Intelligent risk auditing and early warning method and system based on knowledge graph fusion

Abstract

The application discloses a knowledge graph fusion intelligent risk auditing and early warning method and system, and relates to the technical field of intelligent early warning.The application can extract path nodes and dependency relationships from historical archived risk events, construct a structure graph with hierarchical semantics, realize quantitative analysis of path behavior rhythm and structure through periodic behavior trajectories and trajectory offset vectors;in the auditing process, path structure abnormal events can be accurately identified and a warning candidate set can be generated based on periodic offset coding sequences and structure consistency comparison, combined with jump nodes and superior path relationships, the application realizes structured labeling of risk states and triggers a chain response mechanism to form a complete linked risk node set.

Description

Technical Field

[0001] This invention relates to the field of intelligent early warning technology, and in particular to an intelligent risk audit and early warning method and system that integrates knowledge graphs. Background Technology

[0002] With the widespread application of artificial intelligence, big data, and knowledge graph technologies in enterprise risk control, the trend towards intelligent and structured risk auditing and early warning is becoming increasingly apparent. Traditional rule-driven risk control methods are struggling to meet the demands of dynamic and ever-changing business environments, while graph-based risk control models based on historical behavioral trajectories, structural evolution patterns, and multi-level path dependencies have become emerging research hotspots. Knowledge graphs, through entity relationship modeling, can accommodate large amounts of heterogeneous data and behavioral logic, and have gradually become an important infrastructure for structured modeling and contextual reasoning in business auditing. However, most current knowledge graph applications remain at the stage of static clustering or rule screening, and have not yet established dynamic risk behavior modeling mechanisms oriented towards multi-cycle and structural evolution, especially lacking mechanisms for identifying and responding to advanced semantic risk features such as abnormal path node structures and trajectory deviations.

[0003] Prior art document CN116645189A discloses a method, device, electronic device, and readable storage medium for enterprise risk early warning. It aggregates multiple enterprises in an enterprise knowledge graph into an entity set based on geographical and / or business characteristics, and performs correlation analysis on the entities to be warned based on their affiliation relationships, outputting warning results such as risk items and suspected risk items. This approach improves the real-time performance and efficiency of risk early warning, enabling early warning for new customers even in the absence of historical data. However, this method still relies on static features (such as geographical or business information) to drive the analysis and does not model the multi-cycle path behavior of enterprises. It lacks dynamic tracking of hierarchical path relationships and structural change characteristics between entities, making it difficult to identify risk recurrence patterns based on structural evolution. Therefore, it still has limitations in path-dependent structure analysis, cyclical behavior change modeling, and risk linkage early warning.

[0004] The comparative document CN119990719A proposes a method and system for document information entry based on big data processing, combining knowledge graphs to achieve risk category identification and automatic early warning. Its advantages lie in supporting multi-dimensional compliance verification and dynamic rule updates, and improving audit accuracy through big data-driven verification rules. However, the early warning logic of this method still relies on the direct matching of document object attributes and sensitive elements, lacking a mechanism for reusing and dynamically aligning historical risk path structures. It does not involve abnormal trajectory identification based on path structure graphs, nor does it provide the ability to model the linkage relationships between risk nodes, making it difficult to address the chain-like risk response needs that occur during the evolution of structural risks. Summary of the Invention

[0005] Given that most existing risk assessment methods are based on static attribute features and are difficult to support in-depth risk identification based on path structure evolution, this invention is proposed.

[0006] Therefore, the problem to be solved by this invention is how to achieve proactive identification of path node anomalies and linkage response of risk chains through periodic trajectory sampling and structural consistency comparison technology.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] In a first aspect, the present invention provides an intelligent risk audit and early warning method integrating knowledge graphs, comprising: in a knowledge graph mapped by business data, extracting the relevant entity path nodes and path dependencies based on historically archived risk event data to construct a hierarchical structure graph; for path nodes marked as risks, sampling the behavior trajectory in different periodic segments in the hierarchical structure graph, extracting the time interval features and trajectory offset vectors of the path behavior, and constructing a periodic offset encoding sequence; based on the hierarchical structure graph and the periodic offset encoding sequence, performing a structural consistency comparison between the currently occurring audit path node sequence and historical risk paths, confirming path structure anomalies, and writing them into an early warning candidate event set; for each risk node in the early warning candidate event set, extracting the superior and subordinate path relationships, marking the current node status as structural offset risk in the hierarchical structure graph, triggering a chain-like early warning response with the connected superior path nodes, and encoding the current path node as a set of linked risk nodes.

