Method, device and electronic device for determining audit model

Abstract

Embodiments of the present invention provide a method, apparatus, and electronic device for determining an audit model. The method includes: obtaining user permissions of a target user, wherein the user permissions are used to indicate the data the target user is permitted to access; extracting a first data set from an audit database based on the user permissions, wherein the first data set includes multiple data tables; and determining at least one first target audit model from an audit model library based on the first data set, wherein the fields of the data tables in the first data set include fields required for inputting data into the first target audit model. The solution of the present invention can improve the accuracy of audit model selection.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a method, device and electronic equipment for determining an audit model. Background Art

[0002] Log auditing is a crucial component of data security governance. Administrators access logs generated by the audited system and use audit models to analyze and calculate log data to identify security risks associated with system usage and trigger alerts, thereby ensuring system and data security. Audit models, also known as audit analysis models, calculate audit data for the audited object according to predefined calculation rules and identify risk points based on the results. Common audit models include keyword auditing, statistical auditing, and machine learning-based intelligent auditing models.

[0003] Traditionally, audit models are used by auditors, relying on their audit experience and familiarity with data fields or structures, to select models, or by backend developers who directly apply a specific audit model to specific audit data. However, auditors' choice of audit models based on experience can lead to omissions or incorrect selections due to incomplete considerations. Direct backend configuration results in audit models being applicable only to specific datasets and not universally applicable, making them inflexible and scalable. These factors can lead to overlooking risk points during the audit process. Summary of the Invention

[0004] The present invention provides a method, device and electronic equipment for determining an audit model, thereby improving the accuracy of audit model selection.

[0005] To solve the above technical problems, the embodiments of the present invention provide the following solutions:

[0006] A method for determining an audit model, comprising:

[0007] Obtaining user permissions of a target user, wherein the user permissions are used to indicate the data that the target user is allowed to obtain;

[0008] Extracting a first data set from an audit database according to user permissions, wherein the first data set includes a plurality of data tables;

[0009] At least one first target audit model is determined from an audit model library according to the first data set, wherein the fields of the data table in the first data set include fields required for inputting data of the first target audit model.

[0010] Optionally, determining at least one first target audit model from an audit model library based on the first data set includes:

[0011] Generate multiple sub-datasets based on the first data set, wherein the data tables in each sub-dataset are associated;

[0012] The first target audit model is determined according to the characteristics of the data table in the sub-data set and the characteristics of the data required to be input for each audit model in the audit model library.

[0013] Optionally, multiple sub-datasets are generated based on the first data set, including:

[0014] Extracting data features of each data table in the first data set;

[0015] Clustering the data table in the first data set according to data characteristics to obtain multiple data clusters;

[0016] Perform feature analysis on the data tables in each data cluster to generate related information;

[0017] A sub-dataset is generated according to the association information and the first data set.

[0018] Optionally, perform feature analysis on the data tables in each data cluster to generate associated information, including:

[0019] Confirm whether the data tables in each data cluster carry direct association information;

[0020] When a data table contains direct association information, extract the associated table and fields in the associated table.

[0021] Calculate the first degree of coincidence by extracting the associated fields between the data table and the associated table;

[0022] When the first degree of overlap is greater than a first threshold, an association relationship is generated according to the direct association relationship information.

[0023] Optionally, the method further includes:

[0024] In the case where there is no direct association relationship information in the data table, the familiarity between the data tables in each data cluster is calculated;

[0025] When the familiarity between the first data table and the second data table is greater than a second threshold, extracting the associated fields between the first data table and the second data table and calculating a second coincidence degree;

[0026] When the second degree of overlap is greater than the first threshold, association information is generated according to the first data table and the second data table.

[0027] Optionally, determining the first target audit model based on characteristics of the data table in the sub-dataset and characteristics of the data required to be input by each audit model in the audit model library includes:

[0028] Compare the similarity between the features of the data table in the sub-dataset and the features of the data required to be input for each audit model in the audit model library;

[0029] When the similarity between the features of the data table in the sub-dataset and the features of the data required by the audit model is greater than a third threshold, the audit model is determined as the first target audit model.

