Asset risk analysis method and system for multi-source heterogeneous data fusion

Abstract

The application provides a multi-source heterogeneous data fusion asset risk analysis method and system, relates to the technical field of asset risk analysis, and comprises the following steps: fusing structured and unstructured data, extracting standardized fields, and generating a time sequence feature vector; identifying the dependence relationship between assets, constructing an influence propagation matrix to solve a correlation feature vector; segmenting and sampling the correlation feature vector and calculating the deviation, identifying an abnormal mode through clustering analysis, matching the abnormal mode with a risk rule to obtain a risk grade identifier, and correlatively storing the risk grade identifier to form a risk analysis result.

Description

Technical Field

[0001] This invention relates to the field of asset risk analysis technology, and in particular to an asset risk analysis method and system that integrates multi-source heterogeneous data. Background Technology

[0002] In the field of asset risk management, existing technologies typically collect structured and unstructured data related to assets from various sources. Time-series feature vectors are constructed by parsing and mapping this data. To assess the transmission effect of risk among related assets, a dependency network between asset objects is identified and constructed. By performing a topological traversal of this dependency network, risk propagation paths can be analyzed. Weights are assigned to nodes in the path to form an influence propagation matrix, aiming to quantify the impact of associations. Combining the influence propagation matrix representing the association network with the asset's own time-series feature vector yields an association feature vector to characterize systemic risk.

[0003] However, existing technologies still have limitations in accurately simulating complex and dynamically changing actual risk transmission processes. This results in insufficient reliability of systemic risk feature vectors and inadequate exploration of historical data fluctuation patterns. Risk assessment often relies on fixed statistical thresholds or rules, making it difficult to provide early warnings of potential risks accumulated from minor deviations. Summary of the Invention

[0004] This invention provides a method and system for asset risk analysis based on the fusion of multi-source heterogeneous data, which can at least solve some of the problems existing in the prior art.

[0005] A first aspect of this invention provides a method for asset risk analysis based on the fusion of multi-source heterogeneous data, comprising:

[0006] The system obtains structured and unstructured data records corresponding to asset objects from multiple data sources. It extracts fields from the structured data records to obtain structured fields, performs text parsing and entity recognition on the unstructured data records to obtain unstructured fields, performs semantic mapping between the structured and unstructured fields to obtain standardized fields, and performs attribute extraction and time series decomposition on the asset objects based on the standardized fields to obtain time series feature vectors.

[0007] Based on the standardized fields, the dependencies between asset objects are identified. The dependencies are then topologically traversed to obtain node connectivity paths. Weights are assigned to the nodes in the connectivity paths to obtain the influence propagation matrix. Based on the influence propagation matrix and the temporal feature vector, the association feature vector is obtained.

[0008] The associated feature vector is segmented and sampled to obtain multiple time window samples. The statistical deviations corresponding to the samples in different time windows are calculated and a set of deviation vectors is constructed. The set of deviation vectors is clustered to obtain anomaly pattern clusters. The anomaly pattern clusters are matched with preset risk judgment rules to obtain risk level identifiers. The risk level identifiers are associated with the standardized fields of the asset object and stored to obtain risk analysis results.

[0009] In one alternative implementation,

[0010] Structured and unstructured data records corresponding to asset objects are obtained from multiple data sources. The structured data records are processed to extract structured fields, and the unstructured data records are processed to perform text parsing and entity recognition to obtain unstructured fields, including:

[0011] The system obtains structured and unstructured data records corresponding to asset objects from multiple data sources. It identifies the data types of the structured data records to obtain numeric and character type fields. It performs numeric range detection on the numeric type fields and marks abnormal values. It removes the abnormal values ​​from the numeric type fields to obtain retained values. It performs encoding format conversion on the character type fields to obtain unified encoding characters. It merges the retained values ​​and the unified encoding characters to obtain the structured fields.

[0012] The unstructured data records are segmented into words to obtain a word sequence. The word sequence is then labeled with parts of speech to obtain part-of-speech tags. Function words are filtered and entity words are retained based on the part-of-speech tags to obtain a candidate entity word set. Context windows are used to extract context fragments from the word elements in the candidate entity word set. The co-occurrence frequency between word elements is calculated based on the context fragments, and a co-occurrence matrix is ​​constructed. Graph traversal is performed on the co-occurrence matrix to identify connected subgraphs, and word elements in the connected subgraphs are merged into entity phrases to obtain the unstructured field.

[0013] In one alternative implementation,

[0014] Semantic mapping is performed between the structured fields and the unstructured fields to obtain standardized fields. Based on the standardized fields, attribute extraction and time series decomposition are performed on the asset object to obtain a time-series feature vector, including:

[0015] Semantic features are extracted from the structured field and the unstructured field respectively to obtain structured semantic vectors and unstructured semantic vectors, and semantic similarity is calculated. Semantic clustering is performed based on the semantic similarity to obtain semantic clusters. The fields in the semantic clusters are named and normalized and assigned unified identifiers to obtain the standardized fields.

[0016] The attribute key-value pairs of the asset object are extracted from the standardized field and sorted according to the timestamp to obtain a time-series attribute sequence. The time-series attribute sequence is divided into multiple time segments by a sliding window. The attribute values ​​in each time segment are statistically aggregated to obtain segment statistics. The segment statistics are organized into an attribute time series according to the time order.

[0017] The attribute time series is subjected to moving average filtering to obtain a smoothed series. The smoothed series is then subjected to trend fitting to obtain a trend component. The difference between the attribute time series and the smoothed series is calculated and combined with the trend component to obtain a fluctuation component. The trend component is subjected to first-order difference calculation to obtain a rate of change series. The rate of change series is subjected to statistical feature extraction to obtain a rate of change feature vector. The fluctuation component is subjected to frequency domain transformation and the main frequency components are extracted to obtain spectral features. The rate of change feature vector and the spectral features are concatenated to obtain the time series feature vector.

[0018] In one alternative implementation,

[0019] Based on the standardized fields, the dependencies between asset objects are identified. A topological traversal is performed on these dependencies to obtain node connectivity paths. Weights are assigned to the nodes in these connectivity paths to obtain an influence propagation matrix. Based on the influence propagation matrix and the temporal feature vector, the associated feature vector is calculated, including:

[0020] Extract the call relationships and data flow between asset objects from the standardized fields and construct a multi-layer heterogeneous dependency graph. Based on the multi-layer heterogeneous dependency graph, construct inter-layer dependency channels and determine dependency relationships.

[0021] The dependency relationship is represented as a multi-layer adjacency tensor structure, and a breadth-first traversal is performed at each layer to determine the number of cross-layer jumps and the number of intra-layer propagation steps. The path complexity is calculated based on the number of cross-layer jumps and the number of intra-layer propagation steps, and the node connectivity path is determined.

[0022] The path embedding representation of the connected paths of the nodes is learned by path embedding vectors. The structural similarity between different path embedding vectors is calculated and path clustering is performed to obtain path pattern clusters. The topological centrality of the paths within each path pattern cluster is calculated and the influence weight of each node is determined. The influence weights of the same node in different path pattern clusters are weighted and fused to obtain the node comprehensive weight and construct the influence propagation matrix.

[0023] The time-series feature vectors are arranged into a time-series feature matrix according to the asset objects. The influence propagation matrix is ​​decomposed into a tensor to determine the core tensor. The time-series feature matrix is ​​then combined with a tensor contraction operation to obtain a multi-order propagation feature set. Adaptive attention weighting is applied to the different-order propagation features in the multi-order propagation feature set and concatenated with the time-series feature vectors to obtain the associated feature vector.

