Enterprise risk prediction and control method and system

Abstract

The invention relates to the technical field of enterprise risk management and intelligent decision, and discloses an enterprise risk prediction and control method and system, and the method comprises the steps: collecting enterprise multi-source data, carrying out the preprocessing, constructing a risk prediction model of fusion modeling, and outputting a risk score; extracting an operation log behavior path based on the score, and generating a risk situation coding vector; similar events are matched in a historical event library, and the events are combined to re-calculate a response path; inputting the plurality of response paths into a strategy evolution sandbox for dynamic environment simulation, and outputting an evolution stability index; and performing path optimization through a multi-criterion decision method, updating an execution result and behavior codes to a historical mapping pool, and constructing a self-learning closed loop. The method has high interpretability, structural adaptability and strategy evolution capability, and improves the intelligent level of enterprise risk control.

Description

Technical Field

[0001] This invention relates to the field of enterprise risk management and intelligent decision-making technology, specifically to an enterprise risk prediction and control method and system. Background Technology

[0002] In modern business operations, the types of risks faced are becoming increasingly complex, encompassing multiple dimensions such as financial instability, contract defaults, supply chain disruptions, public opinion crises, and policy compliance conflicts. Especially against the backdrop of accelerating globalization of the industrial chain and real-time data, the external environment in which enterprises operate is becoming increasingly dynamic and volatile. Single indicators or static rules are no longer sufficient to meet the requirements for real-time risk identification and precise response. Currently, mainstream enterprise risk management methods largely rely on expert rules or risk scoring models for early warning and control, but these methods have the following typical shortcomings: First, risk prediction results are often disconnected from actual control actions, and scoring results cannot be effectively transformed into dynamic and executable strategies; second, strategy template design relies on prior manual configuration and lacks the ability to provide structured responses based on historical experience; third, strategy stability is often assessed using static indicators, making it difficult to adapt to execution feedback deviations caused by environmental disturbances or resource changes.

[0003] On the other hand, although some studies have attempted to introduce data-driven methods for enterprise operation modeling, such as using machine learning to predict the probability of risk occurrence and using process mining techniques to analyze business logs, a complete technical closed loop from "risk prediction - strategy simulation - dynamic evaluation - feedback reuse" has not yet been formed, especially in terms of the path structure of strategy generation, behavioral semantic interpretation and dynamic adaptability. Summary of the Invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by this invention is the disconnect between existing enterprise risk prediction results and response strategy generation, and the lack of structured path adaptation and dynamic execution feedback loop.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: a method for enterprise risk prediction and control, comprising: collecting multi-source data of an enterprise and preprocessing it, constructing a risk prediction model, and outputting a risk score of the target enterprise;

[0007] Based on the risk score, a behavior-driven risk coding mechanism is used to extract the behavioral path features of the current situation and generate the corresponding risk situation code.

[0008] Using the aforementioned risk scenario encoding, similar historical events are matched in the historical event database, and the similar historical events are re-enacted using the event re-enactment operator to generate multiple response paths.

[0009] The multiple response paths are input into the strategy evolution sandbox mechanism to perform dynamic environment simulation and output the evolution stability index of each response path.

[0010] Based on the evolutionary stability index, a multi-criteria decision-making method is used to evaluate and rank the multiple response paths, select the optimal path for execution, and update the execution result and behavior code together to the historical mapping pool.

[0011] As a preferred embodiment of the enterprise risk prediction and control method described in this invention, the enterprise multi-source data includes internal enterprise data, external enterprise data, semi-structured data, and unstructured data.

[0012] The risk prediction model is constructed by extracting enterprise feature vectors from preprocessed multi-source enterprise data; the enterprise feature vectors include static features, dynamic features, interactive features, and text-based semantic embedding features.

[0013] A gradient boosting decision tree model is used to model static and interactive features, and the first type of model score is output. A recurrent neural network structure is used to model dynamic features, and the second type of model score is output. A pre-trained language model is used to extract semantic vectors from text semantic embedding features, and the third type of model score is output through a fully connected network.

[0014] The risk score of the target company is generated by weighting and fusing the scores from the first type of model, the second type of model, and the third type of model.

[0015] As a preferred embodiment of the enterprise risk prediction and control method described in this invention, the step of extracting the behavioral path features of the current situation includes: extracting operation behavior logs within the current time window from the enterprise business system; grouping the logs according to the process instance number and arranging the logs in chronological order to form a set of operation sequences corresponding to multiple process instances, constituting an event trajectory set;

[0016] Based on the event trajectory set, an operation sequence graph is constructed using a process mining algorithm. The nodes of the operation sequence graph represent standardized business operation actions; the edges of the operation sequence graph represent causal or temporal dependencies between adjacent operations. The edge set includes direct successor edges, concurrent structure edges, backtracking edges, and jump edges. Based on the operation sequence graph, behavioral path features of the enterprise are extracted. The behavioral path features include path length, percentage of abnormal nodes, number of jump edges, frequency of backtracking edges, location of the first abnormal node, and node type diversity index.

[0017] As a preferred embodiment of the enterprise risk prediction and control method described in this invention, the risk scenario encoding includes: cross-combining the behavioral path features with the risk score to form a scoring-behavior coupling feature; and constructing a risk scenario encoding vector for the current enterprise based on the fields of the risk score, the behavioral path features, and the scoring-behavior coupling feature.

[0018] The risk scenario encoding vector is represented as: [risk score | behavioral path feature field 1, 2, 3, ... n | score-behavior coupling feature field 1, 2, 3, ... n].

[0019] As a preferred embodiment of the enterprise risk prediction and control method described in this invention, the method includes: extracting the response control action sequence corresponding to the similar historical events; calling the event re-evolution operator to restructure and adapt the response control action sequence to generate multiple response paths suitable for the current process environment;

[0020] The response control action sequence is a chain of implemented control actions recorded during the execution of historical events;

[0021] The event re-evolution operator includes: a set of control action matching functions, an action mapping and substitution generator, and a path structure fitter and scorer;

[0022] The control action matching function set includes matching each control action in the response control action sequence with each node in the current operation sequence diagram, comparing whether the type of the control action is consistent with the node type, whether the required resources match the resources bound to the node, and whether the preceding and following behavior structures are related to the node's predecessor structure; the three matching results are weighted and summed according to a set weight to obtain the matching score of the node, and all nodes with scores not lower than a set threshold are included in the candidate node set of the corresponding control action;

[0023] The action mapping and substitution generator includes: determining whether the control action matching function set for each control action outputs a non-empty candidate node set; if the candidate node set is not empty, selecting the node with the highest matching score from the candidate node set as the embedded node of the control action in the operation sequence graph; if the candidate node set is empty, extracting the type description of the control action and the context order structure of the control action in the original path, constructing a query vector, and using the query vector to perform semantic similarity calculation with all control actions in the historical action library; when the semantic similarity of the candidate action is not lower than a set threshold, selecting the action with the highest similarity as the substitution control action; when the semantic similarity of the candidate action is lower than the set threshold, setting a control target, searching a set of reachable path segments from the operation sequence graph based on the control target, calculating the stability score of each path segment for the target area, selecting the path segment with the highest score as the substitution control action, and completing the response path;

[0024] The path structure fitter and scorer include: sequentially concatenating the embedded nodes and alternative control actions corresponding to each control action according to the order of the response control action sequence to construct a structurally complete response path; for each response path, sequentially verifying whether the control action nodes have path connectivity in the operation sequence graph, whether the execution order between actions maintains structural consistency, whether the path covers high-risk areas, and whether there are conflicts during resource scheduling; weightedly fusing the four verification indicators of path connectivity, structural consistency, coverage, and resource conflict degree to output a path score value, and selecting the top K paths as the final set of response paths.