[0030] Optionally, the method further includes:

[0031] Get similar users of the target user;

[0032] Determining a second target audit model based on the audit model selected by the similar user and the first target audit model, wherein the audit model selected by the similar user is within the second target audit model;

[0033] sorting the second target audit models according to the number of similar users corresponding to each second target audit model;

[0034] The sorted second target audit model is displayed to the target user.

[0035] Optionally, similar users to the target user can be obtained, including:

[0036] Obtaining a first feature vector corresponding to each user in the user set and a second feature vector corresponding to the target user, wherein the first feature vector is determined according to the corresponding user authority of the user and the selected audit model;

[0037] When the familiarity between the first feature vector and the second feature vector corresponding to the user is greater than a fourth threshold, the user is determined as a target user.

[0038] Optionally, sorting the second target audit models according to the number of similar users corresponding to each second target audit model includes:

[0039] Determining a weight corresponding to each second target audit model according to the number of similar users corresponding to each second target audit model;

[0040] Obtaining a score for the second audit model according to the weight corresponding to the second audit model;

[0041] The second audit models are sorted according to their scores.

[0042] Optionally, the method further includes:

[0043] When obtaining the alarm information issued by the first user using the second target audit model, confirming whether the alarm information is accurate;

[0044] When the warning information is accurate, determining the recall rate of the second audit model, wherein the recall rate is used to indicate the proportion of warning information issued by the second target audit model;

[0045] generating an evaluation value of the second target audit model according to the accuracy and recall rate of the audit performed by the first user using the second target audit model;

[0046] In the case where the evaluation value is less than the fifth threshold, information indicating that the evaluation value of the second target audit model is less than the fifth threshold is sent to the user.

[0047] An embodiment of the present invention further provides a device for determining an audit model, comprising:

[0048] A first acquisition module is used to obtain user permissions of a target user, wherein the user permissions are used to indicate the data that the target user is allowed to obtain;

[0049] An extraction module is used to extract a first data set from the audit database according to user permissions, wherein the first data set includes multiple data tables;

[0050] The first determination module is used to determine at least one first target audit model from the audit model library according to the first data set, wherein the fields of the data table in the first data set include fields required for inputting data of the first target audit model.

[0051] The present invention also provides an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above method through the computer program.

[0052] The present invention also provides a processor-readable storage medium, which stores processor-executable instructions. The processor-executable instructions are used to enable a processor to execute the method described above.

[0053] The above solution of the present invention includes at least the following beneficial effects:

[0054] The above-mentioned solution of the present invention obtains user permissions and extracts a first data set that matches the user permissions from the audit database, thereby determining a first target audit model from the audit model library based on the first data set. In an embodiment of the present invention, the fields of the data table in the first data set include the fields required for the determined first target audit model, thereby matching the first target audit model determined in the audit model with the data that matches the user permissions, thereby improving the accuracy of audit model selection. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 Schematic diagram of a flow chart of a method for determining an audit model according to an embodiment of the present invention;

[0056] Figure 2 A schematic diagram of extracting a data set according to an embodiment of the present invention;

[0057] Figure 3 A schematic diagram of a process for generating an association relationship according to an embodiment of the present invention;

[0058] Figure 4 A schematic diagram of a system for determining an audit model according to an embodiment of the present invention;

[0059] Figure 5 A schematic diagram of a system for determining an audit model according to another embodiment of the present invention;

[0060] Figure 6 Schematic diagram of a module of an apparatus for determining an audit model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0061] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0062] like Figure 1 As shown, an embodiment of the present invention provides a method for determining an audit model, including:

[0063] Step 11: Obtain user rights of the target user, wherein the user rights are used to indicate the data that the target user is allowed to obtain;

[0064] In the embodiment of the present invention, user rights include rights to data in the audit database. In the embodiment of the present invention, different users can be restricted from accessing different data through the setting of user rights, and users can also be restricted from accessing data or fields.

