basic threshold and the serious risk basic threshold, it is also necessary to enhance the processing of some user behaviors in this interval, so that the comprehensive risk assessment results of some user behaviors can be more prominent, so that they can be identified by the serious basic threshold, and then take corresponding emergency measures, which further improves the accuracy and effect of identifying and diagnosing user behaviors.

[0059] Specifically, if the comprehensive risk assessment results in consecutive sliding windows are continuously large, it means that the user is continuously engaging in high / large risk behaviors. Based on this, in order to distinguish occasional high / large risk fluctuations from continuous high / large risk, the comprehensive risk assessment results in the current sliding window and the previous adjacent sliding windows need to be evaluated together. Therefore, the comprehensive risk assessment results in the current sliding window need to be further optimized. The specific optimization steps can be as follows: Figure 7 Specifically, Figure 7 In the optimization step, the optimization step may include: In step S1500, the business risk level thresholds for the current sliding window are obtained and a cumulative value is initialized. The business risk level thresholds include a relatively high risk base threshold and a severe risk base threshold. The business risk level thresholds are classified as low risk, medium risk, and high risk. Specifically, the cumulative value is initialized to 0.

[0060] In step S1501, it is determined whether the comprehensive risk assessment result of the current sliding window is greater than or equal to the larger risk basic threshold.

[0061] In step S1502, when it is determined that the comprehensive risk assessment result of the current sliding window is greater than or equal to the large risk basic threshold, it is determined whether the comprehensive risk assessment result of the current sliding window is less than the severe risk basic threshold.

[0062] In step S1503, if the comprehensive risk assessment result of the current sliding window is determined to be less than the severe risk base threshold, the business risk level corresponding to the previous adjacent sliding window is obtained. The business risk level of the previous adjacent sliding window is low risk (less than the larger risk base threshold), medium risk (greater than or equal to the larger risk base threshold and less than the severe risk base threshold), or high risk (greater than or equal to the severe risk base threshold).

[0063] In step S1504, it is determined whether the business risk level corresponding to the previous adjacent sliding window is greater than or equal to the larger risk basic threshold and less than the severe risk basic threshold.

[0064] In step S1505, when it is determined that the business risk level corresponding to the previous adjacent sliding window is greater than or equal to the larger risk base threshold and less than the severe risk base threshold, the cumulative value is increased by one, and the process returns to the step of obtaining the business risk level corresponding to the previous adjacent sliding window.

[0065] In step S1506, if it is determined that the business risk level corresponding to the previous adjacent sliding window is less than the higher risk base threshold or greater than or equal to the severe risk base threshold, the current cumulative value is obtained. Specifically, if the previous sliding window is at low risk or high risk, resulting in a discontinuous medium risk, the cumulative value corresponding to the number of consecutive medium risk sliding windows is obtained.

[0066] In step S1507, the optimized comprehensive risk assessment value of the current sliding window is obtained according to formula (5). , (5) in, is the optimized comprehensive risk assessment value of the current sliding window, is the comprehensive risk assessment result of the current sliding window, is the risk enhancement factor, and , used to control the optimized growth rate of the comprehensive risk assessment results, Specifically, the optimization of the comprehensive risk assessment results of the current sliding window can improve the response speed to potential threats. Specifically, further considering the superposition influence of the cumulative risk, the risk enhancement coefficient The value of can also include dynamic selection. Specifically, the acquisition of the dynamic risk enhancement coefficient can include calculating according to formula (13), , (13) in, The cumulative value is The dynamic risk enhancement coefficient when The preset maximum limit threshold for the cumulative value, such as .

[0067] In step S1508, it is determined whether the optimized comprehensive risk assessment value is greater than or equal to the severe risk basic threshold.

