Decision-making methods, devices, equipment and program products for operational risks

Abstract

The present invention discloses a decision-making method, device, equipment and program product for operational risk. The method includes: creating a graph database portrait model that matches the operational risk framework based on graph database technology; using a graph weight decision tree algorithm to initialize the parameters of the nodes and paths in the graph database portrait model to obtain a graph weight decision tree framework model; obtaining the operation value of the target monitoring node, and using a graph pattern weight distance evaluation algorithm to determine the risk impact range of the target monitoring node according to the operation value of the target monitoring node; and determining the risk decision-making method according to the risk impact range. The graph weight decision tree framework model is obtained by constructing the operational risk graph database portrait model. When the operation value of the target monitoring node is obtained, the impact range of the target detection node is determined according to the node attributes and path relationship, and the decision-making method for controlling or mitigating the operational risk is determined according to the impact range, so as to achieve effective management and control of the operational risk.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a decision-making method, device, equipment and program product for operational risks. Background Art

[0002] Operational risk refers to the risk caused by imperfect or problematic internal procedures, employees and information technology systems, as well as external events, including legal risk but excluding strategic risk and reputation risk.

[0003] At present, in the process of managing the regular operational risks of banks, attention is paid to the identification, assessment, detection, control and mitigation of relevant risks in the banking process. The content of attention basically includes elements such as internal, external and legal risks.

[0004] However, the operational risk management process currently implemented is unable to determine the impact range of key operational risk indicators based on the relationship and mutual influence between various elements, and therefore cannot achieve effective control of operational risks. Summary of the invention

[0005] The present invention provides a decision-making method, device, equipment and program product for operational risk, so as to achieve effective management and control of operational risk.

[0006] According to one aspect of the present invention, a decision-making method for operational risk is provided, comprising: creating a graph database portrait model matching an operational risk framework based on graph database technology, wherein nodes in the graph database portrait model represent key indicators in the operational risk framework, and paths in the graph database portrait model represent association relationships between the key indicators;

[0007] A graph weighted decision tree algorithm is used to initialize parameters of nodes and paths in the graph database portrait model to obtain a graph weighted decision tree framework model, wherein the types of nodes in the graph weighted decision tree framework model include monitoring nodes, aggregation nodes, and decision nodes;

[0008] Obtaining an operation value of a target monitoring node, and determining a risk impact range of the target monitoring node using a graph pattern weighted distance evaluation algorithm according to the operation value of the target monitoring node;

[0009] Determine the risk decision-making method based on the scope of risk impact.

[0010] According to another aspect of the present invention, a decision-making device for operational risk is provided, comprising: a graph database portrait model creation module, used to create a graph database portrait model matching an operational risk framework based on graph database technology, wherein the nodes in the graph database portrait model represent key indicators in the operational risk framework, and the paths in the graph database portrait model represent the association relationship of the key indicators;

[0011] A graph weighted decision tree framework model acquisition module is used to use a graph weighted decision tree algorithm to perform parameter initialization settings on the nodes and paths in the graph database portrait model to acquire a graph weighted decision tree framework model, wherein the types of nodes in the graph weighted decision tree framework model include monitoring nodes, aggregation nodes, and decision nodes;

[0012] A risk impact range determination module is used to obtain an operation value of a target monitoring node, and determine the risk impact range of the target monitoring node using a graph pattern weighted distance evaluation algorithm according to the operation value of the target monitoring node;

[0013] The wind direction decision mode determination module is used to determine the risk decision mode according to the risk impact range.

[0014] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can perform the method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method described in any embodiment of the present invention when executed.