[0065] Step 12: extracting a first data set from the audit database according to user permissions, where the first data set includes multiple data tables;

[0066] In an embodiment of the present invention, audit data can be stored in an audit database. The audit database can be a traditional relational database, a big data platform, or an index database. The audit database may include various types of log data to be audited (such as interface call logs) and static resource data for association (such as capability interface relationship tables). The log data and static resource data here can be associated based on a certain field. For example, in a common audit scenario, based on the app_id field in the interface call log and the APP_ID field in the capability interface relationship table, the ability_id used by the app_id in the current log is audited to see if it is in the ABILITY_ID set of the APP_ID in the application capability relationship table. If not, it is identified as a risk point.

[0067] In an embodiment of the present invention, the fields in the log data may include: log_time, operation_id, daytime, osb_app_id, request_source, developer_id, app_id, ability_id, interface_id, version, request_time, response_time, duration, tel, resp_type, resp_code, request_dir, service_request_time, service_response_time, etc.

[0068] In an embodiment of the present invention, the fields in the static resource data may include: HISTORY_ID, QUOTA_COUNT, QUOTA_LEVEL, PERIOD, STATUS, ABILITY_DESCRIPTION, ABILITY_ID, APP_ID, DEVELOPER_ID, MODIFY_TIME, MODIFY_ID, MODIFY_CONTENT, REQ_ID.

[0069] like Figure 2 As shown, different data sets can be extracted from the audit database through different user permissions, thereby facilitating the subsequent determination of the audit model based on the extractable data sets.

[0070] Step 13: Determine at least one first target audit model from the audit model library based on the first data set, wherein the fields of the data table in the first data set include fields required for inputting data of the first target audit model.

[0071] In an embodiment of the present invention, a first data set matching the user's permissions is extracted from an audit database by obtaining the user's permissions, thereby determining a first target audit model from an audit model library based on the first data set. In an embodiment of the present invention, the fields of the data table in the first data set include the fields required for the determined first target audit model, thereby matching the first target audit model determined in the audit model with the data matching the user's permissions, thereby improving the accuracy of audit model selection.

[0072] In this embodiment of the present invention, each user has different database table and field permissions, which may overlap or be completely unrelated. The user's data permissions can be expressed in the form of, but not limited to, a JSON list:

[0073] [{"database":Database_1,"table":,"field":[field_1,field_2,…,field_n1]},…].

[0074] Optionally, determining at least one first target audit model from an audit model library based on the first data set includes:

[0075] Generate multiple sub-datasets based on the first data set, wherein the data tables in each sub-dataset are associated;

[0076] The first target audit model is determined according to the characteristics of the data table in the sub-data set and the characteristics of the data required to be input for each audit model in the audit model library.

[0077] In this embodiment of the present invention, the characteristics of the data tables in each sub-dataset are compared with the characteristics of the data required for input into the audit model to obtain an audit model that the user data set satisfies. In this embodiment of the present invention, the corresponding sub-datasets for each first-target audit model are also obtained. The audit model numbers that can be matched under the user data permissions, along with the data tables and field information associated with the corresponding sub-datasets, are recorded. This facilitates subsequent auditing of the corresponding data using the first-target audit model.

[0078] Optionally, multiple sub-datasets are generated based on the first data set, including: extracting data features of each data table in the first data set; clustering the data tables in the first data set based on the data features to obtain multiple data clusters; performing feature analysis on the data tables in each data cluster to generate association information; and generating sub-datasets based on the association information and the first data set.

[0079] In an embodiment of the present invention, the extracted features may include information about the database where the data table is located; table information: table name, table description: data source, data purpose, etc.; field information: field name, field type, field description, etc.; data information: content features, such as the collection and frequency of each field value; some text features can be further extracted through word segmentation.

[0080] In an embodiment of the present invention, based on the characteristics of each data table, the user's data set is clustered after feature selection. Only data tables belonging to the same cluster and category may need to be associated during the audit process and become the combined input data source of the audit model. This also narrows the scope of association analysis of data tables. Association analysis here refers to analyzing the possibility of establishing associations between data tables based on a certain field. In an embodiment of the present invention, the output of clustering can be expressed as:

[0081] [{"cluster":cluster1,"table":[database1.table1,…,database n .table n ]},…].

