Enterprise information business safety supervision system and method based on artificial intelligence

Abstract

The invention provides an enterprise information business safety supervision system and method based on artificial intelligence. The system comprises an information business supervision middle platform, a verification module, an acquisition module, an abnormity identification module, a tampering identification module and a business supervision module. The verification module opens a business operation interface of the target user after verification is passed based on the target user portrait; the acquisition module acquires business operation information of the target user for the enterprise financial information based on the business operation interface; the exception recognition module inputs the target user portrait and the target access operation characteristics into an exception access recognition model to obtain an exception access recognition result; the tampering identification module inputs the target accounting operation feature into an abnormal tampering identification model to obtain an abnormal tampering identification result; and the business supervision module carries out business security supervision on the business operation process of the enterprise financial information of the target user based on the abnormal access identification result and the abnormal tampering identification result. According to the invention, the information supervision security of enterprise financial information is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an enterprise information business security supervision system and method based on artificial intelligence. Background Art

[0002] With the development of information digitization, corporate financial information is no longer limited to paper ledgers and traditional local storage, but widely exists in complex information systems in the form of electronic data. Therefore, the security supervision of corporate financial information is crucial. The traditional business security supervision method of corporate financial information mainly relies on manual audit methods, that is, when users access corporate financial information, internal auditors supervise the user's business operations based on manual experience and predefined financial compliance guidelines. However, when users perform business operations on corporate financial information, abnormal reading operations or potential tampering operations may be hidden in normal business operations, which may cause abnormal access and abnormal tampering of corporate financial information, which is difficult to detect by manual audits, resulting in low information supervision security of corporate financial information. Summary of the invention

[0003] The present invention provides an enterprise information business security supervision system and method based on artificial intelligence, aiming to improve the information supervision security of enterprise financial information.

[0004] In a first aspect, the present invention provides an enterprise information business security supervision system based on artificial intelligence, including an information business supervision middle platform, a verification module, a collection module, an abnormality identification module, a tampering identification module and a business supervision module; the information business supervision middle platform is respectively connected to the verification module, the collection module, the abnormality identification module, the tampering identification module and the business supervision module to manage each module;

[0005] The verification module is used to respond to the target user's business request for enterprise financial information, and after the target user's target user portrait is verified, open the target user's business operation interface;

[0006] The acquisition module is used to obtain the target user's business operation information on the enterprise financial information based on the business operation interface; the business operation information includes target access operation characteristics and target account operation characteristics;

[0007] The abnormality identification module is used to input the target user portrait and the target access operation characteristics into an abnormal access identification model to obtain an abnormal access identification result output by the abnormal access identification model;

[0008] The tampering identification module is used to input the target account operation feature into the abnormal tampering identification model to obtain the abnormal tampering identification result output by the abnormal tampering identification model;

[0009] The business supervision module is used to perform business security supervision on the business operation process of the target user with respect to the enterprise financial information based on the abnormal access identification result and the abnormal tampering identification result;

[0010] Among them, the abnormal access identification model is trained based on sample user portraits, sample access operation features of the sample user portraits and their corresponding result labels; the abnormal tampering identification model is trained based on sample account operation feature features and their corresponding label results.

[0011] In a second aspect, the present invention further provides an enterprise information service security supervision method based on artificial intelligence, which is applied to the enterprise information service security supervision system based on artificial intelligence in the first aspect, and the enterprise information service security supervision method based on artificial intelligence includes:

[0012] Responding to a target user's business request for enterprise financial information, and opening a business operation interface for the target user after the target user profile of the target user is verified;

[0013] Acquiring the target user's business operation information on the enterprise financial information based on the business operation interface; the business operation information includes target access operation characteristics and target account operation characteristics;

[0014] Inputting the target user portrait and the target access operation feature into an abnormal access recognition model to obtain an abnormal access recognition result output by the abnormal access recognition model;

[0015] Inputting the target account operation feature into an abnormal tampering recognition model to obtain an abnormal tampering recognition result output by the abnormal tampering recognition model;

[0016] Based on the abnormal access identification result and the abnormal tampering identification result, business security supervision is performed on the business operation process of the target user with respect to the enterprise financial information;

[0017] Among them, the abnormal access identification model is trained based on sample user portraits, sample access operation features of the sample user portraits and their corresponding result labels; the abnormal tampering identification model is trained based on sample account operation feature features and their corresponding label results.

[0018] According to the enterprise information business security supervision method based on artificial intelligence provided by an embodiment of the present invention, the target access operation features include access permission features, access time features and access frequency features; the abnormal access recognition model includes a graph neural network layer, a self-attention mechanism layer, a deep network layer and an output processing layer; the target user portrait and the target access operation features are input into the abnormal access recognition model to obtain the abnormal access recognition result output by the abnormal access recognition model, including:

[0019] The target user portrait and the target access operation feature are input into the abnormal access recognition model, the target user portrait, the access permission feature, the access time feature and the access frequency feature are integrated to construct a graph structure based on the graph neural network layer, and a first feature vector sequence representing the target user portrait and the target access operation feature is output according to the graph structure;

[0020] Calculating the attention weight vector of each node in the graph structure according to the first feature vector sequence based on the self-attention mechanism layer, and outputting a second feature vector sequence;

[0021] Based on the deep network layer, the second feature vector sequence is subjected to superposition processing by a restricted Boltzmann machine to output a target feature vector;

[0022] Based on the output processing layer, the abnormal access probability that the target user has abnormal access behavior during the business operation is calculated according to the target feature vector, and the abnormal access identification result is output.

[0023] According to the enterprise information service security supervision method based on artificial intelligence provided by an embodiment of the present invention, the calculation formula of the abnormal access identification result is:

[0024]

[0025] Among them, P1 represents the abnormal access recognition result, w represents the weight vector of the output processing layer, b represents the bias of the output processing layer, min(·) represents the minimum function, and w T z represents the inner product operation of the target feature vector z and the weight vector w, that is, the projection length of the target feature vector z in the direction of the weight vector w multiplied by |w|.

[0026] According to the enterprise information service security supervision method based on artificial intelligence provided by an embodiment of the present invention, the loss function of the abnormal access recognition model is:

[0027] L1=βL triplet +(1-β)L focal ;

[0028]

[0029]

[0030] Among them, L1 represents the loss function of the abnormal access recognition model, β represents the weight parameter (0<β<1), and L triplet represents the triple loss function, L focal represents the focal loss function, N represents the number of samples, max() represents the maximum value function, z a The vector obtained after the feature vector of the anchor point sample is processed by the abnormal access recognition model, z p The vector obtained after the feature vector of the positive sample is processed by the abnormal access recognition model, z n The vector obtained after the feature vector of the negative sample is processed by the abnormal access recognition model, d(z a , z p ) represents the distance measure between the anchor sample and the positive sample, d(z a , z n ) represents the distance metric between the anchor sample and the negative sample, α represents the margin parameter, a t Represents the weight dynamically assigned according to the sample category, P t It represents the abnormal access probability predicted by the model for the tth sample, and γ represents the adjustment parameter.

