Automotive finance system operation security analysis method and system based on artificial intelligence

Abstract

The present application provides an artificial intelligence-based automobile financial system operation security analysis method and system, which relate to the field of artificial intelligence technology. In the present application, first, for each access device, each system access action corresponding to the access device is connected according to the timing relationship between the corresponding system access actions to form a corresponding system access action link; then, based on the correlation between the access devices and the correlation between the system access actions, multiple system access action links are connected to form a corresponding system access action link network; finally, the system access action link network is analyzed through the target operation security analysis model formed by pre-training, and the operation security analysis result corresponding to the target automobile financial system is output. Based on the above content, the problem of relatively low reliability of automobile financial system operation security analysis existing in the prior art can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and more specifically, to an artificial intelligence-based automobile financial system operation security analysis method and system. Background Art

[0002] With the rapid development of information technology, automobile financial services have gradually become an important part of the modern financial industry. The automobile financial system helps consumers buy cars by providing services such as loans and installments, which has promoted the rapid development of the automobile industry. However, with the continuous expansion of the scale and complexity of these systems, the security issues of system operation have become increasingly prominent. At present, many automobile financial systems are facing potential security risks, such as malicious access, data leakage, fraud, etc. Once these risks occur, they will have a serious impact on consumers, financial institutions and even the entire industry. Existing security analysis methods for automobile financial systems mostly rely on static rules and traditional risk assessment techniques. These methods usually use preset security rules to determine whether the system has security risks. However, the reliability and accuracy of this method are low, and it is difficult to detect complex attack behaviors or abnormal patterns in a timely manner. In addition, the security analysis of existing technologies mostly relies on manual analysis and experience accumulation, and the analysis process is cumbersome and inefficient. Therefore, there is a problem of relatively low reliability overall. Summary of the invention

[0003] In view of this, the purpose of this application is to provide an artificial intelligence-based automobile financial system operation safety analysis method and system to improve the relatively low reliability of automobile financial system operation safety analysis in the prior art.

[0004] To achieve the above objectives, this application adopts the following technical solutions:

[0005] An artificial intelligence-based automobile financial system operation security analysis method includes:

[0006] Acquire target system access data corresponding to a target automobile finance system, wherein the target system access data includes each system access action corresponding to a plurality of access devices, and the system access action refers to an action of the access device accessing the target automobile finance system;

[0007] For each access device among the multiple access devices, each system access action corresponding to the access device is connected according to the timing relationship between the corresponding system access actions to form a system access action link corresponding to the access device, wherein in the system access action link, the timings corresponding to the two connected system access actions are adjacent;

[0008] Based on the correlation between access devices and the correlation between system access actions, multiple system access action links corresponding to the multiple access devices are connected to form a system access action link network corresponding to the target system access data, wherein in the system access action link network, for two connected system access actions, the two system access actions have a correlation relationship, and / or, the two access devices corresponding to the two system access actions have a correlation relationship;

[0009] The system access action link network is analyzed through a target operation safety analysis model formed by pre-training, and an operation safety analysis result corresponding to the target automobile financial system is output, wherein the target operation safety analysis model belongs to a neural network, and the operation safety analysis result is used to reflect whether there is an operation safety risk in the target automobile financial system.

[0010] In a preferred embodiment of the present application, in the above-mentioned artificial intelligence-based automobile financial system operation security analysis method, the step of connecting the multiple system access action links corresponding to the multiple access devices based on the correlation between the access devices and the correlation between the system access actions to form a system access action link network corresponding to the target system access data includes:

[0011] For each two access devices among the plurality of access devices, determining whether the similarity between the system access action links corresponding to the two access devices is higher than a preset similarity, and determining that the two access devices have a correlation relationship when the similarity is higher than the preset similarity;

[0012] For each two system access actions belonging to different system access action links, determining whether the access times and access types corresponding to the two system access actions are consistent, and when the access times and access types are consistent, determining that there is a correlation relationship between the two system access actions;

[0013] In the multiple system access action links corresponding to the multiple access devices, two system access actions with a correlation are connected, and two system access actions with a correlation between the corresponding access devices are connected to form a system access action link network corresponding to the target system access data.

[0014] In a preferred embodiment of the present application, in the above-mentioned method for analyzing the operation safety of an automobile financial system based on artificial intelligence, the target operation safety analysis model formed by pre-training analyzes the system access action link network and outputs the operation safety analysis result corresponding to the target automobile financial system, including:

[0015] Through the feature mining unit in the target operation security analysis model formed by pre-training, feature mining is performed on the action attribute information corresponding to each system access action in the system access action link network, and the initial action attribute feature corresponding to each system access action is output, wherein the action attribute information at least includes corresponding access device information, corresponding access time information, corresponding access type information and corresponding access object information;

[0016] Through the feature updating unit in the target operation security analysis model, the initial action attribute feature corresponding to each system access action is transmitted and updated according to the connection relationship in the system access action link network, so as to form an updated action attribute feature corresponding to each system access action;

[0017] By using the feature integration unit in the target operation security analysis model, the update action attribute feature corresponding to each system access action is integrated to form a corresponding global action attribute feature;

[0018] The global action attribute characteristics are subjected to security analysis through the security analysis unit in the target operational security analysis model, and an operational security analysis result corresponding to the target automobile financial system is output, wherein the security analysis unit includes a classification function for outputting the probability that the target automobile financial system has an operational security risk and the probability that the target automobile financial system does not have an operational security risk.

[0019] In a preferred embodiment of the present application, in the above-mentioned artificial intelligence-based automobile financial system operation safety analysis method, the feature mining unit in the target operation safety analysis model formed by pre-training performs feature mining on the action attribute information corresponding to each system access action in the system access action link network, and outputs the initial action attribute feature corresponding to each system access action, including:

[0020] The embedding subunit in the feature mining unit in the target operation safety analysis model formed by pre-training respectively embeds the action attribute information corresponding to each system access action in the system access action link network, and outputs the action attribute embedding feature corresponding to each system access action, wherein the feature mining unit also includes a focus mining subunit and a feature splicing subunit, and the action attribute embedding feature includes a device embedding feature corresponding to the access device information, a time embedding feature corresponding to the access time information, a type embedding feature corresponding to the access type information, and an object embedding feature corresponding to the access object information;

[0021] Through the focused mining subunit, a focused mining operation is performed on every two embedded features of the device embedded features, the time embedded features, the type embedded features and the object embedded features included in the action attribute embedded features, so that the semantic information between every two embedded features is fused to form a plurality of action attribute focused features corresponding to the action attribute embedded features;

[0022] The feature splicing subunit splices the multiple action attribute focus features to form an initial action attribute feature corresponding to the system access action.

