Instruction risk assessment method and electronic equipment

Abstract

The invention provides an instruction risk assessment method and electronic equipment, and belongs to the technical field of artificial intelligence. According to the method, the instruction risk assessment model is constructed based on the instruction type risk and the instruction parameter compliance risk, and the multi-dimensional risk of the instruction data can be comprehensively considered, so that the subsequent risk assessment result is more accurate. Model training is carried out based on a federated learning architecture formed by a plurality of sub-nodes and fusion nodes, so that data privacy can be protected, and original data leakage is avoided; the instruction risk joint assessment model is constructed based on the trained instruction risk assessment model corresponding to each sub-node, and the assessment result corresponding to each sub-node is comprehensively considered, so that the accuracy of the assessment result can be improved. And then risk assessment is performed on the instruction data based on the instruction risk joint assessment model, so that the accuracy and efficiency of instruction auditing can be improved compared with an assessment mode of a manual rechecking mode after auditing through a single machine.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a risk assessment method for instructions and an electronic device. Background Art

[0002] With the development of 5G (5th Generation Mobile Communication Technology), the intelligent operation scenarios of communication networks have put forward higher requirements for 5G core network service operations and scheduling optimization. Intelligent service activation based on network element instructions is an important part of building cloud network operation capabilities. Instruction issuance is the basis for 5G core network service activation. All application scenarios need to be activated and changed based on network element instructions. Among them, the accuracy of instruction issuance will seriously affect the success rate of service activation and change and user experience.

[0003] At present, after the instructions are issued, they are mainly reviewed by a single machine and then manually reviewed to ensure the accuracy of the instructions. However, with the deepening of digital transformation of enterprises, various business systems will generate a large amount of instruction data that needs to be audited for compliance. The current instruction auditing method has problems such as data security risks and low computing efficiency. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a risk assessment method and electronic device for instructions, aiming to build an instruction risk joint assessment model based on a federated learning architecture to perform risk assessment on instruction data, thereby protecting data privacy, avoiding leakage of original data, and improving the accuracy and efficiency of instruction auditing.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a risk assessment method for an instruction, the method comprising:

[0006] Based on the instruction type risk and instruction parameter compliance risk, a corresponding instruction risk assessment model is configured in each sub-node, where each sub-node is configured with a single agent;

[0007] Based on a federated learning architecture consisting of multiple sub-nodes and fusion nodes, each sub-node trains the local instruction risk assessment model and sends the trained instruction risk assessment model to the fusion node, so that the fusion node constructs an instruction risk joint assessment model based on the instruction risk assessment models trained corresponding to each sub-node;

[0008] The local instruction data of the child node is sent to the fusion node, so that the fusion node calls the instruction risk joint assessment model to perform risk assessment on the local instruction data of the child node to output the risk level of the instruction data.

[0009] In one embodiment of the present application, after sending the instruction data of the local sub-node to the fusion node, the method further includes:

[0010] receiving the risk level of the instruction data output by the instruction risk joint assessment model;

[0011] The instruction execution module of the subnode executes the instruction data based on the risk level of the instruction data and a preset execution program;

[0012] The evaluation module of the child node evaluates the execution result and returns the evaluation result to the instruction execution module to optimize the preset execution program.

[0013] In one embodiment of the present application, configuring a corresponding instruction risk assessment model at each sub-node based on instruction type risk and instruction parameter compliance risk includes:

[0014] Calculate the indicator value under the instruction type dimension, and use the Sigmoid function to convert the indicator value under the instruction type dimension into a first score;

[0015] Calculate the indicator value under the instruction parameter dimension, and use the Sigmoid function to convert the indicator value under the instruction parameter dimension into a second score;

[0016] The first score and the second score are weighted and summarized according to the weights corresponding to the instruction type dimension and the instruction parameter dimension respectively to construct an instruction risk assessment model, and the corresponding instruction risk assessment model is configured in each sub-node.

[0017] In one embodiment of the present application, the federated learning architecture composed of multiple sub-nodes and fusion nodes, each sub-node trains the local instruction risk assessment model, including:

[0018] Each child node inputs local instruction data into the instruction risk assessment model for training to obtain a parameter vector of the instruction risk assessment model;

[0019] The parameter vector is encrypted and sent to the fusion node, so that the fusion node optimizes the parameter vector of each child node based on the clustering algorithm, and sends the optimized parameter vector to each child node until the fusion calculation result of the parameter vector sent by each child node meets the convergence condition, thereby terminating the training of the instruction risk assessment model.

[0020] In one embodiment of the present application, after sending the instruction data of the local sub-node to the fusion node, the method further includes:

[0021] Calling the trained instruction risk assessment model to perform risk assessment on the instruction data of the local child node to output a first risk level of the instruction data;

[0022] receiving a second risk level of the instruction data output by the instruction risk joint assessment model;

[0023] A final risk level corresponding to the instruction data is determined according to the first risk level and the second risk level.

