An enterprise risk intelligent control system and method based on data analysis technology

Abstract

The present invention discloses an enterprise risk intelligent control system and method based on data analysis technology, which relates to the technical field of risk control; the control method includes the following steps: classifying all risk assessment records in any risk assessment log, determining the risk characteristic indicators of each type of risk assessment record and the normal deviation range of each risk characteristic indicator; calculating the risk value of the risk assessment record and determining the risk threshold for judging that the risk assessment record is abnormal; analyzing the correlation between various types of data and setting several types of high-risk data; if high-risk data exists in the new risk assessment record, directly conduct a risk assessment on the new risk assessment record; if the obtained risk value exceeds the risk threshold, mark the new risk assessment record as abnormal; if in a certain risk assessment log, several consecutive risk assessment records are all marked as abnormal, then give a warning to the risk assessment log.

Description

Technical Field

[0001] The present invention relates to the technical field of risk control, and specifically to an intelligent enterprise risk control system and method based on data analysis technology. Background Art

[0002] Enterprise risk assessment is a process of identifying, analyzing, and evaluating potential risks faced by an enterprise and formulating countermeasures; its purpose is to search for and describe enterprise risks, evaluate the impact degree and risk value of various identified risks on the enterprise's goal achievement, etc.

[0003] Effective risk assessment can help enterprises prevent and reduce the impact of risks and ensure the continuous and stable operation of business; therefore, the timely discovery of enterprise risks is crucial for effective risk management and control; if the existence of enterprise risks cannot be discovered in a timely manner and the source of anomalies cannot be found in a timely manner, it may lead to continuous generation of risks for the enterprise in the future, causing a series of losses to the enterprise. Summary of the Invention

[0004] The purpose of the present invention is to provide an intelligent enterprise risk control system and method based on data analysis technology to solve the problems raised in the prior art.

[0005] To achieve the above purpose, the present invention provides the following technical solution: An intelligent enterprise risk control method based on data analysis technology, the control method includes the following steps:

[0006] Step S100: In the enterprise risk assessment system, generate corresponding risk assessment logs for the risk assessment of each enterprise; conduct a risk assessment for any enterprise every other unit cycle, and generate a risk assessment record in a risk assessment log for the process of the risk assessment; classify all risk assessment records in any risk assessment log, determine the risk characteristic indicators of each type of risk assessment record and the normal deviation range of each risk characteristic indicator;

[0007] Step S200: Construct a risk assessment model, obtain the deviation range between any risk assessment record and the corresponding risk characteristic indicator, and calculate the risk value of the risk assessment record; extract the risk values of all risk assessment records with anomalies, and determine the risk threshold for judging that a risk assessment record has an anomaly;

[0008] Step S300: Arbitrarily select a certain risk assessment log, obtain all the data stored in each risk assessment record therein, analyze the sources of various types of data, and obtain the correlation between various types of data; according to the anomaly situations of each risk assessment record and the correlation between various types of data, obtain the probability of various types of data having anomalies, and set several types of high-risk data;

[0009] Step S400: When there is a new risk assessment record generated in real time in a certain risk assessment log; if there is high-risk data in the new risk assessment record, directly conduct a risk assessment on the new risk assessment record; if the obtained risk value exceeds the risk threshold, mark the new risk assessment record as abnormal; if several consecutive risk assessment records in the certain risk assessment log are all marked as abnormal, then give a warning to the risk assessment log.

[0010] Further, step S100 includes the following steps:

[0011] Step S101: Obtain the i-th risk assessment record in a certain risk assessment log, and extract the data information stored in the i-th risk assessment record; obtain the data sources of all data information, classify all data information according to the data sources, and generate a data set of the i-th risk assessment record.

[0012] Step S102: Obtain the evaluation result in the i-th risk assessment record, compare the data type of the evaluation result with a certain type of data in the data set, and set a similarity threshold , where N i is the number of data categories in the i-th risk assessment record; if the obtained similarity is greater than the similarity threshold, then use the certain type of data as the characteristic data of the i-th risk assessment record, and use the type of data with the highest similarity as the risk characteristic index of the i-th risk assessment record; the risk assessment of the enterprise is carried out through one of the types of data, so setting the risk characteristic index only needs to find the data with the highest similarity to the evaluation result from the stored data.

[0013] Step S103: Select all risk assessment records with the same risk characteristic index as the i-th risk assessment record, and divide them into a normal record set and an abnormal record set according to whether there are abnormalities; set the offset of a certain risk assessment record on the risk characteristic index as P, and respectively extract the offsets of each risk assessment record in the normal record set and the abnormal record set, and obtain the normal offset range in the normal record set as (P 1 , P 2 ) and the abnormal offset range in the abnormal record set as (P 3 , P 4 ); if P 3 < P 2 , then obtain the error range as (P 3 , P 2 ).