[0023] In a preferred embodiment of the present application, in the above-mentioned artificial intelligence-based automobile financial system operation safety analysis method, the feature updating unit in the target operation safety analysis model transmits and updates the initial action attribute feature corresponding to each system access action according to the connection relationship in the system access action link network to form the step of updating the action attribute feature corresponding to each system access action, including:

[0024] For each system access action in the system access action chain network, determine the number of other system access actions that have a connection relationship with the system access action in the system access action chain network to obtain the number of connection actions corresponding to the system access action;

[0025] Based on the number of connection actions corresponding to each system access action in the system access action chain network, at least one target system access action is determined in the system access action chain network, wherein the number of connection actions corresponding to any one of the target system access actions is greater than the number of connection actions corresponding to any one of the system access actions other than the target system access action;

[0026] Through the feature updating unit in the target operation security analysis model, based on the at least one target system access action and in accordance with the connection relationship in the system access action link network, the initial action attribute feature corresponding to each system access action is transmitted and updated to form an updated action attribute feature corresponding to each system access action.

[0027] In a preferred embodiment of the present application, in the above-mentioned artificial intelligence-based automobile financial system operation safety analysis method, the feature updating unit in the target operation safety analysis model transmits and updates the initial action attribute feature corresponding to each system access action based on the at least one target system access action and according to the connection relationship in the system access action link network to form the step of updating the action attribute feature corresponding to each system access action, including:

[0028] For each target system access action in the at least one target system access action, determining the degree of connectivity between each system access action in the system access action link network and the target system access action according to the connection relationship in the system access action link network, wherein the degree of connectivity is related to the length of the shortest traversal path between the system access actions;

[0029] Determine an update level corresponding to each system access action based on the connectivity, wherein the update level of the system access action belonging to the target system access action is the highest;

[0030] Through the feature updating unit in the target operation security analysis model, based on the initial action attribute feature corresponding to the target system access action, a focused mining operation is performed on the initial action attribute feature corresponding to the system access action with the highest update level, so as to form a focused action attribute feature corresponding to the system access action with the highest update level;

[0031] Through the feature updating unit in the target operation security analysis model, for each system access action corresponding to each update level other than the highest update level, the system access action is taken as the current system access action, and based on the focused action attribute feature corresponding to the system access action of the higher update level connected to the current system access action, the initial action attribute feature corresponding to the current system access action is focused and mined, so as to form a focused action attribute feature corresponding to the current system access action;

[0032] After obtaining at least one focused action attribute feature corresponding to each system access action based on the at least one target system access action, for each system access action, based on the at least one focused action attribute feature corresponding to the system access action, determine the update action attribute feature corresponding to the system access action.

[0033] In a preferred embodiment of the present application, in the above-mentioned method for analyzing the operation safety of an automobile financial system based on artificial intelligence, the step of integrating the update action attribute features corresponding to each system access action through the feature integration unit in the target operation safety analysis model to form the corresponding global action attribute features includes:

[0034] For each system access action in the system access action chain network, determine the number of other system access actions that have a connection relationship with the system access action in the system access action chain network to obtain the number of connection actions corresponding to the system access action;

[0035] Based on the number of connection actions corresponding to each system access action in the system access action chain network, at least one target system access action is determined in the system access action chain network, wherein the number of connection actions corresponding to any one of the target system access actions is greater than the number of connection actions corresponding to any one of the system access actions other than the target system access action;

[0036] Through the feature integration unit in the target operation security analysis model, based on the at least one target system access action and in accordance with the connection relationship in the system access action link network, the update action attribute features corresponding to each system access action are integrated to form corresponding global action attribute features.

[0037] In a preferred embodiment of the present application, in the above-mentioned artificial intelligence-based automobile financial system operation safety analysis method, the step of integrating the update action attribute features corresponding to each system access action based on the at least one target system access action and the connection relationship in the system access action link network through the feature integration unit in the target operation safety analysis model to form the corresponding global action attribute features includes:

[0038] For each target system access action in the at least one target system access action, determining the degree of connectivity between each system access action in the system access action link network and the target system access action according to the connection relationship in the system access action link network, wherein the degree of connectivity is related to the length of the shortest traversal path between the system access actions;

[0039] Determining the integration level corresponding to each system access action based on the connectivity, wherein the system access action belonging to the target system access action has the highest integration level;

[0040] Through the feature integration unit in the target operation security analysis model, for each system access action at the lowest integration level, based on the update action attribute feature corresponding to the system access action, a focused mining operation is performed on the update action attribute feature corresponding to the system access action to form an integrated action attribute feature corresponding to the system access action;

[0041] Through the feature integration unit in the target operation security analysis model, for each system access action corresponding to each integration level other than the lowest integration level, the system access action is taken as the current system access action, and based on the integrated action attribute feature corresponding to the system access action of the lower integration level connected to the current system access action, the update action attribute feature corresponding to the current system access action is focused on mining the update action attribute feature, so as to form an integrated action attribute feature corresponding to the current system access action;

[0042] After obtaining the integrated action attribute feature corresponding to each target system access action, the integrated action attribute feature corresponding to each target system access action is spliced ​​to form a corresponding global action attribute feature.