[0019] The technical solution of the embodiment of the present invention constructs an operational risk graph database portrait model, and uses a graph weight decision tree algorithm to initialize the parameters of the nodes and paths in the graph database portrait model to obtain a graph weight decision tree framework model. When the operation value of the target monitoring node is obtained, according to the node attributes and path relationship, the distance and weight are reversely calculated to comprehensively monitor and analyze the changes in leaf node indicators, determine the influence range of the target detection node, and determine the decision-making method for controlling or mitigating the operational risk based on the influence range, so as to achieve effective management and control of operational risks.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a decision-making method for operational risk provided according to Embodiment 1 of the present invention;

[0023] Figure 2 This is a schematic diagram of a graph database portrait model provided according to the first embodiment of the present invention;

[0024] Figure 3 It is a schematic diagram of an application scenario of a decision-making method for operational risk according to the first embodiment of the present invention;

[0025] Figure 4 is a schematic diagram of a graph weighted decision tree framework model provided according to Embodiment 1 of the present invention;

[0026] Figure 5 is a flow chart of a decision-making method for operational risk provided according to Embodiment 2 of the present invention;

[0027] Figure 6 is a schematic diagram of the structure of a decision-making device for operational risk provided according to Embodiment 3 of the present invention;

[0028] Figure 7 is a schematic diagram of the structure of an electronic device provided by the fourth embodiment of the present invention; DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 A flowchart of a decision-making method for operational risk is provided for the first embodiment of the present invention. This embodiment is applicable to the case of making decisions for operational risk. The method can be executed by a decision-making device for operational risk, which can be implemented in the form of hardware and / or software. Figure 1 As shown, the method includes:

[0033] Step S110: Create a graph database portrait model that matches the operational risk framework based on graph database technology.

[0034] Optionally, a graph database portrait model matching the operational risk framework is created based on graph database technology, including: taking the operational risk framework as the root node and the key indicators as leaf nodes; connecting the root node and the leaf nodes using paths to obtain the graph database portrait model; wherein the key indicators include at least: employees, internal procedures, information technology systems, external events and legal risks.

[0035] Specifically, for the operational risk framework, we use graph theory technology and graph database technology to abstract the operational risk framework into a one-root-multi-node tree structure, with the operational risk framework as the root node and key indicators such as employees, internal procedures, information technology systems, external events and legal risks as leaf nodes. Each leaf node has multiple attributes, and each attribute is used as the next leaf node of the associated leaf node. The root node and the leaf node are connected by a path to obtain the graph database portrait model. Therefore, the nodes in the graph database portrait model represent the key indicators in the operational risk framework, and the paths in the graph database portrait model represent the relationship between the key indicators, such as Figure 2 As shown in FIG. , it is a schematic diagram of the graph database portrait model in this embodiment. Figure 3 As shown in the figure, it is a schematic diagram of the application scenario of the decision-making method for operational risk. In this implementation, it is mainly based on Figure 3The application scenario shown determines the risk decision-making approach.

[0036] Step S120: Use a graph weighted decision tree algorithm to initialize parameters of nodes and paths in the graph database portrait model to obtain a graph weighted decision tree framework model.

[0037] Optionally, a graph weighted decision tree algorithm is used to initialize parameters of nodes and paths in the graph database portrait model to obtain a graph weighted decision tree framework model, including: initializing the graph database portrait model using a graph weighted decision tree algorithm to determine the node weight and node threshold of each node, and the path weight of each path; constructing the weight transfer direction of each path; and determining the graph weighted decision tree framework model based on the node weight, node threshold, path weight, and weight transfer direction.

[0038] Specifically, in this embodiment, when obtaining the graph weight decision tree framework model according to the graph weight decision tree algorithm, the graph weight decision tree algorithm is used to initialize the node weights, node thresholds, and path weights in the graph database portrait model. Among them, the node weight represents the risk impact of the node on the entire system, the node threshold represents the maximum operation value allowed when a risk warning occurs for each node, and the path weight represents the influence relationship between the child node and the upper parent node, and the weight transfer direction of each path is constructed. The graph weight decision tree framework model is determined based on the above information, such as Figure 4 As shown in FIG. 1 , it is a schematic diagram of the graph weighted decision tree framework model in this embodiment. Of course, this embodiment is only an example and does not limit the specific form of the graph weighted decision tree framework model. Among them, the types of nodes in the graph weighted decision tree framework model include monitoring nodes, aggregation nodes and decision nodes. Figure 4 The square box "1.1.2 Low professional skills" is a monitoring node, the oval box "2.1 Business process defects" is a collection node, and the diamond box "Related impact analysis" is a decision node. Of course, in this implementation, the above is only used as an example, and the specific display form of the monitoring node, collection node and decision node is not limited.

