An artificial intelligence risk level supervision system

Abstract

The present invention relates to the field of artificial intelligence technology, and specifically provides an artificial intelligence risk level supervision system. The system includes a link anomaly recognition module, a behavior pattern mapping module, a path clustering and evaluation module, a level label correction module, and a segmented level tracking module. In the present invention, through the linkage analysis of time records and positioning coordinates, the rapid identification of transition nodes and the screening of abnormal trajectories are realized, the spatial perception ability of dynamic abnormal nodes is enhanced, a cross-behavior structure is constructed by combining overlapping number aggregation, the consistency recognition ability of multi-source behavior data is improved, the illegal paths are clustered by frequency to form a graph expression, the quantitative description and node positioning of risk paths are strengthened, level comparison generates correction feedback, the sensitivity of risk assessment is improved, increasing links are screened based on the level variation trend, the serialization extraction of high-risk paths is realized, and a hierarchical controllable risk link recognition and evaluation closed-loop system is constructed.

Description

Technical Field

[0001] The present invention relates to the technical field of artificial intelligence, and in particular to an artificial intelligence risk level supervision system. Background Art

[0002] The technical field of artificial intelligence includes analyzing, reasoning, and decision-making processing of massive data by constructing human-like intelligent systems. Its core contents include sub-technologies such as machine learning, natural language processing, computer vision, knowledge graphs, and intelligent control. The research in this technical field involves data collection and preprocessing, model training and optimization, feature extraction and classification, language understanding and generation, etc., aiming to enable computing systems to have the ability of automatic cognition, judgment, and execution of complex tasks. The development of artificial intelligence has been widely applied in many industries such as transportation, healthcare, finance, and manufacturing, promoting its in-depth integration in automation, personalized services, and intelligent assisted decision-making.

[0003] Among them, the artificial intelligence risk level supervision system refers to a system used to identify, classify, and supervise different risks existing in the process of artificial intelligence applications, mainly targeting technical matters such as ethical risks, security hazards, algorithmic biases, and data compliance issues caused by artificial intelligence in actual deployment and operation. By constructing a risk factor identification rule set, risk level standards are set.

[0004] The processing mechanism of the prior art in artificial intelligence risk level supervision mainly relies on the rule judgment method under a predefined condition set. This static rule matching and analysis path are fixed and cannot effectively cope with the link dynamics during operation and the complex evolution of risk propagation paths, resulting in the lack of timeliness and flexibility of the identification results. In scenarios involving multi-node behavior intersections, the prior art is difficult to achieve the collection and annotation processing of overlapping numbered data, resulting in the inability to effectively capture the cross-node conduction mode of abnormal behaviors. For example, during the high-frequency instruction transmission process, if there are cases where the numbers are repeated but the behavior performances are significantly different, the traditional system cannot identify the potential deviation aggregation phenomenon. In the risk level judgment link, the current solution fails to form a feedback loop for the setting and update of the level. When there is a long-term inconsistency between the standard level and the actual link level, no dynamic calibration mechanism is provided, resulting in lagging supervision measures and insufficient risk regulation ability. The prior art lacks a tracking mechanism for the level change trend in multi-stage processes and is prone to ignoring the early warning signals of the gradually rising level in high-risk paths, thus unable to achieve early intervention in potential concentrated risk areas and reducing the overall supervision's control ability over the risk evolution path. Summary of the Invention

[0005] The purpose of the present invention is to solve the deficiencies existing in the prior art and propose an artificial intelligence risk level supervision system.

[0006] To achieve the above object, the present invention adopts the following technical solutions: An artificial intelligence risk level supervision system includes:

[0007] The link anomaly identification module, based on the time records and positioning coordinates in the financial supervision node transmission link, identifies and detects the spatial position transition nodes through the time series data stream, screens the node trajectories with a transition frequency exceeding the set threshold, and establishes a node link anomaly map;

[0008] The behavior pattern mapping module calls the node link anomaly map, extracts the abnormal node numbers and behavior identifiers in the map, associates the behavior deviation sequences in the traffic instruction nodes, and performs a collection process on the overlapping numbered data sequences to establish a cross-marked behavior set;

[0009] The path clustering and evaluation module calls the cross-marked behavior set, detects the trigger paths in the illegal operation sequences, records and maps the illegal judgment nodes, forms a mapping block according to the frequency, and constructs a risk path aggregation graph;

[0010] The level label correction module calls the risk path aggregation graph, locates the rule execution chain in the intelligent supervision platform that is consistent with the illustrated path, extracts the current marked level, compares it with the standard path level in the supervision risk registration template, and adjusts and classifies the chains with inconsistent levels to generate a level mapping calibration table.

[0011] As a further solution of the present invention, the node link anomaly map includes the transition node number, the transition frequency threshold, the spatial position change characteristics, the link stability parameter, and the time series offset index. The cross-marked behavior set includes the abnormal node number, the behavior deviation label, the overlapping behavior sequence, the behavior feature index, and the cross-identification mark. The risk path aggregation graph includes the illegal path number, the frequency statistics block, the risk node grouping, the path level identifier, and the aggregated link label. The level mapping calibration table includes the rule execution chain number, the current level label, the standard level benchmark, the level deviation value, and the correction classification mark.

[0012] As a further solution of the present invention, the link anomaly identification module includes:

[0013] The time trajectory extraction sub-module, based on the time records and positioning coordinates in the financial supervision node transmission link, identifies the time difference and coordinate difference between consecutive records, screens the record intervals that meet the time jump threshold and spatial jump threshold conditions, and generates a node time position trajectory sequence;

[0014] The transition node screening sub-module, based on the node time position trajectory sequence, counts the transition frequencies of the nodes in different time periods, determines whether they exceed the transition frequency threshold, screens the corresponding nodes and records the transition time period and the spatial change amount, and obtains the high-frequency transition node change rate;

[0015] The link map construction sub-module calls the high-frequency transition node change rate, identifies the link structure of the transition nodes, determines the connection relationship and transition order, formulates a timing structure according to the transition time period and sets the edge connection weight, and establishes a node link anomaly map.