[0024] In one alternative implementation,

[0025] Path embedding representation learning is performed on the connected paths of the nodes to obtain path embedding vectors. The structural similarity between different path embedding vectors is calculated, and path clustering is performed to obtain path pattern clusters. The topological centrality of the paths within each path pattern cluster is calculated, and the influence weight corresponding to each node is determined, including:

[0026] Extract the path topology features and path semantic features corresponding to the connected paths of each node, perform feature fusion and graph neural network encoding on the path topology features and the path semantic features to obtain the path embedding vector and determine the unit path embedding vector;

[0027] Calculate the cosine similarity between different unit path embedding vectors and construct a path similarity matrix. Based on the path similarity matrix, construct a path similarity graph. Identify the path communities in the path similarity graph using a community detection algorithm and use them as path pattern clusters. Calculate the average path similarity corresponding to all paths in the path pattern cluster and the pattern representative vector of each path pattern cluster.

[0028] For each path pattern cluster, construct an intra-cluster path subgraph of the node connectivity paths. Calculate the multi-dimensional topological index of each node in the intra-cluster path subgraph and perform multilayer perceptron fusion to obtain the node topological centrality. Solve the node pattern matching degree based on the node topological centrality and the pattern representative vector. Determine the intra-cluster node influence weight based on the node pattern matching degree and the node topological centrality.

[0029] Cross-cluster aggregation is performed on the intra-cluster node influence weights of the same node in different path pattern clusters. The cluster weights are calculated based on the size of the path pattern clusters and the average path similarity. The influence weights corresponding to the nodes are obtained based on the intra-cluster node influence weights and the cluster weights.

[0030] In one alternative implementation,

[0031] The associated feature vector is segmented and sampled to obtain multiple time window samples. The statistical deviations corresponding to the samples in different time windows are calculated and a set of deviation vectors is constructed. Cluster analysis is performed on the set of deviation vectors to obtain anomaly pattern clusters, including:

[0032] The associated feature vector is segmented and sampled to obtain time window segments. The associated feature vectors within each time window segment are sampled in the time domain and frequency domain and then concatenated to obtain time window samples.

[0033] A global reference distribution is constructed based on the time window samples, and the global statistical moments corresponding to the global reference distribution are calculated. The distribution distance between each time window sample and the global reference distribution is calculated to obtain the distribution deviation value. The statistical moment features corresponding to each time window sample are extracted, and the difference between the statistical moment features and the global statistical moments is calculated to obtain the moment deviation value. The distribution deviation value and the moment deviation value are combined into a vector to construct a deviation vector set.

[0034] Calculate the distance between different deviation vectors in the deviation vector set and construct a deviation distance matrix. Based on the deviation distance matrix, construct a deviation space graph and perform spectral decomposition to obtain a low-dimensional deviation embedding representation. Perform density estimation on the low-dimensional deviation embedding representation to obtain a density distribution. Based on the density distribution and a preset density threshold, determine the abnormal pattern cluster.

[0035] In one alternative implementation,

[0036] The risk level identifier is obtained by matching the abnormal pattern cluster with the preset risk assessment rules. The risk level identifier is then associated with and stored with the standardized fields of the asset object to obtain the risk analysis result, including:

[0037] Extract the pattern feature vectors corresponding to the abnormal pattern clusters, extract the rule condition set and rule conclusion set from the preset risk judgment rules, perform semantic matching calculation between the pattern feature vectors and the rule condition set to obtain the condition satisfaction degree, and perform weighted aggregation on the rule conclusion set based on the condition satisfaction degree to obtain the risk level identifier.

[0038] A risk level mapping table is constructed based on the risk level identifier. The asset identifier field and attribute field are extracted from the standardized fields of the asset object. The risk level identifier is converted into risk level description information through the risk level mapping table. The risk level description information is associated with the asset identifier field and the attribute field and an association index is constructed. The risk level description information, the asset identifier field, and the attribute field are structured and stored based on the association index to obtain the risk analysis results.

[0039] The risk level description information in the risk analysis results is grouped and statistically analyzed to obtain the risk level distribution. Based on the risk level distribution, the number of asset objects and the proportion of asset objects corresponding to each risk level are calculated and associated with the risk level distribution to obtain a risk statistical report.

[0040] A second aspect of this invention provides an asset risk analysis system that integrates multi-source heterogeneous data, comprising:

[0041] The data feature extraction unit is used to obtain structured and unstructured data records corresponding to asset objects from multiple data sources, extract fields from the structured data records to obtain structured fields, perform text parsing and entity recognition on the unstructured data records to obtain unstructured fields, perform semantic mapping between the structured fields and the unstructured fields to obtain standardized fields, and perform attribute extraction and time series decomposition on the asset objects based on the standardized fields to obtain time series feature vectors.

[0042] The association analysis modeling unit is used to identify the dependency relationship between asset objects based on the standardized fields, perform topological traversal on the dependency relationship to obtain the node connection path, assign weights to the nodes in the node connection path to obtain the influence propagation matrix, and solve for the association feature vector based on the influence propagation matrix and the time series feature vector.

[0043] The risk level assessment unit is used to segment and sample the associated feature vector to obtain multiple time window samples, calculate the statistical deviations corresponding to the samples in different time windows and construct a set of deviation vectors, perform cluster analysis on the set of deviation vectors to obtain anomaly pattern clusters, match the anomaly pattern clusters with preset risk judgment rules to obtain risk level identifiers, and associate and store the risk level identifiers with the standardized fields of the asset object to obtain risk analysis results.

[0044] A third aspect of the present invention provides an electronic device, comprising:

[0045] A processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke instructions stored in the memory to perform the aforementioned method.

[0046] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0047] This invention extracts fields from structured data and performs text parsing and entity recognition on unstructured data, transforming data from different sources and formats into standardized fields with consistent semantics. This solves the problem of information fragmentation caused by diverse data sources and inconsistent structures, providing a high-quality, standardized data foundation for subsequent analysis. Based on standardized fields, attribute extraction and time series decomposition are performed to generate time-series feature vectors. This not only captures the static attributes of assets but also reflects their dynamic behavior patterns over time, improving the continuity and precision of state perception. By identifying dependencies between assets, topological paths are constructed and weighted to form an influence propagation matrix. Combining time-series feature vectors to solve for associated feature vectors, the transmission path and strength of risks in associated asset networks can be modeled, enabling early warning of cascading risks caused by dependencies. By segmenting and sampling associated feature vectors and calculating statistical deviations, a set of deviation vectors is constructed and clustered, automatically identifying anomalous clusters that deviate from normal patterns. Matching anomalous patterns with preset rules determines the risk level, achieving intelligent judgment from data anomalies to risk levels, reducing reliance on human experience, and improving the objectivity and efficiency of risk identification. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating the asset risk analysis method based on multi-source heterogeneous data fusion according to an embodiment of the present invention.

[0049] Figure 2 This is a flowchart illustrating the path embedding and influence analysis process of the asset risk analysis method based on multi-source heterogeneous data fusion, as described in this embodiment of the invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0052] Figure 1 This is a flowchart illustrating the asset risk analysis method based on multi-source heterogeneous data fusion according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0053] The system obtains structured and unstructured data records corresponding to asset objects from multiple data sources. It extracts fields from the structured data records to obtain structured fields, performs text parsing and entity recognition on the unstructured data records to obtain unstructured fields, performs semantic mapping between the structured and unstructured fields to obtain standardized fields, and performs attribute extraction and time series decomposition on the asset objects based on the standardized fields to obtain time series feature vectors.