[0025] As a preferred embodiment of the enterprise risk prediction and control method described in this invention, the dynamic environment simulation includes: constructing a strategy evolution model based on an operation sequence diagram to simulate the execution process of each response path under different external disturbance variables within multiple time periods; the disturbance variables include policy changes, resource constraints, and process blockages.

[0026] The execution of each control action is simulated and analyzed over multiple time periods, and the simulation results of the control actions are recorded. Based on the simulation results, the evolutionary stability index of each path is extracted. The evolutionary stability index includes: control action success rate, path structure retention rate, consistency of key indicator mitigation effect, resource conflict intensity, and environmental adaptability score.

[0027] As a preferred embodiment of the enterprise risk prediction and control method described in this invention, the step of selecting the optimal path includes: setting scoring weight coefficients for the evolutionary stability indicators respectively; weighting and fusing the action success rate score, path structure retention rate score, risk mitigation consistency score, resource conflict intensity score, and environmental adaptability score of each response path to generate a total score value for the path; and selecting the response path with the highest total score value as the optimal path.

[0028] An enterprise risk prediction and control system, wherein:

[0029] The data module collects multi-source data from enterprises, preprocesses it, builds a risk prediction model, and outputs a risk score for the target enterprise.

[0030] The coding module, based on the risk score, adopts a behavior-driven risk coding mechanism to extract the behavioral path features of the current situation and generate the corresponding risk situation code;

[0031] The calculation module uses the risk scenario encoding to match similar historical events in the historical event database, and combines the event re-evaluation operator to perform strategy re-evaluation on the similar historical events to generate multiple response paths;

[0032] The simulation module inputs the multiple response paths into the strategy evolution sandbox mechanism to perform dynamic environment simulation and outputs the evolution stability index of each response path.

[0033] The evaluation module, based on the evolutionary stability index, uses a multi-criteria decision-making method to evaluate and rank the multiple response paths, selects the optimal path for execution, and updates the execution result and behavior code to the historical mapping pool.

[0034] A computer device includes: a memory and a processor; the memory stores a computer program, characterized in that: when the processor executes the computer program, it implements the steps of the method described in any one of the present invention.

[0035] A computer-readable storage medium having a computer program stored thereon, characterized in that: when the computer program is executed by a processor, it implements the steps of the method described in any one of the present invention.

[0036] The beneficial effects of this invention are as follows: The enterprise risk prediction and control method provided by this invention constructs an architecture that combines a risk prediction model with a behavioral path coding mechanism. The system not only achieves accurate risk scoring based on multi-source data, but also extracts operation sequences by introducing process mining algorithms to generate interpretable risk scenario codes. Based on this, the system uses event re-enactment operators to match similar scenarios in a historical event database and re-enact response strategy paths. Combined with dynamic sandbox simulation, it performs multi-cycle simulations of multiple candidate paths under perturbation environments, quantifying and outputting indicators such as action success rate, path stability, and adaptability. Finally, a multi-criteria decision-making method is used to complete path optimization, and execution feedback and coding information are uniformly written into a historical mapping pool, forming a continuously evolving closed-loop system, improving the structural adaptability, dynamic robustness, and self-learning ability of risk response strategies. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 The first embodiment of the present invention provides an overall flowchart of a method for predicting and controlling enterprise risks. Detailed Implementation

[0039] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0040] Example 1, referring to Figure 1 As an embodiment of the present invention, a method for enterprise risk prediction and control is provided, comprising:

[0041] S1: Collect multi-source data from enterprises and preprocess it to build a risk prediction model, and output the risk score and confidence level of the target enterprise.

[0042] Enterprise multi-source data includes: internal enterprise data, external enterprise data, semi-structured data, and unstructured data.

[0043] Internal enterprise data includes: financial indicators, contract performance data, operational logs, ERP records, and personnel adjustment data.

[0044] External data for enterprises includes: fluctuations in upstream and downstream supply chains, industry sentiment data, changes in macroeconomic policies, and data from third-party risk rating agencies, etc.

[0045] Semi-structured / unstructured data includes: PDF format contract texts, invoice image data, web page announcements, and public opinion comment data, which are converted into structured vector representations through OCR recognition and natural language processing.

[0046] Preprocessing of multi-source enterprise data includes: for numerical fields, imputation using the mean method based on sample distribution; for categorical fields, inferential imputation using K-nearest neighbor imputation based on similarity. For data fields that have been missing for a long time or cannot be reliably inferred, missing labels are set to reduce noise interference.

[0047] To address outlier issues, a combination of statistical methods and rule-based strategies is employed for identification and processing. On one hand, box plot analysis and Z-scores are used to identify univariate outliers. On the other hand, reasonable threshold ranges are set based on business rules (e.g., contract performance periods must not be lower than the industry minimum), and samples exceeding logical boundaries are marked. Simultaneously, when processing log-type data, regular expressions and context filtering methods are used to remove redundant operation records and formatting noise.

[0048] For data sources with different frequencies (such as monthly financial statements and daily contract execution data), a sliding window resampling mechanism is used for time alignment. By aligning the sampling windows on the time axis, a unified feature representation of the enterprise at the same time slice is constructed, ensuring temporal consistency in subsequent modeling processes.

[0049] After data preprocessing, enterprise feature vectors are constructed based on data type and business semantics, including static features, dynamic features, interactive features, and text-based semantic embedding features.

[0050] After preprocessing the enterprise's multi-source data, enterprise feature vectors are constructed based on the data type and business semantics. These enterprise feature vectors include the following four types of features:

[0051] Static characteristics: Relatively stable variables used to characterize the basic attributes of an enterprise, including registered capital, years of establishment, industry type, number of historical default records, etc.

[0052] Dynamic characteristics: Indicators used to reflect changes in enterprise operating trends, including year-on-year revenue growth rate, cash flow volatility, coefficient of variation of contract performance duration, and contract delay growth gradient;

[0053] Interactive features: generated through non-linear combinations of different feature fields to capture the joint effects between variables, such as "accounts receivable growth rate × negative sentiment density";

[0054] Text-based semantic embedding features: For unstructured data such as enterprise contract texts, announcement information, and comments, natural language processing models (such as BERT) are used to perform contextual semantic modeling, and deep semantic vectors of the text are extracted as input.