[0043] In a preferred embodiment of the present application, in the above-mentioned artificial intelligence-based automobile financial system operation safety analysis method, the artificial intelligence-based automobile financial system operation safety analysis method further includes a step of training to form the target operation safety analysis model, which step includes:

[0044] Through the feature mining unit in the candidate operation safety analysis model, feature mining is performed on the action attribute information corresponding to each system access action sample in the access action link network sample, and the initial action attribute feature corresponding to each system access action sample is output, wherein the candidate operation safety analysis model also includes a feature updating unit, a feature integration unit and a safety analysis unit;

[0045] By means of the feature updating unit, the initial action attribute feature corresponding to each system access action sample is transmitted and updated according to the connection relationship in the access action link network sample, so as to form an updated action attribute feature corresponding to each system access action sample;

[0046] By means of the feature integration unit, the update action attribute features corresponding to each system access action sample are integrated to form a corresponding global action attribute feature sample;

[0047] Through the security analysis unit, the global action attribute feature sample is subjected to security analysis, and an operation security analysis result sample corresponding to the access action link network sample is output;

[0048] Based on the error between the operation safety analysis result sample and the operation safety risk label corresponding to the access action link network sample, the parameters in the candidate operation safety analysis model are updated to form a corresponding target operation safety analysis model.

[0049] On the basis of the above, the present application also provides an artificial intelligence-based automobile financial system operation security analysis method system, including:

[0050] Memory for storing computer programs;

[0051] The processor connected to the memory is used to execute the computer program stored in the memory to implement the above-mentioned artificial intelligence-based automobile financial system operation security analysis method.

[0052] The artificial intelligence-based automobile financial system operation security analysis method and system provided in the present application first obtain target system access data corresponding to the target automobile financial system; secondly, for each access device among multiple access devices, each system access action corresponding to the access device is connected according to the timing relationship between the corresponding system access actions to form a system access action link corresponding to the access device; then, based on the correlation relationship between the access devices and the correlation relationship between the system access actions, multiple system access action links corresponding to the multiple access devices are connected to form a system access action link network corresponding to the target system access data; finally, the system access action link network is analyzed through the target operation security analysis model formed by pre-training, and the operation security analysis result corresponding to the target automobile financial system is output. Based on the above content, based on the correlation between access devices and the correlation between system access actions, multiple system access action links corresponding to multiple access devices are connected to form a system access action link network corresponding to the target system access data, so that the system access action link network can be fully analyzed. In this way, compared with the conventional technical solution of analyzing a single device or a single system access action, the basis of the analysis can be more sufficient and comprehensive, making the reliability of the analysis higher, thereby improving the relatively low reliability of the safety analysis of the operation of the automobile financial system in the prior art. In addition, based on the analysis of neural networks, the powerful learning ability of neural networks can be fully utilized, which can improve the efficiency of the analysis while improving the reliability of the analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings.

[0054] Figure 1 A structural block diagram of an electronic device provided in an embodiment of the present application.

[0055] Figure 2 A flowchart of an artificial intelligence-based automobile finance system operation security analysis method provided in an embodiment of the present application.

[0056] Figure 3 A schematic diagram of a system access action link network provided in an embodiment of the present application.

[0057] Figure 4 A schematic diagram of delivering updates provided in an embodiment of the present application.

[0058] Figure 5 A schematic diagram of feature integration provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0060] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0061] like Figure 1 As shown, an embodiment of the present application provides an electronic device, wherein the electronic device may include a memory and a processor.

[0062] In detail, the memory and the processor are directly or indirectly electrically connected to realize data transmission or interaction. For example, the memory and the processor can be electrically connected through one or more communication buses or signal lines. The processor is used to execute the executable computer program stored in the memory to implement the artificial intelligence-based automobile financial system operation security analysis method provided in the embodiment of the present application.

[0063] Optionally, the memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc.

[0064] Furthermore, the processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), a system on chip (SoC), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0065] Understandably, Figure 1 The structure shown is for illustration only, and the electronic device may also include Figure 1 More or fewer components as shown, or with Figure 1 The different configurations shown, for example, may also include a communication unit for exchanging information with other devices (such as an automobile financial system, etc.).

[0066] Combination Figure 2 The embodiment of the present application also provides an artificial intelligence-based automobile financial system operation safety analysis method that can be applied to the above electronic device. Among them, the method steps defined in the process related to the artificial intelligence-based automobile financial system operation safety analysis method can be implemented by the electronic device. Figure 2 The specific process shown is explained in detail.

[0067] Step S110, obtaining target system access data corresponding to the target automobile financial system.

[0068] In the embodiment of the present application, the electronic device can obtain the target system access data corresponding to the target automobile financial system. The target system access data includes each system access action corresponding to multiple access devices (network devices, such as mobile phones, computers, etc.), and the system access action refers to the action of the access device to access the target automobile financial system, such as data reading, writing, modifying, deleting, encrypting, etc.

[0069] Step S120 , for each access device among the multiple access devices, each system access action corresponding to the access device is connected according to the timing relationship between the corresponding system access actions to form a system access action link corresponding to the access device.

[0070] In an embodiment of the present application, after acquiring the target system access data, the electronic device can connect each system access action corresponding to the access device according to the timing relationship between the corresponding system access actions for each access device among the multiple access devices, so as to form a system access action link corresponding to the access device. Wherein, in the system access action link, the timings corresponding to the two connected system access actions are adjacent, such as access device 1 performs a data read action on the target automobile financial system at time 1, performs a data modification action on the target automobile financial system at time 2, performs a data read action on the target automobile financial system at time 3, performs a data read action on the target automobile financial system at time 4, and performs a data read action on the target automobile financial system at time 5.

[0071] Step S130, based on the correlation between access devices and the correlation between system access actions, multiple system access action links corresponding to the multiple access devices are connected to form a system access action link network corresponding to the target system access data.

[0072] In the embodiment of the present application, after forming the system access action link, the electronic device can connect the multiple system access action links corresponding to the multiple access devices based on the correlation between the access devices and the correlation between the system access actions to form a system access action link network corresponding to the target system access data, such as Figure 3 As shown. Among them, in the system access action link network, for two connected system access actions, the two system access actions have a correlation relationship, and / or, the two access devices corresponding to the two system access actions have a correlation relationship. In other words, either the system access actions have a correlation relationship, or the corresponding access devices have a correlation relationship, or the system access actions have a correlation relationship and the corresponding access devices have a correlation relationship.