[0016] As a further solution of the present invention, the behavior pattern mapping module includes:

[0017] The node anomaly recognition sub-module calls the node link anomaly map, extracts the node numbers and status identifiers, filters the numbers with status mutations and path offsets, analyzes the amplitude of the status mutation and the intensity of the path change, and obtains the node anomaly intensity value;

[0018] The behavior deviation aggregation sub-module, according to the node anomaly intensity value, associates the labeled behavior deviation sequences in the instruction nodes, filters the numbers in the number sequence that coincide with the deviation sequences, extracts the deviation classifications, performs aggregation and classification, and uses the formula:

[0019] ;

[0020] Calculates the number deviation aggregation value, merges and classifies according to the numerical range, and obtains the deviation aggregation value;

[0021] Wherein, represents the number deviation aggregation value, is the density of the abnormal numbers of the th category, is the amplitude of the status mutation of the abnormal numbers of the th category, is the path offset intensity of the abnormal numbers of the th category, is the number of occurrences of the abnormal number during the monitoring period, is the starting identifier of the th deviation entry in the traffic instruction, is the th deviation entry termination identifier, is the total number of traffic instruction deviation entries,

[0022] The cross-mark recognition sub-module, based on the deviation aggregation value, compares the numbers with the deviation category labels, extracts the co-occurring node pairs in the mapping sequence, analyzes the overlapping feature intervals and behavior differences between the numbers, and establishes a cross-mark behavior set.

[0023] As a further solution of the present invention, the path clustering evaluation module includes:

[0024] The cross - mark analysis sub - module calls the cross - mark behavior set, extracts the behavior label group within the path, detects the behavior label cross - structure through the combination of path position values and label types, calculates the cross - frequency and position offset values, divides the path behaviors into clusters according to the offset positions, and obtains the path behavior cluster frequency values;

[0025] The violation node mapping sub - module calls the path behavior cluster frequency values, filters out the nodes with a conflict rate higher than the behavior threshold, and re - codes them according to the node numbers and frequencies to generate a standard mapping node set;

[0026] The risk path aggregation sub - module, based on the standard mapping node set, aggregates the associated path node structures, identifies the node operation sequence numbers, position sequences, and trigger signal values, and uses the formula:

[0027] ;

[0028] Calculate the path structure correlation degree index, perform block sorting, count the number of paths covered by the block and the node ratio, and construct a risk path aggregation graph;

[0029] Among them, represents the path structure correlation degree index, is the node operation sequence consistency value of the th path, is the trigger signal difference value of the th path, is the operation sequence overlap value of the th path, is the number of mapped nodes of the th path, is the sum of the trigger signal intensities of all nodes of the th path, is the offset behavior mapping intensity adjustment factor of the th path, is the node sequence conflict compensation factor of the th path, is the total number of paths.

[0030] As a further solution of the present invention, the level label correction module includes:

[0031] The risk chain identification sub - module calls the risk path aggregation graph, compares the node order and logic of the paths shown in the graph with the rule chains of the supervision platform, identifies the risk chains with a structure consistency exceeding the threshold, and generates an artificial intelligence risk path chain set;

[0032] The level deviation judgment sub-module extracts the chain level tags according to the artificial intelligence risk path chain set, calls the standard level value of the corresponding path in the supervision risk registration template, judges the corresponding positions of the two in the level sequence and analyzes the differences, and generates the AI risk level deviation value;

[0033] The label mapping adjustment sub-module selects the chains with level deviation exceeding the threshold according to the AI risk level deviation value, extracts the level tags, the frequency of risk events, the node inference coupling strength and the number of path conflicts, and uses the formula:

[0034] ;

[0035] Calculate the correction amplitude of the AI risk label, and perform mapping reconstruction with the current level label value, identify the label mapping relationship, and generate the level mapping calibration table;

[0036] Among them, represents the correction amplitude of the AI risk label, represents the current level label value, represents the standard level value, represents the frequency of risk event triggers, represents the inference coupling strength, represents the AI risk level deviation value, represents the number of path conflicts.

[0037] As a further solution of the present invention, the system further includes a segmented level tracking module:

[0038] The segmented level tracking module calls the level mapping calibration table, marks the corresponding values of the risk levels triggered by the links in the multi-stage process, identifies the distribution trend of the level changes in the instruction conduction path, screens the chains with continuously increasing levels as the risk concentration links, and outputs the segmented risk level supervision path set;

[0039] The segmented risk level supervision path set includes the phased risk level, the level change trajectory, the link concentration section, the continuous increase identifier, and the instruction conduction path mapping.

[0040] As a further solution of the present invention, the segmented level tracking module includes:

[0041] The level mapping marking sub-module calls the level mapping calibration table, identifies the link numbers, trigger times and response times in the process path, extracts the original level values and compares the mapped level items, selects the corresponding values, and generates the risk level mapping value set;

[0042] The level trend identification submodule, based on the risk level mapping value set, sorts the link number sequence and the response time sequence by number, identifies the difference between adjacent values and determines whether it is positive or negative, marks the growth node, extracts the continuous positive difference sequence, records the link number, the total difference and the number of nodes, removes the low-frequency change segment, and generates the number of increasing trend sequences;

[0043] The chain screening aggregation submodule extracts high-frequency increasing path segments according to the number of increasing trend sequences, identifies the start and end numbers, calculates the cumulative increase and the increase rate, screens the path segments whose rates exceed the benchmark value, and obtains the segmented risk level supervision path set.

