Risk processing method and device, electronic equipment and computer readable medium

Abstract

The invention discloses a risk processing method and device, electronic equipment and a computer readable medium, and relates to the technical field of big data processing, one specific embodiment comprises the steps of receiving a risk processing request, and obtaining corresponding operation and maintenance data and target environment data; extracting a target feature in the operation and maintenance data based on a preset dimension, and determining a weight corresponding to a tag corresponding to the target feature; labeling the operation and maintenance data on the basis of the weight to obtain each label corresponding to the operation and maintenance data; taking the risk occurrence judgment result as a dependent variable, taking each label as an independent variable, and performing logistic regression analysis based on the independent variable, the dependent variable and the target environment data to obtain the weight of the independent variable; and determining a target label based on the weight of the independent variable, determining a risk index according to the target label, generating risk prompt information based on the risk index, and outputting the risk prompt information to a risk processing node. Therefore, the efficiency and accuracy of processing risks possibly occurring in the operation and maintenance process are improved.

Description

Technical Field

[0001] The present application relates to the field of big data processing technology, and in particular to a risk management method, device, electronic device and computer-readable medium. Background Art

[0002] At present, with the rapid development of information technology, operation and maintenance risk management has become increasingly important. It may be necessary to evaluate and analyze the risks and violations that may occur during IT operation and maintenance with limited data. Since the systems and components involved in IT operation and maintenance are usually very complex, and the data samples may be limited by many factors, the efficiency and accuracy of risk handling that may occur during operation and maintenance are low. Summary of the invention

[0003] In view of this, the embodiments of the present application provide a risk management method, device, electronic device and computer-readable medium, which can solve the existing problems of low efficiency and poor accuracy in risk management that may occur during operation and maintenance.

[0004] To achieve the above-mentioned purpose, according to one aspect of an embodiment of the present application, a risk handling method is provided, including: receiving a risk handling request, obtaining corresponding operation and maintenance data and target environment data; extracting target features in the operation and maintenance data based on preset dimensions, and determining the weights corresponding to the labels corresponding to the target features; labeling the operation and maintenance data based on the weights to obtain the labels corresponding to the operation and maintenance data; taking the risk occurrence judgment result as the dependent variable and the labels as the independent variables, performing a logistic regression analysis based on the independent variables, the dependent variables and the target environment data to obtain the weights of the independent variables; determining the target label based on the weights of the independent variables, so as to determine the risk indicator according to the target label, generating risk warning information based on the risk indicator and outputting it to the risk handling node.

[0005] Optionally, target features in the operation and maintenance data are extracted based on preset dimensions, and weights corresponding to labels corresponding to the target features are determined, including: inputting the operation and maintenance data into a label annotation model so that the label annotation model scans the operation and maintenance data to generate target features according to the preset dimensions; calling model parameters of the label annotation model to obtain parameter values ​​corresponding to labels corresponding to each target feature in a target environment according to the target features; and determining the parameter values ​​as weights corresponding to the labels corresponding to the target features.

[0006] Optionally, the operation and maintenance data is labeled based on the weight to obtain labels corresponding to the operation and maintenance data, including: for each target feature, labeling the corresponding target feature with the label corresponding to the largest weight to obtain labels corresponding to the operation and maintenance data.

[0007] Optionally, the risk occurrence judgment result is a probability, and the probability range is between 0 and 1.

[0008] Optionally, determining the target label includes: determining a label corresponding to a weight of an independent variable greater than a preset threshold as the target label.

[0009] Optionally, the preset dimension is determined by: obtaining historical abnormal operation and maintenance data and operation status change data; determining the indicator dimension corresponding to the historical abnormal dimension data and the operation status change data, and determining the indicator dimension as the preset dimension.