[0014] Step S104: Continuously select a value P in ascending order of numerical value within the error range ’, count the number of risk assessment records with offsets in the range (P 3 , P ’ ) in the normal record set as M 3 , count the number of risk assessment records with offsets in the range (P ’ , P 4 ) in the abnormal record set as M 4 , until M 3 > M 12 - M 3 and M 4 > M 34 - M 4 , take the value P ’ as the characteristic offset of the divided normal record set and abnormal record set, and obtain the normal amplitude range of the risk characteristic index of the i-th risk assessment record as (0, P ’ );

[0015] When the offset range of the normal record set overlaps with the offset range of the abnormal record set, re-divide the overlapping range according to the distribution of the two record sets within the overlapping range, so that the offset evaluation range can be as accurate as possible.

[0016] Further, step S200 includes the following steps:

[0017] Step S201: Obtain the offset of the i-th risk assessment record in a certain risk assessment log as P i , obtain the normal amplitude range of the risk characteristic index of the i-th risk assessment record as (0, P ’ ), and construct a risk assessment model:

[0018]

[0019] Where N i is the number of data categories in the i-th risk assessment record, and a and b are constant coefficients; calculate the risk value of the i-th risk assessment record as F i ;

[0020] The evaluation of the risk value should take into account the offset of the risk characteristic index and the number of data affected by various types of data; based on the actual offset as the base value, the degree of offset effectively reflects the size of the risk value;

[0021] Step S202: Arbitrarily select several risk assessment records from each risk assessment log to train the risk assessment model, and obtain the risk values of each risk assessment record among the several risk assessment records; divide the several risk assessment records into a normal record set and an abnormal record set according to whether there are abnormalities, respectively obtain the risk value ranges of the normal record set and the abnormal record set, and determine the values of a and b such that the risk values of each risk assessment record in the normal record set are less than the risk values of each risk assessment record in the abnormal record set;

[0022] Step S203: Use the remaining risk assessment records as a test set and input them into the risk assessment model. If there is a risk assessment record in the normal record set whose risk value is greater than the risk value of a certain risk assessment record in the abnormal record set, then select several risk assessment records from the remaining risk assessment records to retrain the risk assessment model;

[0023] Step S204: Obtain the risk values of each risk assessment record among all the risk assessment records with abnormalities, and select the risk value with the smallest numerical value as the risk threshold for judging that a risk assessment record has an abnormality.

[0024] Further, step S300 includes the following steps:

[0025] Step S301: Obtain the data set of the i-th risk assessment record in a certain risk assessment log, and obtain the data sources of each type of data information in the data set; if the data source of a certain type of data information is the same as a type of data information in the data sets of the remaining arbitrary risk assessment records, then set the certain type of data information as derivative data, otherwise, set the certain type of data information as original data; obtain several derivative data sets and original data sets;

[0026] Step S302: Arbitrarily select a type of derivative data. When the data source of the derivative data is another type of derivative data, then obtain the data source of the other type of derivative data again until the data source is the original data, and generate the generation path of the derivative data; By obtaining the generation route of the derivative data, the relationship between various types of data can be most directly reflected, which is beneficial to the subsequent calculation of the correlation degree between various types of data;

[0027] Step S303: Obtain the risk characteristic indicators of the i-th risk assessment record in a certain risk assessment log, and obtain several generation paths for generating the risk characteristic indicators; set the number of paths of the several generation paths as L i , where the number of data types in the j-th generation path is H j , according to the formula:

[0028]

[0029] Among them, K a is the number of categories of the remaining data that is the same as the derivative data generated from the data of category a; the correlation degree G a between the data of category a and the risk characteristic index is calculated; L i -(K a ) reflects that among a number of generated paths, there are some paths where the initial data is different, but the intermediate derivative data is the same. This indicates that the generated derivative data is obtained through multiple types of initial data together. Then, these several paths are actually the same path and need to be excluded; H j then reflects the direct reflection degree between the data;

[0030] Step S304: Obtain the number of records with abnormal risk assessment records corresponding to the risk characteristic index in the enterprise risk assessment system, and obtain the abnormal proportion β of the risk characteristic index showing abnormality; set the abnormal proportion threshold β max . If β > β max , then select the category of data with the highest correlation degree with the risk characteristic index and set it as high-risk data.

