A method, system, electronic device and storage medium for intelligent classification of electronic archives

Abstract

A method, system, electronic device and storage medium for intelligent classification of electronic archives, relating to the field of data processing technology. The method comprises: obtaining electronic document information of a target enterprise; extracting document features corresponding to multiple first documents from the electronic document information, the document features including the frequency of sensitive words, departmental relevance and document circulation range; performing rule matching on each document feature, determining the rule triggering result of each first document, and calculating the rule triggering density of each first document; screening out multiple second documents whose rule triggering density is greater than a threshold; constructing a risk transmission chain network according to the document features and rule triggering results of each second document, and calculating the transmission risk value corresponding to each second document based on the risk transmission chain network; classifying each second document in combination with each transmission risk value and storing it in the document library of the target enterprise. The technical solution provided by the present application is implemented to achieve the effect of improving the accuracy of intelligent classification of electronic archives.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an electronic archive intelligent classification method, system, electronic device and storage medium. Background Art

[0002] With the rapid development of information technology, the number of internal documents in enterprises has increased dramatically, and effective document management systems have become a key component in the construction of enterprise informatization. The main task of these systems is to help enterprises store, retrieve, manage and protect document information to support daily operations and decision-making.

[0003] At present, the existing electronic archive intelligent classification methods mainly classify electronic archives according to the document categories identified and matched by semantic recognition and matching of keyword contents in electronic archives. However, in practical applications, the existing method of classifying electronic archives according to document categories mainly focuses on the shallow analysis of document categories, and it is difficult to comprehensively consider various factors in electronic archives, which makes it easy to ignore the potential risks of enterprises reflected in electronic archives, reducing the accuracy of intelligent classification of electronic archives. Summary of the invention

[0004] The present application provides a method, system, electronic device and storage medium for intelligent classification of electronic archives, which can improve the accuracy of intelligent classification of electronic archives.

[0005] In a first aspect, the present application provides a method for intelligently classifying electronic archives, comprising:

[0006] Obtain electronic document information of the target enterprise;

[0007] Extracting document features corresponding to the plurality of first documents from the electronic document information, the document features including sensitive word frequency, department relevance, and document circulation scope;

[0008] Performing rule matching on each of the document features, determining a rule triggering result of each of the first documents, the rule triggering result including the rule triggering times and the triggering strength, and calculating a rule triggering density corresponding to the rule triggering result of each of the first documents;

[0009] Filter out a plurality of first documents whose rule triggering density is greater than a threshold value as second documents respectively;

[0010] Constructing a risk transmission chain network according to the document features and rule triggering results of each of the second documents, and calculating a transmission risk value corresponding to each of the second documents based on a plurality of document nodes and transmission paths in the risk transmission chain network;

[0011] The second documents are classified in combination with the conduction risk values, and the classified second documents are stored in the document library of the target enterprise.

[0012] In a second aspect of the present application, a system for a nutrition literature model training method is provided, the system comprising:

[0013] An information acquisition module is used to acquire electronic document information of the target enterprise;

[0014] A document feature extraction module, used to extract document features corresponding to the plurality of first documents from the electronic document information, wherein the document features include the frequency of sensitive words, the degree of departmental relevance, and the scope of document circulation;

[0015] A document screening module is used to perform rule matching on each of the document features, determine the rule triggering result of each of the first documents, the rule triggering result includes the rule triggering number and the triggering strength, and calculate the rule triggering density corresponding to the rule triggering result of each of the first documents; screen out a plurality of first documents whose rule triggering density is greater than a threshold value as the second documents respectively;

[0016] A document classification module is used to construct a risk transmission chain network according to the document characteristics and rule triggering results of each second document, and calculate the transmission risk value corresponding to each second document based on multiple document nodes and transmission paths in the risk transmission chain network; classify each second document in combination with each transmission risk value, and store the classified second documents in the document library of the target enterprise.

[0017] In a third aspect of the present application, an electronic device is provided, comprising a memory, a processor, and a program stored in the memory and executable on the processor, wherein the program can implement an intelligent classification method for electronic archives when loaded and executed by the processor.

[0018] In a fourth aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor implements a method for intelligent classification of electronic archives.

[0019] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0020] By adopting the above technical solution, the document characteristics such as the frequency of sensitive words, departmental relevance and document circulation scope of the document are extracted from the electronic archive information of the target enterprise, providing a comprehensive data basis for subsequent risk assessment. Secondly, by calculating the rule trigger density through rule matching, the preliminary screening of high-risk documents is realized, and the efficiency and accuracy of risk identification are improved. On this basis, by constructing a risk transmission chain network, not only the risk attributes of a single document are considered, but also the association relationship and risk transmission effect between documents are integrated, so that the risk assessment is more in line with the actual situation. By calculating the transmission risk value, the system can accurately quantify the influence of the document in the risk transmission network, providing a basis for risk classification. Finally, based on the classification storage mechanism of the transmission risk value, the enterprise can achieve differentiated management of documents of different risk levels. By introducing the dynamic evaluation mechanism of risk transmission, document classification is no longer limited to the characteristics of the document itself, but takes into account the risk association relationship and influence degree between documents, and classifies the electronic archive information in multiple layers, thereby improving the accuracy of intelligent classification of electronic archives. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flowchart of an electronic archive intelligent classification method provided by an embodiment of the present application;

[0022] Figure 2 It is a structural diagram of an electronic archive intelligent classification system provided by an embodiment of the present application;

[0023] Figure 3 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0024] Description of reference numerals: 300, electronic device; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0025] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0026] In the description of the embodiments of the present application, words such as "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "for example" or "for example" is intended to present related concepts in a specific way.

[0027] In the description of the embodiments of the present application, the meaning of the term "multiple" refers to two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0028] The present application embodiment provides a method for intelligent classification of electronic archives. In one embodiment, please refer to Figure 1 , Figure 1 This is a flow chart of the electronic archive intelligent classification method provided by the embodiment of the present application. The method can be implemented by a computer program, which can be integrated into an application or run as an independent tool application. The method can also be implemented by a single-chip microcomputer or run in an electronic archive intelligent classification system based on the von Neumann system. Specifically, the method can include the following steps:

[0029] Step 101: Obtain electronic document information of a target enterprise; extract document features corresponding to a plurality of first documents from the electronic document information, wherein the document features include sensitive word frequency, department relevance, and document circulation scope.

[0030] Electronic document information refers to the collection of various digital documents generated by the target enterprise in its daily operations. These electronic document information include but are not limited to the enterprise's business contracts, technical plans, R&D reports, financial statements, meeting minutes, internal notices, employee files and other digital documents and their metadata information. Document metadata includes basic attribute data such as the creation time, modification history, author information, storage location, access records, etc.

[0031] The document features corresponding to the first document refer to the key feature indicators extracted from the electronic document information, mainly including the quantitative indicators of three dimensions: sensitive word frequency, department relevance, and document circulation scope. Among them, the sensitive word frequency reflects the sensitivity of the document content, the department relevance reflects the scope of the document in the organizational structure, and the document circulation scope indicates the access control level of the document. The first document can be understood as all the documents included in the electronic archive information that have not yet been divided.

[0032] Specifically, it is necessary to first obtain the electronic document information of the target enterprise. The target enterprise usually has a large number of electronic documents, which are distributed in different departments and systems and contain various types of information on the operation of the enterprise. In order to realize the intelligent classification of these documents, the present invention first needs to establish a unified document acquisition mechanism, and batch acquire the electronic document information that needs to be classified through the document management system interface or document storage server of the enterprise. After obtaining the document information, the document features are extracted from three key dimensions. The first is the sensitive word frequency dimension. The system will pre-establish a preset sensitive word library containing relevant words such as commercial secrets, technical secrets, and personal privacy. For each document, the system uses a word segmentation algorithm to process the document content, count the frequency of sensitive words appearing in the document, and calculate the standardized sensitive word frequency index in combination with the total number of words in the document. This indicator can intuitively reflect the sensitivity of the document. Secondly, the department association dimension, the system will analyze the scope of departments involved in the document in combination with the organizational structure information of the enterprise. By extracting the department name, employee name and other information mentioned in the document, and according to the hierarchical relationship and business collaboration relationship between the departments in the organizational structure diagram, the association strength between the document and each department is calculated. This correlation strength takes into account not only the directly mentioned departments, but also the departments indirectly related due to business connections, thus forming a complete department correlation index. The third dimension is the document circulation scope. The system obtains the access permission settings for each document by analyzing the company's document access control system. The document circulation scope index is calculated based on the ratio of the number of employees who can access the document to the total number of employees in the company. This indicator reflects the degree of publicity of the document. The smaller the circulation scope, the higher the importance and sensitivity of the document.