[0009] As a preferred embodiment of the intelligent risk review and early warning method integrating knowledge graphs as described in this invention, the construction of the hierarchical structure graph includes: extracting entity objects, behavioral actions, and triggering sequence information from archived risk event logs in historical risk control data to construct a set of triple sequence sequences; using rule constraints to limit the reasonable triggering relationship between consecutive behavioral actions based on the set of triple sequence sequences; when generating path graph nodes, applying a masking process to path branches that do not meet the rule constraints, retaining only structural paths that satisfy the rule constraint dependencies, thus forming a set of candidate structural paths; and constructing a hierarchical structure graph based on the set of candidate structural paths, wherein each path calculates the path span parameter according to the time span between path nodes and marks it on the path structure.

[0010] As a preferred embodiment of the intelligent risk review and early warning method integrating knowledge graphs as described in this invention, the rule constraint is: based on the set of directional triples already labeled in the knowledge graph behavior sequence, extract all behavioral actions to form a set. A triggering order matrix is ​​constructed based on the co-occurrence frequency in the historical path. Where element M ij Indicates behavior a iIn behavior a j The previously mentioned probability density, n, represents the total number of different types of behavioral actions contained in the action composition set; based on the triggering order matrix M, if and only if M ij ≥θ d And behavior a j In the hierarchical structure diagram, behavior a follows. i Define the path dependency rule function as 1; otherwise, define the path dependency rule function as 0, indicating behavior a. j Not satisfied by behavior a i Triggered path constraints, thereby affecting path branches (a i →a j Apply a blocking marker, θ d This is the minimum trigger probability threshold.

[0011] As a preferred embodiment of the intelligent risk review and early warning method integrating knowledge graphs as described in this invention, the step of extracting time interval features and trajectory offset vectors of path behavior and constructing a periodic offset coding sequence includes: extracting the time interval sequence of behavior between nodes for each periodic trajectory, calculating the average time interval feature value within the trajectory, and constructing a trajectory difference vector with a reference to a benchmark periodic segment to quantify the degree of time behavior offset; and constructing a periodic offset coding sequence for the corresponding risk node based on the trajectory difference vector and periodic window parameters.

[0012] As a preferred embodiment of the intelligent risk review and early warning method integrating knowledge graphs as described in this invention, the step of performing structural consistency comparison to confirm abnormal path structure events includes: constructing a structural vector for the path node sequence formed in the current review behavior according to its positional relationship in the hierarchical structure graph, where each dimension represents the structural displacement distance between the node and its superior node, and mapping the structural vector to the historical path set stored in the hierarchical structure graph for comparison; performing a positional difference comparison between the structural vector and the matched historical path structural vector, and if the structural difference exceeds the offset threshold, and the corresponding path node's periodic offset encoding sequence has a behavior rhythm change value exceeding the drift amplitude, then the current path structure is determined to be in an abnormal state; and the path node sequence P that meets the structural abnormality determination conditions is... t Marked as an abnormal path identifier, extract the set N of skip nodes. j and corresponding period offset code C i With triples (P) t N j C i Write the candidate event set into the form of )

[0013] As a preferred embodiment of the intelligent risk audit and early warning method integrating knowledge graphs as described in this invention, wherein: marking the current node state as structural offset risk in the hierarchical structure graph includes: for each triplet (P) in the early warning candidate event set t N j C i ), Traverse the set of jump nodes N j For each risk node, the set of direct superior path nodes is retrieved in the hierarchical structure graph to form a connecting path relationship chain; a structural offset status label is added to the path nodes in the hierarchical structure graph, and the risk level factor is calculated by combining the maximum rhythm drift value in the periodic offset coding sequence.

[0014] As a preferred embodiment of the intelligent risk audit and early warning method integrating knowledge graphs described in this invention, the triggering and connecting upper-level path nodes to issue chain-like early warning responses includes: issuing structural offset early warnings to the set of upper-level path nodes level by level based on the connection path relationship chain and the attached risk level factor, and recording the linked nodes as a set of linked risk nodes in the order of the early warning responses.

[0015] Secondly, this invention provides an intelligent risk review and early warning system integrating knowledge graphs, comprising:

[0016] The graph construction module is used to extract the relevant entity path nodes and path dependencies from the knowledge graph of business data mapping, based on historically archived risk event data, and construct a hierarchical structure graph.

