An authorized operation chain tracing system and method based on online process

Abstract

The application discloses an authorized operation chain tracing system and method based on an online process, and relates to the technical field of data analysis.The method comprises the following steps: collecting data of each stage of the authorized operation chain, determining the data integrity and task completion threshold, and transmitting the data to the next stage if the threshold is met; extracting each stage case and feature from the chain history abnormal record, standardizing the cases and features, and training a baseline model using random forest; when an abnormality is monitored, collecting real-time features to calculate the initial and corrected abnormal probability, executing the target stage if the probability meets the threshold, checking whether the abnormality is self-induced if the threshold is not met, and otherwise finding the previous stage; preferentially checking the previous stage that has the greatest impact on the target stage, identifying and adjusting the features that affect the previous stage to the normal range, excluding the previous stage if the previous stage is restored, and checking whether the target stage abnormal probability meets the threshold; if the threshold is not met or the previous stage is not restored, repeating the checking and adjusting until the target stage abnormal probability is lower than the preset abnormal threshold, and the application realizes authorized operation chain tracing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data analysis, in particular to an authorized operation chain tracing system and method based on online process. BACKGROUND

[0002] With the acceleration of digital transformation, the authorized operation of enterprises gradually forms a multi-stage online operation chain covering all stages, and full-process tracing is the demand to ensure the compliance of authorized business and prevent abnormal risks, which affects the safety, compliance and efficiency of enterprise operation;

[0003] However, the existing authorized operation chain tracing method has many problems and cannot meet the fine and intelligent tracing needs of enterprises: first, data collection and transmission are not standardized, and the tracing foundation is weak. In the traditional process, the data of each stage is scattered in different systems, and the collection is not real-time and complete, and there is a lack of unified data completeness and task completion degree judgment standard, often resulting in data missing and delayed transmission problems; second, abnormal positioning relies on manual work, which is low in efficiency and poor in accuracy. After monitoring the abnormality, each stage needs to be checked one by one, which cannot quantify the abnormal risk of each stage and cannot consider the derivative influence of the previous stage on the subsequent stage, making it difficult to quickly lock the core root cause; in addition, although some existing tracing schemes have basic automation functions, they do not combine machine learning models to build the quantitative relationship between features and abnormal probability, cannot calculate the abnormal risk of each stage, and lack a correction mechanism for the derivative influence of the previous stage, so the abnormal positioning still stays at the surface stage and it is difficult to trace the root cause of the abnormality. SUMMARY

[0004] The purpose of the present application is to provide an authorized operation chain tracing system and method based on online process to solve the problems in the prior art.

[0005] To achieve the above purpose, the present application provides the following technical scheme: an authorized operation chain tracing method based on online process, the method comprising the following steps:

[0006] Collecting data of each stage of the authorized operation chain, calculating the data completeness and task completion degree of the current stage, and determining based on the set threshold value. If the data completeness and task completion degree indicators of the current stage are greater than or equal to the set threshold value, the data of the current stage is transmitted to the next stage;

[0007] Based on the historical abnormal records stored on the authorized operation chain, the abnormal and non-abnormal cases and corresponding features of each stage are extracted, the features are standardized, and a baseline model is trained using a random forest model; when an abnormality is monitored, the features of each stage are collected in real time and substituted into the baseline model to obtain an initial abnormal probability, and the abnormal probability obtained after correction according to the initial abnormal probability;

[0008] If the abnormal probability of the target stage after correction is less than the preset abnormal threshold, the target stage is executed; if the abnormal probability of the target stage after correction is greater than or equal to the preset abnormal threshold, it is verified whether it is abnormal by itself, and if yes, it is the root cause of the abnormality, and if not, the previous stage thereof is found;

[0009] The previous stage of the screening target stage is preferentially investigated, the features affecting the previous stage are identified and adjusted to a normal range, and if the previous stage is restored, the target stage is excluded and the abnormal probability of the target stage is checked; if it does not meet the standard or the previous stage is not restored, the investigation and adjustment are repeated until the abnormal probability of the target stage is lower than the preset abnormal threshold.

[0010] Real-time collection of data of each stage of the authorized operation chain, and calculation of data completeness and task completion of the current stage, based on the set threshold for judgment, if the data completeness and task completion of the current stage are greater than or equal to the set threshold, the data of the current stage is transmitted to the next stage, the specific steps include:

[0011] Real-time collection of data of each stage of the authorized operation chain, including operation behavior log, involved authorized proof file storage, data volume to be submitted at each stage, submitted data volume meeting the requirements, received data volume and processed data volume meeting the standards, the collected data of each stage of the authorized operation chain is denoted as {s1, s2,..., sn}; wherein s1, s2,..., sn represent the data of the 1st, 2nd,..., nth stage, n represents the number of stages of the authorized operation chain, wherein the submitted data volume meeting the requirements means that the submitted data meets the requirements of data security and personal information protection in terms of compliance with laws and regulations and management specifications of the authorized operation chain corresponding to the stage; the processed data volume meeting the standards means that the data processing meets the judgment criteria in terms of compliance with laws and regulations and management specifications of the authorized operation chain corresponding to the stage;

[0012] Based on the submitted data volume meeting the requirements and the data volume to be submitted at the current stage, the data completeness Di of the current stage is calculated as Di=D(i,1) / D(i,0)*100%; wherein D(i,1) represents the submitted data volume meeting the requirements of the ith stage, i represents the stage number of the authorized operation chain, i=1, 2,..., n, and D(i,0) represents the data volume to be submitted at the ith stage;

[0013] The stage data completeness threshold is defined in advance, and the threshold is used to determine the data completeness of the current stage of the authorized operation chain; if the data completeness of the current stage of the authorized operation chain is greater than or equal to the preset stage data completeness threshold, it is determined that the data completeness of the current stage meets the standard, and the data of the current stage is transmitted to the next stage, otherwise it is determined that the data of the current stage is missing, and the data correction process is triggered;

[0014] Calculate the task completion degree of the current stage Ri=R(i,1) / R(i,0)*100% based on the amount of data processed in the current stage that meets the standard and the amount of data received; wherein R(i,1) represents the amount of data processed in the i th stage that meets the standard, and R(i,0) represents the amount of data received in the i th stage;

[0015] A threshold value of the task completion degree of the stage is defined, and threshold value judgment is performed on the task completion degree of the current authorized operation chain stage based on the threshold value; if the task completion degree corresponding to the current authorized operation chain stage is greater than or equal to the preset threshold value of the task completion degree of the stage, it is judged that the task completion degree of the current stage meets the standard, and the data transmission of the current stage is transmitted to the next stage, otherwise it is judged that the task completion degree of the current stage does not meet the standard, and a task re-execution or reason troubleshooting process is triggered.