[0033] By extracting features from these three dimensions, the system can fully characterize the document. Compared with the traditional document classification method that relies only on keywords, this multi-dimensional feature extraction method takes into account the actual application scenarios of documents in enterprise management. It not only focuses on the document content itself, but also combines enterprise management elements such as organizational structure and access control. The document features extracted in this way are more comprehensive and accurate, providing a data basis for subsequent rule matching and risk assessment.

[0034] Based on the above embodiment, as an optional embodiment, in step 101: extracting document features corresponding to multiple first documents from the electronic document information, the document features including the frequency of sensitive words, the department relevance, and the document circulation scope, this step may also include the following steps:

[0035] Step 201: Obtain a preset sensitive word library, organizational structure information, and document access rights of each employee of the target enterprise; perform word segmentation processing on each first document to obtain word frequency statistics, and match the word frequency statistics with the preset sensitive word library to determine the sensitive word frequency of each first document.

[0036] Among them, the preset sensitive word library refers to a vocabulary set containing sensitive information keywords pre-established by the target enterprise based on its business characteristics, industry requirements and information security management needs.

[0037] Organizational structure information refers to the organizational structure system data of the target enterprise, including the hierarchical relationship between departments within the enterprise, business collaboration relationships, and personnel composition information of each department.

[0038] Document access rights refer to the target enterprise's access control settings for electronic documents, which stipulate the scope of operations allowed for different documents by employees within the enterprise.

[0039] Sensitive word frequency refers to the ratio of the total number of times a sensitive word appears in the first document to the total number of words in the document, reflecting the density of sensitive information in the document content. This indicator comprehensively considers the number of times a sensitive word appears, the overall size of the document, and the distribution of sensitive words, and can quantify the sensitivity of the document.

[0040] Specifically, in order to accurately and intelligently classify and assess the risk of the target enterprise's electronic documents, three key basic data must be obtained first: preset sensitive word library, organizational structure information, and employee document access rights. The preset sensitive word library is a vocabulary set pre-established by the enterprise based on its own business characteristics and information security needs, which contains sensitive words such as commercial secrets, technical secrets, and personal privacy; the organizational structure information reflects the hierarchical relationship and business collaboration relationship between the various departments of the enterprise; and the employee document access rights record the access and operation permission settings of each employee to different documents. After obtaining these basic data, the system performs word segmentation on each first document. Specifically, the system uses natural language processing technology to first pre-process the document content, including removing interference items such as special characters and punctuation marks, and then uses the word segmentation algorithm to divide the document content into individual words. During the word segmentation process, the system will consider the context of the word and the particularity of the professional terminology to ensure the accuracy of the word segmentation results. For the results after word segmentation, the system counts the frequency of each word in the document and generates a word frequency statistical result. Next, the system matches and analyzes the word frequency statistical results with the preset sensitive word library. The matching process uses a fuzzy matching algorithm, which not only considers the situation of complete matching, but also considers variant forms such as synonyms and near-synonyms to improve the accuracy of sensitive word recognition. For the matched sensitive words, the system calculates their frequency of occurrence in the document. The specific calculation formula is: Sensitive word frequency = total number of occurrences of sensitive words in the document / total number of words in the document. This standardized calculation method can eliminate the impact of document length differences and make the sensitivity of different documents comparable. This sensitive word frequency calculation method based on a preset sensitive word library has significant advantages over traditional simple keyword matching. It improves the accuracy of word recognition by performing professional word segmentation on the document.

[0041] Step 202: Determine the department information involved in each first document, and determine the department correlation between the departments involved in each first document based on the organizational structure information and the department information involved in each first document.

[0042] Department information refers to the identification data of the internal organizational unit of the enterprise involved in the first document, including the basic identification of the department (such as department name, department code), department personnel information (such as department head, relevant employees), department business information (such as department responsibilities, business scope), etc. This information reflects the associated subjects and business scope of the document in the enterprise organizational structure.

[0043] Department relevance refers to the degree of relevance between the departments involved in the first document in the organizational structure of the target enterprise.

[0044] Specifically, in order to accurately assess the scope and importance of the document in the enterprise organizational structure, the system needs to analyze the department information involved in the first document and the relationship between these departments. This analysis not only helps to understand the business coverage of the document, but also reflects the potential risk transmission path that the document may bring. The system first analyzes the content of the first document through natural language processing technology to extract the department information involved. Specifically, the system will identify the department name, department code, department-related personnel and other information appearing in the document, and match them with the department data in the organizational structure information to determine the list of departments directly involved in the document. In the identification process, the system uses a fuzzy matching algorithm that can handle multiple expressions such as department aliases and abbreviations to ensure the integrity and accuracy of information extraction. After determining the directly related departments involved in the document, the system analyzes the relationship between these departments based on the organizational structure information. The calculation of departmental relevance adopts a weighted network analysis method, which takes into account the relevance factors of multiple dimensions: first, the organizational hierarchical relationship between departments, and the direct superior-subordinate relationship has a higher relevance weight; second, the frequency of business collaboration between departments, and departments that often need to work together have a strong relevance; finally, the degree of information sharing, and the relevance between departments that need to share core information is also high. For example, when the first document involves both the R&D department and the production department, the system will analyze the position relationship, historical collaboration records, and information sharing degree of the two departments in the organizational structure, and comprehensively calculate the departmental correlation between them. If the two departments often carry out product R&D and production connection work, then the business collaboration weight between them will be higher, and the final departmental correlation will also be higher.

[0045] This multi-dimensional departmental correlation calculation method has significant advantages. First, it can fully reflect the actual correlation strength between departments, taking into account not only the formal organizational relationship but also the substantive business connection; second, by adjusting the weight coefficient, the system can flexibly adjust the importance of each factor according to the actual situation of the enterprise; finally, this quantitative correlation indicator provides data support for subsequent risk assessment.

[0046] Step 203: Based on the document access rights of each employee, determine the range of persons who can access each first document, and determine the document circulation range corresponding to each first document according to the ratio of each accessible personnel range to the total number of people in the target enterprise; use the frequency of sensitive words in each first document, the document circulation range, and the department correlation between the departments involved in each first document as corresponding document features.

[0047] The scope of accessible personnel refers to the set of enterprise employees who have legal access rights to the first document, including all personnel with various operation permissions such as viewing, editing, downloading, forwarding, etc. This scope reflects the authorized dissemination scope of the document within the enterprise, and reflects the degree of openness of the document and the potential scope of information diffusion.

[0048] Specifically, in order to comprehensively evaluate the security risk characteristics of the first document, the system needs to analyze the access control scope of the document and combine it with indicators such as the frequency of sensitive words and departmental relevance to construct a complete document feature vector. This multi-dimensional feature analysis method can more accurately reflect the security attributes and potential risks of the document. The system first identifies the range of accessible personnel for each first document based on the document access permission data. Specifically, the system queries the permission matrix and counts the list of employees who have various operation permissions such as viewing, editing, and downloading the document. During the statistical process, the system will consider the validity period and operation type of the permission to ensure that the currently valid access permission data is obtained. For example, the permission configuration of a document shows that 100 employees have viewing permissions and 50 employees have editing permissions. The system will remove the duplication of these employees with different permissions to obtain the actual set of accessible personnel. After determining the range of accessible personnel, the system calculates the document circulation range indicator. This indicator is measured by the ratio of the number of accessible personnel to the total number of employees in the enterprise. The calculation formula is: document circulation range = number of accessible personnel / total number of employees in the enterprise. This standardized calculation method makes the document circulation range of enterprises of different sizes comparable. For example, in a company with 1,000 employees, if a document is accessible to 200 people, then its document circulation range is 0.2, which means that 20% of the company's employees can access the document. Finally, the system combines the document circulation range with the sensitive word frequency and department relevance calculated in the previous step to obtain the document features.

