Enterprise abnormal behavior monitoring method and device and computer equipment

Abstract

The invention relates to the technical field of artificial intelligence, and discloses an enterprise abnormal behavior monitoring method and device and computer equipment, and the method comprises the steps: firstly obtaining deployment and control early warning problem data of a target enterprise, carrying out the demand analysis and task disassembly, and obtaining a plurality of to-be-processed sub-tasks; performing pattern recognition to obtain a behavior pattern analysis result under any to-be-processed sub-task; performing behavior pattern fusion analysis on the plurality of behavior pattern analysis results and the deployment and control early warning problem data to obtain image-text decision guidance data; and finally, mapping the time sequence features of the historical risk behavior data of the target enterprise and the visual semantic features of the image-text decision guidance data to the same representation space, and carrying out time-space semantic joint anomaly monitoring to obtain an abnormal behavior category of the target enterprise. And a more accurate abnormal behavior category is obtained based on historical risk behavior data and image-text decision guidance data.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method, device and computer equipment for monitoring abnormal behavior of an enterprise. Background Art

[0002] By monitoring abnormal corporate behavior, potential risks can be identified in a timely manner, helping relevant regulatory authorities make prompt decisions and take effective measures to avoid major economic losses and social impacts. However, in related technologies, the accuracy of abnormal corporate behavior monitoring still needs to be improved.

[0003] Therefore, it is urgent to propose a new method for monitoring abnormal behavior of enterprises. Summary of the invention

[0004] The present application provides a method, device and computer equipment for monitoring abnormal behavior of an enterprise, which solves the technical problem in the related art that the accuracy of monitoring abnormal behavior of an enterprise needs to be improved, and achieves the technical effect of more accurately monitoring abnormal behavior of an enterprise.

[0005] In order to achieve the above objectives, the main technical solutions adopted in this application include: In a first aspect, an embodiment of the present application provides a method for monitoring abnormal behavior of an enterprise, which is applied to an enterprise monitoring platform; the method comprises: Acquire the control and early warning problem data for the target enterprise, perform demand analysis and task decomposition on the control and early warning problem data, and obtain multiple subtasks to be processed; Based on any pending subtask, pattern recognition is performed to obtain a behavior pattern analysis result of the target enterprise under any pending subtask; wherein the target enterprise has multiple behavior pattern analysis results; the behavior pattern analysis results include a public opinion tendency evaluation result, which is obtained by analyzing the public opinion-related information of the target enterprise and constructing a multidimensional evaluation matrix including the propagation heat and the time attenuation factor; Conducting a behavioral pattern fusion analysis on multiple behavioral pattern analysis results of the target enterprise and the control and early warning problem data to obtain graphic and text decision-making guidance data corresponding to the control and early warning problem data; In response to a confirmation operation on the graphic decision guidance data, the time series features of the target enterprise's historical risk behavior data and the visual semantic features of the graphic decision guidance data are mapped to the same representation space, so as to perform spatiotemporal semantic joint anomaly monitoring by adopting cross-modal contrastive learning to obtain the abnormal behavior category of the target enterprise; wherein the abnormal behavior category is used to describe the type of abnormal behavior of the target enterprise identified during the monitoring process.

[0006] Optionally, the obtaining of the control and early warning problem data for the target enterprise includes any one of the following methods: In response to the text input operation, determining the control and early warning problem data; Acquire voice description data for the target enterprise, parse the voice description data, and obtain the control and early warning problem data.

[0007] Optionally, an enterprise anomaly monitoring model is deployed on the enterprise monitoring platform, and the enterprise anomaly monitoring model includes a problem analysis agent; the demand analysis and task decomposition of the control and early warning problem data are performed to obtain a plurality of subtasks to be processed, including: The problem analysis agent performs intention decomposition and step disassembly on the control and warning problem data to obtain the multiple subtasks to be processed.

[0008] Optionally, an enterprise anomaly monitoring model is deployed on the enterprise monitoring platform, and the enterprise anomaly monitoring model includes a plurality of candidate agents. Before performing pattern recognition based on any subtask to be processed, the method further includes: Selecting a target agent that matches any subtask to be processed from the plurality of candidate agents, and correspondingly assigning the any subtask to be processed to the target agent; Accordingly, the pattern recognition is performed based on any subtask to be processed to obtain the behavior pattern analysis result of the target enterprise under any subtask to be processed, including: The enterprise-related data corresponding to any of the to-be-processed subtasks is obtained through the target intelligent agent, and feature extraction and similarity calculation are performed on the enterprise-related data to obtain the behavior pattern analysis result.

[0009] Optionally, the target agent includes a public opinion analysis agent and a recruitment analysis agent, and the multiple subtasks to be processed include a public opinion analysis task and a recruitment analysis task; the step of obtaining enterprise-related data corresponding to any of the subtasks to be processed through the target agent, and performing feature extraction and similarity calculation on the enterprise-related data to obtain the behavior pattern analysis result includes: Obtaining public opinion related information of the target enterprise through the public opinion analysis agent, performing feature extraction and similarity calculation on the public opinion related information, and obtaining a public opinion tendency evaluation result of the target enterprise; The recruitment analysis agent obtains the recruitment-related information of the target enterprise, performs feature extraction and similarity calculation on the recruitment-related information, and obtains the recruitment behavior evaluation result of the target enterprise; wherein the behavior pattern analysis result includes the public opinion tendency evaluation result and the recruitment behavior evaluation result.

[0010] Optionally, the recruitment analysis agent includes a recruitment posting analysis agent and a visitor record analysis agent. The step of obtaining the recruitment-related information of the target enterprise through the recruitment analysis agent, performing feature extraction and similarity calculation on the recruitment-related information, and obtaining the recruitment behavior evaluation result of the target enterprise includes: Obtaining the target enterprise's recruitment release information through the recruitment release analysis agent, performing text mining and cluster analysis on the recruitment release information, and obtaining a recruitment release evaluation result; The personnel flow image data of the target enterprise is obtained through the visitor record analysis agent, and visitor object recognition and activity trajectory recognition are performed on the personnel flow image data to obtain interview-related evaluation results of the target enterprise; wherein the recruitment behavior evaluation results include the recruitment posting evaluation results and the interview-related evaluation results.

[0011] Optionally, an enterprise anomaly monitoring model is deployed on the enterprise monitoring platform, and the enterprise anomaly monitoring model includes a risk fusion agent, and the behavior pattern fusion analysis is performed on multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data to obtain graphic and text decision guidance data corresponding to the control and early warning problem data, including: The risk fusion intelligent agent performs risk fusion assessment and visualization processing on multiple behavior pattern analysis results of the target enterprise and the control and warning problem data to obtain the graphic decision-making guidance data.

[0012] In a second aspect, an embodiment of the present application provides an enterprise abnormal behavior monitoring device, which is applied to an enterprise monitoring platform, including: A data acquisition module is used to acquire the control and early warning problem data for the target enterprise, perform demand analysis and task decomposition on the control and early warning problem data, and obtain multiple subtasks to be processed; A pattern recognition module is used to perform pattern recognition based on any pending subtask to obtain a behavior pattern analysis result of the target enterprise under any pending subtask; wherein the target enterprise has multiple behavior pattern analysis results; the behavior pattern analysis results include a public opinion tendency evaluation result, which is obtained by analyzing the public opinion-related information of the target enterprise and constructing a multidimensional evaluation matrix including a propagation heat and a time decay factor; A fusion analysis module is used to perform a fusion analysis of the behavior pattern of the target enterprise and the control and early warning problem data to obtain graphic and text decision-making guidance data corresponding to the control and early warning problem data; An anomaly monitoring module is used to respond to the confirmation operation of the graphic decision-making guidance data, map the time series characteristics of the historical risk behavior data of the target enterprise and the visual semantic characteristics of the graphic decision-making guidance data to the same representation space, and use cross-modal contrastive learning to perform spatiotemporal semantic joint anomaly monitoring to obtain the abnormal behavior category of the target enterprise; wherein the abnormal behavior category is used to describe the abnormal behavior type of the target enterprise identified during the monitoring process In a third aspect, an embodiment of the present application provides a computer device, including: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method described in any of the above embodiments by executing the computer instructions.

