Potential risk data screening method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a potential risk data screening method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining risk data and potential risk data, the risk data being data monitored by a risk monitoring system, and the potential risk data being data not included in the monitoring range of the risk monitoring system; inputting the risk data and the potential risk data into a pre-trained risk prediction model, and calculating a plurality of similarity matrixes through a plurality of association prediction algorithms in the risk prediction model, the similarity matrixes being used for representing a potential association relationship between the risk data and the potential risk data; weighting the plurality of similarity matrixes based on the target weighted value to obtain a comprehensive similarity matrix; and according to the comprehensive similarity matrix, target potential risk data is screened out from the potential risk data, and the target potential risk data is data having an association relationship with the risk data.

Description

Technical Field

[0001] The present application belongs to the field of data processing technology, and in particular, relates to a method, device, electronic device and storage medium for screening potential risk data. Background Art

[0002] The risk audit system of telecom operators needs to regularly process a large amount of suspected risk data output by risk audit points. The existing audit method mainly relies on manual verification, which is inefficient and has the risk of omissions. The risk audit system of telecom operators contains many risk audit points, which are audited and responded to by various departments or branches. However, the current audit method is inefficient and prone to omissions. At the same time, the existing risk audit model may not be able to fully and accurately mine abnormal problems in telecom services, such as anomalies in telecom business operations, telecom system vulnerabilities, telecom product configuration, telecom business development, and telecom package marketing.

[0003] In the process of discovering abnormal problems in telecommunications services, most existing risk audit models use single feature extraction preprocessing and then use existing conventional models to directly input prior data for training. For the training results obtained from multi-correlated features, they do not have good result expression and feature capture capabilities, and the final result accuracy often does not achieve the expected high-precision effect.

[0004] Therefore, a new technical solution is urgently needed to improve the accuracy of risk prediction, optimize the risk monitoring process, reduce the burden of manual investigation, and more comprehensively cover various abnormal problems in telecommunications services. Summary of the invention

[0005] The embodiments of the present application provide a method, device, equipment and storage medium for screening potential risk data, which can solve the problem that a new technical solution is urgently needed to improve the accuracy of risk prediction.

[0006] In a first aspect, an embodiment of the present application provides a method for screening potential risk data, the method comprising:

[0007] Obtain risk data and potential risk data. Risk data refers to data monitored by the risk monitoring system, while potential risk data refers to data not included in the monitoring scope of the risk monitoring system.

[0008] The risk data and the potential risk data are input into a pre-trained risk prediction model, and multiple similarity matrices are calculated through multiple association prediction algorithms in the risk prediction model, where the similarity matrices are used to characterize the potential association relationship between the risk data and the potential risk data;

[0009] Based on the target weighted value, multiple similarity matrices are weighted to obtain a comprehensive similarity matrix, which is used to characterize the comprehensive correlation between risk data and potential risk data;

[0010] According to the comprehensive similarity matrix, target potential risk data are screened out from the potential risk data, and the target potential risk data are data that have a correlation relationship with the risk data.

[0011] In a second aspect, an embodiment of the present application provides a device for screening potential risk data, the device for screening potential risk data comprising:

[0012] The acquisition module is used to acquire risk data and unmonitored data. Risk data refers to data monitored by the risk monitoring system, and unmonitored data refers to data that is not included in the monitoring scope of the risk monitoring system.

[0013] An input module, used for inputting risk data and unmonitored data into a pre-trained risk prediction model, and calculating multiple similarity matrices through multiple association prediction algorithms in the risk prediction model, wherein the similarity matrices are used for characterizing the potential association relationship between the risk data and the unmonitored data;

[0014] A weighting module is used to perform weighted processing on multiple similarity matrices based on a target weighted value to obtain a comprehensive similarity matrix, and the comprehensive similarity matrix is ​​used to characterize the comprehensive correlation relationship between risk data and unmonitored data;

[0015] The screening module is used to screen out target monitoring data from unmonitored data based on a comprehensive similarity matrix, where the target monitoring data is data that has a correlation relationship with risk data.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the method in the first aspect or any possible implementation of the first aspect.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the method in the first aspect or any possible implementation of the first aspect is implemented.

[0018] In the embodiment of the present application, by acquiring risk data and potential risk data, risk data is data monitored by the risk monitoring system, and potential risk data is data that is not included in the monitoring scope of the risk monitoring system, comprehensive coverage of risks is achieved, and the coverage rate of risk identification is improved. Risk data and potential risk data are input into a pre-trained risk prediction model, and multiple similarity matrices are calculated by multiple association prediction algorithms in the risk prediction model. The similarity matrix is ​​used to characterize the potential association relationship between risk data and potential risk data; through multiple association prediction algorithms, the advantages of each algorithm are comprehensively utilized to improve the prediction accuracy. Based on the target weighted value, multiple similarity matrices are weighted to obtain a comprehensive similarity matrix, which is used to characterize the comprehensive association relationship between risk data and potential risk data; according to the comprehensive similarity matrix, the target potential risk data is screened out from the potential risk data, and the target potential risk data is data that has an association relationship with the risk data. Through the comprehensive similarity matrix, the target potential risk data that has an association relationship with the risk data is accurately screened out, the accuracy of risk identification is improved, the burden of manual investigation is reduced, and various abnormal problems in the business can be covered more comprehensively. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0020] Figure 1 is a flow chart of a method for screening potential risk data provided by an embodiment of the present application;

[0021] Figure 2 is a flow chart of a method for screening potential risk data provided by an embodiment of the present application;

[0022] Figure 3 It is a structural schematic diagram of a potential risk data screening device provided in an embodiment of the present application;

[0023] Figure 4 It is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present application and are not configured to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0025] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0026] Figure 1 This is a flow chart of a method for screening potential risk data provided in an embodiment of the present application.

[0027] like Figure 1 As shown, the potential risk data screening method may include steps 110 to 130, and the method is applied to a potential risk data screening device, as shown below:

[0028] Step 110, obtaining risk data and potential risk data, where risk data is data monitored by the risk monitoring system, and potential risk data is data that is not included in the monitoring scope of the risk monitoring system;

[0029] Risk data: data monitored by the risk monitoring system, data points known to be at risk.

[0030] Potential risk data: data that is not included in the monitoring scope of the risk monitoring system and may contain risky data points.

[0031] Risk Monitoring System: A system used to monitor and identify risk data.

[0032] Collect known risk data through the risk monitoring system and potential risk data through other data sources. Clean the data to remove noise and outliers. You can use API or database query to obtain risk data and potential risk data; use data cleaning tools or write cleaning scripts to remove noise and outliers.

[0033] By acquiring potential risk data, comprehensive risk monitoring can be achieved and the coverage of risk identification can be improved.

[0034] Step 120, inputting the risk data and the potential risk data into a pre-trained risk prediction model, and calculating multiple similarity matrices through multiple association prediction algorithms in the risk prediction model, wherein the similarity matrices are used to characterize the potential association relationship between the risk data and the potential risk data;

[0035] Risk prediction model: A pre-trained model used to predict the relationship between risk data and potential risk data.

[0036] Association prediction algorithms, such as algorithms based on network diffusion, classification algorithms based on features, and algorithms based on matrix decomposition.

[0037] During the model training phase, historical data is used to train the model so that it can accurately predict the correlation between risk data and potential risk data.

[0038] The risk data and potential risk data are input into the pre-trained risk prediction model; multiple association prediction algorithms are used to calculate the similarity matrix between the risk data and the potential risk data. The risk data and potential risk data are passed as input to the pre-trained risk prediction model; multiple association prediction algorithms are used to calculate the similarity matrix.

[0039] Through the pre-trained risk prediction model, the correlation between risk data and potential risk data can be accurately predicted, thereby improving the accuracy of risk identification.

[0040] In a possible embodiment, before step 120, the method further includes:

[0041] Obtain training data, which includes historical potential risk data and historical risk data collected by the risk monitoring system; historical potential risk data is data that is not included in the monitoring scope of the risk monitoring system;

[0042] Inputting historical potential risk data and historical risk data into a preset neural network model, outputting a plurality of historical similarity matrices, wherein the similarity matrices are used to characterize the potential correlation between the historical risk data and the historical potential risk data;

[0043] A plurality of historical similarity matrices are weighted based on a preset weight value to obtain a historical comprehensive similarity matrix, where the historical comprehensive similarity matrix is ​​used to characterize the comprehensive correlation between historical risk data and historical potential risk data;

[0044] The preset neural network model is trained according to the historical comprehensive similarity matrix until the preset neural network model meets the preset training conditions to obtain a trained risk monitoring model.

[0045] Training data: data used to train the preset neural network model.

[0046] Historical potential risk data: historical data that is not monitored.

[0047] Historical risk data: Historical data where risks are known to exist.

[0048] Collect historical potential risk data and historical risk data; clean the data to remove noise and outliers. Use API or database query to obtain historical potential risk data and historical risk data. Use data cleaning tools or write cleaning scripts to remove noise and outliers.

[0049] Preset neural network model: a pre-designed neural network model for training and prediction.

[0050] Historical similarity matrix: a matrix that represents the potential correlation between historical risk data and historical potential risk data.

[0051] The historical potential risk data and historical risk data are used as input and passed to the preset neural network model. The preset neural network model is used to calculate the similarity matrix between the historical risk data and the historical potential risk data. The historical data is input into the preset neural network model to perform model training and improve the prediction accuracy of the model.

[0052] Preset weight value: A preset weight value used to perform weighted processing on multiple historical similarity matrices.

[0053] Historical comprehensive similarity matrix: integrates multiple historical similarity matrices to characterize the comprehensive correlation between historical risk data and historical potential risk data.

[0054] According to the preset weighting value, multiple historical similarity matrices are weighted to obtain a historical comprehensive similarity matrix. Using the preset weighting value, multiple historical similarity matrices are weighted to obtain a historical comprehensive similarity matrix.

[0055] Through weighted processing, the advantages of multiple historical similarity matrices are combined to improve the quality and prediction accuracy of the historical comprehensive similarity matrix; the preset neural network model is trained according to the historical comprehensive similarity matrix until the preset neural network model meets the preset training conditions to obtain a trained risk monitoring model

[0056] Preset training conditions: Preset model training conditions, such as the loss function reaching the preset value, the model performance reaching the preset standard, etc.

[0057] Trained risk monitoring model: A model that meets the preset training conditions and can accurately predict the correlation between risk data and potential risk data.

[0058] Use the historical comprehensive similarity matrix to train the preset neural network model until the model meets the preset training conditions to obtain a trained risk monitoring model. By training the preset neural network model, the model parameters are optimized to improve the model's prediction accuracy and generalization ability.

[0059] In a possible embodiment, obtaining training data includes:

[0060] Obtain the historical risk data list and manual verification results collected by the risk monitoring system. The historical risk data list is a collection of data with risks identified by the monitoring system; the manual verification results are determined by domain experts on the suspected risk data list;

[0061] Use natural language technology to analyze manual verification results and obtain historical risk data.

[0062] Historical risk data list: a collection of data identified as risky by the risk monitoring system.

[0063] Manual verification results: Results determined by domain experts after verifying the list of suspected risk data.

[0064] Collect the historical risk data list and manual verification results collected by the risk monitoring system; clean the data and remove noise and outliers. By obtaining the historical risk data list and manual verification results, a data basis is provided for subsequent natural language technology analysis.

[0065] Natural language technology: technology used to process and analyze natural language text, such as text classification, sentiment analysis, entity recognition, etc.

[0066] Historical risk data: Historical risk data obtained by analyzing manual verification results using natural language technology.

[0067] Use natural language technology to classify texts of manual verification results and identify data with risks. Use natural language technology to identify entities of manual verification results and extract entity information related to risks.

[0068] Automated analysis: Through natural language technology, manual verification results are automatically analyzed to improve the efficiency and accuracy of data processing.

[0069] The embodiment of the present application introduces convolutional neural network (CNN) and recurrent neural network (RNN) algorithms in the natural language processing module to achieve deep understanding of text information and effective integration of context information. CNN automatically extracts local and global features of text through convolutional layers and pooling layers, and can capture subtle semantic patterns in text and the combination relationship between words.

[0070] For example, when processing telecommunications complaint texts, CNN can identify specific semantic patterns such as "customers call to complain without knowing it" and "abnormal deductions of phone bills", and infer that there may be risks of false development and forced orders. These patterns are often related to potential risk issues.

[0071] RNN is good at processing text sequence information, taking into account contextual relationships and modeling the overall semantics of the text. When analyzing long texts, RNN can remember previous information and continuously update its understanding of the text based on subsequent content.

[0072] For example, for a description like "My phone bill suddenly increased a lot last month. I checked the bill and found some unknown charges," RNN can understand the temporal and logical relationship between words such as "last month," "sudden increase," and "unknown charges," thereby more comprehensively grasping the core issues and potential risks of user complaints.

[0073] The combination of CNN and RNN enables the natural language processing module to more accurately extract risk confirmation and feature information from the verification text. Compared with traditional methods, this ability to integrate deep semantic understanding and contextual information greatly improves the ability to understand complex semantics and reduces the possibility of misjudgment and missed judgment.

[0074] When faced with complex and diverse verification texts in telecommunications services, the natural language processing capabilities of the embodiments of the present application show significant advantages. For texts with ambiguous or implicit risk statements, CNN and RNN can work together to mine potential risk information from different angles. CNN uses its powerful feature extraction capabilities to capture local key information in the text, which may indicate the existence of risks. RNN further analyzes and infers these local information based on contextual information to determine its exact risk meaning.

[0075] For example, when a statement like "My phone bill suddenly increased a lot last month. I checked the bill and found some unknown charges," appears in the text, CNN can extract key information such as "in the past two months," "suddenly," "increased a lot," and "unknown charges."

[0076] Based on the uncertainty and frequency information reflected by words such as "last two months", "suddenly" and "unknown", RNN infers that there may be risks of false development and forced orders, and this risk has had a relatively frequent impact on user experience. In this way, the embodiments of the present application can more accurately identify the risk information implied in the text, improving the accuracy of risk identification.

[0077] At the same time, the embodiments of the present application are also highly adaptable to texts containing a large number of professional terms, industry-specific languages, and complex sentence structures. CNN can effectively extract features from professional terms, while RNN can understand the meaning and relationship of these terms in complex contexts.