[0073] Step S140 , analyzing the system access action link network through the target operation safety analysis model formed by pre-training, and outputting the operation safety analysis result corresponding to the target automobile financial system.

[0074] In the embodiment of the present application, after forming the system access action link network, the electronic device can analyze the system access action link network through the target operation safety analysis model formed by pre-training, and output the operation safety analysis result corresponding to the target automobile financial system. Wherein, the target operation safety analysis model belongs to a neural network, and the operation safety analysis result is used to reflect whether there is an operation safety risk in the target automobile financial system.

[0075] Based on the above content, based on the correlation between access devices and the correlation between system access actions, multiple system access action links corresponding to multiple access devices are connected to form a system access action link network corresponding to the target system access data, so that the system access action link network can be fully analyzed. In this way, compared with the conventional technical solution of analyzing a single device or a single system access action, the basis of the analysis can be more sufficient and comprehensive, making the reliability of the analysis higher, thereby improving the relatively low reliability of the safety analysis of the operation of the automobile financial system in the prior art. In addition, based on the analysis of neural networks, the powerful learning ability of neural networks can be fully utilized. While improving the reliability of the analysis, it can also improve the efficiency of the analysis, reduce labor costs, etc., and has a high application value.

[0076] It should be noted that for step S130, the specific manner of connecting the multiple system access action links corresponding to the multiple access devices is not limited and can be selected according to actual needs.

[0077] For example, in an alternative implementation, in order to fully characterize the correlation between system access actions through the formed system access action link network to ensure the reliability of subsequent overall analysis, the above step S130 may further include the following contents:

[0078] First, for each two access devices among the multiple access devices, determine whether the similarity between the system access action links corresponding to the two access devices is higher than a preset similarity, and when the similarity is higher than the preset similarity, determine that the two access devices have a correlation relationship; illustratively, the overlap of the system access actions between the two system access action links can be calculated, and the overlap can be used as the corresponding similarity. In addition, the specific value of the preset similarity is not limited and can be configured according to actual conditions, such as 0.5, 0.6, 0.7, 0.8, etc.;

[0079] Secondly, for each two system access actions belonging to different system access action links, it is determined whether the access time and access type corresponding to the two system access actions are consistent, and when the access time and access type are consistent, it is determined that there is a correlation between the two system access actions, that is, if two access devices simultaneously perform the same type of system access action on the target automobile financial system, the system access actions can be considered to be correlated;

[0080] Then, in the multiple system access action links corresponding to the multiple access devices, two system access actions with a correlation are connected, and two system access actions with a correlation between the corresponding access devices are connected to form a system access action link network corresponding to the target system access data.

[0081] It should be noted that for step S140, the specific method of analyzing the system access action link network is not limited and can be selected according to actual needs.

[0082] For example, in an alternative implementation, in order to achieve a comprehensive analysis of the system access action link network so that the output operation safety analysis results have higher reliability, the above-mentioned step S140 can further include step S141, step S142, step S143 and step S144, and the specific content of each step is as follows.

[0083] Step S141, through the feature mining unit in the pre-trained target operation safety analysis model, feature mining is performed on the action attribute information corresponding to each system access action in the system access action link network, and the initial action attribute feature corresponding to each system access action is output.

[0084] In an embodiment of the present application, the feature mining unit in the target operation security analysis model formed by pre-training can be used to perform feature mining on the action attribute information corresponding to each system access action in the system access action link network, and output the initial action attribute features corresponding to each system access action. Wherein, the action attribute information at least includes the corresponding access device information (such as 1. Device identification information: device name: such as router, switch, firewall, server, etc.; device model: specific model or series of the device; device manufacturer: manufacturer information of the device; 2. Network interface information: interface IP address: IP address of each network interface (such as LAN interface, WAN interface) on the device; MAC address: physical address of the device, used for the unique identification of the device in the local area network; subnet mask: determine the range of the subnet where the device is located; gateway address: the default gateway for the device to connect to other networks), corresponding access time information, corresponding access type information (i.e. action type, as described above) and corresponding access object information (i.e. the type of data accessed, overview or all information of the data, etc.).

[0085] Step S142, through the feature update unit in the target operation security analysis model, the initial action attribute feature corresponding to each system access action is transmitted and updated according to the connection relationship in the system access action link network to form an updated action attribute feature corresponding to each system access action.

[0086] In an embodiment of the present application, after the initial action attribute features are mined, the initial action attribute features corresponding to each system access action can be transferred and updated through the feature update unit in the target operation security analysis model according to the connection relationship in the system access action link network to form updated action attribute features corresponding to each system access action. In other words, the initial action attribute features can be transferred and updated according to the path formed by the connection relationship. For example, the semantic information in the initial action attribute features corresponding to system access action 1 can be transferred to the semantic information in the initial action attribute features corresponding to system access action 2 to achieve the update of the initial action attribute features corresponding to system access action 2 and obtain the corresponding updated action attribute features. In this way, since there is a correlation between the connected system access actions, the transfer and update based on the corresponding connection relationship can make the updated action attribute features have reliable and rich semantic information, thereby improving the reliability of subsequent analysis.

[0087] Step S143 , integrating the update action attribute feature corresponding to each system access action through the feature integration unit in the target operation security analysis model to form a corresponding global action attribute feature.

[0088] In the embodiment of the present application, after obtaining the update action attribute feature, the update action attribute feature corresponding to each system access action can be integrated through the feature integration unit in the target operation security analysis model to form a corresponding global action attribute feature. That is to say, the global action attribute feature can have the semantic information in the update action attribute feature corresponding to each system access action, so that the semantic information can be richer.

[0089] Step S144, performing security analysis on the global action attribute characteristics through the security analysis unit in the target operation security analysis model, and outputting the operation security analysis result corresponding to the target automobile financial system.

[0090] In an embodiment of the present application, after obtaining the global action attribute feature, the global action attribute feature can be subjected to security analysis through the security analysis unit in the target operation safety analysis model, and the operation safety analysis result corresponding to the target automobile financial system can be output. Among them, the security analysis unit includes a classification function, which is used to output the probability that the target automobile financial system has an operation safety risk and the probability that the operation safety risk does not exist. Specifically, the security analysis unit can first perform full connection processing on the global action attribute feature, and then map the fully connected processed features through the classification function (such as softmax, etc.), so as to obtain the probability that the target automobile financial system has an operation safety risk and the probability that the operation safety risk does not exist, and finally, the result with a larger probability is determined as the operation safety analysis result.

