Visual risk control modeling method and system

Abstract

The invention discloses a visual risk control modeling method and system, and relates to the technical field of artificial intelligence, original heterogeneous data is acquired and feature extraction is performed, and if the association strength of extracted feature values is smaller than an association threshold value, the extracted feature values are rejected to obtain a refined feature data set; constructing a risk portrait frame based on the refined feature data set, and generating a risk association graph according to the risk portrait frame by adopting a graph neural network; predicting a change characteristic value of a node in the risk association map, and if the change characteristic value exceeds a fluctuation range, marking the node as a potential threat signal; according to the method, the potential threat signals are subjected to hierarchical storage, evolution paths of the potential threat signals are analyzed, high-correlation signals are marked, a threat mode of risk evolution is determined, and accurate prediction and visual presentation of risks are realized.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a visual risk control modeling method and system. Background Technology

[0002] Risk control modeling, as a core area of ​​finance and corporate management, plays an irreplaceable role in ensuring the security and stability of economic activities. Especially in the current context of data explosion and diversified risks, building an accurate and real-time risk assessment system has become an urgent need for industry development. However, existing methods often fall short when faced with complex, multi-source data and dynamic risk environments. Many traditional solutions rely on a single data source or static models, making it difficult to adapt to the integration of cross-domain information and real-time changes, resulting in a significant reduction in the accuracy and timeliness of risk prediction.

[0003] At a deeper level, this field faces numerous technical challenges. The most pressing is how to effectively integrate heterogeneous data from different sources and extract key risk characteristics. Due to the diversity and structural differences in data sources, the lack of a unified processing framework leads to severe information silos, making it difficult to form a comprehensive risk profile. A further challenge arises from how to build a dynamically interconnected knowledge system based on multidimensional data to capture hidden relationships and potential threats. The limitations of data silos hinder correlation analysis, thus affecting the ability to deeply understand and predict risk evolution. Finally, this insufficient correlation leads to another critical problem: inadequate extrapolation and decision support capabilities in extreme scenarios, and a lack of dynamic simulation and visualization of future risk trends, making it difficult for decision-makers to respond quickly.

[0004] Therefore, how to achieve accurate risk prediction and intuitive presentation in a multi-source heterogeneous data environment has become a key problem that this research urgently needs to solve. Summary of the Invention

[0005] This application aims to at least partially address one of the technical problems in related technologies. To this end, one objective of this application is to propose a visual risk control modeling method and system that achieves accurate risk prediction and intuitive presentation.

[0006] One aspect of this application provides a visual risk control modeling method, including:

[0007] Step S100: Obtain the original heterogeneous data and perform feature extraction. If the correlation strength of the extracted feature values ​​is less than the correlation threshold, they are removed to obtain a refined feature dataset.

[0008] Step S200: Construct a risk profiling framework based on the refined feature dataset, and use a graph neural network to generate a risk association map based on the risk profiling framework;

[0009] Step S300: Predict the changing characteristic values ​​of nodes in the risk correlation graph. If the changing characteristic values ​​exceed the fluctuation range, mark the node as a potential threat signal.

[0010] Step S400: Store potential threat signals in a hierarchical manner, analyze the evolution path of potential threat signals, mark highly relevant signals, and determine the threat patterns of risk evolution;

[0011] The specific method for obtaining the original heterogeneous data and performing feature extraction, and discarding any extracted feature values ​​whose correlation strength is less than the correlation threshold to obtain a refined feature dataset is as follows:

[0012] Step S110: Obtain raw heterogeneous data from different channels, extract features from the raw heterogeneous data, and obtain the extracted feature values;

[0013] Step S120: Perform correlation analysis based on the extracted feature values ​​to determine the correlation strength between features. If the correlation strength is less than the preset correlation threshold, the feature is removed as an irrelevant feature to obtain a refined feature dataset.

[0014] The process of acquiring raw heterogeneous data from different channels includes: acquiring multi-source data from multiple channels through a preset acquisition framework to form raw heterogeneous data; the acquired raw heterogeneous data is initially organized according to data structure differences using format standards to obtain structured data groups; for the structured data groups, if inconsistencies in data fields are detected, field mapping is performed through metadata description to determine a unified description specification; according to the unified description specification, standardization processing is performed on the structured data groups to obtain a standardized data set.

[0015] The process of extracting features from the original heterogeneous data to obtain extracted feature values ​​includes: obtaining source information of different data from a standardized dataset; integrating data from different sources using data fusion technology to obtain a fused dataset in a unified format; and applying feature extraction methods to the fused dataset to identify and extract key feature value domains to obtain extracted feature values.