[0078] For example, when processing telecommunications network technical documents, CNN can identify professional terms such as various network equipment names, technical parameters, marketing scenarios, etc., while RNN can understand the specific meanings of these terms in describing monitoring architecture, risk diagnosis, etc. based on the overall structure and logic of the document, thereby accurately extracting risk information from the document and providing strong support for risk management of telecommunications services.

[0079] Among them, obtain the historical risk data list collected by the risk monitoring system and the manual verification results, including:

[0080] S1: Collect risk data and verification results through the data acquisition module, including the list of suspected risk data output by the risk audit point and the verification status and results of the branch's manual response.

[0081] S2: Clean the acquired data to remove invalid or erroneous data.

[0082] S3: Format the cleaned data and unify the data format for easy processing.

[0083] S4: Standardize the formatted data to ensure that the data has consistent scale and units.

[0084] Among them, natural language technology is used to analyze the manual verification results to obtain historical risk data, which specifically includes the following steps:

[0085] S5: Use the natural language interaction module to extract key information of the verification text, use the Jieba word segmentation library to segment the pre-processed verification text, and divide the text into words for subsequent processing. For example, for the text "The customer called to complain about the value-added service subscription without knowing it", after word segmentation, the words "complaint", "value-added", "subscription", "uninformed" and so on may be obtained.

[0086] S6: HanLP tool performs part-of-speech tagging on the text after word segmentation to determine the part of speech of each word, such as noun, verb, adjective, etc. For example, in the above word segmentation results, "value-added" may be marked as a noun, "order" as a verb, etc.

[0087] S7: Extract key entities such as "abnormal acceptance" and other risk indicators through named entity recognition technology of SpaCy tool.

[0088] S8-1: Use the TextBlob tool to perform sentiment analysis to determine the risk tendency of the text and judge the degree of risk. For example, risk indicators such as "abnormal acceptance" and "ordering without knowledge". These entities may be related to potential risks. For example, after identifying "ordering without knowledge", it can be used as an important risk feature for subsequent analysis.

[0089] S8-2: Function: textblob.TextBlob(text).sentiment.polarity, where text is the text to be analyzed, and the returned polarity value indicates the sentiment tendency, with positive numbers indicating positive, negative numbers indicating negative, and 0 indicating neutral. For example, for the text "Customer calls to complain about being unaware of the value-added service subscription", sentiment analysis may produce a strong negative polarity value, indicating that this is a risk event.

[0090] S9-1: Introduce natural language processing algorithms based on deep learning, such as convolutional neural networks (CNN) and recurrent neural networks (RNN), to further improve the ability to understand and analyze text information. The specific application algorithm function formula is as follows:

[0091] CNN: Automatically extract local and global features of text through convolutional layers and pooling layers, such as using convolution operations to extract features from text. During the convolution process, the convolution kernel slides over the text to capture local patterns and features in the text. For example, for text describing a system failure, CNN may capture features such as keywords and phrases related to the failure. The formula is

[0092] output = conv(input, kernel)

[0093] Where input is the input text and kernel is the convolution kernel.

[0094] RNN: Processes text sequences, captures contextual relationships, and provides support for risk information extraction. RNN can consider the contextual information of the text and perform correlation analysis on the relevant information before and after the text. For example, when analyzing a description of a system failure, RNN can understand the meaning of the text more comprehensively based on the failure phenomenon mentioned earlier and the impact range mentioned later. Use the loop formula:

[0095] h t =f(Ux t +Wh t-1 )

[0096] Update the hidden layer state, where h t is the current hidden layer state, x t is the current input, U and W are weight matrices, and f is the activation function.

[0097] Consider the contextual information of the text, including the logical relationship between the previous and next texts, the order of events, etc. By comprehensively analyzing the context, the risk tendency of the text can be judged more accurately.

[0098] S9-2: Risk information extraction comprehensively considers the contextual information of the text, including the logical relationship between the previous and next texts, the sequence of events, etc., to more accurately judge the risk tendency of the text.

[0099] For example, if the text mentions "recently the same customer complained about being unaware of the subscription of value-added services", "last month my phone bill suddenly increased a lot, I checked the bill and found some unknown deduction items", "and similar situations have occurred before, but were not resolved in time", by analyzing the context, it can be judged that this may be a more serious risk event, and it can be inferred that there may be risks of false development, secret subscriptions, and forced subscriptions, and this risk has had a more frequent impact on user experience. In this way, the embodiments of the present application can more accurately identify the risk information implicit in the text and improve the accuracy of risk identification.

[0100] S9-3: The result output is to organize and output the extracted risk information and features for use by the subsequent machine learning tuning module. This information is stored in the form of a structured dictionary or data frame, including specific descriptions of the risk, related entities, risk levels, and other information. The subsequent machine learning tuning module can further analyze and process the risk data based on these output results to optimize the risk audit model. Among them, the preset neural network model is trained according to the historical comprehensive similarity matrix until the preset neural network model meets the preset training conditions to obtain a trained risk monitoring model, which specifically includes the following steps:

[0101] S10: The machine learning tuning module receives the output of the natural language processing module, re-performs machine learning on the data that is finally confirmed to be a risk and the data that is confirmed not to be a risk, and optimizes the early warning mechanism.

[0102] S11: By adjusting the model parameters, namely the penalty coefficient and kernel function parameters of the support vector machine (SVM), the model is optimized to identify risks more accurately.

[0103] S12: Apply the Random Forest algorithm for feature selection and model optimization to improve the generalization ability and accuracy of the model. The specific algorithm function formula is: When building a decision tree, use the splitting criterion (such as information gain, Gini index, etc.) to select the best split point. The formula is

[0104]

[0105] Where D is the data set, K is the category set, and p k is the probability of category K appearing in D.

[0106] The application of the Random Forest algorithm in the machine learning tuning module significantly improves the model's feature selection capabilities. Random Forest builds multiple decision trees and randomly selects features for splitting during the construction of each tree, which can automatically evaluate the importance of each feature for risk prediction. This data-driven feature selection method avoids the subjectivity and blindness of manual feature selection and can accurately screen out the feature subset with the highest risk correlation.

[0107] When processing large-scale telecommunications business data, there are many features and there may be complex correlations. RandomForest can effectively handle this situation, quickly find those features that have a key impact on the model prediction results, and remove the interference of irrelevant or redundant features.

[0108] For example, when predicting the risk of telecom users maintaining their credit cards, Random Forest may find that the number of users developed at the end of the month is higher than that in other periods, the number of active contact numbers of developed users is concentrated, the boot time is short, and the information of base stations involved by users is concentrated, which is closely related to the risk of telecom users maintaining their credit cards. Some other features that seem to be related but actually contribute less to the prediction results will be automatically filtered out. This not only reduces the complexity of the model, improves the efficiency of training and prediction, but also enhances the generalization ability of the model, so that it can maintain good prediction performance when facing new data.

[0109] The integration feature of the Random Forest algorithm is the key to improving model stability and reducing the risk of overfitting. Since Random Forest consists of multiple decision trees, each tree has a certain degree of randomness during training, which makes them more robust to noise and outliers in the data. Even if there are some local fluctuations or anomalies in the data, the predictions of individual decision trees may be affected, but by integrating the prediction results of multiple trees, these unfavorable factors can be effectively offset, making the predictions of the entire model more stable and reliable.

[0110] When faced with different data distributions and complex business scenarios, Random Forest can maintain good generalization capabilities. Compared with a single decision tree model, Random Forest is less likely to overfit training data and can better adapt to new data and unknown situations. For example, when a telecommunications business launches a new package or marketing strategy, user behavior and business data may change. Random Forest can adjust the model based on the new data without over-relying on past data patterns, thereby reducing the risk of overfitting and improving the accuracy and stability of the model in practical applications.

[0111] The risk data and potential risk data are input into a pre-trained risk prediction model, and multiple similarity matrices are calculated through multiple association prediction algorithms in the risk prediction model, including:

[0112] S13: The association prediction algorithm module uses a variety of association prediction algorithms, such as algorithms based on network diffusion, classification algorithms based on features, and algorithms based on matrix decomposition, to analyze risk data and predict the association between risk data and business indicators.

[0113] S14: Prediction confirmation is the potential association between risk data and business quality indicator data that is not included in the audit risk model monitoring, and the prediction results are used for subsequent processing.

[0114] S15: Introduce the Graph Neural Network (GNN) algorithm to better capture the complex relationships and topological structures between data and improve the accuracy of association prediction. The specific algorithm function formula is: construct risk data and business quality indicator data into a graph structure, and learn the association pattern between data through message passing and aggregation operations. For example, the node update formula is

[0115]

[0116] in, is the hidden state of node v in the l+1 layer, N(v) is the set of neighbor nodes of node v, W vu is the weight matrix and σ is the activation function.

[0117] The introduction of the Graph Neural Network (GNN) algorithm enables this patent to better capture the complex relationship and topological structure between the data that is confirmed to be a risk and the business quality indicator data that is not included in the audit risk model monitoring. Compared with the traditional association prediction algorithm, GNN can more comprehensively consider the interaction between data, thereby improving the accuracy of association prediction. This is of great significance for discovering potential risk associations and optimizing audit strategies.

[0118] For example, when analyzing the relationship between telecommunications business operations and telecommunications system vulnerabilities, GNN can construct business operation data and system vulnerability data into a graph structure, and capture the complex relationship between them through the relationship between nodes and edges. In this way, it can more accurately predict which business operations may lead to system vulnerabilities, so as to take preventive measures in advance.

[0119] The GNN algorithm can capture the complex relationships and topological structures between data, which is very important for mining the potential associations between risk data and business quality indicator data. It can discover hidden associations that traditional algorithms may ignore, providing more valuable clues for risk audits.

[0120] As telecommunications services continue to develop and change, the GNN algorithm can better adapt to the dynamic changes in data, promptly discover emerging risk associations, and provide more timely support for risk management.

[0121] Step 130, weighting multiple similarity matrices based on the target weighted value to obtain a comprehensive similarity matrix, where the comprehensive similarity matrix is ​​used to characterize the comprehensive correlation between the risk data and the potential risk data;

[0122] Target weighted value: Dynamically adjust the weight of each association prediction algorithm in the calculation of the comprehensive similarity matrix based on its prediction performance on different data subsets.

[0123] According to the prediction performance of each association prediction algorithm on different data subsets, its weight in the calculation of the comprehensive similarity matrix is ​​dynamically adjusted; through weighted processing, multiple similarity matrices are integrated to obtain a comprehensive similarity matrix.

[0124] Using a dynamic weighting strategy, the weights are dynamically adjusted according to the prediction performance of each association prediction algorithm on different data subsets; through weighted processing, multiple similarity matrices are integrated to obtain a comprehensive similarity matrix.

[0125] Through weighted processing, the advantages of multiple association prediction algorithms are integrated to improve the quality of the comprehensive similarity matrix and prediction accuracy.

[0126] In a possible embodiment, before step 130, the following steps may also be included:

[0127] The risk data and potential risk data are constructed into a graph structure, where the nodes of the graph structure represent data points, and the edges of the graph structure represent the associations between data points; the data points are generated based on the risk data and potential risk data;

[0128] The graph structure is updated through the graph neural network to obtain updated node features of the graph structure. The updated node features include high-order neighborhood information between risk data and potential risk data.

[0129] According to the updated node features of the graph structure, the target weight value is determined.

[0130] Graph structure: nodes represent data points, and edges represent the relationship between data points.

[0131] Data points: generated based on risk data and potential risk data.

[0132] Graph structure: a graph structure used to represent the relationship between data points.

[0133] Node: A node in a graph structure represents a data point.

[0134] Edge: The edge in the graph structure represents the relationship between data points.

[0135] Graph Neural Network (GNN): A neural network used to process graph-structured data, capable of capturing complex relationships and topological structures between data.

[0136] High-order neighborhood information: The updated node features include high-order neighborhood information between risk data and potential risk data.

[0137] Generate data points based on risk data and potential risk data; construct the data points into a graph structure, where nodes represent data points and edges represent the association relationship between data points.

[0138] Use data processing tools or write scripts to generate data points based on risk data and potential risk data; use graph building tools or write scripts to build data points into graph structures.

[0139] The graph structure can intuitively represent the relationship between risk data and potential risk data, making it easier to analyze and understand. The graph structure is updated through the graph neural network to obtain updated node features.

[0140] Use graph neural network to perform message passing and aggregation operations on graph structure, update node features, and capture high-order neighborhood information. Use graph neural network model to perform message passing and aggregation operations on graph structure, update node features. Through graph neural network processing, capture high-order neighborhood information between risk data and potential risk data, and improve the accuracy of association relationships.

[0141] According to the updated node features of the graph structure, the weight of each association prediction algorithm in the calculation of the comprehensive similarity matrix is ​​determined; the updated node features are obtained through graph neural network processing; according to the updated node features, the weight of each association prediction algorithm is determined.

[0142] Analyze the updated node features to determine the correlation between risk data and potential risk data; based on the feature analysis results, determine the weight of each association prediction algorithm in the calculation of the comprehensive similarity matrix.

[0143] Use feature analysis tools or write scripts to analyze updated node features; use dynamic weighting strategies to determine the weight of each association prediction algorithm based on the feature analysis results. Dynamically adjust the weight of each association prediction algorithm based on the updated node features to improve the quality of the comprehensive similarity matrix and prediction accuracy.

[0144] The introduction of the graph neural network (GNN) algorithm has brought a qualitative leap in association prediction. GNN can effectively handle the complex relationships and topological structures between data, which is crucial for mining the potential associations between risk data and business quality indicator data in telecommunications services.

[0145] In telecommunications business, there are intricate relationships between various entities, which form a huge graph structure. Entities include users, devices, and services. By learning the graph structure, GNN can capture high-order connections and local structural information between nodes, thereby discovering hidden association patterns that are difficult for traditional algorithms to detect.

[0146] For example, when analyzing the relationship between telecommunications network failures and business impacts, GNN can construct network elements such as equipment, users, and business traffic into a graph. Through node and edge information, GNN can learn the propagation path of equipment failures in the network and the degree of impact on different businesses. It can not only consider the direct connection relationship between devices, but also capture information indirectly associated through multiple intermediate nodes. This in-depth exploration of complex relationships and topological structures makes association predictions more accurate, which can provide more valuable clues for risk audits, helping operators to discover potential risk issues in advance and take corresponding measures to prevent and control them.