[0024] In one embodiment of the present application, determining the final risk level corresponding to the instruction data according to the first risk level and the second risk level includes:

[0025] According to the business type corresponding to the instruction data, one of the first risk level and the second risk level is selected as the final risk level corresponding to the instruction data.

[0026] To achieve the above purpose, a second aspect of an embodiment of the present application proposes an instruction risk assessment method, the method comprising:

[0027] Based on the federated learning architecture consisting of multiple sub-nodes and fusion nodes, assist each sub-node to train the local instruction risk assessment model;

[0028] Receiving the trained instruction risk assessment models corresponding to each sub-node, and constructing an instruction risk joint assessment model based on the trained instruction risk assessment models corresponding to each sub-node;

[0029] The local instruction data of the child node is received, and the instruction risk joint assessment model is called to perform risk assessment on the local instruction data of the child node to output the risk level of the instruction data.

[0030] In one embodiment of the present application, based on a federated learning architecture consisting of multiple sub-nodes and fusion nodes, each sub-node is assisted in training a local instruction risk assessment model, including:

[0031] Receive the parameter vector of the instruction risk assessment model sent by each child node;

[0032] Optimize the parameter vector of each child node based on the clustering algorithm, and send the optimized parameter vector to each child node;

[0033] Return to the step of receiving the parameter vectors of the instruction risk assessment model sent by each child node, until the fusion calculation results of the parameter vectors of each child node meet the convergence conditions, and send an instruction to end the training to each child node.

[0034] In one embodiment of the present application, based on the trained instruction risk assessment models corresponding to each sub-node, an instruction risk joint assessment model is constructed, including:

[0035] The scores of the trained instruction risk assessment models for each sub-node are weighted averaged to obtain the multi-agent collaborative risk score.

[0036] The current multi-agent collaborative risk score and the previous multi-agent collaborative risk score are weighted and summed to construct a joint instruction risk assessment model.

[0037] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the method described in the first aspect of the embodiment of the present application, or implements the method described in the second aspect of the embodiment of the present application.

[0038] In the technical solution provided in the embodiment of the present application, based on the instruction type risk and instruction parameter compliance risk, a corresponding instruction risk assessment model is configured in each child node, and the multi-dimensional risk of instruction data is comprehensively considered, so that the subsequent risk assessment results are more accurate. Based on the federated learning architecture composed of multiple child nodes and fusion nodes, each child node trains the local instruction risk assessment model, and sends the trained instruction risk assessment model to the fusion node, so that the fusion node constructs the instruction risk joint assessment model based on the trained instruction risk assessment model corresponding to each child node. That is, by training the model through the federated learning architecture, data privacy can be protected and original data leakage can be avoided; based on the instruction risk assessment model corresponding to the trained instruction risk assessment model of each child node, an instruction risk joint assessment model is constructed, and the evaluation results corresponding to each child node are comprehensively considered to improve the accuracy of the evaluation results. Then, the instruction data is risk assessed based on the instruction risk joint assessment model, which can improve the accuracy and efficiency of instruction auditing compared to the evaluation method of manual review after a single machine review. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 is a flow chart of a risk assessment method for instructions executed by each sub-node provided by an embodiment of the present application;

[0040] Figure 2 It is a flowchart of the steps of configuring a corresponding instruction risk assessment model at each sub-node based on instruction type risk and instruction parameter compliance risk provided by an embodiment of the present application;

[0041] Figure 3It is a flowchart of the steps of each sub-node training a local instruction risk assessment model based on a federated learning architecture composed of multiple sub-nodes and fusion nodes provided by an embodiment of the present application;

[0042] Figure 4 It is a schematic diagram of the federated learning architecture;

[0043] Figure 5 It is a flowchart of the first step performed after the local instruction data of the sub-node is sent to the fusion node according to an embodiment of the present application;

[0044] Figure 6 It is a flowchart of the second step performed after the local instruction data of the sub-node is sent to the fusion node according to an embodiment of the present application;

[0045] Figure 7 is a flow chart of a risk assessment method for instructions executed by a fusion node provided by an embodiment of the present application;

[0046] Figure 8 It is a flowchart of steps of assisting each sub-node to train a local instruction risk assessment model based on a federated learning architecture composed of multiple sub-nodes and fusion nodes provided by an embodiment of the present application;

[0047] Fig. 9 It is a flowchart of the steps of constructing an instruction risk joint assessment model based on the instruction risk assessment model trained corresponding to each sub-node provided in an embodiment of the present application;

[0048] Fig.10 It is a schematic diagram of the hardware structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0052] At present, after the instruction data is issued, it is mainly reviewed by a single machine and then manually reviewed to ensure the accuracy of the instruction. However, with the deepening of digital transformation of enterprises, various business systems will generate a large amount of instruction data that needs to be audited for compliance. The current instruction auditing method has problems such as data security risks and low computing efficiency.