[0013] In the embodiment of the present application, first, the control and early warning problem data for the target enterprise is obtained, and the demand analysis and task decomposition of the control and early warning problem data are performed to obtain multiple subtasks to be processed; then, pattern recognition is performed based on any subtask to be processed to obtain the behavior pattern analysis result of the target enterprise under any subtask to be processed; then, the behavior pattern fusion analysis is performed on the multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data to obtain the graphic decision guidance data corresponding to the control and early warning problem data; finally, in response to the confirmation operation of the graphic decision guidance data, the time series characteristics of the historical risk behavior data of the target enterprise and the visual semantic characteristics of the graphic decision guidance data are mapped to the same representation space, and the abnormal monitoring of spatiotemporal semantics is performed by cross-modal comparative learning to obtain the abnormal behavior category of the target enterprise. By fusing and analyzing the behavior patterns of multiple behavior pattern analysis results and the control and early warning problem data, more accurate graphic decision guidance data can be obtained, and further based on the time series characteristics of the historical risk behavior data and the visual semantic characteristics of the graphic decision guidance data, the spatiotemporal semantics joint abnormal monitoring is performed by cross-modal comparative learning to obtain a more accurate abnormal behavior category of the target enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0015] Figure 1a A flowchart of a method for monitoring abnormal behavior of an enterprise provided in an embodiment of this specification; Figure 1bA flowchart of a method for monitoring abnormal behavior of an enterprise provided in an embodiment of this specification; Figure 2 A flowchart of a method for monitoring abnormal behavior of an enterprise provided in an embodiment of this specification; Figure 3 A flowchart of a method for monitoring abnormal behavior of an enterprise provided in an embodiment of this specification; Figure 4a A schematic diagram of target enterprise risk probability provided in the embodiments of this specification; Figure 4b A schematic diagram of the frequency of recruitment for risky positions in target enterprises provided in the embodiments of this specification; Figure 4c A schematic diagram of target enterprise risk position interview analysis provided in the embodiments of this specification; Figure 4d A schematic diagram of negative public opinion analysis of a target enterprise provided in the embodiments of this specification; Figure 5 An architectural diagram of an enterprise anomaly monitoring model provided in an embodiment of this specification; Figure 6 A flowchart of a method for monitoring abnormal behavior of an enterprise provided in an embodiment of this specification; Figure 7 A schematic diagram of a device for monitoring abnormal behavior of an enterprise provided in an embodiment of this specification; Figure 8 A schematic diagram of a computer structure provided in an embodiment of this specification. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0017] By monitoring the behavior of enterprises, potential abnormal problems can be identified in a timely manner. This process not only helps relevant regulatory authorities to accurately identify possible illegal behaviors of enterprises, but also provides data support and decision-making basis for relevant regulatory authorities to formulate response strategies, thereby avoiding major economic losses and adverse social impacts. However, there is still much room for improvement in the accuracy of relevant technologies in monitoring abnormal behavior of enterprises.

[0018] Based on this, the present application provides a method for monitoring abnormal behavior of an enterprise. First, the control and early warning problem data for the target enterprise is obtained, and the demand analysis and task decomposition of the control and early warning problem data are performed to obtain multiple subtasks to be processed; then, pattern recognition is performed based on any subtask to be processed to obtain the behavior pattern analysis result of the target enterprise under any subtask to be processed; then, the behavior pattern fusion analysis is performed on the multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data to obtain the graphic decision guidance data corresponding to the control and early warning problem data; finally, in response to the confirmation operation of the graphic decision guidance data, the historical risk behavior data of the target enterprise and the graphic decision guidance data are used for joint abnormal monitoring to obtain the abnormal behavior category of the target enterprise. Based on the demand analysis of the control and early warning problem data, the control and early warning problem data can be more accurately understood and task decomposed. Based on pattern recognition of multiple subtasks, the behavior pattern analysis results of the target enterprise under specific subtasks can be revealed more accurately and quickly. Based on the behavior pattern fusion analysis of the multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data, the data from different sources can be deeply integrated and analyzed, so as to obtain more accurate and comprehensive graphic decision guidance data. By conducting joint anomaly monitoring based on historical risk behavior data and graphic decision-making guidance data, we can obtain more accurate abnormal behavior categories of target enterprises.

[0019] It should be noted that the enterprise abnormal behavior monitoring method can be applied to the enterprise monitoring platform; the enterprise abnormal monitoring model is deployed on the enterprise monitoring platform, and the enterprise abnormal monitoring model includes a problem analysis agent, a public opinion analysis agent, a recruitment analysis agent and a risk fusion agent. Obtain the control and warning problem data for the target enterprise; use the problem analysis agent to perform demand analysis and task decomposition on the control and warning problem data to obtain multiple subtasks to be processed; wherein the multiple subtasks to be processed include public opinion analysis tasks and recruitment analysis tasks; use the public opinion analysis agent to analyze the public opinion related information of the target enterprise, construct a multidimensional evaluation matrix containing the transmission heat and time attenuation factor, and obtain the public opinion tendency evaluation result of the target enterprise; use the recruitment analysis agent to evaluate the recruitment related information of the target enterprise, and obtain the recruitment behavior evaluation result of the target enterprise; use the risk fusion agent to perform risk fusion evaluation and visualization processing on the public opinion tendency evaluation result, the recruitment behavior evaluation result and the control and warning problem data to obtain the graphic decision guidance data; in response to the confirmation operation of the graphic decision guidance data, use the historical risk behavior data of the target enterprise and the graphic decision guidance data to perform joint abnormal monitoring to obtain the abnormal behavior category of the target enterprise.

[0020] According to an embodiment of the present application, an embodiment of a method for monitoring abnormal behavior of an enterprise is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0021] See also Figure 1a In this embodiment, a method for monitoring abnormal behavior of an enterprise is provided, which is applied to an enterprise monitoring platform. The method includes: S101. Obtaining control and early warning problem data for a target enterprise, performing demand analysis and task decomposition on the control and early warning problem data, and obtaining a plurality of subtasks to be processed.

[0022] Among them, the target enterprise can be an enterprise that the relevant regulatory authorities need to monitor for abnormal behavior. The monitoring warning problem data can be the problems related to the business behavior of the target enterprise that the supervisor inputs on the enterprise monitoring platform. Demand analysis can be an in-depth understanding of the monitoring warning problem data through the intelligent agent to identify its semantics. Task decomposition can be based on the semantics obtained from the demand analysis, and further decomposed into several specific subtasks to be processed through the intelligent agent. The subtasks to be processed are tasks for identifying specific business behaviors of the target enterprise.

[0023] In some implementations, supervisors can submit control warning problem data on the enterprise monitoring platform, and then use the agent to understand the semantics of the control warning problem data, and finally decompose the semantics into multiple subtasks to be processed. For example, before entering the control warning problem data, the user has also entered several historical control warning problem data, then the agent can understand the semantics of the control warning problem data and decompose the tasks based on the historical control warning problem data.

[0024] S103: Perform pattern recognition based on any subtask to be processed to obtain a behavior pattern analysis result of the target enterprise under any subtask to be processed.

[0025] Among them, the target enterprise has multiple behavior pattern analysis results. The behavior pattern analysis results include the public opinion tendency evaluation results, which are obtained by analyzing the public opinion-related information of the target enterprise and constructing a multidimensional evaluation matrix including the communication heat and time decay factor. The communication heat can be measured by the comprehensive data of the reading volume, forwarding volume, number of likes, number of comments, etc. of the public opinion. The time decay factor can be obtained by fitting the time decay factor model with the historical data of the communication heat.

