Threshold management method and system based on financial risk

Abstract

The invention relates to the field of threshold value management, and discloses a threshold value management method and system based on financial risks, which are used for solving the problems that data fluctuation is caused by system updating when a financial system is updated, and a previous safety threshold value is no longer representative, and comprises the following steps: collecting system fluctuation data in real time; the method comprises the following steps: acquiring a data fluctuation coefficient, setting an initial safety threshold value, performing first risk judgment, if the first risk judgment system state is abnormal, acquiring threshold value adjustment demand influence data, performing evaluation to obtain a threshold value adjustment demand index, performing safety threshold value adjustment judgment according to the threshold value adjustment demand index, and if the safety threshold value needs to be adjusted, performing second risk judgment. If the system state is abnormal, adjusting the safety threshold according to the threshold adjustment demand index to obtain an actual safety threshold, performing second risk judgment, and if the second risk judgment system state is abnormal, sending out safety early warning, thereby effectively reducing misjudgment caused by data fluctuation due to system update, and improving the accuracy of risk assessment.

Description

Technical Field

[0001] The present invention relates to the field of threshold management, and more specifically to a threshold management method and system based on financial risks. Background Art

[0002] The stability and security of the financial system are of great significance to the efficient operation of the entire financial industry. Financial systems usually involve complex transaction networks, sensitive customer data and high-value capital flows, and face multiple risks during their operation. Therefore, financial institutions usually set system monitoring thresholds to monitor the operating status in real time and detect faults to ensure system stability and business continuity.

[0003] Existing threshold management methods usually adopt a fixed static threshold mode, that is, fixed monitoring indicator thresholds are pre-set according to system performance and business needs. Once a situation exceeding the threshold is detected, an alarm is triggered or emergency measures are taken.

[0004] For example, the invention patent with publication number: CN114092222A discloses a method, device, equipment and medium for establishing a threshold model based on financial risk, including: grouping different financial institutions to determine at least two groups of financial institutions; removing heterogeneous data in the historical loss data of each group of financial institutions according to the anti-fraud model to form at least two groups of sample loss data; selecting the threshold of the threshold model according to each group of sample loss data to establish a threshold model corresponding to each group of financial institutions. The threshold can be selected according to the extreme scale interval of the sample loss data corresponding to each group of financial institutions, so as to reduce the threshold deviation of the threshold model corresponding to each group of financial institutions, and it can avoid heterogeneous data from being used to establish the threshold model when it is greater than the threshold, thereby improving the stability of the threshold model and reducing the model risk of the threshold model.

[0005] For example, the invention patent with the publication number CN118674554A discloses a financial risk monitoring system and monitoring method, including: data acquisition module: responsible for collecting financial market data, financial product information, and transaction behavior records from multiple channels in real time; risk assessment module: in-depth analysis of the collected data, calculation of risk value, conditional risk value, and stress test index; early warning module: according to the risk assessment results, set a threshold value, and when any risk indicator exceeds the preset threshold value, trigger the early warning mechanism and send an early warning signal to management personnel and relevant stakeholders; decision support module: using machine learning algorithms to analyze and learn historical data, and provide financial decision makers with data-driven decision suggestions. The system of the present invention works in collaboration with multiple modules, covering multiple aspects of real-time collection of financial market data, risk assessment, early warning, decision support, and report generation, and can comprehensively monitor and manage financial risks.

[0006] However, in the process of implementing the technical solution of the invention in the embodiments of the present application, the present application found that the above technology has at least the following technical problems: In the existing technology, as the scale of the financial system continues to expand and the technical complexity increases, the system needs to be updated in a timely manner to ensure that it meets the usage requirements. When the system is updated, data fluctuations usually occur. If the existing threshold management method is used, the data will be misjudged as a failure during normal fluctuations, thereby affecting business progress. Summary of the invention

[0007] In order to overcome the above-mentioned defects of the prior art, the present invention provides a threshold management method and system based on financial risk to solve the problems existing in the above-mentioned background technology.

[0008] To achieve the above object, the present invention provides the following technical solutions: A threshold management method based on financial risk includes the following steps: Step 1: Real-time collection of system fluctuation data, the fluctuation data includes resource utilization, performance indicators and transaction data, and the data fluctuation coefficient is obtained according to the fluctuation data evaluation; Step 2: Setting the initial safety threshold, and making the first risk judgment according to the data fluctuation coefficient and the initial safety threshold; Step 3: If the system state is normal in the first risk judgment, then continue the business processing and monitor the fluctuation data in real time; If the system state is abnormal in the first risk judgment, then collect the threshold adjustment demand impact data, the threshold adjustment demand impact data includes the fluctuation data in the system, data sensitivity and financial risk , evaluate the threshold adjustment demand data and obtain the threshold adjustment demand index; step 4: judge the security threshold adjustment according to the threshold adjustment demand index; step 5: if it is judged that the security threshold does not need to be adjusted, the current system state is abnormal and a security warning is issued; if it is judged that the security threshold needs to be adjusted, the security threshold is adjusted according to the threshold adjustment demand index to obtain the actual security threshold; step 6: make a second risk judgment based on the data fluctuation index and the actual security threshold. If the second risk judgment shows that the system state is normal, continue to process the business and monitor the fluctuation data in real time; if the second risk judgment shows that the system state is abnormal, a security warning is issued.