[0017] The behavior sampling module is used to sample the behavior trajectory of path nodes marked as risk in different periodic segments in the hierarchical structure graph, extract the time interval features and trajectory offset vector of path behavior, and construct the periodic offset encoding sequence.

[0018] The structure comparison module is used to compare the structure consistency of the current audit path node sequence and the historical risk path based on the hierarchical structure map and the periodic offset encoding sequence, to identify abnormal path structure events, and to write them into the early warning candidate event set.

[0019] The chain linkage module is used to extract the hierarchical path relationship for each risk node in the early warning candidate event set, mark the current node status as structural offset risk in the hierarchical structure graph, and trigger the chain early warning response to the connected upper-level path nodes, and encode the current path node as a set of linked risk nodes.

[0020] Thirdly, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, they implement the steps of the intelligent risk audit and early warning method for integrating knowledge graphs as described in the first aspect of the present invention.

[0021] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, they implement the steps of the intelligent risk audit and early warning method for integrating knowledge graphs as described in the first aspect of the present invention.

[0022] The beneficial effects of this invention are as follows: This invention can extract path nodes and dependencies from historical archived risk events, construct a structural graph with hierarchical semantics, and achieve quantitative analysis of path behavior rhythm and structure through periodic behavior trajectories and trajectory offset vectors; during the review process, based on the comparison of periodic offset encoding sequences and structural consistency, abnormal path structure events can be accurately identified and a set of early warning candidates can be generated. Combined with the relationship between jump nodes and superior paths, the risk status can be structurally labeled, and a chain response mechanism can be triggered to form a complete set of linked risk nodes.

[0023] Compared with existing methods that rely solely on static attribute matching or rule screening, this invention significantly enhances the ability to identify structural risks and effectively improves the accuracy and timeliness of dynamic early warning in complex business scenarios. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A flowchart for an intelligent risk audit and early warning method that integrates knowledge graphs.

[0026] Figure 2 This is a structural diagram of an intelligent risk review and early warning system that integrates knowledge graphs. Detailed Implementation

[0027] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0028] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0029] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0030] As mentioned in the background section, traditional rule-driven risk control methods are insufficient to meet the demands of dynamic and ever-changing business environments. In contrast, graph-based risk control models, based on historical behavioral trajectories, structural evolution patterns, and multi-level path dependencies, have become an emerging research hotspot. Knowledge graphs, through entity relationship modeling, can accommodate large amounts of heterogeneous data and behavioral logic, and have gradually become a crucial infrastructure for structured modeling and contextual reasoning in business auditing. However, most current knowledge graph applications remain at the stage of static clustering or rule screening, lacking a dynamic risk behavior modeling mechanism oriented towards multi-cycle and structural evolution, and particularly lacking mechanisms for identifying and responding to advanced semantic risk features such as abnormal path node structures and trajectory deviations.

[0031] Figure 1 This is a flowchart of an intelligent risk audit and early warning method and system integrating knowledge graphs according to an embodiment of the present invention. Figure 1 As shown, the intelligent risk review and early warning method integrating knowledge graphs includes:

[0032] S1: In the knowledge graph of business data mapping, based on the historical archived risk event data, extract the relevant entity path nodes and path dependencies to construct a hierarchical structure graph.

[0033] S1.1: Based on the archived risk event logs in historical risk control data, extract the entity objects, behavioral actions and triggering sequence information to construct a set of triple sequences.

[0034] Specifically, conventional technologies often construct entity graphs directly based on the frequency of occurrence of business objects, without extracting the order of triggering behaviors between entities, resulting in a lack of logical direction in the graph. To overcome this problem, our invention sets up a set of triple sequences during the construction process, including two business entity nodes and the actions that occur between them. Each triple represents a directional behavior transition, which is sorted by timestamps appearing in the risk control logs, thus forming a chronological event chain.

[0035] In terms of structural operations, by scanning risk event entries in archived logs, the entities, behaviors, directions, and trigger times involved are extracted, cleaned, and assembled into triplet format to form the smallest unit of path behavior.

[0036] S1.2: Based on the set of triple sequences, use rule constraints to limit the reasonable triggering relationship between consecutive actions.