[0031] According to the enterprise information business security supervision method based on artificial intelligence provided by an embodiment of the present invention, the target account operation features include voucher rollback operation features and account operation frequent features; the abnormal tampering recognition model includes a feature encoding layer, a feature reconstruction layer, a feature enhancement layer, a feature interaction layer and a classifier output layer; the target account operation features are input into the abnormal tampering recognition model to obtain the abnormal tampering recognition result output by the abnormal tampering recognition model, including:

[0032] Input the target account operation feature into the abnormal tampering recognition model, encode and splice the voucher rollback operation feature and the account operation frequent feature based on the feature encoding layer, and output a comprehensive feature vector;

[0033] Mapping the comprehensive feature vector to a mean vector and a standard deviation vector in a latent space based on the feature reconstruction layer, and outputting a reconstructed vector according to the mean vector and the standard deviation vector;

[0034] Based on the feature enhancement layer, weighted processing is performed on the reconstructed vector according to an attention mechanism, and an enhanced feature vector is output;

[0035] Based on the feature interaction layer, the enhanced feature vector is calculated according to the graph convolutional network, and the final feature is output;

[0036] Based on the classifier output layer, the abnormal tampering probability that the target user has abnormal tampering behavior during the business operation is calculated according to the final feature, and the abnormal tampering identification result is output.

[0037] According to the enterprise information service security supervision method based on artificial intelligence provided by an embodiment of the present invention, the loss function of the abnormal tampering recognition model is:

[0038] L2=λ1L recon +λ2L KL +λ3L class ,λ1+λ2+λ3=1;

[0039]

[0040] L class = -tlog(y)+(1-t)log(1-y);

[0041] Among them, L2 represents the loss function of the abnormal tampering recognition model, λ1, λ2, λ3 represent the corresponding weights, L recon represents the reconstruction loss function, L KL represents the divergence loss function, L class represents the classification loss function, n represents the dimension of the comprehensive feature vector X, x i represents the i-th element of the comprehensive feature vector X, Represents the reconstruction vector The i-th element of , u(x) represents the mean of all elements in the comprehensive feature vector X, Represents the reconstruction vector The mean of all elements in , d represents the dimension of the latent variable Z, μ j represents the jth element in the mean vector μ, σ j represents the jth element in the standard deviation vector σ, y represents the abnormal tampering probability, and Y represents the true label.

[0042] According to the enterprise information business security supervision method based on artificial intelligence provided by an embodiment of the present invention, based on the abnormal access identification result and the abnormal tampering identification result, business security supervision is performed on the business operation process of the target user for the enterprise financial information, including:

[0043] Comparing the abnormal access identification result with the preset abnormal access probability to obtain a first comparison result, and comparing the abnormal tampering identification result with the preset abnormal tampering probability to obtain a second comparison result;

[0044] If the first comparison result is that the abnormal access identification result is greater than or equal to the preset abnormal access probability, it is determined that an abnormal access behavior exists; or / and

[0045] If the second comparison result is that the abnormal tampering identification result is greater than or equal to the preset abnormal tampering probability, it is determined that abnormal tampering behavior exists.

[0046] In a third aspect, the present invention also provides an electronic device, comprising: a memory for storing computer software programs; a processor for reading and executing the computer software programs, thereby implementing any of the artificial intelligence-based enterprise information business security supervision methods described above.

[0047] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium, in which a computer software program is stored. When the computer software program is executed by a processor, it implements any of the above-mentioned artificial intelligence-based enterprise information business security supervision methods.

[0048] In a fifth aspect, the present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned artificial intelligence-based enterprise information business security supervision methods.

[0049] The enterprise information business security supervision system based on artificial intelligence provided by the embodiment of the present invention performs business security supervision on the target user's business operation process for enterprise financial information through pre-trained abnormal access recognition models and abnormal tampering recognition models. Therefore, artificial intelligence technology can accurately identify that abnormal reading operation behaviors or potential tampering operation behaviors may be hidden in normal business operations that are difficult to discover in the manual audit process, thereby avoiding abnormal access and abnormal tampering of enterprise financial information and improving the information supervision security of enterprise financial information. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a structural diagram of the enterprise information business security supervision system based on artificial intelligence provided by the present invention;

[0051] Figure 2 It is a flow chart of the enterprise information business security supervision method based on artificial intelligence provided by the present invention;

[0052] Figure 3 An embodiment diagram of an electronic device provided by an embodiment of the present invention;

[0053] Figure 4 An embodiment diagram of a computer-readable storage medium provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0055] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0056] In the description of the present invention, the term "for example" is used to mean "used as an example, illustration or explanation". Any embodiment described as "for example" in the present invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present invention.

[0057] Optional, see Figure 1 As shown, Figure 1 It is a structural diagram of the enterprise information business security supervision system based on artificial intelligence provided by the present invention. The enterprise information business security supervision system based on artificial intelligence includes an information business supervision middle platform, a verification module, a collection module, an abnormality identification module, a tampering identification module and a business supervision module; the information business supervision middle platform is respectively connected to the verification module, the collection module, the abnormality identification module, the tampering identification module and the business supervision module to manage each module.

[0058] In the embodiment of the present invention, when a user (internal personnel of an enterprise) accesses and queries the enterprise's financial information, it is necessary to initiate a service request to the information supervision system. Therefore, after the target user makes a service request for the enterprise's financial information, the information service supervision center responds to the service request and controls the verification module to obtain the target user's target user portrait, wherein the target user portrait may include the target user's biological characteristics, user age, gender, geographic location, etc., and biological characteristics such as fingerprint characteristics, facial characteristics, iris characteristics, etc.

[0059] Further, the verification module matches the target biometric feature of the target user with the biometric feature stored in the information supervision system. If there is a biometric feature matching the target biometric feature in the information supervision system, it is determined that the target user has passed the verification. If there is no biometric feature matching the target biometric feature in the information supervision system, it is determined that the target user has not passed the verification.

[0060] Furthermore, if it is determined that the target user has passed the verification, the business operation interface of the target user is opened, and the target user can perform business operations on the enterprise financial information through the business operation interface. If it is determined that the target user has not passed the verification, an alarm is issued, and the target user portrait is sent to the alarm system.

[0061] Furthermore, the collection module obtains business operation information of the target user performing business operations on the enterprise financial information through the business operation interface, wherein the business operation information includes target access operation characteristics and target account operation characteristics, the target access operation characteristics include access permission characteristics, access time characteristics and access frequency characteristics, the target account operation characteristics include voucher rollback operation characteristics and account operation frequent characteristics, the voucher rollback operation characteristics include rollback time, involved voucher type, rollback amount, etc., the account operation frequent characteristics include the number of times the same data is accessed per unit time, or the frequency of repeated operations on certain data, such as the number of account operations per unit time, or the range of amounts involved in repeated operations.

[0062] Furthermore, the abnormal identification module inputs the target user portrait and the target access operation features into the abnormal access identification model to obtain the abnormal access identification result output by the abnormal access identification model, wherein the abnormal access identification model in the embodiment of the present invention is trained based on the sample user portrait, the sample access operation features of the sample user portrait and their corresponding result labels.

[0063] Furthermore, the tampering identification module inputs the target account operation features into the abnormal tampering identification model to obtain the abnormal tampering identification results output by the abnormal tampering identification model, wherein the abnormal tampering identification model in the embodiment of the present invention is trained based on the sample account operation feature features and their corresponding label results.