[0068] In step S1509, if the optimized comprehensive risk assessment value is greater than or equal to the severe risk threshold, the user's behavior data (user behavior) in the current sliding window is determined to be high risk. If the current user behavior is severe risk / high risk, certain measures can be taken to suppress / prevent the occurrence of high-risk user behavior, such as triggering permission downgrade, access restriction, or alarm mechanism.

[0069] In step S1510, if the optimized comprehensive risk assessment value is determined to be less than the severe risk threshold, the user behavior data (user behavior) in the current sliding window is determined to be low risk. If the comprehensive risk assessment value within the current sliding window does not reach the severe risk / high risk level after optimization, the risk is considered low.

[0070] In step S1511, when it is determined that the comprehensive risk assessment result of the current sliding window is greater than or equal to the severe risk basic threshold, the user behavior of the current sliding window is determined to be high risk.

[0071] In step S1512, when it is determined that the comprehensive risk assessment result of the current sliding window is less than the larger risk base threshold, the user behavior of the current sliding window is determined to be low risk.

[0072] In steps S1500 to S1512, by further dividing the medium-risk interval, the comprehensive risk assessment results of multiple sliding windows continuously located in the medium-risk interval are enhanced and optimized to improve the comprehensive risk assessment results in the case of continuous medium risk. The optimized comprehensive risk assessment value after enhancement and optimization is then compared with the severe risk basic threshold to further divide user behavior in the medium-risk interval into high risk and low risk. This approach of accurately and effectively dividing user behavior into two risk modes results in higher risk assessment accuracy, faster response speed, and safer, more reliable, and more timely risk prevention.

[0073] In this embodiment of the present invention, the present invention divides business types into financial transactions and general inquiries. Financial transactions have higher risks than general inquiries. Therefore, the severe risk basic threshold for financial transactions can be set larger, while the severe risk basic threshold for general inquiries can be set smaller. Specifically, the severe risk basic threshold for financial transactions can be multiplied by a coefficient of 1.2, and the severe risk basic threshold for general inquiries can be multiplied by a coefficient of 0.8 to obtain the corresponding severe risk basic thresholds for different business types. Specifically, the severe risk basic thresholds for different business types can be obtained as follows: Figure 8 Specifically, Figure 8 In the step of obtaining the severe risk basic threshold, the step may include: In step S1513, the business type and the corresponding risk weight corresponding to the current sliding window are obtained.

[0074] In step S1514, the critical risk base threshold of the current sliding window is obtained according to formula (10): , (10) in, is the critical risk threshold of the current sliding window, is the risk weight of the business type corresponding to the current sliding window, is the basic threshold of the current sliding window. Specifically, when the current business type is financial transaction, the risk weight of the financial transaction is 1.2, and when the current business type is general query, the risk weight of the financial transaction is 0.8.

[0075] In step S1515, the cumulative effect risk threshold is obtained according to formula (11): , (11) in, is the cumulative effect risk threshold of the current sliding window, which is also the optimized severe risk base threshold. is the cumulative value, is the threshold compression coefficient, when and As the cumulative effect increases, the risk threshold of the cumulative effect will gradually decrease, thereby increasing sensitivity. For example: in a financial transaction scenario, a higher initial severe risk base threshold can be set, and the cumulative effect of the risk threshold can be increased. As the cumulative effect risk threshold increases, it gradually lowers the cumulative effect risk threshold to quickly respond to potential high-risk behaviors. In common query scenarios, a lower initial severe risk base threshold can be set, and a gentler cumulative effect risk threshold reduction curve can be adopted to balance risk identification and user experience. Specifically, considering that the comprehensive risk assessment results within consecutive sliding windows are relatively large, the severe risk base threshold of the current sliding window can also be optimized and adjusted to increase the sensitivity of the severe risk base threshold.