[0009] Preferably, the step of obtaining the data fluctuation coefficient according to the fluctuation data evaluation is as follows: collecting resource utilization in a detection window in real time, the resource utilization includes CPU utilization, memory utilization and network bandwidth utilization, and calculating the mean and standard deviation of CPU utilization, memory utilization and network bandwidth utilization in a detection window according to the resource utilization data of each sampling point, and calculating the resource utilization fluctuation degree; collecting the performance indicators of the system in a detection window in real time, the performance indicators include response time, throughput and error rate, and obtaining the performance fluctuation degree according to the performance indicator evaluation; collecting the number of real-time successful transactions in a detection window, obtaining the number of historical successful transactions in the previous detection window, and obtaining the transaction fluctuation degree according to the number of real-time successful transactions and the number of historical successful transactions; obtaining the data fluctuation coefficient according to the resource utilization fluctuation degree, the performance fluctuation degree and the transaction fluctuation degree, and the specific acquisition method is as follows: ; In the formula, Expressed as the data fluctuation coefficient, It is expressed as the degree of resource utilization fluctuation, Expressed as the degree of performance fluctuation, Expressed as the degree of trading volatility.

[0010] Preferably, the step of obtaining the degree of performance fluctuation is: screening out the maximum value of the response time and the minimum value of the response time in a detection window, calculating the average response time in a detection window, and obtaining the response time fluctuation according to the maximum value of the response time, the minimum value of the response time and the average response time; calculating the standard deviation of the throughput and the average value of the throughput in a detection window, and obtaining the throughput fluctuation according to the standard deviation of the throughput and the average value of the throughput; obtaining the error rate in the current detection window and the error rate in the previous detection window, and calculating the error rate fluctuation; and obtaining the degree of performance fluctuation according to the response time fluctuation, the throughput fluctuation and the error rate fluctuation evaluation.

[0011] Preferably, the first risk judgment step based on the data fluctuation coefficient and the initial safety threshold is: comparing the data fluctuation coefficient with the initial safety threshold; if the data fluctuation coefficient is less than the initial safety threshold, it is determined that the current data fluctuation is small and the system state is normal; if the data fluctuation coefficient is greater than or equal to the initial safety threshold, it is determined that the current data fluctuation is large and the system state is abnormal.

[0012] Preferably, the threshold adjustment demand index acquisition step is: using the random forest method to divide the data in the system into sensitive data and insensitive data, counting the total amount of data and the amount of sensitive data in the system, and calculating the data sensitivity coefficient; obtaining the number of other systems that the current system directly depends on, recorded as the number of dependent systems; obtaining the number of jumps from the current system to the deepest system, that is, the maximum level of the dependency chain, recorded as the dependency depth; obtaining the total number of interfaces between the current system and the dependent system, recorded as the number of interactive interfaces; evaluating the system dependency complexity according to the number of dependent systems, the dependency depth and the number of interactive interfaces, and the specific acquisition method is as follows: ; In the formula, Expressed as system dependency complexity, Expressed as the number of dependent systems, Expressed as dependency depth, It is expressed as the number of interactive interfaces; the number of database migrations and the total amount of migrated data are obtained, and the risk coefficient is obtained according to the number of database migrations, the total amount of migrated data and the complexity of system dependency assessment; the data fluctuation coefficient, the data sensitivity coefficient and the risk coefficient are normalized, and the threshold adjustment demand index is obtained according to the normalized data fluctuation coefficient, the data sensitivity coefficient and the risk coefficient. The specific acquisition method is as follows: ; In the formula, Expressed as the threshold adjustment demand index, Expressed as the data fluctuation coefficient, Expressed as data sensitivity coefficient, Expressed as the risk factor, , , Expressed as the weight coefficient of data volatility coefficient, data sensitivity coefficient and risk coefficient.

[0013] Preferably, the steps of using the random forest method to classify the data in the system into sensitive data and insensitive data are: collecting historical data samples of the system, the samples contain multiple records, for each sample, extracting features, manually marking these samples as sensitive data or non-sensitive data, and using the marked samples as data sets; numerating the sample features, using one-hot encoding for the classification features, and converting them into numerical vectors; normalizing the numerical features; constructing a random forest classifier to obtain multiple decision trees; dividing the marked data set into a training set and a test set, using the training set to train the random forest model, and after the training is completed, using the test set to evaluate the model performance; deploying the trained random forest model to the actual environment to classify new data samples in real time.

[0014] Preferably, the judgment step of adjusting the safety threshold according to the threshold adjustment requirement index is: comparing the threshold adjustment requirement index with the adjustment threshold; if the threshold adjustment requirement index is less than the adjustment threshold, it is determined that the current safety threshold does not need to be adjusted; if the threshold adjustment requirement index is greater than or equal to the adjustment threshold, it is determined that the current safety threshold needs to be adjusted.