[0044] Compared with the prior art, the advantages and positive effects of the present invention are:

[0045] In the present invention, by linking and analyzing the time records and positioning coordinates in the transmission link of the financial regulatory node, the spatial transition nodes can be quickly detected in the data stream timing structure, and the threshold is set by the transition frequency to form an abnormal trajectory screening mechanism, which enhances the accurate capture of link change behavior and improves the spatial perception depth of dynamic abnormal nodes. Combining transition feature extraction and trajectory behavior classification, it can focus on the atypical changes in node behavior evolution, and construct a cross-behavior structure based on number overlap collection, which effectively enhances the consistency processing capability of multi-source behavior data in abnormal identification. In the process of clustering and mapping the trigger paths of illegal operation sequences, the mapping blocks are divided by frequency dimension to form a multi-angle quantitative description of risk paths, broaden the graph expression ability and node positioning accuracy of illegal events, and form a correction feedback path for level differences based on the comparison and analysis of the current level of the execution chain and the template level. The granularity of risk level assessment system's perception of subtle changes is significantly improved. The level variation trend in the multi-stage process is used as the basis for link screening, and the continuously increasing path is screened as the key link output to achieve serialized extraction of risk distribution trends and improve the centralization and consistency of high-risk link identification. The overall process builds a closed-loop mechanism from data flow perception, behavior recognition, path classification, level comparison to trend tracking, so that the detection, analysis and evaluation of risk links have highly structured and hierarchical controllable capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a system flow chart of the present invention;

[0047] Figure 2 This is a flow chart of the link change identification module in the present invention;

[0048] Figure 3 It is a flow chart of the behavior pattern mapping module in the present invention;

[0049] Figure 4 This is a flow chart of the path clustering evaluation module in the present invention;

[0050] Figure 5 This is the flowchart of the level label correction module in the present invention;

[0051] Figure 6 This is the flowchart of the segmented level tracking module in the present invention. Specific implementation manner

[0052] In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0053] In the description of the present invention, it should be understood that the orientation or positional relationship indicated by terms such as "length", "width", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc. is based on the orientation or positional relationship shown in the accompanying drawings. It is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation to the present invention. In addition, in the description of the present invention, "a plurality of" means two or more unless otherwise specifically defined.

[0054] Please refer to Figure 1 , an artificial intelligence risk level supervision system includes:

[0055] Based on the time records and positioning coordinates in the transmission link of the financial supervision node, the link anomaly identification module identifies and detects the nodes with spatial position transitions through the time series data stream, screens the node trajectories with transition frequencies exceeding the set threshold, and establishes a node link anomaly map;

[0056] The behavior pattern mapping module calls the node link anomaly map, extracts the abnormal node numbers and behavior identifiers in the map, associates the behavior deviation sequences in the traffic instruction nodes, and performs aggregation processing on the data sequences with overlapping numbers to establish a cross-marked behavior set;

[0057] The path clustering and evaluation module calls the cross-marked behavior set, detects the trigger paths in the illegal operation sequences, records and maps the illegal judgment nodes, forms a mapping block according to the frequency, and constructs a risk path aggregation map;

[0058] The level label correction module calls the risk path aggregation map, locates the rule execution chain in the intelligent supervision platform that is consistent with the illustrated path, extracts the current marked level, compares it with the standard path level in the supervision risk registration template, and adjusts and classifies the chains with inconsistent levels to generate a level mapping calibration table;

[0059] The segmented level tracking module calls the level mapping calibration table to mark the corresponding values of the risk levels of the triggering instructions in the multi-stage process, identifies the distribution trend of the level changes in the instruction transmission path, screens the chain with continuously increasing levels as the risk concentration link, and outputs the segmented risk level supervision path set.

[0060] The node link anomaly map includes transition node number, transition frequency threshold, spatial position change characteristics, link stability parameters, and time series offset indicators. The cross-marking behavior set includes abnormal node number, behavior deviation label, overlapping behavior sequence, behavior feature index, and cross-identification label. The risk path aggregation map includes violation path number, frequency statistics block, risk node grouping, path level identification, and aggregation link label. The level mapping calibration table includes the rule execution chain number, current level label, standard level benchmark, level deviation value, and correction classification mark. The segmented risk level supervision path set includes stage risk level, level change trajectory, link concentration section, continuous incremental identification, and instruction conduction path mapping.

[0061] See also Figure 2 , the link change identification module includes:

[0062] The time trajectory extraction submodule identifies the time difference and coordinate difference between consecutive records based on the time records and positioning coordinates in the transmission link of the financial regulatory node, selects the record interval that meets the time jump threshold and space jump threshold conditions, and generates the node time position trajectory sequence;

[0063] First, the time record and location coordinates of the financial regulatory node are obtained. This process involves collecting data from multiple monitoring points. For example, in a transaction, each transaction node such as a bank's ATM, online trading platform, etc. is regarded as a regulatory node. The time and geographical location coordinates of each transaction are recorded in real time to monitor whether the transaction behavior is normal. At this time, a time jump threshold and a space jump threshold are set. For example, the time threshold is set to 30 seconds and the space threshold is set to 100 meters. Only when the recorded time difference and position difference exceed the threshold at the same time, it is considered a valid jump. This setting helps to exclude normal time and space fluctuations and ensure that only truly abnormal behaviors are marked and recorded. Then the records are screened out, and the time and location information is extracted to form a sequence. The sequence shows the movement trajectory of each node in time and space. Through this sequence, it is possible to further analyze whether the node's activities are abnormal. For example, an ATM appears multiple times in a short period of time at two points that are extremely far apart in geographical location, indicating fraud. Finally, a node time and location trajectory sequence is generated, providing regulators with an intuitive method to observe and evaluate the abnormality of node behavior.

[0064] The transition node screening sub-module, based on the node time-position trajectory sequence, counts the transition frequencies of nodes in different time periods, determines whether they exceed the transition frequency threshold, screens the corresponding nodes, records the transition time period and the spatial change amount, and obtains the change rate of high-frequency transition nodes;

[0065] Count the position transition frequencies of each node in different time periods and compare them with the set transition frequency threshold. For example, in financial supervision, if the transition frequency of a supervision node exceeds 10 times within one hour, it indicates that there is an abnormality in this node. In this process, it is first necessary to divide the data in the time-position trajectory sequence into time periods. For example, divide a day into 24 hours, with each hour as a monitoring unit, and then count the transition frequencies within each monitoring unit. The frequency data is then compared with the transition frequency threshold, and the threshold is set based on historical data analysis. For example, it is set by analyzing the average transition frequencies of all nodes in the past year. If the transition frequency of a certain node is significantly higher than this average value, it is marked as abnormal. After screening out the abnormal nodes, record the transition time period and the spatial change amount to provide data support for further analysis. Finally, obtain the change rate of high-frequency transition nodes, which is a quantitative description of the node behavior and provides a basis for subsequent risk assessment and early warning;

[0066] Table 1: Example data of node transition frequencies

[0067] ;

[0068] As shown in Table 1, Table 1 lists the transition frequencies of two nodes in different time periods. Through the data, it can be observed that the transition frequencies of node B in the 1-2 hour and 2-3 hour periods exceed the set threshold (10 times), indicating that there is abnormal behavior in node B.