[0147] In the dynamic environment of the continuous development and change of telecommunications business, the GNN algorithm has shown strong dynamic adaptability. With the expansion of business, changes in user behavior and adjustments to network structure, the correlation between data is also constantly evolving. GNN can update the graph structure and node feature information in real time, quickly adjust model parameters according to new data, and promptly discover new risk associations.

[0148] For example, when telecom operators launch new service packages or carry out promotional activities, user behavior patterns and service data will change accordingly. GNN can quickly learn the impact of these changes on risk associations and predict new risk points that may emerge.

[0149] This dynamic adaptability enables the embodiments of the present application to maintain a high accuracy of correlation prediction in a complex and ever-changing telecommunications business environment, providing real-time and effective risk management support for operators. By timely discovering and responding to potential risks, operators can better ensure the stable operation of their services, reduce risk losses, and improve operational efficiency and service quality.

[0150] In a possible embodiment, determining a target weighted value according to node features after graph structure update includes:

[0151] The updated node features are convolved through the graph convolutional neural network to obtain the predicted similarity matrix of the graph structure;

[0152] Based on the adaptive threshold sparse method, the predicted similarity matrix of the graph structure is sparsely processed to obtain the sparse graph structure;

[0153] According to the sparse graph structure, the prediction performance data of each association prediction algorithm on different data subsets are evaluated; the data subsets include: a subset of risk data and a subset of potential risk data;

[0154] According to the prediction performance data, the weight value corresponding to each associated prediction algorithm is adjusted to obtain the target weight value.

[0155] Graph Convolutional Neural Network (GCN): A deep learning model for processing graph-structured data that can capture high-order neighborhood information between nodes by performing convolution operations on the graph.

[0156] Convolution operation: The updated node features are convolved through the graph convolutional neural network to obtain the predicted similarity matrix of the graph structure.

[0157] Use the graph convolutional neural network to perform convolution operations on the updated node features to capture the high-order neighborhood information between nodes. Use the graph convolutional neural network model to perform convolution operations on the updated node features to obtain the predicted similarity matrix. Through the convolution operation, the high-order neighborhood information between nodes is captured, which improves the accuracy of the predicted similarity matrix.

[0158] Adaptive threshold sparsification method: According to the local structural information of the graph, the sparsification threshold of each node is adaptively determined to retain important connection relationships and reduce noise and redundant information.

[0159] Sparse processing: The predicted similarity matrix is ​​sparsely processed to obtain a sparse graph structure.

[0160] Analyze the neighbor nodes and connection relationships of each node to determine the local structural information; adaptively adjust the sparsification threshold of each node based on the local structural information; and perform sparsification processing on the predicted similarity matrix based on the adaptive threshold to obtain the sparse graph structure.

[0161] Use graph analysis tools or write scripts to analyze the neighbor nodes and connection relationships of each node; use an adaptive threshold algorithm to adjust the sparsification threshold of each node based on local structure information; use a sparsification algorithm based on the adaptive threshold to sparsify the predicted similarity matrix to obtain a sparse graph structure.

[0162] Through sparse processing, important connection relationships are retained, noise and redundant information are reduced, and the accuracy of the graph structure is improved; based on the sparse graph structure, the prediction performance data of each association prediction algorithm on different data subsets is evaluated.

[0163] Evaluate the prediction accuracy, error and other indicators of each association prediction algorithm on different data subsets; Evaluate the prediction performance of each association prediction algorithm on different data subsets. Divide the risk data and potential risk data into multiple subsets. Run each association prediction algorithm on each data subset and calculate the prediction accuracy, error and other indicators.

[0164] You can use data partitioning tools or write scripts to divide risk data and potential risk data into multiple subsets; run each association prediction algorithm on each data subset, and use evaluation tools or write scripts to calculate indicators such as prediction accuracy and error.

[0165] By evaluating the prediction performance on different data subsets, the performance of each associated prediction algorithm can be accurately evaluated to improve the accuracy of weight adjustment; according to the prediction performance data, the weight value corresponding to each associated prediction algorithm is adjusted to obtain the target weight value.

[0166] According to the prediction performance data, the dynamic weighting strategy is used to adjust the weight value corresponding to each association prediction algorithm; According to the prediction performance data, the dynamic weighting strategy is used to adjust the weight value corresponding to each association prediction algorithm. According to the prediction performance data, the weight value of each association prediction algorithm is dynamically adjusted to improve the quality of the comprehensive similarity matrix and the prediction accuracy.

[0167] Among them, Figure 2 As shown in the figure, the updated node features are convolved by the graph convolutional neural network to obtain the predicted similarity matrix of the graph structure, including:

[0168] S16: Introduce the graph convolutional neural network (GCN) in the deep neural network to calculate the predicted similarity matrix of the monitored entities. GCN can effectively process graph structure data and capture the high-order neighborhood information between nodes by performing convolution operations on the graph, thereby more accurately describing the similarity between monitored entities.

[0169] Combined with entity attribute information, deep learning methods are used to automatically extract entity features and build a similarity matrix based on them. The introduction of graph structure provides higher expressive power and accuracy for capturing similarities between entities, and can identify complex patterns and more subtle differences between entities, so as to more accurately capture the similarities between entities.

[0170] Wherein: S16-1, according to the prediction results of each algorithm, the prediction similarity matrix of the monitored entity is calculated respectively. A and B respectively represent the set of monitored entities, and the monitored entities and their association relationships are constructed into a graph structure G = (V, E), where V represents the set of monitored entities and E represents the edge set between entities.

[0171] Step S16-2: for each monitoring entity v i ∈V initializes the feature vector x i ∈R d , where d is the feature dimension.

[0172] Step S16-3, define the graph convolution layer, and its propagation rules are as follows:

[0173]

[0174] Among them, H (l) is the feature matrix of the lth layer, σ is the activation function (such as ReLU function), A is the adjacency matrix of the graph, The degree matrix, W (l) is the weight matrix of layer l

[0175] S16-4, through multi-layer graph convolution operations, the final embedded representation Z = H of each monitored entity is obtained (L), where L is the number of graph convolutional layers.

[0176] S16-5, based on the embedded representation Z of the monitored entity, calculate the predicted similarity matrix Z. i ,v j ), their similarity is defined as:

[0177]

[0178] Where σ is a hyperparameter used to control the decay rate of similarity.

[0179] Using GCN can better capture the complex topological structure and dependencies between monitored entities and improve the accuracy and reliability of the similarity matrix.

[0180] Compared with traditional methods, it has stronger adaptability to data and can process graph data with different structures and scales, providing a more valuable information basis for subsequent association predictions.

[0181] Among them, the sparse processing is performed on the predicted similarity matrix of the graph structure based on the adaptive threshold sparse processing to obtain the sparse graph structure, including:

[0182] S17, using an adaptive threshold sparseness method, combined with the local structure information of the graph to determine the sparseness threshold of each node. This can adaptively adjust the sparsity degree according to the actual situation of the data, better retain important connection relationships, and reduce noise and redundant information to adapt to different application scenarios.

[0183] in:

[0184] S17-1, for the predicted similarity matrix G obtained in S16, calculate each monitored entity v i and its neighbor node μ i The average similarity and standard deviation σ i .

[0185] S17-2, set a sparse threshold T for each monitoring entity i =μ i +ασ i , where α is an adjustment coefficient that can be adjusted according to the characteristics of the data.

[0186] S17-3, according to the sparse threshold T of each node i , sparse the prediction similarity matrix G. For G(v i ,v j ) <T i , set it to 0; otherwise leave it unchanged.

[0187] The adaptive threshold method can adaptively adjust the sparsification degree according to the local structure and distribution of the data, and better balance information retention and noise removal.

[0188] This avoids the problem of information loss or over-sparseness that may be caused by a fixed K value, and improves the effect and flexibility of the sparse processing.

[0189] Among them, according to the sparse graph structure, the prediction performance data of each association prediction algorithm on different data subsets are evaluated; the data subsets include: a subset of risk data and a subset of potential risk data; according to the prediction performance data, the weight value corresponding to each association prediction algorithm is adjusted to obtain the target weight value, including:

[0190] S18, introduces a dynamic weighting strategy to dynamically adjust the weight of each algorithm in the calculation of the integrated similarity matrix according to its prediction performance on different data subsets. This can better utilize the advantages of each algorithm and improve the quality of the integrated similarity matrix and prediction accuracy.

[0191] Among them: S18-1: Stratified sampling is used to divide the data set into K non-overlapping data subsets whose category distribution is consistent with the entire data set: {D1, D2, ..., D K}

[0192] S18-2: There are m algorithms based on Y, G A , G B As input, the similarity matrix of the predicted monitored entities is used. A is the similarity matrix calculated by steps 16 and 17 for the monitoring entity of type A, G B The similarity matrix calculated by steps 16 and 17 for the B-type monitoring entity

[0193] For each algorithm m, in each data subset D K The upper calculator prediction error E m,k The prediction error can be expressed as mean square error (MSE) or other suitable error measurement methods, that is,

[0194]

[0195] Among them G m (v i ,v j ) represents the effect of algorithm m on monitoring entity v i and v j The predicted similarity, S(v i , v j ) indicates the actual similarity.

[0196] S18-3: Calculate the average prediction error of each algorithm on all data subsets:

[0197]

[0198] The dynamic weight of each algorithm is calculated based on its average prediction error:

[0199]

[0200] S18-4: Calculate the integrated similarity matrix by dynamic weighting

[0201]

[0202] in, is the predicted similarity matrix of algorithm m after sparse processing.

[0203] The dynamic weighting strategy can adaptively adjust the weights according to the actual performance of the algorithm on different data subsets, give full play to the advantages of each algorithm, and improve the adaptability and prediction accuracy of the integrated similarity matrix to different data patterns. Compared with the simple weighted superposition method, it can better handle the complexity and diversity of data and improve the generalization ability of the model.

[0204] In a possible embodiment, a sparse processing is performed on the predicted similarity matrix of the graph structure based on a sparse method of an adaptive threshold to obtain a sparse graph structure, including:

[0205] According to the predicted similarity matrix of the graph structure, the neighbor nodes and connection relationships of each node in the graph structure are analyzed to determine the local structure information;

[0206] According to the local structure information, adjust the sparseness threshold of each node of the graph structure;

[0207] The graph structure is sparsely processed according to the sparseness threshold to obtain a sparse graph structure.

[0208] Neighbor node: A node that is directly connected to the current node.

[0209] Connection relationship: The edge between nodes represents the association relationship between nodes.

[0210] Local structural information: information about each node’s neighbor nodes and connection relationships.

[0211] Local structural information: information about each node’s neighbor nodes and connection relationships.

[0212] Sparsification threshold: The threshold used to determine whether the connection relationship between nodes is preserved.

[0213] Sparse processing: According to the sparse threshold, the graph structure is sparsely processed to retain important connection relationships and reduce noise and redundant information.

[0214] Graph structure after sparseness: a graph structure that retains important connection relationships.

[0215] Analyze the neighbor nodes of each node to determine the nodes directly connected to the current node. Analyze the connection relationship of each node to determine the edges between nodes. Determine the local structure information of each node based on the neighbor nodes and connection relationship.

[0216] You can use graph analysis tools or write scripts to analyze the neighbor nodes of each node; use graph analysis tools or write scripts to analyze the connection relationship of each node. According to the neighbor nodes and connection relationships, determine the local structure information of each node.

[0217] By analyzing the neighbor nodes and connection relationships of each node, the local structure information is accurately determined, providing a basis for subsequent sparse processing. The adaptive threshold algorithm is used to adjust the sparse threshold of each node according to the local structure information. By adaptively adjusting the sparse threshold of each node, important connection relationships are retained, noise and redundant information are reduced, and the accuracy of the graph structure is improved.

[0218] According to the sparsification threshold, the graph structure is sparsely processed to retain important connection relationships, reduce noise and redundant information, obtain the sparse graph structure, and improve the accuracy of the graph structure.

[0219] Step 140 , based on the comprehensive similarity matrix, select target potential risk data from the potential risk data, where the target potential risk data is data that has a correlation relationship with the risk data.

[0220] Target potential risk data: potential risk data that is associated with risk data.

[0221] Multiple similarity matrices are integrated to characterize the comprehensive correlation between risk data and potential risk data; based on the comprehensive similarity matrix, the correlation between risk data and potential risk data is analyzed; based on the correlation, target potential risk data is screened out from the potential risk data.

[0222] Use a comprehensive similarity matrix to analyze the correlation between risk data and potential risk data; based on the correlation, use a screening algorithm or write a screening script to filter out target potential risk data from the potential risk data.

[0223] Through the comprehensive similarity matrix, target potential risk data that is correlated with risk data can be accurately screened out, thereby improving the accuracy of risk identification.

[0224] For example, the risk monitoring system is a bank risk monitoring system, which has 100 risk data samples and 200 potential risk data samples. Use API or database query to obtain risk data and potential risk data; use data cleaning tools or write cleaning scripts to remove noise and outliers.

[0225] The risk data and potential risk data are passed as input to the pre-trained risk prediction model; a variety of association prediction algorithms are used to calculate the similarity matrix. The various association prediction algorithms are network diffusion-based algorithms, feature-based classification algorithms, and matrix decomposition-based algorithms, each of which generates a similarity matrix.

[0226] Using a dynamic weighting strategy, the weights are dynamically adjusted according to the prediction performance of each association prediction algorithm on different data subsets. Through weighted processing, the three similarity matrices are integrated to obtain a comprehensive similarity matrix. Based on the comprehensive similarity matrix, the target potential risk data is screened out from the potential risk data:

[0227] Use a comprehensive similarity matrix to analyze the correlation between risk data and potential risk data; based on the correlation, use a screening algorithm or write a screening script to filter out target potential risk data from the potential risk data.

[0228] Therefore, by acquiring risk data and potential risk data, inputting the data into a pre-trained risk prediction model, weighting multiple similarity matrices based on target weighted values, and screening out target potential risk data from potential risk data based on the comprehensive similarity matrix, the accuracy and precision of risk identification can be improved.

[0229] In a possible embodiment, step 140 includes:

[0230] The comprehensive similarity matrix is ​​processed by nonlinear dimensionality reduction through the autoencoder to obtain low-dimensional features;

[0231] According to the low-dimensional features, the target potential risk data is screened out from the potential risk data.