[0015] Preferably, the step of adjusting the safety threshold according to the threshold adjustment demand index to obtain the actual safety threshold is: calculating the adjustment factor by ratio of the threshold adjustment demand index and the adjustment threshold; and calculating the actual safety threshold according to the adjustment factor and the initial safety threshold.

[0016] Preferably, the step of performing a second risk judgment based on the data fluctuation index and the actual safety threshold is: comparing the data fluctuation index with the actual safety threshold; if the data fluctuation index is smaller than the actual safety threshold, it is determined that the current data fluctuation is within a safe range and the system state is normal; if the data fluctuation index is larger than the initial safety threshold, it is determined that the current data fluctuation is large, exceeds the safety range, and the system state is abnormal.

[0017] Preferably, a threshold management system based on financial risk comprises: a fluctuation data analysis module, which is used to obtain system fluctuation data in real time, analyze the fluctuation data to obtain the data fluctuation coefficient, and transmit the data fluctuation coefficient to the first risk judgment module; the first risk judgment module, which is used to set the initial safety threshold, and make the first risk judgment according to the initial safety threshold and the data fluctuation coefficient, and transmit the judgment result to the fluctuation data acquisition module or the threshold adjustment demand module; the threshold adjustment demand module, which is used to collect the threshold adjustment demand impact data, and analyze the threshold adjustment demand impact data to obtain the threshold adjustment demand index, and transmit the threshold adjustment demand index to the early warning module or the threshold adjustment module; the threshold adjustment module, which is used to adjust the safety threshold according to the threshold adjustment demand index to obtain the actual safety threshold, and transmit the actual safety threshold to the second risk judgment module; the second risk judgment module, which is used to make the second risk judgment according to the actual safety threshold and the data fluctuation coefficient, and transmit the judgment result to the fluctuation data acquisition module or the early warning module; the early warning module, which is used to warn of the situation of large data fluctuation, and remind the relevant staff to perform system maintenance in time.

[0018] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: 1. Set the initial safety threshold and make the first risk judgment based on the data fluctuation coefficient and the initial safety threshold, which provides a clear benchmark to quickly identify potential abnormal situations. The initial safety threshold reflects the expected range of the system under normal conditions, while the data fluctuation coefficient integrates the dynamic changes of the current state of the system. By comparing the two, risk signals can be discovered in time at the beginning of system operation, reducing the possibility of misjudgment or missed judgment, and providing a reference for subsequent dynamic adjustments to ensure the efficiency and accuracy of risk assessment.

[0019] 2. If the system status is abnormal in the first risk judgment, the threshold adjustment demand impact data is collected. The threshold adjustment demand impact data includes the fluctuation data, data sensitivity and financial risks in the system. The threshold adjustment demand data is evaluated to obtain the threshold adjustment demand index. This method can provide accurate adjustment basis for abnormal situations. By comprehensively analyzing system fluctuations, data sensitivity and financial risks, the adjustment requirements of the security threshold in the current environment can be dynamically determined to avoid the risk of misjudgment caused by excessive or insufficient adjustment. This method not only improves the flexibility of threshold setting, but also enhances the system's adaptability to dynamically changing environments, while ensuring the security of sensitive data and financial services.

[0020] 3. If it is determined that the security threshold needs to be adjusted, the security threshold is adjusted according to the threshold adjustment demand index to obtain the actual security threshold. By adjusting the security threshold, the optimal point can be found between balancing the system sensitivity and the false alarm rate, which can avoid the normal operation being misjudged as abnormal due to the threshold being too strict, and prevent the real risk from being missed due to the threshold being too wide. This dynamic adjustment mechanism improves the flexibility and robustness of the system operation, especially in the face of complex financial business scenarios and sensitive data protection needs, and can more effectively ensure the security and stability of the system.

[0021] 4. A second risk assessment based on the data volatility index and the actual safety threshold can provide a more accurate risk assessment based on the latest system status and environmental conditions. After the threshold is adjusted, the actual safety threshold is more in line with the current dynamic needs. Combined with the data volatility index, it can significantly reduce misjudgments or missed judgments caused by the initial threshold mismatch, thereby improving the accuracy of risk assessment. This process ensures that the system can be flexibly adjusted in a real-time changing environment, while enhancing sensitivity to potential anomalies, which helps to promptly discover and respond to actual risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A flow chart of a threshold management method based on financial risk provided in an embodiment of the present application.

[0023] Figure 2 A structural diagram of a threshold management system based on financial risk provided in an embodiment of the present application.