[0053] Based on this, the embodiments of the present application propose a risk assessment method and electronic device for instructions, aiming to build an instruction risk joint assessment model based on a federated learning architecture, which is used to perform risk assessment on instruction data, thereby protecting data privacy, avoiding leakage of original data, and improving the accuracy and efficiency of instruction auditing.

[0054] Reference Figure 1 , Figure 1 It is a flowchart of a risk assessment method for instructions executed by each sub-node provided in an embodiment of the present application, including but not limited to steps S110 to S130.

[0055] Step S110, based on the instruction type risk and instruction parameter compliance risk, a corresponding instruction risk assessment model is configured in each sub-node, wherein each sub-node is configured with a single agent.

[0056] In the embodiment of the present application, each sub-node can be each communication operator, such as communication operator A, communication operator B, communication operator C and communication operator D. Each sub-node can be configured with a single agent, wherein the single agent is a computer system capable of independent action, which can perceive the environment, make decisions and take actions. They continuously learn and adapt through interaction with the environment to achieve specific goals. The embodiment of the present application configures a single agent in each sub-node so that the single agent can perform model training and risk assessment. At the same time, based on the instruction type risk and instruction parameter compliance risk, a corresponding instruction risk assessment model is configured in each sub-node. That is, considering the risk under the instruction type dimension and the risk under the instruction parameter dimension to construct an instruction risk assessment model, the risk assessment result can be more accurate. Specifically, the risks corresponding to different business instruction types are different. The instruction type risk is used to characterize whether the instruction data has risks in the instruction type dimension, and the instruction parameter compliance risk is used to characterize whether the instruction data has risks in the instruction parameter dimension. Then, the risks of the instruction data in the instruction type dimension and the risks in the instruction parameter dimension are comprehensively considered to construct an instruction risk assessment model, and the instruction risk assessment model is used to assess the risk level of the instruction data.

[0057] Reference Figure 2 , Figure 2 It is a flowchart of the steps of configuring a corresponding instruction risk assessment model in each sub-node based on instruction type risk and instruction parameter compliance risk provided by an embodiment of the present application, which is executed by each sub-node, including but not limited to steps S210 to S230.

[0058] Step S210, calculating the indicator value under the instruction type dimension, and converting the indicator value under the instruction type dimension into a first score using a Sigmoid function;

[0059] Step S220, calculating the indicator value under the instruction parameter dimension, and converting the indicator value under the instruction parameter dimension into a second score using a Sigmoid function;

[0060] Step S230, weighted aggregation of the first score and the second score according to the weights corresponding to the instruction type dimension and the instruction parameter dimension respectively, to construct an instruction risk assessment model, and configure the corresponding instruction risk assessment model in each sub-node.

[0061] In the embodiment of the present application, the Sigmoid function can be used to calculate the scores of the index values ​​of the instruction data in different dimensions to construct an instruction risk assessment model, so that the risk of the instruction data can be quantified. Specifically, the Sigmoid function is also called the S-type growth curve or the Logistic function. It maps a real number to the interval of (0,1). This feature makes the Sigmoid function perform well in binary classification problems. By calculating the specific index value of the instruction data under the instruction type dimension, the index value under the instruction type dimension can be converted into a first score using the Sigmoid function. Similarly, by calculating the specific index value of the instruction data under the instruction parameter dimension, the index value under the instruction parameter dimension can be converted into a second score using the Sigmoid function. After obtaining the scores under each dimension, it can be further weighted and summarized according to the weights of each dimension to obtain a total score. Among them, the weights under each dimension can be determined in advance based on methods such as expert scoring or data analysis. The total score after weighted summary can more comprehensively reflect the comprehensive performance of the instruction data in each dimension. Thus, the instruction risk assessment model constructed can be expressed by formula 1:

[0062] R i (I) = W r *C i (I)+W p *P i (I) (Formula 1);

[0063] In formula 1, R i(I) represents the total risk score of the i-th child node for instruction data I, C i (I) represents the risk score of the i-th child node for the instruction data I in the instruction type dimension, that is, the first score; P i (I) represents the risk score of the i-th child node for the instruction data I in the instruction parameter dimension, i.e., the second score; W r is the weight of the risk score of instruction data I under the instruction type dimension, W p is the weight of the risk score of instruction data I under the instruction parameter dimension.