[0069] The link graph construction sub-module calls the change rate of high-frequency transition nodes, identifies the link structure of transition nodes, determines the connection relationship and transition order, formulates a time sequence structure according to the transition time period, sets the edge weights, and establishes a node link anomaly graph;

[0070] Use the high-frequency transition node change rate to identify abnormal nodes in the link structure, determine the connection relationship and transition order, call the transition node change rate data, and analyze the relationship between nodes in time and space. For example, if a node frequently jumps from location A to location B and then back to A within a short period of time, this frequent round-trip transition behavior indicates potential risks. Determine the connection relationship between nodes through data, and then construct a time series graph based on the time period of node transitions. This graph not only shows the connections between nodes but also marks the intensity and order of transitions. The transition intensity can be calculated by the product of the transition frequency and the transition distance. Assign a weight value to each connection, and the setting of the weight value is also based on historical data. For example, the weight value can be set by analyzing the relationship between link strength and event influence in past events. Connections with high weights represent more important or more abnormal transition behaviors. Finally, establish a node link anomaly map to visually reveal the key abnormal nodes and their dynamic relationships in the entire supervision network, providing an important visual aid for the decision-making of the supervision department.

[0071] Please refer to Figure 3 , the behavior pattern mapping module includes:

[0072] The node anomaly identification sub-module calls the node link anomaly map, extracts the node numbers and status identifiers, filters the numbers with status mutations and path offsets, analyzes the magnitude of the status mutation and the intensity of the path change, and obtains the node anomaly intensity value;

[0073] In the process of monitoring financial risks, for example, the trading nodes of financial institutions exhibit unusual behaviors due to abnormal internal data processing or sudden changes in the external environment. The behaviors include abnormal trading volumes or trading patterns. By real-time monitoring of trading data, such abnormal behaviors can be quickly identified. In a specific implementation example, if a certain trading node frequently executes a large number of high-risk transactions that do not conform to the historical pattern within a short period of time, the node will be automatically marked as high-risk. The judgment is based on a comprehensive analysis of trading frequency, amount, and historical data. By calculating the trading volume change rate and the degree of deviation of the trading pattern of the node, a comprehensive risk indicator, that is, the node anomaly intensity value, can be generated. This value will be used for further risk assessment and early warning, helping financial institutions adjust their risk management strategies, thereby preventing potential financial crises and allowing financial institutions to take measures before the risks occur, such as adjusting trading strategies and strengthening monitoring measures.

[0074] The behavior deviation aggregation sub-module, according to the node anomaly intensity value, associates the marked behavior deviation sequences in the instruction nodes, filters the numbers in the number sequence that coincide with the deviation sequences, extracts the deviation classifications, and performs aggregation and classification. Using the formula:

[0075] ;

[0076] Calculate the aggregated value of the numbering deviation, merge and classify according to the numerical range, and obtain the deviation aggregation value;

[0077] Among them, represents the aggregated value of the numbering deviation, is the density of the th type of abnormal number, is the magnitude of the state mutation of the th type of abnormal number, is the path deviation intensity of the th type of abnormal number, is the abnormal number The number of occurrences within the monitoring period, is the starting identifier of the th deviation entry in the traffic instruction, is the th termination identifier of the deviation entry, is the total number of traffic instruction deviation entries, is the number of types of abnormal numbers;

[0078] The aggregated value of the numbering deviation refers to the result of collecting and statistically analyzing the data sequences with overlapping numbers in the behavior deviation sequence. The index calculates factors such as the number of occurrences, the magnitude of state mutation, and the path deviation intensity of different numbers within the monitoring period, and finally quantifies the density and intensity of the behavior deviation. The core goal is to identify the numbers with significant behavior deviations at different time points and evaluate the risk level of abnormal behaviors through aggregated information;

[0079] In the financial scenario under the artificial intelligence risk level supervision system, identify, classify, and measure the numbers with abnormal behaviors in the trading nodes to achieve the quantitative identification of potential financial risk factors. Taking the financial securities market as an example, if a certain type of stock shows continuous abnormal trading behaviors during the non-announcement period, the supervision can call the abnormal trading numbers marked in the node anomaly intensity value and compare them with the historical violation trading behavior sequences in the financial behavior deviation annotation. After screening out the overlapping numbers, conduct aggregated statistics on their trading characteristics;

[0080] : The aggregated value of the numbering deviation, representing the deviation intensity evaluation index of the abnormal numbers after aggregation, with the unit of "trading behavior deviation points" (dimensionless);

[0081] : The density of the th type of abnormal number, representing the frequency of abnormal behaviors of this number per unit time, with the unit of "times / hour", obtained by statistically counting the frequency of a certain type of number marked as "abnormal trading" in the AI monitoring system within one hour. If a certain number is recorded as 5 abnormal times from 10:00 to 11:00 in the morning, then ;

[0082] : The state mutation amplitude of the th category of anomaly numbers, representing the deviation degree of the transaction state (such as buy-sell ratio, net trading volume) of this number from the historical average, with the unit of "%", calculated by the deviation degree of the buy-sell ratio of this number during the detection period. For example, if the historical buy-sell ratio is 1.0 and the current one is 1.6, then ;

[0083] : The path deviation intensity of the th category of anomaly numbers, referring to the mutation degree of the trading mode of this number on the capital flow path, with the unit of "number of changed paths", defined as the increment of the number of trading path changes of this number per unit time compared with the historical average. For example, if it changes from the regular 3 paths to 7 paths, then ;

[0084] : The number of occurrences (dimensionless) of the anomaly number during the monitoring period, recording the total number of occurrences of the number during the monitoring period. For example, if a number appears 12 times, then ;

