Artificial intelligence-based enterprise information service security supervision system and method

Abstract

The application provides an enterprise information service security supervision system and method based on artificial intelligence, which comprises an information service supervision middle station, a verification module, a collection module, an abnormality identification module, a tampering identification module and a service supervision module; after the target user portrait is verified based on the verification module, the service operation interface of the target user is opened; the collection module obtains the service operation information of the target user for the enterprise financial information based on the service operation interface; the abnormality identification module inputs the target user portrait and the target access operation feature into the abnormal access identification model to obtain the abnormal access identification result; the tampering identification module inputs the target accounting operation feature into the abnormal tampering identification model to obtain the abnormal tampering identification result; and the service supervision module performs service security supervision on the service operation process of the target user for the enterprise financial information based on the abnormal access identification result and the abnormal tampering identification result. The application improves the information supervision security of enterprise financial information.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an enterprise information business security monitoring system and method based on artificial intelligence. Background Technology

[0002] With the development of digital information, corporate financial information is no longer limited to paper ledgers and traditional local storage, but exists widely in complex information systems in the form of electronic data. Therefore, the security supervision of corporate financial information is crucial. Traditional methods for supervising the security of corporate financial information mainly rely on manual auditing. This involves internal auditors using their experience and predefined financial compliance guidelines to monitor users' business operations when they access corporate financial information. However, during normal business operations involving corporate financial information, abnormal reading or potential tampering may be hidden, potentially leading to unauthorized access and alteration of corporate financial information that is difficult for manual auditors to detect, resulting in low information security for corporate financial information supervision. Summary of the Invention

[0003] This invention provides an artificial intelligence-based enterprise information business security supervision system and method, aiming to improve the information supervision security of enterprise financial information.

[0004] In a first aspect, the present invention provides an enterprise information business security supervision system based on artificial intelligence, comprising an information business supervision platform, a verification module, a data acquisition module, an anomaly identification module, a tampering identification module, and a business supervision module; the information business supervision platform is connected to the verification module, the data acquisition module, the anomaly identification module, the tampering identification module, and the business supervision module respectively, and manages each module;

[0005] The verification module is used to respond to the target user's business request for corporate financial information, and after the target user profile of the target user is verified, the business operation interface of the target user is opened.

[0006] The acquisition module is used to acquire the target user's business operation information regarding the enterprise's financial information based on the business operation interface; the business operation information includes target access operation characteristics and target accounting operation characteristics;

[0007] The anomaly detection module is used to input the target user profile and the target access operation features into the anomaly access detection model to obtain the anomaly access detection result output by the anomaly access detection model.

[0008] The tampering identification module is used to input the target accounting operation characteristics into the abnormal tampering identification model to obtain the abnormal tampering identification result output by the abnormal tampering identification model;

[0009] The business supervision module is used to conduct business security supervision on the target user's business operation process regarding the company's financial information based on the abnormal access identification result and the abnormal tampering identification result.

[0010] The abnormal access identification model is trained based on sample user profiles, sample access operation features of the sample user profiles, and their corresponding result labels; the abnormal tampering identification model is trained based on sample accounting operation features and their corresponding label results.

[0011] Secondly, the present invention also provides an artificial intelligence-based enterprise information business security supervision method, applied to the artificial intelligence-based enterprise information business security supervision system described in the first aspect, wherein the artificial intelligence-based enterprise information business security supervision method includes:

[0012] In response to a target user's business request for corporate financial information, and after verification based on the target user's target user profile, the target user's business operation interface is activated.

[0013] Based on the business operation interface, obtain the target user's business operation information regarding the enterprise's financial information; the business operation information includes target access operation characteristics and target accounting operation characteristics;

[0014] The target user profile and the target access operation features are input into the abnormal access identification model to obtain the abnormal access identification result output by the abnormal access identification model.

[0015] The target accounting operation features are input into the abnormal tampering identification model to obtain the abnormal tampering identification result output by the abnormal tampering identification model;

[0016] Based on the abnormal access identification results and the abnormal tampering identification results, business security supervision is carried out on the target user's business operation process targeting corporate financial information.

[0017] The abnormal access identification model is trained based on sample user profiles, sample access operation features of the sample user profiles, and their corresponding result labels; the abnormal tampering identification model is trained based on sample accounting operation features and their corresponding label results.

[0018] According to the embodiment of the present invention, the enterprise information business security supervision method based on artificial intelligence includes target access operation features such as access permission features, access time features, and access frequency features; the abnormal access identification model includes a graph neural network layer, a self-attention mechanism layer, a deep network layer, and an output processing layer; the step of inputting the target user profile and the target access operation features into the abnormal access identification model to obtain the abnormal access identification result output by the abnormal access identification model includes:

[0019] The target user profile and the target access operation features are input into the abnormal access identification model. Based on the graph neural network layer, the target user profile, the access permission features, the access time features, and the access frequency features are integrated to construct a graph structure. The first feature vector sequence representing the target user profile and the target access operation features is output according to the graph structure.

[0020] Based on the self-attention mechanism layer, the attention weight vector of each node in the graph structure is calculated according to the first feature vector sequence, and the second feature vector sequence is output.

[0021] Based on the deep network layer, the second feature vector sequence is superimposed using a restricted Boltzmann machine to output the target feature vector;

[0022] Based on the output processing layer, the probability of abnormal access during business operations of the target user is calculated according to the target feature vector, and the abnormal access identification result is output.

[0023] According to the enterprise information business security supervision method based on artificial intelligence provided in the embodiments of the present invention, the calculation formula for the abnormal access identification result is as follows:

[0024] ;

[0025] in, This indicates the result of abnormal access identification. This represents the weight vector of the output processing layer. Indicates the bias of the output processing layer. Describes the minimum value function. Represents the target feature vector and weight vector The inner product operation, i.e., the target feature vector In the weight vector Projected length in the direction multiplied by .

[0026] According to the enterprise information business security supervision method based on artificial intelligence provided in this embodiment of the invention, the loss function of the abnormal access identification model is:

[0027] ;

[0028] ;

[0029] ;

[0030] in, This represents the loss function of the abnormal access detection model. Represents the weight parameters. , Represents the triplet loss function. Represents the focus loss function. Indicates the number of samples. Represents the maximum value function. This represents the vector obtained after the feature vector of the anchor point sample has been processed by the abnormal access detection model. This represents the vector obtained after the feature vector of a positive sample has been processed by the abnormal access detection model. This represents the vector obtained after the feature vector of the negative sample has been processed by the anomaly access detection model. This represents the distance metric between the anchor sample and the positive sample. This represents the distance metric between anchor samples and negative samples. This represents the margin parameter. This represents the weights dynamically assigned based on the sample category. This represents the probability of an aberration visit predicted by the model for the t-th sample. Indicates the adjustment parameter. This represents the true anomalous access label for the t-th sample. 0 indicates normal access, and 1 indicates abnormal access.