[0049] This multi-dimensional document feature construction method comprehensively characterizes the security attributes of documents from three perspectives: content, access control, and organizational influence, avoiding the one-sidedness that may be caused by a single indicator; secondly, each feature indicator is standardized to facilitate the system to conduct unified risk assessment and hierarchical management; finally, the design of this feature vector provides a basis for subsequent document classification and security policy formulation.

[0050] Step 102: performing rule matching on features of each document, determining the rule triggering result of each first document, the rule triggering result including the rule triggering times and the triggering strength, and calculating the rule triggering density corresponding to the rule triggering result of each first document.

[0051] The number of rule triggers refers to the number of rules that meet the trigger conditions when the document features of the first document match the rule conditions in the security rule library. This value reflects the extent to which the document violates the enterprise's preset security management rules and reflects the diversity of potential risk points in the document.

[0052] Trigger strength refers to the weighted cumulative value of the severity of the first document's document features exceeding the rule threshold when triggering the security rule. This indicator not only reflects how many rules the document triggers, but more importantly, reflects the severity of the triggering degree. By considering the degree of exceeding the threshold and the importance weight of the rule, it provides a more granular basis for risk assessment.

[0053] The rule trigger density refers to the comprehensive standardized indicator of the rule triggering situation of the first document, which is calculated by weighted normalization of the number of rule triggering and the triggering intensity. This indicator unifies the risk performance of two different dimensions (the number of triggered rules and the severity of the triggering) into a standardized measurement space, which facilitates the unified assessment and comparison of document risks.

[0054] Specifically, in order to accurately assess the security risk level of the first document, the system needs to match and analyze the document features with the preset security rules, and quantify the risk level of the document by calculating the rule triggering situation. This rule-based assessment method can transform the enterprise's security policy requirements into measurable risk indicators. The system first matches the document features of each first document (including sensitive word frequency, document circulation range, and department relevance) with the preset security rule library. Each rule in the security rule library defines a specific trigger condition, such as "trigger when the sensitive word frequency exceeds 0.01 and the document circulation range is greater than 0.3" or "trigger when the department relevance is greater than 0.8 and the document circulation range is greater than 0.5". The system determines which security rules are triggered by each document through conditional judgment. During the rule matching process, the system records two key indicators: the number of rule triggers and the trigger strength. The number of rule triggers refers to the number of rules whose document features successfully match the rule conditions. The trigger strength reflects the severity of the trigger. For example, a rule stipulates that "the sensitive word frequency threshold is 0.01". If the actual sensitive word frequency of a document is 0.015, the degree of exceeding the threshold is 0.005. Based on the number of rule triggers and the trigger intensity, the system further calculates the rule trigger density to standardize the overall risk level of the document. This multi-level rule trigger analysis method can fully capture the risk performance of documents in different security dimensions and reflect complex security requirements through the combination of rules.

[0055] Based on the above embodiment, as an optional embodiment, in step 102: performing rule matching on each document feature to determine the rule triggering result of each first document, the rule triggering result includes the rule triggering times and the triggering strength, this step may also include the following steps:

[0056] Step 301: Obtain a pre-constructed rule decision tree, which includes multiple rule branches and feature trigger thresholds corresponding to the frequency of sensitive words, department relevance, and document circulation scope in each rule branch.

[0057] Among them, the pre-built rule decision tree refers to a multi-level tree-shaped decision model, which is a rule structure for systematically evaluating document risks. It organizes document features such as sensitive word frequency, department relevance, and document circulation scope according to hierarchical judgment logic to form a complete risk judgment framework. The pre-built rule decision tree is based on the historical sample data of the target enterprise and does not consider the subsequent newly added archival information.

[0058] Specifically, in order to achieve accurate assessment and classification of document risks, the system needs to establish a structured rule decision model. As a hierarchical rule expression method, the rule decision tree can effectively capture the combination relationship between different document features and their corresponding risk level judgment logic, and provide a scientific decision basis for the security classification of documents. The system first needs to obtain a pre-built rule decision tree, which is built based on enterprise security management experience and historical data analysis. Each branch of the decision tree represents a risk judgment path, which contains a combination of trigger thresholds for three key feature dimensions: sensitive word frequency, department relevance, and document circulation range. For example, a rule branch may be defined as: when the sensitive word frequency is greater than 0.02, the department relevance is greater than 0.7, and the document circulation range is greater than 0.4, it is judged as a high-risk document. The design of the rule decision tree takes into account the mutual influence between features. For example, when the sensitive word frequency is high, even if the department relevance is low, the document may be judged as a high risk; when the sensitive word frequency is low, a higher department relevance and document circulation range may be required to trigger a high-risk judgment. This multi-dimensional combined judgment makes risk assessment more accurate and reasonable.

[0059] Step 302: Each document feature is used as an input parameter to match the corresponding feature trigger threshold in the rule decision tree to obtain the rule branch trigger quantity and path depth of each document feature in the rule decision tree.

[0060] The number of rule branch triggers refers to the number of complete branches where document features meet the triggering conditions in the rule decision tree, while the path depth refers to the maximum number of layers where document features continuously meet the judgment conditions in each triggered branch. These two indicators together reflect the breadth and depth of document risk features, providing a multi-dimensional quantitative basis for risk assessment.

[0061] Specifically, in order to achieve an accurate assessment of document risk, the system needs to systematically match and analyze each feature of the document with the rule decision tree. This decision tree-based matching process can not only identify which rule branches are triggered by the document, but also reflect the degree of certainty of risk judgment through the path depth, thereby providing a more comprehensive basis for the determination of risk levels. The system first takes the document's sensitive word frequency, department relevance, and document circulation range as input parameters, and matches them layer by layer with the feature trigger thresholds of the corresponding levels in the rule decision tree. The matching process adopts a depth-first traversal method, starting from the root node, and successively determines whether each feature value meets the trigger condition of the current node. For example, for a document feature set {sensitive word frequency = 0.025, department relevance = 0.8, document circulation range = 0.6}, the system will first determine whether the sensitive word frequency exceeds the threshold at the root node, and then select the corresponding child node according to the judgment result to continue the department relevance judgment, and so on. During the matching process, the system will record two key indicators: the number of rule branch triggers and the path depth. The number of rule branch triggers counts the number of branches where document features meet the trigger conditions, reflecting how many different combinations of conditions a document exhibits risk characteristics under. For example, if the frequency of sensitive words in a document meets the threshold conditions of multiple branches at the same time (such as greater than 0.02 and 0.03 at the same time), these branches will be counted in the number of triggers. The path depth records the maximum number of layers in each triggered branch where document features can meet the continuous judgment conditions, which reflects the degree of certainty of risk judgment. For example, if a branch contains three layers of judgment and all document features meet them, the path depth of the branch is 3; if only the first two layers of judgment are met, the path depth is 2. The feature matching method based on the decision tree can capture the combination relationship between features, reflect the reliability of risk judgment through the path depth, and reflect the prevalence of risk through the number of triggers. This information provides a rich decision-making basis for subsequent risk level judgment, enabling the system to more accurately assess the actual risk level of the document.

[0062] Step 303: The number of rule branch triggers of each document feature in the rule decision tree is used as the number of rule triggers of the corresponding first document; the trigger strength corresponding to each first document is calculated by combining the path depth of each document feature in the rule decision tree and the branch weight of each rule branch.

