Internal control risk dynamic identification method and system based on multi-modal model

Abstract

The invention discloses an internal control risk dynamic identification method and system based on a multi-modal model, and relates to the technical field of risk dynamic identification methods. According to the method, through an unsupervised state transition analysis mode, the hidden abnormal jump paragraph in the behavior mode can be dynamically identified, manual rule setting is not needed, and the self-adaptive capability of risk identification is enhanced; when a time lag problem exists in a multi-modal log, through operation chain backtracking and a virtual calibration mechanism, the time consistency and causal integrity of a cross-modal behavior chain are ensured, and the misjudgment probability caused by record inconsistency is remarkably reduced; a state sequence is mapped into a process topological graph by adopting a sliding matching method, free fragments which cannot be matched structurally are effectively identified, and starting and ending points of risk behaviors can be accurately positioned.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of risk dynamic identification methods, in particular to an internal control risk dynamic identification method and system based on a multi-modal model. BACKGROUND

[0002] With the continuous integration of information technology and internal control management system, internal control risk identification methods based on big data, artificial intelligence and other technologies have become an important support tool for organizational governance. In recent years, domestic and foreign researchers have carried out a large number of research and practical exploration around the structural modeling, semantic understanding and risk detection mechanism of internal control data, especially in data-intensive fields such as administration, medicine and finance. Through the construction of neural network models, rule engines and logical reasoning frameworks, the risk perception and dynamic monitoring of internal processes are significantly improved, which significantly improves the data utilization efficiency and risk response capability. However, the existing technology has problems such as weak multi-modal data collaboration, lack of time sequence rhythm modeling of state change sequence, and difficulty in accurately capturing structural deviation features in dealing with internal control operation processes, which still cannot meet the real-time, accuracy and structural integrity requirements of risk identification in complex business processes.

[0003] CN119989421A proposes an administrative and institutional unit internal control information processing method and system based on big data analysis. By using neural networks to extract semantic embedding features of business domains and information content respectively, and establishing a cross-dimensional joint coding mechanism with context awareness, dynamic association modeling and sensitivity judgment between business semantics are realized, which has certain practical value in information desensitization and data leakage prevention and control. However, this scheme focuses more on joint representation and chain logic relationship modeling at the static semantic level, and does not consider the dynamic rhythm characteristics of data at different time scales. Especially when faced with multi-stage complex operation processes, it lacks effective perception and structural calibration means for time lag and operation breakage and other micro-behavioral abnormalities, so it is difficult to achieve high-sensitivity identification of rhythm abnormalities and structural deviation phenomena in the process, which affects the timeliness and accuracy of risk prompts.

[0004] CN119625784A discloses an automated early warning system and method for hospital risk internal control based on big data, focusing on analyzing the characteristics of crowd behavior trajectories through video surveillance and image processing, thereby realizing feedback identification of abnormal behaviors in hospital passages. This method effectively improves the target monitoring capability under dynamic occlusion, and establishes a behavior early warning model through trajectory characteristics and feedback values, which is suitable for risk detection in specific physical scenarios. However, it is mainly oriented towards image modalities, relying on visual perception and trajectory matrices for risk inference, and is difficult to apply to complex process internal control environments where abstract data modalities such as logs, texts, and forms are collaboratively processed. At the same time, its risk detection logic does not cover the historical status tracing and structural consistency verification of the operation chain, and cannot conduct in-depth modeling and identification of potential operation offsets and mismatch risks at the data dimension and process topology levels. Summary of the Invention

[0005] In view of the problems existing in existing internal control risk identification methods based on semantic modeling or behavioral trajectory perception when facing risk identification in multimodal data interaction and multi-stage operation processes, the present invention is proposed.