[0016] The specific method for constructing a risk profiling framework based on a refined feature dataset and generating a risk association graph using a graph neural network based on the risk profiling framework is as follows:

[0017] Step S210: Construct a risk profiling framework based on the refined feature dataset, and use a graph neural network to model the risk profiling framework to determine the connection relationships of each feature in the refined feature dataset; the construction method of the risk profiling framework is as follows: construct a risk profiling framework based on the refined feature dataset and domain knowledge, and the risk profiling framework includes each feature and the correlation strength between them;

[0018] Step S220: Dynamically adjust the connection strength of nodes based on the connection relationship. If the connection strength between two nodes is less than the strength threshold, multiply the weight of the edge connecting them by a weak factor a; otherwise, multiply the weight by a strong factor b to obtain the adjusted connection network.

[0019] Step S230: Compare the connection network before and after adjustment. If the weight of the edge is increased, mark the path between the corresponding features as the key association path to obtain the potential association structure graph.

[0020] Step S240: Construct a risk association graph based on the potential association structure graph to determine the core nodes of risk propagation;

[0021] The method for constructing the graph neural network is as follows: the risk profiling framework is transformed into graph structure data, each feature represents a node in the graph structure, the relationship between features represents the edge connecting two nodes, and the strength of the relationship between features represents the weight of the edge connecting the nodes; the graph neural network is used to model the graph structure data, and the embedding representation of the nodes and the weight of the edges are learned; the edges between nodes are used as the connection relationship between each feature, and the weight of the edge is used as the connection strength between features.

[0022] The method for determining the core nodes of risk propagation is as follows: using a centrality index, which includes degree centrality, betweenness centrality and closeness centrality, and weighting the degree centrality, betweenness centrality and closeness centrality to obtain a weighted centrality index, setting a centrality index threshold, and taking the nodes corresponding to the weighted centrality index that are greater than the centrality index threshold as core nodes.

[0023] The specific method for marking a node as a potential threat signal if the changing characteristic value of a node in the predicted risk correlation graph exceeds the fluctuation range is as follows:

[0024] Step S310: For the risk association graph, real-time monitoring technology is used to track node changes and record the feature values ​​of the nodes;

[0025] Step S320: Based on the feature values ​​of the nodes, use the LSTM model to predict the feature values ​​of future nodes and obtain the changing feature values ​​of the nodes;

[0026] Step S330: Based on the changing characteristic values ​​of the node, construct the fluctuation range according to the historical characteristic values. If the changing characteristic values ​​exceed the fluctuation range, mark the node as a potential threat signal.

[0027] The specific method for predicting future feature values ​​of nodes using an LSTM model is as follows: The feature values ​​of nodes are organized in a time series manner, with each time step corresponding to one feature value of a node, resulting in a feature value sequence. The node feature value at the current time step is used as input to output the predicted feature value for the next time step. Training samples are constructed based on the historical feature value sequence. The loss function of LSTM is defined as mean squared error. The LSTM model is trained using the training samples, minimizing the loss function. Training is complete when the loss function converges. The trained LSTM model is then used to predict future feature values ​​of nodes.

[0028] The method for constructing the fluctuation range is as follows: statistically analyze the changing characteristic values ​​of nodes in the historical characteristic values, calculate the mean μ and standard deviation δ of the changing characteristic values, and construct the fluctuation range with the mean μ as the center and [μ-3×δ,μ+3×δ] as the boundary;

[0029] The specific method for hierarchically storing potential threat signals, analyzing their evolution paths, marking highly relevant signals, and determining threat patterns in risk evolution is as follows:

[0030] Step S410: Based on the potential threat signals, match and calculate the similarity with historical threat patterns to determine the potential risk level and similarity.

[0031] Step S420: Prioritize potential threat signals according to their potential risk level to determine the potential threat signals to be stored in a hierarchical manner;

[0032] Step S430: Set a similarity threshold. If the similarity between a potential threat signal and a historical threat pattern is greater than the similarity threshold, then mark the potential threat signal as a highly relevant signal.

[0033] Step S440: Predict the evolution path of the highly correlated signal's eigenvalues ​​in the future based on the LSTM model;

[0034] Step S450: Classify the feature values ​​of the evolution path based on the support vector machine classification model to determine the threat pattern of risk evolution;

[0035] The specific method for determining the potential risk level and similarity based on potential threat signals, matching them with historical threat patterns, and calculating similarity is as follows:

[0036] Step S411: Divide historical threat events into three potential risk levels: high, medium, and low. Extract the features of historical threat events to form a feature representation of historical threat patterns. Use cosine similarity to calculate the similarity between the feature values ​​of potential threat signals and the feature representation of historical threat patterns.