[0064] In the embodiment of the present application, each child node obtains local instruction data (i.e., source data), and after data preprocessing, extracts features related to instruction types from the instruction data to obtain instruction type features. The extracted instruction type features are then converted into the form of instruction type feature vectors, and the instruction type feature vectors are normalized to eliminate the dimensional differences between the features so that they have a similar scale range. Then, through formula C i (I) = sigmoid(W c *F c (I)+b), the risk score of instruction data I under the instruction type dimension can be calculated. In the formula, C i (I) represents the risk score of the instruction data I in the instruction type dimension by the i-th child node, F c (I) represents the instruction type feature vector extracted from instruction data I, W c represents the weight coefficient of the instruction type dimension, and b represents a constant. Similarly, each child node also extracts features related to instruction parameters from the instruction data to obtain instruction parameter features. The extracted instruction parameter features are then converted into the form of instruction parameter feature vectors, and then the instruction parameter feature vectors are normalized to eliminate the dimensional differences between the features so that they have a similar scale range. Then, through the formula P i (I) = sigmoid(W p *F p (I)+c), the risk score of instruction data I under the instruction parameter dimension can be calculated. In the formula, P i (I) represents the risk score of the i-th child node for the instruction data I in the instruction parameter dimension, F p (I) represents the instruction parameter feature vector extracted from instruction data I, W p represents the weight coefficient of the instruction parameter dimension, and c represents a constant. Thus, the risk score of instruction data I under the instruction type dimension and the risk score under the instruction parameter dimension can be calculated respectively, and then the total risk score of instruction data I can be obtained by weighted aggregation according to the weights corresponding to the instruction type dimension and the instruction parameter dimension.

[0065] Step S120, based on the federated learning architecture composed of multiple child nodes and fusion nodes, each child node trains the local instruction risk assessment model, and sends the trained instruction risk assessment model to the fusion node, so that the fusion node builds an instruction risk joint assessment model based on the trained instruction risk assessment models corresponding to each child node.

[0066] In the embodiment of the present application, considering that the traditional machine learning model training requires the massive data to be concentrated on a central server for training, this will bring serious data privacy leakage risks. Therefore, the embodiment of the present application proposes a model training method based on a federated learning architecture. Federated learning is a distributed machine learning method that allows the model to be trained on multiple devices (or nodes) without transmitting the local data of each node to a central server. Each node retains its own data and only sends the model parameter updates to the central server, which can effectively protect data privacy.

[0067] Specifically, in the embodiment of the present application, each sub-node trains the local instruction risk assessment model based on a federated learning architecture composed of multiple sub-nodes and a fusion node to obtain a trained instruction risk assessment model. The trained instruction risk assessment model is then sent to the fusion node (such as a central server), so that the fusion node can construct an instruction risk joint assessment model based on the instruction risk assessment model corresponding to each sub-node. Among them, the constructed instruction risk joint assessment model can be expressed by Formula 2:

[0068] E k (I) = α*R k (I)+β*R k-1 (I)(Formula 2);

[0069] In formula 2, E k (I) represents the current comprehensive risk score of instruction data I, R k (I) represents the current collaborative risk score of each child node for instruction data I, that is, the current multi-agent collaborative risk score of instruction data I, R k-1 (I) represents the last collaborative risk score of each child node for instruction data I, that is, the last multi-agent collaborative risk score of instruction data I, α represents the weight of the current multi-agent collaborative risk score, and β represents the weight of the last multi-agent collaborative risk score.

[0070] In an embodiment of the present application, the current multi-agent collaborative risk score and the previous multi-agent collaborative risk score are comprehensively considered to obtain the final score, so that the risk assessment of the instruction risk joint assessment model is a dynamically adjusted process, which can improve the accuracy of the assessment of the instruction risk joint assessment model.

[0071] Reference Figure 3 , Figure 3 It is a federated learning architecture based on multiple sub-nodes and fusion nodes provided by an embodiment of the present application. The flowchart of the steps for each sub-node to train the local instruction risk assessment model is executed by each sub-node, including but not limited to steps S310 to S320.

[0072] Step S310, each child node inputs local instruction data into the instruction risk assessment model for training to obtain a parameter vector of the instruction risk assessment model;

[0073] Step S320, encrypt the parameter vector and send the encrypted parameter vector to the fusion node, so that the fusion node optimizes the parameter vector of each child node based on the clustering algorithm, and sends the optimized parameter vector to each child node until the fusion calculation result of the parameter vector sent by each child node meets the convergence condition, thereby terminating the training of the instruction risk assessment model.

[0074] In the present application, refer to Figure 4 , Figure 4 This is a schematic diagram of the federated learning architecture. Figure 4 As shown, each sub-node includes local instruction data, which can be used for the training of the instruction risk assessment model. The local instruction data can be used as a data source from the corresponding sub-node (such as communication operator A) based on the business instruction data corresponding to the various businesses handled. Among them, when handling different businesses, there is at least one corresponding business instruction issued, and usually one business requires multiple business instructions to be issued in a coordinated manner. Each sub-node is a data owner, and the data source (ie, instruction data) is saved by the data owner, that is, the instruction data is saved by the sub-node itself. Other participants in the model training are technically unable to know the specific data in other data sources.