[0006] Therefore, the problem to be solved by the present invention is how to extract multimodal shared feature vectors by integrating the attention mechanism, combining unsupervised state transfer modeling and operation chain calibration technology, to achieve accurate recognition of rhythm anomalies, time lags and structural free fragments.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] In the first aspect, the present invention provides a dynamic identification method for internal control risks based on a multimodal model, which includes: using a fusion attention mechanism to extract a set of feature vectors of multimodal shared semantics from data of multiple modalities, and serializing the time dimension to obtain an internal control operation sequence tensor; performing unsupervised state transfer analysis on the internal control operation sequence tensor, identifying rhythm abnormal segments with intervals lower than the global expected window in multi-stage operations, and constructing a state jump graph; based on the state jump graph, when it is found that there is a timestamp lag in the log mode corresponding to any jump path, activating the operation chain backtracking, inserting a virtual calibration node and mounting a label; mapping the calibrated state jump graph to a preset process topology graph, performing subgraph sliding matching of a length of n, and if n consecutive time series state nodes cannot form a connected subgraph in the process topology graph, it is determined to be a structural free fragment and the start and end node indexes are output as risk warning points, where n is a constant.

[0009] As a preferred scheme of the internal control risk dynamic identification method based on the multi-modal model, the multi-modal shared semantic feature vector set is extracted, including: taking the time stamp field as the basis, using a fixed length sliding window strategy to align each modal original data, constructing a synchronous data block sequence, and eliminating fragments with a cross-modal time window overlap rate below a set threshold; the synchronous data block sequence is input into a cross-modal attention network to identify the dominant contribution of key modalities to the behavior characteristics in the current time window at the semantic level, and a shared semantic tensor is generated accordingly to suppress weakly related modal noise.

[0010] As a preferred scheme of the internal control risk dynamic identification method based on the multi-modal model, the non-supervised state transition analysis includes: window segmentation processing the internal control operation sequence tensor along the time dimension, calculating the operation state cluster center in each segment using an adaptive clustering distance function, and generating a time sequence state node set; based on the time sequence state node set, a state transition candidate graph is constructed in a non-supervised manner, wherein each edge is set according to the node operation order and the behavior variation degree.

[0011] As a preferred scheme of the internal control risk dynamic identification method based on the multi-modal model, the construction of the state jump graph includes: according to the global expected window length, performing rhythm coherence constraint detection on the state transition candidate graph, and marking any state jump interval below the global expected window as an abnormal jump edge; the state transition candidate graph containing the abnormal jump edge is subgraph cropped, and fragments with insufficient continuous non-abnormal edges below the cropping threshold are removed, and a structured state jump graph is output.

[0012] As a preferred scheme of the internal control risk dynamic identification method based on the multi-modal model, the activated operation chain backtracking includes: based on the state jump graph, extracting the log modality timestamp sequence associated with each abnormal jump edge, calculating the cross-modal lag matrix after aligning the timestamp field, and identifying the lag jump path with a time lag higher than the ratio threshold; for the lag jump path, recursively search from the starting node, and extract the shortest path segment with continuous abnormal jump edges as the backtracking sub-chain.

[0013] As a preferred scheme of the internal control risk dynamic identification method based on the multi-modal model, the insertion of the virtual calibration node and the mounting of the label include: in the backtracking sub-chain, determining the weakest modality paragraph position, inserting a virtual calibration node with a time interpolation mark, and attaching a corresponding modality type label and a delay estimation value to the node; the backtracking sub-chain structure after inserting the virtual calibration node is mapped back and updated to the state jump graph, forming a calibrated state jump graph.

[0014] As a preferred solution of the method for dynamic identification of internal control risks based on a multimodal model described in the present invention, the mapping of the calibrated state jump diagram to a preset process topology diagram includes: extracting time series state nodes arranged in chronological order from the calibrated state jump diagram, and constructing a sliding sub-path set consisting of n continuous state nodes in a sliding window manner with a fixed length n; for each sliding sub-path, searching in sequence in the process structure diagram for a path with a consistent node order and any adjacent nodes having a direct directed edge connection in the process structure diagram.

[0015] In the second aspect, the present invention provides a dynamic identification system for internal control risks based on a multimodal model, which includes: a semantic extraction module, which uses a fusion attention mechanism to extract a set of feature vectors of multimodal shared semantics from data of multiple modalities, and serializes the time dimension to obtain an internal control operation sequence tensor; a state analysis module, which performs unsupervised state transfer analysis on the internal control operation sequence tensor, identifies rhythm abnormal segments with intervals lower than the global expected window in multi-stage operations, and constructs a state jump graph; a backtracking calibration module, based on the state jump graph, activates operation chain backtracking, inserts virtual calibration nodes and mounts labels when it is found that there is a timestamp lag in the log mode corresponding to any jump path; a structure detection module, which maps the calibrated state jump graph to a preset process topology graph, performs subgraph sliding matching of a length of n, and if n consecutive time series state nodes cannot form a connected subgraph in the process topology graph, it is determined to be a structural free fragment and the start and end node indexes are output as risk warning points, where n is a constant.