[0031] Furthermore, step S400 includes the following steps:

[0032] Step S401: If it is set that a certain category of high-risk data is stored in the new risk assessment record, then input the new risk assessment record into the risk assessment model, and calculate the risk value F new of the new risk assessment record;

[0033] Step S402: Set the risk threshold for judging that the risk assessment record is abnormal as F max ; when F new > F max , then mark the new risk assessment record as abnormal;

[0034] Step S403: Obtain the risk assessment record closest to the generation time of the new risk assessment record in the risk assessment log corresponding to the new risk assessment record. If there is an abnormal mark in the closest risk assessment record, then give a warning to the risk assessment log.

[0035] In order to better implement the above method, an enterprise risk intelligent control system based on data analysis technology is also proposed. The control system includes a historical record analysis module, an enterprise risk analysis module, a risk data analysis module, and a risk real-time analysis module;

[0036] The historical record analysis module is used to generate corresponding risk assessment logs for the risk assessment of each enterprise in the enterprise risk assessment system; conduct a risk assessment for any enterprise every unit cycle, and generate a risk assessment record in the risk assessment log for the process of the risk assessment; classify all the risk assessment records in any risk assessment log, and determine the risk characteristic indicators of each type of risk assessment record and the normal deviation range of each risk characteristic indicator.

[0037] The enterprise risk analysis module is used to construct a risk assessment model, obtain the deviation range between any risk assessment record and the corresponding risk characteristic indicator, and calculate the risk value of the risk assessment record; extract the risk values of all risk assessment records with anomalies, and determine the risk threshold for judging that a risk assessment record has an anomaly.

[0038] The risk data analysis module is used to arbitrarily select a certain risk assessment log, obtain all the data stored in each risk assessment record therein, analyze the sources of various types of data, and obtain the relevance between various types of data; based on the anomaly conditions of each risk assessment record and the relevance between various types of data, obtain the probability of anomalies in various types of data, and set several types of high-risk data.

[0039] The risk real-time analysis module is used to generate a new risk assessment record in real time when there is a certain risk assessment log; if there is high-risk data in the new risk assessment record, directly conduct a risk assessment on the new risk assessment record; if the obtained risk value exceeds the risk threshold, mark the new risk assessment record as abnormal; if several consecutive risk assessment records in a certain risk assessment log are all marked as abnormal, then give a warning to the risk assessment log.

[0040] Further, the historical record analysis module includes an evaluation record setting unit and an evaluation record division unit;

[0041] The evaluation record setting unit is used to generate corresponding risk assessment logs for the risk assessment of each enterprise in the enterprise risk assessment system; conduct a risk assessment for any enterprise every unit cycle, and generate a risk assessment record in the risk assessment log for the process of the risk assessment; the evaluation record division unit is used to classify all the risk assessment records in any risk assessment log, and determine the risk characteristic indicators of each type of risk assessment record and the normal deviation range of each risk characteristic indicator.

[0042] Further, the enterprise risk analysis module includes an evaluation model analysis unit and a risk threshold setting unit;

[0043] The evaluation model analysis unit is used to construct a risk assessment model, obtain the deviation amplitude between any risk assessment record and the corresponding risk characteristic index, and calculate the risk value of the risk assessment record; the risk threshold setting unit is used to extract the risk values of all risk assessment records with anomalies and determine the risk threshold for judging that a risk assessment record has an anomaly.

[0044] Further, the enterprise risk analysis module includes an evaluation model analysis unit and a risk threshold setting unit;

[0045] The evaluation model analysis unit is used to construct a risk assessment model, obtain the deviation amplitude between any risk assessment record and the corresponding risk characteristic index, and calculate the risk value of the risk assessment record; the risk threshold setting unit is used to extract the risk values of all risk assessment records with anomalies and determine the risk threshold for judging that a risk assessment record has an anomaly.

[0046] Further, the risk data analysis module includes a data correlation evaluation unit and a data anomaly analysis unit;

[0047] The data correlation evaluation unit is used to arbitrarily select a certain risk assessment log, obtain all the data stored in each risk assessment record therein, analyze the sources of various types of data, and obtain the correlation between various types of data; the data anomaly analysis unit is used to obtain the probability of various types of data appearing abnormally according to the anomaly conditions of each risk assessment record and the correlation between various types of data, and set several types of high-risk data.

[0048] Further, the risk real-time analysis module includes a risk real-time evaluation unit and an anomaly marking analysis unit;

[0049] The risk real-time evaluation unit is used to generate a new risk assessment record in real time when there is a certain risk assessment log; if there is high-risk data in the new risk assessment record, directly conduct a risk assessment on the new risk assessment record; the anomaly marking analysis unit is used to mark the new risk assessment record as abnormal if the obtained risk value exceeds the risk threshold; if there are anomaly marks in several consecutive risk assessment records in the certain risk assessment log, then give a warning to the risk assessment log.