[0055] A corporate risk prediction model is established based on corporate feature vectors to assess the likelihood of a target company experiencing a major risk event within a specified future time window, and outputs the corresponding risk score and confidence level.

[0056] The modeling process employs a fusion modeling strategy, using differentiated model structures for different types of features: for static and interactive features, a gradient boosting decision tree model (XGBoost) is used to model the relationship between nonlinear variables and risk outcomes, and output the first type of model score results.

[0057] For dynamic features, a recurrent neural network structure (LSTM) is used to model the changing trend of time-series features and output the second type of model score results.

[0058] For text-based semantic embedding features, a pre-trained language model is used to perform contextual semantic encoding on unstructured text, and a fully connected neural network is used to complete feature extraction and score prediction, outputting the third type of model score results.

[0059] The above multiple scoring results are used as input and further integrated into a lightweight logistic regression fusion model. The fusion model combines the outputs of the three sub-models through a weighted calculation to generate the final risk score for the target company. This score is a real number between 0 and 1, representing the probability of the company experiencing a major risk event during the forecast period.

[0060] During model training, supervised learning is performed using a dataset labeled with historical risks. Positive samples are companies that have experienced risk events such as credit defaults, contract terminations, or major public opinion crises, while negative samples are companies that have not experienced such events during the same period. To address the imbalance between positive and negative samples, the SMOTE oversampling method is introduced to increase the number of positive samples.

[0061] By introducing a multi-dimensional data fusion mechanism that integrates internal, external, semi-structured, and unstructured data, and employing targeted preprocessing strategies, the completeness and quality of data input can be significantly improved. In the preprocessing stage, various methods such as mean imputation, K-nearest neighbor inference, and missing label marking effectively address data missingness and inconsistency issues. Simultaneously, outlier identification using statistical methods such as Z-scores and box plots, coupled with upper and lower limit filtering logic set by business rules, enhances the model's tolerance for outliers and its ability to suppress risk noise, thus providing a stable and reliable data foundation for subsequent modeling.

[0062] A multi-type feature fusion modeling strategy is adopted. For static and interactive features, a tree model is used to construct a nonlinear risk representation. For dynamic features, a neural network is used to extract trend evolution patterns over time. For textual information, semantic encoding is used to obtain deep semantic vectors. This combined strategy effectively expands the model's adaptability to multiple data dimensions. The scoring results of each sub-model are further fused using a logistic regression model, achieving integrated judgment of different risk factor dimensions without increasing structural complexity, which is beneficial to improving the overall model's generalization ability and prediction accuracy.

[0063] During model training, by introducing clearly labeled historical risk event samples and constructing supervised learning tasks, the prior patterns of high-risk enterprises can be accurately captured. To address the problem of imbalanced sample classes, the SMOTE oversampling algorithm is integrated to increase the density of positive samples, thereby reducing training bias and improving the model's ability to identify high-risk sample regions. The final output risk score is a continuous probability value, which can be used not only for ranking-based risk warnings but also as the input basis for behavior encoding and policy matching, realizing a numerical closed loop between the prediction and response systems.

[0064] S2: Based on the risk score, a behavior-driven risk coding mechanism is adopted to extract the behavioral path features of the current situation and generate the corresponding risk situation code.

[0065] Based on the risk score of the target company, it is used to measure the likelihood of the company experiencing a major risk event.

[0066] Operational behavior log data within the current time window is extracted from the enterprise's business systems. These logs include, but are not limited to, operation records generated by ERP systems, project approval systems, contract performance platforms, HR systems, and supply chain systems. Log fields include: operation timestamp, operator, operation type, target object, and operation status. To improve the accuracy of behavior modeling and coding quality, the logs are cleaned, retaining key behavioral information and removing redundant records. The logs are organized into a standard event log table, with each event record containing a process instance number (EventID) and a standardized operation activity. The logs are grouped according to the process instance number, with the same number representing a complete business process. The operation records within each group are sorted in ascending order by timestamp, forming an operation sequence for a single process instance. The set of operation sequences corresponding to all process instances constitutes an event trajectory set, representing the evolution of the enterprise's business activities within the current time period. Based on the operation logs, a process mining algorithm (AlphaMiner) is used to extract causal patterns and align sequences in the event trajectory set, constructing an operation sequence graph. In the path structure, each node represents a business action (such as "contract approval", "payment instruction", "risk feedback"), and each edge is used to represent the causal or temporal relationship between adjacent business actions. The risk score is introduced as a dynamic control factor in the construction of the edges to adjust the support threshold and retention rules of edge construction, thereby realizing risk-guided path modeling.

[0067] The edge set includes direct successor edges, concurrent structure edges, backtracking edges, and jump edges.

[0068] direct successor edge Construction: Count the frequency f(A→B) of the next neighboring node B of node A, and then calculate based on the score. Introducing a rating adjustment factor λ, the dynamic threshold is calculated:

[0069] θ adj =θ min ×(1-λR)

[0070] When f(A→B)≥θ adj The edge is retained as a direct successor edge. A higher score lowers the edge retention threshold, used to capture less frequent but important sequential operation relationships under high-risk conditions. Where θ adj θ represents the threshold for retaining direct successor edges after risk score adjustment. min The base threshold is set statically, λ∈(0,1) is the adjustment coefficient, and R∈[0,1] represents the enterprise's current risk score. The higher the score, the lower the threshold for the frequency of edge occurrence, making it easier for the system to retain unconventional path structures under high-risk conditions.

[0071] Construction of concurrent edge structures: When A→B occurs in some trajectories and B→A occurs in others, determine whether they constitute a concurrent structure based on the frequencies of occurrence of these two types of edges; calculate the concurrency ratio by statistically analyzing f(A→B) and f(B→A).

[0072]

[0073] Introduce a risk score R ∈ [0, 1] and set a dynamic threshold:

[0074] θ adb =θ concur ·(1-βR)

[0075] When ρ≥θ adb When this happens, the edge is retained as a concurrent structure edge.

[0076] Where β∈(0,1) is the adjustment coefficient; ρ represents the concurrency ratio, and f A→B f represents the frequency of activity A appearing directly before activity B in the trajectory. B→A θ represents the frequency at which activity B directly precedes activity A in the trajectory. concur This represents the statically set baseline threshold for concurrency judgment; R represents the current risk score of the enterprise; θ adb This represents the dynamically adjusted concurrency retention threshold.

[0077] Construction of the backtrack edge (B→A): By statistically analyzing the frequency of the edge B→A in all trajectories, denoted as f(B→A), and introducing the current enterprise's risk score, we can construct the backtrack edge (B→A). Retention threshold for dynamically adjusting back edges Construct a score-driven backoff edge detection mechanism. Specifically:

[0078]

[0079] Where f(B→A) represents the frequency of the edge that backtracks from node B to node A in all behavioral trajectories; Indicates the threshold for retaining backedges; θ r δ represents the initial fixed backoff edge retention frequency threshold; δ represents the adjustment coefficient of the risk score on the backoff edge threshold, with a value range of (0, 1); R represents the risk score value of the target enterprise in the current time window, with a value range of [0, 1].