[0024] Figure 3 Schematic diagram of performance indicator changes in the embodiments of the present application. DETAILED DESCRIPTION

[0025] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the present invention. In addition, the forms of the various structures recorded in the following embodiments are merely illustrative. The threshold management method and system based on financial risk involved in the present invention are not limited to the various structures recorded in the following embodiments. All other implementations obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] The present invention provides a threshold management method based on financial risk, such as Figure 1 As shown, the following steps are included: Step 1: Collect system fluctuation data in real time. The fluctuation data includes resource utilization, performance indicators, and transaction data, and obtain the data fluctuation coefficient based on the fluctuation data evaluation; In this embodiment, it should be specifically explained that the steps of obtaining the data fluctuation coefficient according to the fluctuation data evaluation are as follows: Real-time collection of resource utilization within a detection window. Resource utilization includes CPU utilization, memory utilization, and network bandwidth utilization. According to the resource utilization data of each sampling point, the mean and standard deviation of CPU utilization, memory utilization, and network bandwidth utilization within a detection window are calculated, and the degree of resource utilization fluctuation is calculated. The specific acquisition method is as follows: ; In the formula, It is expressed as the degree of resource utilization fluctuation, It is expressed as the standard deviation of CPU utilization within a detection window. It is expressed as the average value of CPU utilization within a detection window. It is expressed as the standard deviation of memory usage within a detection window. It is expressed as the mean value of memory usage within a detection window. It is expressed as the standard deviation of network bandwidth usage within a detection window. It is expressed as the average value of network bandwidth usage within a detection window; The performance indicators of the system within a detection window are collected in real time. The performance indicators include response time, throughput and error rate. The degree of performance fluctuation is evaluated based on the performance indicators. The response time refers to the time interval from the system receiving the request to the completion of returning the result. The throughput refers to the number of requests successfully processed by the system per unit time. The error rate refers to the ratio of the number of failed requests to the total number of requests per unit time. For example, the system has 5 sampling points in a detection window, and the performance indicators are recorded as shown in Table 1. Table 1 Performance indicators

[0027] As shown in Table 1, in a specific embodiment, the numerical changes of performance indicators are displayed through different dimensions. By analyzing the fluctuations of these indicators, abnormal components that do not conform to the normal performance mode can be identified, such as abnormal response delays or error rate changes. These fluctuations can also be used to evaluate the stability and reliability of the system under different load conditions. In the real-time monitoring solution of the financial trading system, analyzing the fluctuations of these indicators can effectively capture performance anomalies caused by system pressure or potential failures, thereby timely optimizing system operating parameters and ensuring the stability and continuity of the system.

[0028] Collect the number of successful real-time transactions in a detection window, obtain the number of successful historical transactions in the previous detection window, and obtain the transaction volatility based on the number of successful real-time transactions and the number of successful historical transactions. The specific acquisition method is as follows: ; In the formula, Expressed as trading volatility, Expressed as the number of successful transactions in real time, Expressed as the number of successful historical transactions; The data fluctuation coefficient is obtained based on the resource utilization fluctuation degree, performance fluctuation degree and transaction fluctuation degree. The specific method of obtaining it is as follows: ; In the formula, Expressed as the data fluctuation coefficient, It is expressed as the degree of resource utilization fluctuation, Expressed as the degree of performance fluctuation, Expressed as the degree of trading volatility.

[0029] In this embodiment, it should be specifically explained that the steps for obtaining the performance fluctuation degree are: Filter out the maximum and minimum response time in a detection window, calculate the average response time in a detection window, and obtain the response time fluctuation based on the maximum, minimum and average response time. The specific acquisition method is as follows: ; In the formula, Expressed as response time fluctuation, Expressed as the maximum value of the response time, Expressed as the minimum value of the response time, Expressed as the average response time, the range is divided by the mean to measure the relative fluctuation range of the response time; Calculate the standard deviation of the throughput and the average value of the throughput within a detection window, and obtain the throughput fluctuation based on the standard deviation of the throughput and the average value of the throughput. The specific acquisition method is as follows: ; In the formula, Expressed as throughput fluctuation, Expressed as the standard deviation of throughput, Expressed as the average value of throughput, the standard deviation is divided by the mean to measure the relative intensity of throughput fluctuations. It is more suitable for dynamic traffic fluctuation scenarios. Get the error rate in the current detection window and the error rate in the previous detection window, and calculate the error rate fluctuation. The specific acquisition method is as follows: ; In the formula, Expressed as error rate fluctuation, It is expressed as the error rate within the current detection window. Expressed as the error rate within the previous detection window; The degree of performance fluctuation is evaluated based on the response time fluctuation, throughput fluctuation, and error rate fluctuation. The specific method for obtaining the degree of performance fluctuation is as follows: ; In the formula, Expressed as the degree of performance fluctuation, Expressed as response time fluctuation, taking the logarithm of the response time fluctuation, limiting the impact of extreme values ​​on the results and avoiding over-exaggeration of extreme cases, Expressed as throughput fluctuation, It is expressed as error rate fluctuation, and the square root is used to smooth the error rate fluctuation range to reduce the impact of small fluctuations.

[0030] Step 2: Set the initial safety threshold and make the first risk judgment based on the data fluctuation coefficient and the initial safety threshold; In this embodiment, it should be specifically explained that the first risk judgment step based on the data fluctuation coefficient and the initial safety threshold is: The data fluctuation coefficient is compared with the initial safety threshold. If the data fluctuation coefficient is less than the initial safety threshold, it is determined that the current data fluctuation is small and the system status is normal; if the data fluctuation coefficient is greater than or equal to the initial safety threshold, it is determined that the current data fluctuation is large and the system status is abnormal.