[0026] In some embodiments, the enterprise monitoring platform can obtain enterprise-related data of the target enterprise, such as monitoring data, visitor records, online public opinion, online recruitment information, etc. Each pending subtask has a corresponding subtask processing agent, and the subtask processing agent performs pattern recognition through enterprise-related data to obtain the behavior pattern analysis results of the target enterprise under any pending subtask, which can be the behavior characteristics of the target enterprise, or abnormal performance, or both. For example, the behavior pattern analysis results of the target enterprise obtained based on online recruitment information may be a large number of financial personnel recruitment or recruitment abnormalities.

[0027] In some embodiments, the behavior pattern analysis results include public opinion tendency evaluation results, and the public opinion tendency evaluation results are obtained by analyzing the public opinion-related information of the target enterprise and constructing a multidimensional evaluation matrix including the propagation heat and the time decay factor. Specifically, a web crawler can be used to crawl public opinion data about the target enterprise on the Internet, including news websites, social media platforms (such as Weibo, WeChat), forums, etc., and then analyze the crawled public opinion data. Exemplarily, first use a web crawler to crawl financial public opinion data about the target enterprise on the Internet, including positive and negative public opinions. For each type of public opinion (positive, negative), multiple days of historical data from its appearance can be obtained. Then, the time decay factor model is fitted through the historical data. Exemplarily, for the time decay factor model , through parameter fitting, the lambda value is 3, and the time decay factor of positive public opinion is Finally, a multidimensional evaluation matrix is ​​constructed. For example, the multidimensional evaluation matrix of a certain enterprise is as follows: Among them, a1 is the spread heat of the first day of the positive public opinion on the forum, w11(t) is the time decay factor of the positive public opinion on the forum, a2 is the spread heat of the first day of the negative public opinion on the forum, and w12(t) is the time decay factor of the negative public opinion on the forum; b1 is the spread heat of the first day of the positive public opinion on Weibo, w21(t) is the time decay factor of the positive public opinion on Weibo, b2 is the spread heat of the first day of the negative public opinion on Weibo, and w22(t) is the time decay factor of the negative public opinion on Weibo; c1 is the spread heat of the first day of the positive public opinion on the news portal, w31(t) is the time decay factor of the positive public opinion on the news portal, c2 is the spread heat of the first day of the negative public opinion on the news portal, and w32(t) is the time decay factor of the negative public opinion on the news portal. It should be noted that when calculating the time decay factor, the starting day t=0, the next day t=1, and so on. It can be understood that the spread heat of a certain public opinion (such as positive forum public opinion) on the first day multiplied by its time decay factor can be used to calculate its daily spread heat. For example, if the total number of negative public opinions on the target company's finances minus the total number of positive public opinions in two weeks is greater than 100,000, the public opinion tendency assessment result is that its negative public opinions on finances are serious.

[0028] S105. Conduct a behavioral pattern fusion analysis on multiple behavioral pattern analysis results and control and early warning problem data of the target enterprise to obtain graphic and text decision-making guidance data corresponding to the control and early warning problem data.

[0029] Among them, the graphic decision guidance data is used to intuitively display at least one of the target enterprise's behavioral change trends and potential risk situations.

[0030] In some implementations, a fusion analysis intelligent agent is provided in the enterprise monitoring platform, and multiple behavior pattern analysis results and control and warning problem data of the target enterprise are input into the fusion analysis intelligent agent to obtain graphic decision guidance data corresponding to the control and warning problem data.

[0031] It should be noted that, initially, the data of control and early warning problems are analyzed for requirements and tasks to obtain multiple subtasks to be processed; then, after pattern recognition of each subtask to be processed, multiple behavior pattern analysis results of the target enterprise are obtained. Finally, the multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data are integrated and analyzed, and more accurate graphic and text decision-making guidance data can be obtained through a deeper understanding of multiple behavior pattern analysis results and control and early warning problem data.

[0032] S107. In response to the confirmation operation of the graphic and text decision guidance data, the time series features of the historical risk behavior data of the target enterprise and the visual semantic features of the graphic and text decision guidance data are mapped to the same representation space, and cross-modal contrastive learning is used to perform spatiotemporal semantic joint anomaly monitoring to obtain the abnormal behavior category of the target enterprise.

[0033] Among them, historical risk behavior data can be the target enterprise's previous risk behavior record data. It exists in the form of time series. Abnormal behavior categories are used to describe the types of abnormal behaviors identified by the target enterprise during the monitoring process, such as financial anomalies, supply chain anomalies, legal compliance anomalies, etc. Contrastive learning can be a method of learning feature representation by comparing the similarity between the time series feature vectors of the target enterprise's historical risk behavior data and the visual semantic feature vectors of the graphic decision guidance data, which can map the above two different modal vectors to the same representation space.

[0034] In some embodiments, the accuracy of the graphic decision guidance data is confirmed based on the feedback of the supervisor. It is understandable that if the graphic decision guidance data does not meet the query intention of the supervisor, the supervisor can adjust the control warning problem data or ask further questions and submit the request again to obtain more expected graphic decision guidance data.

[0035] In some embodiments, the supervisor monitors the target enterprise for abnormal behavior. After the graphic decision guidance data is confirmed, the enterprise monitoring platform uses an intelligent agent (such as a model of a transformer architecture) to extract features from the time series data corresponding to multiple historical risk behaviors of the target enterprise to obtain time series features of multiple historical risk behavior data, and also extracts features from the graphic decision guidance data to obtain visual semantic features of the graphic decision guidance data. Then, through comparative learning, the features of the above two different modalities are mapped to the same representation space. By performing a similarity comparison between the visual semantic features of the graphic decision guidance data and the time series features of each historical risk behavior data, multiple similarity data are obtained. For example, when a certain similarity data exceeds a preset threshold, it is determined that the target enterprise has a corresponding risk behavior.

[0036] In the above embodiment, first, the control and early warning problem data for the target enterprise is obtained, and the demand analysis and task decomposition of the control and early warning problem data are performed to obtain multiple subtasks to be processed; then, pattern recognition is performed based on any subtask to be processed to obtain the behavior pattern analysis result of the target enterprise under any subtask to be processed; then, the behavior pattern fusion analysis is performed on the multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data to obtain the graphic decision guidance data corresponding to the control and early warning problem data; finally, in response to the confirmation operation of the graphic decision guidance data, the time series characteristics of the historical risk behavior data of the target enterprise and the visual semantic characteristics of the graphic decision guidance data are mapped to the same representation space, and the abnormal monitoring of spatiotemporal semantics is performed by cross-modal contrast learning to obtain the abnormal behavior category of the target enterprise. Based on the demand analysis of the control and early warning problem data, the control and early warning problem data can be understood more accurately and the task decomposition can be performed. Based on pattern recognition of multiple subtasks, the behavior pattern analysis results of the target enterprise under a specific subtask can be revealed more accurately and quickly. Based on the behavior pattern fusion analysis of multiple behavior pattern analysis results and control and warning problem data of target enterprises, data from different sources can be deeply integrated and analyzed to obtain more accurate and comprehensive graphic decision-making guidance data. Based on the time series characteristics of historical risk behavior data and the visual semantic characteristics of graphic decision-making guidance data, the spatiotemporal semantic joint anomaly monitoring can be performed in a cross-modal comparative learning manner to obtain more accurate abnormal behavior categories of target enterprises.

[0037] See also Figure 1b In this embodiment, a method for monitoring abnormal behavior of an enterprise is provided, which is applied to an enterprise monitoring platform. The method includes: S110, obtaining the control and early warning problem data for the target enterprise, performing demand analysis and task decomposition on the control and early warning problem data, and obtaining a plurality of subtasks to be processed.

[0038] Among them, the target enterprise can be an enterprise that the relevant regulatory authorities need to monitor for abnormal behavior. The monitoring warning problem data can be the problems related to the business behavior of the target enterprise that the supervisor inputs on the enterprise monitoring platform. Demand analysis can be an in-depth understanding of the monitoring warning problem data through the intelligent agent to identify its semantics. Task decomposition can be based on the semantics obtained from the demand analysis, and further decomposed into several specific subtasks to be processed through the intelligent agent. The subtasks to be processed are tasks for identifying specific business behaviors of the target enterprise.