[0082] In an embodiment of the present invention, the characteristics of the data tables under the same cluster are analyzed, and the associated information is obtained and verified. Standardized associated information can be generated and saved, so that the associated data set can be obtained later through the associated information. In an embodiment of the present invention, the associated information can also be expressed as a JSON list, for example:

[0083] [{"table":[database1.table1,database1.table2],

[0084] "field":[database1.table1.field1,database1.table2.field2]},…].

[0085] Optionally, feature analysis is performed on the data tables in each data cluster to generate association information, including: confirming whether the data tables in each data cluster carry direct association relationship information; if the data tables carry direct association relationship information, extracting the association table and the fields in the association table of the data table; calculating a first degree of overlap by extracting the association fields between the data table and the association table; and generating an association relationship based on the direct association relationship information when the first degree of overlap is greater than a first threshold.

[0086] Optionally, the method also includes: when the data table does not carry direct association relationship information, calculating the familiarity between the data tables in each data cluster; when the familiarity between the first data table and the second data table is greater than a second threshold, extracting the associated fields between the first data table and the second data table and calculating the second overlap; when the second overlap is greater than the first threshold, generating association information based on the first data table and the second data table.

[0087] like Figure 3 As shown, in an embodiment of the present invention, it is determined whether the data tables in each data cluster carry direct association relationship information. If the data tables carry direct association relationship information, the associated tables and fields in the associated tables can be directly extracted through word segmentation or foreign key dependency relationships. Here, the names of the associated tables and fields can be extracted from the data table description information through word segmentation; or if the table itself has a foreign key, the association status of the table can be obtained based on the primary and foreign key dependencies of the data table.

[0088] If the data tables do not contain direct association information, the similarity between the data tables in each data cluster is calculated. If the similarity between the first data table and the second data table is greater than a second threshold, the associated fields between the first data table and the second data table are extracted. Here, the association information between the tables is obtained by calculating the similarity between the table name, field name, field type, table description information, and field description information of each table.

[0089] In the embodiment of the present invention, the overlap degree is calculated by extracting the associated fields of the two tables and performing association verification, thereby improving the accuracy of the acquired association relationship. For example, based on the two table names and field names in the association information, the set of field values ​​{a1, a2, ..., a n} and {b1,b2,……,b n The validity of the association information is determined by judging whether the overlap between two sets exceeds a certain threshold.

[0090] Optionally, determining the first target audit model based on characteristics of the data table in the sub-dataset and characteristics of the data required to be input by each audit model in the audit model library includes:

[0091] Compare the similarity between the features of the data table in the sub-dataset and the features of the data required to be input for each audit model in the audit model library;

[0092] When the similarity between the features of the data table in the sub-dataset and the features of the data required by the audit model is greater than a third threshold, the audit model is determined as the first target audit model.

[0093] In an embodiment of the present invention, the audit model library can store model ID, model name, model category, source program file path, description (equation form, input and output data, functional description of the model, input requirements for model operation, and natural language description of the algorithm), selected users, and corresponding scores. The input data that the audit model relies on may involve fields of a single data table under the user data set, or may involve fields of multiple data tables. During the calculation process, the statistical information of one data table may be needed as a credential for the audit of another data table; it may also be necessary to associate one data table with another data table based on the fields before conducting the next audit, such as associating and obtaining basic information of suspected violators as audit output, which is used as a credential for subsequent security incident processing.

[0094] In an embodiment of the present invention, features of the data required as input for each audit model can be extracted. The features extracted here can include input field features, such as the input data field name, field description, and field type, and model features can include the model name, model requirements, and model description.

[0095] In the embodiment of the present invention, the sub-data set here may be multiple sub-data sets that can be generated under the associated information, such as:

[0096] [set1,set2,…,set n ], where set1 contains {table1, table2};

[0097] Based on the associated information:

[0098] [{"table":[database1.table1,database1.table2],"field":

[0099] [database1.table1.field1,database1.table2.field2]},…];

[0100] Table1 and table2 can be associated based on fields field1 and field2. Set1 contains the set of all fields in table1 and table2 within the user's permission range:

[0101] fieldSet1:{table1.field1,table2.field2,…}.