[0031] According to the enterprise information business security supervision method based on artificial intelligence provided in the embodiments of the present invention, the target accounting operation features include voucher rollback operation features and frequent accounting operation features; the abnormal tampering identification model includes a feature encoding layer, a feature reconstruction layer, a feature enhancement layer, a feature interaction layer, and a classifier output layer; the step of inputting the target accounting operation features into the abnormal tampering identification model to obtain the abnormal tampering identification result output by the abnormal tampering identification model includes:

[0032] The target accounting operation features are input into the abnormal tampering identification model. Based on the feature encoding layer, the voucher rollback operation features and the frequent accounting operation features are encoded and concatenated to output a comprehensive feature vector.

[0033] Based on the feature reconstruction layer, the comprehensive feature vector is mapped to the mean vector and standard deviation vector in the latent space, and the reconstruction vector is output according to the mean vector and the standard deviation vector;

[0034] Based on the feature enhancement layer, the reconstructed vector is weighted according to the attention mechanism to output an enhanced feature vector;

[0035] Based on the feature interaction layer, the enhanced feature vector is calculated using a graph convolutional network to output the final features;

[0036] Based on the classifier output layer, the probability of abnormal tampering during the business operation of the target user is calculated according to the final features, and the abnormal tampering identification result is output.

[0037] According to the enterprise information business security supervision method based on artificial intelligence provided in this embodiment of the invention, the loss function of the abnormal tampering identification model is:

[0038] ;

[0039] ;

[0040] ;

[0041] ;

[0042] in, This represents the loss function of the abnormal tampering detection model. These represent the corresponding weights. Represents the reconstruction loss function. Represents the divergence loss function. Classification loss function This represents the dimension of the composite feature vector X. Represents the first eigenvector of the composite feature vector X. One element, Represents the reconstructed vector The One element, This represents the mean of all elements in the comprehensive feature vector X. Represents the reconstructed vector The mean of all elements in the set. This represents the dimension of the latent variable Z. Represents the mean vector The first in One element, Represents the standard deviation vector The first in There are 1 element, y, which represents the probability of abnormal tampering. This indicates the actual label.

[0043] According to an embodiment of the present invention, an artificial intelligence-based enterprise information business security supervision method is provided to conduct business security supervision on the business operation process of the target user targeting enterprise financial information based on the abnormal access identification result and the abnormal tampering identification result, including:

[0044] The abnormal access identification result is compared with the preset abnormal access probability to obtain the first comparison result, and the abnormal tampering identification result is compared with the preset abnormal tampering probability to obtain the second comparison result;

[0045] If the first comparison result is that the abnormal access identification result is greater than or equal to the preset abnormal access probability, then it is determined that there is abnormal access behavior; or / and

[0046] If the second comparison result is that the abnormal tampering identification result is greater than or equal to the preset abnormal tampering probability, then it is determined that there is abnormal tampering behavior.

[0047] Thirdly, the present invention also provides an electronic device, comprising: a memory for storing computer software programs; and a processor for reading and executing the computer software programs, thereby realizing the enterprise information business security supervision method based on artificial intelligence as described above.

[0048] Fourthly, the present invention also provides a non-transitory computer-readable storage medium storing a computer software program, which, when executed by a processor, implements the enterprise information business security supervision method based on artificial intelligence as described above.

[0049] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the artificial intelligence-based enterprise information business security supervision method as described above.

[0050] The enterprise information business security supervision system based on artificial intelligence provided in this invention uses pre-trained abnormal access identification models and abnormal tampering identification models to conduct business security supervision on the business operation process of target users targeting enterprise financial information. Therefore, artificial intelligence technology can accurately identify abnormal reading operations or potential tampering operations that may be hidden in normal business operations that are difficult to detect during manual auditing, thus avoiding abnormal access and abnormal tampering of enterprise financial information and improving the information supervision security of enterprise financial information. Attached Figure Description

[0051] Figure 1 This is a structural diagram of the enterprise information business security supervision system based on artificial intelligence provided by the present invention;

[0052] Figure 2 This is a flowchart of the enterprise information business security supervision method based on artificial intelligence provided by the present invention;

[0053] Figure 3 An embodiment diagram of the electronic device provided in this invention;

[0054] Figure 4 An embodiment diagram of a computer-readable storage medium provided in accordance with the present invention. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0057] In the description of this invention, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed herein.

[0058] Optional, see below Figure 1 As shown, Figure 1This is a structural diagram of the AI-based enterprise information business security supervision system provided by the present invention. The AI-based enterprise information business security supervision system includes an information business supervision platform, a verification module, a data acquisition module, an anomaly identification module, a tampering identification module, and a business supervision module. The information business supervision platform is connected to the verification module, data acquisition module, anomaly identification module, tampering identification module, and business supervision module respectively, and manages each module.

[0059] In this embodiment of the invention, when a user (an employee within the enterprise) accesses and queries the enterprise's financial information, they need to initiate a business request to the information supervision system. Therefore, after the target user makes a business request regarding the enterprise's financial information, the information business supervision platform responds to the business request and controls the verification module to obtain the target user profile. The target user profile may include the target user's biometric characteristics, age, gender, geographical location, etc. Biometric characteristics include fingerprint features, facial features, iris features, etc.

[0060] Furthermore, the verification module matches the target user's biometric features with the biometric features stored in the information monitoring system. If a matching biometric feature exists in the information monitoring system, the target user passes verification. If no matching biometric feature exists in the information monitoring system, the target user fails verification.

[0061] Furthermore, if the target user passes verification, their business operation interface is activated, allowing them to perform business operations related to the company's financial information. If the target user fails verification, an alert is issued, and the target user's profile is sent to the alert system.

[0062] Furthermore, the acquisition module obtains business operation information of target users performing business operations on corporate financial information through business operation interfaces. The business operation information includes target access operation characteristics and target accounting operation characteristics. Target access operation characteristics include access permission characteristics, access time characteristics, and access frequency characteristics. Target accounting operation characteristics include voucher rollback operation characteristics and accounting operation frequency characteristics. Voucher rollback operation characteristics include rollback time, voucher type involved, rollback amount, etc. Accounting operation frequency characteristics include the number of times the same data is accessed within a unit of time, or the frequency of repeated operations on a certain data, such as the number of accounting operations within a unit of time, or the range of amounts involved in repeated operations.

[0063] Furthermore, the anomaly detection module inputs the target user profile and target access operation features into the anomaly access detection model to obtain the anomaly access detection result output by the anomaly access detection model. In this embodiment of the invention, the anomaly access detection model is trained based on the sample user profile, the sample access operation features of the sample user profile, and their corresponding result labels.

[0064] Furthermore, the tampering identification module inputs the target accounting operation features into the abnormal tampering identification model to obtain the abnormal tampering identification result output by the abnormal tampering identification model. In this embodiment of the invention, the abnormal tampering identification model is trained based on the sample accounting operation features and their corresponding label results.