[0016] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, the steps of the method for dynamic identification of internal control risks based on a multimodal model as described in the first aspect of the present invention are implemented.

[0017] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, the steps of the method for dynamic identification of internal control risks based on a multimodal model as described in the first aspect of the present invention are implemented.

[0018] The beneficial effects of the present invention are as follows: the present invention can dynamically identify abnormal jump sections hidden in behavioral patterns through unsupervised state transition analysis, without relying on manually set rules, thereby enhancing the adaptive ability of risk identification; when there is a time lag problem in multimodal logs, the time consistency and causal integrity of the cross-modal behavior chain are ensured through the operation chain backtracking and virtual calibration mechanism, which significantly reduces the probability of misjudgment due to inconsistent records; the sliding matching method is used to map the state sequence to the process topology diagram, effectively identifying free fragments that cannot be matched in the structure, and accurately locating the starting and ending points of risky behaviors. In summary, the present invention has high adaptability, high robustness and high interpretability, and provides strong technical support for the dynamic identification of internal control risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 This is a flow chart of the dynamic identification method of internal control risks based on multimodal models.

[0021] Figure 2 This is the structural diagram of the internal control risk dynamic identification system based on the multimodal model. DETAILED DESCRIPTION

[0022] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0023] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0025] As mentioned in the above background technology, in recent years, domestic and foreign researchers have conducted extensive research and practical exploration around the structural modeling, semantic understanding, and risk detection mechanisms of internal control data. This is especially true in data-intensive fields such as administration, healthcare, and finance. By building neural network models, rule engines, and logical reasoning frameworks, they can perceive and dynamically monitor internal processes for risk, significantly improving data utilization efficiency and risk response capabilities. However, existing technologies have problems in responding to internal control operations, such as weak multimodal data collaboration, lack of temporal rhythm modeling of state change sequences, and difficulty in accurately capturing structural deviation features. These problems make it difficult to meet the requirements for real-time, accurate, and structural integrity in risk identification in complex business processes.

[0026] Figure 1 The flowchart of the method for dynamic identification of internal control risk based on multimodal model according to an embodiment of the present application is shown. Figure 1 As shown, in the method for dynamically identifying internal control risks based on a multimodal model in an embodiment of the present invention, the method includes:

[0027] S1: Use the fusion attention mechanism to extract the multi-modal shared semantic feature vector set from the data of multiple modalities, and serialize the time dimension to obtain the internal control operation sequence tensor.

[0028] First, for approval logs, behavior trajectories, operation timestamps and video surveillance data, a modal index set is constructed based on the collection source, structural dimension and timestamp field; based on the timestamp field in the modal index set, a fixed-length sliding window strategy is adopted to align the original data of each modality, construct a synchronized data block sequence, and eliminate fragments whose cross-modal time window overlap rate is lower than the set threshold.

[0029] Traditional methods often use timestamps directly for approximate alignment, but this method can easily lead to a large amount of time drift or loss of modal information in asynchronously collected data scenarios. The present invention calculates the overlap of modal data in each synchronized data block. If it is found that the data coverage ratio of any modality in the time window is lower than a preset value (such as 40%), the time window is automatically marked as a low-credibility window and eliminated. This operation not only improves the robustness of subsequent semantic fusion, but also effectively avoids the feature bias problem caused by the lack of modal data.

[0030] Furthermore, the synchronized data block sequence is input into a cross-modal attention network to identify the dominant contribution of key modalities to the behavioral features in the current time window at the semantic level, and a shared semantic tensor is generated accordingly to suppress weakly correlated modal noise.

[0031] In practice, approval logs are first converted into text embedding vectors, behavioral trajectories into displacement pattern vectors, and video frames are extracted into visual feature vectors, all of which are uniformly encoded into the same feature space. Then, based on the attention interaction mechanism between modalities, the modal combination that dominates behavioral information within a certain time window is automatically identified. This generates a shared semantic tensor, minimizing the interference effect of irrelevant or weakly related modalities.