[0016] In the historical abnormal record stored in the authorized operation chain, the abnormal and non-abnormal cases of each stage and the corresponding features are extracted, and after standardization processing of the features, a baseline model that can predict the abnormal probability through the features is trained by using a random forest model; when an abnormality is monitored, the features of each stage are collected in real time and substituted into the baseline model to obtain an initial abnormal probability, and the abnormal probability obtained after correction according to the initial abnormal probability, the specific steps include:

[0017] Based on the abnormal processing record stored in the authorized operation chain, the historical abnormal cases of each stage, the feature variable value corresponding to each abnormality, and the feature variable value of the non-abnormal case are extracted;

[0018] The extracted feature variable values are standardized processed;

[0019] A random forest model is used, the stage is abnormal or not is taken as a label, the label is set to 1 when the stage is abnormal, and the label is set to 0 when the stage is normal, the standardized processed feature variable values are taken as inputs, and a baseline model of “feature variable→abnormal probability” is trained;

[0020] When the authorized operation chain monitors an abnormal signal, the feature variable values of the current stages are collected in real time, the real-time feature variable values are substituted into the baseline model of the corresponding stage, the abnormal probability of each stage is calculated, and the initial abnormal probability of each stage is obtained;

[0021] Based on the historical data statistics, the probability that the abnormality of stage i leads to the abnormality of stage j is calculated as the correlation weight W(i→j), which is defined as follows: W(i→j)=T(i,j) / T(i), wherein i and j represent the sequence number of the authorized operation chain stage, stage i is the previous stage of stage j, T(i,j) represents the number of cases of simultaneous abnormality of stages i and j, T(i) represents the total number of cases of abnormality of stage i, and W(i→j) represents the influence weight of stage i on stage j;

[0022] Based on the initial probability of stage j and the derived probability caused by the abnormality of the previous stage, the modified abnormality probability P'j=max(Pj-∑[P'i×W(i→j)],0) is obtained; wherein, Pj represents the initial abnormality probability of stage j, P'j represents the modified abnormality probability of stage j, P'i represents the modified abnormality probability of stage i, and ∑[P'i×W(i→j)] represents the total of the derived influence of the previous stage.

[0023] If the modified abnormality probability of stage j is less than the preset abnormality threshold, stage j is executed; if the modified abnormality probability of stage j is greater than or equal to the preset abnormality threshold, it is verified whether it is an abnormality root, yes, otherwise find its previous stage, the specific steps include:

[0024] Determine whether the abnormality of stage j is caused by itself, the specific steps are as follows:

[0025] Based on the task input data of stage j, the task input features of stage j are obtained, and the task input features of stage j are compared with the input features of the normal task of stage j in the historical task data. If the deviation of the task input features of stage j from the input features of the normal task of stage j in the historical task data is greater than or equal to the set feature deviation threshold, it is determined that stage j is an abnormality root; if not, go to the previous stage;

[0026] The stage j previous stage set is screened out.

[0027] The previous stage of the target stage is screened out, the previous stage that has the greatest impact on it is preferentially investigated, the features affecting the previous stage are identified and adjusted to the normal range, if the previous stage is restored, it is excluded and it is checked whether the abnormality probability of the target stage meets the standard; if not or the previous stage is not restored, repeat the investigation and adjustment until the abnormality probability of the target stage is lower than the preset abnormality threshold, the specific steps include:

[0028] According to the stage j previous fault stage set screened out, the stage with the greatest impact on stage j is preferentially investigated, which is recorded as stage A, wherein, the stage j previous fault stage represents the previous stage of stage j in the authorized operation chain, and the modified abnormality probability corresponding to the previous stage is greater than or equal to the preset abnormality threshold, and stage A represents the stage with the highest modified abnormality probability in the previous stage of the abnormality stage with the highest risk level in the authorized operation chain, which needs to be preferentially processed;

[0029] identifying a maximum impact feature of stage A, confirming a normal range threshold of the maximum impact feature of stage A, adjusting the maximum impact feature of stage A, adjusting the feature value to the normal range, if stage A returns to normal after adjusting the maximum impact feature of stage A, excluding stage A from the screened stage j pre-stage set, at this time, recalculating the corrected abnormal probability of stage j, when the corrected abnormal probability of stage j is less than the preset abnormal threshold, at this time, executing stage j; when the corrected abnormal probability of stage j is greater than or equal to the preset abnormal threshold, at this time, recalculating the pre-stage set of stage j, wherein the maximum impact feature of stage A is selected as follows: based on the feature importance ranking output by the baseline model of stage A, the feature with the largest contribution to the abnormal probability of stage A is selected;

[0030] If stage A does not return to normal after adjusting the maximum impact feature of stage A, re-predicting, re-predicting the corrected abnormal probability of stage j, if the corrected abnormal probability is lower than the preset abnormal threshold, then executing stage j; if the corrected abnormal probability is greater than or equal to the preset abnormal threshold, then re-selecting the stage j pre-fault stage set and checking the stage that has the greatest impact on stage j, and then adjusting the maximum impact feature of the stage until the corrected abnormal probability is lower than the preset abnormal threshold.