[0031] Step 3: If the first risk judgment system status is normal, continue to process the business and monitor the fluctuation data in real time; if the first risk judgment system status is abnormal, collect the threshold adjustment demand impact data, which includes the fluctuation data, data sensitivity and financial risks in the system, evaluate the threshold adjustment demand data, and obtain the threshold adjustment demand index; In this embodiment, it should be specifically explained that the steps for obtaining the threshold adjustment requirement index are: Use the random forest method to divide the data in the system into sensitive data and insensitive data, count the total amount of data and the amount of sensitive data in the system, and calculate the data sensitivity coefficient. The specific acquisition method is as follows: ; In the formula, Expressed as data sensitivity coefficient, is the amount of sensitive data, is the total data quantity; Get the number of other systems that the current system directly depends on, recorded as the number of dependent systems. The number of dependent systems indicates the total number of other systems that the current system directly depends on, which reflects the degree of coupling between the system and the external environment. The more dependent systems there are, the more external systems the system needs to coordinate during operation, which increases potential failure points and complexity; get the number of jumps from the current system to the deepest system, that is, the maximum level of the dependency chain, recorded as the dependency depth. The dependency depth indicates the number of jumps from the current system to the deepest system in the dependency chain, reflecting the system's dependency hierarchy structure. The greater the dependency depth, the longer the dependency path of the system, and the higher the possibility of fault propagation during data flow or function call transmission. In addition, deep dependency chains may make it difficult to quickly locate and fix problems, increasing the difficulty of system maintenance and updating; get the total number of interfaces between the current system and dependent systems, recorded as the number of interactive interfaces. The number of interactive interfaces indicates the total number of all interfaces between the current system and dependent systems, which is a direct reflection of the complexity of communication and collaboration between systems. The more interfaces there are, the more complex the communication, data exchange, and protocol compatibility issues that the system needs to deal with, which may increase potential errors or performance bottlenecks. In addition, when updating or maintaining a system with a large number of interfaces, it may be necessary to coordinate the compatibility of more interfaces, further increasing the complexity; The system dependency complexity is evaluated based on the number of dependent systems, the depth of dependency relationships, and the number of interactive interfaces. The specific method of obtaining it is as follows: ; In the formula, Expressed as system dependency complexity, Expressed as the number of dependent systems, Expressed as dependency depth, It is expressed as the number of interactive interfaces. It should be noted that the number of dependent systems, the depth of dependency relations, and the number of interactive interfaces are all normalized to eliminate the influence of different parameter magnitudes; Obtain the number of database migrations and the total amount of migrated data. The specific method for obtaining the risk factor is as follows: ; In the formula, Expressed as the risk factor, Expressed as the number of database migrations, It is expressed as the total amount of migrated data. It is expressed as the system dependency complexity. It should be noted that the number of database migrations, the total amount of migrated data, and the system dependency complexity are all normalized to eliminate the impact of different parameter magnitudes; The data fluctuation coefficient, data sensitivity coefficient and risk coefficient are normalized, and the threshold adjustment demand index is obtained according to the normalized data fluctuation coefficient, data sensitivity coefficient and risk coefficient. The specific acquisition method is as follows: ; In the formula, Expressed as the threshold adjustment demand index, Expressed as the data fluctuation coefficient, during the system update, when it is detected that the fluctuation range of the system operation data has increased significantly, it is necessary to relax the safety threshold range accordingly to adapt to the dynamic changes of the system and reduce false alarms. This relationship reflects that the short-term performance fluctuations that may occur during the system update are normal and expected, while strict thresholds may lead to too many misjudgments and increase the burden on the operation and maintenance team. By relaxing the threshold, invalid alarms triggered by normal fluctuations can be avoided, ensuring that the monitoring system focuses resources on identifying real anomalies or failures, thereby improving operational efficiency, while providing greater fault tolerance for the smooth transition of the system. This adjustment is particularly applicable in the system's low-sensitivity data processing or controllable risk environment, and can effectively reduce unnecessary intervention and interruption. Expressed as a data sensitivity coefficient, when the data involved in the system is more sensitive, the security threshold range needs to be tightened to enhance the ability to detect potential anomalies and protect sensitive data. Data sensitivity reflects the importance of data and the degree of potential risk. Once leaked, tampered with or lost, it may cause serious consequences. Therefore, when processing highly sensitive data, even if normal fluctuations occur during system operation, it is necessary to control the security threshold more strictly and reduce the tolerance range to ensure that any abnormal behavior that may threaten data security can be quickly captured and responded to. Expressed as a risk factor, when the risk factor in the system is higher, stricter security thresholds are required to enhance the monitoring of potential risks and the detection of abnormal events. The risk factor reflects the potential impact that system operations may have on business and the market. In higher-risk scenarios, appropriately tightening the security threshold range can improve the sensitivity of monitoring, reduce the possibility of misjudgment or omission, and ensure that hidden dangers that affect business security can be quickly identified and responded to. Especially when it comes to core business processes (such as payment, trading, clearing) or high-risk market operations, strict threshold management helps reduce the probability of risk spread and provide decision makers with more accurate risk warning information. , , It is expressed as the weight coefficient of data volatility coefficient, data sensitivity coefficient and risk coefficient, and , , , The specific value is determined by professionals according to the actual situation, for example, , , It can be 0.1, 0.4, or 0.5.