[0032] Finally, the shared semantic tensor is input into a temporal perception network with a residual gating structure to preserve the changes in behavioral patterns across time periods, and finally outputs an internal control operation sequence tensor.

[0033] It should be noted that, since user behavior has the characteristics of temporal variation, if each window is directly analyzed in isolation, it will be difficult to reveal the behavioral evolution trend of risk events. To this end, the present invention inputs the shared semantic tensor into a time-aware network with a residual gating structure to realize the sequence modeling of the shared semantic tensor in the time dimension. The time-aware network integrates the bidirectional gated recurrent unit (Bi-GRU) and the residual connection module. On the one hand, it can capture the evolution characteristics of the behavior pattern over time. On the other hand, it retains the original feature information through the residual mechanism to avoid the gradient dissipation problem caused by deep time series modeling. In this network, each shared semantic tensor is regarded as a time step vector in the time series, and multiple time windows are spliced ​​to form an input sequence; the time-aware network uses a bidirectional propagation mechanism to capture the previous and next dependencies, thereby enhancing the model's ability to express changes in complex behavior patterns. The final network output is the internal control operation sequence tensor, which has good time continuity and context perception while maintaining the semantic expression of behavior.

[0034] S2: Perform unsupervised state transition analysis on the internal control operation sequence tensor to identify rhythm abnormal segments with intervals lower than the global expected window in multi-stage operations and construct a state jump graph.

[0035] S2.1: The internal control operation sequence tensor is segmented along the time dimension, and the center of the operation state cluster is calculated using the adaptive clustering distance function in each segment to generate a set of time series state nodes.

[0036] Specifically, the segmentation process involves extracting local operational features within each global expectation window and dividing it into subsequences. The step size of the sliding window is set to half the length of the global expectation window to ensure overlap between segments, thereby improving sequence coherence and contextual consistency.

[0037] The adaptive clustering distance function not only considers the Euclidean distance between semantic vectors but also incorporates a modal weight adjustment term, giving feature dimensions with higher modal credibility in the semantic vectors a higher weight in the cluster. This design has the advantage of giving greater influence to highly relevant modalities (such as operation logs) while suppressing the interference of low-quality modalities (such as partially blurred video frames) on the clustering results. Ultimately, each time period will have a cluster center node representing the state center, forming a time series state node set.

[0038] S2.2: Based on the set of time series state nodes, an unsupervised approach is used to construct a state transition candidate graph. Each edge is weighted based on the order of operations and the variability of behavior between nodes, and the influence of multimodal heterogeneity is balanced based on the entropy weight coefficient. The specific steps are as follows:

[0039] S2.2.1: Based on the generated time series state node set, construct the initial state connection path according to the time order of the state nodes in the operation sequence as the backbone structure of the state transition candidate graph.

[0040] Among them, the nodes in the state transition candidate graph correspond to the centers of each state cluster, and the edges represent the jump behaviors in the operation sequence. Under unsupervised conditions, the nodes are first sorted according to their timestamps, and the time of each node is t i , if t i <t i+1 , then build an edge.

[0041] S2.2.2: For any pair of adjacent state nodes, set the edge weights of state jumps based on the weighted Mahalanobis distance metric, highlighting jump edges with lower behavioral similarity.

[0042] It's important to note that edge weight calculation is based on a weighted Mahalanobis distance function, which can better capture behavioral deviations within a covariance structure. A larger calculated value indicates a significant difference in the behavioral characteristics of the two states, and should be considered as a key edge for detection. This mechanism automatically amplifies behavioral differences between potentially abnormal operations.

[0043] S2.2.3: In the state transition candidate graph, remove redundant edges whose edge weights are lower than the set threshold and retain state jump paths with high information gain to enhance the boundary clarity of subsequent rhythm anomaly detection.

[0044] To avoid overly complex graph structures, a minimum edge weight threshold is set. Edges with weights below the threshold are considered low-information-gain paths and removed. This step not only reduces the size of the state graph but also improves the efficiency and accuracy of subsequent graph traversals, helping to clearly visualize the boundaries of rhythmic anomalies.