[0037] The rules and constraints are as follows:

[0038] Based on the set of directional triples already labeled in the graph behavior sequence, extract all behavior actions to form a set. A triggering order matrix is ​​constructed based on the co-occurrence frequency in the historical path. Where element M ij Indicates behavior a i In behavior a j The probability density mentioned earlier, where n is the total number of different types of behavioral actions contained in the action set;

[0039] Based on the triggering order matrix M, if and only if M ij ≥θ d And behavior a j In the hierarchical structure diagram, behavior a follows. i Define the path dependency rule function as 1; otherwise, define the path dependency rule function as 0, indicating behavior a. j Not satisfied by behavior a i Triggered path constraints, thereby affecting path branches (a i →a j Apply a blocking marker, θ d This is the minimum trigger probability threshold.

[0040] S1.3: When generating path graph nodes, a masking process is applied to path branches that do not meet the rule constraints, and only structural paths that satisfy the rule constraints are retained to form a candidate structural path set.

[0041] It should be noted that conventional graph generation methods often include all connectable paths between entities in the graph, resulting in complex path combinations and a large number of invalid transitions. Our invention uses the aforementioned path dependency rule function to determine the validity of each behavioral transition relationship in the hierarchical graph. For path edge pairs with a return value of 0, a masking process is applied, meaning they are not included in the final hierarchical graph.

[0042] Simultaneously, for any segment of a multi-step path that does not satisfy the rule constraints, the entire path is removed from the candidate structural path set. This avoids situations where there are non-logical behavioral jumps in the middle of the path. The final candidate structural path set is the behavioral structural path set selected through rule constraints, possessing strict time-triggered logic and causal relationship of behavioral direction.

[0043] S1.4: Based on the candidate structure path set, construct a hierarchical structure graph, where each path calculates the path span parameter according to the time span between path nodes and marks it on the path structure.

[0044] In the operation, the time span between adjacent nodes is first calculated based on the order of path nodes and timestamp information contained in each path in the candidate structure path set. The time span of each path is accumulated to obtain the span parameter of the corresponding path. The span parameter is then marked on the corresponding path structure as the basis for judging the stability of the path and the rhythm of periodic behavior.

[0045] In terms of structural hierarchy, the hierarchical relationship of nodes is automatically assigned by their position in the path. The target entity of the previous action becomes the starting point of the next action, automatically forming a causal path from superior to subordinate. The introduction of the path span parameter allows the graph to not only express structural logic but also embed a temporal semantic dimension.

[0046] S2: For path nodes marked as risk, sample the behavior trajectory in different periodic segments in the hierarchical structure graph, extract the time interval features and trajectory offset vector of the path behavior, and construct the periodic offset coding sequence.

[0047] First, all historical path sequences containing risk nodes are identified in the graph, and the paths are divided into timelines based on behavior timestamps, forming several sets of continuous periodic segments, each of which is a subsequence of a periodic trajectory. The division of periods can be implemented using business rules, natural day intervals, or sliding window mechanisms to ensure that the time dimension has equidistant or semi-overlapping characteristics; this embodiment is not limited to a single method.

[0048] Within each cycle trajectory, the occurrence times of the corresponding risk node's actions with its superior and subordinate nodes are extracted, and the time interval sequence between path behavior nodes is calculated. This time interval sequence reflects the triggering and response rhythm of the risk node within this cycle.

[0049] Furthermore, the time interval features of path behavior and trajectory offset vectors are extracted, and a periodic offset encoding sequence is constructed, including:

[0050] For each periodic trajectory segment, extract the time interval sequence of behavior between nodes, calculate the average time interval feature value within the trajectory, and construct a trajectory difference vector with reference to the baseline periodic segment to quantify the degree of time behavior offset; based on the trajectory difference vector and periodic window parameters, construct the periodic offset encoding sequence of the corresponding risk node.

[0051] If the trajectory difference vector continues to rise, it indicates that the behavior triggers are becoming sparser or delayed; if it continues to fall, it may indicate that the response frequency of risk nodes is increasing, and there is a tendency for short-cycle recurrence. Unlike conventional periodic frequency statistics, this invention starts from the time interval itself to construct the rhythm deviation of behavior triggers, thereby discovering microstructural rhythm anomalies without relying on the specific meaning of the behavior.