[0037] Step S412: The risk level corresponding to the historical threat pattern with the highest similarity to the potential threat signal is taken as the potential risk level of the potential threat signal;

[0038] The specific method for prioritizing is as follows: First, the potential threat signals are sorted from high to low according to their potential risk level. Then, based on the similarity of each potential threat signal at the same potential risk level, they are sorted from high to low to obtain the priority ranking of potential threat signals at the same level.

[0039] The specific method for classifying the feature values ​​of the evolution path based on the support vector machine classification model to determine the threat mode of risk evolution is as follows: extract the feature value change amplitude based on the evolution path of the feature values ​​of highly correlated signals in the future, take the feature value change amplitude as input and the threat mode category as output, classify the feature values ​​of the evolution path of highly correlated signals based on the pre-trained support vector machine classification model, and predict the threat mode category to which they belong.

[0040] One aspect of this application provides a visual risk control modeling system, comprising:

[0041] The refined feature extraction module is used to acquire raw heterogeneous data and extract features. If the correlation strength of the extracted feature values ​​is less than the correlation threshold, they are removed to obtain a refined feature dataset.

[0042] The association graph generation module is used to construct a risk profiling framework based on a refined feature dataset, and uses a graph neural network to generate a risk association graph based on the risk profiling framework.

[0043] The threat signal marking module is used to predict the changing characteristic values ​​of nodes in the risk correlation graph. If the changing characteristic value exceeds the fluctuation range, the node is marked as a potential threat signal.

[0044] The risk evolution analysis module is used to classify and store potential threat signals, analyze the evolution path of potential threat signals, mark highly relevant signals, and determine the threat patterns of risk evolution.

[0045] The visual risk control modeling method and system proposed in this application have the following advantages over existing technologies:

[0046] This application obtains a unified format fused dataset by acquiring raw heterogeneous data and performing data fusion, feature extraction and correlation analysis. Key feature values ​​are extracted and irrelevant features are removed to obtain a refined feature dataset, which provides more refined data for risk prediction.

[0047] This application constructs a risk profiling framework that includes features and their relationships. It learns the connection relationships and connection strengths between features through graph neural networks, generates a risk association map, and identifies the core nodes of risk propagation through centrality indicators, intuitively presenting the association structure and propagation path of risks.

[0048] This application tracks changes in node characteristic values ​​through real-time monitoring technology, uses an LSTM model to predict future node characteristic values, constructs a fluctuation range, identifies nodes that exceed the fluctuation range, and marks them as potential threat signals, thus realizing real-time monitoring and early warning of risks.

[0049] This application determines the risk level of potential threat signals by calculating similarity with historical threat patterns, and then prioritizes and stores them according to risk level and similarity. For highly correlated signals, an LSTM model is used to predict their future feature value evolution paths, and a support vector machine classification model is used to classify the evolution paths, thus identifying the threat patterns of risk evolution and achieving accurate risk prediction.

[0050] This application effectively solves the problem of accurate risk prediction and intuitive presentation in a multi-source heterogeneous data environment by combining multiple technical means such as data fusion, feature extraction, graph neural network, LSTM prediction and support vector machine classification. It achieves accurate risk prediction and accurately grasps the trend of risk evolution by predicting the evolution path of threat signals and determining threat patterns. Attached Figure Description

[0051] Figure 1 A flowchart of a visual risk control modeling method provided in this application;

[0052] Figure 2 A flowchart illustrating the method for generating the risk association map provided in this application;

[0053] Figure 3 A flowchart illustrating the method for determining threat patterns of risk evolution provided in this application;

[0054] Figure 4 A functional module diagram of a visual risk control modeling system provided in this application. Detailed Implementation

[0055] To better understand this application, various aspects of this application will be described in more detail with reference to the accompanying drawings. It should be understood that these detailed descriptions are merely illustrative of exemplary embodiments of this application and are not intended to limit the scope of this application in any way. Throughout the specification, the same reference numerals refer to the same elements. The expression "and / or" includes any and all combinations of one or more of the associated listed items.

[0056] In the accompanying drawings, the size, dimensions, and shapes of the elements have been slightly adjusted for ease of illustration. The drawings are for illustrative purposes only and are not strictly to scale. As used herein, the terms “approximately,” “about,” and similar terms are used to indicate approximation, not degree, and are intended to illustrate inherent deviations in measured or calculated values ​​that will be recognized by one of ordinary skill in the art. Furthermore, the order in which the steps are described in this application does not necessarily indicate the order in which these steps occur in actual operation, unless otherwise expressly defined or deduced from the context.