[0064] The abnormal access identification result in the embodiment of the present invention is the abnormal access probability, and the abnormal tampering identification result is the abnormal tampering probability. Therefore, the business supervision module performs business security supervision on the target user's business operation process for corporate financial information based on the preset probability rules and combined with the abnormal access identification result and the abnormal tampering identification result, that is, determines whether the target user has abnormal access behavior and / or abnormal tampering behavior.

[0065] The embodiments of the present invention perform business security supervision on the target user's business operation process for enterprise financial information through pre-trained abnormal access recognition models and abnormal tampering recognition models. Therefore, artificial intelligence technology can accurately identify that abnormal reading operation behaviors or potential tampering operation behaviors may be hidden in normal business operations that are difficult to discover during manual audits, thereby avoiding abnormal access and abnormal tampering of enterprise financial information and improving the information supervision security of enterprise financial information.

[0066] Reference Figure 2 , Figure 2 It is a flow chart of the enterprise information business security supervision method based on artificial intelligence provided by the present invention. In the embodiment of the present invention, the execution subject of the enterprise information business security supervision method based on artificial intelligence is the information supervision system, and the enterprise information business security supervision method based on artificial intelligence includes:

[0067] Step 10, responding to the target user's business request for enterprise financial information, and opening the target user's business operation interface after verification based on the target user's target user portrait.

[0068] In the embodiment of the present invention, when a user (personnel within an enterprise) accesses and queries the financial information of an enterprise, it is necessary to initiate a service request to the information supervision system.

[0069] Optionally, after the target user makes a business request for corporate financial information, the information supervision system responds to the business request and obtains a target user portrait of the target user, wherein the target user portrait may include the target user's biometric features, user age, gender, geographic location, etc., and biometric features such as fingerprint features, facial features, iris features, etc.

[0070] Further, the information supervision system matches the target biometric feature of the target user with the biometric feature stored in the information supervision system. If there is a biometric feature matching the target biometric feature in the information supervision system, it is determined that the target user has passed the verification. If there is no biometric feature matching the target biometric feature in the information supervision system, it is determined that the target user has not passed the verification.

[0071] Furthermore, if it is determined that the target user has passed the verification, the business operation interface of the target user is opened, and the target user can perform business operations on the enterprise financial information through the business operation interface. If it is determined that the target user has not passed the verification, an alarm is issued, and the target user portrait is sent to the alarm system.

[0072] Step 20: Acquire the target user's business operation information for the enterprise financial information based on the business operation interface; the business operation information includes target access operation characteristics and target account operation characteristics.

[0073] Furthermore, the information supervision system obtains business operation information of the target user performing business operations on the enterprise financial information through the business operation interface, wherein the business operation information includes target access operation characteristics and target account operation characteristics, the target access operation characteristics include access permission characteristics, access time characteristics and access frequency characteristics, the target account operation characteristics include voucher rollback operation characteristics and account operation frequency characteristics, the voucher rollback operation characteristics include rollback time, involved voucher type, rollback amount, etc., the account operation frequency characteristics include the number of times the same data is accessed per unit time or the frequency of repeated operations on certain data, such as the number of account operations per unit time, or the range of amounts involved in repeated operations.

[0074] Step 30: Input the target user portrait and the target access operation characteristics into the abnormal access recognition model to obtain the abnormal access recognition result output by the abnormal access recognition model.

[0075] Optionally, a pre-trained abnormal access recognition model is embedded in the information supervision system of the embodiment of the present invention, and the abnormal access recognition model is trained based on sample user portraits, sample access operation features of sample user portraits, and their corresponding result labels. Therefore, the information supervision system inputs the target user portrait and the target access operation features into the abnormal access recognition model to obtain the abnormal access recognition results output by the abnormal access recognition model, as described in detail in steps 301 to 304.

[0076] Step 40: Input the target account operation feature into the abnormal tampering recognition model to obtain the abnormal tampering recognition result output by the abnormal tampering recognition model.

[0077] Optionally, the information supervision system of the embodiment of the present invention is embedded with a pre-trained abnormal tampering recognition model, which is trained based on the sample account operation feature characteristics and their corresponding label results. Therefore, the information supervision system inputs the target account operation characteristics into the abnormal tampering recognition model to obtain the abnormal tampering recognition results output by the abnormal tampering recognition model, as shown in steps 401 to 405.

[0078] Step 50: Based on the abnormal access identification results and the abnormal tampering identification results, business security supervision is performed on the business operation process of the target user with respect to the enterprise financial information.

[0079] The abnormal access identification result in the embodiment of the present invention is the abnormal access probability, and the abnormal tampering identification result is the abnormal tampering probability. Therefore, the information supervision system performs business security supervision on the target user's business operation process for the enterprise financial information according to the preset probability rules, combined with the abnormal access identification result and the abnormal tampering identification result, that is, determines whether the target user has abnormal access behavior and / or abnormal tampering behavior, specifically steps 501 to 503. In one embodiment, the preset probability rule is: if the abnormal access identification result is greater than or equal to the preset abnormal access probability, then there is abnormal access behavior. If the abnormal tampering identification result is greater than or equal to the preset abnormal tampering probability, then there is abnormal tampering behavior.

[0080] The embodiments of the present invention perform business security supervision on the target user's business operation process for enterprise financial information through pre-trained abnormal access recognition models and abnormal tampering recognition models. Therefore, artificial intelligence technology can accurately identify that abnormal reading operation behaviors or potential tampering operation behaviors may be hidden in normal business operations that are difficult to discover during manual audits, thereby avoiding abnormal access and abnormal tampering of enterprise financial information and improving the information supervision security of enterprise financial information.

[0081] In one embodiment, the target access operation features of the embodiment of the present invention include access permission features, access time features and access frequency features, and the abnormal access recognition model includes a graph neural network layer, a self-attention mechanism layer, a deep network layer and an output processing layer. Therefore, the description of steps 301 to 304 is as follows:

[0082] Step 301: Input the target user portrait and target access operation features into the abnormal access recognition model, integrate the target user portrait, access permission features, access time features and access frequency features to construct a graph structure based on the graph neural network layer, and output the first feature vector sequence representing the target user portrait and target access operation features according to the graph structure.

[0083] Optionally, the information supervision system inputs the target user portrait, access permission characteristics, access time characteristics and access frequency characteristics into the abnormal access identification model.

[0084] Furthermore, the graph neural network layer integrates the target user portrait, access permission features, access time features, and access frequency features to construct a graph structure, and outputs a first feature vector sequence representing the target user portrait and target access operation features according to the graph structure, as follows:

[0085] The graph neural network layer integrates the target user profile and the target access operation features to construct a graph structure G = (V, E), where V represents a node set, E represents a node edge set, and different attributes in the target user profile, such as user age, gender, geographic location, etc., and access operation features, i.e., access permission features, access time features, and access frequency features, are nodes in the graph structure G. Whether there is a node edge between each node is determined based on whether there is a potential association between each node. In one embodiment, if there is a potential association between the user's geographic location and the access time, then there is a node edge between the corresponding nodes.

[0086] For the i-th node v in the graph structure G i ∈V, its initial eigenvector can be expressed as The feature vector integrates the information related to the node in the target user profile and access operation characteristics.