[0091] It is understandable that, in the above step S141, the specific method of performing feature mining on the action attribute information corresponding to each system access action in the system access action link network is not limited and can be selected according to actual needs. For example, in an alternative implementation, in order to ensure that the mined initial action attribute features have a more accurate semantic representation capability, the above step S141 can further include the following contents:

[0092] First, the action attribute information corresponding to each system access action in the system access action link network can be embedded by an embedding subunit (which can be a word embedding model) in a feature mining unit in a pre-trained target operation safety analysis model, and action attribute embedding features corresponding to each system access action can be output, wherein the feature mining unit also includes a focus mining subunit and a feature splicing subunit, and the action attribute embedding features include device embedding features corresponding to access device information, time embedding features corresponding to access time information, type embedding features corresponding to access type information, and object embedding features corresponding to access object information;

[0093] Secondly, the focused mining subunit can be used to perform focused mining operations on every two embedded features of the device embedded features, time embedded features, type embedded features and object embedded features included in the action attribute embedded features, so that the semantic information between every two embedded features is fused to form a plurality of action attribute focused features corresponding to the action attribute embedded features; illustratively, the object embedded features can be focused and mined based on the device embedded features, time embedded features and type embedded features, respectively, to obtain three corresponding action attribute focused features; the type embedded features can be focused and mined based on the device embedded features, time embedded features and object embedded features, respectively, to obtain three corresponding action attribute focused features; the time embedded features can be focused and mined based on the device embedded features, type embedded features and object embedded features, respectively, to obtain three corresponding action attribute focused features; the device embedded features can be focused and mined based on the time embedded features, type embedded features and object embedded features, respectively, to obtain three corresponding action attribute focused features; wherein the specific method of the focused mining operation is described below;

[0094] Then, the multiple action attribute focused features can be spliced ​​together through the feature splicing sub-unit to form the initial action attribute feature corresponding to the system access action; or, in other embodiments, based on the consideration of the amount of calculation, the multiple action attribute focused features can be averaged to obtain the corresponding initial action attribute feature; or, after the multiple action attribute focused features are spliced ​​together, corresponding compression can be performed through pooling processing.

[0095] It is understandable that, in the above step S142, the specific method of transmitting and updating the initial action attribute characteristics corresponding to each system access action is not limited and can be selected according to actual needs. For example, in an alternative implementation, in order to take into account the reliability and efficiency of the transmission update, the above step S142 can further include step S142a, step S142b and step S142c, and the specific content of each step is as follows.

[0096] Step S142a, for each system access action in the system access action chain network, determine the number of other system access actions that have a connection relationship with the system access action in the system access action chain network, and obtain the number of connection actions corresponding to the system access action.

[0097] In an embodiment of the present application, for each system access action in the system access action chain network, the number of other system access actions that have a connection relationship with the system access action can be determined in the system access action chain network, and the number of connection actions corresponding to the system access action can be obtained, that is, the number of directly connected gas system access actions.

[0098] Step S142b: Based on the number of connection actions corresponding to each system access action in the system access action link network, at least one target system access action is determined in the system access action link network.

[0099] In an embodiment of the present application, after obtaining the number of connection actions, at least one target system access action can be determined in the system access action chain network based on the number of connection actions corresponding to each system access action in the system access action chain network. The number of connection actions corresponding to any one of the target system access actions is greater than the number of connection actions corresponding to any one of the system access actions other than the target system access action. For example, the number of connection actions with the maximum value can be determined, and then each system access action corresponding to the number of connection actions can be used as the target system access action, thereby obtaining at least one target system access action.

[0100] Step S142c, through the feature update unit in the target operation security analysis model, based on the at least one target system access action and in accordance with the connection relationship in the system access action link network, the initial action attribute feature corresponding to each system access action is transmitted and updated to form an updated action attribute feature corresponding to each system access action.

[0101] In an embodiment of the present application, after the target system access action is determined, the initial action attribute feature corresponding to each system access action can be transferred and updated based on the at least one target system access action and the connection relationship in the system access action link network through the feature update unit in the target operation security analysis model, so as to form an updated action attribute feature corresponding to each system access action. Exemplarily, the semantic information in the initial action attribute feature corresponding to the target system access action can be sequentially transferred to the initial action attribute features corresponding to other system access actions based on the corresponding connection relationship, so as to form an updated action attribute feature.

[0102] It is understandable that, in the above step S142c, the specific method of transferring and updating the initial action attribute characteristics corresponding to each system access action is not limited and can be selected according to actual needs. For example, in an alternative implementation, in order to ensure that the semantic information in the initial action attribute characteristics corresponding to the target system access action can be effectively transferred and updated, the above step S142c can further include the following content:

[0103] First, for each target system access action in the at least one target system access action, the degree of connectivity between each system access action in the system access action link network and the target system access action is determined according to the connection relationship in the system access action link network, wherein the degree of connectivity is related to the length of the shortest traversal path between the system access actions, such as the smaller the length of the shortest traversal path, the greater the corresponding degree of connectivity, and the closer the relationship;

[0104] Secondly, the update level corresponding to each system access action is determined based on the connectivity, wherein the system access action belonging to the target system access action has the highest update level. That is to say, the greater the connectivity, the higher the corresponding update level. In this way, the semantic information centered on the target system access action can be diffused outward, such as Figure 4 As shown, the system access action 9 is the target system access action, and the corresponding update level is the highest;

[0105] Then, through the feature updating unit in the target operation security analysis model, based on the initial action attribute feature corresponding to the target system access action, a focused mining operation is performed on the initial action attribute feature corresponding to the system access action with the highest update level, so as to form a focused action attribute feature corresponding to the system access action with the highest update level, so that the semantic information in the initial action attribute feature corresponding to the target system access action can be transferred to the initial action attribute feature corresponding to the system access action with the highest update level;