[0057] It should also be understood that expressions such as "comprising," "including," "having," "containing," and / or "comprising" are open-ended rather than closed-ended expressions in this specification, indicating the presence of the stated features, elements, and / or components, but not excluding the presence of one or more other features, elements, components, and / or combinations thereof. Furthermore, when expressions such as "at least one of..." appear after a list of listed features, they modify the entire list of features, not just individual elements in the list. Additionally, when describing embodiments of this application, the word "may" is used to mean "one or more embodiments of this application." And the term "exemplary" is intended to refer to examples or illustrations.

[0058] Unless otherwise specified, all terms used herein (including engineering and technical terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It should also be understood that, unless expressly stated herein, terms defined in common dictionaries shall be interpreted as having the meaning consistent with their meaning in the context of the relevant art, and not as having an idealized or overly formalized meaning.

[0059] It should be noted that, where there is no conflict, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0060] Example 1

[0061] like Figure 1 As shown, this application provides a visual risk control modeling method, which includes:

[0062] Step S100: Obtain the original heterogeneous data and perform feature extraction. If the correlation strength of the extracted feature values ​​is less than the correlation threshold, they are removed to obtain a refined feature dataset.

[0063] The specific method for obtaining the original heterogeneous data and performing feature extraction, and discarding any extracted feature values ​​whose correlation strength is less than the correlation threshold to obtain a refined feature dataset is as follows:

[0064] Step S110: Obtain raw heterogeneous data from different channels, extract features from the raw heterogeneous data, and obtain the extracted feature values;

[0065] Specifically, acquiring raw heterogeneous data from different channels includes: acquiring multi-source data from multiple channels through a pre-defined acquisition framework to form raw heterogeneous data; based on differences in data structure, the acquired raw heterogeneous data is initially organized using format standards to obtain structured data groups; for the structured data groups, if inconsistencies in data fields are detected, field mapping is performed through metadata descriptions to determine a unified description specification; according to the unified description specification, standardization processing is performed on the structured data groups to obtain a standardized data set.

[0066] Specifically, feature extraction is performed on the original heterogeneous data to obtain the extracted feature values. This includes: obtaining source information of different data from a standardized dataset, integrating data from different sources using data fusion technology to obtain a fused dataset in a unified format; and applying feature extraction methods to the fused dataset to identify and extract key feature value ranges to obtain the extracted feature values.

[0067] Step S120: Perform correlation analysis based on the extracted feature values ​​to determine the correlation strength between features. If the correlation strength is less than the preset correlation threshold, the feature is removed as an irrelevant feature to obtain a refined feature dataset.

[0068] The specific method for determining the correlation strength between features based on the extracted feature values ​​is as follows: the calculation of the Pearson correlation coefficient is used as the correlation analysis based on the feature values, and the calculated Pearson correlation coefficient is the correlation strength between the feature values.

[0069] The formula for calculating the correlation strength is: Where, r xy This represents the correlation strength between feature x and feature y, where n is the number of feature values, x i This represents the i-th eigenvalue of feature x. The mean of the eigenvalues ​​of feature x, y i This represents the i-th feature value of feature y. This represents the mean of the eigenvalues ​​of feature y;

[0070] The preset association threshold is set by those skilled in the art based on domain knowledge and experience; preferably, the association threshold is 0.3; when the association strength between features is less than 0.3, the two features are considered to have a weak association, and feature y is removed as an irrelevant feature.

[0071] Step S200: Construct a risk profiling framework based on the refined feature dataset, and use a graph neural network to generate a risk association map based on the risk profiling framework;

[0072] like Figure 2 The diagram shown is a flowchart of the risk association graph generation method provided in this application. The specific method for constructing a risk profiling framework based on a refined feature dataset and generating a risk association graph using a graph neural network based on the risk profiling framework is as follows:

[0073] Step S210: Construct a risk profiling framework based on the refined feature dataset, and use a graph neural network to model the risk profiling framework to determine the connection relationships of each feature in the refined feature dataset;

[0074] The method for constructing the risk profiling framework is as follows: based on the refined feature dataset and domain knowledge, a risk profiling framework is constructed, which includes each feature and the correlation strength between them;

[0075] The method for constructing the graph neural network is as follows: the risk profiling framework is transformed into graph structure data, each feature represents a node in the graph structure, the relationship between features represents the edge connecting two nodes, and the strength of the relationship between features represents the weight of the edge connecting the nodes; the graph neural network is used to model the graph structure data, and the embedding representation of the nodes and the weight of the edges are learned; the edges between nodes are used as the connection relationship between each feature, and the weight of the edge is used as the connection strength between features.