[0087] The graph neural network layer captures information propagation in the graph structure by iteratively updating the feature vectors of nodes. In the kth iteration, node v i The formula for updating the eigenvector of is as follows:

[0088]

[0089] in, Represents node v i The feature vector after the kth iteration of the graph neural network GNN; σ represents the activation function, such as the ReLU activation function; v j Represents node v i The adjacent nodes of node v, N(i) represents i The set of adjacent nodes; c ij Represents a normalization constant, which is used to process the influence weights of different adjacent nodes and is determined according to the weights of the node edges; Represents node v j The eigenvector after k-1 iterations, W (k) represents the weight matrix of the kth iteration, b (k) represents the bias vector for the kth iteration.

[0090] After K iterations, the updated feature vector sequence X of the output node set of the graph neural network layer is obtained, where the updated feature vector sequence Represents the nth node v in the node set V n The updated feature vector after K iterations, |V| represents the number of nodes in the node set V.

[0091] Furthermore, the graph neural network layer transforms the updated feature vector sequence of the node set into It is input as the first feature vector sequence to the self-attention mechanism layer.

[0092] Step 302, based on the self-attention mechanism layer, calculates the attention weight vector of each node in the graph structure according to the first feature vector sequence, and outputs a second feature vector sequence.

[0093] Furthermore, the self-attention mechanism layer calculates each node v in the graph structure through the self-attention mechanism. i The attention weight vector α i , the calculation formula is as follows:

[0094]

[0095] Among them, e ij Represents node v i The updated feature vector of node v j The attention weight of the updated feature vector, Represents node v i The updated feature vector and node v j The feature similarity between the updated feature vectors of , s(·) represents a similarity function, such as a cosine similarity function.

[0096] After being processed by the self-attention mechanism layer, the second feature vector sequence output by the self-attention mechanism layer is obtained, where the second feature vector sequence A = {α1, α2, ..., α n}.

[0097] Step 303: Based on the deep network layer, the second feature vector sequence is superimposed by a restricted Boltzmann machine to output a target feature vector.

[0098] The deep network layer of the embodiment of the present invention includes m restricted Boltzmann machines (RBMs), and the number of visible layer nodes of the mth restricted Boltzmann machine RBM is S m , the number of hidden layer nodes is H m , the visible layer node vector of the mth restricted Boltzmann machine RBM is represented by s m , the hidden layer node vector is represented as h m Therefore, the energy function E(s m ,h m ) can be expressed as:

[0099]

[0100] Among them, s mi represents the neuron state of the i-th visible layer node in the m-th restricted Boltzmann machine RBM, W mijrepresents the connection weight between the i-th visible layer node and the j-th hidden layer node in the m-th restricted Boltzmann machine RBM, h mj represents the neuron state of the jth hidden layer node in the mth restricted Boltzmann machine RBM, b mi represents the bias of the i-th visible layer node in the m-th restricted Boltzmann machine RBM, b mj represents the bias of the jth hidden layer node in the mth restricted Boltzmann machine RBM.

[0101] Therefore, the self-attention mechanism layer converts the second feature vector sequence A = {α1, α2, ..., α n} is input to the deep network layer, and the deep network layer converts the second feature vector sequence A={α1,α2,...,α n} as the visible layer node vector of the first restricted Boltzmann machine RBM, that is, the visible layer node vector s of the first restricted Boltzmann machine RBM 1n ={α1,α2,...,α n}, that is, s 11 =α1,s 12 =α2,s 1n =α n .

[0102] Therefore, the energy function E(s1,h1) of the first restricted Boltzmann machine RBM can be expressed as

[0103]

[0104] Furthermore, the first restricted Boltzmann machine RBM is trained using the Contrastive Divergence algorithm to update its weight W 1ij , bias b 1i and b 1j , so that the first restricted Boltzmann machine RBM can learn the potential pattern in the input feature vector (i.e., feature vector sequence A). After training, the hidden layer of the first restricted Boltzmann machine RBM outputs a new feature representation, and the new feature representation is used as the input of the next restricted Boltzmann machine RBM for training, and this cycle is repeated to the mth restricted Boltzmann machine RBM. After the superposition of m restricted Boltzmann machine RBMs, the hidden layer of the mth restricted Boltzmann machine RBM outputs a low-dimensional target feature vector z.

[0105] Among them, the target feature vector z integrates the key information of the target user portrait and the target access operation features after being processed by the previous multiple layers, that is, it is the comprehensive result obtained after being processed by the graph neural network layer, the self-attention mechanism layer and the deep network layer.

[0106] Step 304 , based on the output processing layer, the abnormal access probability of the target user having abnormal access behavior during the business operation is calculated according to the target feature vector, and the abnormal access identification result is output.

[0107] Further, the deep network layer inputs the target feature vector z to the output processing layer, and the output processing layer calculates the abnormal access probability P1 of the target user having abnormal access behavior during the business operation according to the target feature vector z, and determines the abnormal access probability of the target user having abnormal access behavior in the business operation as the abnormal access identification result. The calculation formula of the abnormal access probability P1 of the target user having abnormal access behavior in the business operation is as follows:

[0108]

[0109] Where w represents the weight vector of the output processing layer, b represents the bias of the output processing layer, min(·) represents the minimum function, and w T z represents the inner product operation of the target feature vector z and the weight vector w, that is, the projection length of the target feature vector z in the direction of the weight vector w multiplied by |w|.

[0110] Optionally, the loss function of the abnormal access recognition model in the embodiment of the present invention includes a triple loss function and a focal loss function. Therefore, the loss function of the abnormal access recognition model is specifically analyzed as follows:

[0111] In one embodiment, the training data set is in, Indicates the target access operation characteristics of the tth sample, including specific characteristic information of access rights, access time, and access frequency; represents the target user profile of the tth sample, including various user attribute information such as age, gender, and geographic location; t represents the true abnormal access label of the tth sample (y t ∈[0,1], 0 represents normal access, 1 represents abnormal access), and N represents the number of samples.

[0112] Furthermore, triple samples are constructed based on the training data set. Each triple sample includes an anchor sample, a positive sample and a negative sample. The anchor sample and the positive sample have the same abnormal access label, that is, they are all normal access or abnormal access, and the negative sample has the opposite abnormal access label. The feature vector of the anchor sample is processed by the abnormal access recognition model to obtain the vector z a , the feature vector of the positive sample is processed by the abnormal access recognition model to obtain the vector z p , the feature vector of the negative sample is processed by the abnormal access recognition model to obtain the vector z nThe purpose of triplet loss is to make the distance between the anchor sample and the positive sample as small as possible, and the distance between the anchor sample and the negative sample as large as possible. Therefore, the formula of the triplet loss function in the implementation of the present invention is:

[0113]

[0114] Among them, L triplet represents the triple loss function, max() represents the maximum value function, d(z a ,z p ) represents the distance measure between the anchor sample and the positive sample, d(z a ,z n ) represents the distance measure between the anchor sample and the negative sample; d(·) represents the distance function, such as the cosine distance function; α represents the margin parameter, which is used to control the distance difference requirement between the positive sample and the negative sample and the anchor sample.

[0115] The model of the embodiment of the present invention needs to focus on difficult samples, that is, samples that are easily misjudged. Therefore, the embodiment of the present invention uses focal loss to handle the category imbalance problem. The specific formula of the focal loss function is as follows:

[0116]

[0117] Among them, L focal represents the focal loss function, a t represents the weight dynamically assigned according to the sample category. For example, a higher weight is given to abnormal access samples to highlight their importance. γ represents the adjustment parameter used to control the degree of attention paid to difficult samples. P t Represents the abnormal access probability predicted by the model for the tth sample.