[0075] Federated Learning is a distributed machine learning technology. Its core idea is to conduct distributed model training among multiple data sources with local data. There is no need to exchange local data. Only by exchanging model parameters or intermediate results, a global model based on virtual fused data is constructed, thereby achieving a balance between data privacy protection and data sharing computing. Therefore, encrypted transmission, K-means++ algorithm, and local instruction risk assessment model are all deployed locally on the child node. The global K-means++ model can be deployed on the fusion node outside each child node, so that the fusion node can perform clustering optimization on the parameter vectors encrypted and uploaded by each child node through the K-means++ algorithm. The encrypted parameter transmission part encrypts the parameter vector and transmits it to the fusion node for parameter fusion. The fusion node then sends the fused parameters to each child node and updates the K-means++ parameters. The training process is as follows: Figure 3 As shown, each child node inputs the local instruction data into the instruction risk assessment model for training to obtain the parameter vector of the instruction risk assessment model. The parameter vector is then encrypted and sent to the fusion node. Among them, the child node can set preset conditions such as the number of training times. When the preset conditions are met, the parameter vector of the instruction risk assessment model is sent to the fusion node. The fusion node optimizes the parameter vectors of each child node based on the clustering algorithm until the fusion calculation results of the parameter vectors sent by each child node meet the convergence conditions, and then the training of the instruction risk assessment model is terminated.

[0076] The training of the model under the federated learning architecture requires the participation of multiple institutions (sub-nodes). After the training is completed, the trained model will be saved by each institution (sub-node). The embodiment of the present application can pre-train the instruction risk assessment model based on the federated learning architecture through a clustering algorithm. Based on the federated learning architecture, the instruction risk assessment model can be trained by combining the data in multiple sub-nodes while protecting the data privacy of multiple sub-nodes. The output of the instruction risk assessment model can be focused on the preset risk type through the clustering algorithm, thereby improving the accuracy of the instruction risk assessment model.

[0077] Step S130, sending the local instruction data of the child node to the fusion node, so that the fusion node calls the instruction risk joint assessment model to perform risk assessment on the local instruction data of the child node to output the risk level of the instruction data.

[0078] In an embodiment of the present application, after the instruction risk joint assessment model is constructed and deployed on the fusion node, the child node can send the local instruction data to the fusion node, so that the fusion node calls the instruction risk joint assessment model to perform risk assessment on the instruction data of the child node, and outputs the risk level of the instruction data. The risk level may include four levels: high risk, medium risk, low risk and no risk. By evaluating the risk level of the instruction data, the instruction execution module on the child node can be guided to perform corresponding execution processing based on the risk level. If the instruction risk joint assessment model outputs that the risk level of instruction A is high risk, the instruction execution module does not execute the instruction A, or a high-risk pop-up window prompt is performed, and manual verification is performed to further verify whether to execute the high-risk instruction. If the instruction risk joint assessment model outputs that the risk level of instruction A is low risk, the instruction execution module automatically executes the instruction A.

[0079] Reference Figure 5 , Figure 5 It is a flowchart of the first step performed after the local instruction data of the sub-node is sent to the fusion node, provided by an embodiment of the present application, and is executed by each sub-node, including but not limited to steps S510 to S530.

[0080] Step S510, receiving the risk level of instruction data output by the instruction risk joint assessment model;

[0081] Step S520, the instruction execution module of the child node executes the instruction data based on the risk level of the instruction data and the preset execution program;

[0082] In step S530, the evaluation module of the child node evaluates the execution result and returns the evaluation result to the instruction execution module to optimize the preset execution program.

[0083] In the embodiment of the present application, after the fusion node calls the instruction risk joint assessment model to perform risk assessment on the instruction data of the sub-node and outputs the risk level of the instruction data, the fusion node can send the risk level of the instruction data to the corresponding sub-node. The sub-node deployment consists of an instruction execution module and an assessment module. The instruction execution module can execute based on the risk level of the instruction data and the preset execution program. For example, the preset execution program is not to execute the instruction when the risk level is high risk, and to execute the instruction when the risk level is not high risk. At this time, if the risk level of the instruction data received by the instruction risk joint assessment model is high risk, the instruction execution module does not execute the corresponding instruction. If the risk level of the instruction data received by the instruction risk joint assessment model is not high risk (such as medium risk), the instruction execution module executes the corresponding instruction. If the preset execution program is not to execute the instruction when the risk level is high risk and medium risk, and to execute the instruction when the risk level is low risk and no risk. At this time, if the risk level of the instruction data received by the instruction risk joint assessment model is high risk or medium risk, the instruction execution module does not execute the corresponding instruction. If the risk level of the instruction data received by the instruction risk joint assessment model is low risk or no risk, the instruction execution module executes the corresponding instruction. After the instruction execution module executes the corresponding instruction (including execution or non-execution), the evaluation module can evaluate the execution result of the instruction execution module, and then return the evaluation result to the instruction execution module to optimize the preset execution program. For example, the preset execution program is not to execute instructions when the risk level is high risk, and to execute instructions when the risk level is not high risk. At this time, if the risk level of the instruction data received by the instruction execution module output by the instruction risk joint assessment model is high risk, the instruction execution module does not execute the corresponding instruction. If the risk level of the instruction data received by the instruction execution module output by the instruction risk joint assessment model is not high risk (such as medium risk), the instruction execution module executes the corresponding instruction. The evaluation module evaluates the execution result of the instruction execution module. When it is found that the risk level of the instruction data is medium risk, the instruction should not be executed. In this case, the preset execution program needs to be optimized, that is, the preset execution program is updated to not execute the instruction when the risk level is high risk and medium risk, and to execute the instruction when the risk level is low risk and no risk.