[0045] S2.3: Based on the global expected window length, perform rhythmic continuity constraint detection on the state transition candidate graph and mark any edge with a state jump interval lower than the expected window as an abnormal jump edge, including the following operations:

[0046] S2.3.1: From the generated state transition candidate graph, extract all state jump edges with direct connections, record the time interval corresponding to each edge, that is, the time step difference between the source node and the target node in the original time series, and construct a jump time interval set.

[0047] S2.3.2: Based on the global expected window length parameter Δτ, compare the jump time interval set edge by edge, filter out all jump edges that are less than Δτ and mark them in the graph.

[0048] Specifically, the setting process of the global expected window length parameter Δτ is as follows:

[0049] By counting the central time intervals of adjacent data blocks in the synchronization data block sequence to form a rhythm interval set, and performing mean or median statistics on the rhythm interval set, we can obtain the global expected window length parameter Δτ, which is used to characterize the average rhythm level of modal synchronization behavior in the current task scenario.

[0050] S2.3.3: For edges marked as abnormal rhythm jumps, differentiated level labels are assigned to the abnormal edges based on the edge weight strength of the connecting nodes and the node modal labels to enhance the stability of boundary recognition in subsequent structure trimming.

[0051] Among them, the determination of the differentiation level of abnormal edges includes: first calculating the mean and standard deviation of all edge weights; for each edge that has been marked as an abnormal rhythm jump, judging the difference between the edge weight and the average edge weight; if the edge weight is significantly higher than the average, it means that the edge is abnormally strong in structure and may represent an abnormal high-frequency jump; if the edge weight is far lower than the average, it means that the edge may be abnormally weak in structure and may represent a discontinuous mutation; if the two nodes come from different modes, it means that there is a cross-modal jump on this edge, and the stability of the information flow is poor, so vigilance should be increased; if the two nodes come from the same mode, it means that this jump is an abnormal connection within the mode and is relatively stable; if an edge weight is significant (i.e., it deviates significantly from the mean) and the connection mode is inconsistent, the corresponding edge should be assigned a high-level abnormality label; if the edge weight does not change much and the mode is consistent, the corresponding edge is considered to have a low abnormality level; if only one of them is significant, it is assigned a medium-level label.

[0052] S2.4: Perform subgraph pruning on the state transition candidate graph containing abnormal jump edges, remove the segments where the number of continuous non-abnormal edges is less than the pruning threshold, and finally output the structured state jump graph.

[0053] S3: Based on the state jump graph, when a timestamp lag is found in the log mode corresponding to any jump path, the operation chain backtracking is activated, a virtual calibration node is inserted, and a label is attached.

[0054] S3.1: Based on the state transition graph, extract the log modal timestamp sequence associated with each abnormal transition edge, align it with the timestamp field, calculate the cross-modal lag matrix, and identify the lag transition paths with time lag higher than the ratio threshold.

[0055] During field alignment, a synchronous time synchronization mechanism is employed to address issues such as inconsistent time units and varying recording granularity across modalities. After alignment, the time interval between the source and target nodes in the log mode is calculated and combined with the corresponding time differences in other modalities (such as operation trajectory and video frame) to form a cross-modal lag matrix. Each element in the cross-modal lag matrix represents the degree of lag in the log mode relative to other modalities along a particular jump path.

[0056] Among them, the ratio threshold is set as the maximum alignment offset of different signals / the span of the same behavior time window. In cross-modal data alignment research (such as multi-sensor data fusion, modal synchronization, video-speech alignment, etc.), a lag ratio of 0.2 to 0.3 is often considered to have caused obvious information dislocation, and the ratio threshold is set accordingly.

[0057] S3.2: For delayed jump paths, recursively search forward from the starting node and extract the shortest path segment with continuous abnormal jump edges as the backtracking subchain to avoid computational redundancy caused by traversing the entire graph.

[0058] The specific approach is to start from the source node of the delayed jump edge, trace back all upstream nodes with connected relationships along the graph structure, and limit the tracing to only those edges that are also marked as abnormal jumps. During the tracing process, every time an abnormal edge is encountered, the two end nodes are included in the candidate backtracking path set; if a non-abnormal edge is encountered or the path tracing depth limit (such as no more than 5 jumps) is reached, the recursive branch is terminated. In this way, a shortest path segment consisting of continuous abnormal jump edges can be effectively extracted to form a local backtracking subchain. This backtracking subchain not only covers the key links where the cumulative effect of time lag may occur, but also avoids the time and space complexity problems brought by the full graph search.