[0052] The construction of the periodic offset encoded sequence includes:

[0053] Set periodic window parameters (e.g., 3-5 periods), and for each sliding periodic window, the trajectory offset vector group is coded as follows: if the offset value increases continuously, it is encoded as +1, indicating a slowing-down offset; if it decreases, it is encoded as -1, indicating a tightening-down offset; if the fluctuation is within a preset threshold, it is encoded as 0, indicating a stable rhythm. The marking results of each sliding window are combined into a periodic offset encoding sequence, which serves as the periodic change trajectory of the path node in a given time dimension.

[0054] It should be noted that, compared with traditional behavior frequency coding, this coding sequence can retain rhythmic trend characteristics, is applicable to different path scenarios, and supports the linkage judgment of periodic anomalies of risk nodes.

[0055] S3: Based on the hierarchical structure map and periodic offset encoding sequence, perform a structural consistency comparison between the current audit path node sequence and historical risk paths, confirm abnormal path structure events, and write them into the early warning candidate event set.

[0056] S3.1: Based on the path node sequence formed in the current review behavior, construct a structure vector according to the positional relationship in the hierarchical structure graph, where each dimension represents the structural displacement distance between the node and the parent node, and map the structure vector to the historical path set stored in the hierarchical structure graph for comparison.

[0057] First, for the path node sequence that occurs in the current review process, based on the hierarchical structure graph constructed in step S1, a structural vector is constructed according to the structural displacement relationship between each node in the path and its superior node in the graph. The vector element is the structural level difference between the node and its superior node in the hierarchical structure, which is used to accurately express the distribution characteristics and logical position of the current path node in the hierarchical structure graph.

[0058] S3.2: Perform a bit-by-bit difference comparison between the structure vector and the matched historical path structure vector. If the structural difference exceeds the offset threshold and the behavior rhythm change value in the periodic offset encoding sequence of the corresponding path node exceeds the drift amplitude, then the current path structure is determined to be in an abnormal state.

[0059] The archived historical risk paths in the hierarchical structure map are selected as comparison samples. The current structure vector is compared position-by-position with each historical structure vector, the structural difference vector is calculated, and the offset is defined as:

[0060]

[0061] Where m is the path length, ΔV j Let σ be the structural displacement difference between the current path and the historical path at the j-th path node.s If the offset is greater than or equal to the offset threshold, that is, if the structural offset exceeds the preset offset threshold, it is considered a significant structural inconsistency.

[0062] It should be noted that structural differences alone are insufficient as anomaly markers; a combined judgment must be made in conjunction with changes in behavioral rhythm. Therefore, for paths with structural offsets exceeding a threshold, a periodic offset encoding sequence is added to extract the rhythmic symbol sequence corresponding to the offset structural vector position.

[0063] If the absolute value of the periodic encoding value exceeds the rhythm drift amplitude threshold (e.g., taking +1 or -1 state) at any offset point in the path, it is determined that the path is accompanied by abnormal rhythm changes at the structural jump point.

[0064] This two-factor judgment method can identify path structure anomalies, effectively avoiding normal scenarios with structural variations but stable behavioral rhythms, and enhancing the accuracy and robustness of anomaly judgment.

[0065] S3.3: The path node sequence P that meets the structural anomaly determination criteria. t Marked as an abnormal path identifier, extract the set N of skip nodes. j and corresponding period offset code C i With triples (P) t N j C i Write the candidate event set into the form of )

[0066] S4: For each risk node in the early warning candidate event set, extract the upper and lower level path relationship, mark the current node status as structural offset risk in the hierarchical structure graph, and trigger the chain early warning response of the connected upper level path node, and encode the current path node as a set of linked risk nodes.

[0067] S4.1: For each triplet (P) in the candidate event set for early warning t N j C i ), Traverse the set of jump nodes N j For each risk node, the set of direct superior path nodes is retrieved in the hierarchical structure graph to form a connecting path relationship chain.

[0068] It should be noted that this retrieval operation not only includes single-level parent nodes, but can also be extended to multi-level parent chains in the structural graph, forming a chain of connected paths from path nodes to ancestor nodes, where each node has a clear structural dependency relationship. This operation breaks through the limitation of traditional risk labeling, which only applies to the trigger node itself. By identifying the superior paths connected to risk nodes through structural logic, it provides basic topological support for chain-based early warning.

[0069] Meanwhile, during the construction of the connecting path chain, all nodes in the path are recorded sequentially to provide a response transmission sequence for subsequent chain-based early warning, ensuring the directionality and structural integrity of the early warning chain.