[0084] Reference Figure 6 , Figure 6 It is a flowchart of the second step performed after the local instruction data of the sub-node is sent to the fusion node, provided by an embodiment of the present application, and is executed by each sub-node, including but not limited to steps S610 to S630.

[0085] Step S610, calling the trained instruction risk assessment model to perform risk assessment on the instruction data of the local child node to output a first risk level of the instruction data;

[0086] Step S620, receiving the second risk level of the instruction data output by the instruction risk joint assessment model;

[0087] Step S630: determining a final risk level corresponding to the instruction data according to the first risk level and the second risk level.

[0088] In an embodiment of the present application, after the fusion node calls the instruction risk joint assessment model to perform risk assessment on the instruction data of the sub-node and outputs the risk level of the instruction data, the fusion node can send the second risk level of the instruction data to the corresponding sub-node. At the same time, the sub-node can also call the trained instruction risk assessment model to perform risk assessment on the instruction data of the sub-node to output the first risk level of the instruction data, so that the final risk level corresponding to the instruction data can be further determined according to the first risk level and the second risk level. If the levels corresponding to the first risk level and the second risk level are the same, the final risk level can be determined to be the first risk level or the second risk level. If the levels corresponding to the first risk level and the second risk level are different, the final risk level can be further determined according to the business type.

[0089] In some embodiments, the evaluation methods corresponding to instruction data of different business types may be different. For example, for instruction data corresponding to simple business types, a risk assessment of the instruction data based on the instruction risk assessment model trained locally by the child node can obtain a more accurate evaluation result. For instruction data corresponding to complex business types, it is necessary to conduct a risk assessment of the instruction data based on the instruction risk joint assessment model deployed by the fusion node to obtain a more accurate evaluation result. Therefore, after the child node obtains the first risk level output by the locally trained instruction risk assessment model and the second risk level output by the instruction risk joint assessment model, it can select one from the first risk level and the second risk level as the final risk level corresponding to the instruction data based on the business type corresponding to the instruction data. If the business type corresponding to the instruction data is relatively simple, the first risk level is selected as the final risk level corresponding to the instruction data. If the business type corresponding to the instruction data is relatively complex, the second risk level is selected as the final risk level corresponding to the instruction data.

[0090] Reference Figure 7 , Figure 7 It is a flowchart of a risk assessment method for instructions executed by a fusion node provided by an embodiment of the present application, including but not limited to steps S710 to S730.

[0091] Step S710, based on the federated learning architecture composed of multiple sub-nodes and fusion nodes, assist each sub-node to train the local instruction risk assessment model.

[0092] In an embodiment of the present application, based on a federated learning architecture consisting of multiple sub-nodes and a fusion node, the fusion node assists each sub-node in training a local instruction risk assessment model.

[0093] Specifically, Federated Learning is a distributed machine learning technology. Its core idea is to perform distributed model training among multiple data sources with local data. There is no need to exchange local data. It only exchanges model parameters or intermediate results to build a global model based on virtual fused data, thereby achieving a balance between data privacy protection and data sharing computing.

[0094] Reference Figure 8 , Figure 8 It is a flowchart of the steps of a federated learning architecture composed of multiple sub-nodes and fusion nodes provided in an embodiment of the present application, which assists each sub-node in training a local instruction risk assessment model, and is executed by the fusion node, including but not limited to steps S810 to S840.

[0095] Step S810, receiving the parameter vector of the instruction risk assessment model sent by each child node;

[0096] Step S820, optimizing the parameter vector of each child node based on the clustering algorithm, and sending the optimized parameter vector to each child node;

[0097] Step S830, detecting whether the fusion calculation results of the parameter vectors of each child node meet the convergence conditions;

[0098] Step S840: If the fusion calculation results of the parameter vectors of each child node meet the convergence condition, an instruction to end training is sent to each child node; if the fusion calculation results of the parameter vectors of each child node do not meet the convergence condition, return to step S810.