[0039] In some implementations, supervisors can submit control warning problem data on the enterprise monitoring platform, and then use the agent to understand the semantics of the control warning problem data, and finally decompose the semantics into multiple subtasks to be processed. For example, before entering the control warning problem data, the supervisor also entered several historical control warning problem data, then the agent can understand the semantics of the control warning problem data and decompose the tasks based on the historical control warning problem data.

[0040] S120: Perform pattern recognition based on any subtask to be processed to obtain a behavior pattern analysis result of the target enterprise under any subtask to be processed.

[0041] The target enterprise has a plurality of behavior pattern analysis results; the behavior pattern analysis results are used to describe at least one of the behavior characteristics and abnormal performance of the target enterprise under the corresponding subtask to be processed.

[0042] In some embodiments, the enterprise monitoring platform can obtain the required enterprise-related data of the target enterprise, such as monitoring data, visitor records, online public opinion, online recruitment information, etc. Each pending subtask has a corresponding subtask processing agent. The subtask processing agent performs pattern recognition through enterprise-related data to obtain the behavior pattern analysis results of the target enterprise under any pending subtask, which can be the behavior characteristics of the target enterprise, or abnormal performance, or both. Exemplarily, the behavior pattern analysis results of the target enterprise obtained based on online public opinion may be financial anomalies. Exemplarily, the behavior pattern analysis results of the target enterprise obtained based on online recruitment information may be a large number of financial personnel recruitment or recruitment anomalies.

[0043] S130, performing a behavioral pattern fusion analysis on multiple behavioral pattern analysis results and control and early warning problem data of the target enterprise to obtain graphic and text decision-making guidance data corresponding to the control and early warning problem data.

[0044] Among them, the graphic decision guidance data is used to intuitively display at least one of the target enterprise's behavioral change trends and potential risk situations.

[0045] In some implementations, a fusion analysis intelligent agent is provided in the enterprise monitoring platform, and multiple behavior pattern analysis results and control and warning problem data of the target enterprise are input into the fusion analysis intelligent agent to obtain graphic decision guidance data corresponding to the control and warning problem data.

[0046] It should be noted that, initially, the data of control and early warning problems are analyzed for requirements and tasks to obtain multiple subtasks to be processed; then, after pattern recognition of each subtask to be processed, multiple behavior pattern analysis results of the target enterprise are obtained. Finally, the multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data are integrated and analyzed, and more accurate graphic and text decision-making guidance data can be obtained through a deeper understanding of multiple behavior pattern analysis results and control and early warning problem data.

[0047] S140 , in response to a confirmation operation on the graphic-text decision guidance data, performing joint anomaly monitoring using the historical risk behavior data of the target enterprise and the graphic-text decision guidance data to obtain an abnormal behavior category of the target enterprise.

[0048] The historical risk behavior data may be the target enterprise's previous risk behavior records. The abnormal behavior category is used to describe the type of abnormal behavior identified by the target enterprise during the monitoring process, such as financial anomalies, supply chain anomalies, legal compliance anomalies, etc.

[0049] In some embodiments, the accuracy of the graphic decision guidance data is confirmed based on the feedback of the supervisor. It is understandable that if the graphic decision guidance data does not meet the query intention of the supervisor, the supervisor can adjust the control warning problem data or ask further questions and submit the request again to obtain more expected graphic decision guidance data.

[0050] In some embodiments, the relevant regulatory authorities monitor the target enterprise for abnormal behavior. After the confirmation operation of the graphic decision guidance data triggers the joint abnormal monitoring process, the enterprise monitoring platform will combine the historical risk behavior data of the target enterprise with the current graphic decision guidance data for analysis. For example, the target enterprise has historical risk behavior data that has been punished for financial data fraud. The enterprise monitoring platform can perform joint abnormal monitoring based on the historical risk behavior data and the graphic decision guidance data to determine whether the target enterprise has repeated financial data fraud. For example, the target enterprise has multiple historical risk behavior data. The enterprise monitoring platform can perform joint abnormal monitoring based on the above multiple historical risk behavior data and graphic decision guidance data to determine whether the target enterprise has repeated abnormal behavior, or other abnormal behaviors in the abnormal behavior category to which the above multiple historical risk behavior data belong.

[0051] In the above embodiment, first, the control and early warning problem data for the target enterprise is obtained, and the control and early warning problem data is analyzed for requirements and tasks to obtain multiple subtasks to be processed; then, pattern recognition is performed based on any subtask to be processed to obtain the behavior pattern analysis result of the target enterprise under any subtask to be processed; then, the behavior pattern fusion analysis is performed on the multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data to obtain the graphic decision guidance data corresponding to the control and early warning problem data; finally, in response to the confirmation operation of the graphic decision guidance data, the historical risk behavior data of the target enterprise and the graphic decision guidance data are used to perform joint abnormal monitoring to obtain the abnormal behavior category of the target enterprise. Based on the demand analysis of the control and early warning problem data, the control and early warning problem data can be more accurately understood and task-decomposed. Based on pattern recognition of multiple subtasks, the behavior pattern analysis results of the target enterprise under a specific subtask can be revealed more accurately and quickly. Based on the behavior pattern fusion analysis of the multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data, the data from different sources can be deeply integrated and analyzed, thereby obtaining more accurate and comprehensive graphic decision guidance data. By conducting joint anomaly monitoring based on historical risk behavior data and graphic decision-making guidance data, we can obtain more accurate abnormal behavior categories of target enterprises.

[0052] In some embodiments, obtaining the control and early warning problem data for the target enterprise includes any of the following methods: In response to the text input operation, control and early warning problem data is determined.

[0053] Acquire voice description data for the target enterprise, parse the voice description data, and obtain control and early warning problem data.

[0054] The voice description data may be the voice form of the control and early warning problem data. The analysis may be to recognize the voice input data and convert it into text format data.

[0055] In some embodiments, the enterprise monitoring platform is provided with a problem input module, and the supervisor can input the control warning problem data into the problem input module in the form of text as the control warning problem data. Exemplarily, the control warning problem data can be "analyzing the recruitment behavior and public opinion information of enterprise A in the past three months to see whether there is abnormal recruitment or negative public opinion". In other embodiments, the enterprise monitoring platform is provided with a voice analysis module, and the supervisor can submit the voice description data to the voice analysis module in the form of voice. The voice analysis module analyzes the voice description data to obtain the control warning problem data in text form.

[0056] In the above embodiments, the control and early warning problem data is obtained by text input or voice description data analysis, which improves the accuracy and flexibility of obtaining the control and early warning problem data.

[0057] In some embodiments, an enterprise anomaly monitoring model is deployed on the enterprise monitoring platform, and the enterprise anomaly monitoring model includes a problem analysis agent; the control and warning problem data is analyzed for requirements and tasks to obtain multiple subtasks to be processed, including: the control and warning problem data is analyzed for intent and steps through the problem analysis agent to obtain multiple subtasks to be processed.

[0058] Among them, the enterprise anomaly monitoring model can be an intelligent analysis model deployed on the enterprise monitoring platform, and its main function is to identify and analyze abnormal behaviors in the operation of the target enterprise.

[0059] The problem analysis agent is one of the core components of the enterprise anomaly monitoring model. Its main function can be to decompose the intention and step of the control and warning problem data, so as to convert the control and warning problem data into multiple specific and operational subtasks to be processed. Intent decomposition can be to decompose multiple intentions through understanding the control and warning problem data. Some intentions can be directly used as subtasks to be processed, and some intentions need to be further decomposed. Step decomposition can be that some intentions need to be further decomposed to obtain subtasks to be processed, and the subtasks to be processed have a sequence of execution.

[0060] In some implementations, the problem analysis agent is a large language model (LLM), such as GPT-4. When the enterprise abnormal monitoring model obtains the control and early warning problem data input by the supervisor, the control and early warning problem data is passed to the problem analysis agent. The problem analysis agent performs intention decomposition and step decomposition on the control and early warning problem data through chain-of-thought (CoT) reasoning.