[0059] S3.3: In the backtracking subchain, determine the position of the weakest modal segment, insert a virtual calibration node with a time interpolation marker, and attach the corresponding modal type label and delay estimate to the node.

[0060] In this embodiment of the present invention, the location of the weakest modal segment is determined through a weighted calculation of modal data's timestamp coverage density, number of synchronization events, consistency deviation, and data integrity, quantitatively assessing the time synchronization capabilities of different modalities on the same operational path. This calculation identifies the modal segment with the lowest synchronization confidence within the backtracking subchain, i.e., the operational segment most susceptible to lag or misalignment.

[0061] A virtual calibration node is inserted at the corresponding paragraph. This virtual calibration node does not represent a real-world operation, but rather serves as a structural placeholder to indicate a possible synchronization breakpoint on the timeline. The virtual calibration node is loaded with the following three attributes: a time interpolation tag, which indicates where the node should be pushed to compensate for the synchronization delay; a modal type tag, which records the mode the node affects; and a delay estimate, which is the time difference calculated based on the cross-modal lag matrix of the previous and next nodes.

[0062] S3.4: Map the backtracking subchain structure after inserting the virtual calibration node back to and update the state jump graph to form a calibrated state jump graph.

[0063] In the embodiment of the present invention, the original jump edges need to be trimmed and replaced during the mapping process.

[0064] Specifically, for any original jump edge, if a virtual calibration node is inserted in the middle, it must be split into two new edges. The weights of these two new edges inherit a portion of the original edge's value and are compensated based on the delay estimate. At the same time, to ensure the directedness and temporal consistency of the graph structure, an updated topological sorting index must be maintained to assist with path planning and rhythm anomaly detection.

[0065] The calibrated state transition graph not only has the ability to correct the structure of the lagged mode, but also improves the graph model's ability to perceive and adjust multimodal time mismatch through the label information of virtual nodes.

[0066] S4: Map the calibrated state jump graph to the preset process topology graph, perform subgraph sliding matching of length n, and if n consecutive time series state nodes cannot form a connected subgraph in the process topology graph, it is determined to be a structural free fragment and the start and end node indexes are output as risk warning points, where n is a constant.

[0067] S4.1: Extract the time series state nodes arranged in chronological order from the calibrated state jump graph, and construct a sliding subpath set consisting of n consecutive state nodes in a sliding window manner with a fixed length n.

[0068] It should be noted that n is set so that the average time span of the sliding subpath is not less than the global expected window to avoid mismatching with the rhythm judgment result.

[0069] S4.2: For each sliding sub-path, search the process structure diagram in sequence for a path with consistent node order and any adjacent nodes connected by a direct directed edge in the process structure diagram; if during the mapping process any node cannot be mapped one-to-one to a node in the process structure diagram, or there is no valid topological edge connection between adjacent nodes, the corresponding sliding sub-path will be marked as a structurally disconnected segment.

[0070] For example, for each sliding sub-path, the following verification logic is executed in sequence in a preset process topology diagram (the diagram is a static directed graph that represents the expected business or device behavior process):

[0071] Determine whether each state node in the sliding subpath can find a unique corresponding node in the process topology graph; if all nodes have corresponding points, then check in sequence whether the adjacent nodes in the sliding path are connected by direct directed edges in the process graph; if there is any node that has no mapping corresponding in the process graph, or if the adjacent nodes have no topological connection edges in the process graph, then the sliding subpath is marked as a structurally disconnected segment; otherwise, the path is considered to be consistent with the process graph structure and is an expected behavior path.

[0072] The core of the above operations of the present invention is to remove non-process behaviors through structural consistency verification and construct candidate areas of structural anomalies.

[0073] S4.3: When k consecutive sliding subpaths are judged to be structurally disconnected segments, and at least one of them contains a state node that originates from a calibration insertion node, the corresponding subpath is marked as a structurally free segment, and the corresponding start and end node indexes are output as risk warning points.