[0099] In the embodiment of the present application, each child node inputs the local instruction data into the instruction risk assessment model for training, obtains the parameter vector of the instruction risk assessment model, and encrypts the parameter vector and sends it to the fusion node. The fusion node receives the parameter vector sent by each child node, optimizes the parameter vector of each child node based on the clustering algorithm, and sends the optimized parameter vector to each child node. After each child node receives the returned optimized parameter vector, it continues to train the instruction risk assessment model to update the parameter vector of the model and then sends it to the fusion node. The fusion node optimizes the parameter vector of each child node again based on the clustering algorithm, and detects whether the fusion calculation results of the parameter vectors of each child node meet the convergence conditions. If the fusion calculation results of the parameter vectors of each child node meet the convergence conditions, an instruction to end training is sent to each child node to end the training. If the fusion calculation results of the parameter vectors of each child node do not meet the convergence conditions, return to step S810 and continue training.

[0100] The embodiment of the present application assists each child node in training a local instruction risk assessment model based on a federated learning architecture, which can protect data privacy and security and improve the accuracy of each child node's local instruction risk assessment model.

[0101] Step S720, receiving the trained instruction risk assessment model corresponding to each sub-node, and constructing an instruction risk joint assessment model based on the trained instruction risk assessment model corresponding to each sub-node.

[0102] In an embodiment of the present application, after receiving the trained instruction risk assessment models corresponding to each child node, the fusion node can construct an instruction risk joint assessment model based on the trained instruction risk assessment models corresponding to each child node. By comprehensively considering the assessment results corresponding to each child node, the accuracy of the assessment results of the instruction risk joint assessment model can be improved.

[0103] Reference Fig. 9 , Fig. 9It is a flowchart of the steps of constructing an instruction risk joint assessment model based on the instruction risk assessment model trained corresponding to each sub-node provided in an embodiment of the present application, which is executed by the fusion node, including but not limited to steps S910 to S920.

[0104] Step S910, performing weighted average calculation on the scores corresponding to the trained instruction risk assessment models of each sub-node to obtain a multi-agent collaborative risk score;

[0105] Step S920, performing a weighted sum calculation on the current multi-agent collaborative risk score and the previous multi-agent collaborative risk score to construct an instruction risk joint assessment model.

[0106] In the embodiment of the present application, the multi-agent collaborative risk score can be obtained by weighted averaging the scores corresponding to the trained instruction risk assessment models of each sub-node. Specifically, the multi-agent collaborative risk score can be obtained by formula The multi-agent collaborative risk score is calculated, where R(I) represents the multi-agent collaborative risk score of instruction data I, and R i (I) represents the total risk score of the ith child node for instruction data I, where R i (I) = W r *C i (I)+W p *P i (I). N represents the total number of child nodes, W i Represents the weight of the i-th child node in the total risk score of instruction data I.

[0107] Next, the current multi-agent collaborative risk score and the previous multi-agent collaborative risk score are weighted and calculated to construct a joint instruction risk assessment model, where the constructed joint instruction risk assessment model can be expressed by Formula 2:

[0108] E k (I) = α*R k (I)+β*R k-1 (I)(Formula 2);

[0109] In formula 2, E k (I) represents the current comprehensive risk score of instruction data I, R k (I) represents the current collaborative risk score of each child node for instruction data I, that is, the current multi-agent collaborative risk score of instruction data I, R k-1(I) represents the last collaborative risk score of each child node for instruction data I, that is, the last multi-agent collaborative risk score of instruction data I, α represents the weight of the current multi-agent collaborative risk score, and β represents the weight of the last multi-agent collaborative risk score.

[0110] In the embodiment of the present application, the evaluation results of each sub-node and the evaluation results of each sub-node last time are comprehensively considered to construct an instruction risk joint evaluation model, so that the risk evaluation is a dynamically adjusted process, which can improve the accuracy of the model evaluation.

[0111] Step S730, receiving the local instruction data of the child node, and calling the instruction risk joint assessment model to perform risk assessment on the local instruction data of the child node to output the risk level of the instruction data.

[0112] In the embodiment of the present application, after the fusion node deploys the instruction risk joint assessment model, the fusion node can receive the instruction data of the local child node, and call the instruction risk joint assessment model to perform risk assessment on the instruction data of the local child node to output the risk level of the instruction data. Then, the risk level of the instruction data is sent to the corresponding child node, so that the corresponding child node can execute the instruction based on the risk level of the instruction data.

[0113] In the embodiment of the present application, the fusion node assists each child node in training the local instruction risk assessment model based on the federated learning architecture, which can protect data privacy and security and avoid data leakage. The fusion node constructs an instruction risk joint assessment model based on the instruction risk assessment model trained by each child node, which can improve the accuracy of instruction auditing; then, the instruction data is risk assessed based on the constructed instruction risk joint assessment model, which can improve the accuracy and efficiency of instruction auditing compared to the assessment method of reviewing by a single machine and then manually reviewing.