[0070] S4.2: Add structural offset status labels to the path nodes of the hierarchical structure graph, and combine this with the maximum rhythm drift value δ in the periodic offset coding sequence. max The risk level factor is calculated, and its expression can be: 1 + δ max / k, where k is the number of cycles in which the current node appears in the path (i.e., cycle coverage).

[0071] S4.3: Based on the connection path relationship chain and the attached risk level factor, issue structural offset warnings to the higher-level path node set level by level, and record the linked nodes as the linked risk node set according to the warning response order.

[0072] This set of linked risk nodes not only supports triggering joint audits in the audit engine, but also supports building a "structural offset propagation chain" in the graph, helping auditors to quickly identify risk diffusion paths.

[0073] By constructing a set of interconnected nodes, our invention breaks through the limitations of "point-based early warning" and "targeted response" in traditional risk control. It uses structural logic as a medium to construct an interconnected situation map, forming a directional and traceable risk propagation link, providing highly valuable strategy input for the audit system.

[0074] Furthermore, such as Figure 2 As shown, this embodiment also provides an intelligent risk review and early warning system that integrates knowledge graphs, including:

[0075] The graph construction module is used to extract the relevant entity path nodes and path dependencies from the knowledge graph of business data mapping, based on historically archived risk event data, and construct a hierarchical structure graph.

[0076] The behavior sampling module is used to sample the behavior trajectory of path nodes marked as risk in different periodic segments in the hierarchical structure graph, extract the time interval features and trajectory offset vector of path behavior, and construct the periodic offset encoding sequence.

[0077] The structure comparison module is used to compare the structure consistency of the current audit path node sequence and the historical risk path based on the hierarchical structure map and the periodic offset encoding sequence, to identify abnormal path structure events, and to write them into the early warning candidate event set.

[0078] The chain linkage module is used to extract the hierarchical path relationship for each risk node in the early warning candidate event set, mark the current node status as structural offset risk in the hierarchical structure graph, and trigger the chain early warning response to the connected upper-level path nodes, and encode the current path node as a set of linked risk nodes.

[0079] This embodiment also provides a computer device suitable for the intelligent risk review and early warning method that integrates knowledge graphs, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the intelligent risk review and early warning method that integrates knowledge graphs as proposed in the above embodiment.

[0080] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0081] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the intelligent risk audit and early warning method for integrating knowledge graphs as proposed in the above embodiments.

[0082] In summary, this invention can extract path nodes and dependencies from historical archived risk events, construct a hierarchical semantic structure graph, and achieve quantitative analysis of path behavior rhythm and structure through periodic behavior trajectories and trajectory offset vectors. During the review process, based on the comparison of periodic offset encoding sequences and structural consistency, abnormal path structure events can be accurately identified and a set of early warning candidates can be generated. By combining the relationship between jump nodes and superior paths, the risk status can be structurally labeled, and a chain response mechanism can be triggered to form a complete set of linked risk nodes.

[0083] Compared with existing methods that rely solely on static attribute matching or rule screening, this invention significantly enhances the ability to identify structural risks and effectively improves the accuracy and timeliness of dynamic early warning in complex business scenarios.

[0084] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An intelligent risk assessment and early warning method integrating knowledge graphs, characterized by: include: In the knowledge graph of business data mapping, based on historically archived risk event data, the relevant entity path nodes and path dependencies are extracted to construct a hierarchical structure graph; For path nodes marked as risk, the behavior trajectories in different periodic segments are sampled in the hierarchical structure graph, the time interval features and trajectory offset vectors of the path behavior are extracted, and a periodic offset coding sequence is constructed. Based on the hierarchical structure graph and periodic offset coding sequence, the structural consistency of the current audit path node sequence and historical risk paths is compared to identify abnormal path structure events and write them into the early warning candidate event set. For each risk node in the early warning candidate event set, extract the upper and lower level path relationship, mark the current node status as structural offset risk in the hierarchical structure graph, and trigger the chain early warning response of the connected upper level path node, and encode the current path node as a set of linked risk nodes. The construction of the hierarchical structure graph includes: extracting entity objects, behavioral actions, and triggering sequence information from archived risk event logs in historical risk control data to construct a set of triple sequence sets; using rule constraints to limit the reasonable triggering relationships between consecutive behavioral actions based on the triple sequence set; when generating path graph nodes, applying a masking process to path branches that do not meet the rule constraints, retaining only structural paths that satisfy the rule constraint dependencies, forming a set of candidate structural paths; and constructing a hierarchical structure graph based on the set of candidate structural paths, where each path calculates the path span parameter according to the time span between path nodes and marks it on the path structure. The construction of the periodic offset coding sequence includes: extracting the time interval sequence of the behavior between nodes for each periodic trajectory, calculating the average time interval feature value within the trajectory, and constructing a trajectory difference vector with a reference periodic segment to quantify the degree of time behavior offset; and constructing a periodic offset coding sequence for the corresponding risk node based on the trajectory difference vector and the periodic window parameter. The process of performing structural consistency comparison to confirm abnormal path structure events includes: constructing a structural vector for the path node sequence formed in the current review behavior according to its positional relationship in the hierarchical structure graph, where each dimension represents the structural displacement distance between the node and its superior node, and mapping the structural vector to the historical path set stored in the hierarchical structure graph for comparison; performing a positional difference comparison between the structural vector and the matched historical path structural vector, and if the structural difference exceeds the offset threshold, and the corresponding path node's periodic offset encoding sequence has a behavior rhythm change value exceeding the drift amplitude, then the current path structure is determined to be in an abnormal state.