[0076] In steps S1513 to S1515, the severe risk base threshold of the current sliding window can be adaptively modified according to the business type of the current user, so as to select a more appropriate diagnostic threshold according to the risk characteristics of different business types. In addition, when the comprehensive risk assessment results of multiple consecutive sliding windows are at a medium risk in the initial assessment level (low risk, medium risk, high risk), in addition to enhancing the comprehensive risk assessment result of the current sliding window, the severe risk base threshold of the current sliding window can also be reduced based on the cumulative effect. Specifically, the enhancement of the comprehensive risk assessment result of the current sliding window and the sensitivity reduction of the severe risk base threshold can be performed alone or simultaneously, and the selection is based on actual needs.

[0077] In this embodiment of the present invention, after the risk level of the user behavior in the current sliding window is diagnosed and determined, the actual feedback result of the user behavior in the sliding window is obtained, indicating whether it is high risk or low risk. Based on the diagnosis result and the actual feedback result, the severe risk basic threshold can be adjusted. The specific adjustment steps can be as follows: Figure 9 Specifically, Figure 9 In the step of adjusting the critical risk threshold feedback, the critical risk threshold feedback adjustment step may include: In step S1516, the risk diagnosis accuracy, false positive rate, and missed negative rate within a preset time period are obtained. The risk diagnosis accuracy represents the accuracy of the risk diagnosis. Specifically, for a false positive rate, a high risk diagnosis is made when the risk is actually low; for a missed negative rate, a low risk diagnosis is made when the risk is actually high.

[0078] In step S1517, the corresponding feedback factor is obtained according to the false alarm rate and the missed alarm rate. When the false alarm rate is greater than the preset value of the missed alarm rate, the feedback factor (or higher, such as 1.1); when the false alarm rate is less than the preset value of the missed alarm rate, the feedback factor (or lower, such as 0.9), the feedback factor in other cases .

[0079] In step S1518, the feedback adjustment threshold is obtained according to formula (12): , (12) in, is the feedback adjustment threshold, is the feedback factor.

[0080] In steps S1516 to S1518, after the risk diagnosis of the current sliding window is completed, the corresponding risk diagnosis accuracy can be obtained in combination with the corresponding actual feedback results. Based on this risk diagnosis accuracy, the critical risk threshold can be feedback-adjusted to achieve reverse optimization of model weight distribution and incremental learning parameters.

[0081] Traditional fixed thresholds and rigid threshold policies lead to high false positive and / or false negative rates. Static thresholds cannot be dynamically adjusted based on the business environment. For example, during e-commerce promotions, the access frequency of normal users may surge, and fixed thresholds are prone to triggering false positives. The dynamic threshold feedback adjustment of the present invention combines business risk level diagnosis results with real-time feedback results to adaptively adjust risk sensitivity and support millisecond-level policy response.

[0082] On the other hand, the present invention also provides a dynamic risk assessment and management system based on business risk control. Specifically, the dynamic risk assessment and management system may include a data acquisition module and a control module.

[0083] The data collection module is connected to the business system and is used to collect behavioral data in the business system. The control module is connected to the data collection module and is used to execute any of the above dynamic risk assessment management methods.

[0084] Through the above technical solution, the dynamic risk assessment management method and system based on business risk control provided by the present invention obtains user behavior data and extracts statistical features from the user behavior data to construct a dynamic Bayesian network. At the same time, the conditional probability table of the dynamic Bayesian network is incrementally updated based on the real-time behavior data. The method of constructing the dynamic Bayesian network using statistical features can effectively capture the temporal changes of the behavior data. Incremental online learning can ensure that the model parameters of the dynamic Bayesian network are adaptively adjusted as the behavior data changes. Then, based on the behavior data, an LSTM model and a random forest model are constructed and trained. The current real-time behavior data are respectively input into the dynamic Bayesian network, the LSTM model, and the random forest model to obtain the corresponding predicted risk. Based on the predicted risk, the current comprehensive risk assessment result can be obtained. Based on the comprehensive risk assessment result, the current business risk level can be determined. The use of multi-model fusion can effectively improve the accuracy of risk assessment. Finally, an adversarial sample is constructed. Based on the adversarial sample, the dynamic Bayesian network and the LSTM model are trained offline, which can improve the generalization ability of unknown attack patterns and provide higher security. This invention solves the lag and vulnerability of traditional risk control systems in dynamic environments. It can be widely used in scenarios with high real-time requirements such as financial transactions and e-commerce anti-fraud, and has outstanding industrial application value.