[0010] In addition, the present application also provides a risk handling device, including: a receiving unit, configured to receive a risk handling request, and obtain corresponding operation and maintenance data and target environment data; a first weight determination unit, configured to extract target features in the operation and maintenance data based on preset dimensions, and determine the weights corresponding to the labels corresponding to the target features; a label determination unit, configured to label the operation and maintenance data based on the weights to obtain the labels corresponding to the operation and maintenance data; a second weight determination unit, configured to use the risk occurrence judgment result as the dependent variable, and each label as the independent variable, and perform a logistic regression analysis based on the independent variable, the dependent variable and the target environment data to obtain the weight of the independent variable; the risk handling unit, configured to determine the target label based on the weight of the independent variable, to determine the risk indicator according to the target label, generate risk warning information based on the risk indicator and output it to the risk handling node.

[0011] Optionally, the first weight determination unit is further configured to: input the operation and maintenance data into the label annotation model, so that the label annotation model scans the operation and maintenance data to generate target features according to preset dimensions; call the model parameters of the label annotation model to obtain parameter values ​​corresponding to the labels corresponding to each target feature in the target environment according to the target features; and determine the parameter value as the weight corresponding to the label corresponding to the target feature.

[0012] Optionally, the label determination unit is further configured to: for each target feature, label the corresponding target feature with the label corresponding to the largest weight, so as to obtain each label corresponding to the operation and maintenance data.

[0013] Optionally, the risk occurrence judgment result is a probability, and the probability range is between 0 and 1.

[0014] Optionally, the risk processing unit is further configured to: determine the label corresponding to the weight of the independent variable greater than a preset threshold as the target label.

[0015] Optionally, the preset dimension is determined by: obtaining historical abnormal operation and maintenance data and operation status change data; determining the indicator dimension corresponding to the historical abnormal dimension data and the operation status change data, and determining the indicator dimension as the preset dimension.

[0016] In addition, the present application also provides a risk management electronic device, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by one or more processors, the one or more processors implement the risk management method as described above.

[0017] In addition, the present application also provides a computer-readable medium on which a computer program is stored, and when the program is executed by a processor, the risk handling method as described above is implemented.

[0018] To achieve the above objective, according to another aspect of the embodiments of the present application, a computer program product is provided.

[0019] A computer program product according to an embodiment of the present application includes a computer program, and when the program is executed by a processor, the risk handling method provided by the embodiment of the present application is implemented.

[0020] One embodiment of the above invention has the following advantages or beneficial effects: the application receives a risk processing request to obtain the corresponding operation and maintenance data and target environment data; extracts the target features in the operation and maintenance data based on the preset dimensions, and determines the weights corresponding to the labels corresponding to the target features; labels the operation and maintenance data based on the weights to obtain the labels corresponding to the operation and maintenance data; uses the risk occurrence judgment result as the dependent variable, and each label as the independent variable, and performs a logistic regression analysis based on the independent variable, the dependent variable and the target environment data to obtain the weight of the independent variable; determines the target label based on the weight of the independent variable, determines the risk index according to the target label, generates risk warning information based on the risk index and outputs it to the risk processing node. This improves the efficiency and accuracy of handling risks that may occur during the operation and maintenance process.

[0021] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with specific implementation examples. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to better understand the present application and do not constitute an improper limitation on the present application.

[0023] Figure 1 is a schematic diagram of the main process of a risk handling method according to an embodiment of the present application;

[0024] Figure 2 is a schematic diagram of the main process of a risk handling method according to an embodiment of the present application;

[0025] Figure 3 It is a schematic diagram of the main process of a risk handling method according to an embodiment of the present application;

[0026] Figure 4 is a schematic diagram of the main units of the risk management device according to an embodiment of the present application;

[0027] Figure 5 is an exemplary system architecture diagram to which the embodiments of the present application can be applied;

[0028] Figure 6 It is a structural diagram of a computer system of a terminal device or server suitable for implementing an embodiment of the present application. DETAILED DESCRIPTION

[0029] The following is a description of the exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, and they should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. Similarly, for the sake of clarity and conciseness, the description of known functions and structures is omitted in the following description. It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of the present application are in compliance with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of the present application, certain software, components, models, and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or must have used the solution. In the technical solution of the present application, the collection, analysis, use, transmission, storage, and other aspects of the user's personal information involved are in compliance with the provisions of relevant laws and regulations, and are used for legal and reasonable purposes, and are not shared, leaked, or sold outside of these legal uses, and are subject to supervision and management by regulatory authorities. Take necessary measures to prevent illegal access to such personal information, ensure that persons with access to personal information comply with relevant laws and regulations, and ensure the security of personal information. Once such personal information is no longer needed, risks should be minimized by limiting or even prohibiting data collection and / or deleting data.