[0050] Compared with the prior art, the beneficial effects of the present invention are:

[0051] 1. By evaluating the risk value of an enterprise, the present invention realizes the effective management and risk control of the enterprise, discovers and reminds enterprises with anomalies in a timely manner, and ensures the normal operation of the enterprise;

[0052] 2. The present invention classifies risk assessment records based on the data stored in different risk assessment records and the risk characteristic indicators of the last risk assessment; and through different offsets, it can reasonably reflect the abnormal conditions of various risk assessment records.

[0053] 3. The present invention analyzes the correlation between various types of data to obtain the influence degree of various types of data on the final risk characteristic indicators; considers the situation where the same risk characteristic indicators continuously appear abnormally, screens out several types of high-risk data, and when the generated risk assessment record records high-risk data, directly conducts risk assessment, avoiding risks to the enterprise caused by high-risk data, being able to detect abnormalities in a timely manner and handle them, reducing the losses of the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a schematic diagram of the steps of an enterprise risk intelligent control method based on data analysis technology of the present invention;

[0055] Figure 2 It is a schematic diagram of the structure of an enterprise risk intelligent control system based on data analysis technology of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0056] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0057] Embodiment: As Figures 1 to 2 shown, the present invention provides an enterprise risk intelligent control method based on data analysis technology, and the control method includes the following steps:

[0058] Step S100: In an enterprise risk assessment system, generate corresponding risk assessment logs for the risk assessments of each enterprise; conduct a risk assessment on any enterprise every other unit cycle, and generate a risk assessment record in a risk assessment log for the process of the risk assessment; classify all the risk assessment records in any risk assessment log, determine the risk characteristic indicators of each type of risk assessment record and the normal offset range of each risk characteristic indicator;

[0059] Among them, step S100 includes the following steps:

[0060] Step S101: Obtain the i-th risk assessment record in a certain risk assessment log, and extract the data information stored in the i-th risk assessment record; obtain the data sources of all the data information, classify all the data information according to the data sources, and generate a data set of the i-th risk assessment record.

[0061] Step S102: Obtain the assessment result in the i-th risk assessment record, compare the data type of the assessment result with a certain type of data in the data set, and set a similarity threshold , where N i is the number of data categories in the i-th risk assessment record; if the obtained similarity is greater than the similarity threshold, then use the certain type of data as the characteristic data of the i-th risk assessment record, and use the type of data with the highest similarity as the risk characteristic index of the i-th risk assessment record.

[0062] Step S103: Select all the risk assessment records with the same risk characteristic index as the i-th risk assessment record, and divide them into a normal record set and an abnormal record set according to whether there are abnormalities; set the offset of a certain risk assessment record on the risk characteristic index as P, and respectively extract the offsets of each risk assessment record in the normal record set and the abnormal record set, and obtain the normal offset range in the normal record set as (P 1 , P 2 ), and the abnormal offset range in the abnormal record set as (P 3 , P 4 ); if P 3 < P 2 , then obtain the error range as (P 3 , P 2 ).

[0063] Step S104: Continuously select a value P in ascending order of numerical value within the error range ’ , and count the number of risk assessment records with offsets in the range (P 3 , P ’ ) in the normal record set as M 3 , and the number of risk assessment records with offsets in the range (P ’ , P 4 ) in the abnormal record set as M 4 , until M 3 > M 12 - M 3 and M 4 > M 34 - M 4 is satisfied, and use the value P ’ as the characteristic offset for dividing the normal record set and the abnormal record set, and obtain the normal amplitude range of the risk characteristic index of the i-th risk assessment record as (0, P’ )

[0064] Example: Set the normal offset range in the normal record set to (0, 20%), and the abnormal offset range in the abnormal record set to (15%, 50%); obtain the error range as (15%, 20%); select an offset of 17% from the error range. It is obtained that there are more offsets in the normal record set within the range of (15%, 17%), and there are more offsets in the abnormal record set within the range of (17%, 20%). Then, the offset of 17% is obtained as the characteristic offset, and the normal amplitude range of the risk characteristic index is obtained as (0, 17%);

[0065] Step S200: Construct a risk assessment model, obtain the offset amplitude between any risk assessment record and the corresponding risk characteristic index, and calculate the risk value of the risk assessment record; extract the risk values of all risk assessment records with anomalies, and determine the risk threshold for judging that a risk assessment record has an anomaly;

[0066] Among them, step S200 includes the following steps:

[0067] Step S201: Obtain that the offset of the i-th risk assessment record in a certain risk assessment log is P i , and obtain that the normal amplitude range of the risk characteristic index of the i-th risk assessment record is (0, P ’ ), and construct a risk assessment model:

[0068]