[0031] An authorization operation chain tracing system based on an online process, the system comprising: a data acquisition module, a baseline model construction module, an abnormal root source positioning module and an abnormal processing module; the data acquisition module is used to collect data of each stage of the authorization operation chain, and the data is judged according to the data integrity and task completion threshold, and if it meets the standard, it is transmitted to the next stage; the baseline model construction module is used to extract cases and features of each stage from historical abnormal records on the chain, and the baseline model is trained after standardization by random forest; the abnormal root source positioning module is used to calculate the initial and corrected abnormal probability when an abnormality is monitored, and if the target stage probability meets the standard, it is executed, if not, check whether it is abnormal itself, otherwise find its pre-stage; the abnormal processing module is used to preferentially check the pre-stage that has the greatest impact on it, identify and adjust the feature that affects the pre-stage to the normal range, if the pre-stage returns to normal, it is excluded and the target stage abnormal probability is checked; if it does not meet the standard or does not return to normal, repeat the checking and adjusting until the target stage abnormal probability is lower than the preset abnormal threshold.

[0032] The data acquisition module includes an authorized operation chain stage data acquisition unit, a data completeness calculation unit, a task completion degree calculation unit and a process triggering unit. The authorized operation chain stage data acquisition unit is used to acquire real-time data of each stage of the authorized operation chain, including operation behavior logs, involved authorized proof file storage, data volume to be submitted at each stage, submitted data volume meeting requirements, received data volume and standard processing data volume. The data completeness calculation unit is used to calculate the data completeness of each stage of the authorized operation chain. The task completion degree calculation unit is used to calculate the task completion degree of each stage of the authorized operation chain. The process triggering unit is used to transmit the current stage data to the next stage if the current stage data completeness and task completion degree indicators are greater than or equal to the set threshold. The output end of the data acquisition module is connected to the input end of the baseline model construction module.

[0033] The baseline model construction module includes a feature standardization processing unit, a baseline model training unit and an abnormal probability calculation unit. The feature standardization processing unit is used to standardize the extracted historical case feature variable values and the real-time acquired feature variable values, and map the data to the 0-1 interval. The baseline model training unit is used to take whether a stage is abnormal as a label, with an abnormal label being 1 and a normal label being 0, and take the standardized historical feature variable values as input, and train a baseline model of “feature variable→abnormal probability” using a random forest algorithm. The abnormal probability calculation unit is used to acquire real-time feature variable values of each stage when the authorized operation chain monitors an abnormal signal, and input the feature variable values into the baseline model of the corresponding stage to output the initial abnormal probability of each stage, calculate the correlation weight based on the historical data on the authorized operation chain, and calculate the corrected abnormal probability of each stage based on the calculated correlation weight. The output end of the baseline model construction module is connected to the input end of the abnormal root cause positioning module.

[0034] The abnormal root cause positioning module comprises a target stage abnormal threshold determination unit, a target stage self-abnormality verification unit and a preceding failure stage screening unit, the target stage abnormal threshold determination unit is used for presetting an abnormal threshold, comparing the target stage corrected abnormal probability with the threshold, if the target stage corrected abnormal probability is less than the threshold, it is determined that the target stage can be normally executed, otherwise the abnormal root cause positioning process is triggered; the target stage self-abnormality verification unit is used for extracting the task input features of the target stage, and comparing them with the historical normal task input feature range of the target stage stored on the authorized operation chain; if the deviation of the current input features and the historical normal features is greater than or equal to a preset feature deviation threshold, it is determined that the target stage is the abnormal root cause; if the deviation is less than the threshold, the preceding stage tracing process is entered; the preceding failure stage screening unit is used for screening the preceding stages of the target stage, excluding the stages with a corrected abnormal probability less than a preset threshold, forming a target stage preceding failure stage set, calculating the influence degree of each stage on the target stage for the preceding stages in the set, and determining the preceding stages to be preferentially checked after sorting, and the output end of the abnormal root cause positioning module is connected with the input end of the abnormal handling module.

[0035] The abnormal handling module comprises a preceding stage determination unit, a maximum influence feature adjustment unit and an adjustment effect verification unit; the preceding stage determination unit is used for selecting the preceding stage with the highest influence degree on the target stage from the target stage preceding failure stage set; the maximum influence feature adjustment unit is used for selecting the feature with the largest contribution to the abnormal probability of the preceding stage based on the feature importance ranking output by the baseline model of the preceding stage, determining the normal range threshold of the maximum influence feature, and adjusting the feature value to the normal range; the adjustment effect verification unit is used for recalculating the corrected abnormal probability of the preceding stage after adjustment, if the corrected abnormal probability of the preceding stage is lower than a preset abnormal threshold, it is determined that the preceding stage has returned to normal, after excluding the preceding stage that has returned to normal, the corrected abnormal probability of the target stage is recalculated, whether the preceding failure stage set is reselected is judged, if the preceding stage has not returned to normal after adjustment, the corrected abnormal probability of the target stage is recalculated, whether iteration is continued is determined, and the process is repeated until the abnormal probability of the target stage is lower than the threshold.

[0036] Compared with the prior art, the present application has the following advantages:

[0037] 1、The present application collects the full-stage data of the authorized operation chain in real time, uniformly calculates the data integrity and task completion degree of each stage, and determines whether the data meets the standard based on a preset threshold, which is different from the existing technology in which the data is stored and collected in a scattered manner, not in real time and lacks a unified determination standard, and the present application builds a standardized data collection and transmission system;

[0038] 2. This invention introduces a random forest model to train a baseline model of "feature variable → anomaly probability", collects features in real time to calculate the initial anomaly probability, and then corrects the derivative effects of the preceding stage through the correlation weights of historical data statistics to obtain the corrected anomaly probability. Unlike the existing technology that relies on manual investigation, does not quantify the anomaly risk and ignores the preceding effects, this invention achieves a quantitative assessment of anomaly risk.

[0039] 3. This invention uses a process of "self-anomaly verification + preceding fault screening + feature adjustment verification" and combines the correction of anomaly probability to remove the preceding derivative effects. Unlike existing basic automation solutions that lack derivative effect correction mechanisms and only locate surface stages, this invention can distinguish between "self-independent anomalies" and "preceding derivative anomalies", thereby tracing the root cause of the anomaly. Attached Figure Description

[0040] Figure 1 This is a flowchart illustrating an online-based authorized operation chain traceability method according to the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] like Figure 1 As shown, this invention provides a technical solution: a method for tracing the authorization operation chain based on an online process. This method includes the following steps:

[0043] Collect data from each stage of the authorized operation chain, calculate the data completeness and task completion rate of the current stage, and determine the data based on the set threshold. If the data completeness and task completion rate of the current stage are greater than or equal to the set threshold, the data of the current stage will be transferred to the next stage.