[0030] When used, including in certain related applications, user privacy is protected by de-identifying data, such as by removing specific identifiers when used, controlling the amount or specificity of data stored, controlling how data is stored, and / or other methods of de-identification.

[0031] Figure 1 is a schematic diagram of the main process of the risk handling method according to an embodiment of the present application, such as Figure 1As shown, the risk handling method mainly includes the following steps S101 to S105.

[0032] Step S101, receiving a risk handling request, and obtaining corresponding operation and maintenance data and target environment data.

[0033] In this embodiment, the execution subject of the risk handling method (for example, a server) can receive the risk handling request through a wired connection or a wireless connection. The risk handling request can be a request for timely discovery and response to risks that may occur during the operation and maintenance of the enterprise. After receiving the risk handling request, the execution subject can obtain the operation and maintenance data of the enterprise corresponding to the request and the current target environment data. The target environment data can be the current operation and maintenance environment data, for example, it can include device logs, performance data, interface data, etc.

[0034] Step S102: extract target features from the operation and maintenance data based on preset dimensions, and determine weights corresponding to labels corresponding to the target features.

[0035] Specifically, the preset dimension is determined by: acquiring historical abnormal operation and maintenance data and operation status change data; determining the indicator dimension corresponding to the historical abnormal dimension data and the operation status change data, and determining the indicator dimension as the preset dimension.

[0036] For example, the indicator dimensions corresponding to the historical abnormal operation and maintenance data and the indicator dimensions that have not triggered the monitoring threshold but have situation changes that may cause abnormalities can be determined as preset dimensions to improve the accuracy of the target features in the extracted operation and maintenance data and improve the accuracy of handling the corresponding risks.

[0037] After accurately determining the preset dimension, the target feature corresponding to the preset dimension can be extracted from the operation and maintenance data, and the label corresponding to the target feature can be the risk that may exist in the operation and maintenance data. After obtaining the target feature, the maximum entropy model is called to obtain the weight of the label corresponding to each target feature in the target environment data.

[0038] Step S103: label the operation and maintenance data based on the weights to obtain labels corresponding to the operation and maintenance data.

[0039] The larger the weight, the greater the possibility that the corresponding label is a risk. Label the operation and maintenance data according to the weight to obtain the labels corresponding to the operation and maintenance data.

[0040] Specifically, based on the weight, the operation and maintenance data is labeled to obtain the labels corresponding to the operation and maintenance data, including: for each target feature, the label corresponding to the largest weight is labeled to obtain the labels corresponding to the operation and maintenance data.

[0041] The label corresponding to the largest weight is the risk that may occur during the operation process. Labeling the target feature with the label corresponding to the largest weight can achieve the risk corresponding to the label of the target feature. The labels corresponding to the obtained operation and maintenance data are the most likely risks corresponding to the operation and maintenance data. This improves the accuracy of determining the labels corresponding to the operation and maintenance data (i.e., the corresponding risks).

[0042] Step S104, taking the risk occurrence judgment result as the dependent variable and each label as the independent variable, performing a logistic regression analysis based on the independent variable, the dependent variable and the target environment data to obtain the weight of the independent variable.

[0043] Specifically, the risk occurrence judgment result is a probability, and the probability range is between 0 and 1.

[0044] The result of the risk occurrence judgment can be, for example, 0.9, 0.5, etc., which is a probability, or can be "0" or "1", where "0" represents "no" and "1" represents "yes". As the labels of the independent variables, for example, "performance abnormality", "access abnormality", "service abnormality", etc., the logistic regression algorithm is calculated by combining the dependent variable "0" or "1" or any number between 0 and 1 and the independent variables "performance abnormality", "access abnormality", "service abnormality", etc. with the target environment data to obtain the weight of the independent variable. The weight of the independent variable indicates the contribution of the independent variable to the result of the dependent variable.