[0102] Set the field characteristics, table characteristics and input fields in the audit model of fieldSet1:

[0103] fieldSet 2,:{field1,field2,…} features are compared and analyzed with model features. If the similarity meets the requirements, the model is recommended to the user. For example, after table1 and table2 are linked based on user_id, fieldSet1 contains the fields user_name and client_ip from table1 and the field org_name from table2, while fieldSet2 requires the input fields user_name, client_ip, and org_name. At the same time, if the features of these fields, the involved table features, and the model features all meet a certain similarity, then the sub-dataset is considered to meet the requirements of the current audit model.

[0104] Compare the sub-datasets with each audit model according to the above method, and finally obtain a list of recommended audit models and their corresponding sub-datasets:

[0105] [{"model":model1,"table":[database1.table1,database1.table2],

[0106] "field":[database1.table1.field1,database1.table2.field2,…]},…].

[0107] Optionally, the method also includes: obtaining similar users of the target user; determining a second target audit model based on the audit model selected by the similar users and the first target audit model, wherein the audit model selected by the similar users is in the second target audit model; sorting the second target audit models according to the number of similar users corresponding to each second target audit model; and displaying the sorted second target audit models to the target user.

[0108] In an embodiment of the present invention, the second target audit model can be sorted according to the selections of similar users, and the sorted second target audit model can be displayed to the user, thereby providing the user with a reference for the dimensions selected by other users when selecting an audit model through sorting display.

[0109] Optionally, obtaining similar users of the target user includes: obtaining a first feature vector corresponding to each user in the user set and a second feature vector corresponding to the target user, wherein the first feature vector is determined based on the user's corresponding user authority and the selected audit model; when the degree of acquaintance between the first feature vector and the second feature vector corresponding to the user is greater than a fourth threshold, the user is determined as the target user.

[0110] In this embodiment of the present invention, features can be extracted based on user data permissions and model selection, and a feature vector or feature matrix can be constructed for each user. For each user, a ranking of user similarities is obtained: [User 1, User 2, …, User n]. Users with similarities below a certain threshold are eliminated to obtain similar users to the current user. The set of audit models selected by similar users under the current user is obtained, and the intersection of this set with the candidate audit model library for the current user is taken to obtain a list of audit models that can be further recommended: [Model 1, Model 2, …, Model n].

[0111] Optionally, the second target audit models are sorted according to the number of similar users corresponding to each second target audit model, including: determining the weight corresponding to the second audit model according to the number of similar users corresponding to each second target audit model; obtaining the score of the second audit model according to the weight corresponding to the second audit model; and sorting the second audit models according to the score of the second audit model.

[0112] In this embodiment of the present invention, based on the sorting of the similar user list, each model is assigned a weight based on the selected user, resulting in a score for each model in the audit model list. The audit model list is then sorted by score and pushed to the current user, who can then select a model based on its score and various attribute descriptions.

[0113] Optionally, the method also includes: when obtaining the alarm information issued by the first user using the second target audit model, confirming whether the alarm information is accurate; when the alarm information is accurate, determining the recall rate of the second audit model, wherein the recall rate is used to indicate the proportion of alarm information issued for the second target audit model; generating an evaluation value of the second target audit model based on the accuracy and recall rate of the audit performed by the first user using the second target audit model; when the evaluation value is less than the fifth threshold, sending information that the evaluation value of the second target audit model is less than the fifth threshold to the user.

[0114] In an embodiment of the present invention, when a user uses an audit model to continuously audit a corresponding sub-dataset and receives an alarm message from it, it is necessary to determine whether the current alarm message is accurate and feed back the confirmation result to the system. Based on the information fed back by the user, the accuracy and recall rate of the audit model for the current user are calculated and a corresponding evaluation value is generated. When the evaluation value is lower than a certain threshold, the relevant information will be pushed to the user. In an embodiment of the present invention, for an audit model with a low evaluation value, the user can choose not to use the audit model anymore and update the user's model selection table. A new audit model can be generated using the data set corresponding to the audit model, and the new audit model can be added to the audit model library and the user's candidate model library.