[0232] Autoencoder: An unsupervised learning model that captures nonlinear structures in data by learning a compressed representation of the data while reducing feature dimensionality.

[0233] Comprehensive similarity matrix: combines multiple similarity matrices to characterize the comprehensive correlation between risk data and potential risk data.

[0234] Non-linear dimensionality reduction processing: The comprehensive similarity matrix is ​​subjected to non-linear dimensionality reduction processing through the autoencoder to obtain low-dimensional features.

[0235] Low-dimensional features: Low-dimensional features extracted by the autoencoder represent important information in the data.

[0236] The encoder part of the autoencoder is used to compress the comprehensive similarity matrix into a low-dimensional representation. The decoder part of the autoencoder is used to reconstruct the low-dimensional representation into high-dimensional data. The autoencoder is used to perform nonlinear dimensionality reduction to capture the nonlinear structure in the data and improve the accuracy of feature extraction.

[0237] Analyze low-dimensional features to determine the correlation between risk data and potential risk data. Based on the feature analysis results, filter out target potential risk data from potential risk data. Through low-dimensional features, accurately filter out target potential risk data and improve the accuracy of risk identification.

[0238] Among them, the comprehensive similarity matrix is ​​processed by nonlinear dimensionality reduction through the autoencoder to obtain low-dimensional features, including:

[0239] S19 uses a nonlinear dimensionality reduction method based on autoencoders to extract low-dimensional features. Autoencoders learn the compressed representation of data through unsupervised learning, which can effectively capture the nonlinear structure in the data and reduce the feature dimension.

[0240] Among them: S19-1, build a multi-layer autoencoder network, including encoder and decoder parts. The encoder consists of multiple fully connected layers, which maps high-dimensional input data to low-dimensional latent space to obtain low-dimensional feature representation: Encoder: z = Encoder (x)

[0241] S19-2, the decoder is also composed of multiple fully connected layers, trying to reconstruct the original data from the low-dimensional feature representation: Decoder:

[0242] S19-3, define the loss function of the autoencoder as the reconstruction error, that is

[0243] The autoencoder network is trained by minimizing this loss function.

[0244] S19-4, after training, the encoder part is used to map the original data to the low-dimensional feature space to obtain the low-dimensional feature F of each monitored entity A and F B .

[0245] Autoencoders can automatically learn nonlinear feature representations of data, better capture complex patterns and structures in data, and improve the quality and expressiveness of low-dimensional features.

[0246] Compared with the SVD method, it has better computational efficiency and scalability when processing large-scale data, and can adapt to different types of data distribution.

[0247] Additionally, the following steps may be included:

[0248] S20, when building an adaptive weighted ensemble model, introduces a multi-head attention mechanism to enhance the model's ability to learn the interactions between different features. The multi-head attention mechanism allows the model to focus on feature information from multiple different angles and better capture the complex dependencies between features.

[0249] Among them: S20-1 is the low-dimensional feature matrix F obtained by S19 A and F B They are input into the multi-head attention mechanism respectively. The multi-head attention mechanism consists of multiple parallel attention heads, each of which calculates the attention weight independently.

[0250] By introducing the multi-head attention mechanism, the model can capture the interactive relationship between features from multiple angles, enabling the model to better learn the complex connections between different features and improve the model's ability to model the associations between monitored entities.

[0251] The multi-head attention mechanism enhances the expressiveness and generalization performance of the model, and can more accurately predict the potential correlation between data confirmed to be risks and business quality indicator data that are not included in the audit risk model monitoring.

[0252] For example, when dealing with the card maintenance monitoring problem, the multi-head attention mechanism can more accurately identify the association between card maintenance behaviors between agent outlets, as well as the complex association between card maintenance behaviors and other commission business indicators.

[0253] S20-2 For each attention head h, calculate the attention weight A h as follows:

[0254]

[0255] in are the weight parameters of the query matrix and the key matrix respectively, d k is the dimension of the attention head.

[0256] S20-3 obtains multiple attention weight matrices A1, A2, ..., A through calculation of multiple attention heads H , concatenate them to get the final attention weight matrix A = concat(A1, A2, ..., A H );

[0257] S20-4 combines the attention weight matrix A with the low-dimensional feature matrix F A and F B Interact to obtain the enhanced feature representation F' A =AF A and F' B =AF B

[0258] S20-5 constructs an adaptive weighted ensemble model as follows:

[0259] P=σ(W0+W1F' A +W2F' B +W3G AS F' A +W4G BS F' B )

[0260] Where σ is the sigmoid function, W0, W1, W2, W3, W4 are the weight parameters of the model.

[0261] The multi-head attention mechanism can capture the interactive relationship between features from multiple perspectives, allowing the model to better learn the complex connections between different features and improve the model's ability to model the association of monitored entities. It enhances the model's expressiveness and generalization performance, and can more accurately predict the potential association between data that is confirmed to be a risk and business quality indicator data that is not included in the audit risk model monitoring.

[0262] S21 introduces a structural information regularization term in the objective function to better constrain the model to learn the intrinsic structure and potential patterns of the data. At the same time, an adaptive learning rate adjustment strategy is adopted to dynamically adjust the learning rate according to the progress of model training to improve the convergence speed and training stability of the model.

[0263] Among them: S21-1 defines the objective function as follows:

[0264]

[0265] Among them: the first term -∑ i,j (Y ij log(P ij )+(1-Y ij )log(1-P ij )) is the cross entropy loss function, which is used to measure the difference between the model prediction results and the actual association matrix;

[0266] Item 2 It is a regularization term used to control the complexity of the model and prevent overfitting;

[0267] Specifically, L represents the overall loss of the objective function;

[0268] i, j represent the row and column indices of the elements in the incidence matrix;

[0269] Y ij is the actual association matrix element, indicating whether there is an association (e.g., risk association) between two monitored entities. 1 indicates that there is an association, and 0 indicates that there is no association.

[0270] P ij The probability that there is an association between two monitored entities predicted by the model;

[0271] log is the natural logarithm function;

[0272] λ0, λ1, λ2, λ3 and λ4 are regularization coefficients, which are used to adjust the importance of different terms in the objective function;

[0273] Represent the square of the Frobenius norm of matrices W0, W1, W2, W3, and W4, respectively, which are used to control the complexity of the model and prevent overfitting;

[0274] Step S21-2 uses an adaptive learning rate adjustment strategy, such as the AdamW optimization algorithm, to train the model. AdamW introduces a weight decay mechanism based on the Adam optimization algorithm to further improve the generalization ability of the model.

[0275] The introduction of structural information regularization terms can guide the model to better learn the intrinsic structure and potential patterns of the data, improve the model's generalization ability and ability to capture complex associations. The adaptive learning rate adjustment strategy can automatically adjust the learning rate according to the model training situation, speed up the model's convergence speed, avoid falling into the local optimal solution, and improve the stability and efficiency of training.

[0276] Step S22 uses a more efficient and stable numerical calculation method to calculate partial derivatives, and combines automatic differentiation technology to simplify the calculation process. At the same time, in order to improve the stability of variable updating, gradient clipping technology is used to limit the size of the gradient.

[0277] Among them: S22-1 uses the automatic differentiation function provided by the deep learning framework to automatically calculate the partial derivatives of the objective function with respect to each variable during the model training process.

[0278] S22-2, after calculating the gradient, apply the gradient clipping technique, for each variable gradient g, calculate its norm ‖g‖, if ‖g‖>C (where C is the preset gradient clipping threshold), then scale the gradient g to

[0279] Use the clipped gradient to update the model's variables according to the optimization algorithm (such as the AdamW optimization algorithm). The specific update formula is as follows:

[0280] m t =β1m t-1 +(1-β1)g t

[0281]

[0282]

[0283] Among them, m t and v t are the first-order and second-order moment estimates, β1 and β2 are exponential decay rates, η is the learning rate, ∈ is a small constant value used to prevent the denominator from being zero, and clip(·, -C, C) means clipping the gradient to the range of [-C, C].

[0284] Automatic differentiation technology can accurately and efficiently calculate the partial derivatives of complex objective functions, improving computational efficiency. Gradient clipping technology effectively ensures the stability and convergence of model training, improving the quality and effect of model training.

[0285] Step S23 introduces a dynamic weight adjustment mechanism based on historical performance and current prediction error. In addition to considering the prediction error of the current iteration, the weight is adjusted based on the average prediction error and accuracy trend of each algorithm over the past period of time, so that the weight update more accurately reflects the actual performance of the algorithm and its adaptability to the current data.

[0286] Where: S23-1, for each algorithm m:

[0287] Record its prediction error sequence in the past T iterations {E m,t-T+1 , E m,t-T+2 ,…,E m,t ,} and the accuracy sequence {Accuracy m,t-T+1 ,Accuracy m,t-T+2 ,…,Accuracy m,t ,}

[0288] S23-2, calculate the average prediction error of each algorithm in the past T iterations

[0289]

[0290] and the rate of change of accuracy

[0291]

[0292] S23-3, the weight update formula is adjusted to:

[0293]

[0294] Among them, α, β and γ are hyperparameters used to adjust the influence of the current prediction error, average error and accuracy change rate on the weight.

[0295] The weight update mechanism that takes into account historical performance and accuracy trends can evaluate the performance of each algorithm more comprehensively and accurately, making weight adjustments more flexible and adaptive to dynamic changes in data.

[0296] It can better balance the contributions of different algorithms in the model and improve the performance and stability of the integrated model, especially when the data distribution changes or different algorithms show differences at different stages.

[0297] S24 uses a multi-indicator comprehensive judgment convergence criterion, combining the rate of change of the objective function, the performance indicators of the model on the training set, and the stability of the weights to determine whether the model has converged. This can more comprehensively and accurately evaluate the training status of the model and avoid making wrong judgments due to the limitations of a single indicator.

[0298] When multiple convergence judgment indicators and corresponding thresholds are set, the following calculation is performed:

[0299] S24-1, calculate the rate of change of the objective function between adjacent iterations

[0300]

[0301] S24-2, calculate the rate of change of the model's accuracy (or other appropriate performance indicators) on the training set between adjacent iterations

[0302]

[0303] S24-3, calculate the average rate of change of algorithm weights

[0304]

[0305] S24-4, the model is considered to have converged when the following conditions are met:

[0306] δL≤∈1 and δAccuracy≤∈2 and δω≤∈3

[0307] Among them, ∈1, ∈2 and ∈3 are pre-set thresholds, which can be adjusted according to specific problems and data.

[0308] The convergence criterion of comprehensive judgment of multiple indicators can more comprehensively consider the training situation of the model and reduce the misjudgment caused by the fluctuation of a single indicator. Combining the judgment method of objective function, training set performance indicator and weight stability can more accurately determine whether the model has converged to a better state and improve the training effect and reliability of the model.

[0309] Step S25: Use the final model to perform risk prediction and audit optimization.

[0310] The embodiments of the present application integrate multiple algorithms, including algorithms based on network diffusion, classification algorithms based on features, algorithms based on matrix decomposition, and GNN algorithms, etc. These algorithms analyze telecommunication business data from different angles and dimensions, complement each other, and form a comprehensive risk monitoring system. Different algorithms can play their respective advantages for different types of risks and data characteristics, thereby achieving comprehensive coverage of various risks in telecommunication services.

[0311] For example, algorithms based on network diffusion can effectively discover the propagation path and impact range of risks in the network structure, feature-based classification algorithms can quickly identify potential risk patterns based on business indicators and user behavior characteristics, and algorithms based on matrix decomposition can mine potential factors and associations in data, while GNN algorithms have unique advantages in processing complex relationships and topological structure data. Through the collaborative work of these algorithms, the system can capture various potential risks more comprehensively and accurately, avoiding the limitations and blind spots that may exist in a single algorithm, and improving the overall effectiveness and efficiency of risk management.

[0312] In practical applications, the real-time performance and rapid response capabilities of the embodiments of the present application are crucial to ensuring the stable operation of telecommunications services. The system can process and analyze a large amount of risk data in real time and provide accurate risk prediction results in a timely manner. This enables operators to quickly grasp the risk dynamics in business operations and take corresponding measures to prevent and control risks in a timely manner.

[0313] For example, when it is monitored that the number of discount labels accepted by outlets in a certain area suddenly increases or certain key business indicators, such as the broadband disassembly rate that month, show abnormal fluctuations, the system can analyze the possible risk causes and impact scope through correlation prediction algorithms in a short period of time, and promptly feed back this information to the relevant business control departments.

[0314] Operators can make decisions quickly based on this information, such as optimizing business processes, adjusting the configuration of sales rules, strengthening the management and control of acceptance rights to avoid excessive discounts, etc., thereby effectively reducing the impact of risks on business, ensuring the normal user experience, and maintaining the stable operation of telecommunications services. This real-time and rapid response capability is an important embodiment of the embodiments of this application in improving overall efficiency, providing telecom operators with an efficient and reliable risk management solution.

[0315] In addition, you can also use the Echarts framework to achieve dynamic interactive effects, and display risk data in real time on the big screen through its configuration items and data interfaces. The visual monitoring big screen module builds data visualization components based on the D3.js library, and displays the above analysis results in clear and intuitive charts, such as bar charts showing the number of users with different risk levels, line charts showing the changes in user churn rate over time, and pie charts showing the risk ratio of each package type, etc., which makes it convenient for managers to grasp risk dynamics in a timely manner and formulate targeted marketing strategies.

[0316] The Echarts framework is used to achieve dynamic interactive effects, and risk data is displayed on the big screen in real time through its configuration items and data interfaces. The visual monitoring big screen module builds data visualization components based on the D3.js library, and displays the above analysis results in clear and intuitive charts.

[0317] Specifically, the following data visualization techniques are included:

[0318] Use a bar chart to show the quantitative distribution of different types of risks. For example, use the bar function in the matplotlib library. The formula is plt.bar(x,height), where x is the risk type and height is the number of the corresponding type.

[0319] Use a line graph to present the changing trend of risk indicators over time, such as the plot function in matplotlib. The formula is plt.plot(x,y), where x is the time point and y is the risk indicator value.

[0320] Use pie charts to show the proportion of each risk in the total, such as the pie function of matplotlib, the formula is plt.pie(sizes), where sizes is the proportion of each risk.