[0039] It is worth mentioning that the monitoring node weight is divided into the weight of the conventional aggregation influence on the aggregation node and the weight of the extension influence on other nodes across the path, with the initial probability distribution weight of this node in the overall graph weight decision tree framework model. The aggregation node is the parent node of the monitoring node, and there is a path between the monitoring node and the monitoring node. The path weight represents the conventional attribute trajectory relationship and the closeness of the related influence between the monitoring node and the aggregation node. The path weight is divided into two categories: length and width: the length represents the strength of the influence transmission between the upper and lower nodes, and the width represents the closeness of the influence between the upper and lower nodes. The aggregation node also has the extension influence weight on the nodes on the cross-path, and the aggregation node is attached with the utility distribution mapping table of the secondary node and its subordinate nodes. The main meaning of the decision node is to express the weight decision of the correlation influence. The decision node is attached with the decision tree algorithm, which is generally divided into three types of weights: input, judgment and output: the input value is the critical warning value or trigger threshold of the relevant node; the judgment weight is divided into the input mapping relationship value of the influence degree, transmission degree and aggregation degree; the output weight is the selection mapping table value, which is usually defined as normal and abnormal.

[0040] Among them, when using the graph weight decision tree algorithm to initialize the question database portrait model, the specific method is to initialize the node weights, dependencies and relationship paths; based on the node weights and path weights, initially construct the weight decision function baseline, that is, the monitoring node threshold; build the weight transfer direction; initially construct the influence level baseline of each decision node, that is, the decision node threshold. This baseline is based on the changes in the key indicators monitored, and the influence relationship analysis and decision path transfer analysis are performed in the graph theory. As shown in Table 1 below, it is a panoramic diagram of the key indicators corresponding to the initialized graph weight decision tree framework model:

[0041] Table 1

[0042]

[0043]

[0044] Among them, the quantitative early warning indicators in Table 1 are equivalent to node thresholds, and also include information such as node weights, path weights, and weight transfer directions.

[0045] In this implementation, according to the operational risk graph database portrait model and the graph weight decision tree framework model obtained therefrom, during the operation of commercial banks, five types of matters and subsequent indicators are dynamically monitored. When the monitoring indicators change, there are response processes and weights respectively. Each risk is included in the graph model for overall qualitative and quantitative analysis. Then, according to the evolution path of each risk, the minimum impact path and the best response strategy are found in the graph to perform threshold-based early warning.

[0046] Step S130: Obtain an operation value of the target monitoring node, and determine the risk impact range of the target monitoring node using a graph pattern weighted distance evaluation algorithm based on the operation value of the target monitoring node.

[0047] Specifically, the monitoring and decision-making of operational risk items are actually item-driven. Through graph database modeling and profiling, operational risk items are abstracted in the form of graphs into indicators such as nodes, paths and node relationships, node (item) attributes and weights, path weights, and node relationship weights. Node attributes represent various items and item attributes in the operational risk field, such as "1 Human Factors", "1.1 Operation Errors", "1.1.1 Misoperation", etc. in Table 1. The business rules of the node are: Due to the subjective factors of personnel, the personnel quality is insufficient when handling bank services. For example, for the credit business process, the loan interest rate is input with a high value, resulting in an increase in customer fund risk and the occurrence of credit violation risks. Because the business process design is not reasonable, the above items are not avoided by internal audit. The 1.1.1 Misoperation node attribute in Table 1 carries the relevant business attribute values ​​of this business operation process. At the same time, the node attribute contains the monthly / quarterly statistics of the loss income caused by misoperation and the allowable loss threshold. When this threshold enters the warning value range, the relevant impact analysis is triggered. In the process of impact analysis, relevant attributes, node attributes, node relationships, path relationships and weights are all substituted into the deduction process. Therefore, the core idea of ​​this implementation method is to build an operational risk framework diagram database portrait model, according to the node attributes and path relationship rules, by reversely calculating the distance and weight, comprehensively monitoring and analyzing and estimating the changes in leaf node indicators, and through the scope and trend of the impact of the path on the root node weight, so as to control and mitigate the impact of operational risks on institutional operations.