[0044] Based on the historical anomaly records stored on the authorized operation chain, the abnormal and non-abnormal cases and corresponding features of each stage are extracted. After the features are standardized, a baseline model is trained using a random forest model. When an anomaly is detected, the features of each stage are collected in real time and substituted into the baseline model to obtain the initial anomaly probability. The anomaly probability is then corrected based on the initial anomaly probability.

[0045] If the abnormal probability after the target stage correction is less than the preset abnormal threshold, then the target stage is executed; if the abnormal probability after the target stage correction is greater than or equal to the preset abnormal threshold, verify whether it is abnormal itself. If it is, then it is the root cause of the abnormality; otherwise, find its preceding stage.

[0046] Filter the preceding stages of the target stage, prioritize the preceding stages that have the greatest impact on it, identify the characteristics that affect the preceding stage and adjust them to the normal range. If the preceding stage recovers, exclude it and check whether the abnormal probability of the target stage meets the standard. If it does not meet the standard or the preceding stage has not recovered, repeat the investigation and adjustment until the abnormal probability of the target stage is lower than the preset abnormal threshold.

[0047] Real-time data collection across all stages of the authorized operation chain, calculation of data completeness and task completion rate for the current stage, and judgment based on set thresholds. If the data completeness and task completion rate indicators for the current stage are greater than or equal to the set thresholds, the data for the current stage is transferred to the next stage. Specific steps include:

[0048] Real-time data collection across all stages of the authorization operation chain includes operation logs, evidence of relevant authorization documents, the amount of data to be submitted at each stage, the amount of compliant data already submitted, the amount of data received, and the amount of compliant processed data. The collected data for each stage of the authorization operation chain is denoted as {s1, s2, ..., sn}; where s1, s2, ..., sn represent the data for stages 1, 2, ..., n, respectively, and n represents the number of stages in the authorization operation chain. "Compliant" in the context of the submitted compliant data refers to the compliance of the business rules at the corresponding stage of the authorization operation chain with the laws, regulations, and management standards governing data security and personal information protection. "Compliant" in the context of the compliant processed data refers to the criteria used at the corresponding stage of the authorization operation chain to ensure that the data processing is legally authorized and that sensitive information protection meets the standards.

[0049] Based on the amount of compliant data submitted in the current stage and the amount of data to be submitted, calculate the data integrity of the current stage: Di = D(i,1) / D(i,0)*100%; where D(i,1) represents the amount of compliant data submitted in the i-th stage, i represents the authorized operation chain stage number, i = 1, 2, ..., n, and D(i,0) represents the amount of data to be submitted in the i-th stage.

[0050] A threshold for data integrity at a given stage is predefined. Based on this threshold, the data integrity of the current authorized operation chain stage is judged. If the data integrity of the current authorized operation chain stage is greater than or equal to the predefined threshold for data integrity at the given stage, the data integrity of the current stage is deemed to meet the standard, and the data of the current stage is transferred to the next stage. Otherwise, the data of the current stage is deemed to be missing, and the data correction process is triggered.

[0051] Based on the amount of data processed and received that meet the standards in the current stage, calculate the task completion rate Ri = R(i,1) / R(i,0)*100% for the current stage; where R(i,1) represents the amount of data processed that meets the standards in the i-th stage, and R(i,0) represents the amount of data received in the i-th stage.

[0052] A threshold for task completion is predefined for each stage. Based on this threshold, the task completion of the current authorized operation chain stage is judged. If the task completion of the current authorized operation chain stage is greater than or equal to the predefined threshold, the task completion of the current stage is judged to meet the standard, and the data of the current stage is transferred to the next stage. Otherwise, the task completion of the current stage is judged to not meet the standard, and the task is re-executed or the cause investigation process is triggered.

[0053] Based on historical anomaly records stored on the authorized operation chain, abnormal and non-abnormal cases and their corresponding features at each stage are extracted. After standardizing the features, a baseline model that can predict anomaly probabilities through features is trained using a random forest model. When an anomaly is detected, features at each stage are collected in real time and substituted into the baseline model to obtain an initial anomaly probability. The anomaly probability is then corrected based on the initial anomaly probability. The specific steps include:

[0054] Based on the abnormal handling records stored on the authorized operation chain, extract historical abnormal cases at each stage, the characteristic variable values ​​corresponding to each abnormal case, and the characteristic variable values ​​of non-abnormal cases;

[0055] The extracted feature variable values ​​are then standardized.

[0056] Using a random forest model, a baseline model of "feature variable → anomaly probability" is trained by labeling whether a stage is abnormal, specifying that the label is 1 when the stage is abnormal and 0 when the stage is normal, and taking the standardized feature variable values ​​as input.

[0057] When the authorized operation chain detects an abnormal signal, it collects the characteristic variable values ​​of each stage in real time, substitutes the real-time characteristic variable values ​​into the baseline model of the corresponding stage, calculates the abnormal probability of each stage, and uses it as the initial abnormal probability of each stage.

[0058] Based on historical data, the probability that an anomaly in stage i leads to an anomaly in stage j is used as the correlation weight W(i→j), defined as follows: W(i→j)=T(i,j) / T(i), where i and j represent the stage numbers of the authorized operation chain, and stage i is the preceding stage of stage j, T(i,j) represents the number of cases where stage i and stage j are both abnormal, T(i) represents the total number of cases where stage i is abnormal, and W(i→j) represents the influence weight of stage i on stage j.

[0059] Based on the initial probability of stage j and the derived probability caused by the anomaly of the preceding stage, the corrected anomaly probability P'j = max(Pj - Σ[P'i × W(i → j)], 0) is obtained; where Pj represents the initial anomaly probability of stage j, P'j represents the corrected anomaly probability of stage j, P'i represents the corrected anomaly probability of stage i, and Σ[P'i × W(i → j)] represents the sum of the derived effects of the preceding stage.