[0321] Heatmap: Use the heatmap function in the seaborn library. The formula is sns.heatmap(data,cmap), where data is the data matrix to be displayed and cmap is the specified color map.

[0322] Boxplot: It is implemented through the boxplot function of matplotlib. The formula is plt.boxplot(data), where data is the data for drawing the boxplot.

[0323] Radar chart: drawn using the matplotlib library. The core formula is to calculate the angle angle = 2*np.pi*i / num_vars (i is the variable index, num_vars is the total number of variables) and the coordinates x = r*np.cos(angle), y = r*np.sin(angle) (r is the value of the corresponding variable).

[0324] Map visualization: Use the folium library to display geographic data by adding elements such as markers and polygons. For example, the formula for adding markers is folium.Marker([latitude, longitude], popup = ' Info ').add_to(map), where latitude and longitude are geographic coordinates and popup is popup information.

[0325] Bubble chart: In matplotlib, this can be achieved by setting the size and color of the points, for example, plt.scatter(x,y,s=size,c=color), where size is the bubble size and color is the bubble color.

[0326] Funnel chart: Usually you need to customize the calculation of the conversion rate and display width of each stage. For example, the formula for calculating the conversion rate is conversion_rate=current_stage_count / previous_stage_count.

[0327] Sankey diagram: Generally, a specialized library such as pySankey is used, and the specific functions and parameters are set according to the library documentation.

[0328] The embodiments of this application achieve comprehensive, in-depth and accurate monitoring and prediction of telecommunications business risks through technical innovations in natural language processing, model optimization, and association prediction. This comprehensive risk management capability enables operators to more clearly understand the various risk conditions in business operations, discover potential risk points in a timely manner, and take targeted measures to prevent and control them.

[0329] Based on accurate risk prediction results, the embodiments of the present application provide powerful decision support for operators. Operators can optimize business processes, adjust marketing strategies, and reasonably allocate resources based on risk assessment results, thereby improving operational efficiency and service quality and enhancing market competitiveness.

[0330] For example, in terms of package design, by analyzing user behavior data and risk-related information, operators can launch package plans that are more in line with user needs and have lower risks, etc.

[0331] With the continuous development and innovation of telecommunications services, new risk types and data models continue to emerge. The embodiments of this application have good scalability and adaptability, can quickly integrate new algorithms and technologies, continuously improve the performance and functions of the system, and meet the new requirements of business development for risk management.

[0332] For example, with the widespread application of 5G technology, the amount of telecommunications business data has exploded, the data types have become more diverse, and the business scenarios have become more complex. The embodiments of the present application can flexibly expand and adjust the algorithm model to adapt to the data characteristics and business needs of the 5G era.

[0333] At the same time, by continuously introducing new algorithms and technologies, such as the latest research results in deep learning and more efficient graph computing methods, we continue to optimize risk prediction and management capabilities, providing strong support for telecom operators to maintain their competitive advantage in a rapidly changing market environment.

[0334] In the embodiment of the present application, by acquiring risk data and potential risk data, risk data is data monitored by the risk monitoring system, and potential risk data is data that is not included in the monitoring scope of the risk monitoring system, comprehensive coverage of risks is achieved, and the coverage rate of risk identification is improved. Risk data and potential risk data are input into a pre-trained risk prediction model, and multiple similarity matrices are calculated by multiple association prediction algorithms in the risk prediction model. The similarity matrix is ​​used to characterize the potential association relationship between risk data and potential risk data; through multiple association prediction algorithms, the advantages of each algorithm are comprehensively utilized to improve the prediction accuracy. Based on the target weighted value, multiple similarity matrices are weighted to obtain a comprehensive similarity matrix, which is used to characterize the comprehensive association relationship between risk data and potential risk data; according to the comprehensive similarity matrix, the target potential risk data is screened out from the potential risk data, and the target potential risk data is data that has an association relationship with the risk data. Through the comprehensive similarity matrix, the target potential risk data that has an association relationship with the risk data is accurately screened out, the accuracy of risk identification is improved, the burden of manual investigation is reduced, and various abnormal problems in the business can be covered more comprehensively.

[0335] The following is explained in conjunction with several specific embodiments:

[0336] Embodiment 1

[0337] Example 1.1: As of August 2024, there are 283 monitoring points in the risk monitoring system of telecom operators, and each monitoring point outputs suspected risk data every month. For example, there are 10 risk audit points in the risk audit system of telecom operators, and each audit point regularly outputs a list of suspected risk data. Through the data acquisition module, the system automatically collects these data lists and the response results of manual verification by the branch.

[0338] For example, at the card maintenance monitoring point, it was found that the average daily user development volume of a certain agent outlet in the last 3-5 days of the month was more than 40% higher than the average daily user development volume in other periods, triggering an early warning of suspected card maintenance.

[0339] Example 1.2: The natural language processing module analyzes the text of the manual reply to extract the risk confirmation and feature information. For example, if the reply text of the monitoring point for the account adjustment operation during the billing period contains "excessive discount", the data is marked as high risk.

[0340] For example, in the card maintenance monitoring point, if the reply text contains "few calls, no call records, etc.", the data is marked as high risk for card maintenance.

[0341] Convolutional Neural Network (CNN) and Recurrent Neural Network (RNN) are used to conduct in-depth analysis of text and extract richer semantic information and contextual relationships.

[0342] Example 1.3: The machine learning tuning module receives the output of the natural language processing module and performs further analysis and learning. By adjusting model parameters, such as the penalty coefficient of the support vector machine (SVM), the model is optimized to more accurately identify risks.

[0343] For example, for user data whose total commission of a certain branch is 0 for three consecutive months, the model can determine whether the suspected card maintenance users should be excluded.

[0344] The Random Forest algorithm is used for feature selection and model optimization to automatically select the most important features for risk prediction and improve the performance of the model. For example, from many user behavior features, features that are highly related to card maintenance behavior, such as "monthly contact number concentration" and "short-term network closure" are selected.

[0345] Example 1.4: The association prediction algorithm module uses 5 different algorithms to analyze risk data and predict potential associations with unmonitored business indicators. The prediction results Y(1) to Y(5) are used for subsequent processing.

[0346] For example, through an algorithm based on matrix decomposition, it was found that the card-maintaining behavior is correlated with the concentration of base station information in a certain area, that is, the number of base stations to which the communication call records of a large number of suspected card-maintaining users belong is extremely small.

[0347] The Graph Neural Network (GNN) algorithm is introduced to better capture the complex relationships and topological structures between data and improve the accuracy of association prediction.

[0348] Example 1.5: Based on these prediction results, the prediction similarity matrices G_A^(l) and G_B^(l) of the monitored entity are calculated according to the formula. Then, the prediction similarity matrices are sparsely processed to obtain G_AS^(l) and G_BS^(l). Next, the integrated similarity matrices GAS(l) and GBS(l) of the monitored entity are calculated by weighted superposition:

[0349]

[0350] In the application of card maintenance monitoring, for example, for the card maintenance risk prediction of multiple agent outlets, by calculating the integrated similarity matrix, the similarity and correlation degree of the card maintenance behaviors between the outlets can be comprehensively considered.

[0351] Example 1.6: Perform sparse processing to retain strong connections and remove noise.

[0352] In card maintenance monitoring, this helps highlight those outlets where card maintenance behavior is obvious and closely related, and reduce interference from irrelevant information.

[0353] Example 1.7: Calculate the integrated similarity matrix by weighted superposition The weight Acquired through adaptive learning.

[0354] For example, based on historical data and model training results, the weight of each algorithm in the risk prediction of card maintenance is automatically adjusted, so that the algorithm that predicts card maintenance behavior more accurately has a higher weight.

[0355] Example 1.8: Using an autoencoder to extract low-dimensional features F from the original similarity matrix A and F B , combined with the integrated similarity matrix to build an adaptive weighted integration model.

[0356] In card maintenance monitoring, by extracting low-dimensional features, we can more deeply explore the essential characteristics and potential correlations of card maintenance behavior.

[0357] Example 1.9: The model is trained and optimized by solving the objective function and updating the optimization variables alternately until the convergence condition is met. During the training and optimization process of the card maintenance monitoring model, the model parameters are continuously adjusted to improve the recognition accuracy and prediction ability of the card maintenance behavior.

[0358] Example 1.10: Finally, the converged model is used to reconstruct the prediction matrix to obtain the potential correlation prediction results between the risk data and the business quality indicator data that are not included in the audit risk model monitoring. For example, it is predicted that certain card maintenance behaviors are potentially correlated with the marketing methods of specific business packages, providing a basis for telecom operators to further optimize risk management strategies.

[0359] Through the above actual cases, the specific application and effectiveness of the embodiments of the present application in card maintenance monitoring points are demonstrated, which can more accurately identify and predict card maintenance risks and provide strong support for the risk management of telecom operators.

[0360] Embodiment 2

[0361] This section describes in detail the specific implementation methods of the telecommunications audit risk intelligent prediction and optimization system, including system construction, data flow, algorithm application and example description, to demonstrate its practicality, replicability and scalability.

[0362] System construction and deployment: System construction begins with the deployment of the data acquisition module, which serves as the data input interface of the system and is responsible for obtaining the suspected risk data list and the corresponding manual verification results from the risk audit system of the telecom operator in real time. The data acquisition module needs to be able to process large-scale data and have an efficient data synchronization mechanism.

[0363] Data collection and preprocessing: The acquired data first enters the data preprocessing stage, including data cleaning, data formatting and data standardization. This step ensures the data quality for subsequent processing.

[0364] Risk text analysis and processing: After data cleaning, the verification text enters the natural language processing module. This module first performs word segmentation and part-of-speech tagging on the text, and then extracts key entities such as "abnormal traffic / ordering" and other risk indicators through named entity recognition (NER) technology. Then, sentiment analysis is used to determine the risk tendency of the text.

[0365] Risk feature extraction and machine learning model training: In the machine learning tuning module, the labeled risk data is used to train the classification model. A support vector machine (SVM) is used to classify the risk data, and the penalty coefficient C and kernel function parameters are adjusted to optimize the model performance.

[0366] Association prediction model integration: The association prediction algorithm module integrates multiple algorithms, such as content-based recommendation algorithms and collaborative filtering algorithms, to predict the potential association between risk data and unmonitored business indicators. Each algorithm analyzes different aspects of the data according to its characteristics.

[0367] Dimensionality reduction module construction: The dimension reduction module uses an autoencoder to convert the high-dimensional similarity matrix into a low-dimensional feature matrix. These feature matrices capture the inherent structure of the data and provide feature support for risk prediction.

[0368] Model training and optimization: In the model reconstruction and prediction module, an adaptive weighted ensemble model is constructed. The AdamW optimizer is used to update the model parameters according to the objective function, where the objective function combines the prediction error and the regularization term to prevent overfitting.

[0369] Example: As of August 2024, there are 283 monitoring points in the risk monitoring system of telecom operators, and each monitoring point outputs suspected risk data every month. The natural language processing module identifies keywords such as "abnormal traffic / ordering", and the machine learning module trains a risk classification model based on this. The association prediction algorithm module finds that "abnormal traffic / ordering" has a potential association with specific business indicators. The similarity calculation model further extracts the features of this data and optimizes the model weights through an integrated learning framework. The final prediction model identifies high-risk areas and provides them to decision makers for verification.

[0370] Model evaluation and iteration: The model evaluation uses the 10-fold cross-validation method, and the evaluation indicators include accuracy, recall, and F1 score. According to the evaluation results, the model parameters and algorithm weights are adjusted to achieve iterative optimization of the model.

[0371] User Interface and Interaction: The system provides a user-friendly interface that allows telecom operators’ risk managers to monitor risk prediction results, adjust model parameters, perform risk checks, and view optimization suggestions.

[0372] System deployment and maintenance: The system is deployed on the telecom operator's server and is regularly maintained and updated to adapt to changing business needs and data characteristics.

[0373] Through the above steps, the telecommunications audit risk intelligent prediction and optimization system can realize the full process automation from data collection to risk prediction to decision support, which significantly improves the intelligence level of telecommunications business risk management.

[0374] Embodiment 3

[0375] Deployment of a single module.

[0376] Example 2.1: Taking P3301_Agency network status abnormality audit as an example, when the risk audit system of the telecom operator audits the agency network on the 15th of a certain month, it is found that the status of a certain agency network is abnormal, specifically, the agency network is in an invalid state, and the amount of commission audited by the telecom operator in that month is greater than zero. Through the data acquisition module, the system automatically collects the relevant data of the network and triggers an abnormal work order.

[0377] Example 2.2: In the audit of P3304_Ledger Commission Ratio Too High, the system counts the agency outlets as units and finds that the agency outlet commission of a certain outlet is greater than 2,000 yuan (including commission account adjustment), and the account ratio is greater than or equal to 20%. At the same time, the agent outlet status is not 'S0X' in the current period, and the TEMPLATE_ID (commission settlement template) of the outlet is not within the range of excluded data. The natural language processing module analyzes the text of the relevant manual reply and extracts the risk information that the outlet may have a high account commission ratio.

[0378] Example 2.3: For the audit of P3305_high-value ledgers, the system counts the amount of ledgers at the agency outlets and finds that the amount of ledgers at a certain outlet exceeds 10,000 yuan, and the relevant data of the outlet meets the other conditions of the audit. The machine learning tuning module analyzes the historical data of the outlet and further confirms that the outlet may have the risk of high-value ledgers.

[0379] Example 2.4: In P3306_Commission Adjustment Audit, the system collects commission settlement data for the current month by agency outlets and finds that the absolute value of an agency outlet's adjustment exceeds 3,000 yuan, and the adjustment is abnormal. The association prediction algorithm module predicts that the outlet may have artificially adjusted commissions by analyzing the outlet's historical data and other related data.

[0380] Example 2.5: P3309_In the audit of commission 0 bill users, the system uses the analysis results of non-billed users, 0 billed users, re-entered users, and agent card users in the development quality monitoring analysis of the market department, and finds that some numbers of a certain agent with commissions greater than 0 have bills of 0, and these numbers meet the audit rules, such as excluding new mobile number 0 billed users in the current month. The natural language processing module analyzes the relevant manual verification results and confirms these abnormal situations.