[0118] Therefore, the specific formula of the loss function L1 of the abnormal access recognition model in the embodiment of the present invention is as follows:

[0119] L1=βL triplet +(1-β)L focal ;

[0120] Among them, β represents the weight parameter (0<β<1), which is used to balance the importance of triplet loss and focal loss in the whole training process.

[0121] By minimizing the loss function of the abnormal access recognition model, the stochastic gradient descent algorithm is used to update the weights and biases of the model, so that the model can accurately identify abnormal access behavior.

[0122] The embodiment of the present invention can accurately capture the complex relationship between user portraits and access operation features through the graph neural network, self-attention mechanism and deep network in the abnormal access identification model, and then effectively identify whether there is abnormal access behavior in the business operation process of the target user to the enterprise financial information, thereby improving the information supervision security of the enterprise financial information.

[0123] In one embodiment, the target account operation features in the embodiment of the present invention include voucher rollback operation features and account operation frequent features. The abnormal tampering recognition model includes a feature encoding layer, a feature reconstruction layer, a feature enhancement layer, a feature interaction layer and a classifier output layer. Therefore, steps 401 to 405 are specifically as follows:

[0124] Step 401, input the target account operation feature into the abnormal tampering recognition model, encode and splice the voucher rollback operation feature and the account operation frequent feature based on the feature encoding layer, and output a comprehensive feature vector.

[0125] Optionally, the information supervision system inputs the target account operation characteristics into an abnormal tampering identification model.

[0126] Furthermore, the feature encoding layer encodes the voucher rollback operation features and the frequent accounting operation features, and the encoded voucher rollback operation feature vector is obtained as X roll , dimension is n roll , the encoding account operation frequent feature vector is X freq , dimension is n freq , wherein the encoding method is determined according to the feature type. In one embodiment, the credential type feature in the credential rollback operation feature is encoded by a one-hot encoding method, and the time feature in the credential rollback operation feature is converted into a timestamp-related numerical feature by a timestamp encoding method.

[0127] Furthermore, the feature encoding layer converts the encoded credential rollback operation feature vector into X roll The frequent feature vector of accounting operations after encoding is X freq Splice and get the comprehensive feature vector X = [X roll |X freq ], where | represents the concatenation operation, and the dimension of the comprehensive feature vector X is n = n roll +n freq .

[0128] Step 402 : Mapping the comprehensive feature vector to a mean vector and a standard deviation vector in a latent space based on a feature reconstruction layer, and outputting a reconstructed vector according to the mean vector and the standard deviation vector.

[0129] Furthermore, the feature encoding layer inputs the comprehensive feature vector X to the feature reconstruction layer, wherein the feature reconstruction layer is a feature reconstruction layer of a variational autoencoder, and therefore, the feature reconstruction layer includes an encoder layer (Encoder) and a decoder layer (Decoder).

[0130] Furthermore, the encoder layer maps the input comprehensive feature vector X to the mean vector μ and standard deviation vector σ in the latent space. The encoder layer includes L fully connected layers, which are specifically analyzed as follows:

[0131] The weight matrix of the first fully connected layer of the encoder layer is W e1 , dimension is n h1 *n, the bias vector is b e1 , dimension is n h1 , where n h1 Represents the number of neurons in the hidden layer of the first fully connected layer.

[0132] Therefore, the first fully connected layer passes the input comprehensive feature vector X through the weight matrix W e1 and the bias vector b e1 Perform linear transformation and obtain the linear transformation result z e1 =W e1 X+b e1 , whose dimension is n h1 Furthermore, the first fully connected layer uses the ReLU activation function to transform the linear result z e1 Processing is performed to obtain the output result h of the first fully connected layer e1 , output result h e1 =ReLU(z e1 )=ReLU(W e1 X+b e1 ), where ReLU(z e1 )=max(0,z e1 ). Further, the first fully connected layer will output the result h e1 As the input of the second fully connected layer, it circulates to L fully connected layers in sequence.

[0133] For the Lth fully connected layer, the weight matrix of the Lth fully connected layer is W eL , dimension is d*n h(L-1) , the bias vector is b eL , with a dimension of d, where d represents the dimension of the latent variable Z.

[0134] Therefore, the Lth fully connected layer will output the result h e(L-1) After the weight matrix W eL and the bias vector b eL Perform linear transformation and obtain linear transformation result Linear transformation results is the mean vector μ, that is Furthermore, the linear transformation result is processed by softplus function. Processing is performed to obtain the standard deviation vector σ, where the softplus function is softplus(x)=log(1+e x ),therefore,

[0135] Furthermore, the encoder layer samples the mean vector μ and the standard deviation vector σ to obtain a latent variable Z with dimension d. The specific sampling formula is Z=μ+σ⊙∈, where ∈~N(0,I), that is, the standard normal distribution.

[0136] Furthermore, the encoder layer inputs the latent variable Z into the decoder layer, and the decoder layer reconstructs the latent variable Z into a reconstructed vector with the same dimension as the input comprehensive feature vector X Among them, the encoder layer includes M fully connected layers, and the specific decoding and reconstruction process is as follows:

[0137] The weight matrix of the first fully connected layer of the decoder layer is W d1 , dimension is n′ h1 *d, the bias vector is b d1 , dimension is n′ h1 , where n′ h1 Represents the number of neurons in the hidden layer of the first fully connected layer. It should be noted that the number of neurons in the hidden layer of the first fully connected layer in the decoder layer is n′ h1 Not necessarily the same as the number of neurons n in the hidden layer of the first fully connected layer in the encoder layer h1 same.

[0138] Therefore, the first fully connected layer passes the input latent variable Z through the weight matrix W d1 and the bias vector b d1 Perform linear transformation and obtain the linear transformation result z d1 =W d1 Z+b d1 , whose dimension is n′ h1 Furthermore, the first fully connected layer uses the ReLU activation function to transform the linear result z d1 Processing is performed to obtain the output result h of the first fully connected layer d1 , output result h d1 =ReLU(z d1 )=ReLU(W d1 X+b d1 ), where ReLU(z d1 )=max(0,z d1). Further, the first fully connected layer will output the result h d1 As the input of the second fully connected layer, it circulates to M fully connected layers in sequence.

[0139] For the Mth fully connected layer, the weight matrix of the Mth fully connected layer is W dM , the dimension is n*n′ h(M-1) , the bias vector is b dM , the dimension is n, where n represents the dimension of the comprehensive feature vector X.

[0140] Therefore, the Mth fully connected layer will output the result h d(M-1) After the weight matrix W dM and the bias vector b dM Perform linear transformation and obtain the linear transformation result z dM , the linear transformation result z dM =W dM h d(M-1) +b dM , the linear transformation result z dM The reconstruction vector

[0141] Step 403: Based on the feature enhancement layer, the reconstructed vector is weighted according to the attention mechanism, and an enhanced feature vector is output.