[0054] Based on the standardized fields, the dependencies between asset objects are identified. The dependencies are then topologically traversed to obtain node connectivity paths. Weights are assigned to the nodes in the connectivity paths to obtain the influence propagation matrix. Based on the influence propagation matrix and the temporal feature vector, the association feature vector is obtained.

[0055] The associated feature vector is segmented and sampled to obtain multiple time window samples. The statistical deviations corresponding to the samples in different time windows are calculated and a set of deviation vectors is constructed. The set of deviation vectors is clustered to obtain anomaly pattern clusters. The anomaly pattern clusters are matched with preset risk judgment rules to obtain risk level identifiers. The risk level identifiers are associated with the standardized fields of the asset object and stored to obtain risk analysis results.

[0056] In one alternative implementation,

[0057] Structured and unstructured data records corresponding to asset objects are obtained from multiple data sources. The structured data records are processed to extract structured fields, and the unstructured data records are processed to perform text parsing and entity recognition to obtain unstructured fields, including:

[0058] The system obtains structured and unstructured data records corresponding to asset objects from multiple data sources. It identifies the data types of the structured data records to obtain numeric and character type fields. It performs numeric range detection on the numeric type fields and marks abnormal values. It removes the abnormal values ​​from the numeric type fields to obtain retained values. It performs encoding format conversion on the character type fields to obtain unified encoding characters. It merges the retained values ​​and the unified encoding characters to obtain the structured fields.

[0059] The unstructured data records are segmented into words to obtain a word sequence. The word sequence is then labeled with parts of speech to obtain part-of-speech tags. Function words are filtered and entity words are retained based on the part-of-speech tags to obtain a candidate entity word set. Context windows are used to extract context fragments from the word elements in the candidate entity word set. The co-occurrence frequency between word elements is calculated based on the context fragments, and a co-occurrence matrix is ​​constructed. Graph traversal is performed on the co-occurrence matrix to identify connected subgraphs, and word elements in the connected subgraphs are merged into entity phrases to obtain the unstructured field.

[0060] The structured data records are processed by identifying the attribute category of each field through data type recognition. Specifically, dates, amounts, and quantities are identified as numeric fields, while names, addresses, and descriptions are identified as character fields. For numeric fields, value range detection is performed based on a preset reasonable range. For example, the reasonable range for an asset price field can be set to be greater than zero and less than a certain multiple of the highest market price. When the asset price in a record is negative or exceeds the upper limit, the value is marked as an abnormal value. The marked abnormal values ​​are processed according to business rules; they can be directly deleted from the field or replaced with null values, resulting in the retained values. For character fields, since different data sources may use different encoding formats such as GBK, UTF-8, or ISO-8859-1, encoding format conversion is required. Specifically, the original encoding format is first detected, and then uniformly converted to UTF-8 encoding format to obtain unified encoded characters. The retained values ​​and unified encoded characters are then merged according to the original field order to form cleaned structured fields.

[0061] When processing unstructured data records, text segmentation employs a method combining dictionary matching and statistical models. For Chinese text, the maximum matching algorithm is used to segment continuous text into independent word units, forming word unit sequences. Each word unit in the word unit sequence is tagged with its part of speech, including nouns, verbs, adjectives, prepositions, etc., resulting in corresponding part-of-speech tags. When filtering based on these tags, prepositions, conjunctions, auxiliary words, and other functional words are removed, retaining entity words such as nouns, verbs, and adjectives, forming a candidate entity word set. During context window extraction, for each word unit in the candidate entity word set, three word units before and after each word unit are extracted as context fragments. By statistically analyzing the co-occurrence of word units in all context fragments, the co-occurrence frequency between word units is calculated, constructing a co-occurrence matrix. For example, the element in the i-th row and j-th column of the matrix represents the number of times word unit i and word unit j co-occur within the window. When traversing the co-occurrence matrix, word units are treated as nodes, and edges are established between word unit pairs whose co-occurrence frequency exceeds a preset threshold. A depth-first search algorithm is used to identify connected subgraphs. The tokens in each connected subgraph are merged according to their position in the original text to form entity phrases. For example, "assets", "liabilities", and "ratio" are merged into "asset-liability ratio", resulting in an unstructured field containing multiple entity phrases.

[0062] In this embodiment, by performing data type identification, numerical range detection, and outlier removal on structured data, and by uniformly encoding character fields, the problems of inconsistent formats of multi-source data and outlier interference with analysis results are effectively solved. This significantly improves the consistency and reliability of structured data and reduces the noise impact in subsequent data processing. By performing word segmentation, part-of-speech tagging, and functional word filtering on unstructured data, combined with context window analysis and word co-occurrence relationship modeling, and identifying connected subgraphs based on graph traversal to construct entity phrases, semantic associations and entity boundaries can be captured more accurately. This effectively reduces semantic fragmentation and ambiguity, and improves the completeness of entity recognition and semantic expression capabilities.

[0063] In one alternative implementation,

[0064] Semantic mapping is performed between the structured fields and the unstructured fields to obtain standardized fields. Based on the standardized fields, attribute extraction and time series decomposition are performed on the asset object to obtain a time-series feature vector, including:

[0065] Semantic features are extracted from the structured field and the unstructured field respectively to obtain structured semantic vectors and unstructured semantic vectors, and semantic similarity is calculated. Semantic clustering is performed based on the semantic similarity to obtain semantic clusters. The fields in the semantic clusters are named and normalized and assigned unified identifiers to obtain the standardized fields.

[0066] The attribute key-value pairs of the asset object are extracted from the standardized field and sorted according to the timestamp to obtain a time-series attribute sequence. The time-series attribute sequence is divided into multiple time segments by a sliding window. The attribute values ​​in each time segment are statistically aggregated to obtain segment statistics. The segment statistics are organized into an attribute time series according to the time order.

[0067] The attribute time series is subjected to moving average filtering to obtain a smoothed series. The smoothed series is then subjected to trend fitting to obtain a trend component. The difference between the attribute time series and the smoothed series is calculated and combined with the trend component to obtain a fluctuation component. The trend component is subjected to first-order difference calculation to obtain a rate of change series. The rate of change series is subjected to statistical feature extraction to obtain a rate of change feature vector. The fluctuation component is subjected to frequency domain transformation and the main frequency components are extracted to obtain spectral features. The rate of change feature vector and the spectral features are concatenated to obtain the time series feature vector.

[0068] Information such as field names, data types, and value ranges in structured fields are encoded. A pre-trained word embedding model converts the field names into 256-dimensional vector representations, forming structured semantic vectors. For unstructured fields, named entity recognition technology is used to extract key entities. The BERT model is then used to encode the entities and their corresponding context, generating corresponding unstructured semantic vectors. The cosine similarity between two classes of vectors is calculated; fields are considered semantically related when the similarity exceeds a threshold of 0.85. The DBSCAN density clustering algorithm is used to cluster highly similar field pairs, with a cluster radius of 0.15 and a minimum sample size of 3, forming several semantic clusters. For each semantic cluster, the field name with the highest frequency is selected as the standard name, and a globally unique UUID identifier is assigned to the current semantic cluster, completing the naming normalization process and obtaining a standardized field set.

[0069] Key-value pairs such as asset ID, update time, and numerical attributes are extracted from standardized fields and arranged in ascending order of timestamps to form a time-series attribute sequence. A sliding window size of 24 hours and a step size of 1 hour are set to divide the sequence into several time segments. For each segment, five statistical measures—mean, median, standard deviation, maximum, and minimum—are calculated for the numerical attributes. These segment statistics are then arranged in chronological order to form the attribute time series.