[0032] In this embodiment, it should be specifically explained that the steps of using the random forest method to classify the data in the system into sensitive data and insensitive data are as follows: Collect historical data samples of the system. The samples contain multiple records, and each record can be in the form of fields, files, or records. For each sample, extract features, including field type (numeric, text, etc.), field length (such as string length), whether it conforms to a specific format (such as ID number or credit card number format), storage location (local or cloud), and access permission level (such as administrator permission or public permission). Then, manually label these samples as sensitive data or non-sensitive data, where sensitive data (labeled as 1) includes privacy or financial information such as ID number, transaction amount, account balance, etc., and non-sensitive data (labeled as 0) includes logs, cached data, and other information that does not contain privacy. The labeled samples are used as data sets; In order to adapt the data to the random forest model, the sample features are digitized. Use one-hot encoding for categorical features (such as field type and storage location) to convert them into numerical vectors; normalize numerical features (such as field length) and scale the values ​​to the range of [0, 1] to eliminate magnitude differences. This process ensures that the model can correctly understand the contribution of each feature while reducing the impact of high-magnitude features on model decisions; Numerical processing is the process of converting the original features of the sample into a numerical form acceptable to the random forest model. For categorical features (such as field type and storage location), one-hot encoding is often used to convert them into binary vectors to avoid misleading the model by the size order of the categorical information; for numerical features (such as field length), normalization is usually performed to scale the values ​​to the range of [0, 1] to eliminate the differences in the magnitude of different features; for Boolean features (such as whether they conform to a specific format), they are directly represented by 0 and 1. This process ensures that the model can correctly process all features and improve classification accuracy and efficiency.

[0033] Construct a random forest classifier to obtain multiple decision trees, and implement classification based on the integration of multiple decision trees. Random forest determines the final classification by voting on the results of each tree. Each decision tree is constructed by random feature selection and random sample sampling, and the best feature is selected based on the principle of maximizing information gain when splitting; Divide the labeled data set into a training set and a test set (e.g. 80% training set and 20% test set). Use the training set to train the random forest model and let the model learn the classification rules for sensitive data and non-sensitive data. After training, use the test set to evaluate the model performance and calculate indicators such as accuracy, precision, recall, and F1 score. Accuracy reflects the overall classification ability, precision and recall measure the correctness and coverage of the model's classification of sensitive data respectively, and the F1 score comprehensively evaluates the model performance; Deploy the trained random forest model to the actual environment to classify new data samples in real time. For each new data sample, extract its features and input them into the model, and output the data as sensitive data or non-sensitive data through the model. In actual applications, sensitive data can be marked, encrypted, or access rights can be restricted based on the classification results, thereby improving the data security of the system. At the same time, a more flexible processing strategy can be adopted for non-sensitive data to optimize the use of system resources.

[0034] Step 4: Determine the safety threshold adjustment based on the threshold adjustment demand index; In this embodiment, it should be specifically explained that the determination steps for adjusting the safety threshold according to the threshold adjustment requirement index are: The threshold adjustment requirement index is compared with the adjustment threshold. If the threshold adjustment requirement index is less than the adjustment threshold, it is determined that the current safety threshold does not need to be adjusted; if the threshold adjustment requirement index is greater than or equal to the adjustment threshold, it is determined that the current safety threshold needs to be adjusted.

[0035] Step 5: If it is determined that the safety threshold does not need to be adjusted, the current system state is abnormal and a safety warning is issued; if it is determined that the safety threshold needs to be adjusted, the safety threshold is adjusted according to the threshold adjustment demand index to obtain the actual safety threshold; In this embodiment, it should be specifically explained that the steps of adjusting the safety threshold according to the threshold adjustment requirement index to obtain the actual safety threshold are: The adjustment factor is calculated by calculating the ratio of the threshold adjustment demand index to the adjustment threshold. The specific method of obtaining the factor is as follows: ; In the formula, Expressed as the adjustment factor, Expressed as the threshold adjustment demand index, It is indicated as the adjustment threshold; The actual safety threshold is calculated based on the adjustment factor and the initial safety threshold. The specific method of obtaining it is as follows: ; In the formula, Represents the actual safety threshold, is represented as the initial safety threshold, Expressed as adjustment factor.

[0036] Step 6: Perform a second risk assessment based on the data fluctuation index and the actual safety threshold. If the system status is normal, continue business processing and monitor fluctuation data in real time. If the system status is abnormal, issue a safety warning.