[0074] To improve the robustness of anomaly recognition and avoid oversensitivity to occasional structural drift, a joint constraint of continuity and calibration nodes is performed. The specific process is as follows:

[0075] If k (e.g., k = 3) structurally disconnected segments appear consecutively, the consecutive segments are considered candidate structural anomaly areas. In the aforementioned consecutive disconnected segments, if at least one state node originates from the virtual calibration node inserted in the S3 stage, or any subpath contains ≥1 rhythmic anomaly edges and the differentiation level of the anomaly edges is medium or high, the anomaly is considered to be more likely caused by synchronous offset propagation caused by modal mismatch. The set of subpaths that meet the above two conditions is integrated into a structurally free segment. The indexes of the starting and ending nodes in the segment in the original state time series are output as risk prompt points to indicate potential behavioral deviation risks.

[0076] Through the above operations, segments that still have structural derailment behavior after modal calibration can be effectively identified, especially sub-paths with continuous structural drift before and after the calibration node, which are often an important manifestation of the synchronization deviation in multimodal time series fusion not being completely eliminated.

[0077] Furthermore, this embodiment also provides a dynamic identification system for internal control risks based on a multimodal model, such as Figure 2 Shown, including,

[0078] The semantic extraction module 100 extracts a set of feature vectors of multimodal shared semantics from data of multiple modalities using a fusion attention mechanism, and serializes the time dimension to obtain an internal control operation sequence tensor;

[0079] The state analysis module 200 performs unsupervised state transition analysis on the internal control operation sequence tensor, identifies rhythm abnormal segments whose intervals are lower than the global expected window in the multi-stage operation, and constructs a state jump graph;

[0080] The backtracking calibration module 300, based on the state jump graph, activates the operation chain backtracking, inserts a virtual calibration node and attaches a label when it finds that the timestamp lag exists in the log mode corresponding to any jump path;

[0081] The structure detection module 400 maps the calibrated state jump diagram to the preset process topology diagram, performs subgraph sliding matching of length n, and if n consecutive time series state nodes cannot form a connected subgraph in the process topology diagram, it is determined to be a structural free fragment and the start and end node indexes are output as risk warning points, where n is a constant.

[0082] This embodiment also provides a computer device, which is suitable for the case of a dynamic identification method of internal control risks based on a multimodal model, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the dynamic identification method of internal control risks based on a multimodal model proposed in the above embodiment.

[0083] The computer device may be a terminal, comprising a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a button, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse.

[0084] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for dynamically identifying internal control risks based on a multimodal model as proposed in the above embodiment is implemented.

[0085] In summary, the present invention can dynamically identify abnormal jump sections hidden in behavioral patterns through unsupervised state transition analysis, without relying on manually set rules, thereby enhancing the adaptive ability of risk identification; when there is a time lag problem in multimodal logs, the operation chain backtracking and virtual calibration mechanism ensures the time consistency and causal integrity of the cross-modal behavior chain, significantly reducing the probability of misjudgment due to inconsistent records; the sliding matching method is used to map the state sequence to the process topology diagram, effectively identifying structurally unmatched free fragments, and accurately locating the starting and ending points of risky behaviors. In summary, the present invention has high adaptability, high robustness, and high interpretability, and provides strong technical support for the dynamic identification of internal control risks.

[0086] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A dynamic identification method for internal control risks based on a multimodal model, characterized by: include: The fusion attention mechanism is used to extract the feature vector set of multimodal shared semantics from the data of multiple modalities, and the time dimension is serialized to obtain the internal control operation sequence tensor; Perform unsupervised state transition analysis on the internal control operation sequence tensor to identify rhythm abnormal segments with intervals below the global expected window in multi-stage operations and construct a state jump graph; Based on the state transition graph, if a timestamp lag is found in the log mode corresponding to any transition path, the operation chain backtracking is activated, a virtual calibration node is inserted, and a label is attached. The calibrated state jump graph is mapped to the preset process topology graph, and a subgraph sliding matching of length n is performed. If n consecutive time series state nodes cannot form a connected subgraph in the process topology graph, it is determined to be a structural free fragment and the start and end node indexes are output as risk warning points, where n is a constant.