[0045] Step S105, based on the weight of the independent variable, determine the target label, determine the risk index according to the target label, generate risk warning information based on the risk index and output it to the risk processing node.

[0046] The greater the weight of the independent variable, the greater its contribution to the result of the corresponding dependent variable. The target label can be determined according to the weight of the independent variable.

[0047] Specifically, determining the target label includes: determining a label corresponding to the weight of the independent variable greater than a preset threshold as the target label.

[0048] The preset threshold can be a weight value derived by the user based on experience or a model that can be used to accurately distinguish operation and maintenance risks. The label corresponding to the weight of the independent variable greater than the preset threshold is determined as the target label, that is, the final risk corresponding to the operation and maintenance data is accurately determined.

[0049] This embodiment receives a risk processing request to obtain the corresponding operation and maintenance data and target environment data; extracts the target features in the operation and maintenance data based on the preset dimensions, and determines the weights corresponding to the labels corresponding to the target features; labels the operation and maintenance data based on the weights to obtain the labels corresponding to the operation and maintenance data; uses the risk occurrence judgment result as the dependent variable, and each label as the independent variable, and performs a logistic regression analysis based on the independent variable, the dependent variable and the target environment data to obtain the weight of the independent variable; determines the target label based on the weight of the independent variable, determines the risk index based on the target label, generates risk warning information based on the risk index and outputs it to the risk processing node. This improves the efficiency and accuracy of handling risks that may occur during the operation and maintenance process.

[0050] Figure 2 is a schematic diagram of the main flow of a risk handling method according to an embodiment of the present application, such as Figure 2 As shown, the risk handling method mainly includes the following steps S201 to S207.

[0051] Step S201, receiving a risk handling request, and obtaining corresponding operation and maintenance data and target environment data.

[0052] The execution subject may obtain the operation and maintenance data and target environment data corresponding to the operation and maintenance system identifier from the database based on the operation and maintenance system identifier carried in the risk handling request. The target environment data may be, for example, the current operation and maintenance environment data.

[0053] Step S202: input the operation and maintenance data into the label annotation model, so that the label annotation model scans the operation and maintenance data to generate target features according to preset dimensions.

[0054] The label annotation model, for example, may be a maximum entropy model, or may be a pre-trained model for characterizing the correspondence between operation and maintenance data and labels. The embodiment of the present application does not specifically limit the label annotation model. The label annotation model may scan the input operation and maintenance data to generate all possible features according to the features of the preset dimensions determined in the model training phase, that is, generate target features. The target features correspond to the risks that may exist in the operation and maintenance data.

[0055] Step S203, calling the model parameters of the label annotation model to obtain the parameter values ​​corresponding to the labels corresponding to each target feature in the target environment according to the target features.

[0056] The model parameters of the label annotation model can be the parameters corresponding to the model trained in the model training phase and can be used for accurate label annotation. The label annotation model and the trained model parameters are used to calculate the parameter values ​​(i.e., weights) corresponding to the labels (i.e., corresponding risks) of each target feature in the target environment corresponding to the target environment data.

[0057] Step S204: determining the parameter value as the weight corresponding to the label corresponding to the target feature.

[0058] The risk classification corresponding to the operation and maintenance data can be predicted by the weight corresponding to the label of the target feature.

[0059] By using the parameter value corresponding to the label of the target feature output by the label annotation model as the weight corresponding to the label of the target feature, the scientificity and accuracy of weight determination can be improved, and inaccurate weights caused by excessive subjective factors in the process of weight determination can be avoided.

[0060] Step S205: label the operation and maintenance data based on the weights to obtain labels corresponding to the operation and maintenance data.