[0037] In this embodiment, it should be specifically explained that the second risk judgment step based on the data fluctuation index and the actual safety threshold is: The data fluctuation index is compared with the actual safety threshold. If the data fluctuation index is less than the actual safety threshold, it is determined that the current data fluctuation is within the safety range and the system status is normal; if the data fluctuation index is greater than the initial safety threshold, it is determined that the current data fluctuation is large, exceeds the safety range, and the system status is abnormal.

[0038] In this embodiment, it is necessary to specifically explain that a threshold management system based on financial risk, such as Figure 2 As shown, the system includes: The fluctuation data analysis module is used to obtain the system fluctuation data in real time, analyze the fluctuation data to obtain the data fluctuation coefficient, and transmit the data fluctuation coefficient to the first risk judgment module; The first risk judgment module is used to set the initial safety threshold, and perform the first risk judgment based on the initial safety threshold and the data fluctuation coefficient, and transmit the judgment result to the fluctuation data acquisition module or the threshold adjustment requirement module; A threshold adjustment demand module is used to collect threshold adjustment demand impact data, analyze the threshold adjustment demand impact data to obtain a threshold adjustment demand index, and transmit the threshold adjustment demand index to the early warning module or the threshold adjustment module; A threshold adjustment module is used to adjust the safety threshold according to the threshold adjustment demand index to obtain the actual safety threshold, and transmit the actual safety threshold to the second risk judgment module; A second risk judgment module is used to make a second risk judgment based on the actual safety threshold and the data fluctuation coefficient, and transmit the judgment result to the fluctuation data acquisition module or the early warning module; The early warning module is used to issue early warnings for situations where data fluctuates significantly, and to remind relevant staff to perform system maintenance in a timely manner.

[0039] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0040] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A threshold management method based on financial risk, characterized in that: The following steps are involved: Step 1: Collect system fluctuation data in real time. The fluctuation data includes resource utilization, performance indicators, and transaction data. The data fluctuation coefficient is obtained based on the fluctuation data evaluation. Step 2: Set the initial safety threshold and make the first risk judgment based on the data fluctuation coefficient and the initial safety threshold; Step 3: If the first risk judgment system status is normal, continue to process the business and monitor the fluctuation data in real time; if the first risk judgment system status is abnormal, collect the threshold adjustment demand impact data, which includes the fluctuation data, data sensitivity and financial risks in the system, evaluate the threshold adjustment demand data, and obtain the threshold adjustment demand index; Step 4: Determine the safety threshold adjustment based on the threshold adjustment demand index; Step 5: If it is determined that the safety threshold does not need to be adjusted, the current system state is abnormal and a safety warning is issued; If it is determined that the safety threshold needs to be adjusted, the safety threshold is adjusted according to the threshold adjustment demand index to obtain the actual safety threshold; Step 6: Perform a second risk assessment based on the data fluctuation index and the actual safety threshold. If the system status is normal after the second risk assessment, continue to process the business and monitor the fluctuation data in real time. If the second risk assessment system status is abnormal, a safety warning will be issued.

2. A threshold management method based on financial risk according to claim 1, characterized in that: The step of obtaining the data fluctuation coefficient according to the fluctuation data evaluation is as follows: Real-time collection of resource utilization within a detection window, including CPU utilization, memory utilization, and network bandwidth utilization. Based on the resource utilization data of each sampling point, the mean and standard deviation of CPU utilization, memory utilization, and network bandwidth utilization within a detection window are calculated, and the degree of resource utilization fluctuation is calculated. Real-time collection of system performance indicators within a detection window, including response time, throughput, and error rate, and the degree of performance fluctuation is obtained based on performance indicator evaluation; Collect the number of successful real-time transactions in a detection window, obtain the number of successful historical transactions in the previous detection window, and obtain the degree of transaction volatility based on the number of successful real-time transactions and the number of successful historical transactions; The data fluctuation coefficient is obtained based on the resource utilization fluctuation degree, performance fluctuation degree and transaction fluctuation degree. The specific method of obtaining it is as follows: ； In the formula, Expressed as the data fluctuation coefficient, Expressed as the degree of resource utilization fluctuation, Expressed as the degree of performance fluctuation, Expressed as the degree of trading volatility.

3. A threshold management method based on financial risk according to claim 2, characterized in that: The steps for obtaining the performance fluctuation degree are as follows: The maximum value and the minimum value of the response time in a detection window are screened out, and the average response time in a detection window is calculated. The response time fluctuation is obtained according to the maximum value, the minimum value and the average response time of the response time. Calculate the standard deviation of the throughput and the average value of the throughput within a detection window, and obtain the throughput fluctuation based on the standard deviation of the throughput and the average value of the throughput; Obtain the error rate in the current detection window and the error rate in the previous detection window, and calculate the error rate fluctuation; The degree of performance fluctuation is evaluated based on response time fluctuation, throughput fluctuation, and error rate fluctuation.

4. The method for managing financial risk based on a threshold value according to claim 1, characterized in that: The first step of risk judgment based on the data fluctuation coefficient and the initial safety threshold is: The data fluctuation coefficient is compared with the initial safety threshold. If the data fluctuation coefficient is less than the initial safety threshold, it is determined that the current data fluctuation is small and the system status is normal; if the data fluctuation coefficient is greater than or equal to the initial safety threshold, it is determined that the current data fluctuation is large and the system status is abnormal.