[0381] Example 2.6: In P3317_Audit of suspected card maintenance (social channels), the system discovered that an agent outlet of a social channel had suspected card maintenance behavior, and assigned an order according to the audit criteria. The physical channel sent the work order to the branch company for verification.

[0382] Example 2.7: In P3318_Suspected Card Maintenance Audit (Electronic Channel), based on the abnormal list of the suspected card maintenance model, the system discovered that an agent outlet of a certain electronic channel had suspected card maintenance behavior, and assigned the work order to the corresponding channel responsible personnel for verification according to the audit caliber.

[0383] Example 2.8: P3321_In the audit of overdue unpaid negative commissions by agents, the system monitors on a monthly basis and aggregates them by agent. It is found that an agent has negative commissions that have not been paid for more than 3 months. The branch office will feedback the reason for non-payment in the system to form a closed-loop management.

[0384] Example 2.9: In P3322_Reverse Settlement User Audit (ITV), the SP / CP value-added service revenue dimension is analyzed, and the data of group SP / CP settlement, provincial SP / CP settlement and municipal SP / CP settlement are summarized. It is found that the SP / CP value-added service revenue of a certain agent is less than the settlement expenditure, which triggers an abnormal work order.

[0385] Example 2.10: In P3323_In the user disassembly audit (ITV) for accounts receivable settlement, according to the rules of settlement based on accounts receivable, the system checks the online status of users of a certain business and finds that the user has completed the disassembly, but the subsequent ordering platform still generates fees and participates in the settlement. This situation violates the provisions of the audit scope.

[0386] Example 2.11: In P3324_Risk Audit of Arrears in Accounts Receivable Settlement (ITV), the system checks the arrears of users of its business according to the rules of accounts receivable settlement and finds that a group of users have arrears for more than 3 months and the arrears rate is 1.5 times higher than the bad debt rate, and issues a risk warning to the corresponding business operation department.

[0387] Example 2.12: In P3325_ Audit of abnormal fluctuations in settlement costs (ITV), data files were obtained from the SPOA settlement system. After removing the hundred-number data, the system found that the settlement costs of a certain platform product fluctuated abnormally. After verification, it was due to system reasons. Subsequently, the system settlement cost calculation accuracy was optimized through fault reporting.

[0388] Example 2.13: In P3326_Multiple Settlement Audits (No. 100), the system retrieved the ratio data of the sum of the settlement amounts of all partners of a certain business to the total settlement amount of the business, and found that there was an abnormal situation with a ratio greater than 85%. After verification, it was found that it was caused by human factors. Subsequently, the relevant responsible persons were punished and multiple settlement audits were strengthened.

[0389] Example 2.14: In P3327_Reverse Settlement User Audit (Number 100), the system summarizes the outgoing amount and business settlement amount of the numbers involved in each business in the previous month's account period, and screens out abnormal data where the outgoing amount of a certain business is less than the settlement amount. After verification, it was found that this was caused by unclear business rules. Subsequently, the business rules were optimized and the relevant agents were rectified.

[0390] Example 2.15: In P3328_Audit of user dismantling of accounts receivable for settlement (No. 100), the system retrieves the user data of users who dismantled their machines before last month, verifies the settlement period of last month, and finds that a group of users still participate in the settlement after the machines have been dismantled. After verification, it is found that this is caused by a system loophole. Subsequently, the system handles the problem through reporting and standardizes the settlement processing mechanism of accounts receivable for dismantled users.

[0391] Example 2.16: In P3329_Audit of abnormal fluctuations in settlement expenses (No. 100), the system performed month-on-month operations based on the business and the settlement amount of the current month to determine the fluctuation ratio. It was found that the settlement expenses of a certain business fluctuated abnormally. After verification, it was found that it was caused by human factors. Subsequently, the relevant responsible persons were punished and the abnormal settlement expense handling mechanism was standardized.

[0392] Example 2.17: P3330_ During the audit of abnormal fluctuations in commission billing data, the system took agency outlets as units for statistics and conducted a month-on-month fluctuation analysis on the billing data. It was found that the total commission of a certain agency outlet last month was within a specific range, while the amount for the current month exceeded the specified percentage. After verification, it was found that this was caused by system reasons, and the accuracy of the system's commission billing was subsequently optimized.

[0393] Example 2.18: P3331_During the audit of abnormal user status, the system audited the commission payment data and found that the status of a group of users was abnormal (suspended due to arrears, dismantled) but they still participated in the commission settlement. After verification, it was found that it was caused by human factors. Subsequently, the relevant responsible persons were punished and the commission settlement mechanism was standardized.

[0394] Example 2.19: In P3332_Suspected card maintenance audit (government and enterprise channels), orders were dispatched based on the abnormal list of the suspected card maintenance model, and it was found that an agent outlet of a government and enterprise channel had suspected card maintenance behavior. After verification and confirmation by various channels, commissions were deducted from the suspected card maintenance outlets.

[0395] Example 2.20: P3333_During the audit of negative cash flow of off-grid users, the system monitors on a monthly basis and audits users who joined the network 7 months ago and are currently off-grid. It was found that the cumulative actual collection of a certain group of users was less than the cumulative paid commissions (number-level commissions). After verification, it was found that this was caused by some irregular operations in the business development process. Subsequently, the relevant business processes were optimized.

[0396] Example 2.21: P3334_Broadband must accept the overtime intensive compensation audit. The system audits the data generated in two links: the cash compensation list and the compensation result. It was found that there were abnormal situations such as overpaid amounts, users, and users who made repeated compensations. After verification, it was found that this was caused by irregular process management. Subsequently, the relevant processes were optimized and standardized.

[0397] Example 2.22: P3335_In the commission audit for changing the main package, the system conducts monthly audits and finds that the interval between a batch of mobile main card numbers that changed their main packages last month and the last change of the main package was less than 3 months, and the output was suspected to be abnormal. After verification, it was found that it was caused by the agents illegally taking commissions. Subsequently, the relevant agents were punished and the audit management was strengthened.

[0398] Example 2.23: P3336_During the audit of large-value channel points, the system checked the results of the redemption of large-value channel points (single number single transaction points exceeding 20,000) and found that a certain outlet had non-compliant points redemption. After verification, it was found that this was caused by poor channel management. Subsequently, the outlet was fined commissions and the channel points management was strengthened.

[0399] Example 2.24: In P3337_ Public exemption and public tax user points audit (pre-audit), the system audited the public exemption and public tax users and found that a certain group of users had abnormal points redemption. After verification, it was found that this was due to irregular user information management. Subsequently, user information management was optimized and points auditing was strengthened.

[0400] Example 2.25: P3338_During the audit of fluctuations in branch points, the system audited the fluctuations in the value points of agent branches with commission redemption records and found that the value points of a certain agent branch were within a specific range last month, but the fluctuation in the value points exceeded the prescribed ratio this month. Upon verification, it was found that this was caused by the illegal business development to obtain commissions. Subsequently, the branch was penalized for commission deductions and its business development was regulated.

[0401] Example 2.26: P3339_During the audit of adjustments and reductions in points at outlets, the system grouped the accounts by outlets and audited the users who participated in the redemption of points for commissions at the outlets last month. It was found that the total adjustment and reduction of points was abnormally more than 1,000. After verification, it was found that this was caused by the risk of illegal acceptance. Subsequently, the outlet was rectified and the points management was strengthened.

[0402] Example 2.27: P3340_In the audit of re-entry users (including commissions and points), the system audits users who install and remove devices once, and finds that a group of users generated points for redemption of commissions when they newly installed the device, but the authenticity of the business is questionable. After verification, it was found that this was caused by the risk of channel or personnel concentration. Subsequently, commissions were deducted from relevant outlets and user audit management was strengthened.

[0403] Example 2.28: P3341_Negative commission points were not included in the commission settlement audit. According to the audit caliber, the system found that a batch of users who joined the network in month T had a single product or integrated users (new or old plus new) with a total score of unsettled commissions less than 0 points and other abnormal situations. After verification, it was found that this was caused by the imperfect commission settlement mechanism. Subsequently, the commission settlement mechanism was optimized and the audit management was strengthened.

[0404] Embodiment 4: Based on the above embodiment, a specific use in the card maintenance monitoring scenario is also proposed:

[0405] Data collection and preparation:

[0406] In the risk audit system of telecom operators, user data within a period of time is selected as the research object. These data include basic information of users (such as user ID, package type, network access time, etc.), consumption behavior data (such as call fee consumption amount, data usage, call duration, etc.), business handling records (such as package change records, participation in preferential activities, etc.) and some indicator data related to card maintenance behavior (such as a large number of card openings in a short period of time, very few calls, abnormal data usage, etc.).

[0407] Natural language processing and feature extraction:

[0408] For manually verified text data, natural language processing is performed. For example, the user complaint text is analyzed to extract information related to card maintenance behavior. The text is segmented using the jieba word segmentation library to divide the text into words. Then, the part-of-speech tagging is performed using the HanLP tool to determine the part of speech of each word. Next, the SpaCy tool is used for named entity recognition to extract key entity information such as "abnormal card opening" and "abnormal call records". At the same time, the TextBlob tool is used for sentiment analysis to determine the degree of user dissatisfaction with the service in the text as an auxiliary feature.

[0409] In terms of feature extraction, in addition to directly obtaining some features from the original data, deep learning algorithms are also used to further extract features. For example, CNN is used to extract features from the user's consumption behavior data. The consumption behavior data (such as the series of phone bill consumption amounts and traffic usage amounts over a period of time) is converted into a two-dimensional matrix form as the input of CNN. CNN automatically captures local patterns and features in the data through convolutional layers and pooling layers, such as the fluctuation pattern of consumption amounts and the periodicity of traffic usage. These features can reflect the potential laws of user behavior and help discover the characteristics of card maintenance behavior.

[0410] Machine learning tuning and association prediction:

[0411] In the machine learning tuning module, the Random Forest algorithm is used for feature selection and model optimization. First, the data after natural language processing and preliminary feature extraction is input into the Random Forest model. RandomForest automatically evaluates the importance of each feature and sorts the features according to the importance score. A subset of features with higher importance is selected for subsequent model training, and some features that contribute less to the prediction results are removed to improve the performance and generalization ability of the model.

[0412] The association prediction algorithm module uses a variety of algorithms to predict the association of card maintenance risks. For example, based on the feature-based classification algorithm, a logistic regression model is used to classify and predict user data. The selected features are used as input to determine whether the user has card maintenance behavior. At the same time, the GNN algorithm is introduced to construct users, business processing records, etc. into a graph structure, in which users are nodes and the relationship between business processing is an edge. Through the message passing and aggregation operations of GNN, the potential associations between users and the propagation mode of card maintenance behavior in the graph structure are captured.

[0413] Adaptive weighted ensemble model and model training optimization:

[0414] In the adaptive weighted integration model, GCN is first used to calculate the predicted similarity matrix of the monitored entity (user). The association relationship between users (such as call records, jointly participated business activities, etc.) is constructed as a graph structure, and the node embedding representation of each user is obtained through the multi-layer convolution operation of GCN. Then, the similarity between users is calculated based on the node embedding representation to construct the predicted similarity matrix.

[0415] The predicted similarity matrix is ​​subjected to adaptive threshold sparse processing. The average similarity and standard deviation of the similarity between each user and its neighbor users are calculated, and the sparse threshold T is set. i =μ i +ασ i , where α is an adjustment coefficient. For similarity less than T i For user pairs, set their elements in the prediction similarity matrix to 0 to obtain a sparse matrix.

[0416] The integrated similarity matrix is ​​calculated by weighted superposition. The prediction similarity matrices obtained by different algorithms (such as feature-based classification algorithms, GNN algorithms, etc.) after sparse processing are weighted and summed according to the dynamic weighting strategy. The dynamic weight is calculated based on the prediction performance of each algorithm on different data subsets, and the specific method is as described above.

[0417] Construct a multi-layer autoencoder network, including encoder and decoder parts. The encoder consists of multiple fully connected layers, mapping the high-dimensional input data to a low-dimensional latent space to obtain a low-dimensional feature representation: Encoder: z = Encoder (x), the decoder also consists of multiple fully connected layers, trying to reconstruct the original data from the low-dimensional feature representation: Decoder: The loss function of the autoencoder is defined as the reconstruction error, that is, The autoencoder network is trained by minimizing this loss function. After training, the encoder part is used to map the original data into a low-dimensional feature space to obtain the low-dimensional feature F of each monitored entity. A and F B .

[0418] When constructing the adaptive weighted integration model, a multi-head attention mechanism is introduced. The low-dimensional feature matrix F A and F B They are input into the multi-head attention mechanism respectively. For each attention head h, the attention weight is calculated as follows:

[0419]

[0420] in are the weight parameters of the query matrix and the key matrix respectively, d kis the dimension of the attention head. Through the calculation of multiple attention heads, multiple attention weight matrices are obtained, and they are concatenated to obtain the final attention weight matrix A. Then, the attention weight matrix A interacts with the low-dimensional feature matrix to obtain the enhanced feature representation F' A and F' B .

[0421] Define the objective function for model training optimization. The objective function includes the cross entropy loss function and the model complexity regularization term. The specific form is as follows:

[0422]

[0423] Y ij is the actual association matrix element, indicating the probability that there is a card maintenance association between user i and user j (1 means existence, 0 means non-existence), P ij is the probability predicted by the model that there is a card-keeping association between user i and user j. λ0, λ1, λ2, λ3, and λ4 are regularization coefficients used to adjust the importance of different items in the objective function. They represent the square of the Frobenius norm of matrices W0, W1, W2, W3, and W4, respectively, and are used to control the complexity of the model and prevent overfitting.

[0424] During the training process, automatic differentiation technology is used to calculate the partial derivatives of the objective function with respect to each variable, and gradient clipping technology and AdamW optimization algorithm are applied to update the model parameters. Through continuous iterative training, the weights and parameters of the model are adjusted to gradually converge the objective function.

[0425] Model evaluation and application:

[0426] The model was evaluated using the 10-fold cross-validation method. The data set was randomly divided into 10 subsets of equal size, and 9 of the subsets were used as training sets and 1 subset was used as validation sets for model training and validation. Evaluation indicators include accuracy, recall, and F1 score. Through multiple cross-validations, the average performance indicators of the model were obtained to evaluate the accuracy and reliability of the model in the card maintenance risk prediction task.