[0070] For the attribute time series, a simple moving average method is used for filtering, with a window length of 7 time points. The arithmetic mean of the values ​​within the window is calculated as the smoothed value for the current time point, resulting in a smoothed series. The least squares method is then applied to the smoothed series for linear fitting, with the fitting function in the form of... Where k represents the trend slope, b is the intercept, and t represents time, the trend component is obtained. The point-by-point difference between the original attribute time series and the smoothed series is calculated, and the corresponding value of the trend component is subtracted from the difference series to obtain the volatility component reflecting the short-term volatility characteristics.

[0071] A first-order difference operation is performed on the trend component, i.e., the difference between values ​​at adjacent time points is calculated, to obtain the rate of change sequence. Four statistical features—maximum rate of change, minimum rate of change, mean rate of change, and variance of rate of change—are extracted from the aforementioned rate of change sequence to form a 12-dimensional rate of change feature vector. A fast Fourier transform is applied to the fluctuation component to convert it to the frequency domain, the power spectral density is calculated, and the top five frequency components by energy proportion and their corresponding amplitudes are extracted to form a 10-dimensional spectral feature vector. The 12-dimensional rate of change feature vector and the 10-dimensional spectral feature vector are concatenated sequentially to form a 22-dimensional time-series feature vector, comprehensively characterizing the temporal evolution characteristics of the asset object.

[0072] In this embodiment, by extracting semantic features from structured and unstructured fields and calculating semantic similarity, semantic clustering and naming standardization are performed, effectively solving the problems of inconsistent field naming, inconsistent semantic expression, and data silos. This improves the accuracy and standardization of data integration, reduces the cost of manual mapping and rule maintenance, and achieves a structured expression of the attribute evolution process by constructing a time-sorted attribute sequence and performing sliding window segmentation and statistical aggregation. This enhances the ability to characterize the time dependence of data, transforming data from discrete records into continuous evolution sequences and improving the accuracy of describing dynamic changes. By smoothing, trend fitting, and fluctuation decomposition of the attribute time series, and combining rate of change analysis and frequency domain feature extraction, a time-series feature vector integrating time and frequency domain information is constructed, which can more comprehensively reflect the changing characteristics of the data and effectively improve the ability to characterize complex dynamic behaviors and identify abnormal patterns.

[0073] In one alternative implementation,

[0074] Based on the standardized fields, the dependencies between asset objects are identified. A topological traversal is performed on these dependencies to obtain node connectivity paths. Weights are assigned to the nodes in these connectivity paths to obtain an influence propagation matrix. Based on the influence propagation matrix and the temporal feature vector, the associated feature vector is calculated, including:

[0075] Extract the call relationships and data flow between asset objects from the standardized fields and construct a multi-layer heterogeneous dependency graph. Based on the multi-layer heterogeneous dependency graph, construct inter-layer dependency channels and determine dependency relationships.

[0076] The dependency relationship is represented as a multi-layer adjacency tensor structure, and a breadth-first traversal is performed at each layer to determine the number of cross-layer jumps and the number of intra-layer propagation steps. The path complexity is calculated based on the number of cross-layer jumps and the number of intra-layer propagation steps, and the node connectivity path is determined.

[0077] The path embedding representation of the connected paths of the nodes is learned by path embedding vectors. The structural similarity between different path embedding vectors is calculated and path clustering is performed to obtain path pattern clusters. The topological centrality of the paths within each path pattern cluster is calculated and the influence weight of each node is determined. The influence weights of the same node in different path pattern clusters are weighted and fused to obtain the node comprehensive weight and construct the influence propagation matrix.

[0078] The time-series feature vectors are arranged into a time-series feature matrix according to the asset objects. The influence propagation matrix is ​​decomposed into a tensor to determine the core tensor. The time-series feature matrix is ​​then combined with a tensor contraction operation to obtain a multi-order propagation feature set. Adaptive attention weighting is applied to the different-order propagation features in the multi-order propagation feature set and concatenated with the time-series feature vectors to obtain the associated feature vector.

[0079] Dependencies between asset objects are constructed by extracting relationship data, including API call records, data transfer logs, and configuration dependency declarations, from standardized fields. API call records are obtained by parsing API call logs to obtain the caller and callee identifiers. Data flow is determined by analyzing database connection strings and message queue subscription relationships to identify the data sender and receiver. The extracted call relationships and data flow are mapped to different layers: application layer relationships constitute the first layer, data layer relationships constitute the second layer, and infrastructure layer relationships constitute the third layer, forming a multi-layered heterogeneous dependency graph. In this multi-layered heterogeneous dependency graph, inter-layer dependency channels are established by identifying mapping nodes of the same asset object at different layers. Specifically, cross-layer node associations are achieved by matching the unique identifiers of asset objects.

[0080] Dependencies are represented as a third-order adjacency tensor, where the first and second dimensions represent the asset object node indices, and the third dimension represents the hierarchy index. A breadth-first traversal is performed on each hierarchy slice, expanding layer by layer from the specified source node to visit adjacent nodes, recording the number of layers visited for each node as the number of propagation steps within that layer. When a node with inter-layer dependency channels is encountered during traversal, a cross-layer jump operation is performed, and the number of cross-layer jumps is accumulated. Path complexity is calculated using a weighted summation method, multiplying the number of propagation steps within the layer by a weight coefficient of 0.6 and the number of cross-layer jumps by a weight coefficient of 1.2, and then adding them together to obtain the path complexity value. Paths with path complexity below a preset threshold are retained as valid node connectivity paths.

[0081] For each node-connected path, path embedding representation learning is performed. The sequence of nodes traversed in the path is input into a graph neural network encoder. Each node is mapped to a 128-dimensional vector through a node embedding layer. After two layers of graph convolution to aggregate information from adjacent nodes, a global pooling layer is used to generate a fixed-dimensional path embedding vector. The cosine similarity between different path embedding vectors is calculated, and a hierarchical clustering algorithm is used to group paths with a similarity greater than 0.75 into the same path pattern cluster. For each path pattern cluster, the betweenness centrality of each path within the cluster is calculated. Betweenness centrality is determined by statistically analyzing the frequency of the node's appearance in all shortest paths; a higher frequency indicates a stronger topological centrality. The betweenness centrality of a node is normalized and used as the influence weight of the current node in that path pattern cluster. For the influence weights of the same node in different path pattern clusters, a weighted average is performed using the cluster size as the weight coefficient to obtain the node's comprehensive weight. The comprehensive weights of all nodes are then filled into a matrix structure to form the influence propagation matrix.

[0082] The temporal feature vectors are arranged in the index order of asset objects to form a temporal feature matrix, where rows correspond to asset objects and columns correspond to time step features. The influence propagation matrix is ​​decomposed using Tucker decomposition, resulting in a product of a core tensor and a factor matrix, with the core tensor dimension set to 70% of the original matrix dimension. Tensor contraction is performed on the core tensor and the temporal feature matrix, with an inner product operation along the asset object dimension, yielding a multi-order propagation feature set containing first-order and second-order propagation features. An adaptive attention mechanism is applied to different-order propagation features, calculating the attention score for each order feature using a learnable parameter matrix. After softmax normalization, this score is multiplied by the corresponding order feature to obtain a weighted feature. The weighted propagation features are then concatenated with the original temporal feature vectors along the feature dimension to form a dimensionally expanded associated feature vector.