[0115] In an embodiment of the present invention, the audit model can be determined before using it for data processing. Model determination is based on data matching, considering the associations between various data tables within the user's data permissions. Based on data and model information, the audit database and the audit model library are directly matched. This method proposes an audit model recommendation solution in which an analysis and comparison module automatically matches the audit model library and the audit database to obtain a user candidate model library. A user collaborative filtering module then optimizes and ranks the recommendations, and an alert feedback module finally updates the recommendations. This improves the accuracy of model determination.

[0116] like Figure 4 and Figure 5 As shown, an embodiment of the present invention further provides a system for determining a calculation model, including:

[0117] The analysis and comparison module is used to analyze and compare the audit database and the audit model library to obtain the user's candidate model library and the corresponding user data set;

[0118] The user collaborative filtering module extracts features based on the user data permission table and the user model selection table, and further filters the current candidate model library to obtain model selections for similar users.

[0119] The alarm feedback module updates the audit model library based on the user's processing results or user ratings of the audit model output alarms. This update includes updating the recommended ratings in the audit model library, adding audit models, or deleting audit models.

[0120] The analysis and comparison module here will be based on the audit database and audit model library, and according to the current user's data permissions, output the user-applicable audit model (i.e., candidate model library) and user data set (including the original user data table, the association information between data tables, and the matching information with the audit model).

[0121] like Figure 6 As shown, the embodiment of the present invention further provides an audit model determination device 60, comprising:

[0122] A first acquisition module 61 is configured to acquire user rights of a target user, wherein the user rights are used to indicate the data that the target user is allowed to obtain;

[0123] An extraction module 62 is configured to extract a first data set from the audit database according to user permissions, wherein the first data set includes a plurality of data tables;

[0124] The first determination module 63 is configured to determine at least one first target audit model from the audit model library according to the first data set, wherein the fields of the data table in the first data set include fields required for inputting data of the first target audit model.

[0125] Optionally, the first determining module 63 includes:

[0126] A first generating unit is configured to generate a plurality of sub-datasets based on the first data set, wherein the data tables in each sub-dataset are associated;

[0127] The first determining unit is configured to determine a first target audit model according to characteristics of the data table in the sub-data set and characteristics of the data required to be input to each audit model in the audit model library.

[0128] Optionally, the first generation unit is specifically used to: extract data features of each data table in the first data set; cluster the data tables in the first data set based on the data features to obtain multiple data clusters; perform feature analysis on the data tables in each data cluster to generate association information; and generate a sub-data set based on the association information and the first data set.

[0129] Optionally, the first generation unit is further specifically used to: confirm whether the data table in each data cluster carries direct association relationship information; if the data table carries direct association relationship information, extract the association table and fields in the association table of the data table; calculate the first degree of overlap by extracting the association fields between the data table and the association table; if the first degree of overlap is greater than a first threshold, generate an association relationship based on the direct association relationship information.

[0130] Optionally, the device 60 further includes:

[0131] A first calculation module is used to calculate the familiarity between the data tables in each data cluster when there is no direct association relationship information in the data tables;

[0132] a second calculation module, configured to extract associated fields between the first data table and the second data table and calculate a second coincidence degree when the familiarity between the first data table and the second data table is greater than a second threshold;

[0133] The first generating module is configured to generate association information according to the first data table and the second data table when the second overlap degree is greater than a first threshold.

[0134] Optionally, the first determination unit is specifically used to: compare the similarity between the characteristics of the data table in the sub-dataset and the characteristics of the data required to be input for each audit model in the audit model library; when the similarity between the characteristics of the data table in the sub-dataset and the characteristics of the data required by the audit model is greater than a third threshold, determine the audit model as the first target audit model.