[0080] when In this case, the backoff edge is retained and incorporated into the operation sequence graph structure to enhance the ability to express abnormal feedback paths in high-risk process structures.

[0081] Construction of jump edges: In some trajectories, when node C immediately follows node A, and there is an unexecuted standard node B in between (i.e., A→B→C is more common in other trajectories), the system identifies this behavior as a jump edge. Statistics on such jump paths are then compiled. The frequency of occurrence of is denoted as . Based on the enterprise's current risk score R∈[0,1], the retention threshold for jump edges is dynamically reduced, as expressed by the formula:

[0082]

[0083] Where f(A-C) represents the frequency of node C immediately following node A in the event trajectory (skipping intermediate node B); θ j R represents the retention threshold for the basic jump edge; R represents the current enterprise's risk score, ranging from 0 to 1; η represents the jump edge score adjustment coefficient, ranging from (0, 1). This represents the threshold for retaining the jump edge, dynamically calculated under R adjustment.

[0084] when At that time, the system retains the edge. They are then marked as jump edges to support subsequent risk interpretation and control path simulation.

[0085] After constructing the operation sequence graph based on the risk score and labeling various edge structures, the system further extracts the behavioral path features of the current enterprise based on the operation sequence graph, which is used to characterize the potential risk causal patterns in the behavioral graph.

[0086] Specifically, the system extracts behavioral path features from the constructed graph structure, including:

[0087] Path length: The number of nodes in the main path from the start node to the end node, used to measure the depth of process operations; Abnormal node ratio: The percentage of low-frequency operation nodes retained in the path graph, indicating the density of non-main process behaviors; Number of jump edges: The number of all jump edges marked by the system, reflecting the penetration degree of non-standard operation paths; Backtracking edge frequency: The proportion of backtracking edges to the total number of edges, used to measure process rework and response instability; First abnormal node position: The index position of the first abnormal node in the main path, measuring the earlyness of risk exposure; Node type diversity index: The number of operation types involved in a node, assessing the complexity of process operations.

[0088] All behavioral path features are directly extracted from nodes and edges in the path graph, ensuring consistency between the behavioral structure and the rating-driven graph construction, and avoiding semantic disconnect.

[0089] To further enhance the ability of risk scores to explain the process structure, behavioral path feature fields are cross-combined with enterprise risk scores to form a set of scoring behavior coupling features, specifically including: risk score × path length; risk score × percentage of abnormal nodes; risk score × number of jump edges; risk score × frequency of backtracking edges; risk score × position of the first abnormal node; and risk score × node type diversity index.

[0090] The introduction of scoring behavior coupled feature fields enables the system to generate differentiated expressions for the same structural feature under different risk levels, strengthening the ability to highlight "high score + structural anomaly".

[0091] The system constructs a risk scenario encoding vector for the current enterprise based on the scoring behavior coupling feature field, including: scoring dimension field: using the risk score value generated in step S1; structural feature dimension field: derived from the behavioral path features extracted from the operation sequence diagram; scoring coupling dimension field: scoring behavior coupling feature generated by the intersection of the score value and the structural field.

[0092] The final generated risk scenario encoding vector is an ordered set of features, with the fields arranged in the following order:

[0093] [Score | Structure fields 1, 2, 3, ... n | Coupling fields 1, 2, 3, ... n]

[0094] All field values ​​in the risk scenario encoding vector are numerical, making it suitable for subsequent calculation scenarios such as scoring, classification, clustering, and path matching. The order between fields is fixed, and field names or indexes correspond one-to-one with semantics, facilitating version control and feature traceability. The length of the risk scenario encoding vector is fixed or configurable, supporting flexible access and decomposition in different policy systems.

[0095] After the risk score is generated, the process of constructing operational behavior paths based on the score effectively establishes a structural correlation between the score results and process behaviors. By extracting the enterprise's operation log data within a specified time window, grouping it by process instance number and arranging it in ascending order to form an event trajectory set, and then using process mining methods for causal relationship analysis and time sequence alignment, a relatively complete enterprise business path structure can be recovered at the log level. Compared to existing technologies that only use importance indicators to construct static risk labels, this process supports reconstructing the risk formation path from the business execution level, providing a concrete behavioral basis for subsequent response control.

[0096] In the process of constructing the operational path, a scoring value is introduced as an adjustment parameter for edge construction, making the retention judgment of various types of edges in the path risk-sensitive. Dynamic retention thresholds associated with the scoring value are designed for direct successor edges, concurrent structure edges, backtracking edges, and jump edges, respectively. The tolerance for edges can be adjusted according to the scoring level, thereby automatically enhancing the retention capability of non-main process links in high-risk scenarios. This strategy overcomes the limitations of existing technologies that rely solely on frequency statistics for process graphing and cannot reflect the scoring context, making the scoring results directly affect structural modeling and improving the ability of behavioral path representation to interpret risk.

[0097] After completing path mapping and edge structure annotation, the structural features of the process path are further extracted, such as path length, percentage of abnormal nodes, proportion of backtracking edges, and number of jump behaviors. These features are then combined with the scoring values ​​at the field level to construct a numerical vector representation linking scoring and behavior. This encoding result combines scoring intensity information with structural behavior differences, and can be directly input into subsequent strategy calculation modules or similarity matching models. This fills the technical gaps where prediction results cannot be quantified and implemented, and control responses lack input interfaces, ensuring a traceable and computable intermediate support structure between scoring output and response generation.

[0098] S3: Using the risk scenario encoding, match similar historical events in the historical event database, and combine the event replay operator to perform policy replay on the similar historical events to generate multiple response paths.

[0099] After completing the risk scenario coding, the system uses the coding as an input vector to perform sample similarity matching operations in the historical event database, and combines it with strategy replay to construct a candidate set of response paths that are suitable for the current enterprise.

[0100] Establishing a structured historical event database includes: each historical record contains a set of risk scenario codes, a corresponding operational path diagram, a sequence of response control actions implemented, and actual path performance indicators generated from historical execution feedback. These indicators are derived from monitoring data after the historical path was executed within the original enterprise, including response success rate, process recovery time, resource consumption intensity, public opinion fluctuation amplitude, and risk score decline amplitude. All feedback results are uniformly bound to the original path and stored in the event database after the control is completed.

[0101] To find historical cases similar to the current enterprise risk scenario structure, the system uses risk scenario encoding vectors as the retrieval basis and performs similarity matching operations on historical samples. Specifically, for the risk scenario encoding vectors already archived in the historical event database, the system uses a field-weighted similarity calculation method to compare each vector with the current encoding, generating similarity ranking results. To improve the semantic relevance of the matching, static field weight coefficients are set for each field in the risk scenario encoding vector, serving as weighting factors when calculating similarity. The field weights are set according to the predefined field influence level classification rules in the system. Among them, the proportion of abnormal nodes, score values, and number of jump edges are marked as first-level weight fields, assigned a value of 1.0; path length, backedge frequency, etc. are second-level fields, assigned a value of 0.7; and other structural feature fields are assigned a value no higher than 0.5. During the similarity calculation process, the system multiplies the difference between each field by the corresponding field weight, performs normalization and superposition, and finally outputs a weighted distance or weighted cosine similarity score as the basis for matching ranking. This method avoids the risk of weakening key structural fields, making the matching results more consistent with the common structural features in high-risk contexts.