[0076] The graph neural network adopts the GCN model, namely the graph convolutional network model, which includes an input layer, a graph convolutional layer, a pooling layer, and an output layer. The input layer is used to represent the features in the risk profiling framework as nodes of a graph, and the relationships between features are represented as edges connecting the nodes. The graph structure data is taken as input, and the graph convolutional layer performs convolution operations on the input graph structure data to update the embedding representation of the nodes. The pooling layer performs pooling operations on the embedding representation output by the graph convolutional layer to extract important node features and reduce the size of the graph. In the output layer, the output of the pooling layer is transformed through a fully connected layer to obtain the final embedding representation of the nodes.

[0077] The graph neural network (GNN) functions as follows: Through graph convolutional layers, it effectively aggregates neighbor information of nodes and updates node feature representations, enabling it to capture the mutual influence and dependencies between nodes; through pooling layers, it extracts important node features and reduces the graph size, making subsequent computations more efficient; through the output layer, it obtains node-level or graph-level representations for downstream tasks such as node classification, link prediction, and graph classification. Based on the correlations of features within the risk profiling framework, the GNN learns embedded representations of nodes and determines the connection strength and relationships between features, providing crucial information and a foundation for subsequent risk association graph construction and risk propagation analysis.

[0078] The convolution operation of the graph convolutional layer can be represented as: Among them, H (l) This represents the feature matrix of the nodes in the l-th layer. The normalized adjacency matrix, Let W be the node degree matrix. (l) Here is the weight matrix for the l-th layer;

[0079] Step S220: Dynamically adjust the connection strength of nodes based on the connection relationship. If the connection strength between two nodes is less than the strength threshold, multiply the weight of the edge connecting them by a weak factor a; otherwise, multiply the weight by a strong factor b to obtain the adjusted connection network.

[0080] The strength threshold is set by those skilled in the art based on domain knowledge and experience; preferably, the strength threshold is 0.5; if the connection strength between two nodes is less than 0.5, their correlation is considered weak. For edges with connection strength less than the strength threshold, their weight is multiplied by a weak factor a, where a is a value less than 1. For edges with connection strength greater than or equal to the strength threshold, their weight is multiplied by a strong factor b, where b is a value greater than 1; preferably, a equals 0.8 and b equals 1.2.

[0081] Step S230: Compare the connection network before and after adjustment. If the weight of the edge is increased, mark the path between the corresponding features as the key association path to obtain the potential association structure graph.

[0082] Step S240: Construct a risk association graph based on the potential association structure graph to determine the core nodes of risk propagation;

[0083] The construction of a risk association graph based on a potential association structure graph refers to improving and refining the potential association structure graph by combining domain knowledge to obtain a risk association graph.

[0084] The method for determining the core nodes of risk propagation is as follows: using a centrality index, which includes degree centrality, betweenness centrality and closeness centrality, and weighting the degree centrality, betweenness centrality and closeness centrality to obtain a weighted centrality index, setting a centrality index threshold, and taking the nodes corresponding to the weighted centrality index that are greater than the centrality index threshold as core nodes.

[0085] The centrality threshold is set by those skilled in the art based on experience; preferably, the centrality threshold is 0.6.

[0086] The degree centrality C D The formula for calculating (v) is: Where deg(v) represents the degree of node v, and N represents the total number of nodes in the risk association graph; degree centrality measures the number of direct connections of a node, and the greater the degree, the greater the local influence of the node.

[0087] The degree of node v represents the number of edges directly connected to node v;

[0088] The betweenness centrality C B The formula for calculating (v) is: Where s represents the source node in the risk association graph, t represents the target node in the risk association graph, and σ st (v) represents the number of shortest paths from the source node to the target node through node v. s≠v≠t means that the source node, node v, and target node must be distinct. Betweenness centrality measures a node’s ability to control information propagation or flow in a network. The higher the betweenness centrality, the stronger the node’s control over the network.

[0089] The close centrality C C The formula for calculating (v) is: Where N-1 refers to the number of nodes other than node v, and d(v,u) represents the sum of the shortest path lengths from node v to other nodes u in the risk association graph; tight centrality measures the reciprocal of the sum of the distances from a node to other nodes. The higher the tight centrality, the shorter the average distance from a node to other nodes, and the greater its influence in the network.