[0135] Optionally, the device 60 further includes:

[0136] The second acquisition module is used to acquire similar users of the target user;

[0137] A second determining module is configured to determine a second target audit model based on the audit model selected by the similar user and the first target audit model, wherein the audit model selected by the similar user is within the second target audit model;

[0138] a sorting module, configured to sort the second target audit models according to the number of similar users corresponding to each second target audit model;

[0139] The display module is used to display the sorted second target audit model to the target user.

[0140] Optionally, the second acquisition module includes:

[0141] A first acquiring unit is configured to acquire a first feature vector corresponding to each user in the user set and a second feature vector corresponding to the target user, wherein the first feature vector is determined according to the corresponding user authority of the user and the selected audit model;

[0142] The second determining unit is configured to determine the user as a target user when the familiarity between the first feature vector and the second feature vector corresponding to the user is greater than a fourth threshold.

[0143] Optionally, the sorting module includes:

[0144] a third determining unit, configured to determine a weight corresponding to each second target audit model according to the number of similar users corresponding to each second target audit model;

[0145] A second obtaining unit is configured to obtain a score of the second audit model according to a weight corresponding to the second audit model;

[0146] The sorting unit is used to sort the second audit models according to the scores of the second audit models.

[0147] Optionally, the device 60 further includes:

[0148] A confirmation module, configured to, upon obtaining the alarm information issued by the first user using the second target audit model, confirm whether the alarm information is accurate;

[0149] A third determining module is configured to determine a recall rate of the second audit model when the alarm information is accurate, wherein the recall rate indicates a proportion of the second target audit model for which alarm information is issued;

[0150] A second generating module is configured to generate an evaluation value of the second target audit model based on the accuracy and recall rate of the audit performed by the first user using the second target audit model;

[0151] The sending module is used to send information that the evaluation value of the second target audit model is less than the fifth threshold to the user when the evaluation value is less than the fifth threshold.

[0152] It should be noted that this device is a device corresponding to the above-mentioned method embodiment, and all implementation methods in the above-mentioned method embodiment are applicable to the embodiment of this device and can achieve the same technical effect.

[0153] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described method using the computer program. All implementations in the above-described method embodiments are applicable to the embodiments of this device and can achieve the same technical effects.

[0154] An embodiment of the present invention further provides a processor-readable storage medium storing processor-executable instructions for causing the processor to execute the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0155] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0156] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0157] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0158] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0159] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0160] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard drive, ROM, RAM, a magnetic disk, or an optical disk.

[0161] In addition, it should be noted that, in the apparatus and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. Moreover, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but it is not necessary to perform them in chronological order, and some steps can be performed in parallel or independently of each other. For those of ordinary skill in the art, it will be understood that all or any steps or components of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or a network of computing devices in hardware, firmware, software or a combination thereof, which can be achieved by those of ordinary skill in the art using their basic programming skills after reading the description of the present invention.

[0162] Therefore, the purpose of the present invention can also be achieved by running a program or a group of programs on any computing device. The computing device can be a well-known general-purpose device. Therefore, the purpose of the present invention can also be achieved simply by providing a program product containing program code that implements the method or device. That is to say, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any well-known storage medium or any storage medium developed in the future. It should also be pointed out that in the device and method of the present invention, it is obvious that each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. In addition, the steps of performing the above-mentioned series of processing can naturally be performed in chronological order according to the order of description, but do not necessarily need to be performed in chronological order. Certain steps can be performed in parallel or independently of each other.

[0163] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for determining an audit model, characterized in that: include: Obtaining user permissions of a target user, wherein the user permissions are used to indicate the data that the target user is allowed to obtain; Extracting a first data set from an audit database according to the user authority, wherein the first data set includes a plurality of data tables; Determine at least one first target audit model from an audit model library according to the first data set, wherein the fields of the data table in the first data set include fields required for inputting data of the first target audit model; Wherein, determining at least one first target audit model from an audit model library according to the first data set includes: Extracting data features of each data table in the first data set; Clustering the data tables in the first data set according to the data features to obtain multiple data clusters; Performing feature analysis on the data tables in each of the data clusters to generate association information; generating a sub-dataset based on the association information and the first data set; wherein the data tables in each sub-dataset are associated; Comparing the similarity between the features of the data table in the sub-dataset and the features of the data required to be input for each audit model in the audit model library; When the similarity between the features of the data table in the sub-dataset and the features of the data required by the audit model is greater than a third threshold, the audit model is determined as the first target audit model.