[0102] After matching is completed, the top M historical path samples with the highest similarity are retrieved, and the adaptability of the historical path response action sequences is verified. The response action sequence for each matched event is retrieved, and the event re-evolution operator is used to reconstruct the structure and evaluate the adaptability of the response action sequence. The event re-evolution operator is used to complete control action mapping, substitution generation, and path structure fitting to construct a feasible response path for the current process environment.

[0103] The event re-evolution operator includes: a set of control action matching functions, an action mapping and substitution generator, and a path structure fitter and scorer.

[0104] The control action matching function set is used to identify the mapping position of each control action in the historical response path in the current operation sequence diagram. Each control action in the historical response path is represented as a structural triple:

[0105] a i =<τ i ,r i,i >

[0106] Where, τ i Indicates the action type (such as "Approve", "Freeze", or "Replace"), r i This indicates the resource call characteristics of the action (such as required roles, system permissions, approval object type, etc.). i This indicates the logical location context of the action within the original path (such as the type of preceding action or the current process segment). i This represents the i-th control action; i represents the index of the control action.

[0107] In the current enterprise's operation sequence graph G = (V, E), the system assigns each graph node v j ∈V performs matching score calculation to determine whether it satisfies a. i The structural consistency relationship between them.

[0108] The matching score includes three sub-conditions, specifically:

[0109] Type consistency function: f1(a i ,v j If τ = 1 i =type(v j ), otherwise it is 0.

[0110] Resource matching degree function: f2(a i ,v j ) = sim(r i ,r j ), where r j Represents node v j The corresponding resource call vector.

[0111] Context alignment function: f3(a i ,v j If v = 1 j Predecessor node set structure and i The corresponding path segments are logically equivalent; otherwise, the value is 0.

[0112] The node matching score is defined as:

[0113] S ij =αf1(a i ,v j )+βf2(a i ,v j )+γf3(a i ,v j )

[0114] Where α, β, γ ∈ [0, 1], satisfying α + β + γ = 1, representing the weight preferences of the three types of matching factors respectively. j represents the node index, V represents the node set, E represents the edge set, and r i Indicates the control action a i The required resource call feature vector, sim represents the similarity function; S ij This represents the node matching score.

[0115] Set a matching score threshold θ, if S ij If ≥θ, then node v j Include control action a i The set of candidate matching nodes:

[0116] Ci ={v j ∈V∣S ij ≥θ}

[0117] The candidate node set C i This will serve as a candidate node set when embedding subsequent control actions into the operation sequence diagram, and will be used as input for the path structure generation and scoring stages.

[0118] For C i All nodes v j A second screening is conducted, and the fit score for each node is calculated based on the following comprehensive scoring rules:

[0119]

[0120] Among them, LS(v j ) indicates the connectivity between this node and its adjacent nodes in the current flowchart; RF(v j ) indicates the degree of conflict between the node's resource allocation and the current context (lower is better); λ1, λ2, and λ3 are the scoring weights for each dimension, satisfying λ1+λ2+λ3=1. This represents the overall adaptation score of the node.

[0121] Select the node with the highest score As control action α i Embedded nodes in the current operation sequence graph.

[0122] The action mapping and substitution generator is used to find functionally equivalent or policy-purpose equivalent substitution actions from the historical action library when the historical control actions cannot be adapted in the current operation sequence diagram, and to construct logically equivalent control paths to ensure the executability of the path structure and the semantic consistency of the control objectives.

[0123] The control action a that failed to match i =<τ i ,r i,i >Mapped to query vector:

[0124]

[0125] Among them, Embed(τ i ) indicates that the action type is encoded as a semantic vector; Context( i This indicates that the structural features of the preceding and following path segments are encoded into context vectors, reflecting the pre-action / subsequent action graph features.

[0126] Search for all candidate actions in the historical action library. k '∈A, calculate its matching degree Sim with the query vector. k :

[0127]

[0128] When action a exists k 'Meet Sim k If the similarity is ≥δ (where δ is the equivalence similarity threshold), then a is determined to be... k 'This is an alternative action that can replace the original action a' i .

[0129] If no single action satisfies the replacement requirement, the system initiates a path construction process: using the target control effect vector g. i (For example, "freezing high-risk nodes" and "isolating non-compliant paths") are used as constraints. The path constructor is called to search for a set of reachable sub-paths P = {p1, p2, ...} in the current path graph, and the policy objective fit score is performed for each path.

[0130] R(p j ,g i )=η·Coverage(p j ,target nodes)+(1-η)·Stabi

[0131] Coverage() indicates whether the path covers the critical area of ​​the process affected by the original target action, and Stability() indicates the stability assessment result of the path in the process structure. The path p′ with the highest score is selected to replace the original action a. i , as a newly constructed response path segment, participates in subsequent structural assembly. R(p j ,g i The score represents the policy objective fit score of the path.

[0132] Control node By concatenating the highest-scoring path segment p′ in sequence, a structured response path sequence P is generated:

[0133] P=(v′1,p′2,v′3,…,v′ n )

[0134] Each element in the path represents the embedded result of a control action from the matching or substitution output. If a step is a path segment, the system automatically performs connectivity analysis and graph structure alignment on adjacent segments to ensure the overall structure of the response path is executable and sequentially complete. Finally, the system constructs a set of response paths.

[0135]

[0136] Each path is a semantically preserved and structurally reorganized result of historical paths, serving as input for the path structure fitting and scoring stages.

[0137] By introducing structured risk context encoding and field-weighted matching mechanisms, this method achieves accurate screening and highly semantically consistent context alignment for high-dimensional heterogeneous historical events. Compared to traditional historical strategy backtracking methods based on tag classification or keyword retrieval, this method can maintain the expression of field features at the risk structure level while highlighting the influence of key risk feature fields such as anomaly density and jump structures. It overcomes the problems of key fields being diluted by the mean and large matching errors, making the matching results closer to the real business risk map.

[0138] During the strategy replay process, a feasible response path reorganization mechanism is constructed by combining a set of control action matching functions and an alternative generator. Compared with the traditional "template copying" path mapping method, this solution introduces structural triples to model action behaviors and forms a quantifiable node matching score based on a three-dimensional scoring function of context alignment, resource invocation, and type structure. At the same time, for nodes that cannot be matched, semantic embedding and path constructors are introduced to support dynamic substitution at the action level and path level. Under the premise of ensuring that the strategy objective remains unchanged, the logical structure is adaptively generated, breaking through the technical barriers of "templates cannot be transferred" and "strategy structure is rigid" in traditional systems.