[0106] Afterwards, through the feature updating unit in the target operation security analysis model, for each system access action corresponding to each update level other than the highest update level, the system access action is taken as the current system access action, and based on the focused action attribute feature corresponding to the system access action of the higher update level connected to the current system access action, the initial action attribute feature corresponding to the current system access action is focused and mined, so as to form a focused action attribute feature corresponding to the current system access action; illustratively, based on the focused action attribute feature corresponding to the system access action of the update level 3, the initial action attribute feature corresponding to the system access action of the update level 2 can be focused and mined, and based on the focused action attribute feature corresponding to the system access action of the update level 2, the initial action attribute feature corresponding to the system access action of the update level 1 can be focused and mined; in addition, if there are multiple system access actions of the higher update level connected to the current system access action, the initial action attribute feature corresponding to the current system access action can be focused and mined based on the focused action attribute feature corresponding to each system access action of the higher update level, and then the results of the focused and mined operation can be averaged to obtain a corresponding focused action attribute feature;

[0107] Finally, after obtaining at least one focused action attribute feature corresponding to each system access action based on the at least one target system access action, for each system access action, based on the at least one focused action attribute feature corresponding to the system access action, determine the update action attribute feature corresponding to the system access action; exemplarily, when there are multiple target system access actions, each system access action corresponds to multiple focused action attribute features, so that the multiple focused action attribute features can be averaged to obtain the corresponding update action attribute feature.

[0108] It is understandable that, in the above step S143, the specific method of integrating the update action attribute features corresponding to each system access action is not limited and can be selected according to actual needs. For example, in an alternative implementation, in order to take into account the reliability and efficiency of feature integration, the above step S143 can further include step S143a, step S143b and step S143c, and the specific content of each step is as follows.

[0109] Step S143a, for each system access action in the system access action chain network, determine the number of other system access actions that have a connection relationship with the system access action in the system access action chain network, and obtain the number of connection actions corresponding to the system access action.

[0110] In an embodiment of the present application, for each system access action in the system access action chain network, the number of other system access actions that have a connection relationship with the system access action is determined in the system access action chain network, and the number of connection actions corresponding to the system access action is obtained, as described above.

[0111] Step S143b: Based on the number of connection actions corresponding to each system access action in the system access action link network, at least one target system access action is determined in the system access action link network.

[0112] In an embodiment of the present application, at least one target system access action can be determined in the system access action chain network based on the number of connection actions corresponding to each system access action in the system access action chain network, as described above. The number of connection actions corresponding to any one of the target system access actions is greater than the number of connection actions corresponding to any one of the system access actions other than the target system access action.

[0113] Step S143c, through the feature integration unit in the target operation security analysis model, based on the at least one target system access action and in accordance with the connection relationship in the system access action link network, the update action attribute features corresponding to each system access action are integrated to form corresponding global action attribute features.

[0114] In an embodiment of the present application, through the feature integration unit in the target operation security analysis model, based on the at least one target system access action and according to the connection relationship in the system access action link network, the update action attribute feature corresponding to each system access action is integrated to form a corresponding global action attribute feature. Exemplarily, the semantic information in the update action attribute feature corresponding to each system access action can be integrated into the update action attribute feature corresponding to the at least one target system access action according to the corresponding connection relationship, thereby obtaining a global action attribute feature with richer semantic information.

[0115] It is understandable that, in the above step S143c, the specific method of integrating the update action attribute features corresponding to each system access action is not limited and can be selected according to actual needs. For example, in an alternative implementation, in order to improve the reliability of feature integration, so that the formed global action attribute features can characterize the global semantic information of the system access action of the target automobile financial system, the above step S143c may include the following contents:

[0116] First, for each target system access action in the at least one target system access action, the degree of connectivity between each system access action in the system access action link network and the target system access action is determined based on the connection relationship in the system access action link network, wherein the degree of connectivity is related to the length of the shortest traversal path between the system access actions, as described above;

[0117] Secondly, the integration level corresponding to each system access action is determined based on the connectivity, wherein the system access action belonging to the target system access action has the highest integration level; that is, the greater the connectivity, the higher the corresponding integration level, so that the semantic information of the update action attribute features corresponding to each system access action can be integrated into the update action attribute features corresponding to the target system access action, such as Figure 5 As shown, the system access action 9 is the target system access action, and the corresponding integration level is the highest;

[0118] Then, through the feature integration unit in the target operation security analysis model, for each system access action at the lowest integration level, based on the update action attribute feature corresponding to the system access action, a focused mining operation is performed on the update action attribute feature corresponding to the system access action to form an integrated action attribute feature corresponding to the system access action;

[0119] Afterwards, through the feature integration unit in the target operation security analysis model, for each system access action corresponding to each integration level other than the lowest integration level, the system access action is taken as the current system access action, and based on the integrated action attribute feature corresponding to the system access action of the lower integration level connected to the current system access action, the update action attribute feature corresponding to the current system access action is focused on mining operations to form an integrated action attribute feature corresponding to the current system access action; illustratively, the dot product between the integrated action attribute feature and the transposed feature of the update action attribute feature can be calculated, and then, based on the dot product, the update action attribute feature is weightedly summed to obtain an integrated action attribute feature corresponding to the current system access action; or In some other implementations, the feature integration unit has a first parameter matrix, a second parameter matrix, and a third parameter matrix. In this way, the first parameter matrix and the integrated action attribute feature can be multiplied to obtain a first multiplication matrix, and the second parameter matrix and the third parameter matrix can be multiplied with the update action attribute feature respectively to obtain a second multiplication matrix and a third multiplication matrix. Then, the dot product calculation can be performed on the transposed matrix of the first multiplication matrix and the second multiplication matrix. After that, the weighted sum calculation can be performed on the third multiplication matrix based on the obtained dot product to realize the focused mining operation; in addition, when there are multiple system access actions at a lower integration level connected, the focused mining operation can be performed separately, and then the results of the focused mining operation are averaged to obtain a corresponding integrated action attribute feature;

[0120] Finally, after obtaining the integrated action attribute features corresponding to each of the target system access actions, the integrated action attribute features corresponding to each of the target system access actions are spliced ​​to form corresponding global action attribute features; illustratively, the integrated action attribute features corresponding to each of the target system access actions can be averaged to obtain corresponding global action attribute features; or, after splicing the integrated action attribute features corresponding to each of the target system access actions, the spliced ​​features can be pooled to achieve compression.