[0085] , : Respectively, the start and end time points of the th deviation entry in the traffic instruction, with the unit of "minute", which are the time marks for recording the start and end of each deviation behavior. For example, if the deviation behavior starts at 9:00 and ends at 9:07, the corresponding values are 540 and 547 (minutes);

[0086] : The total number of traffic instruction deviation entries (dimensionless);

[0087] : The number of types of anomaly numbers (dimensionless);

[0088] All indicators are processed through unit conversion to ensure a unified dimension, , , and uniformly enter the molecular layer for normalization of the unit;

[0089] A numerical calculation example is as follows:

[0090] Let , , and the assignments of each parameter are as follows:

[0091] , , , , , ;

[0092] , , , , , ;

[0093] Substitute into the calculation:

[0094] The first part: ;

[0095] The second part: ;

[0096] Final result: ;

[0097] In the current detection period, the aggregated behavior deviation numbers show a comprehensive deviation intensity of 32.17 in multiple dimensions such as transaction frequency and status deviation. If the preset deviation benchmark value is 25, it indicates that there is an excessive risk deviation for this numbered behavior, which should be included in the AI risk level supervision list and cross-deviation verification processing should be carried out;

[0098] By jointly using multi-dimensional indicators such as transaction deviation density, state mutation amplitude, and path deviation, the aggregated result of deviation behaviors has both time intensity, frequency density, and transaction path complexity, improving the comprehensive accuracy and adaptability of identifying abnormal behaviors in the financial market.

[0099] The cross-mark identification sub-module, based on the deviation aggregation value, compares the numbers with the deviation category labels, extracts the co-occurring node pairs in the mapping sequence, analyzes the overlapping feature intervals and behavior differences between the numbers, and establishes a cross-mark behavior set;

[0100] Identifying and analyzing cross-risks and behavior associations in the market, applicable to environments dealing with complex financial products and a large amount of transaction data. For example, when regulatory agencies need to evaluate the associated risks between multiple financial markets or various financial products, cross-mark generation can analyze the transaction behavior deviations between different markets or products. Through in-depth analysis of the deviation aggregation value of behavior deviations, the potential paths of risk contagion can be identified, such as a financial crisis spreading from one market to another, generating a behavior association graph that shows the behavior deviation relationships between different markets or products. This graph helps regulatory agencies understand the interdependencies between markets and potential risk contagion points. Through analysis, a cross-mark behavior set is generated, providing a visual way to help regulatory agencies monitor and manage financial risks at the global level, thereby effectively improving the response ability and early warning mechanism for systemic risks.

[0101] Please refer to Figure 4 , the path clustering evaluation module includes:

[0102] The cross - mark analysis sub - module calls the cross - mark behavior set, extracts the behavior label group within the path, detects the behavior label cross - structure through the combination of path position value and label type, calculates the cross - frequency and position offset value, divides the path behaviors into clusters according to the offset position, and obtains the path behavior cluster frequency value;

[0103] In financial risk assessment, the extraction of the behavior label group can effectively identify potential risk behaviors. Through the combination of path position value and label type, the cross - structure of behavior labels shows the inter - relationship between different behaviors, which is particularly important in identifying complex financial transaction fraud. Calculating the cross - frequency and position offset value is completed through numerical analysis. For example, by comparing the transaction paths of different customers to find abnormal cross - points, dividing the path behaviors into clusters according to the offset position makes the formation of each behavior cluster have a clear statistical basis for risk level determination. Obtaining the path behavior cluster frequency value is obtained through set operations in statistical analysis, specifically calculating the frequency of specific behavior patterns, providing a method for regulatory agencies to quantify risks.

[0104] The violation node mapping sub - module calls the path behavior cluster frequency value, filters out the nodes with a conflict rate higher than the behavior threshold, and re - codes them according to the node number and frequency to generate a standard mapping node set;

[0105] In a practical application in financial risk management, the frequency value is used to distinguish high - risk cases, and the node set within the path cluster is obtained. The screening of nodes is based on a threshold. For example, setting the frequency value as an upper limit of a certain percentage to identify customers with abnormal behaviors. The identification of nodes with a conflict rate higher than the behavior threshold is determined through a specific calculation formula. For example, a frequency value higher than twice the average is considered high - risk. The re - coded nodes not only include digitization but also their position information in the network, such as the re - sorting of node numbers. The processing process is all to simplify the subsequent risk assessment operations and generate a standard mapping node set. The generation of the set is completed through an optimized data - processing flow, such as integrating and optimizing node information through data - mining techniques.

[0106] The risk path aggregation sub - module, based on the standard mapping node set, aggregates the associated path node structure, identifies the node operation sequence number, position sequence, and trigger signal value, and uses the formula:

[0107] ;

[0108] Calculate the path structure correlation degree index, perform block sorting, count the number of paths covered by the block and the node ratio, and construct a risk path aggregation graph;

[0109] Among them, represents the path structure correlation degree index, is the The consistency value of the node operation sequence of the path, is the difference in trigger signals of the path, is the overlap value of the operation sequence of the path, is the number of mapped nodes of the path, is the sum of the trigger signal strengths of all nodes of the path, is the offset behavior mapping strength adjustment factor of the path, is the path node sequence conflict compensation factor, is the total number of paths;

[0110] The path structure correlation index is used to evaluate the correlation between the node operation sequence and the trigger signal in the violation path. By calculating factors such as the consistency of the node operation sequence, the difference in trigger signals, and the overlap of the operation sequence in the path, the correlation degree of the path is obtained, which further helps to identify potential risk paths and nodes. The calculation of this index can reveal the cross - over and complexity of the behaviors in the path, thus quantifying the intensity of risk propagation;

[0111] Aggregate the associated path node structure. In financial risk assessment, first obtain the node operation sequence number, position sequence, and trigger signal value. The data acquisition is completed through real - time monitoring and data analysis. Construct three participation items: the consistency value between paths, the signal difference, and the operation overlap value. The process involves complex data processing techniques, such as using statistical analysis to determine which paths have high - risk characteristics;