[0063] Specifically, in order to accurately quantify the risk level of a document, the system needs to convert the matching results of the rule decision tree into computable rule triggering times and triggering strength indicators to support subsequent risk assessment work. The system directly uses the number of complete rule branches triggered by document features in the rule decision tree as the rule triggering times of the document. At the same time, the triggering strength is calculated based on the path depth and branch weight. The calculation formula is: triggering strength = Σ(path depth i × branch weight i × depth adjustment factor), where the depth adjustment factor = path depth / maximum depth of the decision tree. For example, a document triggers two rule branches: the path depth of branch 1 is 3 and the weight is 0.6, and the path depth of branch 2 is 2 and the weight is 0.4. In the decision tree with a maximum depth of 3, its triggering strength is calculated as: (3×0.6×3 / 3)+(2×0.4×2 / 3)= 2.33. The path depth reflects the certainty of risk judgment, and the branch weight reflects the difference in importance of different risk paths. Through this method of combining direct mapping with weighted calculation, the system achieves accurate quantification of document risks. The number of rule triggering times reflects the breadth of the document triggering risk rules, while the triggering intensity comprehensively reflects the depth and importance of risk determination, providing a reliable quantitative basis for subsequent risk grading. This method has good adjustability and can adapt to different risk assessment needs by modifying branch weights.

[0064] Based on the above embodiment, as an optional embodiment, in step 102: calculating the rule triggering density corresponding to the rule triggering result of each first document, this step may also include the following steps:

[0065] Step 304: Map the sensitive word frequency, department relevance, and document circulation range of each first document to the X-axis, Y-axis, and Z-axis in the three-dimensional coordinate system, respectively, to obtain the feature point coordinates corresponding to each first document.

[0066] Specifically, in order to intuitively display the distribution of document risk characteristics and provide a spatial geometric basis for subsequent risk clustering analysis, the system needs to convert the three core features of the document into coordinate points in three-dimensional space to achieve visual expression of risk characteristics. The system uses a spatial rectangular coordinate system to model, mapping the frequency of sensitive words to the X-axis (value range [0, 1]), the department association to the Y-axis (value range [0, 1]), and the document circulation range to the Z-axis (value range [0, 1]). For each document, its feature value set {sensitive word frequency = a, department association = b, document circulation range = c} will be mapped to a spatial coordinate point P (a, b, c). For example, when the document feature value is {sensitive word frequency = 0.025, department association = 0.8, document circulation range = 0.6}, the corresponding feature point coordinates are P (0.025, 0.8, 0.6). This mapping maintains the original dimension of the feature value and ensures the authenticity of the spatial distribution. By mapping document features to three-dimensional space, the system achieves a geometric expression of risk characteristics. This expression not only facilitates intuitive understanding of the distribution characteristics of documents in various risk dimensions, but also lays a mathematical foundation for subsequent risk clustering analysis based on spatial distance. At the same time, the three-dimensional spatial model also supports dynamic monitoring of risk distribution, and can track changes in document risk status by observing the spatial migration of feature points.

[0067] Step 305: Based on a preset correction coefficient mapping table, determine the correction coefficient corresponding to the trigger strength of each first document, and determine the corrected target feature point coordinates of each first document according to the correction coefficient and feature point coordinates of each first document.

[0068] Specifically, in order to combine the triggering results of the rule decision tree with the spatial feature expression, the system needs to adjust the feature point coordinates through the correction coefficient, so as to reflect the rule triggering situation of the document in the spatial expression, so as to make the risk assessment results more accurate and comprehensive. The system first determines the correction coefficient based on the preset correction coefficient mapping table, which defines the correspondence between the trigger strength interval and the correction coefficient. For example: the trigger strength in [0, 1) corresponds to a correction coefficient of 1.0, [1, 2) corresponds to 1.2, [2, 3) corresponds to 1.5, and [3, ∞) corresponds to 2.0. For a document with a trigger strength of 2.33, the corresponding correction coefficient is 1.5. After determining the correction coefficient, the system multiplies each component of the original feature point coordinate P (x, y, z) by the correction coefficient to obtain the corrected target feature point coordinate P' (1.5x, 1.5y, 1.5z). For example, the original feature point coordinates are P(0.025, 0.8, 0.6). After using the correction coefficient of 1.5, the corrected target feature point coordinates are P'(0.0375, 1.2, 0.9). When the corrected coordinate value exceeds 1, the system truncates it to 1 to ensure that the coordinate value is still within the valid range. Through the introduction of correction coefficients and coordinate correction, the system realizes the organic combination of rule triggering conditions and spatial features. The corrected feature point coordinates not only retain the relative relationship of the original features, but also reflect the risk triggering degree of the document through the enhancement of the coordinate values, providing a more accurate spatial feature expression for subsequent risk clustering analysis. This feature correction mechanism based on trigger strength enables the spatial model to more comprehensively characterize the risk status of the document and improve the accuracy of risk assessment.

[0069] Step 306: Based on the coordinates of each target feature point, calculate the rule triggering space volume of each first document in the three-dimensional coordinate system; and use the ratio of the rule triggering times of each first document to the rule triggering space volume as the corresponding rule triggering density.

[0070] Specifically, in order to quantify the risk distribution characteristics of documents from the perspective of spatial geometry, the system needs to calculate the volume of the rule trigger space and combine the number of rule triggers to obtain the rule trigger density, so as to evaluate the degree of rule triggering in the unit risk space and provide a new quantitative basis for risk rating. The system calculates the volume of the rule trigger space based on the target feature point coordinates P'(x', y', z'), which is equal to the volume of the rectangular body with the coordinate origin and the target feature point as diagonal vertices, and the calculation formula is V=x'×y'×z'. For example, for the target feature point coordinates P'(0.0375, 1.0, 0.9), its rule trigger space volume V=0.0375×1.0×0.9=0.03375 cubic units. Subsequently, the system divides the number of rule triggers n obtained by the rule trigger space volume V to obtain the rule trigger density ρ=n / V. For example, if the number of rule triggers of the document is 3, its rule trigger density ρ=3 / 0.03375=88.89. This density value reflects the average number of times the rule is triggered in the unit risk space. The larger the value, the more concentrated the risk is in the unit space. By calculating the rule trigger space volume and rule trigger density, the system realizes the spatial quantification of the document risk distribution characteristics. The rule trigger space volume reflects the spatial coverage of the document risk characteristics, and the rule trigger density reflects the concentration of risk rules in space. The combination of these two indicators provides a new perspective for risk assessment. This quantitative method based on spatial geometry takes into account both the distribution range of risk characteristics and the density of risk triggers, making the risk assessment results more three-dimensional and comprehensive.

[0071] Step 103: Filter out multiple first documents whose rule trigger density is greater than a threshold as second documents; construct a risk transmission chain network according to the document characteristics and rule triggering results of each second document, and calculate the transmission risk value corresponding to each second document based on multiple document nodes and transmission paths in the risk transmission chain network.

[0072] Among them, the second document refers to a high-risk document whose rule triggering density exceeds a preset threshold among all documents to be evaluated. In the embodiment of the present application, it can be understood as documents that not only trigger more risk rules, but also these rule triggerings are relatively concentrated in a smaller risk feature space. These documents tend to show more significant risk characteristics and a greater possibility of risk transmission due to their higher rule triggering density.

[0073] The risk transmission chain network refers to a network structure constructed with the second document as the node and the departmental association relationship, user reference relationship and content similarity relationship between documents as the connection path to characterize the possibility of document risk transmission.

[0074] A document node refers to the basic unit that represents a single second document in the risk transmission chain network. Each node has unique risk characteristics and rule triggering characteristics. A transmission path refers to the relationship line connecting different document nodes, reflecting the channels and methods through which risk transmission may occur between nodes.

[0075] The transmission risk value refers to a comprehensive numerical indicator that measures the risk impact that a second document may have on other documents through the network structure in the risk transmission chain network. This indicator comprehensively considers the risk level of the document itself, the risk level of other documents directly and indirectly connected to it, and the impact intensity of the corresponding transmission path.