[0083] In this embodiment, by extracting call relationships and data flow from standardized fields and constructing a multi-layered heterogeneous dependency graph, different types and levels of dependency relationships can be expressed under a unified framework. This enhances the ability to describe cross-level interaction relationships in complex systems and avoids information fragmentation and dependency omissions. By representing dependency relationships as multi-layered adjacency tensors and combining cross-layer jump counts and intra-layer propagation steps to calculate path complexity, the difficulty and structural features of path propagation can be more precisely characterized, thereby improving the accuracy of critical path identification and the ability to distinguish complex propagation processes. Through path embedding representation learning and structural similarity clustering, typical path patterns are extracted and node influence weights are calculated by combining topological centrality. This achieves a comprehensive evaluation of node influence from the global path structure, effectively improving the reliability and stability of critical node identification. By performing tensor decomposition on the influence propagation matrix and tensor contraction on the temporal feature matrix, a multi-order propagation feature set is constructed. This can simultaneously integrate multi-order propagation effects and temporal dynamic information, thereby more comprehensively reflecting the diffusion process of influence in the network.

[0084] In one alternative implementation,

[0085] Path embedding representation learning is performed on the connected paths of the nodes to obtain path embedding vectors. The structural similarity between different path embedding vectors is calculated, and path clustering is performed to obtain path pattern clusters. The topological centrality of the paths within each path pattern cluster is calculated, and the influence weight corresponding to each node is determined, including:

[0086] Extract the path topology features and path semantic features corresponding to the connected paths of each node, perform feature fusion and graph neural network encoding on the path topology features and the path semantic features to obtain the path embedding vector and determine the unit path embedding vector;

[0087] Calculate the cosine similarity between different unit path embedding vectors and construct a path similarity matrix. Based on the path similarity matrix, construct a path similarity graph. Identify the path communities in the path similarity graph using a community detection algorithm and use them as path pattern clusters. Calculate the average path similarity corresponding to all paths in the path pattern cluster and the pattern representative vector of each path pattern cluster.

[0088] For each path pattern cluster, construct an intra-cluster path subgraph of the node connectivity paths. Calculate the multi-dimensional topological index of each node in the intra-cluster path subgraph and perform multilayer perceptron fusion to obtain the node topological centrality. Solve the node pattern matching degree based on the node topological centrality and the pattern representative vector. Determine the intra-cluster node influence weight based on the node pattern matching degree and the node topological centrality.

[0089] Cross-cluster aggregation is performed on the intra-cluster node influence weights of the same node in different path pattern clusters. The cluster weights are calculated based on the size of the path pattern clusters and the average path similarity. The influence weights corresponding to the nodes are obtained based on the intra-cluster node influence weights and the cluster weights.

[0090] For the obtained node connectivity paths, they need to be converted into a computable numerical representation to achieve automatic path pattern recognition. For each node connectivity path, topological features are extracted, including path length, path node degree sequence, and edge type distribution. Semantic features are obtained by extracting semantic information from standardized fields corresponding to nodes in the path, such as word vectorization of text descriptions like asset type and business attributes. The path topological features are represented as vectors and concatenated or weighted with the path semantic feature vectors to form a hybrid feature vector. This hybrid feature vector is then input into a graph attention network or graph convolutional network for encoding. After propagation through a multi-layer graph neural network, a path embedding vector fusing topological and semantic information is obtained. The path embedding vector is then L2-norm normalized to obtain a unit path embedding vector with a modulus of 1.

[0091] For all obtained unit path embedding vectors, cosine similarity is calculated pairwise, specifically through vector dot product. The calculated similarity values ​​are then filled into the corresponding positions in the path similarity matrix, with the matrix dimension being the product of the total number of paths. An undirected graph is constructed based on the path similarity matrix as the path similarity graph, where each path is a node. When the similarity between two path nodes exceeds a preset threshold, such as 0.7, an edge is established between the two path nodes. Community detection algorithms, such as the Louvain algorithm or label propagation algorithm, are used to partition the path similarity graph. Each identified community is a path pattern cluster, with paths within the cluster exhibiting high similarity. For each path pattern cluster, the arithmetic mean of the similarities between any two paths within the cluster is calculated as the average path similarity, reflecting the cluster's tightness. The mean vector of the unit path embedding vectors for all paths within the cluster is calculated and used as the pattern representative vector for that cluster, characterizing the typical features of this type of path pattern.

[0092] For each path pattern cluster, extract all nodes and edges involved in the connected paths of all nodes within the cluster, constructing an intra-cluster path subgraph containing only these paths. For each node in the subgraph, calculate multi-dimensional topological indices: degree centrality is obtained by counting the number of edges connected to the node; betweenness centrality is obtained by calculating the proportion of shortest paths passing through the node; proximity centrality is obtained by calculating the reciprocal of the average shortest path length from the node to all other nodes; and eigenvector centrality is obtained by iteratively calculating the importance of the node and its neighbors. Normalize the aforementioned topological indices to form a vector, input it into a multilayer perceptron with two hidden layers for nonlinear fusion, using ReLU as the activation function. The output layer produces a scalar value as the node's topological centrality. Calculate the cosine similarity between the normalized field embedding vector corresponding to the node and the representative vector of the cluster pattern as the node pattern matching degree, which reflects the degree of fit between the node features and the cluster pattern. Multiply the node's topological centrality and node pattern matching degree to obtain the intra-cluster node influence weight.

[0093] Since the same node may appear in multiple path pattern clusters, its influence weights in different clusters need to be aggregated. For each path pattern cluster, the cluster size is calculated based on the number of paths within the cluster, and the cluster weight is obtained by multiplication using the previously calculated average path similarity. Clusters with larger sizes and higher internal similarity receive higher weights. For the same node, its influence weights within each cluster are multiplied by the corresponding cluster weights, and then summed to complete the cross-cluster weighted aggregation, resulting in the node's final influence weight. This weight reflects the node's overall influence capability in the overall asset dependency network.

[0094] In this embodiment, by simultaneously extracting and fusing path topological features and path semantic features, the completeness and discriminative ability of path representation are improved, making the identification of similar paths more accurate. By constructing a path similarity graph based on cosine similarity and using a community detection algorithm to classify path patterns, the problem of difficulty in discovering high-order structural patterns in traditional path analysis is effectively overcome. Automatic classification and pattern extraction of a large number of paths are achieved, enhancing the ability to identify potential propagation patterns in complex dependencies. By constructing subgraphs within path pattern clusters and fusing multi-dimensional topological indicators to calculate node topological centrality, and combining pattern representative vectors to calculate node pattern matching degree, the refinement and discriminative ability of node influence assessment are significantly improved. By performing cross-cluster aggregation of node influence in different path pattern clusters and weighting the results by combining the path pattern cluster size and average similarity, a unified assessment of the comprehensive role of nodes under multiple propagation patterns is achieved, enhancing the global consistency and robustness of the results.

[0095] Figure 2 This is a flowchart illustrating the path embedding and influence analysis process of the asset risk analysis method based on multi-source heterogeneous data fusion, as described in this embodiment of the invention.

[0096] In one alternative implementation,

[0097] The associated feature vector is segmented and sampled to obtain multiple time window samples. The statistical deviations corresponding to the samples in different time windows are calculated and a set of deviation vectors is constructed. Cluster analysis is performed on the set of deviation vectors to obtain anomaly pattern clusters, including:

[0098] The associated feature vector is segmented and sampled to obtain time window segments. The associated feature vectors within each time window segment are sampled in the time domain and frequency domain and then concatenated to obtain time window samples.