[0139] Based on the results of the aforementioned action embedding and substitution process, the system reconstructs the structured response path sequence and generates a candidate path set through path splicing logic. This process automatically reconstructs the order of control actions, verifies connectivity and reachability, and aligns the structure, ensuring the continuity and execution integrity of the response path. Compared to traditional path adaptation methods that rely on manual judgment or piecemeal assembly in policy migration, this method achieves seamless translation of response paths from a "historical experience base" to an "operation sequence graph," improving policy migration efficiency, control path stability, and the automation level of model evolution.

[0140] S4: Input the multiple response paths into the strategy evolution sandbox mechanism, perform dynamic environment simulation, and output the evolution stability index of each response path;

[0141] Based on the operation sequence diagram and current enterprise state information, the system constructs a strategy evolution sandbox model S to simulate the execution effect of each response path in a dynamic context. Each response path p... k A sequence of control actions arranged in a time order:

[0142]

[0143] The system constructs a sequence of external perturbation variables for each path:

[0144]

[0145] Where, p kThis represents the k-th response path, which consists of a set of control actions in chronological order. Indicates the response path p k The i-th control action in the [1, m], where the index i ∈ [1, m] k ] represents the action number within the path, and the superscript (k) in parentheses indicates that the action belongs to the k-th path; m k Represents path p k The number of control actions included; ε (t) This represents the sequence of external disturbance variables over a time period t; Let j represent the specific state of the j-th external disturbance variable under time period t, where j∈[1,q] represents the variable type number; q represents the total number of disturbance variables considered.

[0146] During sandbox operation, the system processes each path p k Perform periodic simulations and record each control action within each time period t∈[1,T]. Simulation feedback; simulation feedback includes execution success flags. ∈{0,1}, resource utilization rate Feedback delay Key indicator: slow release

[0147] For each path p k The system defines the evolutionary stability vector as follows:

[0148] S(p k = [S1,S2,S3,S4,S5]

[0149] S1: Success rate of the action

[0150]

[0151] S2: Path structure retention rate

[0152]

[0153] S3: Consistency of sustained-release effect (standard deviation reflects instability)

[0154]

[0155] S4: Resource Conflict Intensity

[0156]

[0157] S5: Environmental Adaptability Score (Score of overall performance in sandbox simulation)

[0158]

[0159] Where S1 represents the success rate of the action; m k p represents the k-th response path k The number of control actions in the simulation; T represents the total number of time periods set during the sandbox simulation. Represents path p k S1 is a flag variable indicating whether the i-th control action was successfully executed in time period t (with a value of 0 or 1); S2 represents the path structure retention rate; the number of path breaks represents the number of times the path was interrupted during the simulation; the maximum number of actions represents the maximum number of control actions in the path; S3 represents the consistency of the mitigation effect (used to reflect the stability of the execution effect); Represents path p k Risk mitigation effectiveness metrics for each period within the time period from 1 to T; std(·) represents the standard deviation calculated for the input variables; S1 represents the maximum value of the slow-release amount across all simulation cycles; S4 represents the resource conflict intensity; conflict_score(t) represents the resource conflict score detected by the system within time period t; S5 represents the environmental adaptability score. Represents path p k The set of external environmental disturbance variables ε under time period t (t) The adaptation score.

[0160] By constructing a path sequence p k With external disturbance variable sequence ε (t) The strategy evolution sandbox model allows the system to perform fine-grained extrapolation of the execution behavior of multiple response paths in future dynamic environments. During the sandbox simulation, execution feedback markers at the control action granularity (such as...) are introduced. The system, at the path level, not only monitors the continuity of the structure and the completion of control actions, but also dynamically evaluates risk mitigation efficiency, resource conflict intensity, and adaptability, thereby constructing a stability scoring vector S(p) containing five-dimensional quantitative indicators. k This method effectively overcomes the shortcomings of traditional response paths that rely solely on static rule matching. For the first time, it introduces external disturbance modeling into path evaluation, breaking through the technical bottleneck of "unpredictable execution effects" in dynamic risk control scenarios. At the execution level, the system supports multi-cycle, disturbance-inducing simulation re-engineering for each candidate path. It supports generating fine-grained indicators such as path breakage rate, mitigation effect variance, conflict score, and fit goodness through simulation feedback, improving the comparability and real-world applicability of path ranking. Compared to traditional methods that use fixed template strategies or preset path coverage rules for selection, the current mechanism provides a structurally responsive path adaptation measurement method for changing environmental conditions, possessing dynamic decision-making capabilities across cycles and scenarios, significantly improving the rationality of strategy selection and the effectiveness of environmental resilience matching.

[0161] S5: Based on the evolutionary stability index, a multi-criteria decision-making method is used to evaluate and rank the multiple response paths, select the optimal path to execute, and update the execution result and behavior code together to the historical mapping pool.

[0162] The system receives the following set of response path stability metrics from the S4 phase output:

[0163] S = {S(p1),S(p2),...,S(p...} n )}

[0164]

[0165] Among them, each S(p k ) represents path p k The five-dimensional stability index vector calculated during the strategy evolution sandbox simulation corresponds to action success rate, structure retention rate, mitigation consistency, resource conflict intensity, and environmental adaptability score. The system sets the stability dimension weight vector as follows:

[0166]

[0167] The total score for each path is calculated using the following weighted formula:

[0168]

[0169] The system sorts all path scores in descending order and selects the response path with the highest score:

[0170]

[0171] and the selected path p * The data is submitted to the enterprise control system for actual execution. During path execution, the system records each control action. Actual startup time t i Execution status Feedback delay Compared with actual sustained-release effect After execution, the system constructs a structured execution feedback set:

[0172]

[0173] The system will select path p * Its corresponding behavior encoding vector E(p) * ), simulation index vector S(p * and actual execution feedback set Unified binding is performed to form historical samples:

[0174]

[0175] It is written into the historical mapping pool to update the historical event library index and policy replay scoring parameters in the event replay operator, thereby achieving closed-loop adaptive learning.

[0176] The system employs a multi-criteria decision-making method to weight and score the evolutionary stability index vector of the response path. This comprehensively considers multiple dimensions such as action success rate, structure retention rate, mitigation consistency, resource conflict intensity, and environmental adaptability, quantifying the overall execution performance of the response path. Compared to traditional strategy selection methods that statically rank based on a single dimension such as the number of responses or historical trigger frequency, this method constructs a scoring function `Score(pk)` and introduces a weight vector `w`. This achieves multi-scale aggregation of path stability characteristics, giving the ranking results stronger risk matching and execution prediction capabilities. This effectively overcomes the technical limitation that response strategies cannot dynamically assess execution feasibility and control effectiveness.