[0060] If the corrected anomaly probability of stage j is less than the preset anomaly threshold, then stage j is executed; if the corrected anomaly probability of stage j is greater than or equal to the preset anomaly threshold, verify whether it is itself abnormal. If so, it is the root cause of the anomaly; otherwise, find its preceding stage. The specific steps include:

[0061] To determine whether an anomaly in stage j is caused independently of itself, the specific steps are as follows:

[0062] Based on the task input data of stage j, the task input features of stage j are obtained and compared with the input features of normal tasks of stage j in historical task data. If the deviation between the task input features of stage j and the input features of normal tasks of stage j in historical task data is greater than or equal to the set feature deviation threshold, then stage j is determined to be the root cause of the anomaly; otherwise, the previous tracing is performed.

[0063] Select the set of preceding stages for stage j.

[0064] The process involves screening preceding stages of the target stage, prioritizing those stages that have the greatest impact, identifying the characteristics affecting these preceding stages, and adjusting them to a normal range. If the preceding stage recovers, it is excluded, and the anomaly probability of the target stage is checked. If it does not meet the standard or the preceding stage has not recovered, the screening and adjustment are repeated until the anomaly probability of the target stage is lower than a preset anomaly threshold. Specific steps include:

[0065] Based on the selected set of preceding fault stages for stage j, the stage that has the greatest impact on stage j is prioritized for investigation and is denoted as stage A. The preceding fault stage for stage j refers to the preceding stage of stage j in each stage of the authorized operation chain, and the corrected abnormal probability of the preceding stage is greater than or equal to the preset abnormal threshold. Stage A refers to the stage with the highest corrected abnormal probability among the preceding stages of the current highest risk level and the abnormal stage that needs to be dealt with first in the authorized operation chain.

[0066] Identify the most influential feature affecting stage A, confirm the normal range threshold of the most influential feature affecting stage A, adjust the most influential feature affecting stage A to bring the feature value to the normal range. If stage A returns to normal after adjusting the most influential feature of stage A, exclude stage A from the set of preceding stages selected for stage j. At this time, recalculate the corrected anomaly probability of stage j. If the corrected anomaly probability of stage j is less than the preset anomaly threshold, stage j is executed. If the corrected anomaly probability of stage j is greater than or equal to the preset anomaly threshold, the set of preceding stages of stage j is recalculated. The selection process of the most influential feature affecting stage A is as follows: based on the feature importance ranking of the baseline model output of stage A, select the feature that contributes the most to the anomaly probability of stage A.

[0067] If stage A does not return to normal after adjusting the maximum impact feature of stage A, a new prediction is made, and the corrected anomaly probability of stage j is predicted again. If the corrected anomaly probability is lower than the preset anomaly threshold, stage j is executed. If the corrected anomaly probability is greater than or equal to the preset anomaly threshold, the set of preceding fault stages of stage j is selected again, and the stage with the greatest impact on stage j is investigated. The maximum impact feature of the stage is then adjusted until the corrected anomaly probability is lower than the preset anomaly threshold.

[0068] In this embodiment: During the data collection and transmission phase, data from each stage is collected in real time, including basic supporting documents and authorization application forms during the material submission stage, verification operation records and qualification validity judgment results during the qualification verification stage, review opinions and data usage scope descriptions during the solution review stage, compliance inspection reports during the online audit stage, and call behavior logs during the process monitoring stage. Simultaneously, the completeness of data and task completion at each stage are judged according to a unified standard: if all necessary documents have been submitted and meet the format requirements during the material submission stage, the data completeness is deemed satisfactory; if the validity verification of all required qualifications is completed during the qualification verification stage, the task completion is deemed satisfactory, and the satisfactory data is automatically transmitted to the next stage; if any documents are missing at a certain stage, a data correction process is triggered, reminding relevant personnel to supplement the materials.

[0069] During the model training phase, abnormal and non-abnormal cases and their corresponding features are extracted from the historical abnormal records stored on the blockchain. For example, cases of qualification failure in the qualification verification phase and cases of out-of-scope requirements in the solution review phase are extracted. After standardizing these features, a baseline model is trained through a machine learning model to establish the correlation between features and the probability of abnormality. When an abnormal signal is detected, such as when abnormal data call behavior is found in the process monitoring phase, the current features of each phase are collected in real time, substituted into the corresponding baseline model to obtain the initial abnormal probability, and then combined with the influence relationship between the preceding phase and the subsequent phase based on historical data statistics to correct the initial abnormal probability and obtain the corrected abnormal probability.

[0070] If the target stage is the online review, and its corrected anomaly probability exceeds a preset threshold, first verify whether the stage itself is abnormal. Extract the input features of the online review stage, such as the solution review conclusion and compliance check results, and compare them with the input features of historical normal online reviews. If the deviation is small, it is determined that it is not its own anomaly, and proceed to trace the preceding stages. Screen the preceding stages of the online review, sort them according to the degree of influence of each preceding stage on the online review, and prioritize the solution review stage, which has the greatest impact. Identify the features affecting the solution review stage through the model, such as the clarity of the data usage scope definition, and adjust the feature to the normal range, that is, supplement and improve the data usage scope description. If the solution review stage returns to normal, exclude this stage and recalculate the anomaly probability of the online review stage. If the probability drops below the threshold, the online review stage is executed normally; if the probability still exceeds the standard, rescreen the preceding stages and continue to investigate and adjust until the anomaly probability of the online review stage reaches the standard.

[0071] An online-based authorization operation chain traceability system includes: a data acquisition module, a baseline model construction module, an anomaly root cause localization module, and an anomaly handling module. The data acquisition module collects data from each stage of the authorization operation chain, judging data completeness and task completion thresholds; if the thresholds are met, the data is passed to the next stage. The baseline model construction module extracts cases and features from historical anomaly records on the chain, standardizes them, and trains a baseline model using a random forest. The anomaly root cause localization module, upon detecting an anomaly, calculates the initial and corrected anomaly probabilities using real-time features. If the target stage probability meets the threshold, execution is performed; otherwise, it checks for anomalies within the target stage itself, or searches for its preceding stages. The anomaly handling module prioritizes investigating the preceding stages that have the greatest impact on the target stage, identifies and adjusts the features affecting that preceding stage to a normal range. If the preceding stage recovers, it is excluded, and the anomaly probability of the target stage is checked. If it does not meet the threshold or has not recovered, the investigation and adjustment are repeated until the anomaly probability of the target stage is below a preset anomaly threshold.