[0099] A global reference distribution is constructed based on the time window samples, and the global statistical moments corresponding to the global reference distribution are calculated. The distribution distance between each time window sample and the global reference distribution is calculated to obtain the distribution deviation value. The statistical moment features corresponding to each time window sample are extracted, and the difference between the statistical moment features and the global statistical moments is calculated to obtain the moment deviation value. The distribution deviation value and the moment deviation value are combined into a vector to construct a deviation vector set.

[0100] Calculate the distance between different deviation vectors in the deviation vector set and construct a deviation distance matrix. Based on the deviation distance matrix, construct a deviation space graph and perform spectral decomposition to obtain a low-dimensional deviation embedding representation. Perform density estimation on the low-dimensional deviation embedding representation to obtain a density distribution. Based on the density distribution and a preset density threshold, determine the abnormal pattern cluster.

[0101] The associated feature vectors are sampled in segments at fixed time intervals, with the length of each time window segment determined based on the business cycle characteristics of the asset object. In time-domain sampling, feature values ​​are extracted from the associated feature vectors within each time window segment at equal time intervals, forming a time-domain feature sequence. In frequency-domain sampling, Fourier transforms are performed on the associated feature vectors within the same time window segment to extract the main frequency components and their corresponding amplitudes in the spectrum, forming a frequency-domain feature sequence. The time-domain and frequency-domain feature sequences are combined according to a preset concatenation rule to obtain a time-window sample containing both time and frequency domain information.

[0102] The global reference distribution is constructed by aggregating the feature values ​​from all time window samples, and the probability density function of the feature values ​​is fitted using the kernel density estimation method. Global statistical moments include mean, variance, skewness, and kurtosis, representing the central tendency, dispersion, symmetry, and tail characteristics of the data, respectively. Distribution distance is calculated using KL divergence, specifically representing the relative entropy between the empirical distribution of the time window samples and the global reference distribution, yielding the distribution bias value. For statistical moment feature extraction, the mean, variance, skewness, and kurtosis are calculated for each time window sample. These statistical moments are subtracted from the corresponding global statistical moments, and the absolute values ​​are taken to obtain the moment bias values ​​in four dimensions. Using the distribution bias value as the first dimension and the four moment bias values ​​as subsequent dimensions, a five-dimensional bias vector is formed. The bias vectors corresponding to all time window samples constitute the bias vector set.

[0103] The deviation distance matrix is ​​constructed by calculating the Euclidean distance between any two deviation vectors in the deviation vector set. Matrix elements represent the similarity between two time window samples in the deviation space. The deviation space graph treats each deviation vector as a node in the graph. When the deviation distance between two nodes is less than an adaptive threshold, an edge is established, with the edge weight set to the reciprocal of the distance. Eigenvalue decomposition is performed on the Laplacian matrix of the deviation space graph. For example, the eigenvectors corresponding to the k smallest non-zero eigenvalues ​​are selected, and these eigenvectors are combined column-wise to form a low-dimensional deviation embedding representation, achieving a mapping from the high-dimensional deviation space to the low-dimensional manifold space. Density estimation uses a local density calculation method. For each low-dimensional embedding point, the number of points within its neighborhood is counted and divided by the neighborhood volume to obtain the density value of that point. The density distribution exhibits differences between dense and sparse regions. A density threshold is set to 1.5 times the global density mean. Embedding points with density values ​​higher than the density threshold and their connected regions are identified as anomalous pattern clusters. Each anomalous pattern cluster corresponds to a set of time window samples with similar statistical deviation characteristics.

[0104] In this embodiment, by segmenting the associated feature vectors and simultaneously introducing time-domain and frequency-domain sampling within each time window, the instantaneous and periodic features of the signal can be captured more comprehensively, enhancing the ability to express complex dynamic patterns and avoiding the omission of key information. By constructing a global reference distribution and introducing a joint characterization method of distribution deviation value and statistical moment deviation value, the limitations of relying solely on a single statistical indicator or simple threshold judgment are effectively overcome. This achieves a comprehensive measurement of the degree of anomaly from both the overall distribution pattern and high-order statistical features, significantly improving the ability to identify weak and gradual anomalies. By constructing a distance matrix from the deviation vector set and performing spectral decomposition to obtain a low-dimensional embedding representation, the impact of the curse of dimensionality and noise interference can be effectively reduced, improving the separability of structural relationships between anomaly patterns and making the anomaly patterns more clearly apparent. By performing density estimation in low-dimensional space and combining it with density thresholds to identify anomaly pattern clusters, adaptive discovery and clustering identification of anomaly patterns are achieved. This not only identifies discrete anomaly points but also discovers anomaly groups with similar features, improving the comprehensiveness and stability of anomaly detection.

[0105] In one alternative implementation,

[0106] The risk level identifier is obtained by matching the abnormal pattern cluster with the preset risk assessment rules. The risk level identifier is then associated with and stored with the standardized fields of the asset object to obtain the risk analysis result, including:

[0107] Extract the pattern feature vectors corresponding to the abnormal pattern clusters, extract the rule condition set and rule conclusion set from the preset risk judgment rules, perform semantic matching calculation between the pattern feature vectors and the rule condition set to obtain the condition satisfaction degree, and perform weighted aggregation on the rule conclusion set based on the condition satisfaction degree to obtain the risk level identifier.

[0108] A risk level mapping table is constructed based on the risk level identifier. The asset identifier field and attribute field are extracted from the standardized fields of the asset object. The risk level identifier is converted into risk level description information through the risk level mapping table. The risk level description information is associated with the asset identifier field and the attribute field and an association index is constructed. The risk level description information, the asset identifier field, and the attribute field are structured and stored based on the association index to obtain the risk analysis results.

[0109] The risk level description information in the risk analysis results is grouped and statistically analyzed to obtain the risk level distribution. Based on the risk level distribution, the number of asset objects and the proportion of asset objects corresponding to each risk level are calculated and associated with the risk level distribution to obtain a risk statistical report.

[0110] For risk level matching and storage of anomalous pattern clusters, pattern feature vectors are extracted from the clustered anomalous pattern clusters. These feature vectors include statistical parameters of the cluster centroids, the dispersion of samples within the cluster, and the trend of change within a time window. Pre-defined risk assessment rules are organized in the form of condition-conclusion pairs. The rule condition set defines the feature threshold range, rate of change limit, and combination conditions of multi-dimensional features that trigger risk, while the rule conclusion set corresponds to risk level labels of different severity levels.

[0111] Semantic matching is achieved by iterating through the set of rule conditions one by one. The values ​​of each dimension of the pattern feature vector are compared numerically with the threshold ranges in the rule conditions. For interval-type conditions, interval inclusion is used for judgment; for boundary-type conditions, distance metric is used for calculation. A value of 1.0 is assigned when a feature value of a certain dimension fully satisfies the corresponding condition; a satisfaction score between 0 and 1 is calculated based on the degree of deviation when it partially satisfies the condition; and a value of 0 is assigned when it does not satisfy the condition at all. For composite rules containing multiple sub-conditions, the satisfaction scores of each sub-condition are combined using minimum value calculation or product calculation to obtain the overall condition satisfaction score of the rule.

[0112] Based on the calculated satisfaction levels of each rule's conditions, the set of rule conclusions is weighted and aggregated. The risk level conclusion corresponding to each rule is converted into a numerical level code. Using the condition satisfaction level of that rule as a weighting coefficient, the level codes of all rules are weighted, summed, and then normalized. When the weighted aggregation result falls within a preset level range threshold, it is mapped to the corresponding risk level identifier, such as "high risk," "medium risk," or "low risk."