[0177] During the response path determination and execution feedback phase, the system not only implements structured control of path selection but also simultaneously records the actual execution status, mitigation effect, and key indicator feedback of each control action. This data, along with the original risk scenario encoding and simulation indicator vectors, is then encapsulated into structured samples and written into the historical mapping pool. This mechanism supports the automatic updating of policy quality assessment and replay scores for subsequent similar scenarios by the event replay operator, constructing a closed-loop feedback system of "policy scoring—execution verification—sample update." This significantly improves the adaptive capability and cross-cycle evolution capability of the policy system, solving the structural problem that response strategies struggle to maintain long-term effectiveness amidst environmental changes.

[0178] Example 2, an embodiment of the present invention, provides an enterprise risk prediction and control system, including:

[0179] The data module collects multi-source data from enterprises, preprocesses it, builds a risk prediction model, and outputs a risk score for the target enterprise.

[0180] The coding module, based on the risk score, adopts a behavior-driven risk coding mechanism to extract the behavioral path features of the current situation and generate the corresponding risk situation code.

[0181] The calculation module uses the risk scenario encoding to match similar historical events in the historical event database, and combines the event re-evolution operator to perform policy re-evolution on the similar historical events to generate multiple response paths.

[0182] The simulation module inputs the multiple response paths into the strategy evolution sandbox mechanism to perform dynamic environment simulation and outputs the evolution stability index of each response path.

[0183] The evaluation module, based on the evolutionary stability index, uses a multi-criteria decision-making method to evaluate and rank the multiple response paths, selects the optimal path for execution, and updates the execution result and behavior code to the historical mapping pool.

[0184] Example 3, an embodiment of the present invention, differs from the previous two embodiments in that:

[0185] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0186] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device).

[0187] "Computer-readable medium" can be any means that can contain, store, communicate, propagate or transmit programs for use by or in conjunction with an instruction execution system, apparatus or device.

[0188] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0189] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0190] Example 4 is an embodiment of the present invention, which provides a method and system for enterprise risk prediction and control. In order to verify the beneficial effects of the present invention, a simulation experiment is conducted for scientific demonstration.

[0191] To verify the adaptability and effectiveness of the enterprise risk prediction and control method proposed in this invention in actual enterprise scenarios, a manufacturing company A was selected as the experimental subject. The time range was from January 2023 to March 2024, covering the company's internal structured data, external monitoring data, and unstructured text records.

[0192] First, the data sources collected included: internal enterprise data: 29 items of financial data (such as net profit and revenue growth rate), 12 human resource indicators, and 1.03 million ERP operation logs; external data: credit records of upstream and downstream customers, industry policy updates, third-party risk ratings, and credit risk reports from partner banks; unstructured data: 412 scanned copies of announcement documents, with an average of 980 characters of recognized text per document after OCR conversion, which were then processed using an NLP model to form a contract stability vector; before entering the modeling process, all data were cleaned using normalization, missing data imputation, and anomaly correction strategies. Static features were imputed using the mean method, categorical features were filled using the KNN completion strategy, and dynamic indicators were aggregated into daily granularity using a sliding window.

[0193] In the risk prediction modeling stage, the preprocessed features are input into three types of sub-models: static and interactive features are modeled by XGBoost; dynamic trend data is input into LSTM; text data is encoded by BERT and then input into MLP to extract features; the outputs of the three sub-models are fused by logistic regression to obtain a risk score of 0.83 for the company in the next quarter, which is predicted to be a high-risk state.

[0194] The system then automatically retrieved 1,864 operation log records from ERP, OA, contract platform, and HR system, aggregating them into 52 complete process trajectories. The process mining module used the HeuristicMiner algorithm to construct an operation sequence graph containing 78 nodes and 104 edges, and extracted behavioral path features, such as 7 jump edges, a backtracking edge frequency of 18.75%, and an abnormal node ratio of 22.3%. These features were cross-coupled with high scores to generate a risk scenario encoding vector.

[0195] During the strategy replay phase, similar risk scenario codes (top 10 similarities) are matched from the historical event database, control action sequences are extracted, and the event replay operator is invoked for structure mapping and action substitution, generating 8 executable response paths. All paths are input into an evolutionary sandbox to simulate execution feedback under disturbances such as policy changes, customer churn, and supply chain delays over the next 3 months, outputting a five-dimensional stability index vector. The system ultimately selects the path with the highest comprehensive score for execution and records the control action completion rate, mitigation effect, and feedback delay during the execution process, completing a full closed-loop update.

[0196] The experimental data includes: Risk score: 0.83 (high risk level); Operation trajectory sample: 52 process trajectories, average number of nodes: 14.25; Behavioral path characteristics: Abnormal node percentage: 22.30%; Number of jump edges: 7; Backtrack edge frequency: 18.75%; First abnormal node position: 3rd; Number of response paths generated: 8; Average response path length: 9.13 steps; Sandbox simulation cycle: 90 days (T=90); Sandbox output stability indicators (final selected path) include: Action success rate: 0.97; Path retention rate: 0.89; Slow-release consistency: 0.92; Resource conflict intensity: 0.08; Environmental adaptability: 0.91; Actual execution feedback includes: Control action completion rate: 96.55%; Risk score decline: from 0.83 to 0.41 (a decrease of 50.60%); Number of negative public opinion comments decreased: 32 → 6; Contract performance delay cases decreased by 37.14%.

[0197] The results from the risk prediction phase show that the company's initial score reached 0.83, clearly placing it in the high-risk range. Traditional methods typically provide risk warnings based on financial indicators or fixed business rules, but these methods struggle to explain the source of the score and the underlying behavioral triggers. This embodiment, by introducing operational path diagrams and process mining techniques, accurately identifies the distribution structure of jumps, regressions, and abnormal nodes in the current business flow. The coupled modeling of behavioral paths and scores significantly improves the interpretability of the risk structure.

[0198] In terms of response strategy design, traditional strategy libraries only provide preset templates or fixed solutions, which cannot adapt to complex structures. This invention, however, combines event re-evolution operators with a control action substitution mechanism to automatically construct equivalent sub-paths when control action matching fails, ensuring the continuity and feasibility of the response path. During implementation, three control actions that could not be embedded were automatically identified and repaired through semantic equivalence substitution or path segment construction, forming a complete control sequence.

[0199] The sandbox simulation realistically simulates the enterprise's response capabilities under various disturbance scenarios, and performs multi-dimensional stability scoring on different paths, avoiding the limitations of relying solely on score values ​​or costs in path selection. The selected path achieved success rates above 90% in three indicators: action success rate, mitigation consistency, and environmental adaptability, indicating that the strategy has strong adaptability under possible future conditions.

[0200] Most importantly, during the closed-loop execution phase, the system updates the historical event index by binding behavioral coding with execution feedback, providing structured data samples for subsequent similar scenario matching. Actual feedback shows that this strategy reduced the risk score from 0.83 to 0.41 within 3 weeks, with comprehensive improvement in key behavioral indicators. This demonstrates that the method has significant risk control and response optimization capabilities in real-world dynamic enterprise scenarios, outperforming traditional static strategy methods and exhibiting outstanding creativity and practical application value.