[0072] The data acquisition module includes an authorized operation chain stage data acquisition unit, a data integrity calculation unit, a task completion calculation unit, and a process triggering unit. The authorized operation chain stage data acquisition unit is used to collect data from each stage of the authorized operation chain in real time, including operation behavior logs, relevant authorization certificate documents, the amount of data to be submitted at each stage, the amount of submitted data that meets the requirements, the amount of received data, and the amount of processed data that meets the standards. The data integrity calculation unit is used to calculate the data integrity of each stage of the authorized operation chain. The task completion calculation unit is used to calculate the task completion of each stage of the authorized operation chain. The process triggering unit is used to transfer the data of the current stage to the next stage if the data integrity and task completion indicators of the current stage are greater than or equal to a set threshold. The output end of the data acquisition module is connected to the input end of the baseline model construction module.

[0073] The baseline model construction module includes a feature standardization processing unit, a baseline model training unit, and an anomaly probability calculation unit. The feature standardization processing unit is used to standardize the extracted historical case feature variable values ​​and real-time collected feature variable values, mapping the data to the 0-1 range. The baseline model training unit is used to train a baseline model of "feature variable → anomaly probability" using the standardized historical feature variable values ​​as input, with an anomaly label of 1 and a normal label of 0. The anomaly probability calculation unit is used to collect feature variable values ​​of each stage in real time when the authorized operation chain detects an anomaly signal, substitute them into the baseline model of the corresponding stage, output the initial anomaly probability of each stage, calculate the correlation weight based on historical data on the authorized operation chain, and calculate the corrected anomaly probability of each stage based on the calculated correlation weight. The output end of the baseline model construction module is connected to the input end of the anomaly root cause localization module.

[0074] The anomaly root cause localization module includes a target stage anomaly threshold determination unit, a target stage self-anomaly verification unit, and a preceding fault stage filtering unit. The target stage anomaly threshold determination unit is used to preset anomaly thresholds and compare the corrected anomaly probability of the target stage with the threshold. If the corrected anomaly probability of the target stage is less than the threshold, the target stage is determined to be able to execute normally; otherwise, the anomaly root cause localization process is triggered. The target stage self-anomaly verification unit is used to extract the task input features of the target stage and compare them with the range of historical normal task input features of the target stage stored on the authorized operation chain. If the deviation between the current input features and the historical normal features is greater than or equal to a preset feature deviation threshold, the target stage is determined to be the anomaly root cause. If the deviation is less than the threshold, the preceding stage tracing process is entered. The preceding fault stage filtering unit is used to filter the preceding stages of the target stage, excluding stages whose corrected anomaly probability is less than the preset threshold, forming a set of preceding fault stages of the target stage. The influence of each preceding stage on the target stage is calculated for the preceding stages in the set, and the preceding stages are sorted to determine the priority for investigation. The output of the anomaly root cause localization module is connected to the input of the anomaly handling module.

[0075] The anomaly handling module includes a preceding stage determination unit, a maximum impact feature adjustment unit, and an adjustment effect verification unit. The preceding stage determination unit selects the preceding stage with the highest impact on the target stage from the set of preceding fault stages. The maximum impact feature adjustment unit selects the feature that contributes the most to the anomaly probability of the preceding stage based on the feature importance ranking of the baseline model output of the preceding stage, determines the normal range threshold of the maximum impact feature, and adjusts the feature value to the normal range. The adjustment effect verification unit recalculates the corrected anomaly probability of the preceding stage after adjustment. If the corrected anomaly probability of the preceding stage is lower than the preset anomaly threshold, it determines that the preceding stage has recovered. After excluding the recovered preceding stage, it recalculates the corrected anomaly probability of the target stage and determines whether to re-screen the set of preceding fault stages. If the preceding stage has not recovered after adjustment, it re-predicts the corrected anomaly probability of the target stage and determines whether to continue iterating until the anomaly probability of the target stage is lower than the threshold.

[0076] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A method for tracing the authorization operation chain based on an online process, characterized in that: The method includes the following steps: The data integrity of the current stage is calculated based on the amount of compliant data submitted and the amount of data to be submitted in the current stage; the task completion of the current stage is calculated based on the amount of compliant processed data and the amount of data received in the current stage; and the data transmission direction of the current stage is determined based on the set threshold. Real-time data collection across all stages of the authorization operation chain includes operation logs, evidence of relevant authorization documents, the amount of data to be submitted at each stage, the amount of compliant data already submitted, the amount of data received, and the amount of compliant processed data. The collected data for each stage of the authorization operation chain is denoted as {s1, s2, ..., sn}; where s1, s2, ..., sn represent the data for stages 1, 2, ..., n, respectively, and n represents the number of stages in the authorization operation chain. "Compliant" in the context of the submitted compliant data refers to the compliance of the business rules at the corresponding stage of the authorization operation chain with the laws, regulations, and management standards governing data security and personal information protection. "Compliant" in the context of the compliant processed data refers to the criteria used at the corresponding stage of the authorization operation chain to ensure that the data processing is legally authorized and that sensitive information protection meets the standards. Based on the amount of compliant data submitted in the current stage and the amount of data to be submitted, calculate the data integrity of the current stage: Di = D(i,1) / D(i,0)*100%; where D(i,1) represents the amount of compliant data submitted in the i-th stage, i represents the authorized operation chain stage number, i = 1, 2, ..., n, and D(i,0) represents the amount of data to be submitted in the i-th stage. A threshold for data integrity at a given stage is predefined. Based on this threshold, the data integrity of the current authorized operation chain stage is judged. If the data integrity of the current authorized operation chain stage is greater than or equal to the predefined threshold for data integrity at the given stage, the data integrity of the current stage is deemed to meet the standard, and the data of the current stage is transferred to the next stage. Otherwise, the data of the current stage is deemed to be missing, and the data correction process is triggered. Based on the amount of data processed and received that meet the standards in the current stage, calculate the task completion rate Ri = R(i,1) / R(i,0)*100% for the current stage; where R(i,1) represents the amount of data processed that meets the standards in the i-th stage, and R(i,0) represents the amount of data received in the i-th stage. A threshold for task completion is predefined for each stage. Based on this threshold, the task completion of the current authorized operation chain stage is judged. If the task completion of the current authorized operation chain stage is greater than or equal to the predefined threshold for task completion, the task completion of the current stage is judged to meet the standard, and the data of the current stage is transferred to the next stage. Otherwise, the task completion of the current stage is judged to not meet the standard, and the task is re-executed or the cause investigation process is triggered. Extract abnormal and non-abnormal cases and their corresponding features from each stage of the authorized operation chain, standardize the features, and train a baseline model using a random forest model. When an abnormality is detected, collect the features of each stage in real time and substitute them into the baseline model to obtain the initial abnormality probability. Based on the initial abnormality probability, determine the corrected abnormality probability. If the abnormal probability after the target stage correction is less than the preset abnormal threshold, then the target stage is executed; if the abnormal probability after the target stage correction is greater than or equal to the preset abnormal threshold, its own abnormal state is verified; if there is no abnormality, then its preceding stage is searched. Filter the preceding stages of the target stage, prioritize the preceding stages that have the greatest impact on it, identify the characteristics that affect the preceding stage and adjust them to the normal range. If the preceding stage recovers, exclude it and check whether the abnormal probability of the target stage meets the standard. If it does not meet the standard or the preceding stage has not recovered, repeat the investigation and adjustment until the abnormal probability of the target stage is lower than the preset abnormal threshold.