[0113] After obtaining the risk level identifier, a risk level mapping table is constructed for standardized description. This mapping table establishes the correspondence between the level identifier and the structured descriptive information, which includes the level name, numerical range, risk level description, and recommended remedial measures. An asset identifier field is extracted from the standardized fields of the asset object; this field serves as a unique key to identify the specific asset entity. Attribute fields reflecting asset type, department, and business attributes are also extracted.

[0114] By querying the risk level mapping table, risk level identifiers are converted into risk level descriptions with complete explanations. When performing field association operations, the asset identifier field is used as the primary key, and the risk level description information is organized as a new field alongside existing attribute fields. The association index is constructed using a hybrid approach combining hash indexes and B-tree indexes. A hash index is created for the asset identifier field for fast location, while a B-tree index is created for the risk level field to support range queries and sorting.

[0115] The structured organization and storage employ a relational data table structure. The table structure includes an asset identifier column, attribute field columns, and a risk level description column, and records the analysis timestamp and data version number. The processed field values ​​are inserted into the data table row by row, ensuring the uniqueness constraint of the asset identifier field. For existing asset objects, an update operation is performed to replace the old risk level information. After storage, a risk analysis result dataset is generated.

[0116] When performing statistical analysis on the risk analysis results, the risk levels are grouped according to the risk level description information. The number of records within each level group is counted to obtain the risk level distribution. The number of asset objects corresponding to each risk level is the total number of records for that level group. The percentage of asset objects is obtained by dividing the number of asset objects in that level by the total number of all asset objects. The calculated quantities and percentages are associated with the corresponding risk level categories and organized into triplets containing the level name, number of objects, and percentage. The statistical data of all levels are summarized to generate a risk statistical report to support management decisions and resource allocation.

[0117] In this embodiment, by semantically matching the pattern feature vectors of anomaly pattern clusters with the condition set in the preset risk judgment rules, and weighting and aggregating the rule conclusions based on the condition satisfaction, a multi-rule collaboration and flexible matching mechanism is realized. This enables a more refined characterization of the relationship between anomalies and risks, reduces the probability of misjudgment and omission, and improves the accuracy and adaptability of risk level judgment. By constructing a risk level mapping table and associating and structuring risk levels with asset identifiers and attribute fields, efficient binding and unified management of risk information and asset data are achieved, significantly improving data query efficiency and result traceability. By grouping and statistically analyzing the risk analysis results and calculating the asset proportion corresponding to each risk level, a risk level distribution and statistical report are generated. Compared with methods that only output single-point risk results, this method achieves an improvement from individual risk identification to overall risk situation analysis, enhancing decision support capabilities and a global perspective on risk management.

[0118] A second aspect of this invention provides an asset risk analysis system that integrates multi-source heterogeneous data, comprising:

[0119] The data feature extraction unit is used to obtain structured and unstructured data records corresponding to asset objects from multiple data sources, extract fields from the structured data records to obtain structured fields, perform text parsing and entity recognition on the unstructured data records to obtain unstructured fields, perform semantic mapping between the structured fields and the unstructured fields to obtain standardized fields, and perform attribute extraction and time series decomposition on the asset objects based on the standardized fields to obtain time series feature vectors.

[0120] The association analysis modeling unit is used to identify the dependency relationship between asset objects based on the standardized fields, perform topological traversal on the dependency relationship to obtain the node connection path, assign weights to the nodes in the node connection path to obtain the influence propagation matrix, and solve for the association feature vector based on the influence propagation matrix and the time series feature vector.

[0121] The risk level assessment unit is used to segment and sample the associated feature vector to obtain multiple time window samples, calculate the statistical deviations corresponding to the samples in different time windows and construct a set of deviation vectors, perform cluster analysis on the set of deviation vectors to obtain anomaly pattern clusters, match the anomaly pattern clusters with preset risk judgment rules to obtain risk level identifiers, and associate and store the risk level identifiers with the standardized fields of the asset object to obtain risk analysis results.

[0122] A third aspect of the present invention provides an electronic device, comprising:

[0123] A processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke instructions stored in the memory to perform the aforementioned method.

[0124] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0125] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0126] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for asset risk analysis based on the fusion of multi-source heterogeneous data, characterized in that, include: The system obtains structured and unstructured data records corresponding to asset objects from multiple data sources. It extracts fields from the structured data records to obtain structured fields, performs text parsing and entity recognition on the unstructured data records to obtain unstructured fields, performs semantic mapping between the structured and unstructured fields to obtain standardized fields, and performs attribute extraction and time series decomposition on the asset objects based on the standardized fields to obtain time series feature vectors. Based on the standardized fields, the dependencies between asset objects are identified. The dependencies are then topologically traversed to obtain node connectivity paths. Weights are assigned to the nodes in the connectivity paths to obtain the influence propagation matrix. Based on the influence propagation matrix and the temporal feature vector, the association feature vector is obtained. The associated feature vector is segmented and sampled to obtain multiple time window samples. The statistical deviations corresponding to the samples in different time windows are calculated and a set of deviation vectors is constructed. The set of deviation vectors is clustered to obtain anomaly pattern clusters. The anomaly pattern clusters are matched with preset risk judgment rules to obtain risk level identifiers. The risk level identifiers are associated with the standardized fields of the asset object and stored to obtain risk analysis results.

2. The method according to claim 1, characterized in that, Structured and unstructured data records corresponding to asset objects are obtained from multiple data sources. The structured data records are processed to extract structured fields, and the unstructured data records are processed to perform text parsing and entity recognition to obtain unstructured fields, including: The system obtains structured and unstructured data records corresponding to asset objects from multiple data sources. It identifies the data types of the structured data records to obtain numeric and character type fields. It performs numeric range detection on the numeric type fields and marks abnormal values. It removes the abnormal values ​​from the numeric type fields to obtain retained values. It performs encoding format conversion on the character type fields to obtain unified encoding characters. It merges the retained values ​​and the unified encoding characters to obtain the structured fields. The unstructured data records are segmented into words to obtain a word sequence. The word sequence is then labeled with parts of speech to obtain part-of-speech tags. Function words are filtered and entity words are retained based on the part-of-speech tags to obtain a candidate entity word set. Context windows are used to extract context fragments from the word elements in the candidate entity word set. The co-occurrence frequency between word elements is calculated based on the context fragments, and a co-occurrence matrix is ​​constructed. Graph traversal is performed on the co-occurrence matrix to identify connected subgraphs, and word elements in the connected subgraphs are merged into entity phrases to obtain the unstructured field.

3. The method according to claim 1, characterized in that, Semantic mapping is performed between the structured fields and the unstructured fields to obtain standardized fields. Based on the standardized fields, attribute extraction and time series decomposition are performed on the asset object to obtain a time-series feature vector, including: Semantic features are extracted from the structured field and the unstructured field respectively to obtain structured semantic vectors and unstructured semantic vectors, and semantic similarity is calculated. Semantic clustering is performed based on the semantic similarity to obtain semantic clusters. The fields in the semantic clusters are named and normalized and assigned unified identifiers to obtain the standardized fields. The attribute key-value pairs of the asset object are extracted from the standardized field and sorted according to the timestamp to obtain a time-series attribute sequence. The time-series attribute sequence is divided into multiple time segments by a sliding window. The attribute values ​​in each time segment are statistically aggregated to obtain segment statistics. The segment statistics are organized into an attribute time series according to the time order. The attribute time series is subjected to moving average filtering to obtain a smoothed series. The smoothed series is then subjected to trend fitting to obtain a trend component. The difference between the attribute time series and the smoothed series is calculated and combined with the trend component to obtain a fluctuation component. The trend component is subjected to first-order difference calculation to obtain a rate of change series. The rate of change series is subjected to statistical feature extraction to obtain a rate of change feature vector. The fluctuation component is subjected to frequency domain transformation and the main frequency components are extracted to obtain spectral features. The rate of change feature vector and the spectral features are concatenated to obtain the time series feature vector.