[0048] Optionally, the risk impact range of the target monitoring node is determined based on the operation value of the target monitoring node using a graph pattern weight distance evaluation algorithm, including: when it is determined that the operation value is greater than the target monitoring node threshold and less than the first-level aggregation node threshold connected by the first-level path weight, the risk impact range of the target monitoring node is determined to be the first-level aggregation node of this path; when it is determined that the operation value is greater than the first-level aggregation node threshold, the risk impact range of the target monitoring node is determined through the decision nodes of this path.

[0049] Optionally, the risk impact range of the target monitoring node is determined through the decision nodes of this path, including: obtaining the attribute of the target monitoring node through the decision nodes of this path; judging whether the attribute is a specified attribute, and if so, crossing the path to the first adjacent path, and determining the risk impact range of the target monitoring node through the decision nodes of the first adjacent path; otherwise, determining the risk impact range of the target monitoring node as the secondary aggregation node connected by the secondary path weight.

[0050] Optionally, the risk impact range of the target monitoring node is determined through the decision nodes of the first adjacent path, including: obtaining the attribute of the target monitoring node through the decision nodes of the first adjacent path; judging whether the attribute is a specified attribute, and if so, crossing the path to the second adjacent path, and determining the risk impact range as the relevant nodes of the second adjacent path, wherein the relevant nodes of the second adjacent path include legal risks; otherwise, determining the risk impact range of the target monitoring node as the relevant nodes of the first adjacent path.

[0051] In a specific implementation, Figure 4 As shown, when the target monitoring node is the 1.1.1 misoperation node, and the misoperation weight specifically refers to the proportion of the impact of misoperation in the system risk, for example, 2%, the warning threshold corresponding to the misoperation node is 3, the 1.1 operation error can be called a first-level aggregation node, and the connection relationship between the 1.1.1 misoperation node and the 1.1 operation error node is called a first-level path weight, and the warning threshold corresponding to the 1.1 operation error node is 7. The misoperation value can be obtained by detecting the misoperation node. When the operation value is determined to be 4 misoperations, since the number of operation errors is greater than 3 but less than 7, the risk impact range of the 1.1.1 misoperation node is determined to be the 1.1 operation error node of this path.

[0052] In addition, the 1st human factor can be called the secondary aggregation node of this path, and the connection relationship between 1.1 operation error and 1st human factor is called the secondary path weight, and the warning threshold corresponding to the 1st human factor node is 9. When the operation value is determined to be 8 times of wrong operation, since it exceeds the warning threshold corresponding to the 1.1 operation error node, it will be judged through the decision node of this path. When the decision node is judging, it specifically obtains the attribute of the wrong operation node through the decision node, that is, whether the executor of the 8 wrong operations is an old employee or a new employee. Since the risk tolerance for new and old employees is different, and the requirements for old employees are more stringent, and the weight values ​​of the first-level paths used by new and old employees are different, when it is determined that the executor is an old employee, that is, the attribute is specified, it will cross the path to the first adjacent path, that is, the path corresponding to the 2.1 business process defect node, and judge through the decision node of the first adjacent path. When it is determined that the executor is not an old employee, the risk impact range of the 1.1.1 wrong operation node is determined to be 1st human factor of this path.

[0053] It should be noted that after crossing the path, the method of determining the risk impact range of the 1.1.1 misoperation node through the decision node of the first adjacent path is roughly the same as the method of determining the risk impact range of the current path, so it will not be repeated in this embodiment. And when the decision node of the first adjacent path is determining that it exceeds the relevant warning threshold of the first adjacent path and is a specified attribute, it will continue to cross the path to the second adjacent path. Otherwise, it will determine that the risk impact range of the 1.1.1 misoperation node is the relevant node of the first adjacent path, for example, 2 internal program nodes. Of course, this embodiment is only based on Figure 4 1.1.1 The misoperation node is used as an example of a target monitoring node, and the specific type of the target detection node is not limited in this implementation.

[0054] Step S140: determine the risk decision-making method according to the risk impact scope.