[0069] Among them, N i is the number of data categories in the i-th risk assessment record, and a and b are constant coefficients; calculate that the risk value of the i-th risk assessment record is F i ;

[0070] Example: Set the offset of the i-th risk assessment record to 10%, and the normal amplitude range to (0, 17%). The number of data categories in the i-th risk assessment record is 3, a = 50%, and b = 100. The obtained risk value is F i = 10%×(1 - 0.7×50%)×3 + 100 = 100.195;

[0071] Step S202: Arbitrarily select several risk assessment records from each risk assessment log, train the risk assessment model, and obtain the risk values of each risk assessment record among the several risk assessment records; divide the several risk assessment records into a normal record set and an abnormal record set according to whether there are abnormalities, respectively obtain the risk value ranges of the normal record set and the abnormal record set, and determine the values of a and b such that the risk values of each risk assessment record in the normal record set are all less than the risk values of each risk assessment record in the abnormal record set;

[0072] Step S203: Use the remaining risk assessment records as a test set and input them into the risk assessment model. If there is a risk assessment record in the normal record set whose risk value is greater than the risk value of a certain risk assessment record in the abnormal record set, then select several risk assessment records from the remaining risk assessment records to retrain the risk assessment model;

[0073] Step S204: Obtain the risk values of each risk assessment record among all the risk assessment records with abnormalities, and select the risk value with the smallest numerical value as the risk threshold for judging that a risk assessment record has an abnormality.

[0074] Step S300: Arbitrarily select a certain risk assessment log, obtain all the data stored in each risk assessment record therein, analyze the sources of various types of data, and obtain the relevance between various types of data; according to the abnormality conditions of each risk assessment record and the relevance between various types of data, obtain the probabilities of various types of data appearing abnormally, and set several types of high-risk data;

[0075] Among them, step S300 includes the following steps:

[0076] Step S301: Obtain the data set of the i-th risk assessment record in the certain risk assessment log, and obtain the data sources of each type of data information in the data set; if the data source of a certain type of data information is the same as a type of data information in the data sets of the remaining arbitrary risk assessment records, then set the certain type of data information as derivative data, otherwise, set the certain type of data information as original data; obtain several derivative data sets and original data sets;

[0077] Step S302: Arbitrarily select a type of derivative data. When the data source of the derivative data is another type of derivative data, then obtain the data source of the other type of derivative data again until the data source is the original data, and generate the generation path of the derivative data;

[0078] Step S303: Obtain the risk characteristic indicators of the i-th risk assessment record in the certain risk assessment log, and obtain several generation paths for generating the risk characteristic indicators; set the number of paths of the several generation paths as L i, where the number of data types in the j-th generation path is H j , according to the formula:

[0079]

[0080] where K a is the number of categories of the remaining data that is the same as the derivative data generated from the a-th type of data; calculate the correlation degree G between the a-th type of data and the risk characteristic index a ;

[0081] Example: The number of generation paths for generating the b-th type of data is 5. Among them, there are 3 paths in which different original data generate the same derivative data. Therefore, K a = 2, and the number of data types in each generation path is 3; calculate the correlation degree G = 1 / 3 × 1 / 3 × 5 = 5 / 9;

[0082] Step S304: Obtain the number of records with anomalies in the risk assessment records corresponding to the risk characteristic index in the enterprise risk assessment system, and obtain the anomaly ratio β of the risk characteristic index; set the anomaly ratio threshold β max , if β > β max , then select the type of data with the highest correlation degree with the risk characteristic index and set it as high-risk data.

[0083] Step S400: When there is a new risk assessment record generated in real time in a certain risk assessment log; if there is high-risk data in the new risk assessment record, directly perform a risk assessment on the new risk assessment record; if the obtained risk value exceeds the risk threshold, mark the new risk assessment record as abnormal; if several consecutive risk assessment records in a certain risk assessment log are all marked as abnormal, then give a warning to the risk assessment log;

[0084] Among them, step S400 includes the following steps:

[0085] Step S401: Set that when a certain type of high-risk data is stored in the new risk assessment record, input the new risk assessment record into a risk assessment model, and calculate the risk value F of the new risk assessment record new ;

[0086] Step S402: Set the risk threshold for determining that a risk assessment record is abnormal as F max ; when F new > F max , then mark the new risk assessment record as abnormal;

[0087] Step S403: Obtain the risk assessment record closest to the generation time of the new risk assessment record in the risk assessment log corresponding to the new risk assessment record. If there is an anomaly flag in the closest risk assessment record, give a warning to the risk assessment log.