[0061] In some implementations, prompt word engineering is used to implement intention decomposition of control and early warning problem data. For example, the prompt word template may be as follows: "###role play You are an excellent corporate regulator, especially good at reading and analyzing data on control and early warning issues.

[0062] ###Quest Requirements The following control and early warning questions involve descriptions of business operations. Please summarize the relevant issues of each business operation from the following perspectives in the format of the table below.

[0063] ###Notes {Analyze business behaviors such as recruitment, public opinion, visiting personnel, capital flow, etc., and pay attention to the time period of analysis} Output format |Business Practices|Issues| ###Analysis of control and early warning problem data {Enter analysis, control and warning problem data here}".

[0064] For example, for the control and early warning problem data "analyze whether there are abnormal situations in enterprise A in the past three months", multiple decomposition intentions are obtained as follows: 1) Analyze the recruitment information of Company A in the past three months 2) Analyze the online public opinion of Company A in the past three months 3) Analyze the cash flow of Company A in the past three months Exemplarily, online public opinion analysis can be directly used as a subtask to be analyzed. Exemplarily, recruitment information analysis can be decomposed into recruitment release information analysis and interview information analysis, and the recruitment release information analysis is performed first, and the evaluation result is abnormal, such as when a large number of financial personnel are recruited, interview information analysis is performed. Because the interview is a subsequent step in the release of recruitment information, the interview information analysis is a further confirmation of the recruitment release information analysis. When the recruitment release information is normal, there is no need to perform interview information analysis. Only when the recruitment release information is abnormal, is it necessary to perform interview information analysis. In some embodiments, the steps can be disassembled based on rule management. Exemplarily, when the data obtained by the intention decomposition contains "recruitment information", the corresponding steps are to perform recruitment release information analysis first and then interview information analysis.

[0065] In the above embodiment, the problem analysis agent in the enterprise abnormality monitoring model performs demand analysis and task decomposition on the control and warning problem data, which can more accurately identify and process the control and warning problem data and enhance the abnormal behavior monitoring capability of the enterprise monitoring platform.

[0066] In some embodiments, an enterprise anomaly monitoring model is deployed on the enterprise monitoring platform, and the enterprise anomaly monitoring model includes multiple candidate intelligent agents. Before performing pattern recognition based on any subtask to be processed, the method also includes: selecting a target intelligent agent that matches any subtask to be processed from the multiple candidate intelligent agents, and correspondingly assigning any subtask to be processed to the target intelligent agent.

[0067] In some embodiments, any candidate agent has functional features, wherein the functional features can be obtained by extracting features from the functional description text of the candidate agent. The enterprise abnormality monitoring model can extract features from any pending subtask to obtain the features of the pending subtask, and compare the features of the pending subtask with the functional features of each candidate agent for similarity, and determine the candidate agent corresponding to the functional features with the highest similarity as the target agent.

[0068] Accordingly, pattern recognition is performed based on any subtask to be processed to obtain the behavior pattern analysis results of the target enterprise under any subtask to be processed, including: obtaining the enterprise-related data corresponding to any subtask to be processed through the target intelligent agent, and performing feature extraction and similarity calculation on the enterprise-related data to obtain the behavior pattern analysis results.

[0069] Among them, pattern recognition can be based on enterprise-related data to identify the target enterprise's business model, such as recruitment model, transfer model, public opinion model, etc. The behavior pattern analysis result can be based on enterprise-related data to identify its potential behavior patterns and trends. For example, the recruitment pattern analysis result can be false recruitment, frequent recruitment, etc. Enterprise-related data can be various data related to the target enterprise, such as online public opinion, recruitment release information, monitoring data, visitor information, etc.

[0070] In some embodiments, any target intelligent agent is pre-set with a method for acquiring enterprise-related data. For example, if the target intelligent agent needs to analyze the online public opinion of the target enterprise, a web crawler can be used to capture various data about the target enterprise on the Internet, including news websites, social media platforms, forums, etc. For example, if the target intelligent agent needs to analyze the monitoring data of the target enterprise, the cloud storage storing the monitoring data of the target enterprise can be accessed through an account. After receiving the subtask to be processed, the target intelligent agent first obtains the enterprise-related data according to the subtask to be processed. For example, if the target intelligent agent receives the subtask to be processed "Identify the online public opinion of enterprise A within six months", the target intelligent agent first uses a web crawler to capture the public opinion-related information about enterprise A on the Internet within six months.

[0071] In some embodiments, the enterprise monitoring platform is preset with a pattern feature knowledge base, which stores various features of the enterprise's business model. The target intelligent agent obtains the behavior pattern analysis result by extracting features and calculating similarity on the enterprise-related data. Exemplarily, the target intelligent agent uses natural language processing technology (NLP) to extract features of the public opinion-related information of the target enterprise A captured on the Internet to obtain the public opinion features of A, and then compares the public opinion features with the various public opinion features stored in the pattern feature knowledge base for similarity, which can be Euclidean distance or cosine similarity. Finally, the public opinion pattern name corresponding to the public opinion feature with the greatest similarity is selected as the public opinion pattern analysis result of A, such as less negative public opinion, more negative public opinion, and serious negative public opinion.

[0072] In the above embodiment, firstly, by selecting a target agent that matches the subtask to be processed in the abnormal monitoring model and assigning the subtask to be processed to the target agent, accurate task allocation can be achieved. Secondly, pattern recognition based on the target agent can quickly obtain target enterprise-related data and perform feature extraction and similarity calculation, thereby obtaining the behavior pattern analysis results of the target enterprise under a specific subtask. This method can effectively improve the efficiency of task processing and the accuracy of analysis.

[0073] See also Figure 2 In some embodiments, the target agent includes a public opinion analysis agent and a recruitment analysis agent, and the multiple subtasks to be processed include a public opinion analysis task and a recruitment analysis task; the enterprise-related data corresponding to any subtask to be processed is obtained through the target agent, and feature extraction and similarity calculation are performed on the enterprise-related data to obtain the behavior pattern analysis results, including: S510. Obtain the public opinion-related information of the target enterprise through the public opinion analysis intelligent agent, perform feature extraction and similarity calculation on the public opinion-related information, and obtain the public opinion tendency evaluation result of the target enterprise.

[0074] S520. Obtain recruitment-related information of the target enterprise through the recruitment analysis agent, perform feature extraction and similarity calculation on the recruitment-related information, and obtain recruitment behavior evaluation results of the target enterprise.

[0075] Among them, the behavioral pattern analysis results include public opinion tendency assessment results and recruitment behavior assessment results.

[0076] In some embodiments, the enterprise monitoring platform is preset with a pattern feature knowledge base, which stores the relevant features of the enterprise's business model. After receiving the subtask to be processed, the public opinion analysis agent first uses a web crawler to crawl the public opinion-related information about the target enterprise on the Internet, and then uses natural language processing technology (NLP) to extract features of the public opinion-related information to obtain public opinion features, and then compares the public opinion features with the various public opinion features stored in the pattern feature knowledge base for similarity, which can be Euclidean distance or cosine similarity, and finally selects the public opinion pattern name corresponding to the public opinion feature with the greatest similarity as the public opinion tendency evaluation result of the target enterprise, such as serious negative public opinion in financial aspects.

[0077] In some embodiments, after receiving the subtask to be processed, the recruitment analysis agent first uses a web crawler to crawl recruitment-related information about the target enterprise on the Internet, and then uses natural language processing technology (NLP) to extract features of the recruitment-related information to obtain recruitment features. The recruitment features are then compared with the various recruitment features stored in the pattern feature knowledge base for similarity, which can be Euclidean distance or cosine similarity. Finally, the recruitment pattern name corresponding to the recruitment feature with the greatest similarity is selected as the recruitment behavior evaluation result of the target enterprise, such as frequent recruitment of financial positions.