[0427] Based on the prediction results of the model, operators can promptly identify potential card-maintaining users and take corresponding measures to prevent risks, such as strengthening user identity authentication, restricting abnormal business processing, monitoring suspicious users, etc. At the same time, through the correlation analysis of card-maintaining behavior and other business quality indicator data, operators can deeply understand the impact of card-maintaining behavior on the business and provide a basis for optimizing business strategies.

[0428] Results and discussion:

[0429] Through the application of this embodiment, the effectiveness of the embodiment of the present application in card maintenance monitoring is demonstrated. Compared with traditional methods, the introduced deep learning algorithms (such as CNN, GNN) and advanced model optimization techniques (such as adaptive weighted integration model, dynamic weight adjustment, etc.) can more accurately capture the complex relationship between user behavior characteristics and data, and improve the accuracy of card maintenance risk prediction. For example, in actual applications, the model's accuracy rate reached 89%, the recall rate reached 90%, and the F1 score reached 0.9, which is a significant improvement compared to traditional methods.

[0430] The natural language processing module can effectively extract valuable information from the manually verified text, and combined with other data features, it further enriches the model input and improves the model's ability to identify risks. At the same time, the integration and collaborative working of multiple algorithms enable the model to comprehensively analyze the risks of card maintenance from different angles, avoiding the limitations of a single algorithm and providing telecom operators with a more comprehensive and accurate risk management tool.

[0431] Example 5: Based on the above example, a specific use in the package marketing risk analysis scenario is also proposed

[0432] Data collection and preprocessing:

[0433] Collect data related to package marketing of telecom operators, including detailed information of different packages (such as package content, price, preferential policies, etc.), users' package selection records, users' basic information (age, gender, region, etc.), users' consumption behavior data (call duration, data usage, number of text messages, etc.) and market feedback data (user satisfaction surveys, complaint records, etc.).

[0434] Preprocess the collected data. Clean the data to remove duplicate, invalid or abnormal data records. Fill missing values ​​appropriately, such as using mean filling, median filling or prediction filling based on other features. Encode categorical data and convert it into numerical form for model processing.

[0435] Natural Language Processing and Feature Engineering:

[0436] Perform natural language processing on user comments and complaint texts in market feedback data. After using the jieba word segmentation database for word segmentation, use the HanLP tool to perform part-of-speech tagging and named entity recognition to extract keywords and entity information related to package marketing risks, such as "high package fees", "insufficient traffic", "poor signal", etc. At the same time, use the TextBlob tool to perform sentiment analysis and divide the text sentiment into three categories: positive, negative, and neutral, as a feature variable for subsequent analysis.

[0437] In terms of feature engineering, in addition to the features in the original data, some new features are also constructed. For example, the ratio of the user's monthly consumption amount to the package price is calculated as an indicator of the user's perceived cost-effectiveness of the package; the difference in the user's call duration and traffic usage in different time periods (such as weekdays and weekends, daytime and night) is calculated to reflect the user's usage habits. In addition, based on the user's historical package change records, the frequency and interval of package changes are calculated as potential indicators of user loyalty and package satisfaction.

[0438] Association prediction and risk analysis:

[0439] A variety of association prediction algorithms are used to analyze package marketing risks. Based on the network diffusion algorithm, users are regarded as nodes, and the social relationships between users (such as phone calls, joint participation in activities, etc.) are regarded as edges to build a social network. By simulating the spread of risks in social networks, the scope of impact and spread trend of package problems on other users are analyzed. For example, if a user expresses dissatisfaction with a package and spreads this dissatisfaction in the social network, the algorithm based on network diffusion can predict other user groups that may be affected.

[0440] Based on the feature classification algorithm, the decision tree algorithm is used to predict whether users will churn due to package problems. The user's features are used as input, including features extracted from the original data and new features constructed through feature engineering, to build a decision tree model. The decision tree can intuitively show the relationship between different feature combinations and user churn risks by dividing features and generating decision rules.

[0441] Combined with the GNN algorithm, information such as packages, users, user behavior, and market feedback is constructed into a more complex graph structure. In this graph structure, not only the social relationship between users is considered, but also the selection relationship between packages and users, the association relationship between user behavior and packages, and the relationship between market feedback and users and packages. Through GNN's message passing and aggregation operations, the risk information hidden in these complex relationships is deeply mined. For example, GNN can discover the potential association between certain package features and the behavior patterns of a specific user group, thereby predicting the risks that these packages may face in this user group.

[0442] Similarity calculation model and comprehensive analysis:

[0443] The autoencoder model is used to further analyze the potential relationship between packages and users. By extracting features from the user-package selection matrix, the user-package potential feature matrix is ​​obtained. These low-dimensional potential features can capture the characteristics of users and packages in the potential dimensions, as well as the relationship between them.

[0444] Construct a multi-layer autoencoder network, including encoder and decoder parts. The encoder consists of multiple fully connected layers, mapping the high-dimensional user-package selection input data to a low-dimensional latent space to obtain a low-dimensional feature representation: Encoder: z = Encoder(x) The decoder also consists of multiple fully connected layers, trying to reconstruct the original data from the low-dimensional feature representation: Decoder: The loss function of the autoencoder is defined as the reconstruction error, that is, The autoencoder network is trained by minimizing this loss function. After training, the encoder part is used to map the original data into a low-dimensional feature space to obtain the low-dimensional features of each monitored entity. By analyzing these potential features, the user's preference patterns for packages and the similarities and differences between packages can be discovered.

[0445] The low-dimensional features obtained by the autoencoder are combined with the results obtained by the previous association prediction algorithm to comprehensively consider the impact of multiple factors on package marketing risks. For example, the user-package association information obtained by the GNN algorithm is combined with the user and package potential features obtained by the autoencoder to build a more comprehensive risk assessment model. This can fully utilize the advantages of different algorithms and models, deeply analyze package marketing risks from multiple angles, and improve the accuracy and reliability of risk prediction.

[0446] Model training optimization and result visualization:

[0447] During the model training process, an optimization method similar to that in Example 1 is used. An objective function containing multiple contents is defined, the gradient is calculated by combining the automatic differentiation technique, the gradient clipping technique is applied to prevent gradient explosion, and the AdamW optimization algorithm is used to update the model parameters. At the same time, a dynamic weight adjustment mechanism based on historical performance and current prediction error is introduced to dynamically adjust the weights of different algorithms in the model to better adapt to the characteristics and changes of the data.

[0448] Through continuous iterative training and adjustment of model parameters, the objective function gradually converges to obtain a model that can accurately predict package marketing risks. Then, the prediction results of the model are visualized. Use a bar chart to show the distribution of risk levels of different packages to help operators intuitively understand the degree of risk faced by each package; use a line chart to show the trend of user churn rate over time, and perform correlation analysis with the launch time of different packages to find out the impact of package factors on user churn; use a pie chart to show the distribution of user satisfaction with different packages, find out the packages with low satisfaction, and provide a basis for package optimization.

[0449] Example results and application value:

[0450] In practical applications, through the method of this embodiment, operators can more accurately identify high-risk packages and potential risk factors. For example, if it is found that certain packages have a high risk of churn in a specific user group, it may be because the package content does not match user needs, or the package price is too high, resulting in a decrease in user satisfaction. Based on these analysis results, operators can adjust package strategies in a targeted manner, such as optimizing package content, lowering prices, launching personalized packages, etc., to reduce risks and improve the market competitiveness and user satisfaction of packages.

[0451] In addition, through comprehensive analysis and visual display of package marketing risks, operators can better grasp market dynamics and changes in user demand, adjust marketing strategies in a timely manner, and improve the scientificity and accuracy of marketing decisions. At the same time, the method of this embodiment also provides operators with an effective risk monitoring method, which can monitor the risk status of package marketing in real time, discover problems in a timely manner and take measures to intervene, so as to ensure the stable development of the business.

[0452] Embodiment 6: Based on the above embodiment, a specific use in the scenario of network failure and service impact analysis is also proposed:

[0453] Data collection and compilation:

[0454] Data related to network failures and business impacts are collected from multiple data sources such as the network management system and business operation support system of telecom operators. These data include the operating status data of network equipment (such as device type, device ID, CPU usage, memory usage, port status, etc.), network traffic data (such as the traffic size, flow direction, protocol type, etc. between different network nodes), performance indicator data of business systems (such as business processing delay, success rate, number of concurrent users, etc.), and user complaints and feedback data.

[0455] The collected data is sorted and integrated to establish a unified data format and data warehouse for subsequent analysis and processing. At the same time, the data is aligned in time series to ensure that the data from different data sources are consistent in the time dimension.

[0456] Feature extraction and graph construction:

[0457] Extract features related to network failures and business impacts from the collated data. For example, calculate the resource utilization change rate of network equipment in different time periods, abnormal fluctuation indicators of network traffic, deviation of business system performance indicators, etc. These features can reflect the operating status of the network and business as well as potential risk factors.

[0458] Build a graph structure based on the network topology and business association relationships. Use network devices, business systems, user terminals, etc. as nodes, and the connection relationship between devices, the dependency relationship between businesses, and the usage relationship between users and businesses as edges. Give each node and edge corresponding feature information, such as the type and attribute of the node, the weight and direction of the edge, etc. In this way, complex networks and business relationships are converted into intuitive graph data, which is convenient for analysis using the GNN algorithm.

[0459] GNN algorithm application and analysis:

[0460] The constructed graph data is input into the GNN model for training and analysis. In each layer of the GNN, nodes exchange information with neighboring nodes through a message passing mechanism and update their own feature representations. Through multiple layers of iterative calculations, the feature information of the node gradually integrates the information of the surrounding neighbors and the overall structural information of the graph, thereby better capturing the complex relationship between network failures and business impacts.

[0461] For example, when a network device fails, GNN can propagate fault information through the graph structure and predict other devices and business systems affected by the failure. At the same time, based on information such as changes in performance indicators of the business system and user complaint feedback, it can reversely infer potential causes and risk propagation paths that may lead to the failure. In this way, GNN can provide strong support for the rapid location of network failures and the assessment of business impact.

[0462] Model training optimization and result interpretation:

[0463] During the training process of the GNN model, an optimization method similar to the previous embodiment is used. A suitable loss function is defined, the gradient is calculated in combination with the automatic differentiation technique, and the optimization algorithm (AdamW) is used to update the model parameters. At the same time, in order to improve the generalization ability of the model and its adaptability to the dynamic network environment, a strategy of regularly updating the model parameters is adopted to continuously adjust the model according to new data.

[0464] Explain and visualize the analysis results of the GNN model. Use visualization tools to present information such as network fault propagation paths, business impact range, and the strength of association between nodes in a graphical manner. For example, use a heat map to show the importance of a node in the fault propagation process. The darker the color, the greater the impact of the node on the fault propagation. Use arrows and line thickness to indicate the direction and strength of fault propagation. In this way, network operation and maintenance personnel can intuitively understand the relationship between network faults and business impacts, and quickly formulate corresponding fault recovery and business assurance measures.

[0465] Practical application effects and significance:

[0466] In actual telecommunications network operations, the method of this embodiment can help operators detect network failures in a timely manner and accurately assess the impact of failures on services. Through early warning and rapid response, operators can reduce failure losses and improve network reliability and business continuity. For example, in a network failure event, the GNN model predicted in advance the scope of services that may be affected by the failure. The operator took measures such as traffic scheduling and service switching in a timely manner based on the prediction results, avoiding large-scale business interruptions and ensuring the normal user experience.

[0467] In addition, through in-depth analysis of the relationship between network failures and business impacts, operators can discover potential risk points and weak links in the network, providing a basis for network optimization and upgrades. For example, according to the GNN model analysis, it is found that certain devices or links have played a key role in multiple failure events. Operators can strengthen the maintenance of these devices and the redundancy of links in a targeted manner to improve the overall stability and risk resistance of the network.

[0468] Example 7: Based on the above example, a specific use in the agent risk management scenario is also proposed

[0469] Data collection and preprocessing:

[0470] Collect various types of data related to agents, including basic information of agents (such as agent ID, name, location, cooperation time, etc.), business development data (such as the number of users developed, business volume, business income, etc.), commission data (such as commission calculation method, commission payment records, commission adjustment, etc.), user complaint data (complaint content involving agents, number of complaints, etc.) and other data related to agent behavior (such as participation in marketing activities, violation records, etc.).

[0471] Preprocess the collected data. Check the integrity and consistency of the data, and remove duplicate and obviously erroneous data. For missing values, use appropriate methods to fill in the missing values ​​according to the characteristics of the data, such as using the mean or median for continuous data, and using the mode for discrete data or inferring and filling based on other relevant information. Standardize the data to make the data of different indicators comparable.

[0472] Risk indicator construction and feature engineering:

[0473] Based on the collected data, a series of indicators related to agent risks are constructed. For example, the agent's business development growth rate, commission fluctuation coefficient, complaint rate, user churn rate and agent relevance are calculated. These indicators can reflect the agent's operating status and potential risks from different angles.

[0474] Further explore the potential information in the data through feature engineering. For example, analyze the business development data of agents according to time series, extract trend characteristics (such as long-term growth trends, seasonal changes, etc.) and volatility characteristics (such as standard deviation, range, etc.). Encode the geographical location information of agents and convert it into numerical features so that the model can use this information. In addition, according to the business type and cooperation model of the agent, construct some virtual variables to represent different categories to capture the differences between different types of agents.

[0475] Multi-algorithm integration and risk prediction:

[0476] Use a variety of algorithms to predict agent risk. Feature-based classification algorithms, such as the random forest algorithm, use the constructed risk indicators and features as input to classify agents and determine whether they are high risk. The random forest algorithm can effectively process high-dimensional data and complex feature relationships by constructing multiple decision trees and integrating their prediction results, thereby improving the accuracy of risk prediction.

[0477] Introduce association prediction algorithms to analyze the potential associations between agents’ behavioral data and other business indicators. For example, by analyzing the association between users developed by agents and their subsequent business usage, it is found that some agents may have abnormal development patterns or potential risky behaviors. At the same time, similarity calculation algorithms are used to mine the deep relationships between agents, businesses, and users to find risk patterns hidden in the data.