[0112] Among them, the specific meanings and acquisition processes of each parameter are as follows:

[0113] : The consistency value of the node operation sequence of the x - th path, obtained by calculating the consistency ratio of the behaviors of each node in the path with the standard behavior model. For example, if there are 10 node behaviors in a path and 9 of them conform to the standard behavior model, then ;

[0114] and : Represent the difference in trigger signals and the overlap value of the operation sequence of the x - th path respectively. The difference in trigger signals can be calculated by measuring the standard deviation of the trigger signals between nodes. The overlap value of the operation sequence is obtained by calculating the overlap degree of the operations within the time window. For example, if the standard deviation of the trigger signals between nodes is 20, then , if 50% of the operations overlap in time, then ;

[0115] : The number of mapping nodes in the x-th path, i.e., the total number of nodes included in this path;

[0116] : The sum of the trigger signal strengths of all nodes in the x-th path, which is the sum of the trigger signal strengths of all nodes within this path;

[0117] and : Respectively, the mapping intensity adjustment factor for the offset behavior of the x-th path and the node sequence conflict compensation factor. The factors are obtained by analyzing historical data. For example, if a path is offset due to a specific type of behavior, a higher value is assigned. If conflicts in the node sequence occur frequently, then the value will be increased to reflect this;

[0118] An example of substituting specific numerical values for calculation:

[0119] Suppose there are the following parameter values: , , , , , , , (total number of paths);

[0120] Calculation process: ;

[0121] This calculation demonstrates how to solve the risk level indicator through the formula using specific numerical parameters , and this numerical value is relatively small, indicating that in this case, the risk level is relatively low. This calculation method can help financial institutions evaluate and manage risks in actual operations.

[0122] Please refer to Figure 5 , the level label correction module includes:

[0123] The risk chain identification sub-module calls the risk path aggregation graph, compares the node order and logic of the illustrated path with the rule chain of the regulatory platform, identifies the risk chains whose structural consistency exceeds the threshold, and generates an artificial intelligence risk path chain set;

[0124] By comparing the illustrated path with the structure and logic of the rule execution chain in the supervision platform through intelligent algorithms, risk chains with matching structures are identified, ensuring that each risk chain is obtained through the consistency comparison of node sequences. The comparison process involves checking the attributes and connection logic of each node to ensure complete coincidence with the chain in the supervision platform. For example, for a certain financial transaction path, check whether each link in its transaction chain is executed in accordance with regulatory requirements. If a node logic mismatch is found, it is marked as a risk node. Then, the chain structure is optimized through the node comparison algorithm to enhance the pertinence and effectiveness of supervision. Finally, an artificial intelligence risk path chain set is generated, which will be used as the basis for subsequent risk level adjustment.

[0125] The level deviation judgment sub-module extracts the chain level labels according to the artificial intelligence risk path chain set, calls the standard level value of the corresponding path in the supervision risk registration template, judges their corresponding positions in the level sequence and analyzes the differences, and generates the AI risk level deviation value.

[0126] Extract the current level label of each chain, call the standard level defined in the supervision risk registration template using the data analysis model, and calculate the deviation between the two by comparing the sequence position relationship between the current marked level and the standard level. For example, when dealing with the AI risk of specific financial services, if the current level of a chain is medium risk and the standard level is high risk, the calculated deviation value is a one-level difference. This calculation process not only considers the base difference of the levels but also involves the probability of risk occurrence and potential impact to ensure the accuracy of risk assessment, thereby generating the AI risk level deviation value. This deviation value is a key parameter for adjusting the supervision strategy.

[0127] The label mapping adjustment sub-module selects the chains with level deviations exceeding the threshold according to the AI risk level deviation value, extracts the level label, risk event frequency, node inference coupling strength, and path conflict quantity, and uses the formula:

[0128] ;

[0129] Calculate the correction amplitude of the AI risk label, and perform mapping reconstruction with the current level label value, identify the label mapping relationship, and generate the level mapping calibration table.

[0130] Among them, represents the correction amplitude of the AI risk label, represents the current level label value, represents the standard level value, represents the risk event trigger frequency, represents the inference coupling strength, represents the AI risk level deviation value, represents the path conflict quantity;

[0131] The correction amplitude of the AI risk label is the result of adjustment based on the deviation between the risk label generated by the AI system on the path and the standard risk template. This amplitude is a correction value calculated by comprehensively considering multi-dimensional factors such as the path trigger frequency, inference coupling strength, and the number of path conflicts, and is used to adjust and optimize the risk assessment label to ensure that the classification and monitoring of risks can be more accurate;

[0132] For risk chains where the level deviation exceeds the judgment threshold, an adjustment operation of the risk level label needs to be performed. Filter out the chain objects that exceed the preset deviation limit (such as the set 3-level deviation threshold) from the AI risk level deviation values, and extract their current marked levels and the standard level in the supervision template The level label is a numerical level score, with the range set from 1 to 5 points. The larger the value, the higher the risk level. Specifically, for example: 1 is low risk, 3 is medium risk, and 5 is high risk. Assume that the current level of chain A is 4 and the corresponding standard level is 2, then , ;

[0133] Subsequently, collect the risk event trigger records of this chain in the past 7 days, and count the frequency as For example, if the risk trigger identified within this chain is 6 times, that is ,and analyze the logical reasoning dependence degree between key nodes in the path to quantify the inference coupling strength Use the normalization coefficient to convert the call frequency and dependence structure between nodes into strength values, set as continuous values between 0 and 10. If there is a high-frequency call relationship and strong data dependence within this path, the inference coupling strength is set to be relatively high. For example ;

[0134] Obtain that the current chain deviation is level 3 from the previously generated AI risk level deviation values, so ,and identify and count the data conflicts caused by this path during operation. For example, if the number of processing exceptions caused by inconsistent model version calls is counted as 2 times, then Substitute the above data into the formula:

[0135] ;

[0136] The obtained risk level correction amplitude is 1.4967. This value indicates that the original level label needs to be raised by approximately 1.5 levels. If the original label level is 4, it should be adjusted to approximately 5.5 levels after correction. Considering that the label upper limit is set to 5, it is set to the highest level 5. Finally, this result is entered into the artificial intelligence risk level label calibration table. All parameters in the above calculation process have been dimensionally unified. For example, the level difference is expressed in level points, the event frequency and the number of conflicts are dimensionless integer values, and the coupling strength is included in the unified evaluation range (0 - 10) after normalization processing. By introducing the square root mechanism of the inference strength and the event frequency, the coupling response to multi-dimensional risk characteristics is more sensitive, effectively reflecting the dynamic risk degree in the chain operation. This result indicates that there is a deviation between the current level of Chain A and the actual risk, and the level label needs to be raised. The adjusted result can be further used as the trigger condition for the regulatory intervention rule.