[0078] In some embodiments, the behavior pattern analysis result is that the target enterprise has serious negative public opinion on finance and frequently recruits for financial positions, which may indicate that the target enterprise has financial problems, such as a financial crisis, and attempts to cope with complex financial problems by expanding the financial team.

[0079] In the above embodiment, the public opinion analysis agent and the recruitment analysis agent are used to obtain the public opinion-related information and recruitment-related information of the target enterprise, and feature extraction and similarity calculation are performed on the information to obtain the public opinion tendency evaluation result and recruitment behavior evaluation result of the target enterprise. This method can effectively analyze the public opinion and recruitment behavior of the target enterprise and provide more accurate enterprise behavior pattern analysis results.

[0080] See also Figure 3 In some embodiments, the recruitment analysis agent includes a recruitment posting analysis agent and a visitor record analysis agent. The recruitment analysis agent obtains the recruitment-related information of the target enterprise, performs feature extraction and similarity calculation on the recruitment-related information, and obtains the recruitment behavior evaluation results of the target enterprise, including: S610. Obtain the recruitment release information of the target enterprise through the recruitment release analysis agent, perform text mining and cluster analysis on the recruitment release information, and obtain the recruitment release evaluation result.

[0081] S620. Obtain personnel flow image data of the target enterprise through the visitor record analysis agent, perform visitor object recognition and activity trajectory recognition on the personnel flow image data, and obtain interview-related evaluation results of the target enterprise.

[0082] Among them, the recruitment behavior evaluation results include recruitment posting evaluation results and interview-related evaluation results. The recruitment posting analysis agent can be an intelligent component for analyzing recruitment posting information. Text mining can be to process recruitment posting information through natural language processing technology, identify and extract some key information fields in the recruitment posting information, such as job description key information, required skills key information, work experience key information, information release time, etc., with the purpose of converting unstructured recruitment posting information into structured data, so as to facilitate subsequent analysis. Cluster analysis can be the process of classifying quantized recruitment posting information according to one or several fields to discover potential patterns and trends in recruitment behavior.

[0083] The visitor record analysis agent can be an intelligent component for analyzing the visitor flow data of the target enterprise. The personnel flow image data can be image information about the flow of visitors in the target enterprise area obtained by the camera, each camera is provided with location information, and the image information contains time data. Visitor object recognition can be to use face recognition technology to identify the real identity of the visitor in the personnel flow image data. Activity trajectory recognition can be to simulate the activity trajectory of the visitor based on the visitor location data and time data captured by the camera.

[0084] In some embodiments, the enterprise monitoring platform is preset with a pattern feature knowledge base, which stores various features of the enterprise's business model. After receiving the subtask to be processed, the recruitment release analysis agent first uses a web crawler to crawl the recruitment release information of the target enterprise on the Internet; then uses natural language processing technology to perform text mining on the recruitment release information to obtain the key information fields of each job release information; then, a vector embedding model (such as BERT) is used to vectorize the key information fields of each recruitment release information to obtain the recruitment release information vector; finally, cluster analysis is performed on the recruitment release information vector.

[0085] In some embodiments, the recruitment release analysis agent uses the K-means clustering method to cluster the recruitment release information vector according to the information release time and position, and can obtain the target enterprise's annual recruitment release information. According to the target enterprise's annual staff turnover rate, the recruitment situation is also relatively close. If the recruitment release information this year is significantly higher than that of previous years, it means that there may be abnormalities in the recruitment release information this year, and the recruitment release analysis agent determines that the recruitment release evaluation result is a large number of recruitments. Exemplarily, in the clustering results, there are significantly more financial position recruitment information in the recruitment release information this year than in previous years, which means that the target enterprise has been recruiting financial personnel for a long time or in large quantities this year, and the target enterprise is likely to have abnormalities in finance and needs to recruit financial personnel to handle complex problems.

[0086] In some embodiments, after receiving the subtask to be processed, the visitor record analysis agent first obtains the personnel flow image data of the target enterprise from the cloud storage according to the visitor's name, identity certificate, visit time and other information recorded in the visitor's machine; then identifies the visitor object in the personnel flow image data; and then simulates the activity trajectory of the visitor object in the target enterprise according to the location data and time data of the visitor object in the personnel flow image data. Exemplarily, after entering the enterprise, the visitor object first signs in at the front reception area and then enters the negotiation room. If there are a large number of similar visitor objects, it means that the target enterprise is likely to interview a large number of applicants. The visitor record analysis agent determines that the interview-related evaluation result is a large number of recruitment.

[0087] In some embodiments, when both the recruitment posting evaluation results and the interview-related evaluation results are large-scale recruitment, the recruitment analysis intelligent agent determines that the recruitment behavior evaluation result is large-scale recruitment, and the interview-related evaluation results can further confirm the recruitment posting evaluation results.

[0088] In the above embodiment, firstly, the recruitment posting analysis agent performs text mining and cluster analysis on the recruitment posting information to obtain the recruitment posting evaluation results; secondly, the visitor record analysis agent obtains the personnel flow image data of the target enterprise, and performs visitor object recognition and activity trajectory recognition on the data to obtain the interview-related evaluation results. Based on the recruitment posting evaluation results, further verification combined with the interview-related evaluation results helps to obtain more accurate recruitment behavior evaluation results.

[0089] In some embodiments, an enterprise anomaly monitoring model is deployed on the enterprise monitoring platform, and the enterprise anomaly monitoring model includes a risk fusion intelligent agent, which performs a behavior pattern fusion analysis on multiple behavior pattern analysis results and control and warning problem data of the target enterprise to obtain graphic decision guidance data corresponding to the control and warning problem data, including: performing risk fusion assessment and visualization processing on multiple behavior pattern analysis results and control and warning problem data of the target enterprise through the risk fusion intelligent agent to obtain graphic decision guidance data.

[0090] Among them, the risk fusion agent can be a system component based on artificial intelligence, which is used to fuse data from different sources, such as behavioral pattern analysis results and control and early warning problem data, to conduct a more accurate risk assessment of the target enterprise's risk behavior. Graphic decision guidance data can be decision support information generated after behavioral pattern fusion analysis, which can be a combination of text, graphics, and charts to show regulators the possible risk points of the enterprise as a basis for regulators to make decisions.

[0091] In some embodiments, the problem analysis agent understands the requirements of the control and early warning problem data and then breaks it down into multiple subtasks to be processed. After the processing is completed, multiple behavior pattern analysis results are returned. If a behavior pattern analysis result is an abnormal performance, it has a corresponding risk probability value, which can be the maximum similarity between a behavior pattern feature of the target enterprise and the corresponding behavior pattern feature in the pattern feature knowledge base; if a behavior pattern analysis result is not an abnormal performance, the corresponding risk probability value can be 0. By extracting features from each behavior pattern analysis result and comparing the similarity with the control and early warning problem data, such as calculating the Euclidean distance, the similarity between each behavior pattern analysis result and the control and early warning problem data can be obtained. Then, the ratio of the similarity corresponding to each behavior pattern analysis result to the sum of the similarities of all behavior pattern analysis results is used as the weight of the behavior pattern analysis result. Finally, the risk probability of each behavior pattern analysis result is multiplied by the corresponding weight, and the results are added as the abnormal risk probability of the target enterprise.

[0092] In some embodiments, see Figure 4a , which shows the risk probability of the target enterprise, and each part of the figure represents its proportion in the risk probability of the target enterprise. Figure 4b , which shows the recruitment frequency of risky positions in the target enterprise. Each part of the figure represents the recruitment frequency of a risky position in a period of time, such as the frequency of posting recruitment information for this position in a year. Figure 4c , which shows the risk interview situation of the target enterprise. Each part of the figure represents the number of interviews for a risk position in a period of time. Figure 4d ,This figure shows the changing trend of negative public opinion of the target enterprise.