[0055] Optionally, the risk decision method is determined according to the risk impact scope, including: when the risk impact scope is determined to be the nodes of this path, the risk decision method is determined to be internal control on this path, wherein the nodes of this path include first-level aggregation nodes and second-level aggregation nodes; when the risk impact scope is determined to be the relevant nodes of the first adjacent path, the risk decision method is determined to be mitigation on the first adjacent path; when the risk impact scope is determined to be the relevant nodes of the second adjacent path, the risk decision method is determined to be business continuity assurance.

[0056] Specifically, Figure 4 As shown, when the impact scope of the 1.1.1 misoperation node is determined to be the node of this path, such as 1.1 operational error or 1 human factor, the risk decision method can be determined to be internal control in this path. When the risk impact scope is determined to be the relevant node of the first ringing path, for example, 2.1 business process defects or 2 internal procedures, the risk decision method is determined to be mitigation in the first ringing path. When the risk impact scope is determined to be the relevant node of the second adjacent path, for example, 5 legal risk, the risk decision method is determined to be business continuity assurance.

[0057] In this implementation, an operational risk graph database portrait model is constructed, and a graph weight decision tree algorithm is used to initialize the parameters of the nodes and paths in the graph database portrait model to obtain a graph weight decision tree framework model. When the operational value of the target monitoring node is obtained, the distance and weight are reversely calculated based on the node attributes and path relationships, and the changes in leaf node indicators are monitored and analyzed in a coordinated manner to determine the influence range of the target detection node. Based on the influence range, the decision-making method for controlling or mitigating operational risks is determined to achieve effective management and control of operational risks.

[0058] Embodiment 2

[0059] Figure 5 A flowchart of a decision-making method for operational risk provided in Embodiment 2 of the present invention. This embodiment is based on the above embodiment. After determining the risk decision-making method according to the risk impact range, it also includes: when the risk decision-making method is determined to be mitigation or business continuity guarantee, the graph weight decision tree framework model is backtracked to adjust the parameters of the nodes and paths. The method includes:

[0060] Step S210: Create a graph database portrait model that matches the operational risk framework based on graph database technology.

[0061] Optionally, a graph database portrait model matching the operational risk framework is created based on graph database technology, including: taking the operational risk framework as the root node and the key indicators as leaf nodes; connecting the root node and the leaf nodes using paths to obtain the graph database portrait model; wherein the key indicators include at least: employees, internal procedures, information technology systems, external events and legal risks.

[0062] Step S220: Use a graph weighted decision tree algorithm to initialize parameters of nodes and paths in the graph database portrait model to obtain a graph weighted decision tree framework model.

[0063] Optionally, a graph weighted decision tree algorithm is used to initialize parameters of nodes and paths in the graph database portrait model to obtain a graph weighted decision tree framework model, including: initializing the graph database portrait model using a graph weighted decision tree algorithm to determine the node weight and node threshold of each node, and the path weight of each path; constructing the weight transfer direction of each path; and determining the graph weighted decision tree framework model based on the node weight, node threshold, path weight, and weight transfer direction.

[0064] Step S230: Obtain the operation value of the target monitoring node, and determine the risk impact range of the target monitoring node using a graph pattern weighted distance evaluation algorithm based on the operation value of the target monitoring node.

[0065] Optionally, the risk impact range of the target monitoring node is determined based on the operation value of the target monitoring node using a graph pattern weight distance evaluation algorithm, including: when it is determined that the operation value is greater than the target monitoring node threshold and less than the first-level aggregation node threshold connected by the first-level path weight, the risk impact range of the target monitoring node is determined to be the first-level aggregation node of this path; when it is determined that the operation value is greater than the first-level aggregation node threshold, the risk impact range of the target monitoring node is determined through the decision nodes of this path.

[0066] Optionally, the risk impact range of the target monitoring node is determined through the decision nodes of this path, including: obtaining the attribute of the target monitoring node through the decision nodes of this path; judging whether the attribute is a specified attribute, and if so, crossing the path to the first adjacent path, and determining the risk impact range of the target monitoring node through the decision nodes of the first adjacent path; otherwise, determining the risk impact range of the target monitoring node as the secondary aggregation node connected by the secondary path weight.