[0061] The executing entity can sort the obtained weights, and label the corresponding operation and maintenance data with the labels corresponding to the first N weights in the sort, so as to obtain the labels corresponding to the operation and maintenance data, thereby labeling possible risks as much as possible to avoid omissions and ensure the accuracy of risk handling.

[0062] Step S206, taking the risk occurrence judgment result as the dependent variable and each label as the independent variable, performing a logistic regression analysis based on the independent variable, the dependent variable and the target environment data to obtain the weight of the independent variable.

[0063] Logistic regression analysis can provide an intuitive probabilistic explanation for the risk classification corresponding to the predicted operation and maintenance data so that the risk of the operation and maintenance data finally determined is more accurate.

[0064] Independent variables can be either continuous or categorical. For example, the dependent variable can be "whether performance is abnormal", and the corresponding independent variables can include "system configuration loss", "abnormal shutdown", "file damage", "blue screen", etc. Logistic regression analysis is performed based on independent variables, dependent variables and target environment data to obtain the weights of independent variables. That is, the weights of each independent variable that may lead to the results of the dependent variable are obtained to accurately find the risk inducement and facilitate timely response to the risk.

[0065] Step S207, based on the weight of the independent variable, determine the target label, determine the risk index according to the target label, generate risk warning information based on the risk index and output it to the risk processing node.

[0066] By determining the weight of the independent variable, it is possible to determine which risks are risk factors that lead to the results of the dependent variable (such as performance abnormalities), so as to find these risk factors, i.e., target labels, to determine risk indicators based on the target labels, generate risk warning information based on the risk indicators and output it to the risk processing node. The risk processing node can be a terminal corresponding to an offline risk processing personnel, or it can be a process node for automatically processing risks online. The embodiment of the present application does not specifically limit the risk processing node.

[0067] Figure 3 It is a main flow diagram of the risk handling method according to an embodiment of the present application. The risk handling method of the embodiment of the present application is from passive fault handling to active risk prevention, that is, processing from risk discovery to risk warning. Among them, the passive fault handling includes an algorithm analysis stage and a risk identification stage, wherein the algorithm analysis stage may include the calculation of the acquired operation and maintenance data based on the time series model ARIMA, the calculation based on the z-score, the calculation based on the maximum entropy model, the calculation based on the logistic regression model, the time series prediction, the time anomaly detection, etc., so as to empower the algorithm, mine the data value, and use the obtained algorithm analysis result data for risk identification, so as to obtain the success rate of Luban tasks, storage utilization rate, business transaction volume trend, business transaction duration trend, Luban task time consumption trend and CPU utilization trend. In order to achieve the construction of accurate and effective risk identification models for different data using a variety of machine learning algorithms. Make full use of massive operation and maintenance data to actively discover some anomalies and potential problems.

[0068] Operation and maintenance risk compliance refers to real-time monitoring and recording of operation and maintenance operations to ensure that the operations and data of operation and maintenance personnel comply with safety regulations, and to solve problems or make predictions in a timely manner. The risk library refers to the existing risk scenario management center of the Export-Import Bank of China, which can set the level and score value of risk scenarios. Risk disposal refers to the judgment of suspected illegal data, which does not include special approval, whitelist and other data to prevent misjudgment.

[0069] The maximum entropy-Logistic risk probability prediction model is adopted. The maximum entropy principle is a criterion for probability model learning. Entropy is an indicator to measure the uncertainty of random variables. The larger the entropy, the greater the uncertainty of random variables. In the maximum entropy model, the model P(y|x) is estimated by maximizing the entropy of conditional probability. The Logistic regression model is adopted. Logistic regression is a probability classification model. The model parameters are estimated by maximizing the likelihood function to obtain the conditional probability distribution P(y|x). For binary classification tasks, its conditional probability distribution has a specific form.