[0137] Please refer to Figure 6 , the segmented level tracking module includes:

[0138] The level mapping marking sub-module calls the level mapping calibration table, identifies the link number, trigger time, and response time in the process path, extracts the original level value, compares it with the mapped level item, selects the corresponding value, and generates a set of risk level mapping values;

[0139] By calling the link number, trigger time, and response time in the process path, this is to ensure that the activity records of each process link can be accurately matched with the risk level mapping items in the level mapping calibration table. The key execution actions in this process include data matching and re-evaluation of the risk level. By matching the link number with the corresponding item in the mapping calibration table, the original level value of the corresponding link is extracted, and then the risk levels are compared to select the mapped level with the highest matching degree. For example, if the original risk level of a certain process link is level 3, according to the corresponding level 3 risk in the mapping table, the new risk assessment is medium risk. At this time, medium risk will be selected as the final risk level of this link. Through a series of operations, a set of risk level mapping values is finally generated. This result set contains the risk levels adjusted according to the latest risk assessment criteria for each link, providing basic data for the next risk analysis.

[0140] The level trend identification sub-module, based on the set of risk level mapping values, sorts the link number sequence and the response time sequence by number, identifies the differences between adjacent values and judges their positive and negative, marks the growth nodes, extracts the continuous positive difference sequence, records the link number, the total difference, and the number of nodes, eliminates the low-frequency change segments, and generates the number of increasing trend sequences;

[0141] Call link number sequence and its response time sequence, sort the level mapping values in the order of the numbers, and perform difference calculation. The key execution actions include difference analysis and trend marking. For example, if the level mapping values of two consecutive links are level 2 and level 3 respectively, and the calculated difference is 1, it indicates an increasing trend in the risk level. This marking of positive differences helps to identify the upward trend of the risk level. Count all the links with consecutive positive differences, record the link number sequence, total difference, and number of nodes, and screen out those low-frequency change segments, only retaining the high-frequency continuously increasing sequences. Through the processing process, generate the number of increasing trend sequences. This number reflects that during the entire monitoring period, the upward trend of the risk level is obvious, which is an important basis for further analyzing and preventing potential risks.

[0142] The chain screening and aggregation sub-module extracts high-frequency increasing path segments according to the number of increasing trend sequences, identifies the start and end numbers, calculates the cumulative increase and increase rate, and screens out the path segments with a rate exceeding the benchmark value to obtain the segmented risk level supervision path set;

[0143] Perform screening and aggregation of the chain according to the number of increasing trend sequences. The execution process includes the extraction of path segments and risk focusing. Extract the start and end numbers of each link from the high-frequency increasing path segments, and calculate the cumulative increase and increase rate of the path segment level. The key execution actions are comparative analysis and risk screening. For example, if the cumulative increase value of a certain path segment is 5 and the increase rate is 0.5, compare the value with the set benchmark value of the risk level change rate, and screen out those path segments higher than the benchmark value. Through the screening process, obtain the segmented risk level supervision path set. This result set shows the key paths where the risk level rises concentratedly during the entire monitoring period, providing specific operation targets and risk concentration areas for risk management.

[0144] The above is only the preferred embodiment of the present invention, and it is not intended to limit the present invention in other forms. Any person skilled in the art may use the technical content disclosed above to make changes or modifications into equivalent embodiments with equivalent changes and apply them to other fields. However, as long as it does not depart from the technical solution content of the present invention, any simple modification, equivalent change, and modification made to the above embodiments based on the technical essence of the present invention still fall within the protection scope of the technical solution of the present invention.

Claims

1. An artificial intelligence risk level supervision system, characterized in that, The system includes: Based on the time records and positioning coordinates in the transmission link of the financial supervision node, the link anomaly identification module identifies and detects the nodes with spatial position transitions through the time series data stream, screens the node trajectories with transition frequencies exceeding the set threshold, and establishes a node link anomaly map; The behavior pattern mapping module calls the node link anomaly map, extracts the abnormal node numbers and behavior identifiers in the map, correlates the behavior deviation sequences in the traffic instruction nodes, and performs a collection process on the overlapping numbered data sequences to establish a cross-marked behavior set; The path clustering and evaluation module calls the cross-marked behavior set, detects the trigger paths in the violation operation sequences, records and maps the violation judgment nodes, forms a mapping block according to the frequency, and constructs a risk path aggregation graph; The level label correction module calls the risk path aggregation graph, locates the rule execution chain in the intelligent supervision platform that is consistent with the path shown in the graph, extracts the current marked level, compares it with the standard path level in the supervision risk registration template, and adjusts and classifies the chains with inconsistent levels to generate a level mapping calibration table.

2. The artificial intelligence risk level supervision system according to claim 1, characterized in that The node link anomaly map includes transition node numbers, transition frequency thresholds, spatial position change characteristics, link stability parameters, and time series offset indicators. The cross-marked behavior set includes abnormal node numbers, behavior deviation labels, overlapping behavior sequences, behavior feature indexes, and cross-identification marks. The risk path aggregation graph includes violation path numbers, frequency statistical blocks, risk node groups, path level identifiers, and aggregated link labels. The level mapping calibration table includes rule execution chain numbers, current level labels, standard level benchmarks, level deviation values, and correction classification marks.