[0142] Further, the decoder layer reconstructs the vector Input to the feature enhancement layer, wherein the feature enhancement layer in the embodiment of the present invention is a feature enhancement layer of the attention mechanism. Therefore, the feature enhancement layer reconstructs the vector The attention mechanism is input into the attention mechanism, which increases the focus on key features by calculating the correlation between different feature dimensions. In one embodiment, the query vector Q, key vector K, and value vector V in the attention mechanism are reconstructed by the vector Through different linear transformations, we get Among them, W Q , W K and W V Represents the corresponding weight matrix, so the formula for attention weight is:

[0143] Among them, d k Represents the dimension of the key vector K.

[0144] Therefore, the feature enhancement layer is weighted by the attention mechanism to obtain the weighted enhanced feature vector X att , enhanced feature vector in,

[0145] Step 404, based on the feature interaction layer, the enhanced feature vector is calculated according to the graph convolutional network, and the final feature is output.

[0146] Furthermore, the feature enhancement layer will enhance the feature vector X att Input to the feature interaction layer, wherein the feature interaction layer in the embodiment of the present invention is a feature interaction layer based on the graph convolutional network GCN. Therefore, the feature interaction layer is based on the enhanced feature vector X att Build the graph.

[0147] Among them, the enhanced feature vector X att Each dimension of is a node in the graph. For example, the enhanced feature vector X att is an n-dimensional vector, so there are n nodes in the graph, and each node carries information about the characteristics of the accounting operation in a certain dimension. The node edges between the nodes in the graph are determined based on prior knowledge. For example, there is an intrinsic correlation between the dimension of the amount feature involved in the voucher rollback operation and the dimension related to the same amount range in the frequency of accounting operations, so there is a node edge between the corresponding nodes of the two. The existence of a node edge indicates that the two feature dimensions may have a mutual influence relationship when judging abnormal tampering.

[0148] Initialization input: The graph convolutional network GCN consists of r layers, and the input feature matrix of the rth layer is H (r) , initially H (0) =X att . H in the embodiment of the present invention (r) is a m*d r matrix, m is the number of nodes (with X att dimensions are the same), d r is the feature dimension of each node in the rth layer.

[0149] Adjacency matrix and degree matrix: The adjacency matrix A is an m*m matrix used to represent the connection relationship between nodes. If there is an edge connecting node i and node j, then A ij =1, or assign a corresponding value according to the edge weight, otherwise A ij = 0. The degree matrix D is a diagonal matrix, and its diagonal elements D ii is the degree of node i, that is, the number of edges connected to node i. If it is a weighted graph, it is the sum of the edge weights.

[0150] Graph convolution operation: The calculation formula of the GCN layer is in, Represents self-connection, and I represents the identity matrix, so each node can include its own information for update. express The degree matrix, W (r)Represents the weight matrix of the rth layer, whose dimension is d r *d r+1 , used to perform linear transformation on the input features.

[0151] Nonlinear activation: After computing Finally, the ReLU activation function, ReUL(x) = max(0,x), is used to introduce nonlinearity, so that the graph convolutional network GCN can learn more complex feature interaction patterns. For example, in the scenario of account operation features, nonlinear associations can be discovered through nonlinear activation, such as the special performance of certain feature combinations in the case of abnormal tampering.

[0152] Multi-layer GCN: After multi-layer graph convolution network GCN calculation, each layer will update the feature representation of the node. As the number of layers increases, the node can integrate more neighborhood information and gradually learn the interaction mode between more advanced and abstract account operation features to obtain the final feature Xgcn. The final feature Xgcn = H R , where R represents the feature enhancement layer including R layers of graph convolutional network GCN, and the final feature X gcn The interaction information between nodes in the entire graph structure is integrated to provide richer semantic information for abnormal tampering identification.

[0153] Step 405 , based on the classifier output layer, the abnormal tampering probability of the target user having abnormal tampering behavior during the business operation is calculated according to the final features, and the abnormal tampering identification result is output.

[0154] Furthermore, the feature enhancement layer converts the final feature X gcn Input to the classifier output layer, wherein the classifier output layer in the embodiment of the present invention is a classifier output layer of a two-layer perceptron, and the first layer of perceptron processes the final feature X through the weight matrix and the bias vector gcn Process and obtain the intermediate processing result h mpl1 , intermediate processing result h mpl1 =ReUL(W mpl1 X gcn +b mpl1 ), where W mpl1 represents the weight matrix of the first layer of perceptron, b mpl1 Represents the bias vector of the first layer of perceptron. Weight matrix W mpl1 The dimension of the final feature X gcn The dimension of and the number of hidden units of the first layer of perceptrons are determined.

[0155] In one embodiment, the final feature X gcn It's m*d gcn The first layer of perceptron has d1 hidden units, so the weight matrix W mpl1 The dimension is dgcn *d1. The ReLU activation function is used to introduce nonlinearity, enabling the learning of more complex decision boundaries.

[0156] Furthermore, the first layer of perceptrons converts the intermediate processing result h mpl1 The second layer perceptron uses the sigmoid function. Therefore, the second layer perceptron processes the intermediate result h through the weight matrix and bias vector of the second layer perceptron. mpl1 Processing is performed to output the abnormal tampering probability that the target user has abnormal tampering behavior during the business operation. The abnormal tampering probability is the abnormal tampering identification result. The abnormal tampering probability y = σ(W mpl2 h mpl1 +b mpl2 ), where W mpl2 represents the weight matrix of the second layer perceptron, b mpl2 Represents the bias vector of the second layer perceptron, the abnormal tampering probability y∈[0,1], and the weight matrix W mpl2 The dimension is d1*1.

[0157] Among them, the sigmoid function

[0158] The loss function of the abnormal tampering recognition model in the embodiment of the present invention includes a reconstruction loss function, a divergence loss function and a classification loss function.

[0159] Among them, the mean square error (MSE) is used as the reconstruction loss function to measure the reconstruction vector The difference between the original comprehensive feature vector X. The divergence loss function is used to measure the difference between the distribution of the latent variable Z and the standard normal distribution. The binary cross-entropy loss is used as the classification loss function to measure the difference between the abnormal tampering probability y output by the classifier and the true label Y, (Y∈[0,1]). Therefore, the loss function analysis of the abnormal tampering recognition model is as follows:

[0160] The reconstruction loss function can be expressed as:

[0161]

[0162] Among them, L recon represents the reconstruction loss function, n represents the dimension of the comprehensive feature vector X, x i represents the i-th element of the comprehensive feature vector X, Represents the reconstruction vector The i-th element of , u(x) represents the comprehensive feature

[0163] The mean of all elements in vector X, Represents the reconstruction vector The mean of all elements in .

[0164] The divergence loss function is expressed as:

[0165]

[0166] Among them, L KL represents the divergence loss function, d represents the dimension of the latent variable Z, μ j represents the jth element in the mean vector μ, σ j represents the j-th element in the standard deviation vector σ.

[0167] Classification loss function L class It can be expressed as:

[0168] L class =-Ylog(y)+(1-Y)log(1-y).

[0169] Therefore, the loss function of the abnormal tampering recognition model can be expressed as:

[0170] L2=λ1L recon +λ2L KL +λ3L class ,λ1+λ2+λ3=1;

[0171] Among them, L2 represents the loss function of the abnormal tampering recognition model, and λ1, λ2, and λ3 represent the corresponding weights respectively.

[0172] During the training process, the loss function L2 of the abnormal tampering recognition model is minimized by adjusting the weight parameters and optimizing the model parameters, thereby obtaining the abnormal tampering recognition model with the best recognition effect.