[0093] In the above embodiment, the risk fusion agent performs risk fusion assessment and visualization processing on multiple behavior pattern analysis results and control warning problem data of the target enterprise to obtain graphic decision-making guidance data. Based on the visualized data, supervisors can analyze, judge and warn the abnormal behavior of the target enterprise more quickly and accurately.

[0094] In this embodiment, the enterprise monitoring platform deploys an enterprise anomaly monitoring model. Figure 5 ,The enterprise anomaly monitoring model includes a problem analysis agent, multiple candidate agents, and a risk fusion agent. Among them, the multiple candidate agents include a public opinion analysis agent, a recruitment analysis agent, and other agents. The recruitment analysis agent also includes a recruitment posting analysis agent, and a visitor record analysis agent.

[0095] See also Figure 6In some embodiments, the target enterprise's historical risk behavior data and graphic decision guidance data are used for joint anomaly monitoring to obtain the target enterprise's abnormal behavior category, including: S810. Integrate the historical risk behavior data with the current risk behavior data in the graphic decision-making guidance data to obtain target risk behavior data.

[0096] S820, performing graphic fusion on the target risk behavior data and the enterprise behavior analysis graph in the graphic decision guidance data to obtain the abnormal behavior category of the target enterprise.

[0097] Among them, the current risk behavior data can be multiple behavior pattern analysis results of the target enterprise obtained by the risk fusion agent and the corresponding risk probability value. The historical risk behavior data can be multiple behavior pattern analysis results of the target enterprise historically obtained by the risk fusion agent and the corresponding risk probability value. The historical risk behavior data can be stored in the database of the enterprise monitoring platform. The enterprise behavior analysis chart can be a risk position recruitment frequency chart, a risk position interview analysis chart, an enterprise negative public opinion analysis chart, an enterprise visitor analysis chart, an enterprise transaction analysis chart, an enterprise capital flow analysis chart, etc. Graphics and text fusion can be to fuse the graphic data features in the graphic and text decision guidance data with the target risk behavior data features.

[0098] In some embodiments, the target risk behavior data is obtained by integrating the historical risk behavior data and the current risk behavior data by adding the weights. It is understandable that the longer the time interval between the historical risk behavior data and the current risk behavior data, the smaller the weight, because over time, changes in the environment may cause past behavior patterns to change accordingly, and new risk factors may appear. Therefore, the current data has a greater influence on the accuracy and effectiveness of risk prediction.

[0099] In some embodiments, a fine-tuned multimodal large model, such as GPT-4, is used to perform graphic-text fusion on the target risk behavior data and the enterprise behavior analysis graph in the graphic-text decision guidance data. Specifically, first, a text encoder is used to extract features from the target risk behavior data to obtain target risk behavior features; a visual encoder is used to extract features from the enterprise behavior analysis graph to obtain enterprise behavior analysis graph features. Then, the target risk behavior features and the enterprise behavior analysis graph features are concatenated or weighted averaged to obtain enterprise behavior graphic-text fusion features. Finally, the multimodal large model infers the enterprise behavior graphic-text fusion features to obtain the abnormal behavior category of the target enterprise, such as financial anomalies.

[0100] In the above embodiment, by integrating the current risk behavior data and the historical risk behavior data, more accurate target risk behavior data is obtained; further, by fusing the target risk behavior data and the enterprise behavior analysis chart, the abnormal behavior category of the target enterprise can be more accurately determined.

[0101] See also Figure 7 In this embodiment, an enterprise abnormal behavior monitoring device 900 is also provided. The enterprise abnormal behavior monitoring device 900 is applied to an enterprise monitoring platform, and includes: The data acquisition module 910 is used to acquire the control and early warning problem data for the target enterprise, perform demand analysis and task decomposition on the control and early warning problem data, and obtain multiple subtasks to be processed; The pattern recognition module 920 is used to perform pattern recognition based on any pending subtask to obtain the behavior pattern analysis result of the target enterprise under any pending subtask; wherein the target enterprise has multiple behavior pattern analysis results; the behavior pattern analysis results include public opinion tendency evaluation results, and the public opinion tendency evaluation results are obtained by analyzing the public opinion related information of the target enterprise and constructing a multi-dimensional evaluation matrix including the propagation heat and the time decay factor; The fusion analysis module 930 is used to perform a fusion analysis of the behavior pattern of the target enterprise's multiple behavior pattern analysis results and the control and early warning problem data to obtain graphic and text decision-making guidance data corresponding to the control and early warning problem data; The anomaly monitoring module 940 is used to respond to the confirmation operation of the graphic decision guidance data, map the time series characteristics of the historical risk behavior data of the target enterprise and the visual semantic characteristics of the graphic decision guidance data to the same representation space, and use cross-modal contrastive learning to perform spatiotemporal semantic joint anomaly monitoring to obtain the abnormal behavior category of the target enterprise; wherein the abnormal behavior category is used to describe the type of abnormal behavior of the target enterprise identified during the monitoring process.

[0102] In some implementations, the data acquisition module 910 further includes any of the following units: A text data determination unit, used to determine the control and early warning problem data in response to the text input operation; The voice data acquisition unit is used to acquire voice description data for the target enterprise, analyze the voice description data, and obtain control and early warning problem data.

[0103] In some implementations, an enterprise anomaly monitoring model is deployed on the enterprise monitoring platform, and the enterprise anomaly monitoring model includes a problem analysis agent; the data acquisition module 910 also includes: The decomposition and disassembly unit is used to perform intention decomposition and step disassembly of the control and warning problem data through the problem analysis agent to obtain multiple subtasks to be processed.

[0104] In some implementations, an enterprise anomaly monitoring model is deployed on the enterprise monitoring platform, the enterprise anomaly monitoring model includes multiple candidate agents, and the pattern recognition module 920 also includes: An agent selection unit, used to select a target agent matching any subtask to be processed from a plurality of candidate agents, and accordingly assign any subtask to be processed to the target agent; The enterprise data acquisition unit is used to obtain the enterprise-related data corresponding to any subtask to be processed through the target intelligent agent, and perform feature extraction and similarity calculation on the enterprise-related data to obtain the behavior pattern analysis results.

[0105] In some implementations, the target agent includes a public opinion analysis agent and a recruitment analysis agent, and the plurality of to-be-processed subtasks include a public opinion analysis task and a recruitment analysis task; the pattern recognition module 920 further includes: A public opinion information acquisition unit is used to obtain public opinion related information of the target enterprise through the public opinion analysis agent, perform feature extraction and similarity calculation on the public opinion related information, and obtain the public opinion tendency evaluation result of the target enterprise; The recruitment-related information acquisition unit is used to obtain the recruitment-related information of the target enterprise through the recruitment analysis intelligent agent, perform feature extraction and similarity calculation on the recruitment-related information, and obtain the recruitment behavior evaluation results of the target enterprise; among which, the behavior pattern analysis results include public opinion tendency evaluation results and recruitment behavior evaluation results.

[0106] In some implementations, the recruitment analysis agent includes a recruitment posting analysis agent and a visitor record analysis agent, and the pattern recognition module 920 further includes: A recruitment release information acquisition unit is used to obtain the recruitment release information of the target enterprise through a recruitment release analysis agent, perform text mining and cluster analysis on the recruitment release information, and obtain recruitment release evaluation results; The image data acquisition unit is used to obtain the personnel flow image data of the target enterprise through the visitor record analysis intelligent agent, perform visitor object recognition and activity trajectory recognition on the personnel flow image data, and obtain the interview-related evaluation results of the target enterprise; wherein the recruitment behavior evaluation results include recruitment posting evaluation results and interview-related evaluation results.

[0107] In some implementations, an enterprise anomaly monitoring model is deployed on the enterprise monitoring platform, and the enterprise anomaly monitoring model includes a risk fusion agent, and the fusion analysis module 930 also includes: The evaluation and processing unit is used to perform risk fusion evaluation and visualization processing on multiple behavior pattern analysis results and control and warning problem data of the target enterprise through the risk fusion intelligent agent to obtain graphic decision-making guidance data.