[0114] See also Fig.10 , Fig.10 : is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application, the electronic device includes:

[0115] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0116] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other applications. When the technical solution provided in the embodiments of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls the risk assessment method for executing the instructions of the embodiments of this application;

[0117] Input / output interface 1003, used to implement information input and output;

[0118] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0119] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0120] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0121] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0122] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0123] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0124] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0125] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0126] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0127] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0128] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0129] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0130] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0131] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and substance of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for risk assessment of instructions, characterized in that: The method comprises: Based on the instruction type risk and instruction parameter compliance risk, a corresponding instruction risk assessment model is configured in each sub-node, where each sub-node is configured with a single agent; Based on a federated learning architecture consisting of multiple sub-nodes and fusion nodes, each sub-node trains the local instruction risk assessment model and sends the trained instruction risk assessment model to the fusion node, so that the fusion node constructs an instruction risk joint assessment model based on the instruction risk assessment models trained corresponding to each sub-node; The local instruction data of the child node is sent to the fusion node, so that the fusion node calls the instruction risk joint assessment model to perform risk assessment on the local instruction data of the child node to output the risk level of the instruction data.

2. The method according to claim 1, characterized in that After sending the local instruction data of the child node to the fusion node, the method further includes: receiving the risk level of the instruction data output by the instruction risk joint assessment model; The instruction execution module of the subnode executes the instruction data based on the risk level of the instruction data and a preset execution program; The evaluation module of the child node evaluates the execution result and returns the evaluation result to the instruction execution module to optimize the preset execution program.

3. The method according to claim 1, characterized in that Based on the instruction type risk and instruction parameter compliance risk, configuring the corresponding instruction risk assessment model in each sub-node includes: Calculate the indicator value under the instruction type dimension, and use the Sigmoid function to convert the indicator value under the instruction type dimension into a first score; Calculate the indicator value under the instruction parameter dimension, and use the Sigmoid function to convert the indicator value under the instruction parameter dimension into a second score; The first score and the second score are weighted and summarized according to the weights corresponding to the instruction type dimension and the instruction parameter dimension respectively to construct an instruction risk assessment model, and the corresponding instruction risk assessment model is configured in each sub-node.

4. The method according to claim 1, characterized in that: The federated learning architecture composed of multiple sub-nodes and fusion nodes, in which each sub-node trains the local instruction risk assessment model, includes: Each child node inputs local instruction data into the instruction risk assessment model for training to obtain a parameter vector of the instruction risk assessment model; The parameter vector is encrypted and sent to the fusion node, so that the fusion node optimizes the parameter vector of each child node based on the clustering algorithm, and sends the optimized parameter vector to each child node until the fusion calculation result of the parameter vector sent by each child node meets the convergence condition, thereby terminating the training of the instruction risk assessment model.

5. The method according to claim 1, characterized in that After sending the local instruction data of the child node to the fusion node, the method further includes: Calling the trained instruction risk assessment model to perform risk assessment on the instruction data of the local child node to output a first risk level of the instruction data; receiving a second risk level of the instruction data output by the instruction risk joint assessment model; A final risk level corresponding to the instruction data is determined according to the first risk level and the second risk level.

6. The method according to claim 5, characterized in that The determining, according to the first risk level and the second risk level, a final risk level corresponding to the instruction data includes: According to the business type corresponding to the instruction data, one of the first risk level and the second risk level is selected as the final risk level corresponding to the instruction data.

7. A method for evaluating instruction risk, characterized in that: The method comprises: Based on the federated learning architecture consisting of multiple sub-nodes and fusion nodes, assist each sub-node to train the local instruction risk assessment model; Receiving the trained instruction risk assessment models corresponding to each sub-node, and constructing an instruction risk joint assessment model based on the trained instruction risk assessment models corresponding to each sub-node; The local instruction data of the child node is received, and the instruction risk joint assessment model is called to perform risk assessment on the local instruction data of the child node to output the risk level of the instruction data.

8. The method according to claim 7, characterized in that Based on the federated learning architecture consisting of multiple sub-nodes and fusion nodes, each sub-node is assisted in training the local instruction risk assessment model, including: Receive the parameter vector of the instruction risk assessment model sent by each child node; Optimize the parameter vector of each child node based on the clustering algorithm, and send the optimized parameter vector to each child node; Return to the step of receiving the parameter vectors of the instruction risk assessment model sent by each child node, until the fusion calculation results of the parameter vectors of each child node meet the convergence conditions, and send an instruction to end the training to each child node.

9. The method according to claim 7, characterized in that: Based on the trained instruction risk assessment models corresponding to each sub-node, an instruction risk joint assessment model is constructed, including: The scores of the trained instruction risk assessment models for each sub-node are weighted averaged to obtain the multi-agent collaborative risk score. The current multi-agent collaborative risk score and the previous multi-agent collaborative risk score are weighted and summed to construct a joint instruction risk assessment model.

10. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 or the method according to any one of claims 7 to 9 when executing the computer program.

Images