[0070] The construction of operation and maintenance risk compliance is an important part of digital operation and maintenance construction. The main content is to build an operation and maintenance risk control model based on data such as change instructions and operation plans, realize timely perception of risks such as operation and maintenance operations and major changes, and effectively control the risks of operation and maintenance operations. The system construction evaluates the standardization and danger of the operation and maintenance personnel in the operation and maintenance process. On the one hand, a unified control mechanism for sensitive commands is established to strengthen risk monitoring and security control of operation and maintenance operations, and improve the automation level of operation and maintenance authority management; on the other hand, the existing operation and maintenance system is connected to realize the security control of high-risk commands in the operation and maintenance process, and realize the pre-monitoring and early warning of operation and maintenance operations. Operation and maintenance risk compliance follows standard data design specifications, and interconnects data based on data integration platforms and operation and maintenance tools and other systems to realize real-time collection and sharing of automation data, ECC access control data, ITSM data, inspection data, bastion host data, face recognition system data, etc., and customize risk compliance scenarios according to actual needs. The data integration platform collects source system data such as ECC access control, ITSM, automation, bastion host, and performs data processing, cleaning, conversion, etc. for extraction of operation and maintenance risk compliance scenarios. In the operation and maintenance risk compliance scenario, the extracted data is analyzed according to the risk rules, and the result data is displayed in a list. At the same time, the report platform can extract data from the data integration platform, perform risk distribution statistics, display monthly and weekly reports and other report statistics in the top ranking of departments, and support downloading reports. Risk rule customization supports customized development of risk rules in the data integration platform or operation and maintenance risk compliance scenario. Define rules to determine whether operation and maintenance operations, permission password data, and big data calculation results are compliant. Risk data display displays the violation data list to count daily violation data, and count the number of unprocessed violation data in real time for independent query by the operation and maintenance department and risk management department. Supports display of violation levels and differentiated classification of data. Supports providing rectification suggestions for violation data, and can urge relevant responsible persons to generate internal letters to remind relevant personnel to handle them. Supports the display of violation details and the export of violation data. Early warning of operation and maintenance risks, through modeling and analysis of massive historical operation and maintenance data, for some situations that have not triggered the monitoring threshold but have changed, which may cause abnormalities, the system prompts. Ultimately, the entire process of risk analysis-discovery-tracking is traceable, promoting the overall improvement of system operation stability. The current indicators of concern include foundation, application, and batch scheduling. Under small sample conditions, the maximum entropy model (i.e., the risk probability prediction model based on maximum entropy in the embodiment of this application) can handle problems with sparse data and large uncertainty, while the Logistic regression model can provide an intuitive probability explanation. The risk probability prediction model based on maximum entropy can achieve effective prediction of operation and maintenance risks to reduce potential violation risks.The combination of the maximum entropy model (i.e., the risk probability prediction model based on maximum entropy in the embodiment of the present application) and the logistic regression model can better adapt to the characteristics of small sample data, improve the robustness and accuracy of the prediction, and promptly discover and respond to potential risks.

[0071] Figure 4 Schematic diagram of the main units of the risk management device according to an embodiment of the present application. Figure 4 As shown, the risk processing device 400 includes a receiving unit 401 , a first weight determination unit 402 , a label determination unit 403 , a second weight determination unit 404 and a risk processing unit 405 .

[0072] The receiving unit 401 is configured to receive a risk handling request and obtain corresponding operation and maintenance data and target environment data.

[0073] A first weight determination unit 402 is configured to extract target features in the operation and maintenance data based on a preset dimension, and determine a weight corresponding to a label corresponding to the target feature;

[0074] The label determination unit 403 is configured to label the operation and maintenance data based on the weights to obtain labels corresponding to the operation and maintenance data.

[0075] The second weight determination unit 404 is configured to use the risk occurrence judgment result as the dependent variable and each label as the independent variable, and perform a logistic regression analysis based on the independent variable, the dependent variable and the target environment data to obtain the weight of the independent variable.

[0076] The risk processing unit 405 is configured to determine a target label based on the weight of the independent variable, determine a risk index according to the target label, generate risk warning information based on the risk index, and output the risk warning information to the risk processing node.