[0065] In this embodiment of the invention, the abnormal access identification result is the abnormal access probability, and the abnormal tampering identification result is the abnormal tampering probability. Therefore, the business supervision model, based on the preset probability rules and combining the abnormal access identification result and the abnormal tampering identification result, conducts business security supervision on the business operation process of the target user targeting the enterprise's financial information, that is, determines whether the target user has abnormal access behavior or / and abnormal tampering behavior.

[0066] This invention uses pre-trained abnormal access and abnormal tampering identification models to conduct business security supervision of target users' business operations on corporate financial information. Therefore, artificial intelligence technology can accurately identify abnormal reading or potential tampering behaviors that may be hidden in normal business operations that are difficult to detect during manual auditing, thus preventing abnormal access and tampering of corporate financial information and improving the information security of corporate financial information supervision.

[0067] Reference Figure 2 , Figure 2 This is a flowchart of the AI-based enterprise information business security supervision method provided by the present invention. In this embodiment of the invention, the executing entity of the AI-based enterprise information business security supervision method is an information supervision system, and the AI-based enterprise information business security supervision method includes:

[0068] Step 10: Respond to the target user's business request for corporate financial information. After verification based on the target user's profile, activate the target user's business operation interface.

[0069] In this embodiment of the invention, when a user (an employee within the company) accesses and queries the company's financial information, they need to initiate a business request to the information supervision system.

[0070] Optionally, after a target user makes a business request for the company's financial information, the information supervision system responds to the business request and obtains the target user profile. The target user profile may include the target user's biometric characteristics, user age, gender, geographical location, etc. Biometric characteristics include fingerprint features, facial features, iris features, etc.

[0071] Furthermore, the information monitoring system matches the target user's biometric characteristics with the biometric characteristics stored in the system. If a matching biometric characteristic exists in the system, the target user is deemed to have passed verification. If no matching biometric characteristic exists in the system, the target user is deemed to have failed verification.

[0072] Furthermore, if the target user passes verification, their business operation interface is activated, allowing them to perform business operations related to the company's financial information. If the target user fails verification, an alert is issued, and the target user's profile is sent to the alert system.

[0073] Step 20: Obtain the target user's business operation information regarding the enterprise's financial information based on the business operation interface; the business operation information includes the target access operation characteristics and the target accounting operation characteristics.

[0074] Furthermore, the information supervision system obtains business operation information of target users performing business operations on corporate financial information through business operation interfaces. Among them, business operation information includes target access operation characteristics and target accounting operation characteristics. Target access operation characteristics include access permission characteristics, access time characteristics, and access frequency characteristics. Target accounting operation characteristics include voucher rollback operation characteristics and accounting operation frequency characteristics. Voucher rollback operation characteristics include rollback time, voucher type involved, rollback amount, etc. Accounting operation frequency characteristics include the number of times the same data is accessed within a unit of time or the frequency of repeated operations on a certain data, such as the number of accounting operations within a unit of time or the range of amounts involved in repeated operations.

[0075] Step 30: Input the target user profile and target access operation features into the abnormal access identification model to obtain the abnormal access identification result output by the abnormal access identification model.

[0076] Optionally, the information monitoring system of this embodiment of the invention embeds a pre-trained abnormal access identification model, which is trained based on sample user profiles, sample access operation features of the sample user profiles, and their corresponding result labels. Therefore, the information monitoring system inputs the target user profile and target access operation features into the abnormal access identification model to obtain the abnormal access identification result output by the abnormal access identification model, as described in steps 301 to 304.

[0077] Step 40: Input the target accounting operation features into the abnormal tampering identification model to obtain the abnormal tampering identification results output by the abnormal tampering identification model.

[0078] Optionally, the information monitoring system of this embodiment of the invention embeds a pre-trained abnormal tampering identification model, which is trained based on the sample accounting operation features and their corresponding label results. Therefore, the information monitoring system inputs the target accounting operation features into the abnormal tampering identification model to obtain the abnormal tampering identification result output by the abnormal tampering identification model, as specifically in steps 401 to 405.

[0079] Step 50: Based on the results of abnormal access identification and abnormal tampering identification, conduct business security supervision on the business operation process of the target user targeting the company's financial information.

[0080] In this embodiment of the invention, the abnormal access identification result is the abnormal access probability, and the abnormal tampering identification result is the abnormal tampering probability. Therefore, the information supervision system, based on preset probability rules and combining the abnormal access identification result and the abnormal tampering identification result, conducts business security supervision on the target user's business operation process regarding the enterprise's financial information, that is, determines whether the target user has abnormal access behavior and / or abnormal tampering behavior, specifically steps 501 to 503. In one embodiment, the preset probability rule is: if the abnormal access identification result is greater than or equal to the preset abnormal access probability, then abnormal access behavior exists. If the abnormal tampering identification result is greater than or equal to the preset abnormal tampering probability, then abnormal tampering behavior exists.

[0081] This invention uses pre-trained abnormal access and abnormal tampering identification models to conduct business security supervision of target users' business operations on corporate financial information. Therefore, artificial intelligence technology can accurately identify abnormal reading or potential tampering behaviors that may be hidden in normal business operations that are difficult to detect during manual auditing, thus preventing abnormal access and tampering of corporate financial information and improving the information security of corporate financial information supervision.

[0082] In one embodiment, the target access operation features of this invention include access permission features, access time features, and access frequency features. The abnormal access identification model includes a graph neural network layer, a self-attention mechanism layer, a deep network layer, and an output processing layer. Therefore, steps 301 to 304 are described as follows:

[0083] Step 301: Input the target user profile and target access operation features into the abnormal access identification model. Based on the graph neural network layer, integrate the target user profile, access permission features, access time features and access frequency features to construct a graph structure, and output the first feature vector sequence to represent the target user profile and target access operation features according to the graph structure.

[0084] Optionally, the information monitoring system can input the target user profile, access permission characteristics, access time characteristics, and access frequency characteristics into the abnormal access identification model.

[0085] Furthermore, the graph neural network layer integrates the target user profile, access permission features, access time features, and access frequency features to construct a graph structure, and outputs a first feature vector sequence representing the target user profile and target access operation features based on the graph structure, as follows:

[0086] The graph neural network layer integrates the target user profile and target access operation features to construct a graph structure. ,in, Represents a set of nodes. The graph structure represents the set of nodes and edges, different attributes in the target user profile, such as user age, gender, and geographic location, as well as access operation characteristics, namely access permission characteristics, access time characteristics, and access frequency characteristics. The existence of nodes in a network depends on whether there are potential associations between them. In one embodiment, if a user's geographical location and access time are potentially related, then there are node edges between the corresponding nodes.

[0087] For graph structures The i-th node in Its initial eigenvector can be expressed as The feature vector integrates information related to the node from the target user profile and access operation features.