[0090] Furthermore, key association paths and core nodes in the risk association graph are marked using visualization tools; dynamic change monitoring is implemented for core nodes of risk propagation. If a significant change in the connection strength of a core node is detected during monitoring, an update mechanism is triggered to obtain the latest risk association graph; based on the latest risk association graph, the monitoring strategy is adjusted, and the evolution direction of the risk propagation path is determined by continuously tracking the changing trends of core nodes.

[0091] Step S300: Predict the changing characteristic values ​​of nodes in the risk correlation graph. If the changing characteristic values ​​exceed the fluctuation range, mark the node as a potential threat signal.

[0092] The specific method for marking a node as a potential threat signal if the changing characteristic value of a node in the predicted risk correlation graph exceeds the fluctuation range is as follows:

[0093] Step S310: For the risk association graph, real-time monitoring technology is used to track node changes and record the feature values ​​of the nodes;

[0094] Specifically, for the risk association graph, real-time monitoring technology is used to track node changes and record the node's feature values, including: real-time monitoring of nodes in the risk association graph and recording changes in node feature values;

[0095] Step S320: Based on the feature values ​​of the nodes, use the LSTM model to predict the feature values ​​of future nodes and obtain the changing feature values ​​of the nodes;

[0096] The specific method for predicting future feature values ​​of nodes using an LSTM model is as follows: The feature values ​​of nodes are organized in a time series manner, with each time step corresponding to one feature value of a node, resulting in a feature value sequence. The node feature value at the current time step is used as input to output the predicted feature value for the next time step. Training samples are constructed based on the historical feature value sequence. The loss function of LSTM is defined as mean squared error. The LSTM model is trained using the training samples, minimizing the loss function. Training is complete when the loss function converges. The trained LSTM model is then used to predict future feature values ​​of nodes.

[0097] The changed feature value of the node is the predicted node feature value.

[0098] Step S330: Based on the changing characteristic values ​​of the node, construct the fluctuation range according to the historical characteristic values. If the changing characteristic values ​​exceed the fluctuation range, mark the node as a potential threat signal.

[0099] The method for constructing the fluctuation range is as follows: statistically analyze the changing characteristic values ​​of nodes in the historical characteristic values, calculate the mean μ and standard deviation δ of the changing characteristic values, and construct the fluctuation range with the mean μ as the center and [μ-3×δ,μ+3×δ] as the boundary;

[0100] For example, real-time monitoring and dynamic change analysis of risk association graphs are performed. The weights of nodes and edges represent the transaction relationships between enterprises. A graph neural network algorithm is used to extract features from the graph, update the connection strength between nodes in real time, refresh the data every 5 minutes, monitor the changing feature values ​​of nodes, and record abnormal fluctuations if the changing feature values ​​exceed the fluctuation range.

[0101] Step S400: Store potential threat signals in a hierarchical manner, analyze the evolution path of potential threat signals, mark highly relevant signals, and determine the threat patterns of risk evolution;

[0102] like Figure 3 The flowchart shown is a method for determining the threat pattern of risk evolution provided in this application. The specific method for determining the threat pattern of risk evolution by hierarchically storing potential threat signals, analyzing the evolution path of potential threat signals, and marking highly relevant signals is as follows:

[0103] Step S410: Based on the potential threat signals, match and calculate the similarity with historical threat patterns to determine the potential risk level and similarity.

[0104] The specific method for determining the potential risk level and similarity based on potential threat signals, matching them with historical threat patterns, and calculating similarity is as follows:

[0105] Step S411: Divide historical threat events into three potential risk levels: high, medium, and low. Extract the features of historical threat events to form a feature representation of historical threat patterns. Use cosine similarity to calculate the similarity between the feature values ​​of potential threat signals and the feature representation of historical threat patterns.

[0106] Specifically, historical threat events are classified using a support vector machine classification model. Assuming there are 10,000 historical threat data entries, including 5,000 network attacks, 3,000 data breaches, and 2,000 system failure records, the system automatically extracts feature representations of historical threat patterns, such as attack frequency and data loss, and classifies historical threat events into three potential risk levels: high, medium, and low.

[0107] Step S412: The risk level corresponding to the historical threat pattern with the highest similarity to the potential threat signal is taken as the potential risk level of the potential threat signal;

[0108] Specifically, the similarity between potential threat signals and historical threat patterns is calculated, and the historical threat pattern with the highest similarity to the potential threat signal is found. Then, the potential threat signal and the historical threat pattern are associated with the same threat pattern category.

[0109] Step S420: Prioritize potential threat signals according to their potential risk level to determine the potential threat signals to be stored in a hierarchical manner;

[0110] The specific method for prioritizing is as follows: First, the potential threat signals are sorted from high to low according to their potential risk level. Then, based on the similarity of each potential threat signal at the same potential risk level, they are sorted from high to low to obtain the priority ranking of potential threat signals at the same level.