[0085] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0086] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0087] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0089] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0090] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0091] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can be implemented using any method or technology for information storage. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media, such as modulated data signals and carrier waves.

[0092] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0093] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A dynamic risk assessment management method based on business risk control, characterized in that: include: Obtaining user behavior data and performing statistical feature extraction on the behavior data; constructing a dynamic Bayesian network based on the statistical characteristics of the behavioral data; Incrementally updating the conditional probability table of the dynamic Bayesian network according to the real-time behavioral data; Build and train an LSTM model and a random forest model using the behavioral data; Obtaining a current comprehensive risk assessment result based on the real-time behavioral data and the dynamic Bayesian network, the LSTM model, and the random forest model, including: According to formula (1), the comprehensive risk assessment result is obtained. ，（1） in, is the comprehensive risk assessment result, is the risk probability of the dynamic Bayesian network, is the sequence anomaly score of the LSTM model, is the classification probability of the random forest model, is the fusion weight of the dynamic Bayesian network, is the fusion weight of the LSTM model, is the fusion weight of the random forest model; Determine the current business risk level based on the comprehensive risk assessment results; Construct adversarial samples and train the dynamic Bayesian network and the LSTM model offline.

2. The dynamic risk assessment management method according to claim 1, characterized in that: Extracting statistical features from the behavioral data includes: Preset the size of the sliding window; dividing the behavior data according to the sliding window; Obtain statistical features within the sliding window.

3. The dynamic risk assessment management method according to claim 2, characterized in that: Constructing a dynamic Bayesian network based on the statistical characteristics of the behavioral data includes: Get the mutual information value between the data in the sliding window; Determining whether the mutual information value is greater than a preset threshold; When it is determined that the mutual information value is greater than a preset threshold, a dependency edge across time slices is established to dynamically adjust the network structure.

4. The dynamic risk assessment management method according to claim 3, characterized in that: Constructing a dynamic Bayesian network based on the statistical characteristics of the behavioral data further includes: According to formula (2), the Bayesian information criterion score is obtained. ，（2） in, Score the Bayesian Information Criterion, is the number of data samples, is the number of model parameters, is the maximum log-likelihood estimate of the model, is the structural stability weight, For the The number of edge changes in the time window, is the time decay rate, is the window number, is the maximum window number; The optimal network structure is obtained according to the Bayesian Information Criterion score.

5. The dynamic risk assessment management method according to claim 1, characterized in that: Incrementally updating the conditional probability table of the dynamic Bayesian network according to the real-time behavioral data includes: Constructing new samples based on the real-time behavioral data; Update the conditional probability table of the dynamic Bayesian network according to formula (3), ，（3） in, is the incrementally updated conditional probability estimate, is the conditional probability estimate of historical data, is the conditional probability estimate of the new data, is the number of historical samples, is the number of new samples, For the forgetting factor.

6. The dynamic risk assessment management method according to claim 1, characterized in that: Obtaining a current comprehensive risk assessment result based on the real-time behavioral data and the dynamic Bayesian network, the LSTM model, and the random forest model includes: Obtaining the risk probability output by the dynamic Bayesian network; Obtaining a sequence anomaly score output by the LSTM model; Obtaining the classification probability output by the random forest model; Obtain the average F1 scores of the dynamic Bayesian network, the LSTM model, and the random forest model in K sliding windows respectively; Obtaining corresponding fusion weights according to the average F1 scores of the dynamic Bayesian network, the LSTM model, and the random forest model; A comprehensive risk assessment result is obtained based on the risk probability, the sequence anomaly score, the classification probability, and the corresponding average F1 score.