[0076] Specifically, in order to identify and evaluate high-risk documents with the possibility of risk transmission, the system needs to screen out the documents of focus and analyze the risk transmission relationship between them, so as to evaluate the risk impact that the documents may cause in the entire document network. The system first screens out high-risk documents as second documents according to the preset rule trigger density threshold. The rule trigger density of these documents is significantly higher than that of ordinary documents. Subsequently, the system constructs a risk transmission chain network, takes each second document as a network node, and establishes a transmission path based on the association relationship between documents. These associations mainly consider three aspects: the degree of association of the department to which the document belongs, the degree of overlap of the document viewing users, and the similarity of the document content. The system assigns a corresponding weight to each transmission path, and the weight value is determined based on the comprehensive evaluation of these three aspects. When calculating the transmission risk value, the system first identifies the documents directly connected to the target document and calculates their risk impact on the target document; then expands outward step by step to analyze the impact of indirectly connected documents. With each additional level of association distance, the degree of impact is correspondingly weakened. The final transmission risk value comprehensively considers the risk level of all related documents and the impact strength of the transmission path. By establishing a risk transmission chain network and calculating the transmission risk value, the system can comprehensively evaluate the scope and degree of risk impact of documents within the organization. This networked risk assessment method not only takes into account the risk status of a single document, but also reflects the possibility of risk transmission between documents. It helps to timely discover risk transmission chains and key risk nodes, and provide more accurate decision-making basis for risk prevention and control.

[0077] Based on the above embodiment, as an optional embodiment, in step 103: constructing a risk transmission chain network according to the document features of each second document and the rule triggering result, this step may also include the following steps:

[0078] Step 401: Take each second document as a document node; based on the document features of each second document, calculate the sensitive word similarity, department overlap and circulation range intersection between any two document nodes, and use the calculation results as the feature association strength between the two document nodes.

[0079] Among them, sensitive word similarity refers to the degree of similarity between two document nodes in the use of sensitive words, which is calculated by comparing the frequency and distribution of sensitive words in the documents; department overlap refers to the degree of overlap of the departments involved in the two document nodes in the organizational structure, reflecting the relevance of the documents at the organizational department level; circulation range intersection refers to the overlap of the actual reading user groups of the two document nodes, reflecting the relevance of the documents at the circulation behavior level.

[0080] Specifically, in order to build a risk transmission chain network that accurately reflects the correlation between documents, the system needs to calculate the correlation strength between nodes based on document features, so as to quantitatively evaluate the possibility of risk transmission between different documents. The system first sets each second document as an independent document node in the network, and then analyzes the correlation between any two document nodes. The sensitive word similarity is calculated by comparing the sensitive word sets of the two documents, using the cosine similarity method of word frequency vectors; the department overlap is calculated by calculating the proportion of the intersection of the departments involved in the two documents to the union; the circulation range intersection is determined by analyzing the degree of overlap of the actual circulation user groups of the two documents. For example, when two document nodes contain multiple sensitive words, involve the same business department, and have a large number of common circulation users, the feature correlation strength between them will be correspondingly higher. These three feature correlation strengths serve as basic indicators for measuring the degree of correlation between document nodes, providing a quantitative basis for the subsequent construction of the transmission path. By calculating the feature correlation strength between document nodes, the system achieves accurate quantification of document correlation. This method of calculating association strength based on multi-dimensional features not only takes into account the similarity of document content, but also covers the correlation between organizational structure and circulation behavior, so that the subsequently constructed risk transmission chain network can more accurately reflect the actual degree of correlation between documents, providing a more reliable network structure foundation for risk transmission analysis.

[0081] Step 402: normalize the sensitive word similarity, department overlap and circulation range intersection between any two document nodes to obtain the conduction probability between any two document nodes, and establish a conduction path between two document nodes whose conduction probability is greater than a probability threshold.

[0082] Specifically, in order to make the feature association strengths of different dimensions comparable and determine whether to establish a transmission path based on a unified standard, the system needs to normalize the feature association strengths and set a reasonable threshold, so as to construct a network structure that reflects the actual risk transmission possibility. The system first normalizes the sensitive word similarity, department overlap, and circulation range intersection between document nodes, and maps the values ​​of these three indicators to the range of 0 to 1. For each pair of document nodes, the system uses a linear weighted method to synthesize the three normalized indicators into a transmission probability, where the distribution of weights reflects the importance of different features in risk transmission. For example, when the normalized sensitive word similarity of two document nodes is 0.8, the department overlap is 0.6, and the circulation range intersection is 0.7, assuming that the weights of the three indicators are 0.4, 0.3, and 0.3 respectively, the transmission probability between the two nodes can be calculated to be 0.71. The system sets a transmission probability threshold. When the transmission probability between two document nodes exceeds the threshold, a transmission path is established between the two nodes, indicating that there is a significant risk transmission possibility between the two documents. Through normalization and calculation of transmission probability, the system realizes a unified measurement of the strength of association between document nodes and screens out significant transmission relationships based on probability thresholds. This transmission path construction method based on multi-dimensional features not only ensures the comparability of different feature indicators, but also ensures the significance of the transmission path through threshold control, so that the risk transmission chain network finally constructed can more accurately reflect the actual risk transmission relationship between documents.

[0083] Step 403: Determine the conduction direction of each conduction path according to the conduction probability of each conduction path; generate a risk conduction chain network based on each conduction path, the conduction direction of each conduction path and each document node.

[0084] Specifically, in order to accurately reflect the actual transmission trend of risks between documents, the system needs to determine the directionality of the transmission path and build a complete risk transmission chain network based on the transmission path with direction, so as to reveal the transmission law of document risks within the organization. The system first analyzes the risk characteristics and temporal relationship of the document nodes at both ends of each transmission path to determine the transmission direction. When there is a significant difference in risk levels between two document nodes, the system sets the transmission direction from high-risk documents to low-risk documents; when the risk levels are similar, the system considers the temporal relationship of the documents and sets the transmission direction from early documents to later documents. For example, for two document nodes with established transmission paths, if the rule triggering density of the source document is significantly higher than that of the target document, or the generation time of the source document is earlier than that of the target document, the transmission direction is determined to be from the source document to the target document. After determining the direction of all transmission paths, the system integrates the document nodes and the transmission paths with direction into a complete risk transmission chain network, which presents the risk transmission relationship between documents in the form of a directed graph. By determining the transmission direction and building the risk transmission chain network, the system achieves an accurate characterization of the document risk transmission pattern. This network structure based on directional transmission paths not only reflects the strength of association between documents, but also reflects the actual direction and trend of risk transmission, which helps to identify the source and key path of risk transmission and provide more targeted decision support for risk prevention and control. The constructed risk transmission chain network can intuitively show the transmission trend of document risks within the organization, helping managers better understand and control the risk transmission process.

[0085] Based on the above embodiment, as an optional embodiment, in step 103: based on multiple document nodes and transmission paths in the risk transmission chain network, the transmission risk value corresponding to each second document is calculated. This step may also include the following steps:

[0086] Step 404: In the risk transmission chain network, multiple walking paths are generated with each document node as the starting point; multiple transmission sub-paths in each walking path are extracted, and the length of each transmission sub-path and the document node sequence passed through are obtained.

[0087] Specifically, in order to comprehensively analyze the propagation path and impact range of risks in the document network, the system needs to explore various possible transmission paths in the network through random walks, and extract key transmission information in these paths to provide basic data for the subsequent calculation of transmission risk values. The system adopts a random walk algorithm, takes each document node as the starting point, and performs multiple random walks in the risk transmission chain network. During each walk, the system selects the next access node according to the transmission probability of the transmission path according to the established rules until the preset maximum number of walk steps is reached or the terminal node that cannot move forward is encountered. For example, starting from a certain document node, multiple walk paths of different lengths may be generated, and each path records all the node sequences passed during the walk. For each generated walk path, the system further extracts the transmission sub-paths, which can be direct transmission relationships consisting of two consecutive nodes or indirect transmission relationships consisting of multiple nodes. The system records the length of each transmission sub-path (that is, the number of nodes included minus one) and the complete node sequence information. By generating diverse transmission paths through random walks, the system realizes an in-depth exploration of the risk transmission chain network. This random walk-based path generation method can discover potential risk transmission channels in the network and obtain fine-grained transmission relationship information by extracting transmission sub-paths. The generated walk paths and transmission sub-paths provide rich network structure features for evaluating the transmission risk value of document nodes, which helps to more accurately measure the importance and influence of documents in the risk transmission process.