5. The method for managing financial risk based on a threshold value according to claim 1, characterized in that: The steps for obtaining the threshold adjustment demand index are as follows: Use the random forest method to divide the data in the system into sensitive data and non-sensitive data, count the total amount of data and the amount of sensitive data in the system, and calculate the data sensitivity coefficient; Get the number of other systems that the current system directly depends on, and record it as the number of dependent systems; Get the number of jumps from the current system to the deepest system, that is, the maximum level of the dependency chain, recorded as the dependency depth; get the total number of interfaces between the current system and the dependent system, recorded as the number of interactive interfaces; The system dependency complexity is evaluated based on the number of dependent systems, the depth of dependency relationships, and the number of interactive interfaces. The specific method of obtaining it is as follows: ； In the formula, Expressed as system dependency complexity, Expressed as the number of dependent systems, Expressed as dependency depth, It is expressed as the number of interactive interfaces; Obtain the number of database migrations and the total amount of migrated data, and evaluate the risk factor based on the number of database migrations, the total amount of migrated data, and the complexity of system dependencies; The data fluctuation coefficient, data sensitivity coefficient and risk coefficient are normalized, and the threshold adjustment demand index is obtained according to the normalized data fluctuation coefficient, data sensitivity coefficient and risk coefficient. The specific acquisition method is as follows: ； In the formula, Expressed as the threshold adjustment demand index, Expressed as the data fluctuation coefficient, Expressed as data sensitivity coefficient, Expressed as the risk factor, , , Expressed as the weight coefficient of data volatility coefficient, data sensitivity coefficient and risk coefficient.

6. A threshold management method based on financial risk according to claim 5, characterized in that: The steps of using the random forest method to divide the data in the system into sensitive data and insensitive data are as follows: Collect historical data samples of the system. The samples contain multiple records. For each sample, extract features and manually mark these samples as sensitive data or non-sensitive data. The marked samples are used as data sets. The sample features are digitized, and the categorical features are encoded using one-hot encoding to convert them into numerical vectors; the numerical features are normalized; Construct a random forest classifier and obtain multiple decision trees; Divide the labeled data set into a training set and a test set, use the training set to train the random forest model, and after the training is complete, use the test set to evaluate the model performance; Deploy the trained random forest model to the actual environment to classify new data samples in real time.

7. The method for managing financial risk based on a threshold value according to claim 1, characterized in that: The determination steps for adjusting the safety threshold according to the threshold adjustment requirement index are as follows: The threshold adjustment requirement index is compared with the adjustment threshold. If the threshold adjustment requirement index is less than the adjustment threshold, it is determined that the current safety threshold does not need to be adjusted. If the threshold adjustment requirement index is greater than or equal to the adjustment threshold, it is determined that the current safety threshold needs to be adjusted.

8. The method for managing financial risk based on a threshold value according to claim 1, characterized in that: The steps of adjusting the safety threshold according to the threshold adjustment requirement index to obtain the actual safety threshold are: The adjustment factor is obtained by calculating the ratio of the threshold adjustment demand index to the adjustment threshold; The actual safety threshold is calculated based on the adjustment factor and the initial safety threshold.

9. The method for managing financial risk based on a threshold value according to claim 1, characterized in that: The steps of performing the second risk judgment based on the data fluctuation index and the actual safety threshold are as follows: Compare the data fluctuation index with the actual safety threshold. If the data fluctuation index is less than the actual safety threshold, it is determined that the current data fluctuation is within the safety range and the system status is normal. If the data fluctuation index is greater than the initial safety threshold, it is determined that the current data fluctuation is large, exceeds the safety range, and the system status is abnormal.

10. A threshold management system based on financial risk, used to implement a threshold management method based on financial risk according to any one of claims 1 to 9, characterized in that: The system comprises: The fluctuation data analysis module is used to obtain the system fluctuation data in real time, analyze the fluctuation data to obtain the data fluctuation coefficient, and transmit the data fluctuation coefficient to the first risk judgment module; The first risk judgment module is used to set the initial safety threshold, and perform the first risk judgment based on the initial safety threshold and the data fluctuation coefficient, and transmit the judgment result to the fluctuation data acquisition module or the threshold adjustment requirement module; A threshold adjustment demand module is used to collect threshold adjustment demand impact data, analyze the threshold adjustment demand impact data to obtain a threshold adjustment demand index, and transmit the threshold adjustment demand index to the early warning module or the threshold adjustment module; A threshold adjustment module is used to adjust the safety threshold according to the threshold adjustment demand index to obtain the actual safety threshold, and transmit the actual safety threshold to the second risk judgment module; A second risk judgment module is used to make a second risk judgment based on the actual safety threshold and the data fluctuation coefficient, and transmit the judgment result to the fluctuation data acquisition module or the early warning module; The early warning module is used to issue early warnings for situations where data fluctuates greatly, and to remind relevant staff to perform system maintenance in a timely manner.

Images