[0088] Graph neural network layers capture the propagation of information within the graph structure by iteratively updating the feature vectors of nodes. In the k-th iteration, the node... The feature vector update formula is as follows:

[0089] ;

[0090] in, Represents a node The feature vector after the k-th iteration of the graph neural network (GNN); This represents an activation function, such as the ReLU activation function; Represents a node The adjacent nodes, Represents a node The set of adjacent nodes; This represents the normalization constant, used to handle the influence weights of different adjacent nodes, and is determined based on the weights of the node edges; Represents a node The feature vector after k-1 iterations This represents the weight matrix for the k-th iteration. This represents the bias vector for the k-th iteration.

[0091] After K iterations, the updated feature vector sequence of the output node set of the graph neural network layer is obtained. Among them, the updated feature vector sequence , This represents the nth node in the node set V. The updated feature vector after K iterations This represents the number of nodes in the node set V.

[0092] Furthermore, the graph neural network layer updates the feature vector sequence of the node set. The first feature vector sequence is input into the self-attention mechanism layer.

[0093] Step 302: Based on the self-attention mechanism layer, calculate the attention weight vector of each node in the graph structure according to the first feature vector sequence, and output the second feature vector sequence.

[0094] Furthermore, the self-attention mechanism layer computes the values ​​of each node in the graph structure through a self-attention mechanism. attention weight vector The calculation formula is as follows:

[0095] ;

[0096] ;

[0097] in, Represents a node The updated feature vector pairs of nodes The attention weights of the updated feature vectors. Represents a node Updated feature vectors and nodes The feature similarity between the updated feature vectors This represents a similarity function, such as the cosine similarity function.

[0098] After processing by the self-attention mechanism layer, the second feature vector sequence output by the self-attention mechanism layer is obtained, wherein the second feature vector sequence... .

[0099] Step 303: Based on the deep network layer, the second feature vector sequence is superimposed using a restricted Boltzmann machine to output the target feature vector.

[0100] The deep network layer in this embodiment of the invention includes m Restricted Boltzmann Machines (RBMs), and the number of visible layer nodes of the m-th RBM is... The number of hidden layer nodes is The visible layer node vector of the m-th Restricted Boltzmann Machine (RBM) is represented as: The hidden layer node vector is represented as Therefore, the energy function of deep network layers It can be represented as:

[0101] ;

[0102] in, Let represent the neuron state of the i-th visible layer node in the m-th Restricted Boltzmann Machine (RBM). This represents the connection weight between the i-th visible layer node and the j-th hidden layer node in the m-th Restricted Boltzmann Machine (RBM). This represents the neuron state of the j-th hidden layer node in the m-th Restricted Boltzmann Machine (RBM). This represents the bias of the i-th visible layer node in the m-th Restricted Boltzmann Machine (RBM). This represents the bias of the j-th hidden layer node in the m-th Restricted Boltzmann Machine (RBM).

[0103] Therefore, the self-attention mechanism layer will use the second feature vector sequence The input is fed into a deep network layer, which then processes the second feature vector sequence. As the visible layer node vector of the first Restricted Boltzmann Machine (RBM), i.e., the visible layer node vector of the first Restricted Boltzmann Machine (RBM) ,Right now , , .

[0104] Therefore, the energy function of the first restricted Boltzmann machine (RBM) It can be represented as

[0105] .

[0106] Furthermore, the first Restricted Boltzmann Machine (RBM) is trained using the Contrastive Divergence algorithm to update its weights. Bias and This enables the first Restricted Boltzmann Machine (RBM) to learn the input feature vector (i.e., the sequence of feature vectors). The latent patterns in the model are identified. After training, the hidden layer of the first Restricted Boltzmann Machine (RBM) outputs a new feature representation, which is then used as the input to the next RBM for training. This process is repeated until the m-th RBM. After the stacking of m RBMs, the hidden layer of the m-th RBM outputs a low-dimensional target feature vector z.

[0107] Among them, the target feature vector z integrates the key information of the target user profile and the target access operation features after the previous multi-layer processing, that is, it is the comprehensive result obtained after processing by the graph neural network layer, the self-attention mechanism layer and the deep network layer.

[0108] Step 304: Based on the output processing layer, calculate the probability of abnormal access behavior of the target user during business operation according to the target feature vector, and output the abnormal access identification result.

[0109] Furthermore, the deep network layer inputs the target feature vector z into the output processing layer, which then calculates the probability of abnormal access based on the target feature vector z, indicating that the target user exhibited unusual access behavior during business operations. The probability of abnormal access behavior in the target user's business operations is determined as the abnormal access identification result. The calculation formula is as follows:

[0110] ;

[0111] in, This represents the weight vector of the output processing layer. Indicates the bias of the output processing layer. Describes the minimum value function. Represents the target feature vector and weight vector The inner product operation, i.e., the target feature vector In the weight vector Projected length in the direction multiplied by .

[0112] Optionally, the loss function of the abnormal access identification model in this embodiment of the invention includes a triplet loss function and a focus loss function. Therefore, the specific analysis of the loss function of the abnormal access identification model is as follows:

[0113] In one embodiment, the training dataset is ,in, This represents the target access operation characteristics of the t-th sample, including specific feature information such as access permissions, access time, and access frequency. This represents the target user profile of the t-th sample, including various user attribute information such as the user's age, gender, and geographic location; Indicates the true anomalous access label of the t-th sample ( 0 indicates normal access, 1 indicates abnormal access. Indicates the number of samples.

[0114] Furthermore, triplet samples are constructed based on the training dataset. Each triplet sample includes an anchor sample, a positive sample, and a negative sample. The anchor sample and the positive sample have the same anomalous access label, i.e., both are normal access or anomalous access, while the negative sample has the opposite anomalous access label. The feature vector of the anchor sample is processed by the anomalous access recognition model to obtain a vector. The feature vectors of positive samples are processed by the abnormal access detection model to obtain vectors. The feature vectors of negative samples are processed by the abnormal access detection model to obtain vectors. The purpose of triplet loss is to minimize the distance between the anchor sample and the positive sample, and maximize the distance between the anchor sample and the negative sample. Therefore, the formula for the triplet loss function in this invention is:

[0115] ;

[0116] in, Represents the triplet loss function. Represents the maximum value function. This represents the distance metric between the anchor sample and the positive sample. This represents the distance metric between the anchor sample and the negative sample; Represents distance functions, such as the cosine distance function; This represents the margin parameter, which controls the required distance difference between positive and negative samples and the anchor sample.

[0117] The model in this embodiment of the invention needs to focus on hard-to-classify samples, i.e. samples that are easily misclassified. Therefore, this embodiment of the invention uses focus loss to address the class imbalance problem. The specific formula for the focus loss function is as follows:

[0118] ;

[0119] in, Represents the focus loss function. This indicates that the weights are dynamically assigned based on the sample category. For example, samples with abnormal access are given higher weights to highlight their importance. This represents an adjustment parameter used to control the degree of attention given to difficult-to-classify samples; This represents the probability of abnormal access predicted by the model for the t-th sample.