[0088] Step 405: For the wandering path of each document node, the conduction probabilities between adjacent document nodes in each document node sequence are multiplied to obtain the conduction strength corresponding to each conduction sub-path.

[0089] Specifically, in order to quantitatively evaluate the impact strength of each transmission sub-path, the system needs to calculate the overall transmission strength based on the transmission probability between adjacent nodes on the path, so as to reflect the attenuation law and actual impact degree of risks on different transmission paths. The system calculates the transmission strength of the transmission sub-path extracted from each wandering path. For a transmission sub-path, the system sequentially obtains the transmission probability between adjacent document nodes on the path, and multiplies these transmission probabilities to obtain the overall transmission strength of the transmission sub-path. For example, for a transmission sub-path containing three document nodes, if the transmission probability from the first node to the second node is 0.8, and the transmission probability from the second node to the third node is 0.7, then the transmission strength of the transmission sub-path is 0.56. This multiplication calculation method reflects the cumulative attenuation characteristics of risks in the transmission process, that is, the longer the path, the smaller the transmission strength is usually, which is in line with the law of actual risk transmission. By calculating the transmission strength of the transmission sub-path, the system achieves accurate quantification of the impact degree of risk transmission. This calculation method based on the multiplication of transmission probabilities not only takes into account the probability characteristics of each transmission link on the path, but also reflects the attenuation effect of the transmission distance on the risk impact, so that the calculated transmission intensity can more accurately characterize the actual transmission effect of risks on different transmission paths.

[0090] Step 406: Based on a preset path attenuation mapping table, determine the path attenuation factor corresponding to the length of each conduction sub-path, and use the product of the conduction strength of each sub-path and the path attenuation factor as the corresponding effective conduction value; and use the sum of the effective conduction values ​​of each sub-path as the conduction risk value of the second document corresponding to the document node.

[0091] Among them, the preset path attenuation mapping table refers to a comparison table that defines the relationship between different conduction path lengths and corresponding attenuation coefficients. The table reflects the objective law that the risk gradually weakens with the increase of propagation distance during the conduction process, and embodies the specific quantitative performance of the distance attenuation effect in risk conduction.

[0092] The path attenuation factor is a coefficient used to quantify the distance attenuation effect in the risk transmission process. This coefficient decreases as the transmission path length increases, reflecting the natural attenuation law of risk influence in the transmission process. It is the specific value corresponding to a specific transmission path length in the preset path attenuation mapping table.

[0093] Specifically, in order to more accurately reflect the impact of the conduction path length on the risk conduction effect and ultimately calculate the overall conduction risk value of the document node, the system needs to introduce a path attenuation factor to adjust the conduction strength, so as to obtain a risk conduction assessment result that is more in line with the actual situation. The system first determines the attenuation factor of each conduction sub-path based on the preset path attenuation mapping table, which defines the attenuation coefficients corresponding to different path lengths. For example, a path with a length of 1 may correspond to an attenuation factor of 1.0, a path with a length of 2 may correspond to an attenuation factor of 0.8, a path with a length of 3 may correspond to an attenuation factor of 0.6, and so on, reflecting the characteristic that the longer the path, the more obvious the attenuation. For each conduction sub-path, the system multiplies its conduction strength by the corresponding path attenuation factor to obtain an effective conduction value that takes into account the influence of the path length. For example, if a conduction sub-path with a length of 2 has a conduction strength of 0.56 and a corresponding path attenuation factor of 0.8, its effective conduction value is 0.448. Finally, the system sums the effective conduction values ​​of all conduction sub-paths of the same document node to obtain the conduction risk value of the second document corresponding to the node, which comprehensively reflects the influence of the document in the entire risk conduction network. By introducing the path attenuation factor and calculating the transmission risk value, the system achieves a reasonable assessment of the risk transmission capacity of the document. This calculation method that takes into account the path length attenuation effect not only reflects the distance attenuation characteristics of risk transmission, but also retains the cumulative effect of multiple transmission paths, so that the transmission risk value finally calculated can more accurately characterize the actual influence of the document in the risk transmission network. This provides a quantitative basis for identifying key risk documents and formulating targeted risk prevention and control measures.

[0094] Step 104: Classify each second document in combination with each transmission risk value, and store each classified second document in a document library of the target enterprise.

[0095] Among them, the document library refers to a data management system used to centrally store and manage various types of enterprise documents and their related attribute information. It not only contains the basic content of the document, but also includes risk management-related metadata information such as the document's risk level, transmission risk value, classification label, etc.

[0096] Specifically, in order to facilitate the management and control of documents of different risk levels, the system needs to reasonably classify the second document according to the calculated transmission risk value, and save the classification results to the document library, so as to provide basic support for subsequent risk prevention and control work. The system first determines the distribution characteristics of the transmission risk value based on statistical analysis, and sets multiple risk level division thresholds. For example, the transmission risk value can be divided into three levels: high, medium, and low, where those above 0.8 are divided into high-risk documents, those between 0.4 and 0.8 are divided into medium-risk documents, and those below 0.4 are divided into low-risk documents. The system classifies the second document according to these thresholds and adds corresponding risk level labels to each document. After the classification is completed, the system stores the documents with risk level labels in the document library of the target enterprise, and records the key information such as the transmission risk value and classification time of the document. The data is organized in a structured way during storage to ensure that the risk attributes of the document can be quickly retrieved and updated. By classifying and storing the second document, the system realizes the clear division and efficient management of the risk level of the document. This classification method based on the transmission risk value enables enterprises to quickly identify and locate documents of different risk levels and implement differentiated control measures in a targeted manner. At the same time, storing the classification results in the document library also provides a data basis for risk monitoring and early warning, which helps enterprises to timely discover and deal with potential risks and improve the overall risk management level. This classification storage mechanism enables enterprises to establish a complete document risk profile, providing an important reference for the continuous optimization of risk prevention and control strategies.

[0097] Based on the above embodiment, as an optional embodiment, in step 104: classifying each second document in combination with each conduction risk value, this step may also include the following steps:

[0098] Step 501: obtaining a preset risk threshold sequence, wherein the preset risk threshold sequence includes a plurality of increasing risk thresholds; comparing the conduction risk value of each second document with the plurality of risk thresholds in the risk threshold sequence respectively to obtain a comparison result.

[0099] Specifically, in order to establish the document risk classification standard, the system needs to set a set of increasing risk threshold sequences, and compare the transmission risk value of the document with these thresholds to achieve accurate classification of the document risk level, thereby providing a basis for subsequent differentiated management. The system first sets a risk threshold sequence based on historical data analysis and expert experience, and the sequence contains multiple risk thresholds arranged from small to large. For example, four increasing risk thresholds can be set: 0.3, 0.5, 0.7, and 0.9, which are used to classify documents into five risk levels. The system obtains the transmission risk value of each second document in turn and compares it with each threshold in the risk threshold sequence. The comparison process adopts a sequential comparison method to record the size relationship between the transmission risk value and each threshold. For example, when the transmission risk value of a document is 0.6, the system will record the comparison results that it is greater than 0.3 and 0.5, but less than 0.7 and 0.9. These comparison results will be used to determine the specific risk level of the document. By setting the risk threshold sequence and making comparisons, the system achieves an objective quantitative judgment of the document risk level. This multi-threshold comparison method avoids the problem of overly rough classification caused by a single threshold, making the risk level classification more refined and reasonable. At the same time, the incremental threshold sequence design reflects the progressive nature of the risk level, which helps to more accurately identify documents of different risk levels. These comparison results provide a reliable basis for subsequent document classification and help enterprises implement more targeted risk management measures.