[0067] Optionally, the risk impact range of the target monitoring node is determined through the decision nodes of the first adjacent path, including: obtaining the attribute of the target monitoring node through the decision nodes of the first adjacent path; judging whether the attribute is a specified attribute, and if so, crossing the path to the second adjacent path, and determining the risk impact range as the relevant nodes of the second adjacent path, wherein the relevant nodes of the second adjacent path include legal risks; otherwise, determining the risk impact range of the target monitoring node as the relevant nodes of the first adjacent path.

[0068] Step S240: When the risk decision mode is determined to be mitigation or business continuity assurance, the graph weight decision tree framework model is backtracked to adjust the parameters of the nodes and paths.

[0069] Specifically, in this implementation, when the risk decision mode is determined to be mitigation or business continuity assurance, it is determined that the target monitoring node has a greater risk impact on the business system. At this time, it is necessary to backtrack the graph weight decision tree framework model to adjust the parameters of the nodes and paths. For example, Figure 4 In the graph weight decision tree framework model shown, when it is determined that the impact range of the 1.1.1 erroneous operation node is 5 legal risks, and the corresponding risk decision-making method is business continuity assurance, the erroneous operation weight of the 1.1.1 erroneous operation node can be adjusted to 5% accordingly. Of course, this implementation is only an example and does not limit the specific value of the adjustment.

[0070] In this embodiment, by constructing an operational risk graph database portrait model, and using a graph weight decision tree algorithm to initialize the parameters of the nodes and paths in the graph database portrait model, a graph weight decision tree framework model is obtained. When the operation value of the target monitoring node is obtained, the distance and weight are reversely calculated according to the node attributes and path relationship, and the leaf node indicator changes are comprehensively monitored and analyzed to determine the influence range of the target detection node. According to the influence range, the decision-making method for controlling or mitigating operational risks is determined to achieve effective management and control of operational risks. And by adjusting the graph weight decision tree framework model, the management and control of operational risks can be further improved.

[0071] Embodiment 3

[0072] Figure 6 This is a schematic diagram of a decision-making device for operational risk provided by Embodiment 3 of the present invention. Figure 6 As shown, the device includes: a graph database portrait model creation module 510, a graph weight decision tree framework model acquisition module 520, a risk impact range determination module 530 and a risk decision method determination module 540.

[0073] A graph database portrait model creation module 510 is used to create a graph database portrait model that matches the operational risk framework based on graph database technology, wherein the nodes in the graph database portrait model represent key indicators in the operational risk framework, and the paths in the graph database portrait model represent the association relationship between the key indicators;

[0074] A graph weighted decision tree framework model acquisition module 520 is used to use a graph weighted decision tree algorithm to initialize parameters of nodes and paths in the graph database portrait model to acquire a graph weighted decision tree framework model, wherein the types of nodes in the graph weighted decision tree framework model include monitoring nodes, aggregation nodes, and decision nodes;

[0075] The risk impact range determination module 530 is used to obtain the operation value of the target monitoring node, and determine the risk impact range of the target monitoring node using a graph pattern weighted distance evaluation algorithm according to the operation value of the target monitoring node;

[0076] The risk decision-making method determination module 540 is used to determine the risk decision-making method according to the risk impact scope.

[0077] Optionally, a graph database portrait model creation module is used to use the operational risk framework as the root node and the key indicators as leaf nodes;

[0078] Connect the root node and leaf nodes using paths to obtain the graph database portrait model;

[0079] Among them, key indicators include at least: employees, internal procedures, information technology systems, external events and legal risks.

[0080] Optionally, a graph weight decision tree framework model acquisition module is used to initialize the graph database portrait model using a graph weight decision tree algorithm to determine the node weight and node threshold of each node, and the path weight of each path;

[0081] Construct the weight transfer direction of each path;

[0082] According to the node weight, node threshold, path weight and weight transfer direction, the graph weight decision tree framework model is determined.

[0083] Optional, risk impact scoping module, including:

[0084] The first determination submodule is used to determine the risk impact range of the target monitoring node as the first-level aggregation node of the path when the determined operation value is greater than the target monitoring node threshold and less than the first-level aggregation node threshold connected by the first-level path weight;

[0085] The second determination submodule is used to determine the risk impact range of the target monitoring node through the decision node of this path when the determined operation value is greater than the first-level aggregation node threshold.