4. The method according to claim 1, characterized in that, Based on the standardized fields, the dependencies between asset objects are identified. A topological traversal is performed on these dependencies to obtain node connectivity paths. Weights are assigned to the nodes in these connectivity paths to obtain an influence propagation matrix. Based on the influence propagation matrix and the temporal feature vector, the associated feature vector is calculated, including: Extract the call relationships and data flow between asset objects from the standardized fields and construct a multi-layer heterogeneous dependency graph. Based on the multi-layer heterogeneous dependency graph, construct inter-layer dependency channels and determine dependency relationships. The dependency relationship is represented as a multi-layer adjacency tensor structure, and a breadth-first traversal is performed at each layer to determine the number of cross-layer jumps and the number of intra-layer propagation steps. The path complexity is calculated based on the number of cross-layer jumps and the number of intra-layer propagation steps, and the node connectivity path is determined. The path embedding representation of the connected paths of the nodes is learned by path embedding vectors. The structural similarity between different path embedding vectors is calculated and path clustering is performed to obtain path pattern clusters. The topological centrality of the paths within each path pattern cluster is calculated and the influence weight of each node is determined. The influence weights of the same node in different path pattern clusters are weighted and fused to obtain the node comprehensive weight and construct the influence propagation matrix. The time-series feature vectors are arranged into a time-series feature matrix according to the asset objects. The influence propagation matrix is ​​decomposed into a tensor to determine the core tensor. The time-series feature matrix is ​​then combined with a tensor contraction operation to obtain a multi-order propagation feature set. Adaptive attention weighting is applied to the different-order propagation features in the multi-order propagation feature set and concatenated with the time-series feature vectors to obtain the associated feature vector.

5. The method according to claim 4, characterized in that, Path embedding representation learning is performed on the connected paths of the nodes to obtain path embedding vectors. The structural similarity between different path embedding vectors is calculated, and path clustering is performed to obtain path pattern clusters. The topological centrality of the paths within each path pattern cluster is calculated, and the influence weight corresponding to each node is determined, including: Extract the path topology features and path semantic features corresponding to the connected paths of each node, perform feature fusion and graph neural network encoding on the path topology features and the path semantic features to obtain the path embedding vector and determine the unit path embedding vector; Calculate the cosine similarity between different unit path embedding vectors and construct a path similarity matrix. Based on the path similarity matrix, construct a path similarity graph. Identify the path communities in the path similarity graph using a community detection algorithm and use them as path pattern clusters. Calculate the average path similarity corresponding to all paths in the path pattern cluster and the pattern representative vector of each path pattern cluster. For each path pattern cluster, construct an intra-cluster path subgraph of the node connectivity paths. Calculate the multi-dimensional topological index of each node in the intra-cluster path subgraph and perform multilayer perceptron fusion to obtain the node topological centrality. Solve the node pattern matching degree based on the node topological centrality and the pattern representative vector. Determine the intra-cluster node influence weight based on the node pattern matching degree and the node topological centrality. Cross-cluster aggregation is performed on the intra-cluster node influence weights of the same node in different path pattern clusters. The cluster weights are calculated based on the size of the path pattern clusters and the average path similarity. The influence weights corresponding to the nodes are obtained based on the intra-cluster node influence weights and the cluster weights.

6. The method according to claim 1, characterized in that, The associated feature vector is segmented and sampled to obtain multiple time window samples. The statistical deviations corresponding to the samples in different time windows are calculated and a set of deviation vectors is constructed. Cluster analysis is performed on the set of deviation vectors to obtain anomaly pattern clusters, including: The associated feature vector is segmented and sampled to obtain time window segments. The associated feature vectors within each time window segment are sampled in the time domain and frequency domain and then concatenated to obtain time window samples. A global reference distribution is constructed based on the time window samples, and the global statistical moments corresponding to the global reference distribution are calculated. The distribution distance between each time window sample and the global reference distribution is calculated to obtain the distribution deviation value. The statistical moment features corresponding to each time window sample are extracted, and the difference between the statistical moment features and the global statistical moments is calculated to obtain the moment deviation value. The distribution deviation value and the moment deviation value are combined into a vector to construct a deviation vector set. Calculate the distance between different deviation vectors in the deviation vector set and construct a deviation distance matrix. Based on the deviation distance matrix, construct a deviation space graph and perform spectral decomposition to obtain a low-dimensional deviation embedding representation. Perform density estimation on the low-dimensional deviation embedding representation to obtain a density distribution. Based on the density distribution and a preset density threshold, determine the abnormal pattern cluster.

7. The method according to claim 1, characterized in that, The risk level identifier is obtained by matching the abnormal pattern cluster with the preset risk assessment rules. The risk level identifier is then associated with and stored with the standardized fields of the asset object to obtain the risk analysis result, including: Extract the pattern feature vectors corresponding to the abnormal pattern clusters, extract the rule condition set and rule conclusion set from the preset risk judgment rules, perform semantic matching calculation between the pattern feature vectors and the rule condition set to obtain the condition satisfaction degree, and perform weighted aggregation on the rule conclusion set based on the condition satisfaction degree to obtain the risk level identifier. A risk level mapping table is constructed based on the risk level identifier. The asset identifier field and attribute field are extracted from the standardized fields of the asset object. The risk level identifier is converted into risk level description information through the risk level mapping table. The risk level description information is associated with the asset identifier field and the attribute field and an association index is constructed. The risk level description information, the asset identifier field, and the attribute field are structured and stored based on the association index to obtain the risk analysis results. The risk level description information in the risk analysis results is grouped and statistically analyzed to obtain the risk level distribution. Based on the risk level distribution, the number of asset objects and the proportion of asset objects corresponding to each risk level are calculated and associated with the risk level distribution to obtain a risk statistical report.

8. An asset risk analysis system based on the fusion of multi-source heterogeneous data, used to implement the method of any one of claims 1-7, characterized in that, include: The data feature extraction unit is used to obtain structured and unstructured data records corresponding to asset objects from multiple data sources, extract fields from the structured data records to obtain structured fields, perform text parsing and entity recognition on the unstructured data records to obtain unstructured fields, perform semantic mapping between the structured fields and the unstructured fields to obtain standardized fields, and perform attribute extraction and time series decomposition on the asset objects based on the standardized fields to obtain time series feature vectors. The association analysis modeling unit is used to identify the dependency relationship between asset objects based on the standardized fields, perform topological traversal on the dependency relationship to obtain the node connection path, assign weights to the nodes in the node connection path to obtain the influence propagation matrix, and solve for the association feature vector based on the influence propagation matrix and the time series feature vector. The risk level assessment unit is used to segment and sample the associated feature vector to obtain multiple time window samples, calculate the statistical deviations corresponding to the samples in different time windows and construct a set of deviation vectors, perform cluster analysis on the set of deviation vectors to obtain anomaly pattern clusters, match the anomaly pattern clusters with preset risk judgment rules to obtain risk level identifiers, and associate and store the risk level identifiers with the standardized fields of the asset object to obtain risk analysis results.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images