[0108] In some embodiments, the abnormality monitoring module 940 further includes: A data integration unit, used to integrate historical risk behavior data with current risk behavior data in graphic decision-making guidance data to obtain target risk behavior data; The computing unit is used to fuse the target risk behavior data with the enterprise behavior analysis diagram in the graphic and text decision guidance data to obtain the abnormal behavior category of the target enterprise.

[0109] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0110] The enterprise abnormal behavior monitoring device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0111] See also Figure 8 , Figure 8 is a schematic diagram of the structure of a computer device provided in an embodiment of the present application, such as Figure 8 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 8 A processor 10 is taken as an example.

[0112] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0113] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0114] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0115] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0116] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 8 The example of connecting through bus is taken in the following.

[0117] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device may be a touch screen.

[0118] The embodiment of the present application also provides a computer-readable storage medium. The above method according to the embodiment of the present application can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0119] The embodiment of the present application provides a computer program product, which includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method of any embodiment of the present application.

[0120] Although the embodiments of the present application are described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present application, and such modifications and variations are all within the scope defined by the appended claims.

[0121] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0122] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0123] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0124] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device for implementing the functions specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0125] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0126] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0127] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0128] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0129] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

[0130] Although the embodiments of the present application have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present application, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for monitoring abnormal behavior of an enterprise, characterized in that: Applied to an enterprise monitoring platform; the method comprises: Acquire the control and early warning problem data for the target enterprise, perform demand analysis and task decomposition on the control and early warning problem data, and obtain multiple subtasks to be processed; Based on any pending subtask, pattern recognition is performed to obtain a behavior pattern analysis result of the target enterprise under any pending subtask; wherein the target enterprise has multiple behavior pattern analysis results; the behavior pattern analysis results include a public opinion tendency evaluation result, which is obtained by analyzing the public opinion-related information of the target enterprise and constructing a multidimensional evaluation matrix including the propagation heat and the time attenuation factor; Conducting a behavioral pattern fusion analysis on multiple behavioral pattern analysis results of the target enterprise and the control and early warning problem data to obtain graphic and text decision-making guidance data corresponding to the control and early warning problem data; In response to a confirmation operation on the graphic decision guidance data, the time series features of the target enterprise's historical risk behavior data and the visual semantic features of the graphic decision guidance data are mapped to the same representation space, so as to perform spatiotemporal semantic joint anomaly monitoring by adopting cross-modal contrastive learning to obtain the abnormal behavior category of the target enterprise; wherein the abnormal behavior category is used to describe the type of abnormal behavior of the target enterprise identified during the monitoring process.

2. The method according to claim 1, characterized in that The method of obtaining the control and early warning problem data for the target enterprise includes any one of the following methods: In response to the text input operation, determining the control and early warning problem data; Acquire voice description data for the target enterprise, parse the voice description data, and obtain the control and early warning problem data.

3. The method according to claim 1, characterized in that The enterprise monitoring platform is deployed with an enterprise anomaly monitoring model, which includes a problem analysis agent; the control and early warning problem data is subjected to demand analysis and task decomposition to obtain a plurality of subtasks to be processed, including: The problem analysis agent performs intention decomposition and step disassembly on the control and warning problem data to obtain the multiple subtasks to be processed.

4. The method according to claim 1, characterized in that: The enterprise monitoring platform is deployed with an enterprise anomaly monitoring model, the enterprise anomaly monitoring model includes a plurality of candidate agents, and before pattern recognition is performed based on any subtask to be processed, the method further includes: Selecting a target intelligent agent that matches any subtask to be processed from the plurality of candidate intelligent agents, and correspondingly assigning any subtask to be processed to the target intelligent agent; Accordingly, the pattern recognition based on any subtask to be processed to obtain the behavior pattern analysis result of the target enterprise under any subtask to be processed includes: The enterprise-related data corresponding to any of the to-be-processed subtasks is obtained through the target intelligent agent, and feature extraction and similarity calculation are performed on the enterprise-related data to obtain the behavior pattern analysis result.

5. The method according to claim 4, characterized in that The target intelligent agent includes a public opinion analysis intelligent agent and a recruitment analysis intelligent agent, and the multiple subtasks to be processed include a public opinion analysis task and a recruitment analysis task; the step of obtaining enterprise-related data corresponding to any of the subtasks to be processed through the target intelligent agent, and performing feature extraction and similarity calculation on the enterprise-related data to obtain the behavior pattern analysis result includes: Obtaining public opinion related information of the target enterprise through the public opinion analysis agent, performing feature extraction and similarity calculation on the public opinion related information, and obtaining a public opinion tendency evaluation result of the target enterprise; The recruitment analysis agent obtains the recruitment-related information of the target enterprise, performs feature extraction and similarity calculation on the recruitment-related information, and obtains the recruitment behavior evaluation result of the target enterprise; wherein the behavior pattern analysis result includes the public opinion tendency evaluation result and the recruitment behavior evaluation result.

6. The method according to claim 5, characterized in that The recruitment analysis agent includes a recruitment posting analysis agent and a visitor record analysis agent. The recruitment analysis agent is used to obtain the recruitment related information of the target enterprise, and performs feature extraction and similarity calculation on the recruitment related information to obtain the recruitment behavior evaluation result of the target enterprise, including: Obtaining the target enterprise's recruitment release information through the recruitment release analysis agent, performing text mining and cluster analysis on the recruitment release information, and obtaining a recruitment release evaluation result; The personnel flow image data of the target enterprise is obtained through the visitor record analysis agent, and visitor object recognition and activity trajectory recognition are performed on the personnel flow image data to obtain interview-related evaluation results of the target enterprise; wherein the recruitment behavior evaluation results include the recruitment posting evaluation results and the interview-related evaluation results.

7. The method according to any one of claims 1 to 6, characterized in that: The enterprise monitoring platform is deployed with an enterprise anomaly monitoring model, which includes a risk fusion agent. The behavior pattern fusion analysis is performed on the multiple behavior pattern analysis results of the target enterprise and the control and early warning problem data to obtain graphic and text decision guidance data corresponding to the control and early warning problem data, including: The risk fusion intelligent agent performs risk fusion assessment and visualization processing on multiple behavior pattern analysis results of the target enterprise and the control and warning problem data to obtain the graphic decision-making guidance data.

8. The method according to claim 1, characterized in that The abnormal behavior category of the target enterprise is obtained by fusing the target risk behavior data with the enterprise behavior analysis diagram in the graphic decision guidance data. The target risk behavior data is obtained by integrating the historical risk behavior data with the current risk behavior data in the graphic decision guidance data.

9. An enterprise abnormal behavior monitoring device, characterized in that: The enterprise abnormal behavior monitoring device is applied to the enterprise monitoring platform, including: A data acquisition module is used to acquire the control and early warning problem data for the target enterprise, perform demand analysis and task decomposition on the control and early warning problem data, and obtain multiple subtasks to be processed; A pattern recognition module is used to perform pattern recognition based on any pending subtask to obtain a behavior pattern analysis result of the target enterprise under any pending subtask; wherein the target enterprise has multiple behavior pattern analysis results; the behavior pattern analysis results include a public opinion tendency evaluation result, which is obtained by analyzing the public opinion-related information of the target enterprise and constructing a multidimensional evaluation matrix including a propagation heat and a time decay factor; A fusion analysis module is used to perform a fusion analysis of the behavior pattern of the target enterprise and the control and early warning problem data to obtain graphic and text decision-making guidance data corresponding to the control and early warning problem data; An anomaly monitoring module is used to respond to the confirmation operation of the graphic decision guidance data, map the time series characteristics of the historical risk behavior data of the target enterprise and the visual semantic characteristics of the graphic decision guidance data to the same representation space, and use cross-modal contrastive learning to perform spatiotemporal semantic joint anomaly monitoring to obtain the abnormal behavior category of the target enterprise; wherein the abnormal behavior category is used to describe the type of abnormal behavior of the target enterprise identified during the monitoring process.

10. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 8 by executing the computer instructions.

Images