[0121] It should be further explained that, in order to ensure that the target operation safety analysis model can reliably implement the above content, in an alternative implementation, the artificial intelligence-based automobile financial system operation safety analysis method further includes a step of training to form the target operation safety analysis model, which step may further include the following content:

[0122] First, through the feature mining unit in the candidate operation safety analysis model, feature mining is performed on the action attribute information corresponding to each system access action sample in the access action link network sample, and the initial action attribute feature corresponding to each system access action sample is output, wherein the candidate operation safety analysis model also includes a feature updating unit, a feature integration unit and a safety analysis unit; the specific mining process is as described above;

[0123] Secondly, through the feature updating unit, according to the connection relationship in the access action link network sample, the initial action attribute feature corresponding to each system access action sample is transferred and updated to form an updated action attribute feature corresponding to each system access action sample; the specific process of transfer and update is as described above;

[0124] Then, the update action attribute features corresponding to each system access action sample are integrated through the feature integration unit to form a corresponding global action attribute feature sample; the feature integration process is as described above;

[0125] Further, the security analysis unit performs security analysis on the global action attribute feature sample, and outputs the operation security analysis result sample corresponding to the access action link network sample; the security analysis process is as described above;

[0126] Finally, based on the error (such as cross entropy error, etc.) between the operation safety risk labels corresponding to the operation safety analysis result sample and the access action link network sample, the parameters in the candidate operation safety analysis model are updated to form a corresponding target operation safety analysis model; exemplarily, the parameters in the candidate operation safety analysis model can be updated in the direction of reducing the error until the error is reduced to a preset value or the error reduction is less than a preset value, indicating that the update is completed. In this way, the corresponding target operation safety analysis model can be constructed based on the current parameters of the candidate operation safety analysis model, or the current candidate operation safety analysis model can be used as the corresponding target operation safety analysis model.

[0127] Finally, it should be noted that the above-mentioned features can be expressed in the form of vectors.

[0128] In summary, the artificial intelligence-based automobile financial system operation security analysis method and system provided by the present application first obtain the target system access data corresponding to the target automobile financial system; secondly, for each access device among multiple access devices, each system access action corresponding to the access device is connected according to the timing relationship between the corresponding system access actions to form a system access action link corresponding to the access device; then, based on the correlation between the access devices and the correlation between the system access actions, multiple system access action links corresponding to the multiple access devices are connected to form a system access action link network corresponding to the target system access data; finally, the system access action link network is analyzed through the target operation security analysis model formed by pre-training, and the operation security analysis result corresponding to the target automobile financial system is output. Based on the above content, based on the correlation between access devices and the correlation between system access actions, multiple system access action links corresponding to multiple access devices are connected to form a system access action link network corresponding to the target system access data, so that the system access action link network can be fully analyzed. In this way, compared with the conventional technical solution of analyzing a single device or a single system access action, the basis of the analysis can be more sufficient and comprehensive, making the reliability of the analysis higher, thereby improving the relatively low reliability of the safety analysis of the operation of the automobile financial system in the prior art. In addition, based on the analysis of neural networks, the powerful learning ability of neural networks can be fully utilized, which can improve the efficiency of the analysis while improving the reliability of the analysis.

[0129] In several embodiments provided in the embodiments of the present application, it should be understood that the disclosed device and method can also be implemented in other ways. The device and method embodiments described above are merely schematic, for example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the device, method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0130] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0131] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, electronic device, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code. It should be noted that in this article, the term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such process, method, article or device. Without more constraints, an element defined by the phrase "comprising a..." does not exclude the existence of other identical elements in the process, method, article or apparatus comprising the element.

[0132] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An artificial intelligence-based automobile finance system operation security analysis method, characterized in that: The artificial intelligence-based automobile finance system operation safety analysis method includes: Acquire target system access data corresponding to a target automobile finance system, wherein the target system access data includes each system access action corresponding to a plurality of access devices, and the system access action refers to an action of the access device accessing the target automobile finance system; For each access device among the multiple access devices, each system access action corresponding to the access device is connected according to the timing relationship between the corresponding system access actions to form a system access action link corresponding to the access device, wherein in the system access action link, the timings corresponding to the two connected system access actions are adjacent; For each two access devices, determine whether the similarity between the corresponding system access action links is higher than a preset similarity, and when the similarity is higher than the preset similarity, determine that the two access devices have a correlation relationship; for each two system access actions belonging to different system access action links, determine whether the corresponding access time and access type are consistent, and when the access time and access type are consistent, determine that the two system access actions have a correlation relationship; connect the two system access actions with a correlation relationship, and connect the two system access actions with a correlation relationship between the corresponding access devices to form a system access action link network; The feature mining unit in the target operation safety analysis model formed by pre-training performs feature mining on the action attribute information corresponding to each system access action, and outputs the corresponding initial action attribute features, wherein the action attribute information at least includes access device information, access time information, access type information and access object information; for each system access action, the number of other system access actions that have a connection relationship with the system access action is determined to obtain the corresponding number of connection actions; based on the number of connection actions corresponding to each system access action, at least one target system access action is determined, wherein the number of connection actions corresponding to any target system access action is greater than that of any other system access action other than the target system access action. The number of connection actions corresponding to a system access action; for each target system access action, according to the connection relationship in the system access action link network, determine the degree of connection between each system access action in the system access action link network and the target system access action, wherein the degree of connection is related to the length of the shortest traversal path between the system access actions; based on the degree of connection, determine the update level corresponding to each system access action, wherein the system access action belonging to the target system access action has the highest update level; through the feature update unit in the target operation security analysis model, based on the initial action attribute feature corresponding to the target system access action, update the system access action with the highest update level The initial action attribute feature corresponding to the action is subjected to a focused mining operation to form a focused action attribute feature corresponding to the system access action with the highest update level; through the feature updating unit in the target operation safety analysis model, for each system access action corresponding to each update level other than the highest update level, the system access action is taken as the current system access action, and based on the focused action attribute feature corresponding to the system access action of the next update level connected to the current system access action, the initial action attribute feature corresponding to the current system access action is subjected to a focused mining operation to form a corresponding focused action attribute feature; after obtaining at least one focused action attribute feature corresponding to each system access action based on the at least one target system access action, for each system access action, based on the at least one focused action attribute feature corresponding to the system access action, a corresponding update action attribute feature is determined; through the feature integration unit in the target operation safety analysis model, the update action attribute feature corresponding to each system access action is integrated to form a corresponding global action attribute feature; through the security analysis unit in the target operation safety analysis model, the global action attribute feature is subjected to security analysis to output a corresponding operation safety analysis result, wherein the target operation safety analysis model belongs to a neural network, and the operation safety analysis result is used to reflect whether the target automobile financial system has an operation safety risk.