2. The method for dynamic identification of internal control risks based on a multimodal model according to claim 1, characterized in that: The extracting of a multimodal shared semantic feature vector set includes: Based on the timestamp field, a fixed-length sliding window strategy is used to align the raw data of each modality, construct a synchronized data block sequence, and remove segments with a cross-modal time window overlap rate below a set threshold. The synchronized data block sequence is input into the cross-modal attention network to identify the dominant contribution of the key modality to the behavioral features in the current time window at the semantic level, and a shared semantic tensor is generated accordingly to suppress weakly correlated modal noise.

3. The method for dynamic identification of internal control risks based on a multimodal model according to claim 1, characterized in that: The unsupervised state transition analysis includes: The internal control operation sequence tensor is segmented along the time dimension, and the center of the operation state cluster is calculated in each segment using the adaptive clustering distance function to generate a set of time series state nodes. Based on the set of time series state nodes, an unsupervised approach is used to construct a state transition candidate graph, where the weight of each edge is set according to the operation sequence and behavior variability between nodes.

4. The method for dynamic identification of internal control risks based on a multimodal model according to claim 3, characterized in that: The construction of the state transition diagram includes: Based on the global expected window length, rhythmic continuity constraint detection is performed on the state transition candidate graph, marking any edge with a state jump interval lower than the global expected window as an abnormal jump edge; The state transition candidate graph containing abnormal jump edges is sub-graph pruned, and the segments with continuous non-abnormal edges less than the pruned threshold are removed to output a structured state jump graph.

5. The method for dynamic identification of internal control risks based on a multimodal model according to claim 1, characterized in that: The activation operation chain backtracking includes: Based on the state transition graph, the log modal timestamp sequence associated with each abnormal transition edge is extracted, aligned with the timestamp field, and the cross-modal hysteresis matrix is ​​calculated to identify the hysteresis transition paths with a time lag higher than the ratio threshold. For the delayed jump path, a recursive search is performed forward from the starting node to extract the shortest path segment with continuous abnormal jump edges as the backtracking subchain.

6. The method for dynamic identification of internal control risks based on a multimodal model according to claim 5, characterized in that: Inserting the virtual calibration node and mounting the label includes: In the backtracking subchain, the weakest mode segment position is determined, a virtual calibration node with a time interpolation marker is inserted, and the corresponding mode type label and delay estimate are attached to the node; The backtracking subchain structure after inserting the virtual calibration node is mapped back and the state jump graph is updated to form the state jump graph after calibration.

7. The method for dynamic identification of internal control risks based on a multimodal model according to claim 1, characterized in that: Mapping the calibrated state transition diagram to a preset process topology diagram includes: Extract the time series state nodes arranged in chronological order from the calibrated state transition graph, and construct a sliding subpath set consisting of n consecutive state nodes in a sliding window manner with a fixed length n; For each sliding sub-path, the nodes in the process structure graph are searched sequentially in the same order, and any adjacent nodes are directly connected by directed edges in the process structure graph.

8. A system for dynamically identifying internal control risks based on a multimodal model, based on the method for dynamically identifying internal control risks based on a multimodal model according to any one of claims 1 to 7, characterized in that: Also includes: The semantic extraction module uses a fusion attention mechanism to extract a set of feature vectors of multimodal shared semantics from data of multiple modalities, and serializes the time dimension to obtain an internal control operation sequence tensor; The state analysis module performs unsupervised state transition analysis on the internal control operation sequence tensor, identifies rhythm abnormal segments with intervals below the global expected window in multi-stage operations, and constructs a state jump graph; The backtracking calibration module, based on the state jump graph, activates the operation chain backtracking when it finds a timestamp lag in the log mode corresponding to any jump path, inserts a virtual calibration node, and attaches a label. The structure detection module maps the calibrated state jump diagram to the preset process topology diagram and performs subgraph sliding matching of length n. If n consecutive time series state nodes cannot form a connected subgraph in the process topology diagram, it is judged as a structural free fragment and the start and end node indexes are output as risk warning points, where n is a constant.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the processor implements the steps of the method for dynamically identifying internal control risks based on a multimodal model as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for dynamic identification of internal control risks based on a multimodal model according to any one of claims 1 to 7 are implemented.

Images