[0077] In some embodiments, the first weight determination unit 402 is further configured to: input the operation and maintenance data into the label annotation model so that the label annotation model scans the operation and maintenance data to generate target features according to preset dimensions; call the model parameters of the label annotation model to obtain parameter values ​​corresponding to the labels corresponding to each target feature in the target environment according to the target features; and determine the parameter value as the weight corresponding to the label corresponding to the target feature.

[0078] In some embodiments, the label determination unit 403 is further configured to: for each target feature, label the corresponding target feature with the label corresponding to the corresponding maximum weight, so as to obtain each label corresponding to the operation and maintenance data.

[0079] In some embodiments, the risk occurrence judgment result is a probability, and the probability range is between 0 and 1.

[0080] In some embodiments, the risk processing unit 405 is further configured to: determine the label corresponding to the weight of the independent variable greater than a preset threshold as the target label.

[0081] In some embodiments, the preset dimension is determined by: obtaining historical abnormal operation and maintenance data and operation status change data; determining the indicator dimension corresponding to the historical abnormal dimension data and the operation status change data, and determining the indicator dimension as the preset dimension.

[0082] It should be noted that the risk management method and risk management device of the present application have a corresponding relationship in terms of specific implementation contents, so the repeated contents will not be described again.

[0083] Figure 5 An exemplary system architecture 500 is shown to which the risk processing method or risk processing apparatus according to the embodiment of the present application can be applied.

[0084] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0085] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0086] The terminal devices 501 , 502 , and 503 may be various electronic devices having a risk processing screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0087] Server 505 can be a server that provides various services, such as a background management server that provides support for risk processing requests submitted by users using terminal devices 501, 502, and 503 (only as an example). The background management server can receive risk processing requests, obtain corresponding operation and maintenance data and target environment data; extract target features in the operation and maintenance data based on preset dimensions, and determine the weights corresponding to the labels corresponding to the target features; label the operation and maintenance data based on the weights to obtain the labels corresponding to the operation and maintenance data; use the risk occurrence judgment result as the dependent variable, and use the labels as independent variables, and perform logistic regression analysis based on the independent variables, dependent variables, and target environment data to obtain the weights of the independent variables; determine the target label based on the weight of the independent variable, so as to determine the risk index according to the target label, generate risk warning information based on the risk index, and output it to the risk processing node. This improves the efficiency and accuracy of handling risks that may occur during the operation and maintenance process.

[0088] It should be noted that the risk handling method provided in the embodiment of the present application is generally executed by the server 505 , and accordingly, the risk handling device is generally disposed in the server 505 .

[0089] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0090] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device suitable for implementing an embodiment of the present application. Figure 6 The terminal device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0091] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0092] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0093] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present application are executed.

[0094] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. Computer-readable storage media may include, for example, but are not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0095] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0096] The units involved in the embodiments described in the present application may be implemented by software or by hardware. The units described may also be set in a processor, for example, it may be described as: a processor includes a receiving unit, a first weight determination unit, a label determination unit, a second weight determination unit and a risk processing unit. The names of these units do not constitute limitations on the units themselves in some cases.

[0097] As another aspect, the present application also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs. When the above one or more programs are executed by a device, the device receives a risk processing request and obtains corresponding operation and maintenance data and target environment data; extracts target features in the operation and maintenance data based on preset dimensions, and determines the weights corresponding to the labels corresponding to the target features; based on the weights, labels the operation and maintenance data to obtain the labels corresponding to the operation and maintenance data; takes the risk occurrence judgment result as the dependent variable, takes the labels as the independent variables, and performs a logistic regression analysis based on the independent variables, the dependent variables and the target environment data to obtain the weights of the independent variables; based on the weights of the independent variables, determines the target label, determines the risk index according to the target label, generates risk warning information based on the risk index and outputs it to the risk processing node.

[0098] The computer program product of the present application includes a computer program, and when the computer program is executed by a processor, the risk handling method in the embodiment of the present application is implemented.

[0099] According to the technical solution of the embodiment of the present application, the efficiency and accuracy of handling risks that may arise during the operation and maintenance process can be improved.