[0173] The embodiment of the present invention can accurately capture the key information in the target account operation characteristics through the feature encoding layer, feature reconstruction layer, feature enhancement layer and feature interaction layer in the abnormal tampering identification model, and then effectively identify whether there is abnormal tampering behavior in the business operation process of the target user on the enterprise financial information, thereby improving the information supervision security of the enterprise financial information.

[0174] Further, the description of step 501 to step 503 is as follows:

[0175] Step 501, comparing the abnormal access identification result with the preset abnormal access probability to obtain a first comparison result, and comparing the abnormal tampering identification result with the preset abnormal tampering probability to obtain a second comparison result;

[0176] Step 502: If the first comparison result is that the abnormal access identification result is greater than or equal to the preset abnormal access probability, it is determined that there is abnormal access behavior;

[0177] Step 503: If the second comparison result is that the abnormal tampering identification result is greater than or equal to the preset abnormal tampering probability, it is determined that abnormal tampering behavior exists.

[0178] Optionally, the information supervision system compares the abnormal access identification result with the preset abnormal access probability to obtain a first comparison result, and compares the abnormal tampering identification result with the preset abnormal tampering probability to obtain a second comparison result, wherein the preset abnormal access probability and the preset abnormal tampering probability are set according to actual conditions.

[0179] Further, if it is determined that the first comparison result is that the abnormal access identification result is greater than or equal to the preset abnormal access probability, the information supervision system determines that the target user has abnormal access behavior during the business operation. If it is determined that the second comparison result is that the abnormal tampering identification result is greater than or equal to the preset abnormal tampering probability, the information supervision system determines that the target user has abnormal tampering behavior during the business operation.

[0180] In one embodiment, the preset abnormal access probability is 0.5, the preset abnormal tampering probability is 0.4, and the probability rule is: when the abnormal access probability is greater than or equal to the threshold value 0.5, it is determined that abnormal access exists, and when the abnormal tampering probability is greater than or equal to the threshold value 0.4, it is determined that abnormal tampering exists. The abnormal access probability of user A is 0.1, and the abnormal tampering probability is 0.15, and it is determined that user A does not have abnormality. The abnormal access probability of user B is 0.6, and the abnormal tampering probability is 0.1, and it is determined that user B has abnormal access behavior. The abnormal access probability of user C is 0.1, and the abnormal tampering probability is 0.5, and it is determined that user C has abnormal tampering behavior. The abnormal access probability of user D is 0.6, and the abnormal tampering probability is 0.6, and it is determined that user D has abnormal access behavior and abnormal tampering behavior.

[0181] The embodiment of the present invention can accurately identify abnormal situations of users during business operations through abnormal access identification results and abnormal tampering identification results, thereby improving the information supervision security of enterprise financial information.

[0182] See also Figure 3 , Figure 3 FIG. 1 is an embodiment diagram of an electronic device provided by an embodiment of the present invention. Figure 3 As shown, an embodiment of the present invention provides an electronic device 300, including a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor 320. When the processor 320 executes the computer program 311, the following steps are implemented:

[0183] Respond to the target user's business request for corporate financial information, and open the target user's business operation interface after the target user's target user portrait is verified;

[0184] Based on the business operation interface, the target user's business operation information on the enterprise financial information is obtained; the business operation information includes target access operation characteristics and target account operation characteristics;

[0185] Input the target user portrait and the target access operation features into the abnormal access recognition model to obtain the abnormal access recognition result output by the abnormal access recognition model;

[0186] Input the target account operation features into the abnormal tampering recognition model to obtain the abnormal tampering recognition result output by the abnormal tampering recognition model;

[0187] Based on the abnormal access identification results and abnormal tampering identification results, business security supervision is carried out on the target user's business operation process on the enterprise financial information;

[0188] Among them, the abnormal access recognition model is trained based on sample user portraits, sample access operation features of sample user portraits and their corresponding result labels; the abnormal tampering recognition model is trained based on sample account operation feature features and their corresponding label results.

[0189] See also Figure 4 , Figure 4 Detailed description of an embodiment of a computer-readable storage medium provided by an embodiment of the present invention. Figure 4 As shown, this embodiment provides a computer-readable storage medium 400, on which a computer program 311 is stored. When the computer program 311 is executed by a processor, the following steps are implemented:

[0190] Respond to the target user's business request for corporate financial information, and open the target user's business operation interface after the target user's target user portrait is verified;

[0191] Based on the business operation interface, the target user's business operation information on the enterprise financial information is obtained; the business operation information includes target access operation characteristics and target account operation characteristics;

[0192] Input the target user portrait and the target access operation features into the abnormal access recognition model to obtain the abnormal access recognition result output by the abnormal access recognition model;

[0193] Input the target account operation features into the abnormal tampering recognition model to obtain the abnormal tampering recognition result output by the abnormal tampering recognition model;

[0194] Based on the abnormal access identification results and abnormal tampering identification results, business security supervision is carried out on the target user's business operation process on the enterprise financial information;

[0195] Among them, the abnormal access recognition model is trained based on sample user portraits, sample access operation features of sample user portraits and their corresponding result labels; the abnormal tampering recognition model is trained based on sample account operation feature features and their corresponding label results.

[0196] On the other hand, the present invention further provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the enterprise information business security supervision method based on artificial intelligence provided by the above methods, the method includes:

[0197] Respond to the target user's business request for corporate financial information, and open the target user's business operation interface after the target user's target user portrait is verified;

[0198] Based on the business operation interface, the target user's business operation information on the enterprise financial information is obtained; the business operation information includes target access operation characteristics and target account operation characteristics;

[0199] Input the target user portrait and the target access operation features into the abnormal access recognition model to obtain the abnormal access recognition result output by the abnormal access recognition model;

[0200] Input the target account operation features into the abnormal tampering recognition model to obtain the abnormal tampering recognition result output by the abnormal tampering recognition model;

[0201] Based on the abnormal access identification results and abnormal tampering identification results, business security supervision is carried out on the target user's business operation process on the enterprise financial information;

[0202] Among them, the abnormal access recognition model is trained based on sample user portraits, sample access operation features of sample user portraits and their corresponding result labels; the abnormal tampering recognition model is trained based on sample account operation feature features and their corresponding label results.

[0203] The system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place and / or may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0204] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server or / and a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0205] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified or / and some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An enterprise information business security supervision system based on artificial intelligence, characterized in that: It includes an information service supervision center, a verification module, a collection module, an anomaly identification module, a tampering identification module and a service supervision module; the information service supervision center is respectively connected to the verification module, the collection module, the anomaly identification module, the tampering identification module and the service supervision module to manage each module; The verification module is used to respond to the target user's business request for enterprise financial information, and after the target user's target user portrait is verified, open the target user's business operation interface; The acquisition module is used to obtain the target user's business operation information on the enterprise financial information based on the business operation interface; the business operation information includes target access operation characteristics and target account operation characteristics; The abnormality identification module is used to input the target user portrait and the target access operation characteristics into an abnormal access identification model to obtain an abnormal access identification result output by the abnormal access identification model; The tampering identification module is used to input the target account operation feature into the abnormal tampering identification model to obtain the abnormal tampering identification result output by the abnormal tampering identification model; The business supervision module is used to perform business security supervision on the business operation process of the target user with respect to the enterprise financial information based on the abnormal access identification result and the abnormal tampering identification result; The abnormal access recognition model is trained based on sample user portraits, sample access operation features of the sample user portraits and their corresponding result labels; The abnormal tampering recognition model is trained based on sample account operation feature characteristics and their corresponding label results.