[0086] Optionally, a second determination submodule is used to obtain the attributes of the target monitoring node through the decision node of this path;

[0087] Determine whether the attribute is a specified attribute. If so, cross the path to the first adjacent path and make a judgment through the decision node of the first adjacent path to determine the risk impact range of the target monitoring node;

[0088] Otherwise, the risk impact range of the target monitoring node is determined to be the secondary aggregation node connected by the secondary path weight.

[0089] Optionally, a second determination submodule is used to obtain the attribute of the target monitoring node through the decision node of the first adjacent path;

[0090] Determine whether the attribute is a designated attribute, if so, cross the path to the second adjacent path, and determine that the risk impact range is the relevant nodes of the second adjacent path, wherein the relevant nodes of the second adjacent path include legal risks;

[0091] Otherwise, the risk impact range of the target monitoring node is determined to be the relevant nodes of the first adjacent path.

[0092] Optionally, a risk decision mode determination module is used to determine the risk decision mode as internal control in the path when the risk impact range is determined to be a node of the path, wherein the node of the path includes a first-level aggregation node and a second-level aggregation node;

[0093] When the risk impact range is determined to be the relevant nodes of the first adjacent path, the risk decision method is determined to be mitigation on the first adjacent path;

[0094] When it is determined that the risk impact range is the relevant nodes of the second adjacent path, the risk decision mode is determined to be business continuity assurance.

[0095] Optionally, the device also includes an adjustment module for backtracking the graph weight decision tree framework model to adjust the parameters of the nodes and paths when the risk decision mode is determined to be mitigation or business continuity assurance.

[0096] The decision-making device for operational risk provided in the embodiment of the present invention can execute the decision-making method for operational risk provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0097] Embodiment 4

[0098] Figure 7 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0099] like Figure 7 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0100] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0101] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a decision-making method for operational risks.

[0102] In some embodiments, the decision-making method for operational risk may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the decision-making method for operational risk described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured as a decision-making method for operational risk in any other appropriate manner (e.g., by means of firmware).

[0103] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0104] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0105] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0106] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0107] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0108] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0109] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0110] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A decision-making method for operational risk, characterized in that: include: Creating a graph database portrait model that matches the operational risk framework based on graph database technology, wherein the nodes in the graph database portrait model represent key indicators in the operational risk framework, and the paths in the graph database portrait model represent the association relationships of the key indicators; A graph weighted decision tree algorithm is used to initialize parameters of nodes and paths in the graph database portrait model to obtain a graph weighted decision tree framework model, wherein the types of nodes in the graph weighted decision tree framework model include monitoring nodes, aggregation nodes, and decision nodes; Obtaining an operation value of a target monitoring node, and determining a risk impact range of the target monitoring node using a graph pattern weighted distance evaluation algorithm according to the operation value of the target monitoring node; Determine the risk decision-making method based on the risk impact scope; Wherein, determining the risk decision-making method according to the risk impact scope includes: When it is determined that the risk impact range is a node of this path, the risk decision-making method is determined to be internal control in this path, wherein the node of this path includes a first-level aggregation node and a second-level aggregation node; When it is determined that the risk impact range is the relevant nodes of the first adjacent path, the risk decision mode is determined to be mitigation on the first adjacent path; When it is determined that the risk impact range is the relevant nodes of the second adjacent path, the risk decision mode is determined to be business continuity assurance.

2. The method according to claim 1, characterized in that The graph database portrait model matching the operational risk framework is created based on the graph database technology, including: Taking the operational risk framework as a root node and the key indicators as leaf nodes; Connect the root node and the leaf node using a path to obtain the graph database portrait model; Among them, the key indicators include at least: employees, internal procedures, information technology systems, external events and legal risks.

3. The method according to claim 1, characterized in that The graph weight decision tree algorithm is used to initialize parameters of nodes and paths in the graph database portrait model to obtain a graph weight decision tree framework model, including: The graph database portrait model is initialized using a graph weight decision tree algorithm to determine the node weight and node threshold of each node, as well as the path weight of each path; Constructing the weight transfer direction of each of the paths; The graph weight decision tree framework model is determined according to the node weight, node threshold, path weight and weight transfer direction.