[0478] In the application of the GNN algorithm, agents, users, businesses, and risk factors are constructed into a graph structure. Agents and users are nodes, and the business relationship between agents and users, the social relationship between users, and the association relationship between risk factors are edges. Through GNN's graph structure learning and message passing mechanism, the role of agents in the entire business ecosystem and the risk propagation path are captured. For example, when an agent exhibits risky behavior, GNN can predict other agents and user groups that may be affected, as well as the risk propagation trend in the business network.

[0479] Model training optimization and risk assessment:

[0480] During the model training process, cross-validation, grid search and other technologies are used to optimize the model parameters. By adjusting the number and depth of decision trees in the random forest algorithm, as well as the number of layers and the number of attention heads in the GNN algorithm, the optimal model configuration is found to improve the performance and generalization ability of the model.

[0481] Comprehensively use the prediction results of multiple algorithms to conduct a comprehensive assessment of the risk of agents. Calculate a comprehensive risk score for each agent, which comprehensively considers the prediction probability of agent risk by different algorithms, the numerical value of risk indicators and the correlation between them. According to the risk score, the risk level of agents is divided into high risk, medium risk and low risk levels, so that operators can take corresponding risk management measures.

[0482] Risk management strategy formulation and implementation:

[0483] Based on the risk assessment results of agents, operators can formulate targeted risk management strategies. For high-risk agents, strengthen monitoring, conduct regular audits and inspections, and promptly identify and deal with potential risk issues. For medium-risk agents, provide risk warnings and improvement suggestions to help agents standardize their business behavior and reduce risks. For low-risk agents, keep paying attention, provide necessary support and incentives, and promote their business development.

[0484] In the risk management process, the interpretability analysis results of the model are used to gain an in-depth understanding of the main sources and influencing factors of each agent's risk. For example, by analyzing the importance of each feature in the random forest algorithm and the strength of association between nodes in the GNN algorithm, the key factors that lead to agent risk can be found, such as agents in a certain area generally have higher commission fluctuations or certain types of business are associated with higher user complaint rates. Based on these analyses, operators can make targeted adjustments to agent policies, optimize business processes, or strengthen training and guidance for agents in specific areas to reduce risks at the source.

[0485] Case analysis and effect display:

[0486] Taking the actual agent data of a telecom operator as an example, after applying the method of this embodiment, a group of agents with potential risks were successfully identified. Through further investigation and analysis of these agents, some previously unnoticed risk behaviors were discovered, such as some agents obtaining commissions through improper means and falsely developing users. In response to these problems, the operator took corresponding measures in a timely manner, such as suspending cooperation, recovering illegal income, strengthening training and supervision of agents, etc., effectively reducing the impact of agent risks on the business.

[0487] At the same time, through the comparative analysis of data before and after the implementation of the risk management strategy, it was found that the overall risk level of the agent was effectively controlled, and the business development was healthier and more stable. The user complaint rate dropped significantly, the compliance awareness and business capabilities of the agent were improved, and the cooperative relationship between the operator and the agent was further strengthened. This fully demonstrates the effectiveness and practical application value of the embodiments of this application in agent risk management.

[0488] Based on the above Figure 1 The present application also provides a method for screening potential risk data, such as Figure 3 As shown, the potential risk data screening device 300 may include:

[0489] An acquisition module 310 is used to acquire risk data and unmonitored data. Risk data refers to data monitored by the risk monitoring system, and unmonitored data refers to data that is not included in the monitoring scope of the risk monitoring system.

[0490] An input module 320 is used to input the risk data and the unmonitored data into a pre-trained risk prediction model, and calculate multiple similarity matrices through multiple association prediction algorithms in the risk prediction model, wherein the similarity matrices are used to characterize the potential association relationship between the risk data and the unmonitored data;

[0491] A weighting module 330 is used to perform weighted processing on multiple similarity matrices based on a target weight value to obtain a comprehensive similarity matrix, where the comprehensive similarity matrix is ​​used to characterize the comprehensive correlation between risk data and unmonitored data;

[0492] The screening module 340 is used to screen out target monitoring data from unmonitored data according to the comprehensive similarity matrix, where the target monitoring data is data associated with the risk data.

[0493] In a possible embodiment, the potential risk data screening device 300 may further include:

[0494] A construction module is used to construct risk data and potential risk data into a graph structure, where the nodes of the graph structure represent data points, and the edges of the graph structure represent the association relationship between the data points; the data points are generated based on the risk data and potential risk data;

[0495] An updating module is used to update the graph structure through a graph neural network to obtain updated node features of the graph structure. The updated node features include high-order neighborhood information between risk data and potential risk data.

[0496] The determination module is used to determine the target weight value according to the updated node features of the graph structure.

[0497] In a possible embodiment, the determination module is specifically configured to:

[0498] The updated node features are convolved through the graph convolutional neural network to obtain the predicted similarity matrix of the graph structure;

[0499] Based on the adaptive threshold sparse method, the predicted similarity matrix of the graph structure is sparsely processed to obtain the sparse graph structure;

[0500] According to the sparse graph structure, the prediction performance data of each association prediction algorithm on different data subsets are evaluated; the data subsets include: a subset of risk data and a subset of potential risk data;

[0501] According to the prediction performance data, the weight value corresponding to each associated prediction algorithm is adjusted to obtain the target weight value.

[0502] In a possible embodiment, the determination module is specifically configured to:

[0503] According to the predicted similarity matrix of the graph structure, the neighbor nodes and connection relationships of each node in the graph structure are analyzed to determine the local structure information;

[0504] According to the local structure information, adjust the sparseness threshold of each node of the graph structure;

[0505] The graph structure is sparsely processed according to the sparseness threshold to obtain a sparse graph structure.

[0506] In a possible embodiment, the screening module 340 is used to:

[0507] The comprehensive similarity matrix is ​​processed by nonlinear dimensionality reduction through the autoencoder to obtain low-dimensional features;

[0508] According to the low-dimensional features, the target potential risk data is screened out from the potential risk data.

[0509] In a possible embodiment, the acquisition module 310 is further used to acquire training data, where the training data includes historical potential risk data and historical risk data collected by the risk monitoring system; the historical potential risk data is data that is not included in the monitoring scope of the risk monitoring system;

[0510] The input module 320 is further used to input the historical potential risk data and the historical risk data into a preset neural network model, and output a plurality of historical similarity matrices, wherein the similarity matrices are used to characterize the potential correlation between the historical risk data and the historical potential risk data;

[0511] The weighting module 330 is further used to perform weighted processing on multiple historical similarity matrices based on a preset weight value to obtain a historical comprehensive similarity matrix, where the historical comprehensive similarity matrix is ​​used to characterize the comprehensive correlation between the historical risk data and the historical potential risk data;

[0512] The potential risk data screening device 300 may further include:

[0513] The training module is used to train the preset neural network model according to the historical comprehensive similarity matrix until the preset neural network model meets the preset training conditions to obtain a trained risk monitoring model.

[0514] In a possible embodiment, the acquisition module 310 is specifically configured to:

[0515] Obtain the historical risk data list and manual verification results collected by the risk monitoring system. The historical risk data list is a collection of data with risks identified by the monitoring system; the manual verification results are determined by domain experts on the suspected risk data list;

[0516] Use natural language technology to analyze manual verification results and obtain historical risk data.

[0517] In the embodiment of the present application, by acquiring risk data and potential risk data, risk data is data monitored by the risk monitoring system, and potential risk data is data that is not included in the monitoring scope of the risk monitoring system, comprehensive coverage of risks is achieved, and the coverage rate of risk identification is improved. Risk data and potential risk data are input into a pre-trained risk prediction model, and multiple similarity matrices are calculated by multiple association prediction algorithms in the risk prediction model. The similarity matrix is ​​used to characterize the potential association relationship between risk data and potential risk data; through multiple association prediction algorithms, the advantages of each algorithm are comprehensively utilized to improve the prediction accuracy. Based on the target weighted value, multiple similarity matrices are weighted to obtain a comprehensive similarity matrix, which is used to characterize the comprehensive association relationship between risk data and potential risk data; according to the comprehensive similarity matrix, the target potential risk data is screened out from the potential risk data, and the target potential risk data is data that has an association relationship with the risk data. Through the comprehensive similarity matrix, the target potential risk data that has an association relationship with the risk data is accurately screened out, the accuracy of risk identification is improved, the burden of manual investigation is reduced, and various abnormal problems in the business can be covered more comprehensively.

[0518] Figure 4 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0519] The electronic device may include a processor 401 and a memory 402 storing computer program instructions.

[0520] Specifically, the processor 401 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0521] The memory 402 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 402 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 402 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 402 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 402 is a non-volatile solid-state memory. In a specific embodiment, the memory 402 includes a read-only memory (ROM). In appropriate cases, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM) or a flash memory or a combination of two or more of these.

[0522] The processor 401 reads and executes the computer program instructions stored in the memory 402 to implement any one of the potential risk data screening methods in the embodiments shown in the figure.

[0523] In one example, the electronic device may further include a communication interface 404 and a bus 410. Figure 4 As shown, the processor 401, the memory 402, and the communication interface 404 are connected via a bus 410 and communicate with each other.

[0524] The communication interface 404 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0525] Bus 410 includes hardware, software or both, and the parts of electronic equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 410 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0526] The electronic device can execute the method for screening potential risk data in the embodiment of the present application, thereby realizing the combination Figure 1-Figure 2 Describe the screening methods for potential risk data.

[0527] In addition, in combination with the method for screening potential risk data in the above embodiment, the present application embodiment can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by the processor, the Figure 1-Figure 2 Methods for screening potential risk data.

[0528] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0529] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0530] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0531] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A method for screening potential risk data, characterized in that: The method comprises: Obtain risk data and potential risk data. Risk data refers to data monitored by the risk monitoring system, while potential risk data refers to data not included in the monitoring scope of the risk monitoring system. The risk data and the potential risk data are input into a pre-trained risk prediction model, and multiple similarity matrices are calculated through multiple association prediction algorithms in the risk prediction model, where the similarity matrices are used to characterize the potential association relationship between the risk data and the potential risk data; Based on the target weighted value, multiple similarity matrices are weighted to obtain a comprehensive similarity matrix, which is used to characterize the comprehensive correlation between risk data and potential risk data; According to the comprehensive similarity matrix, target potential risk data are screened out from the potential risk data, and the target potential risk data are data that have a correlation relationship with the risk data.

2. The method according to claim 1, characterized in that Before performing weighted processing on the multiple similarity matrices based on the target weighted value to obtain a comprehensive similarity matrix, the method further includes: The risk data and potential risk data are constructed into a graph structure, where the nodes of the graph structure represent data points, and the edges of the graph structure represent the associations between data points; the data points are generated based on the risk data and potential risk data; The graph structure is updated through the graph neural network to obtain updated node features of the graph structure. The updated node features include high-order neighborhood information between risk data and potential risk data. According to the updated node features of the graph structure, the target weight value is determined.

3. The method according to claim 2, characterized in that Determining the target weighted value according to the node features after the graph structure is updated includes: The updated node features are convolved through the graph convolutional neural network to obtain the predicted similarity matrix of the graph structure; Based on the adaptive threshold sparse method, the predicted similarity matrix of the graph structure is sparsely processed to obtain the sparse graph structure; According to the sparse graph structure, the prediction performance data of each association prediction algorithm on different data subsets are evaluated; the data subsets include: a subset of risk data and a subset of potential risk data; According to the prediction performance data, the weight value corresponding to each associated prediction algorithm is adjusted to obtain the target weight value.

4. The method according to claim 3, characterized in that The adaptive threshold-based sparseness method performs sparseness processing on the predicted similarity matrix of the graph structure to obtain a sparse graph structure, including: According to the predicted similarity matrix of the graph structure, the neighbor nodes and connection relationships of each node in the graph structure are analyzed to determine the local structure information; According to the local structure information, adjust the sparseness threshold of each node of the graph structure; The graph structure is sparsely processed according to the sparseness threshold to obtain a sparse graph structure.

5. The method according to claim 1, characterized in that The step of screening target potential risk data from potential risk data according to the comprehensive similarity matrix includes: The comprehensive similarity matrix is ​​processed by nonlinear dimensionality reduction through the autoencoder to obtain low-dimensional features; According to the low-dimensional features, the target potential risk data is screened out from the potential risk data.

6. The method according to claim 1, characterized in that Before inputting the risk data and the potential risk data into the pre-trained risk prediction model, the method further comprises: Obtain training data, which includes historical potential risk data and historical risk data collected by the risk monitoring system; historical potential risk data is data that is not included in the monitoring scope of the risk monitoring system; Inputting historical potential risk data and historical risk data into a preset neural network model, outputting a plurality of historical similarity matrices, wherein the similarity matrices are used to characterize the potential correlation between the historical risk data and the historical potential risk data; A plurality of historical similarity matrices are weighted based on a preset weight value to obtain a historical comprehensive similarity matrix, where the historical comprehensive similarity matrix is ​​used to characterize the comprehensive correlation between historical risk data and historical potential risk data; The preset neural network model is trained according to the historical comprehensive similarity matrix until the preset neural network model meets the preset training conditions to obtain a trained risk monitoring model.

7. The method according to claim 1, characterized in that The obtaining of training data comprises: Obtain the historical risk data list and manual verification results collected by the risk monitoring system. The historical risk data list is a collection of data with risks identified by the monitoring system; the manual verification results are determined by domain experts on the suspected risk data list; Use natural language technology to analyze manual verification results and obtain historical risk data.

8. A device for screening potential risk data, characterized in that: The screening device for potential risk data comprises: The acquisition module is used to acquire risk data and unmonitored data. Risk data refers to data monitored by the risk monitoring system, and unmonitored data refers to data that is not included in the monitoring scope of the risk monitoring system. An input module, used for inputting risk data and unmonitored data into a pre-trained risk prediction model, and calculating multiple similarity matrices through multiple association prediction algorithms in the risk prediction model, wherein the similarity matrices are used for characterizing the potential association relationship between the risk data and the unmonitored data; A weighting module is used to perform weighted processing on multiple similarity matrices based on a target weighted value to obtain a comprehensive similarity matrix, and the comprehensive similarity matrix is ​​used to characterize the comprehensive correlation relationship between risk data and unmonitored data; The screening module is used to screen out target monitoring data from unmonitored data based on a comprehensive similarity matrix, where the target monitoring data is data that has a correlation relationship with risk data.

9. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the method for screening potential risk data as claimed in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the method for screening potential risk data as described in any one of claims 1 to 7.

Images