2. The authorized operation chain traceability method based on online processes according to claim 1, characterized in that: Extract abnormal and non-abnormal cases and their corresponding features from each stage of the authorization operation chain, standardize the features, and train a baseline model using a random forest model. When an anomaly is detected, collect features from each stage in real time and substitute them into the baseline model to obtain an initial anomaly probability. Based on the initial anomaly probability, determine the corrected anomaly probability. The specific steps include: Based on the abnormal handling records stored on the authorized operation chain, extract historical abnormal cases at each stage, the characteristic variable values ​​corresponding to each abnormal case, and the characteristic variable values ​​of non-abnormal cases; The extracted feature variable values ​​are then standardized. Using a random forest model, a baseline model of "feature variable → anomaly probability" is trained by labeling whether a stage is abnormal, specifying that the label is 1 when the stage is abnormal and 0 when the stage is normal, and taking the standardized feature variable values ​​as input. When the authorized operation chain detects an abnormal signal, it collects the characteristic variable values ​​of each stage in real time, substitutes the real-time characteristic variable values ​​into the baseline model of the corresponding stage, calculates the abnormal probability of each stage, and uses it as the initial abnormal probability of each stage. Based on historical data, the probability that an anomaly in stage i leads to an anomaly in stage j is used as the correlation weight W(i→j), defined as follows: W(i→j)=T(i,j) / T(i), where i and j represent the stage numbers of the authorized operation chain, and stage i is the preceding stage of stage j, T(i,j) represents the number of cases where stage i and stage j are both abnormal, T(i) represents the total number of cases where stage i is abnormal, and W(i→j) represents the influence weight of stage i on stage j. Based on the initial probability of stage j and the derived probability caused by the anomaly of the preceding stage, the corrected anomaly probability P'j = max(Pj - Σ[P'i × W(i → j)], 0) is obtained; where Pj represents the initial anomaly probability of stage j, P'j represents the corrected anomaly probability of stage j, P'i represents the corrected anomaly probability of stage i, and Σ[P'i × W(i → j)] represents the sum of the derived effects of the preceding stage.

3. The authorized operation chain traceability method based on online processes according to claim 2, characterized in that: If the corrected anomaly probability of stage j is less than the preset anomaly threshold, then stage j is executed; if the corrected anomaly probability of stage j is greater than or equal to the preset anomaly threshold, verify whether it is itself abnormal. If so, it is the root cause of the anomaly; otherwise, find its preceding stage. The specific steps include: To determine whether an anomaly in stage j is caused independently of itself, the specific steps are as follows: Based on the task input data of stage j, the task input features of stage j are obtained and compared with the input features of normal tasks of stage j in historical task data. If the deviation between the task input features of stage j and the input features of normal tasks of stage j in historical task data is greater than or equal to the set feature deviation threshold, then stage j is determined to be the root cause of the anomaly; otherwise, the previous tracing is performed. Select the set of preceding stages for stage j.

4. The authorized operation chain traceability method based on online process as described in claim 3, characterized in that: The process involves screening preceding stages of the target stage, prioritizing those stages that have the greatest impact, identifying the characteristics affecting these preceding stages, and adjusting them to a normal range. If the preceding stage recovers, it is excluded, and the anomaly probability of the target stage is checked. If it does not meet the standard or the preceding stage has not recovered, the screening and adjustment are repeated until the anomaly probability of the target stage is lower than a preset anomaly threshold. Specific steps include: Based on the selected set of preceding fault stages for stage j, the stage that has the greatest impact on stage j is prioritized for investigation and is denoted as stage A. The preceding fault stage for stage j refers to the preceding stage of stage j in each stage of the authorized operation chain, and the corrected abnormal probability of the preceding stage is greater than or equal to the preset abnormal threshold. Stage A refers to the stage with the highest corrected abnormal probability among the preceding stages of the current highest risk level and the abnormal stage that needs to be dealt with first in the authorized operation chain. Identify the most influential feature affecting stage A, confirm the normal range threshold of the most influential feature affecting stage A, adjust the most influential feature affecting stage A to bring the feature value to the normal range. If stage A returns to normal after adjusting the most influential feature of stage A, exclude stage A from the set of preceding stages selected for stage j. At this time, recalculate the corrected anomaly probability of stage j. If the corrected anomaly probability of stage j is less than the preset anomaly threshold, stage j is executed. If the corrected anomaly probability of stage j is greater than or equal to the preset anomaly threshold, the set of preceding stages of stage j is recalculated. The selection process of the most influential feature affecting stage A is as follows: based on the feature importance ranking of the baseline model output of stage A, select the feature that contributes the most to the anomaly probability of stage A. If stage A does not return to normal after adjusting the maximum impact feature of stage A, a new prediction is made, and the corrected anomaly probability of stage j is predicted again. If the corrected anomaly probability is lower than the preset anomaly threshold, stage j is executed. If the corrected anomaly probability is greater than or equal to the preset anomaly threshold, the set of preceding fault stages of stage j is selected again, and the stage with the greatest impact on stage j is investigated. The maximum impact feature of the stage is then adjusted until the corrected anomaly probability is lower than the preset anomaly threshold.