[0120] Therefore, the loss function of the abnormal access identification model in this embodiment of the invention The specific formula is as follows:

[0121] ;

[0122] in, Represents weight parameters This is used to balance the importance of triplet loss and focus loss throughout the training process.

[0123] By minimizing the loss function of the abnormal access identification model, the stochastic gradient descent algorithm is used to update the model's weights and biases, thereby enabling the model to accurately identify abnormal access behavior.

[0124] The embodiments of the present invention can accurately capture the complex relationship between user profiles and access operation characteristics through graph neural networks, self-attention mechanisms and deep networks in the abnormal access identification model, thereby effectively identifying whether there is abnormal access behavior in the business operation process of target users regarding corporate financial information, and improving the information supervision security of corporate financial information.

[0125] In one embodiment, the target accounting operation features in this invention include voucher rollback operation features and frequent accounting operation features. The abnormal tampering identification model includes a feature encoding layer, a feature reconstruction layer, a feature enhancement layer, a feature interaction layer, and a classifier output layer. Therefore, steps 401 to 405 are as follows:

[0126] Step 401: Input the target accounting operation features into the abnormal tampering identification model, encode and concatenate the voucher rollback operation features and the frequent accounting operation features based on the feature encoding layer, and output a comprehensive feature vector.

[0127] Optionally, the information monitoring system can input the target accounting operation characteristics into the abnormal tampering identification model.

[0128] Furthermore, the feature encoding layer encodes the voucher rollback operation features and the frequent accounting operation features, resulting in the encoded voucher rollback operation feature vector. , dimension After encoding, the feature vector of frequent accounting operations is , dimension The encoding method is determined based on the feature type. In one embodiment, the voucher type feature in the voucher rollback operation feature is encoded using one-hot encoding, and the time feature in the voucher rollback operation feature is converted into a timestamp-related numerical feature using timestamp encoding.

[0129] Furthermore, the feature encoding layer will assign the feature vector of the encoded voucher rollback operation as follows: The feature vector of frequent accounting operations after encoding is By concatenating the features, a comprehensive feature vector is obtained. ,in, This represents the concatenation operation, which combines the dimensions of the feature vector X. .

[0130] Step 402: Based on the feature reconstruction layer, the comprehensive feature vector is mapped to the mean vector and standard deviation vector in the latent space, and the reconstructed vector is output according to the mean vector and standard deviation vector.

[0131] Furthermore, the feature encoding layer inputs the synthesized feature vector X into the feature reconstruction layer, which is the feature reconstruction layer of the variational autoencoder. Therefore, the feature reconstruction layer includes an encoder layer and a decoder layer.

[0132] Furthermore, the encoder layer maps the input composite feature vector X to the mean vector in the latent space. and standard deviation vector The encoder layer consists of L fully connected layers, as detailed below:

[0133] The weight matrix of the first fully connected layer of the encoder layer is , dimension The bias vector is , dimension ,in, This indicates the number of neurons in the hidden layer of the first fully connected layer.

[0134] Therefore, the first fully connected layer passes the input composite feature vector X through the weight matrix. and bias vector Perform a linear transformation to obtain the linear transformation result. Its dimensions are Furthermore, the first fully connected layer undergoes a linear transformation using the ReLU activation function. The process is performed to obtain the output of the first fully connected layer. Output results ,in, Furthermore, the first fully connected layer will output the result. As input to the second fully connected layer, it is sequentially looped through L fully connected layers.

[0135] For the Lth fully connected layer, the weight matrix of the Lth fully connected layer is: , dimension The bias vector is , dimension ,in, This represents the dimension of the latent variable Z.

[0136] Therefore, the Lth fully connected layer will output the result of the (L-1)th fully connected layer. After weight matrix and bias vector Perform a linear transformation to obtain the linear transformation result. The result of linear transformation That is, the mean vector ,Right now Furthermore, the linear transformation result is processed using the softplus function. After processing, the standard deviation vector is obtained. The softplus function is... ,therefore, .

[0137] Furthermore, the encoder layer obtains the mean vector and standard deviation vector The latent variable Z, with dimension d, is obtained through sampling. The specific sampling formula is as follows: ,in, That is, the standard normal distribution.

[0138] Furthermore, the encoder layer inputs the latent variable Z to the decoder layer, and the decoder layer reconstructs the latent variable Z into a reconstructed vector with the same dimension as the input comprehensive feature vector X. The encoder layer consists of M fully connected layers, and the specific decoding and reconstruction process is as follows:

[0139] The weight matrix of the first fully connected layer in the decoder layer is , dimension The bias vector is , dimension ,in, This indicates the number of neurons in the hidden layer of the first fully connected layer. It should be noted that this refers to the number of neurons in the hidden layer of the first fully connected layer in the decoder layer. It is not necessarily related to the number of neurons in the hidden layer of the first fully connected layer in the encoder layer. same.

[0140] Therefore, the first fully connected layer passes the input latent variable Z through the weight matrix. and bias vector Perform a linear transformation to obtain the linear transformation result. Its dimensions are Furthermore, the first fully connected layer undergoes a linear transformation using the ReLU activation function. The process is performed to obtain the output of the first fully connected layer. Output results ,in, Furthermore, the first fully connected layer will output the result. As input to the second fully connected layer, it is cyclically passed through M fully connected layers.

[0141] For the Mth fully connected layer, the weight matrix of the Mth fully connected layer is: , dimension The bias vector is , dimension ,in, This represents the dimension of the composite feature vector X.

[0142] Therefore, the Mth fully connected layer will output the result of the (M-1)th fully connected layer. After weight matrix and bias vector Perform a linear transformation to obtain the linear transformation result. The result of linear transformation The result of linear transformation That is, the reconstructed vector .

[0143] Step 403: Based on the feature enhancement layer, the reconstructed vector is weighted according to the attention mechanism to output the enhanced feature vector.

[0144] Furthermore, the decoder layer will reconstruct the vector. The input is fed to the feature enhancement layer, wherein, in this embodiment of the invention, the feature enhancement layer is an attention-based feature enhancement layer. Therefore, the feature enhancement layer reconstructs the vector. The input is fed into an attention mechanism, which enhances its focus on key features by calculating the correlations between different feature dimensions. In one embodiment, the query vector Q, key vector K, and value vector V in the attention mechanism are derived from the reconstructed vector. Obtained through different linear transformations, i.e. , , ,in, , and Let represent the corresponding weight matrix; therefore, the formula for the attention weights is:

[0145] ,in, This represents the dimension of the key vector K.

[0146] Therefore, the feature enhancement layer uses an attention mechanism to weight the features, resulting in a weighted enhanced feature vector. Enhance feature vectors ,in, .

[0147] Step 404: Based on the feature interaction layer, the enhanced feature vector is calculated using the graph convolutional network to output the final features.