[0100] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A risk management method, characterized in that: include: Receive risk processing requests and obtain corresponding operation and maintenance data and target environment data; Extracting target features from the operation and maintenance data based on preset dimensions, and determining weights corresponding to labels corresponding to the target features; Based on the weights, labeling the operation and maintenance data to obtain labels corresponding to the operation and maintenance data; Taking the risk occurrence judgment result as the dependent variable and each of the labels as the independent variable, performing a logistic regression analysis based on the independent variable, the dependent variable and the target environment data to obtain the weight of the independent variable; Based on the weight of the independent variable, a target label is determined, so as to determine a risk indicator according to the target label, and risk warning information is generated based on the risk indicator and output to a risk processing node.

2. The method according to claim 1, characterized in that The extracting target features from the operation and maintenance data based on the preset dimension and determining weights corresponding to labels corresponding to the target features include: Inputting the operation and maintenance data into a label annotation model so that the label annotation model scans the operation and maintenance data to generate target features according to preset dimensions; Calling the model parameters of the label annotation model to obtain parameter values ​​corresponding to the labels corresponding to the target features in the target environment according to the target features; The parameter value is determined as a weight corresponding to the label of the target feature.

3. The method according to claim 1, characterized in that The labeling of the operation and maintenance data based on the weight to obtain labels corresponding to the operation and maintenance data includes: For each target feature, the label corresponding to the largest weight is used to label the corresponding target feature, so as to obtain each label corresponding to the operation and maintenance data.

4. The method according to claim 1, characterized in that: The risk occurrence judgment result is a probability, and the range of the probability is between 0 and 1.

5. The method according to claim 1, characterized in that The determining of the target tag comprises: The label corresponding to the weight of the independent variable greater than the preset threshold is determined as the target label.

6. The method according to claim 1, characterized in that The preset dimension is determined in the following manner: Obtain historical abnormal operation and maintenance data and operation status change data; Determine the indicator dimension corresponding to the historical abnormal dimension data and the operating status change data, and determine the indicator dimension as a preset dimension.

7. A risk management device, characterized in that: Configured to: A receiving unit is configured to receive a risk processing request and obtain corresponding operation and maintenance data and target environment data; A first weight determination unit is configured to extract a target feature from the operation and maintenance data based on a preset dimension, and determine a weight corresponding to a label corresponding to the target feature; a label determination unit, configured to label the operation and maintenance data based on the weights to obtain labels corresponding to the operation and maintenance data; a second weight determination unit, configured to use the risk occurrence judgment result as a dependent variable, use the respective labels as independent variables, and perform a logistic regression analysis based on the independent variable, the dependent variable, and the target environment data to obtain a weight of the independent variable; The risk processing unit is configured to determine a target label based on the weight of the independent variable, determine a risk indicator according to the target label, generate risk warning information based on the risk indicator, and output the risk warning information to the risk processing node.

8. The device according to claim 7, characterized in that The first weight determination unit is further configured to: Inputting the operation and maintenance data into a label annotation model so that the label annotation model scans the operation and maintenance data to generate target features according to preset dimensions; Calling the model parameters of the label annotation model to obtain parameter values ​​corresponding to the labels corresponding to the target features in the target environment according to the target features; The parameter value is determined as a weight corresponding to the label of the target feature.

9. The device according to claim 7, characterized in that The label determination unit is further configured to: For each target feature, the label corresponding to the largest weight is used to label the corresponding target feature, so as to obtain each label corresponding to the operation and maintenance data.

10. The device according to claim 7, characterized in that The risk occurrence judgment result is a probability, and the range of the probability is between 0 and 1.

11. The device according to claim 7, characterized in that The risk processing unit is further configured to: The label corresponding to the weight of the independent variable greater than the preset threshold is determined as the target label.

12. The device according to claim 7, characterized in that The preset dimension is determined in the following manner: Obtain historical abnormal operation and maintenance data and operation status change data; Determine the indicator dimension corresponding to the historical abnormal dimension data and the operating status change data, and determine the indicator dimension as a preset dimension.

13. A risk management electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

14. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images