3. The artificial intelligence risk level supervision system according to claim 1, wherein The link anomaly identification module includes: The time trajectory extraction sub-module identifies the time difference and coordinate difference between consecutive records based on the time records and positioning coordinates in the transmission link of the financial supervision node, screens the record intervals that meet the time jump threshold and spatial jump threshold conditions, and generates a node time position trajectory sequence; The transition node screening sub-module counts the transition frequencies of nodes in different time periods based on the node time position trajectory sequence, determines whether they exceed the transition frequency threshold, screens the corresponding nodes and records the transition time period and spatial change amount, and obtains the high-frequency transition node change rate; The link map construction sub-module calls the high-frequency transition node change rate, identifies the link structure of the transition nodes, determines the connection relationship and transition order, formulates a timing structure according to the transition time period and sets the edge weights, and establishes a node link anomaly map.

4. The artificial intelligence risk level supervision system according to claim 3, characterized in that, The behavior pattern mapping module includes: The node anomaly identification sub-module calls the node link anomaly map, extracts the node numbers and status identifiers, screens the numbers with status mutations and path offsets, analyzes the amplitude of the status mutation and the intensity of the path change, and obtains the node anomaly intensity value; The behavior deviation collection sub-module correlates the marked behavior deviation sequences in the instruction nodes according to the node anomaly intensity value, screens the numbers in the number sequence that coincide with the deviation sequences, extracts the deviation classification, and performs an aggregation and classification. Using the formula: ； Calculate the number deviation aggregation value, merge and classify according to the numerical interval, and obtain the deviation collection quantity value; Among them, represents the aggregated value of number deviation, is the density of the anomaly number of the th category, is the mutation amplitude of the status of the anomaly number of the th category, is the path deviation intensity of the anomaly number of the th category, is the number of occurrences of the anomaly number within the monitoring period, is the start identifier of the th deviation entry in the traffic instruction, is the end identifier of the th deviation entry, is the total number of traffic instruction deviation entries, is the number of types of anomaly numbers; The cross - mark recognition sub - module, based on the deviation aggregation magnitude, compares the numbers with the deviation category labels, extracts the co - occurrence node pairs in the mapping sequence, analyzes the overlapping feature intervals and behavioral differences between the numbers, and establishes a cross - mark behavior set.

5. The artificial intelligence risk level supervision system according to claim 4, characterized in that, The path clustering and evaluation module includes: The cross - mark analysis sub - module calls the cross - mark behavior set, extracts the behavior label groups within the path, detects the cross - structure of the behavior labels through the combination of the path position value and the label type, calculates the cross - frequency and the position offset value, divides the path behavior clusters according to the offset position, and obtains the path behavior cluster frequency value; The violation node mapping sub - module calls the path behavior cluster frequency value, filters out the nodes with a conflict rate higher than the behavior threshold, re - codes them according to the node number and frequency, and generates a standard mapping node set; The risk path aggregation sub - module, according to the standard mapping node set, aggregates the associated path node structures, identifies the node operation sequence number, position sequence, and trigger signal value, and uses the formula: ； Calculate the path structure correlation index, perform block sorting, count the number of paths covered by the block and the node ratio, and construct a risk path aggregation graph; Among them, represents the path structure correlation degree index, is the consistency value of the node operation sequence of the th path, is the trigger signal difference value of the th path, is the operation sequence overlap value of the th path, is the number of mapped nodes of the th path, is the sum of the trigger signal strengths of all nodes of the th path, is the offset behavior mapping strength adjustment factor of the th path, is the path node sequence conflict compensation factor of the th path, is the total number of paths.

6. The artificial intelligence risk level supervision system according to claim 5, characterized in that, The level label correction module includes: The risk chain recognition sub - module calls the risk path aggregation graph, compares the node order and logic of the path shown in the graph with the regulatory platform rule chain, identifies the risk chains with a structural consistency exceeding the threshold, and generates an artificial - intelligence risk path chain set; The level deviation judgment sub - module, according to the artificial - intelligence risk path chain set, extracts the chain level labels, calls the standard level values of the corresponding paths in the regulatory risk registration template, judges their corresponding positions in the level sequence and analyzes the differences, and generates an AI risk level deviation value; The label mapping adjustment sub - module, according to the AI risk level deviation value, selects the chains with a level deviation exceeding the threshold, extracts the level labels, risk event frequencies, node inference coupling strength, and path conflict numbers, and uses the formula: ； Calculate the AI risk label correction amplitude, and perform mapping reconstruction with the current level label value, identify the label mapping relationship, and generate a level mapping calibration table; Among them, represents the correction amplitude of the AI risk label, represents the current level label value, represents the standard level value, represents the triggering frequency of risk events, represents the inference coupling strength, represents the AI risk level deviation value, represents the number of path conflicts.

7. The artificial intelligence risk level supervision system according to claim 1, wherein The system also includes a segmented level tracking module: The segmented level tracking module calls the level mapping calibration table, marks the corresponding risk level values of the link - triggering instructions in the multi - stage process, identifies the distribution trend of the level changes in the instruction conduction path, screens the chains with continuously increasing levels as the risk - concentrated links, and outputs a segmented risk level supervision path set; The segmented risk level supervision path set includes the stage - by - stage risk level, level change trajectory, link - concentrated section, continuous increase identifier, and instruction conduction path mapping.

8. The artificial intelligence risk level supervision system according to claim 7, wherein The segmented level tracking module includes: The level mapping marking sub - module calls the level mapping calibration table, identifies the link numbers, trigger time, and response time in the process path, extracts the original level values and compares them with the mapped level items, selects the corresponding values, and generates a risk level mapping value set; Based on the set of risk level mapping values, the level trend recognition sub-module sorts the sequence of link numbers and the response time sequence according to the numbers, identifies the differences between adjacent values and determines the positive and negative signs, marks the growth nodes, extracts the sequence of continuous positive differences, records the link number, the total difference, and the number of nodes, eliminates the low-frequency change segments, and generates the number of increasing trend sequences; According to the number of increasing trend sequences, the chain screening and aggregation sub-module extracts the high-frequency increasing path segments, identifies the start and end numbers, calculates the cumulative increase and the increase rate, screens the path segments with a rate exceeding the benchmark value, and obtains the set of segmented risk level supervision paths.

Images