[0148] Furthermore, the feature enhancement layer will enhance the feature vector. The input is fed to the feature interaction layer, wherein, in this embodiment of the invention, the feature interaction layer is a feature interaction layer based on a graph convolutional network (GCN). Therefore, the feature interaction layer enhances the feature vector. Construct the graph.

[0149] Among them, enhanced feature vector Each dimension represents a node in the graph. For example, augmented feature vectors. As an n-dimensional vector, the graph contains n nodes, each carrying information about the accounting operation characteristics in a certain dimension. The edges between nodes are determined based on prior knowledge. For example, there is an inherent correlation between the monetary feature dimension involved in voucher rollback operations and the dimension related to the same monetary range in the frequency of accounting operations; therefore, there are edges between the nodes corresponding to these two dimensions. The existence of these edges indicates that the two feature dimensions may have a mutual influence when judging abnormal tampering.

[0150] Initialize the input: The Graph Convolutional Network (GCN) consists of r layers, and the input feature matrix of the r-th layer is... Initially In the embodiments of the present invention It is The matrix, where m is the number of nodes (and...). (same dimensions) It is the feature dimension of each node in the r-th layer.

[0151] Adjacency matrix and degree matrix: Adjacency matrix A is a A matrix is ​​used to represent the connections between nodes. If there is an edge connecting node i and node j, then... Alternatively, assign a value based on the edge weight; otherwise... The degree matrix D is a diagonal matrix, and its diagonal elements are... It is the degree of node i, that is, the number of edges connected to node i. If it is a weighted graph, it is the sum of edge weights.

[0152] Graph convolution operation: The calculation formula for GCN layers is as follows: ,in, I represents a self-join, and I represents the identity matrix. Therefore, each node can include its own information for updating. express The degree matrix, This represents the weight matrix of the r-th layer, with dimension . It is used to perform linear transformations on input features.

[0153] Nonlinear activation: after calculation Then, the ReLU activation function is applied, i.e. Introducing nonlinearity enables Graph Convolutional Networks (GCNs) to learn more complex feature interaction patterns. For example, in scenarios involving accounting operation features, nonlinear activation can uncover nonlinear correlations, such as the special behavior of certain feature combinations under abnormal tampering conditions.

[0154] Multi-layer GCN: After computation through a multi-layer graph convolutional network (GCN), each layer updates the feature representation of the nodes. As the number of layers increases, nodes can fuse more neighborhood information and gradually learn more advanced and abstract interaction patterns between accounting operation features, thus obtaining the final features. final features Where R represents the feature enhancement layer, which includes R layers of a graph convolutional network (GCN), and the final feature... It integrates the interaction information between nodes in the entire graph structure, providing richer semantic information for identifying abnormal tampering.

[0155] Step 405: Based on the classifier output layer, calculate the probability of abnormal tampering by the target user during business operations according to the final features, and output the abnormal tampering identification result.

[0156] Furthermore, the feature enhancement layer will ultimately feature... The input is fed to the classifier output layer. In this embodiment of the invention, the classifier output layer is the output layer of a two-layer perceptron. The first layer of the perceptron processes the final features using a weight matrix and a bias vector. The process is performed to obtain intermediate processing results. Intermediate processing results ,in, This represents the weight matrix of the first-layer perceptron. This represents the bias vector of the first-layer perceptron. Weight matrix. The dimension depends on the final feature The dimensions and the number of hidden units of the first-layer perceptron are determined.

[0157] In one embodiment, the final feature yes The matrix, the first layer of the perceptron has If there are hidden units, then the weight matrix The dimension is The ReLU activation function is used to introduce nonlinearity, enabling the learning of more complex decision boundaries.

[0158] Furthermore, the first-layer perceptron will process the intermediate results... The input is fed into the second-layer perceptron, which uses the sigmoid function. Therefore, the second-layer perceptron processes the intermediate results using its weight matrix and bias vector. The process is performed to output the probability of abnormal tampering behavior by the target user during business operations. This probability is the abnormal tampering identification result. ,in, This represents the weight matrix of the second-layer perceptron. This represents the bias vector of the second-layer perceptron, and the probability of abnormal tampering. Weight matrix The dimension is .

[0159] Among them, the sigmoid function .

[0160] The loss function of the abnormal tampering identification model in this embodiment of the invention includes a reconstruction loss function, a divergence loss function, and a classification loss function.

[0161] The mean squared error (MSE) is used as the reconstruction loss function to measure the reconstructed vector. The difference between the latent variable Z and the original integrated feature vector X. The divergence loss function is used to measure the difference between the distribution of the latent variable Z and the standard normal distribution. The binary cross-entropy loss is used as the classification loss function to measure the difference between the anomalous tampering probability y of the classifier output and the true label. , The differences between them necessitate the following analysis of the loss function of the abnormal tampering detection model:

[0162] The reconstruction loss function can be expressed as:

[0163] ;

[0164] in, Represents the reconstruction loss function. This represents the dimension of the composite feature vector X. Represents the first eigenvector of the composite feature vector X. One element, Represents the reconstructed vector The One element, This represents the mean of all elements in the comprehensive feature vector X. Represents the reconstructed vector The mean of all elements in the set.

[0165] Divergence loss function representation:

[0166] ;

[0167] in, Represents the divergence loss function. This represents the dimension of the latent variable Z. Represents the mean vector The first in One element, Represents the standard deviation vector The first in Each element.

[0168] Classification loss function It can be represented as:

[0169] .

[0170] Therefore, the loss function of the abnormal tampering detection model can be expressed as:

[0171] ;

[0172] in, This represents the loss function of the abnormal tampering detection model. These represent the corresponding weights.

[0173] During training, the loss function of the abnormal tampering detection model is adjusted by modifying the weight parameters and optimizing the model parameters. Minimize the model to obtain the optimal abnormal tampering detection model.

[0174] The embodiments of the present invention, through the feature encoding layer, feature reconstruction layer, feature enhancement layer and feature interaction layer in the abnormal tampering identification model, can accurately capture key information in the characteristics of target accounting operations, thereby effectively identifying whether there is abnormal tampering behavior in the business operation process of target users regarding corporate financial information, and improving the information supervision security of corporate financial information.

[0175] Further, steps 501 to 503 are described as follows:

[0176] Step 501: Compare the abnormal access identification result with the preset abnormal access probability to obtain a first comparison result, and compare the abnormal tampering identification result with the preset abnormal tampering probability to obtain a second comparison result;

[0177] Step 502: If the first comparison result is that the abnormal access identification result is greater than or equal to the preset abnormal access probability, then it is determined that there is abnormal access behavior.

[0178] Step 503: If the second comparison result is an abnormal tampering identification result that is greater than or equal to the preset abnormal tampering probability, then it is determined that there is an abnormal tampering behavior.

[0179] Optionally, the information monitoring system compares the abnormal access identification result with the preset abnormal access probability to obtain a first comparison result, and compares the abnormal tampering identification result with the preset abnormal tampering probability to obtain a second comparison result, wherein the preset abnormal access probability and the preset abnormal tampering probability are set according to actual conditions.