[0100] Step 502: Determine the risk threshold interval of each second document based on the comparison result; and determine the risk category corresponding to each second document according to the risk threshold interval of each second document.

[0101] Specifically, in order to convert the transmission risk value into a specific risk category identifier, the system needs to determine the risk threshold interval of the document based on the comparison result, and establish a corresponding relationship between the risk threshold interval and the risk category, so as to achieve accurate division and labeling of the document risk level. The system first determines the specific threshold interval of the transmission risk value of each second document according to the comparison result obtained in the previous step. For example, for the risk threshold sequence [0.3, 0.5, 0.7, 0.9], the system will divide it into five intervals: [0, 0.3), [0.3, 0.5), [0.5, 0.7), [0.7, 0.9), [0.9, 1]. When the transmission risk value of a document is 0.6, it can be determined by the comparison result that it is in the interval [0.5, 0.7). After that, the system maps different risk threshold intervals to corresponding risk categories according to the predefined interval mapping rules. For example, these five intervals can be corresponded to categories such as "very low risk", "low risk", "medium risk", "high risk", and "very high risk" in turn, so as to determine the specific risk category of each second document. By establishing a correspondence between risk threshold intervals and risk categories, the system achieves a clear classification of document risk levels. This classification method based on interval mapping not only ensures the continuity and integrity of the classification, but also provides a more intuitive representation of risk levels. These risk category identifiers can help companies quickly identify documents of different risk levels, facilitating the implementation of hierarchical management and key monitoring. At the same time, this classification result also provides clear guidance for the formulation of subsequent risk prevention and control measures, enabling companies to adopt corresponding management and control strategies based on different risk categories, thereby improving the pertinence and effectiveness of risk management.

[0102] Reference Figure 2 , is an electronic archive intelligent classification system provided by the embodiment of the present application, the system comprises: an information acquisition module, a document feature extraction module, a document screening module, and a document classification module, wherein:

[0103] An information acquisition module is used to acquire electronic document information of the target enterprise;

[0104] A document feature extraction module, used to extract document features corresponding to the plurality of first documents from the electronic document information, wherein the document features include the frequency of sensitive words, the degree of departmental relevance, and the scope of document circulation;

[0105] The document screening module is used to match the features of each document with rules, determine the rule triggering results of each first document, the rule triggering results include the rule triggering times and the triggering strength, and calculate the rule triggering density corresponding to the rule triggering results of each first document; screen out multiple first documents whose rule triggering density is greater than a threshold value as second documents respectively;

[0106] The document classification module is used to construct a risk transmission chain network according to the document characteristics and rule triggering results of each second document, and calculate the transmission risk value corresponding to each second document based on multiple document nodes and transmission paths in the risk transmission chain network; classify each second document in combination with each transmission risk value, and store the classified second documents in the document library of the target enterprise.

[0107] On the basis of the above embodiment, the document feature extraction module is also used to obtain the preset sensitive word library, organizational structure information and document access rights of each employee of the target enterprise; perform word segmentation processing on each first document to obtain word frequency statistics, and match the word frequency statistics with the preset sensitive word library to determine the sensitive word frequency of each first document; determine the department information involved in each first document, and based on the organizational structure information and the department information involved in each first document, determine the department correlation between the departments involved in each first document; based on the document access rights of each employee, determine the range of accessible personnel for each first document, and determine the document circulation range corresponding to each first document according to the proportion of each accessible personnel range to the total number of people in the target enterprise; use the sensitive word frequency of each first document, the document circulation range and the department correlation between the departments involved in each first document as the corresponding document features.

[0108] On the basis of the above embodiment, the document screening module is also used to obtain a pre-constructed rule decision tree, which includes multiple rule branches and feature trigger thresholds corresponding to the frequency of sensitive words, department relevance and document circulation scope in each rule branch; each document feature is used as an input parameter to match the corresponding feature trigger threshold in the rule decision tree to obtain the number of rule branch triggers and path depth of each document feature in the rule decision tree; the number of rule branch triggers of each document feature in the rule decision tree is used as the corresponding number of rule triggers of the first document; and the trigger strength corresponding to each first document is calculated in combination with the path depth of each document feature in the rule decision tree and the branch weight of each rule branch.

[0109] On the basis of the above embodiments, the document screening module is also used to map the sensitive word frequency, department relevance and document circulation scope of each first document to the X-axis, Y-axis and Z-axis in the three-dimensional coordinate system respectively, to obtain the feature point coordinates corresponding to each first document; based on a preset correction coefficient mapping table, determine the correction coefficient corresponding to the trigger strength of each first document, and determine the corrected target feature point coordinates of each first document based on the correction coefficient and feature point coordinates of each first document; based on the coordinates of each target feature point, calculate the rule trigger space volume of each first document in the three-dimensional coordinate system; and take the ratio of the number of rule triggering times of each first document to the rule triggering space volume as the corresponding rule triggering density.

[0110] On the basis of the above embodiment, the document classification module is also used to take each second document as a document node; based on the document features of each second document, calculate the sensitive word similarity, department overlap and circulation range intersection between any two document nodes, and use the calculation results as the feature association strength between the two document nodes; normalize the sensitive word similarity, department overlap and circulation range intersection between any two document nodes to obtain the conduction probability between any two document nodes, and establish a conduction path between two document nodes whose conduction probability is greater than the probability threshold; determine the conduction direction of each conduction path according to the conduction probability of each conduction path; generate a risk conduction chain network based on each conduction path, the conduction direction of each conduction path and each document node.

[0111] On the basis of the above-mentioned embodiments, the document classification module is also used to generate multiple walking paths in the risk transmission chain network with each document node as the starting point; extract multiple transmission sub-paths in each transmission path, and obtain the length of each transmission sub-path and the document node sequence passed through; for the walking path of each document node, multiply the transmission probabilities between adjacent document nodes in each document node sequence to obtain the transmission strength corresponding to each transmission sub-path; based on a preset path attenuation mapping table, determine the path attenuation factor corresponding to the length of each transmission sub-path, and use the product of the transmission strength of each transmission sub-path and the path attenuation factor as the corresponding effective transmission value; and use the sum of the effective transmission values ​​of each transmission sub-path as the transmission risk value of the second document corresponding to the document node.

[0112] Based on the above embodiment, the document classification module is also used to obtain a preset risk threshold sequence, which includes multiple increasing risk thresholds; compare the conduction risk value of each second document with the multiple risk thresholds in the risk threshold sequence to obtain a comparison result; determine the risk threshold interval of each second document based on the comparison result; and determine the risk category corresponding to each second document according to the risk threshold interval of each second document.

[0113] It should be noted that: when the device provided in the above embodiment realizes its function, only the division of the above functional modules is used as an example. In actual application, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0114] The present application also discloses an electronic device. Figure 3 , Figure 3The electronic device 300 may include: at least one processor 301 , at least one network interface 304 , a user interface 303 , a memory 305 , and at least one communication bus 302 .

[0115] The communication bus 302 is used to realize the connection and communication between these components.

[0116] The user interface 303 may include a display interface and a camera interface. Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0117] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0118] Among them, the processor 301 may include one or more processing cores. The processor 301 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and calling data stored in the memory 305. Optionally, the processor 301 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 301 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface diagrams and applications, etc.; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 301, and it can be implemented separately through a chip.

[0119] Among them, the memory 305 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may optionally also be at least one storage device located away from the aforementioned processor 301. Refer to Figure 3 , the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module and an application program of an electronic archive intelligent classification method.

[0120] exist Figure 3 In the electronic device 300 shown, the user interface 303 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 301 can be used to call the application program storing an electronic archive intelligent classification method in the memory 305, and when executed by one or more processors 301, the electronic device 300 executes one or more methods in the above-mentioned embodiments. It should be noted that for the aforementioned method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application.

[0121] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0122] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0123] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0124] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0125] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: various media that can store program codes, such as USB flash drives, mobile hard drives, magnetic disks or optical disks.