5. An online-process-based authorization operation chain traceability system, applied to the online-process-based authorization operation chain traceability method described in any one of claims 1-4, characterized in that: The system includes: a data acquisition module, a baseline model construction module, an anomaly root cause localization module, and an anomaly handling module. The data acquisition module collects data from each stage of the authorized operation chain, judging data completeness and task completion thresholds; if the thresholds are met, the data is passed to the next stage. The baseline model construction module extracts cases and features from historical anomaly records on the chain for each stage, standardizes them, and trains a baseline model using a random forest. The anomaly root cause localization module, when an anomaly is detected, calculates the initial and corrected anomaly probabilities using real-time features. If the target stage probability meets the threshold, execution is performed; otherwise, it checks whether the anomaly is inherent, or if so, it searches its preceding stage. The anomaly handling module prioritizes investigating the preceding stage that has the greatest impact on it, identifies and adjusts the features affecting that preceding stage to the normal range. If the preceding stage recovers, it is excluded, and the anomaly probability of the target stage is checked. If it does not meet the threshold or has not recovered, the investigation and adjustment are repeated until the anomaly probability of the target stage is lower than a preset anomaly threshold.

6. The authorized operation chain traceability system based on online processes according to claim 5, characterized in that: The data acquisition module includes an authorized operation chain stage data acquisition unit, a data integrity calculation unit, a task completion calculation unit, and a process triggering unit. The authorized operation chain stage data acquisition unit is used to collect data from each stage of the authorized operation chain in real time, including operation behavior logs, relevant authorization certificate documents, the amount of data to be submitted at each stage, the amount of submitted data that meets the requirements, the amount of received data, and the amount of processed data that meets the standards. The data integrity calculation unit is used to calculate the data integrity of each stage of the authorized operation chain. The task completion calculation unit is used to calculate the task completion of each stage of the authorized operation chain. The process triggering unit is used to transfer the data of the current stage to the next stage if the data integrity and task completion indicators of the current stage are greater than or equal to a set threshold. The output end of the data acquisition module is connected to the input end of the baseline model construction module.

7. The authorized operation chain traceability system based on online processes according to claim 6, characterized in that: The baseline model construction module includes a feature standardization processing unit, a baseline model training unit, and an anomaly probability calculation unit. The feature standardization processing unit is used to standardize the extracted historical case feature variable values ​​and the real-time collected feature variable values, mapping the data to the 0-1 range. The baseline model training unit is used to train a baseline model of "feature variable → anomaly probability" using the standardized historical feature variable values ​​as input, with an anomaly label of 1 and a normal label of 0. The anomaly probability calculation unit is used to collect the feature variable values ​​of each stage in real time when the authorized operation chain detects an anomaly signal, substitute them into the baseline model of the corresponding stage, output the initial anomaly probability of each stage, calculate the correlation weight based on the historical data on the authorized operation chain, and calculate the corrected anomaly probability of each stage based on the calculated correlation weight. The output of the baseline model building module is connected to the input of the anomaly root cause localization module.

8. The authorized operation chain traceability system based on online processes according to claim 7, characterized in that: The anomaly root cause localization module includes a target stage anomaly threshold determination unit, a target stage self-anomaly verification unit, and a preceding fault stage filtering unit. The target stage anomaly threshold determination unit is used to preset anomaly thresholds and compare the corrected anomaly probability of the target stage with the threshold. If the corrected anomaly probability of the target stage is less than the threshold, the target stage is determined to be able to execute normally; otherwise, the anomaly root cause localization process is triggered. The target stage self-anomaly verification unit is used to extract the task input features of the target stage and compare them with the range of historical normal task input features of the target stage stored on the authorized operation chain. If the deviation between the current input features and the historical normal features is greater than or equal to a preset feature deviation threshold, the target stage is determined to be the anomaly root cause. If the deviation is less than the threshold, proceed to the preceding stage traceability process; The preceding fault stage screening unit is used to screen the preceding stages of the target stage, exclude stages whose abnormal probability after correction is less than a preset threshold, form a set of preceding fault stages of the target stage, calculate the influence degree of each preceding stage on the target stage for the preceding stages in the set, and determine the preceding stages to be investigated first after sorting. The output end of the anomaly root cause localization module is connected to the input end of the anomaly processing module.

9. The authorized operation chain traceability system based on online processes according to claim 8, characterized in that: The anomaly handling module includes a preceding stage determination unit, a maximum impact feature adjustment unit, and an adjustment effect verification unit. The preceding stage determination unit selects the preceding stage with the highest impact on the target stage from the set of preceding fault stages. The maximum impact feature adjustment unit selects the feature that contributes the most to the anomaly probability of the preceding stage based on the feature importance ranking of the baseline model output of the preceding stage, determines the normal range threshold of the maximum impact feature, and adjusts the feature value to the normal range. The adjustment effect verification unit recalculates the corrected anomaly probability of the preceding stage after adjustment. If the corrected anomaly probability of the preceding stage is lower than the preset anomaly threshold, it determines that the preceding stage has recovered. After excluding the recovered preceding stage, it recalculates the corrected anomaly probability of the target stage and determines whether to re-screen the set of preceding fault stages. If the preceding stage has not recovered after adjustment, it re-predicts the corrected anomaly probability of the target stage and determines whether to continue iterating until the anomaly probability of the target stage is lower than the threshold.

Images