2. The method according to claim 1, characterized in that Perform feature analysis on the data tables in each of the data clusters to generate associated information, including: confirming whether the data tables in each of the data clusters carry direct association relationship information; In the case where the data table carries direct association relationship information, extracting the association table of the data table and the fields in the association table; Calculating a first degree of coincidence by extracting associated fields between the data table and the associated table; When the first degree of overlap is greater than a first threshold, the association relationship is generated according to the direct association relationship information.

3. The method according to claim 2, characterized in that The method further comprises: In the case where the data tables do not carry direct association relationship information, calculating the familiarity between the data tables in each of the data clusters; When the familiarity between the first data table and the second data table is greater than a second threshold, extracting the associated fields between the first data table and the second data table and calculating a second coincidence degree; When the second overlap degree is greater than the first threshold, the association information is generated according to the first data table and the second data table.

4. The method according to claim 1, wherein The method further comprises: Obtain similar users of the target user; Determining a second target audit model based on the audit model selected by the similar user and the first target audit model, wherein the audit model selected by the similar user is in the second target audit model; sorting the second target audit models according to the number of similar users corresponding to each second target audit model; The sorted second target audit model is displayed to the target user.

5. The method according to claim 4, characterized in that Obtaining similar users to the target user includes: Obtaining a first feature vector corresponding to each user in the user set and a second feature vector corresponding to the target user, wherein the first feature vector is determined according to the corresponding user authority of the user and the selected audit model; In a case where the familiarity between the first feature vector and the second feature vector corresponding to the user is greater than a fourth threshold, the user is determined as the target user.

6. The method according to claim 4, characterized in that Sorting the second target audit models according to the number of similar users corresponding to each second target audit model includes: determining a weight corresponding to each second target audit model according to the number of similar users corresponding to each second target audit model; Obtaining a score for the second target audit model according to a weight corresponding to the second target audit model; The second target audit models are sorted according to their scores.

7. The method according to claim 1 or 4, characterized in that The method further comprises: When obtaining the warning information issued by the first user using the second target audit model, confirming whether the warning information is accurate; In the case where the alarm information is accurate, determining a recall rate of the second target audit model, wherein the recall rate is used to indicate a proportion of the second target audit model for which alarm information is issued; generating an evaluation value of the second target audit model according to the accuracy and recall rate of the audit performed by the first user using the second target audit model; In a case where the evaluation value is less than the fifth threshold, information indicating that the evaluation value of the second target audit model is less than the fifth threshold is sent to the user.

8. A device for determining an audit model, characterized in that: include: A first acquisition module is configured to acquire user rights of a target user, wherein the user rights are used to indicate the data that the target user is allowed to obtain; An extraction module, configured to extract a first data set from an audit database according to the user authority, wherein the first data set includes a plurality of data tables; a first determining module, configured to determine at least one first target audit model from an audit model library based on the first data set, wherein the fields of the data table in the first data set include fields required for inputting data of the first target audit model; The first determining module includes: A first generating unit is configured to extract data features of each data table in the first data set; cluster the data tables in the first data set based on the data features to obtain a plurality of data clusters; perform feature analysis on the data tables in each data cluster to generate association information; and generate a sub-data set based on the association information and the first data set; wherein the data tables in each sub-data set are associated; The first determination unit is used to compare the similarity between the characteristics of the data table in the sub-dataset and the characteristics of the data required to be input for each audit model in the audit model library; when the similarity between the characteristics of the data table in the sub-dataset and the characteristics of the data required by the audit model is greater than a third threshold, the audit model is determined as the first target audit model.

9. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 7 through the computer program.

10. A processor-readable storage medium, characterized in that: The processor-readable storage medium stores processor-executable instructions, and the processor-executable instructions are used to enable the processor to execute the method according to any one of claims 1 to 7.

Images