[0201] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for enterprise risk prediction and control, characterized in that, include: Collect multi-source data from enterprises and preprocess it to build a risk prediction model and output the risk score of the target enterprise. Based on the risk score, a behavior-driven risk coding mechanism is used to extract the behavioral path features of the current situation and generate the corresponding risk situation code. Using the aforementioned risk scenario encoding, similar historical events are matched in the historical event database, and the similar historical events are re-enacted using the event re-enactment operator to generate multiple response paths. The multiple response paths are input into the strategy evolution sandbox mechanism to perform dynamic environment simulation and output the evolution stability index of each response path. Based on the evolutionary stability index, a multi-criteria decision-making method is used to evaluate and rank the multiple response paths, select the optimal path for execution, and update the execution result and behavior code together to the historical mapping pool.

2. The enterprise risk prediction and control method as described in claim 1, characterized in that: The enterprise's multi-source data includes internal enterprise data, external enterprise data, semi-structured data, and unstructured data; The risk prediction model is constructed by extracting enterprise feature vectors from preprocessed multi-source enterprise data; the enterprise feature vectors include static features, dynamic features, interactive features, and text-based semantic embedding features. A gradient boosting decision tree model is used to model static and interactive features, and the first type of model score is output. A recurrent neural network structure is used to model dynamic features, and the second type of model score is output. A pre-trained language model is used to extract semantic vectors from text semantic embedding features, and the third type of model score is output through a fully connected network. The risk score of the target company is generated by weighting and fusing the scores from the first type of model, the second type of model, and the third type of model.

3. The enterprise risk prediction and control method as described in claim 2, characterized in that: The extraction of behavioral path features in the current context This includes extracting operation behavior logs within the current time window from the enterprise business system; grouping the logs according to the process instance number; arranging the logs in chronological order to form a set of operation sequences corresponding to multiple process instances, thus constituting an event trajectory set; Based on the event trajectory set, an operation sequence graph is constructed using a process mining algorithm. The nodes of the operation sequence graph represent standardized business operation actions; the edges of the operation sequence graph represent causal or temporal dependencies between adjacent operations. The edge set includes direct successor edges, concurrent structure edges, backtracking edges, and jump edges. Based on the operation sequence graph, behavioral path features of the enterprise are extracted. The behavioral path features include path length, percentage of abnormal nodes, number of jump edges, frequency of backtracking edges, location of the first abnormal node, and node type diversity index.

4. The enterprise risk prediction and control method as described in claim 3, characterized in that: The risk scenario coding includes cross-combining the behavioral path features with the risk score to form a scoring-behavior coupling feature; and constructing a risk scenario coding vector for the current enterprise based on the fields of the risk score, behavioral path features, and scoring-behavior coupling feature. The risk scenario encoding vector is represented as: [risk score | behavioral path feature field 1, 2, 3, ... n | score-behavior coupling feature field 1, 2, 3, ... n].

5. The enterprise risk prediction and control method as described in claim 4, characterized in that: Extract the response control action sequence corresponding to the similar historical events; call the event re-operator to restructure and adapt the response control action sequence, and generate multiple response paths suitable for the current process environment; The response control action sequence is a chain of implemented control actions recorded during the execution of historical events; The event re-evolution operator includes: a set of control action matching functions, an action mapping and substitution generator, and a path structure fitter and scorer; The control action matching function set includes matching each control action in the response control action sequence with each node in the current operation sequence diagram, comparing whether the type of the control action is consistent with the node type, whether the required resources match the resources bound to the node, and whether the preceding and following behavior structures are related to the node's predecessor structure; the three matching results are weighted and summed according to a set weight to obtain the matching score of the node, and all nodes with scores not lower than a set threshold are included in the candidate node set of the corresponding control action; The action mapping and substitution generator includes: determining whether the control action matching function set for each control action outputs a non-empty candidate node set; if the candidate node set is not empty, selecting the node with the highest matching score from the candidate node set as the embedded node of the control action in the operation sequence graph; if the candidate node set is empty, extracting the type description of the control action and the context order structure of the control action in the original path, constructing a query vector, and using the query vector to perform semantic similarity calculation with all control actions in the historical action library; when the semantic similarity of the candidate action is not lower than a set threshold, selecting the action with the highest similarity as the substitution control action; when the semantic similarity of the candidate action is lower than the set threshold, setting a control target, searching a set of reachable path segments from the operation sequence graph based on the control target, calculating the stability score of each path segment for the target area, selecting the path segment with the highest score as the substitution control action, and completing the response path; The path structure fitter and scorer include: sequentially concatenating the embedded nodes and alternative control actions corresponding to each control action according to the order of the response control action sequence to construct a structurally complete response path; for each response path, sequentially verifying whether the control action nodes have path connectivity in the operation sequence graph, whether the execution order between actions maintains structural consistency, whether the path covers high-risk areas, and whether there are conflicts during resource scheduling; weightedly fusing the four verification indicators of path connectivity, structural consistency, coverage, and resource conflict degree to output a path score value, and selecting the top K paths as the final set of response paths.

6. The enterprise risk prediction and control method as described in claim 5, characterized in that: The dynamic environment simulation includes constructing a strategy evolution model based on the operation sequence diagram to simulate the execution process of each response path under different external disturbance variables in multiple time periods. The disturbance variables include policy changes, resource constraints, and process disruptions; Simulate and analyze the execution of each control action over multiple time periods, and record the simulation results of the control action. Based on the simulation results, evolutionary stability indices are extracted for each path. These indices include: control action success rate, path structure retention rate, consistency of key indicator mitigation effects, resource conflict intensity, and environmental adaptability score.

7. The enterprise risk prediction and control method as described in claim 6, characterized in that: The process of selecting the optimal path includes setting scoring weight coefficients for the evolutionary stability indicators, weighting and fusing the action success rate score, path structure retention rate score, risk mitigation consistency score, resource conflict intensity score, and environmental adaptability score of each response path to generate a total score value for the path, and selecting the response path with the highest total score value as the optimal path.

8. A business risk prediction and control system employing the method described in any one of claims 1-7, characterized in that: The data module collects multi-source data from enterprises, preprocesses it, builds a risk prediction model, and outputs a risk score for the target enterprise. The coding module, based on the risk score, adopts a behavior-driven risk coding mechanism to extract the behavioral path features of the current situation and generate the corresponding risk situation code; The calculation module uses the risk scenario encoding to match similar historical events in the historical event database, and combines the event re-evaluation operator to perform strategy re-evaluation on the similar historical events to generate multiple response paths; The simulation module inputs the multiple response paths into the strategy evolution sandbox mechanism to perform dynamic environment simulation and outputs the evolution stability index of each response path. The evaluation module, based on the evolutionary stability index, uses a multi-criteria decision-making method to evaluate and rank the multiple response paths, selects the optimal path for execution, and updates the execution result and behavior code to the historical mapping pool.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the enterprise risk prediction and control method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the enterprise risk prediction and control method according to any one of claims 1 to 7.

Images