[0111] Step S430: Set a similarity threshold. If the similarity between a potential threat signal and a historical threat pattern is greater than the similarity threshold, then mark the potential threat signal as a highly relevant signal.

[0112] The similarity threshold is set by those skilled in the art based on experience; preferably, the similarity threshold is equal to 0.8.

[0113] Step S440: Predict the evolution path of the highly correlated signal's eigenvalues ​​in the future based on the LSTM model;

[0114] The evolution path of the highly correlated signal in the future eigenvalues ​​refers to the sequence of eigenvalues ​​for future time steps predicted based on the LSTM model, with each time step corresponding to one eigenvalue.

[0115] Step S450: Classify the feature values ​​of the evolution path based on the support vector machine classification model to determine the threat pattern of risk evolution;

[0116] The specific method for classifying the feature values ​​of the evolution path based on the support vector machine classification model to determine the threat mode of risk evolution is as follows: extract the feature value change amplitude based on the evolution path of the feature values ​​of highly correlated signals in the future, take the feature value change amplitude as input and the threat mode category as output, classify the feature values ​​of the evolution path of highly correlated signals based on the pre-trained support vector machine classification model, and predict the threat mode category to which they belong.

[0117] Furthermore, visualization tools are used to present potential threat signals and highly correlated signals in the risk correlation map, as well as the evolution path and threat patterns of the characteristic values ​​of highly correlated signals.

[0118] Example 2

[0119] like Figure 4 As shown, a visual risk control modeling system provided in this application includes:

[0120] The refined feature extraction module is used to acquire raw heterogeneous data and extract features. If the correlation strength of the extracted feature values ​​is less than the correlation threshold, they are removed to obtain a refined feature dataset.

[0121] The association graph generation module is used to construct a risk profiling framework based on a refined feature dataset, and uses a graph neural network to generate a risk association graph based on the risk profiling framework.

[0122] The threat signal marking module is used to predict the changing characteristic values ​​of nodes in the risk correlation graph. If the changing characteristic value exceeds the fluctuation range, the node is marked as a potential threat signal.

[0123] The risk evolution analysis module is used to classify and store potential threat signals, analyze the evolution path of potential threat signals, mark highly relevant signals, and determine the threat patterns of risk evolution.

[0124] In addition, the parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of the corresponding technical solutions in the prior art have not been described in detail, so as to avoid excessive elaboration.

[0125] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A visual risk control modeling method, characterized in that, include: Obtain the original heterogeneous data and extract features. If the correlation strength of the extracted feature values ​​is less than the correlation threshold, they are removed to obtain a refined feature dataset. A risk profiling framework is constructed based on a refined feature dataset, and a graph neural network is used to generate a risk association map based on the risk profiling framework. Predict the changing characteristic values ​​of nodes in the risk correlation graph. If the changing characteristic values ​​exceed the fluctuation range, mark the node as a potential threat signal. Potential threat signals are classified and stored, their evolution paths are analyzed, highly relevant signals are marked, and threat patterns of risk evolution are identified.

2. The visual risk control modeling method as described in claim 1, characterized in that, The specific method for obtaining the original heterogeneous data and performing feature extraction, and discarding any extracted feature values ​​whose correlation strength is less than the correlation threshold to obtain a refined feature dataset is as follows: Obtain raw heterogeneous data from different channels, extract features from the raw heterogeneous data, and obtain the extracted feature values; Correlation analysis is performed based on the extracted feature values ​​to determine the strength of the association between features. If the association strength is less than a preset association threshold, the feature is removed as an irrelevant feature to obtain a refined feature dataset.

3. The visual risk control modeling method as described in claim 2, characterized in that, The specific method for constructing a risk profiling framework based on a refined feature dataset and generating a risk association graph using a graph neural network based on the risk profiling framework is as follows: A risk profiling framework is constructed based on a refined feature dataset. A graph neural network is used to model the risk profiling framework to determine the connection relationships between each feature in the refined feature dataset. The construction method of the risk profiling framework is as follows: a risk profiling framework is constructed based on the refined feature dataset and domain knowledge. The risk profiling framework includes each feature and the correlation strength between them. The connection strength of nodes is dynamically adjusted based on the connection relationship. If the connection strength between two nodes is less than the strength threshold, the weight of the edge connecting them is multiplied by a weak factor a; otherwise, the weight is multiplied by a strong factor b to obtain the adjusted connection network. Comparing the connection networks before and after the adjustment, if the edge weights are increased, the paths between the corresponding features are marked as key association paths, thus obtaining a potential association structure graph. A risk association graph is constructed based on the potential association structure graph to identify the core nodes of risk propagation.