[0180] Furthermore, if the first comparison result indicates that the abnormal access identification result is greater than or equal to the preset abnormal access probability, the information monitoring system determines that the target user has engaged in abnormal access behavior during business operations. If the second comparison result indicates that the abnormal tampering identification result is greater than or equal to the preset abnormal tampering probability, the information monitoring system determines that the target user has engaged in abnormal tampering behavior during business operations.

[0181] In one embodiment, the preset abnormal access probability is 0.5, and the preset abnormal tampering probability is 0.4. The probability rule is: abnormal access is determined to exist when the abnormal access probability is greater than or equal to the threshold of 0.5, and abnormal tampering is determined to exist when the abnormal tampering probability is greater than or equal to the threshold of 0.4. User A's abnormal access probability is 0.1, and the abnormal tampering probability is 0.15, so user A is determined not to be abnormal. User B's abnormal access probability is 0.6, and the abnormal tampering probability is 0.1, so user B is determined to have engaged in abnormal access behavior. User C's abnormal access probability is 0.1, and the abnormal tampering probability is 0.5, so user C is determined to have engaged in abnormal tampering behavior. User D's abnormal access probability is 0.6, and the abnormal tampering probability is 0.6, so user D is determined to have engaged in both abnormal access behavior and abnormal tampering behavior.

[0182] The embodiments of the present invention can accurately identify abnormal situations of users in the process of business operations by identifying abnormal access and abnormal tampering results, thereby improving the information security of enterprise financial information supervision.

[0183] Please see Figure 3 , Figure 3 An embodiment diagram of an electronic device provided in accordance with the present invention. For example... Figure 3 As shown, this embodiment of the invention provides an electronic device 300, including a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor 320. When the processor 320 executes the computer program 311, it performs the following steps:

[0184] In response to the target user's business request for corporate financial information, after verification based on the target user's target user profile, the target user's business operation interface is activated.

[0185] Based on the business operation interface, obtain the target user's business operation information regarding the enterprise's financial information; the business operation information includes the target access operation characteristics and the target accounting operation characteristics;

[0186] Input the target user profile and target access operation features into the abnormal access identification model to obtain the abnormal access identification results output by the abnormal access identification model;

[0187] Input the target accounting operation characteristics into the abnormal tampering identification model to obtain the abnormal tampering identification results output by the abnormal tampering identification model;

[0188] Based on the results of abnormal access identification and abnormal tampering identification, business security supervision is carried out on the business operation process of target users targeting corporate financial information.

[0189] Among them, the abnormal access identification model is trained based on the sample user profile, the sample access operation features of the sample user profile and their corresponding result labels; the abnormal tampering identification model is trained based on the sample accounting operation features and their corresponding label results.

[0190] Please see Figure 4 , Figure 4 An embodiment diagram of a computer-readable storage medium provided in accordance with an embodiment of the present invention is shown. Figure 4 As shown, this embodiment provides a computer-readable storage medium 400 on which a computer program 311 is stored. When the computer program 311 is executed by a processor, it performs the following steps:

[0191] In response to the target user's business request for corporate financial information, after verification based on the target user's target user profile, the target user's business operation interface is activated.

[0192] Based on the business operation interface, obtain the target user's business operation information regarding the enterprise's financial information; the business operation information includes the target access operation characteristics and the target accounting operation characteristics;

[0193] Input the target user profile and target access operation features into the abnormal access identification model to obtain the abnormal access identification results output by the abnormal access identification model;

[0194] Input the target accounting operation characteristics into the abnormal tampering identification model to obtain the abnormal tampering identification results output by the abnormal tampering identification model;

[0195] Based on the results of abnormal access identification and abnormal tampering identification, business security supervision is carried out on the business operation process of target users targeting corporate financial information.

[0196] Among them, the abnormal access identification model is trained based on the sample user profile, the sample access operation features of the sample user profile and their corresponding result labels; the abnormal tampering identification model is trained based on the sample accounting operation features and their corresponding label results.

[0197] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the artificial intelligence-based enterprise information business security supervision method provided by the above methods, the method including:

[0198] In response to the target user's business request for corporate financial information, after verification based on the target user's target user profile, the target user's business operation interface is activated.

[0199] Based on the business operation interface, obtain the target user's business operation information regarding the enterprise's financial information; the business operation information includes the target access operation characteristics and the target accounting operation characteristics;

[0200] Input the target user profile and target access operation features into the abnormal access identification model to obtain the abnormal access identification results output by the abnormal access identification model;

[0201] Input the target accounting operation characteristics into the abnormal tampering identification model to obtain the abnormal tampering identification results output by the abnormal tampering identification model;

[0202] Based on the results of abnormal access identification and abnormal tampering identification, business security supervision is carried out on the business operation process of target users targeting corporate financial information.

[0203] Among them, the abnormal access identification model is trained based on the sample user profile, the sample access operation features of the sample user profile and their corresponding result labels; the abnormal tampering identification model is trained based on the sample accounting operation features and their corresponding label results.