2. The method for analyzing the operation safety of automobile financial system based on artificial intelligence according to claim 1 is characterized in that: The feature mining unit in the target operation safety analysis model formed by pre-training performs feature mining on the action attribute information corresponding to each system access action in the system access action link network, and outputs the initial action attribute feature corresponding to each system access action, including: The embedding subunit in the feature mining unit in the target operation safety analysis model formed by pre-training respectively embeds the action attribute information corresponding to each system access action in the system access action link network, and outputs the action attribute embedding feature corresponding to each system access action, wherein the feature mining unit also includes a focus mining subunit and a feature splicing subunit, and the action attribute embedding feature includes a device embedding feature corresponding to the access device information, a time embedding feature corresponding to the access time information, a type embedding feature corresponding to the access type information, and an object embedding feature corresponding to the access object information; Through the focused mining subunit, a focused mining operation is performed on every two embedded features of the device embedded features, the time embedded features, the type embedded features and the object embedded features included in the action attribute embedded features, so that the semantic information between every two embedded features is fused to form a plurality of action attribute focused features corresponding to the action attribute embedded features; The feature splicing subunit splices the multiple action attribute focus features to form an initial action attribute feature corresponding to the system access action.

3. The method for analyzing the operation safety of automobile financial system based on artificial intelligence according to claim 1 is characterized in that: The step of integrating the update action attribute feature corresponding to each system access action through the feature integration unit in the target operation security analysis model to form the corresponding global action attribute feature includes: For each system access action in the system access action chain network, determine the number of other system access actions that have a connection relationship with the system access action in the system access action chain network to obtain the number of connection actions corresponding to the system access action; Based on the number of connection actions corresponding to each system access action in the system access action chain network, at least one target system access action is determined in the system access action chain network, wherein the number of connection actions corresponding to any one of the target system access actions is greater than the number of connection actions corresponding to any one of the system access actions other than the target system access action; Through the feature integration unit in the target operation security analysis model, based on the at least one target system access action and in accordance with the connection relationship in the system access action link network, the update action attribute features corresponding to each system access action are integrated to form corresponding global action attribute features.

4. The method for analyzing the operation safety of automobile financial system based on artificial intelligence according to claim 3 is characterized in that: The step of integrating the update action attribute feature corresponding to each system access action based on the at least one target system access action and the connection relationship in the system access action link network through the feature integration unit in the target operation security analysis model to form the corresponding global action attribute feature includes: For each target system access action in the at least one target system access action, determining the degree of connectivity between each system access action in the system access action link network and the target system access action according to the connection relationship in the system access action link network, wherein the degree of connectivity is related to the length of the shortest traversal path between the system access actions; Determining the integration level corresponding to each system access action based on the connectivity, wherein the system access action belonging to the target system access action has the highest integration level; Through the feature integration unit in the target operation security analysis model, for each system access action at the lowest integration level, based on the update action attribute feature corresponding to the system access action, a focused mining operation is performed on the update action attribute feature corresponding to the system access action to form an integrated action attribute feature corresponding to the system access action; Through the feature integration unit in the target operation security analysis model, for each system access action corresponding to each integration level other than the lowest integration level, the system access action is taken as the current system access action, and based on the integrated action attribute feature corresponding to the system access action of the lower integration level connected to the current system access action, the update action attribute feature corresponding to the current system access action is focused on mining the update action attribute feature, so as to form an integrated action attribute feature corresponding to the current system access action; After obtaining the integrated action attribute feature corresponding to each target system access action, the integrated action attribute feature corresponding to each target system access action is spliced ​​to form a corresponding global action attribute feature.

5. The method for analyzing the operation safety of automobile financial system based on artificial intelligence according to claim 1 is characterized in that: The method for analyzing the operation safety of the automobile financial system based on artificial intelligence also includes a step of training and forming the target operation safety analysis model, which step includes: Through the feature mining unit in the candidate operation safety analysis model, feature mining is performed on the action attribute information corresponding to each system access action sample in the access action link network sample, and the initial action attribute feature corresponding to each system access action sample is output, wherein the candidate operation safety analysis model also includes a feature updating unit, a feature integration unit and a safety analysis unit; By means of the feature updating unit, the initial action attribute feature corresponding to each system access action sample is transmitted and updated according to the connection relationship in the access action link network sample, so as to form an updated action attribute feature corresponding to each system access action sample; By means of the feature integration unit, the update action attribute features corresponding to each system access action sample are integrated to form a corresponding global action attribute feature sample; Through the security analysis unit, the global action attribute feature sample is subjected to security analysis, and an operation security analysis result sample corresponding to the access action link network sample is output; Based on the error between the operation safety analysis result sample and the operation safety risk label corresponding to the access action link network sample, the parameters in the candidate operation safety analysis model are updated to form a corresponding target operation safety analysis model.

6. An artificial intelligence-based automobile finance system operation safety analysis system, characterized in that: The automobile finance system operation safety analysis system based on artificial intelligence includes: Memory for storing computer programs; A processor connected to the memory is used to execute the computer program stored in the memory to implement the artificial intelligence-based automobile financial system operation security analysis method described in any one of claims 1 to 5.

Images