2. An enterprise information business security supervision method based on artificial intelligence, applied to the enterprise information business security supervision system based on artificial intelligence as claimed in claim 1, characterized in that: The enterprise information business security supervision method based on artificial intelligence includes: Responding to a target user's business request for enterprise financial information, and opening a business operation interface for the target user after the target user profile of the target user is verified; Acquiring the target user's business operation information on the enterprise financial information based on the business operation interface; the business operation information includes target access operation characteristics and target account operation characteristics; Inputting the target user portrait and the target access operation feature into an abnormal access recognition model to obtain an abnormal access recognition result output by the abnormal access recognition model; Inputting the target account operation feature into an abnormal tampering recognition model to obtain an abnormal tampering recognition result output by the abnormal tampering recognition model; Based on the abnormal access identification result and the abnormal tampering identification result, business security supervision is performed on the business operation process of the target user with respect to the enterprise financial information; Among them, the abnormal access identification model is trained based on sample user portraits, sample access operation features of the sample user portraits and their corresponding result labels; the abnormal tampering identification model is trained based on sample account operation feature features and their corresponding label results.

3. The enterprise information business security supervision method based on artificial intelligence according to claim 2 is characterized in that: The target access operation characteristics include access permission characteristics, access time characteristics and access frequency characteristics; The abnormal access recognition model includes a graph neural network layer, a self-attention mechanism layer, a deep network layer and an output processing layer; The step of inputting the target user portrait and the target access operation feature into an abnormal access recognition model to obtain an abnormal access recognition result output by the abnormal access recognition model includes: The target user portrait and the target access operation feature are input into the abnormal access recognition model, the target user portrait, the access permission feature, the access time feature and the access frequency feature are integrated to construct a graph structure based on the graph neural network layer, and a first feature vector sequence representing the target user portrait and the target access operation feature is output according to the graph structure; Calculating the attention weight vector of each node in the graph structure according to the first feature vector sequence based on the self-attention mechanism layer, and outputting a second feature vector sequence; Based on the deep network layer, the second feature vector sequence is subjected to superposition processing by a restricted Boltzmann machine to output a target feature vector; Based on the output processing layer, the abnormal access probability that the target user has abnormal access behavior during the business operation is calculated according to the target feature vector, and the abnormal access identification result is output.

4. The enterprise information service security supervision method based on artificial intelligence according to claim 3 is characterized in that: The calculation formula of the abnormal access identification result is: Among them, P1 represents the abnormal access recognition result, w represents the weight vector of the output processing layer, b represents the bias of the output processing layer, min(·) represents the minimum function, and w T z represents the inner product operation of the target feature vector z and the weight vector w, that is, the projection length of the target feature vector z in the direction of the weight vector w multiplied by |w|.

5. The enterprise information business security supervision method based on artificial intelligence according to claim 2 is characterized in that: The loss function of the abnormal access recognition model is: L1=βL triplet +(1-β)L focal ; Among them, L1 represents the loss function of the abnormal access recognition model, β represents the weight parameter (0<β<1), and L triplet represents the triple loss function, L focal represents the focal loss function, N represents the number of samples, max() represents the maximum value function, z a The vector obtained after the feature vector of the anchor point sample is processed by the abnormal access recognition model, z p The vector obtained after the feature vector of the positive sample is processed by the abnormal access recognition model, z n The vector obtained after the feature vector of the negative sample is processed by the abnormal access recognition model, d(z a ,z p ) represents the distance measure between the anchor sample and the positive sample, d(z a ,z n ) represents the distance metric between the anchor sample and the negative sample, α represents the margin parameter, a t Represents the weight dynamically assigned according to the sample category, P t It represents the abnormal access probability predicted by the model for the tth sample, and γ represents the adjustment parameter.

6. The enterprise information business security supervision method based on artificial intelligence according to claim 2 is characterized in that: The target account operation features include voucher rollback operation features and account operation frequent features; the abnormal tampering recognition model includes a feature encoding layer, a feature reconstruction layer, a feature enhancement layer, a feature interaction layer and a classifier output layer; the target account operation features are input into the abnormal tampering recognition model to obtain the abnormal tampering recognition result output by the abnormal tampering recognition model, including: Input the target account operation feature into the abnormal tampering recognition model, encode and splice the voucher rollback operation feature and the account operation frequent feature based on the feature encoding layer, and output a comprehensive feature vector; Mapping the comprehensive feature vector to a mean vector and a standard deviation vector in a latent space based on the feature reconstruction layer, and outputting a reconstructed vector according to the mean vector and the standard deviation vector; Based on the feature enhancement layer, weighted processing is performed on the reconstructed vector according to an attention mechanism, and an enhanced feature vector is output; Based on the feature interaction layer, the enhanced feature vector is calculated according to the graph convolutional network, and the final feature is output; Based on the classifier output layer, the abnormal tampering probability that the target user has abnormal tampering behavior during the business operation is calculated according to the final feature, and the abnormal tampering identification result is output.

7. The enterprise information service security supervision method based on artificial intelligence according to claim 6 is characterized in that: The loss function of the abnormal tampering recognition model is: L2=λ1L recon +λ2L KL +λ3L class ,λ1+λ2+λ3=1; L class n-tlog(y)+(1-t)log(1-y) Among them, L2 represents the loss function of the abnormal tampering recognition model, λ1, λ2, λ3 represent the corresponding weights, L recon represents the reconstruction loss function, L KL represents the divergence loss function, L class represents the classification loss function, n represents the dimension of the comprehensive feature vector X, x i represents the i-th element of the comprehensive feature vector X, Represents the reconstruction vector The i-th element of , u(x) represents the mean of all elements in the comprehensive feature vector X, Represents the reconstruction vector The mean of all elements in , d represents the dimension of the latent variable Z, μ j represents the jth element in the mean vector μ, σ j represents the jth element in the standard deviation vector σ, y represents the abnormal tampering probability, and Y represents the true label.

8. The enterprise information service security supervision method based on artificial intelligence according to any one of claims 2 to 7 is characterized in that: Based on the abnormal access identification result and the abnormal tampering identification result, business security supervision is performed on the business operation process of the target user on the enterprise financial information, including: Comparing the abnormal access identification result with the preset abnormal access probability to obtain a first comparison result, and comparing the abnormal tampering identification result with the preset abnormal tampering probability to obtain a second comparison result; If the first comparison result is that the abnormal access identification result is greater than or equal to the preset abnormal access probability, it is determined that an abnormal access behavior exists; or / and If the second comparison result is that the abnormal tampering identification result is greater than or equal to the preset abnormal tampering probability, it is determined that abnormal tampering behavior exists.

9. An electronic device, comprising: A memory and a processor, characterized in that a computer software program is stored in the memory, and when the processor reads and executes the computer software program, the enterprise information business security supervision method based on artificial intelligence as described in any one of claims 2 to 8 is implemented.

10. A non-transitory computer-readable storage medium, characterized in that: The storage medium stores a computer software program, which, when executed by a processor, implements the enterprise information business security supervision method based on artificial intelligence as described in any one of claims 2 to 8.

Images