[0088] An enterprise risk intelligent control system based on data analysis technology, the control system includes a historical record analysis module, an enterprise risk analysis module, a risk data analysis module, and a risk real-time analysis module;

[0089] The historical record analysis module is used to generate corresponding risk assessment logs for the risk assessments of each enterprise in the enterprise risk assessment system; conduct a risk assessment for any enterprise every unit cycle, and generate a risk assessment record in the risk assessment log for the process of the risk assessment; classify all the risk assessment records in any risk assessment log, and determine the risk characteristic indicators of each type of risk assessment record and the normal deviation range of each risk characteristic indicator.

[0090] The enterprise risk analysis module is used to build a risk assessment model, obtain the deviation range between any risk assessment record and the corresponding risk characteristic indicator, and calculate the risk value of the risk assessment record; extract the risk values of all risk assessment records with anomalies, and determine the risk threshold for judging that a risk assessment record has an anomaly.

[0091] The risk data analysis module is used to arbitrarily select a certain risk assessment log, obtain all the data stored in each risk assessment record therein, analyze the sources of various types of data, and obtain the correlation between various types of data; based on the anomaly conditions of each risk assessment record and the correlation between various types of data, obtain the probability of various types of data appearing abnormally, and set several types of high-risk data.

[0092] The risk real-time analysis module is used to generate a new risk assessment record in real time when there is a certain risk assessment log; if there is high-risk data in the new risk assessment record, directly conduct a risk assessment on the new risk assessment record; if the obtained risk value exceeds the risk threshold, mark the new risk assessment record as abnormal; if several consecutive risk assessment records in the certain risk assessment log are all marked as abnormal, give a warning to the risk assessment log.

[0093] Among them, the historical record analysis module includes an evaluation record setting unit and an evaluation record division unit;

[0094] The evaluation record setting unit is used to generate corresponding risk evaluation logs for the risk evaluation of each enterprise in the enterprise risk evaluation system; perform a risk evaluation on any enterprise every unit cycle, and generate a risk evaluation record in a risk evaluation log for the process of the risk evaluation; the evaluation record classification unit is used to classify all risk evaluation records in any risk evaluation log, and determine the risk characteristic indicators of each category of risk evaluation records and the normal deviation range of each risk characteristic indicator.

[0095] Among them, the enterprise risk analysis module includes an evaluation model analysis unit and a risk threshold setting unit;

[0096] The evaluation model analysis unit is used to construct a risk evaluation model, obtain the deviation range between any risk evaluation record and the corresponding risk characteristic indicator, and calculate the risk value of the risk evaluation record; the risk threshold setting unit is used to extract the risk values of all risk evaluation records with anomalies, and determine the risk threshold for judging that a risk evaluation record has an anomaly.

[0097] Among them, the risk data analysis module includes a data correlation evaluation unit and a data anomaly analysis unit;

[0098] The data correlation evaluation unit is used to arbitrarily select a certain risk evaluation log, obtain all the data stored in each risk evaluation record therein, analyze the sources of various types of data, and obtain the correlation between various types of data; the data anomaly analysis unit is used to obtain the probability of anomalies in various types of data according to the anomaly situations of each risk evaluation record and the correlation between various types of data, and set several categories of high-risk data.

[0099] Among them, the risk real-time analysis module includes a risk real-time evaluation unit and an anomaly marking analysis unit;

[0100] The risk real-time evaluation unit is used to generate a new risk evaluation record in real time when there is a certain risk evaluation log; if there is high-risk data in the new risk evaluation record, directly perform a risk evaluation on the new risk evaluation record; the anomaly marking analysis unit is used to mark the new risk evaluation record as an anomaly if the obtained risk value exceeds the risk threshold; if there are anomaly markings in several consecutive risk evaluation records in a certain risk evaluation log, then give a warning to the risk evaluation log.

[0101] It is obvious to those skilled in the art that the present invention is not limited to the details of the above-described exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-limiting. The scope of the present invention is defined by the appended claims rather than the above description. Therefore, all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be embraced within the present invention. Any reference signs in the claims should not be construed as limiting the claims involved.