[0126] The above are only exemplary embodiments of the present disclosure and cannot be used to limit the scope of the present disclosure. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification and practice, those skilled in the art will easily think of other embodiments of the present disclosure.

[0127] This application is intended to cover any variation, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the art not recorded in the present disclosure. The description and examples are to be regarded as exemplary only.

Claims

1. An intelligent classification method for electronic archives, characterized in that: include: Obtain electronic document information of the target enterprise; Extracting document features corresponding to the plurality of first documents from the electronic document information, the document features including sensitive word frequency, department relevance, and document circulation scope; Performing rule matching on each of the document features, determining a rule triggering result of each of the first documents, the rule triggering result including the rule triggering times and the triggering strength, and calculating a rule triggering density corresponding to the rule triggering result of each of the first documents; Filter out a plurality of first documents whose rule triggering density is greater than a threshold value as second documents respectively; Constructing a risk transmission chain network according to the document features and rule triggering results of each of the second documents, and calculating a transmission risk value corresponding to each of the second documents based on a plurality of document nodes and transmission paths in the risk transmission chain network; classifying each of the second documents in combination with each of the transmission risk values, and storing each of the classified second documents in a document library of the target enterprise; The calculating the rule triggering density corresponding to the rule triggering result of each of the first documents includes: Mapping the sensitive word frequency, department relevance, and document circulation range of each of the first documents to the X-axis, Y-axis, and Z-axis in the three-dimensional coordinate system, respectively, to obtain the coordinates of the feature points corresponding to each of the first documents; Based on a preset correction coefficient mapping table, determining a correction coefficient corresponding to the trigger strength of each of the first documents, and determining the corrected target feature point coordinates of each of the first documents according to the correction coefficient and feature point coordinates of each of the first documents; Based on the coordinates of each of the target feature points, calculating the rule triggering space volume of each of the first documents in the three-dimensional coordinate system; The ratio of the number of rule triggering times of each of the first documents to the rule triggering space volume is used as the corresponding rule triggering density.

2. The electronic archive intelligent classification method according to claim 1, characterized in that: The step of extracting document features corresponding to the plurality of first documents from the electronic document information includes: Obtain the preset sensitive word library, organizational structure information, and document access permissions of each employee of the target enterprise; Performing word segmentation processing on each of the first documents to obtain word frequency statistics results, and matching the word frequency statistics results with the preset sensitive word library to determine the frequency of sensitive words in each of the first documents; Determining department information involved in each of the first documents, and determining department correlations between departments involved in each of the first documents based on the organizational structure information and the department information involved in each of the first documents; Based on the document access rights of each of the employees, determining the range of persons who can access each of the first documents, and determining the document circulation range corresponding to each of the first documents according to the ratio of each range of persons who can access each of the first documents to the total number of persons in the target enterprise; The sensitive word frequency of each of the first documents, the document circulation scope, and the department correlation between the departments involved in each of the first documents are used as corresponding document features.

3. The electronic archive intelligent classification method according to claim 1, characterized in that: The rule matching is performed on each of the document features to determine the rule triggering result of each of the first documents, wherein the rule triggering result includes the rule triggering times and the triggering strength, including: Obtain a pre-built rule decision tree, the rule decision tree comprising a plurality of rule branches and feature trigger thresholds corresponding to the frequency of sensitive words, department relevance, and document circulation scope in each of the rule branches; Using each of the document features as an input parameter to match the corresponding feature trigger threshold in the rule decision tree, and obtaining the rule branch trigger quantity and path depth of each of the document features in the rule decision tree; The number of rule branch triggers of each document feature in the rule decision tree is used as the number of rule triggers of the corresponding first document; The trigger strength corresponding to each of the first documents is calculated by combining the path depth of each of the document features in the rule decision tree and the branch weight of each of the rule branches.

4. The electronic archive intelligent classification method according to claim 1, characterized in that: The step of constructing a risk transmission chain network according to the document features of each of the second documents and the rule triggering results includes: Taking each of the second documents as a document node respectively; Based on the document features of each of the second documents, the sensitive word similarity, department overlap, and circulation range intersection between any two of the document nodes are calculated, and the calculation results are used as the feature association strength between the two document nodes; Normalizing the sensitive word similarity, department overlap, and circulation range intersection between any two of the document nodes to obtain a conduction probability between any two of the document nodes, and establishing a conduction path between two document nodes whose conduction probability is greater than a probability threshold; Determining the conduction direction of each conduction path according to the conduction probability of each conduction path; Based on each of the conduction paths, the conduction direction of each of the conduction paths, and each of the document nodes, a risk conduction chain network is generated.

5. The electronic archive intelligent classification method according to claim 1, characterized in that: The calculating the transmission risk value corresponding to each second document based on the plurality of document nodes and transmission paths in the risk transmission chain network includes: In the risk transmission chain network, multiple walking paths are generated with each of the document nodes as a starting point; Extracting multiple conduction sub-paths from each of the walking paths, and obtaining the length of each of the conduction sub-paths and the document node sequence passed through; For each of the document node's wandering paths, the conduction probabilities between adjacent document nodes in each of the document node sequences are multiplied to obtain the conduction strength corresponding to each of the conduction sub-paths; Based on a preset path attenuation mapping table, a path attenuation factor corresponding to the length of each of the conduction sub-paths is determined, and the product of the conduction strength of each of the conduction sub-paths and the path attenuation factor is used as the corresponding effective conduction value; The sum of the effective conduction values ​​of each conduction sub-path is used as the conduction risk value of the second document corresponding to the document node.

6. The electronic archive intelligent classification method according to claim 1, characterized in that: The classifying each of the second documents in combination with each of the transmission risk values ​​includes: Obtaining a preset risk threshold sequence, wherein the preset risk threshold sequence includes a plurality of increasing risk thresholds; Comparing the conduction risk value of each of the second documents with a plurality of risk thresholds in the risk threshold sequence to obtain a comparison result; Determining a risk threshold interval of each second document based on the comparison result; The risk category corresponding to each of the second documents is determined according to the risk threshold interval in which each of the second documents is located.

7. An electronic archive intelligent classification system, characterized in that: The system comprises: An information acquisition module is used to acquire electronic document information of the target enterprise; A document feature extraction module, used to extract document features corresponding to the plurality of first documents from the electronic document information, wherein the document features include the frequency of sensitive words, the degree of departmental relevance, and the scope of document circulation; A document screening module is used to perform rule matching on each of the document features, determine the rule triggering result of each of the first documents, the rule triggering result includes the rule triggering number and the triggering strength, and calculate the rule triggering density corresponding to the rule triggering result of each of the first documents; screen out a plurality of first documents whose rule triggering density is greater than a threshold value as the second documents respectively; A document classification module, configured to construct a risk transmission chain network according to the document features and rule triggering results of each second document, and calculate the transmission risk value corresponding to each second document based on a plurality of document nodes and transmission paths in the risk transmission chain network; classify each second document in combination with each transmission risk value, and store each classified second document in the document library of the target enterprise; The calculating the rule triggering density corresponding to the rule triggering result of each of the first documents includes: Mapping the sensitive word frequency, department relevance, and document circulation range of each of the first documents to the X-axis, Y-axis, and Z-axis in the three-dimensional coordinate system, respectively, to obtain the coordinates of the feature points corresponding to each of the first documents; Based on a preset correction coefficient mapping table, determining a correction coefficient corresponding to the trigger strength of each of the first documents, and determining the corrected target feature point coordinates of each of the first documents according to the correction coefficient and feature point coordinates of each of the first documents; Based on the coordinates of each of the target feature points, calculating the rule triggering space volume of each of the first documents in the three-dimensional coordinate system; The ratio of the number of rule triggering times of each of the first documents to the rule triggering space volume is used as the corresponding rule triggering density.

8. An electronic device, characterized in that: It includes a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the electronic archive intelligent classification method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed, the electronic archive intelligent classification method as described in any one of claims 1-6 is executed.

Images