4. The method according to claim 3, characterized in that The step of determining the risk impact range of the target monitoring node by using a graph pattern weight distance evaluation algorithm according to the operation value of the target monitoring node includes: When it is determined that the operation value is greater than the target monitoring node threshold and less than the first-level aggregation node threshold connected by the first-level path weight, the risk impact range of the target monitoring node is determined to be the first-level aggregation node of this path; When it is determined that the operation value is greater than the first-level aggregation node threshold, the risk impact range of the target monitoring node is determined through the decision node of this path.

5. The method according to claim 4, characterized in that The decision nodes of this path are analyzed and judged to determine the risk impact range of the target monitoring node, including: Acquire the attribute of the target monitoring node through the decision node of this path; Determine whether the attribute is a specified attribute, and if so, cross the path to the first adjacent path, and determine the risk impact range of the target monitoring node through the decision node of the first adjacent path; Otherwise, the risk impact range of the target monitoring node is determined to be a secondary aggregation node connected by the secondary path weight.

6. The method according to claim 5, characterized in that The determining the risk impact range of the target monitoring node by analyzing and judging the decision node of the first adjacent path includes: Acquire the attribute of the target monitoring node through the decision node of the first adjacent path; Determine whether the attribute is a designated attribute, and if so, cross the path to a second adjacent path, and determine that the risk impact range is the relevant nodes of the second adjacent path, wherein the relevant nodes of the second adjacent path include legal risks; Otherwise, it is determined that the risk impact range of the target monitoring node is the relevant nodes of the first adjacent path.

7. The method according to claim 1, characterized in that After determining the risk decision-making method according to the risk impact scope, the method further includes: When it is determined that the risk decision mode is mitigation or business continuity assurance, the graph weight decision tree framework model is backtracked to adjust the parameters of the nodes and the paths.

8. A decision-making device for operational risk, characterized in that: include: A graph database portrait model creation module, used to create a graph database portrait model matching the operational risk framework based on graph database technology, wherein the nodes in the graph database portrait model represent key indicators in the operational risk framework, and the paths in the graph database portrait model represent the association relationships of the key indicators; A graph weighted decision tree framework model acquisition module is used to use a graph weighted decision tree algorithm to perform parameter initialization settings on the nodes and paths in the graph database portrait model to acquire a graph weighted decision tree framework model, wherein the types of nodes in the graph weighted decision tree framework model include monitoring nodes, aggregation nodes, and decision nodes; A risk impact range determination module is used to obtain an operation value of a target monitoring node, and determine the risk impact range of the target monitoring node using a graph pattern weighted distance evaluation algorithm according to the operation value of the target monitoring node; A risk decision-making method determination module is used to determine the risk decision-making method according to the risk impact scope; The risk decision mode determination module is specifically used to determine the risk decision mode as internal control in the path when the risk impact range is determined to be a node of the path, wherein the node of the path includes a first-level aggregation node and a second-level aggregation node; When the risk impact range is determined to be the relevant nodes of the first adjacent path, the risk decision method is determined to be mitigation on the first adjacent path; When it is determined that the risk impact range is the relevant nodes of the second adjacent path, the risk decision mode is determined to be business continuity assurance.

9. The device according to claim 8, characterized in that The graph database portrait model creation module is used to use the operational risk framework as a root node and the key indicators as leaf nodes; Based on the graph database portrait model, the root node and the leaf node are connected by a path to obtain the graph database portrait model; Among them, the key indicators include at least: employees, internal procedures, information technology systems, external events and legal risks.

10. The device according to claim 8, characterized in that The graph weight decision tree framework model acquisition module is used to initialize the graph database portrait model using a graph weight decision tree algorithm to determine the node weight and node threshold of each node, as well as the path weight of each path; Constructing the weight transfer direction of each of the paths; The graph weight decision tree framework model is determined according to the node weight, node threshold, path weight and weight transfer direction.

11. The device according to claim 8, characterized in that The device also includes an adjustment module, which is used to backtrack the graph weight decision tree framework model to adjust the parameters of the nodes and the paths when it is determined that the risk decision mode is mitigation or business continuity assurance.

12. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 7.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 7 when executed.

14. A computer program product, characterized in that The computer program product comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images