Claims

1. An enterprise risk intelligent management and control method based on data analysis technology, characterized by: The control method comprises the following steps: Step S100: In the enterprise risk assessment system, a corresponding risk assessment log is generated for the risk assessment of each enterprise; a risk assessment is performed on any enterprise every unit period, and the risk assessment process is generated into a risk assessment record in the risk assessment log; all risk assessment records in any risk assessment log are classified, and the risk characteristic index of each type of risk assessment record and the normal deviation range of each risk characteristic index are determined; Step S200: construct a risk assessment model, obtain the deviation amplitude between any risk assessment record and the corresponding risk characteristic indicator, and calculate the risk value of the risk assessment record; extract the risk values ​​of all risk assessment records with abnormalities, and determine the risk threshold for judging whether the risk assessment record has abnormalities; Step S300: arbitrarily select a risk assessment log, obtain all data stored in each risk assessment record, analyze the source of each type of data, and obtain the correlation between each type of data; according to the abnormal situation of each risk assessment record and the correlation between each type of data, obtain the probability of abnormality of each type of data, and set several types of high-risk data; Step S400: when there is a risk assessment log, a new risk assessment record is generated in real time; if there is high-risk data in the new risk assessment record, the new risk assessment record is directly risk assessed; if the obtained risk value exceeds the risk threshold, the new risk assessment record is marked as abnormal; if there are several consecutive risk assessment records in the risk assessment log with abnormal marks, the risk assessment log is warned; The step S100 includes the following steps: Step S101: obtaining the ith risk assessment record in a certain risk assessment log, extracting the data information stored in the ith risk assessment record; obtaining the data source of all the data information, classifying all the data information according to the data source, and generating a data set for the ith risk assessment record; Step S102: Obtain the assessment result in the i-th risk assessment record, compare the data type of the assessment result with a certain type of data in the data set, and set a similarity threshold θ=1 / N i , where N i is the number of data categories in the i-th risk assessment record; if the obtained similarity is greater than the similarity threshold, the data of a certain category is used as the characteristic data of the i-th risk assessment record, and the data of the category with the highest similarity is used as the risk characteristic indicator of the i-th risk assessment record; Step S103: select all risk assessment records with the same risk characteristic index of the i-th risk assessment record, and divide them into a normal record set and an abnormal record set according to whether there is an abnormality; set the offset of a certain risk assessment record on the risk characteristic index as P, extract the offset of each risk assessment record in the normal record set and the abnormal record set respectively, and obtain the normal offset range in the normal record set as (P1, P2) and the abnormal offset range in the abnormal record set as (P3, P4); if P3<P2, then obtain the error range as (P3, P2); Step S104: Continuously select a value P from small to large in the error range. ’ , statistics in the normal record set offset is (P3,P ’ ) is M3, and the offset in the abnormal record set is (P ’ ,P4) is M4, until M3>M 12 -M3 and M4>M 34 -M4, the value P ’ As the characteristic offset of the normal record set and the abnormal record set, the normal amplitude range of the risk characteristic index of the risk characteristic index of the i-th risk assessment record is (0,P ’ ); The step S200 includes the following steps: Step S201: Obtain the offset of the i-th risk assessment record in the risk assessment log as P i , the normal range of the risk characteristic index of the i-th risk assessment record is (0,P ’ ), build a risk assessment model: Among them, N i is the number of data categories in the i-th risk assessment record, a and b are constant coefficients; the risk value of the i-th risk assessment record is calculated to be F i ; Step S202: arbitrarily select a number of risk assessment records in each risk assessment log, train the risk assessment model, and obtain the risk value of each risk assessment record in the number of risk assessment records; divide the number of risk assessment records into a normal record set and an abnormal record set according to whether there is an abnormality, obtain the risk value range of the normal record set and the abnormal record set respectively, and determine the values ​​of a and b, so that the risk value of each risk assessment record in the normal record set is less than the risk value of each risk assessment record in the abnormal record set; Step S203: The remaining risk assessment records are used as a test set and input into the risk assessment model. If the risk value of a risk assessment record in the normal record set is greater than the risk value of a risk assessment record in the abnormal record set, then a number of risk assessment records from the remaining risk assessment records are selected to retrain the risk assessment model. Step S204: Obtain the risk value of each risk assessment record in all risk assessment records with abnormalities, and select the risk value with the smallest value as the risk threshold for determining whether the risk assessment record has abnormalities; The step S300 includes the following steps: Step S301: Obtain a data set of the i-th risk assessment record in the risk assessment log, and obtain the data source of each type of data information in the data set; if the data source of a certain type of data information is the same as a type of data information in the data set of any other risk assessment record, then set the certain type of data information as derived data, otherwise, set the certain type of data information as original data; and obtain a plurality of derived data sets and original data sets; Step S302: arbitrarily selecting a type of derived data, when the data source of the derived data is another type of derived data, obtaining the data source of the other type of derived data again until the data source is the original data, thereby generating a generation path for the derived data; Step S303: Obtain the risk characteristic index of the i-th risk assessment record in the risk assessment log, and obtain a number of generation paths for generating the risk characteristic index; set the number of the generation paths to L. i , where the number of data types in the jth generation path is H j , according to the formula: Among them, K a is the number of categories of the remaining data that are the same as the derived data generated by the a-th data; the correlation degree G between the a-th data and the risk characteristic index is calculated a ; Step S304: Obtain the number of abnormal risk assessment records corresponding to the risk characteristic indicator in the enterprise risk assessment system, and obtain the abnormality ratio β of the abnormal risk characteristic indicator; set the abnormality ratio threshold β max , if β>β max , then select the data with the highest correlation with the risk characteristic indicator and set it as high-risk data; The step S400 includes the following steps: Step S401: When a certain type of high-risk data is stored in the new risk assessment record, the risk assessment model is input into the new risk assessment record to calculate the risk value F of the new risk assessment record. new ; Step S402: Setting the risk threshold for determining whether the risk assessment record is abnormal to F max When F new >F max , the new risk assessment record is marked as abnormal; Step S403: obtaining a risk assessment record in the risk assessment log corresponding to the new risk assessment record that is closest to the generation time of the new risk assessment record, and if there is an abnormal mark in the most recent risk assessment record, issuing a warning to the risk assessment log.