2. The intelligent risk review and early warning method integrating knowledge graphs as described in claim 1, characterized in that: The rule constraints are as follows: Based on the set of directional triples already labeled in the graph behavior sequence, extract all behavior actions to form a set. And construct a triggering order matrix based on the co-occurrence order frequency in the historical path. , of which elements Indicates behavior In behavior The probability density that appeared previously, The total number of different types of behavioral actions contained in the action set; Based on trigger order matrix If and only if And behavior In hierarchical structure diagrams, behavior follows. Define the path dependency rule function as 1; otherwise, define the path dependency rule function as 0, indicating behavior. Dissatisfaction by behavior Triggered path constraints, thereby affecting path branches ( Apply a blocking marker. This is the minimum trigger probability threshold.

3. The intelligent risk review and early warning method integrating knowledge graphs as described in claim 1, characterized in that: The path node sequence that meets the structural anomaly determination criteria Marked as an abnormal path identifier, extract the set of skipped nodes. and corresponding period offset encoding With triples The event can be written into the early warning candidate event set in the form of [the event].

4. The intelligent risk review and early warning method integrating knowledge graphs as described in claim 1, characterized in that: The step of marking the current node status as structural offset risk in the hierarchical structure diagram includes: For each triplet in the candidate event set for early warning Traverse the set of jump nodes For each risk node, the set of its direct superior path nodes is retrieved from the hierarchical structure graph to form a connecting path relationship chain; Add structural offset status labels to the path nodes of the hierarchical structure map, and calculate the risk level factor by combining the maximum rhythm drift value in the periodic offset coding sequence.

5. The intelligent risk review and early warning method integrating knowledge graphs as described in claim 4, characterized in that: The chain-like early warning response issued by the upper-level path node that triggers and connects includes: Based on the connection path relationship chain and the attached risk level factor, structural offset warnings are issued to the higher-level path node set level by level, and the nodes marked with linkage are recorded as linkage risk node set according to the order of warning response.

6. An intelligent risk review and early warning system integrating knowledge graphs, based on the intelligent risk review and early warning method integrating knowledge graphs as described in any one of claims 1 to 5, characterized in that: Also includes: The graph construction module is used to extract the relevant entity path nodes and path dependencies from the knowledge graph of business data mapping, based on historically archived risk event data, and construct a hierarchical structure graph. The behavior sampling module is used to sample the behavior trajectory of path nodes marked as risk in different periodic segments in the hierarchical structure graph, extract the time interval features and trajectory offset vector of path behavior, and construct the periodic offset encoding sequence. The structure comparison module is used to compare the structure consistency of the current audit path node sequence and the historical risk path based on the hierarchical structure map and the periodic offset encoding sequence, to identify abnormal path structure events, and to write them into the early warning candidate event set. The chain linkage module is used to extract the hierarchical path relationship for each risk node in the early warning candidate event set, mark the current node status as structural offset risk in the hierarchical structure graph, and trigger the chain early warning response to the connected upper-level path nodes, and encode the current path node as a set of linked risk nodes.

7. A computer device, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the intelligent risk review and early warning method based on the fusion knowledge graph as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the intelligent risk review and early warning method based on the fusion knowledge graph as described in any one of claims 1 to 5.

Images