[0204] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one place and / or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0205] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or / and network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0206] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments and / or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An artificial intelligence-based enterprise information service security supervision method, characterized in that, The method comprises: in response to a business request of a target user for enterprise financial information, after verification based on a target user portrait of the target user, opening a business operation interface of the target user; based on the business operation interface, obtaining business operation information of the target user for enterprise financial information; the business operation information includes target access operation characteristics and target accounting operation characteristics; inputting the target user portrait and the target access operation characteristics into an abnormal access identification model to obtain an abnormal access identification result output by the abnormal access identification model; inputting the target accounting operation characteristics into an abnormal tampering identification model to obtain an abnormal tampering identification result output by the abnormal tampering identification model; based on the abnormal access identification result and the abnormal tampering identification result, performing business security supervision on the business operation process of the target user for enterprise financial information; wherein the abnormal access identification model is trained based on a sample user portrait, sample access operation characteristics of the sample user portrait, and corresponding result labels; and the abnormal tampering identification model is trained based on sample accounting operation characteristics and corresponding label results; the target access operation characteristics include access permission characteristics, access time characteristics, and access frequency characteristics; the abnormal access identification model includes a graph neural network layer, a self-attention mechanism layer, a deep network layer, and an output processing layer; the inputting of the target user portrait and the target access operation characteristics into the abnormal access identification model to obtain the abnormal access identification result output by the abnormal access identification model comprises: inputting the target user portrait and the target access operation characteristics into the abnormal access identification model, integrating and constructing a graph structure based on the graph neural network layer, and outputting a first feature vector sequence representing the target user portrait and the target access operation characteristics according to the graph structure; based on the self-attention mechanism layer, calculating the attention weight vector of each node in the graph structure according to the first feature vector sequence, and outputting a second feature vector sequence; based on the deep network layer, performing superposition processing on the second feature vector sequence through a restricted Boltzmann machine to output a target feature vector; based on the output processing layer, calculating the abnormal access probability of the target user in the business operation process according to the target feature vector, and outputting the abnormal access identification result. 2.The AI-based enterprise information business security supervision method of claim 1, wherein, the calculation formula of the abnormal access identification result is: ； wherein, denotes an anomaly access identification result, denotes a weight vector of an output processing layer, denotes a bias of an output processing layer, denotes a minimum function, denotes a target feature vector and an inner product operation of a weight vector , i.e. a projection length of the target feature vector in a direction of the weight vector multiplied by . 3.The AI-based enterprise information business security supervision method of claim 1, wherein, the loss function of the abnormal access identification model is: ； ； ； wherein, represents a loss function of the abnormal access identification model, represents a weight parameter, , represents a triplet loss function, represents a focal loss function, represents a sample number, represents a maximum function, represents a vector obtained by processing a feature vector of an anchor sample through an abnormal access identification model, represents a vector obtained by processing a feature vector of a positive sample through an abnormal access identification model, represents a vector obtained by processing a feature vector of a negative sample through an abnormal access identification model, represents a distance measure between an anchor sample and a positive sample, represents a distance measure between an anchor sample and a negative sample, represents a margin parameter, represents a weight dynamically allocated according to a sample category, represents an abnormal access probability predicted by a model for a tthsample, represents an adjustment parameter, represents a true abnormal access label of a tthsample, 0 represents normal access, and 1 represents abnormal access. 4.The AI-based enterprise information business security supervision method of claim 1, wherein the target accounting operation characteristics include voucher rollback operation characteristics and accounting operation frequency characteristics; the abnormal tampering identification model includes a feature encoding layer, a feature reconstruction layer, a feature enhancement layer, a feature interaction layer, and a classifier output layer; and the inputting of the target accounting operation characteristics into the abnormal tampering identification model to obtain the abnormal tampering identification result output by the abnormal tampering identification model comprises: Input the target account operation feature into the abnormal tampering identification model, encode and splice the certificate rollback operation feature and the account operation frequency feature based on the feature encoding layer, and output a comprehensive feature vector; Map the comprehensive feature vector to a mean vector and a standard deviation vector in a latent space based on the feature reconstruction layer, and output a reconstruction vector according to the mean vector and the standard deviation vector; Based on the feature enhancement layer, the reconstruction vector is weighted processed according to the attention mechanism, and an enhanced feature vector is outputted; Based on the feature interaction layer, the enhanced feature vector is calculated according to the graph convolution network, and a final feature is outputted; Based on the classifier output layer, the abnormal tampering probability of the target user in the business operation process is calculated according to the final feature, and the abnormal tampering identification result is outputted. 5.The AI-based enterprise information business security supervision method of claim 4, wherein, The loss function of the abnormal tampering identification model is: ； ； ； ； in, This represents the loss function of the abnormal tampering detection model. These represent the corresponding weights. Represents the reconstruction loss function. Represents the divergence loss function. Represents the classification loss function. This represents the dimension of the composite feature vector X. Represents the first eigenvector of the composite feature vector X. One element, Represents the reconstructed vector The One element, This represents the mean of all elements in the comprehensive feature vector X. Represents the reconstructed vector The mean of all elements in the set. This represents the dimension of the latent variable Z. Represents the mean vector The first in One element, Represents the standard deviation vector The first in There are 1 element, y, which represents the probability of abnormal tampering. This indicates the actual label. 6.The AI-based enterprise information service security supervision method according to any one of claims 1 to 5, characterized in that, Based on the abnormal access identification result and the abnormal tampering identification result, the business operation process of the target user on enterprise financial information is supervised for business security, including: Compare the abnormal access identification result with the preset abnormal access probability to obtain a first comparison result, and compare the abnormal tampering identification result with the preset abnormal tampering probability to obtain a second comparison result; If the first comparison result is that the abnormal access identification result is greater than or equal to the preset abnormal access probability, it is determined that there is an abnormal access behavior; or / and If the second comparison result is that the abnormal tampering identification result is greater than or equal to the preset abnormal tampering probability, it is determined that there is an abnormal tampering behavior.

7. An artificial intelligence-based enterprise information service security supervision system, characterized in that, The artificial intelligence-based enterprise information business security supervision method of claim 1 is used to execute; including information business supervision middle station, verification module, acquisition module, abnormal identification module, tampering identification module and business supervision module; the information business supervision middle station is connected with the verification module, the acquisition module, the abnormal identification module, the tampering identification module and the business supervision module respectively, and each module is managed; The verification module is used to respond to the business request of the target user to the enterprise financial information, and open the business operation interface of the target user based on the target user portrait of the target user after verification; The acquisition module is used to acquire the business operation information of the target user to the enterprise financial information based on the business operation interface; the business operation information includes target access operation feature and target account operation feature; The abnormal identification module is used to input the target user portrait and the target access operation feature into the abnormal access identification model to obtain the abnormal access identification result outputted by the abnormal access identification model; The tampering identification module is used to input the target account operation feature into the abnormal tampering identification model to obtain the abnormal tampering identification result outputted by the abnormal tampering identification model; The business supervision module is used to supervise the business operation process of the target user on enterprise financial information based on the abnormal access identification result and the abnormal tampering identification result; The abnormal access identification model is trained based on a sample user portrait, sample access operation features of the sample user portrait, and corresponding result labels; and the abnormal tampering identification model is trained based on sample account operation features and corresponding label results. The target access operation features include access permission features, access time features, and access frequency features; and the abnormal access identification model includes a graph neural network layer, a self-attention mechanism layer, a deep network layer, and an output processing layer. The inputting of the target user portrait and the target access operation features into the abnormal access identification model to obtain an abnormal access identification result output by the abnormal access identification model includes: The target user portrait and the target access operation features are input into the abnormal access identification model, the target user portrait, the access permission features, the access time features, and the access frequency features are integrated and constructed into a graph structure based on the graph neural network layer, and a first feature vector sequence is output to represent the target user portrait and the target access operation features according to the graph structure; The self-attention mechanism layer is used to calculate an attention weight vector of each node in the graph structure according to the first feature vector sequence, and a second feature vector sequence is output; The deep network layer is used to perform superposition processing on the second feature vector sequence through a restricted Boltzmann machine, and a target feature vector is output; The output processing layer is used to calculate an abnormal access probability of the target user in a business operation process according to the target feature vector, and the abnormal access identification result is output.

8. An electronic device comprising: A memory and a processor, wherein the memory stores a computer software program, and the processor reads and executes the computer software program to implement the method for monitoring and supervising enterprise information business security based on artificial intelligence according to any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium, comprising: The storage medium stores a computer software program, and the computer software program is executed by the processor to implement the method for monitoring and supervising enterprise information business security based on artificial intelligence according to any one of claims 1 to 6.

Images