2. An enterprise risk intelligent management and control system, used to execute the enterprise risk intelligent management and control method based on data analysis technology according to claim 1, characterized in that: The management and control system includes a historical record analysis module, an enterprise risk analysis module, a risk data analysis module and a risk real-time analysis module; The historical record analysis module is used to generate corresponding risk assessment logs for risk assessment of each enterprise in the enterprise risk assessment system; Conduct a risk assessment on any enterprise every unit period, and generate a risk assessment record in the risk assessment log for the risk assessment process; Classify all risk assessment records in any risk assessment log, determine the risk characteristic indicators of each type of risk assessment record and the normal deviation range of each risk characteristic indicator; The enterprise risk analysis module is used to construct a risk assessment model, obtain the deviation between any risk assessment record and the corresponding risk characteristic indicator, and calculate the risk value of the risk assessment record; Extract the risk values ​​of all risk assessment records with abnormalities and determine the risk threshold for judging whether the risk assessment records have abnormalities; The risk data analysis module is used to select a risk assessment log at random, obtain all data stored in each risk assessment record, analyze the source of each type of data, and obtain the correlation between each type of data; according to the abnormal situation of each risk assessment record and the correlation between each type of data, obtain the probability of abnormality of each type of data, and set several types of high-risk data; The risk real-time analysis module is used to generate a new risk assessment record in real time when there is a risk assessment log; If there is high-risk data in the new risk assessment record, directly perform risk assessment on the new risk assessment record; If the obtained risk value exceeds the risk threshold, the new risk assessment record is marked as abnormal; If several consecutive risk assessment records in the risk assessment log have abnormal marks, a warning is issued for the risk assessment log.

3. The enterprise risk intelligent management and control system according to claim 2 is characterized by: The historical record analysis module includes an evaluation record setting unit and an evaluation record division unit; The assessment record setting unit is used to generate corresponding risk assessment logs for risk assessment of each enterprise in the enterprise risk assessment system; A risk assessment is conducted on any enterprise every unit period, and the risk assessment process is generated into a risk assessment record in the risk assessment log; the assessment record classification unit is used to classify all risk assessment records in any risk assessment log, determine the risk characteristic indicators of each type of risk assessment record and the normal deviation range of each risk characteristic indicator.

4. The enterprise risk intelligent management and control system according to claim 2 is characterized by: The enterprise risk analysis module includes an evaluation model analysis unit and a risk threshold setting unit; The assessment model analysis unit is used to construct a risk assessment model, obtain the deviation amplitude between any risk assessment record and the corresponding risk characteristic index, and calculate the risk value of the risk assessment record; The risk threshold setting unit is used to extract the risk values ​​of all risk assessment records with abnormalities and determine the risk threshold for judging whether the risk assessment records have abnormalities.

5. The enterprise risk intelligent management and control system according to claim 2 is characterized by: The risk data analysis module includes a data association assessment unit and a data anomaly analysis unit; The data association evaluation unit is used to arbitrarily select a risk assessment log, obtain all data stored in each risk assessment record therein, analyze the sources of various types of data, and obtain the association between various types of data; The data anomaly analysis unit is used to obtain the probability of anomalies in various types of data according to the anomalies of various risk assessment records and the correlation between various types of data, and set several types of high-risk data.

6. The enterprise risk intelligent management and control system according to claim 2 is characterized by: The real-time risk analysis module includes a real-time risk assessment unit and an abnormality mark analysis unit; The real-time risk assessment unit is used to generate a new risk assessment record in real time when there is a risk assessment log; If there is high-risk data in the new risk assessment record, directly perform risk assessment on the new risk assessment record; The abnormal marking analysis unit is used to mark the new risk assessment record as abnormal if the obtained risk value exceeds the risk threshold; If several consecutive risk assessment records in the risk assessment log have abnormal marks, a warning is issued for the risk assessment log.

Images