7. The dynamic risk assessment management method according to claim 6, characterized in that: Obtaining corresponding fusion weights according to the average F1 scores of the dynamic Bayesian network, the LSTM model, and the random forest model includes: According to formula (4), the fusion weight of the model is obtained. ，（4） in, For the The fusion weight of the model, For the The average F1 score of the models, is an integer number, ,and , For the dynamic Bayesian network, For the LSTM model, is the random forest model.

8. The dynamic risk assessment management method according to claim 2, characterized in that: The current business risk level determined based on the comprehensive risk assessment results includes: Obtaining the current business risk level threshold of the sliding window and initializing the accumulated value, wherein the business risk level threshold includes a relatively large risk basic threshold and a severe risk basic threshold; Determining whether the comprehensive risk assessment result of the current sliding window is greater than or equal to a large risk basic threshold; If it is determined that the comprehensive risk assessment result of the current sliding window is greater than or equal to the large risk basic threshold, determining whether the comprehensive risk assessment result of the current sliding window is less than the severe risk basic threshold; When it is determined that the comprehensive risk assessment result of the current sliding window is less than the severe risk basic threshold, obtaining the business risk level corresponding to the previous adjacent sliding window; Determining whether the business risk level corresponding to the previous adjacent sliding window is greater than or equal to a large risk basic threshold and less than a severe risk basic threshold; If it is determined that the business risk level corresponding to the previous adjacent sliding window is greater than or equal to the larger risk base threshold and less than the severe risk base threshold, the accumulated value is increased by one, and the business risk level corresponding to the previous adjacent sliding window is returned; When it is determined that the business risk level corresponding to the previous adjacent sliding window is less than the larger risk basic threshold or greater than or equal to the severe risk basic threshold, obtaining the current cumulative value; According to formula (5), the optimized comprehensive risk assessment value of the current sliding window is obtained. ，（5） in, is the optimized comprehensive risk assessment value of the current sliding window, is the comprehensive risk assessment result of the current sliding window, is the risk enhancement factor, and , is the current cumulative value; Determining whether the optimized comprehensive risk assessment value is greater than or equal to a severe risk basic threshold; If it is determined that the optimized comprehensive risk assessment value is greater than or equal to the severe risk basic threshold, the behavior data of the current sliding window user is determined to be high risk; If it is determined that the optimized comprehensive risk assessment value is less than the severe risk basic threshold, the behavior data of the current sliding window user is determined to be low risk; If it is determined that the comprehensive risk assessment result of the current sliding window is greater than or equal to the severe risk basic threshold, the behavior data of the user in the current sliding window is determined to be high risk; When it is determined that the comprehensive risk assessment result of the current sliding window is less than the larger risk basic threshold, the behavior data of the user in the current sliding window is determined to be low risk.

9. The dynamic risk assessment management method according to claim 1, characterized in that: Constructing adversarial samples and offline training the dynamic Bayesian network and the LSTM model include: According to formulas (6) to (7), we can obtain adversarial samples. ，（6） ，（7） in, is the perturbation vector added to the input sample, is the disturbance intensity, is the input sample, For input For the loss function The gradient, is the sample label, is a symbolic function, is the adversarial sample; Acquire a mixed training sample based on the adversarial sample and the real behavior data; Offline training of the dynamic Bayesian network and the LSTM model according to the mixed training samples; Update the model's loss function according to formula (8), ，（8） in, is the loss function of the model, is the cross entropy loss, To counter the loss weight, is the KL divergence, The model output probability distribution for normal data, Output probability distribution for the model under adversarial data.

10. A dynamic risk assessment and management system based on business risk control, characterized in that: include: A data collection module, connected to the business system, for collecting behavioral data in the business system; A control module is connected to the data acquisition module and is used to execute the dynamic risk assessment management method according to any one of claims 1 to 9.

Images