4. The visual risk control modeling method as described in claim 3, characterized in that, The method for constructing the graph neural network is as follows: the risk profiling framework is transformed into graph structure data, each feature represents a node in the graph structure, the relationship between features represents the edge connecting two nodes, and the strength of the relationship between features represents the weight of the edge connecting the nodes; the graph structure data is modeled using a graph neural network to learn the embedding representation of nodes and the weight of edges; the edges between nodes are used as the connection relationship between each feature, and the weight of the edge is used as the connection strength between features.

5. The visual risk control modeling method as described in claim 4, characterized in that, The method for determining the core nodes of risk propagation is as follows: using a centrality index, which includes degree centrality, betweenness centrality, and closeness centrality, the degree centrality, betweenness centrality, and closeness centrality are weighted and summed to obtain a weighted centrality index. A centrality index threshold is preset, and the nodes corresponding to the weighted centrality index that are greater than the centrality index threshold are taken as core nodes.

6. The visual risk control modeling method as described in claim 5, characterized in that, The specific method for marking a node as a potential threat signal if the changing characteristic value of a node in the predicted risk correlation graph exceeds the fluctuation range is as follows: For the risk association graph, real-time monitoring technology is used to track node changes and record the feature values ​​of the nodes; Based on the feature values ​​of nodes, the LSTM model is used to predict the feature values ​​of future nodes, thus obtaining the changing feature values ​​of nodes. Based on the changing characteristic values ​​of a node, a fluctuation range is constructed according to historical characteristic values. If the changing characteristic value exceeds the fluctuation range, the node is marked as a potential threat signal. The method for constructing the fluctuation range is as follows: statistically analyze the changing characteristic values ​​of nodes in the historical characteristic values, calculate the mean μ and standard deviation δ of the changing characteristic values, and construct the fluctuation range with the mean μ as the center and [μ-3×δ,μ+3×δ] as the boundary.

7. The visual risk control modeling method as described in claim 6, characterized in that, The specific method for predicting future feature values ​​of nodes using an LSTM model is as follows: The feature values ​​of nodes are organized in a time series manner, with each time step corresponding to one feature value of the node, resulting in a feature value sequence. The node feature value at the current time step is used as input to output the predicted feature value for the next time step. Training samples are constructed based on the historical feature value sequence. The loss function of LSTM is defined as mean squared error. The LSTM model is trained using the training samples, minimizing the loss function. Training is complete when the loss function converges. The trained LSTM model is then used to predict future feature values ​​of nodes.

8. The visual risk control modeling method as described in claim 7, characterized in that, The specific method for hierarchically storing potential threat signals, analyzing their evolution paths, marking highly relevant signals, and determining threat patterns in risk evolution is as follows: Based on potential threat signals, they are matched and similarity calculated with historical threat patterns to determine the potential risk level and similarity. The potential threat signals are prioritized according to their potential risk level to determine the potential threat signals for hierarchical storage. The specific method of prioritization is as follows: first, the potential threat signals are sorted from high to low according to their potential risk level; then, based on the similarity of each potential threat signal at the same potential risk level, they are sorted from high to low to obtain the priority order of potential threat signals at the same level. A preset similarity threshold is set. If the similarity between a potential threat signal and a historical threat pattern is greater than the similarity threshold, the potential threat signal is marked as a highly relevant signal. Predicting the evolution path of highly correlated signals' eigenvalues ​​in the future based on LSTM models; The feature values ​​of the evolution path are classified based on the support vector machine classification model to determine the threat pattern of risk evolution.

9. The visual risk control modeling method as described in claim 8, characterized in that, The specific method for determining the potential risk level and similarity based on potential threat signals, matching them with historical threat patterns, and calculating similarity is as follows: Historical threat events are divided into three potential risk levels: high, medium, and low. The features of historical threat events are extracted to form a feature representation of historical threat patterns. Cosine similarity is used to calculate the similarity between the feature values ​​of potential threat signals and the feature representation of historical threat patterns. The risk level corresponding to the historical threat pattern with the highest similarity to the potential threat signal is taken as the potential risk level of the potential threat signal.

10. A visual risk control modeling system, implemented based on the visual risk control modeling method according to any one of claims 1-9, characterized in that, include: The refined feature extraction module is used to acquire raw heterogeneous data and extract features. If the correlation strength of the extracted feature values ​​is less than the correlation threshold, they are removed to obtain a refined feature dataset. The association graph generation module is used to construct a risk profiling framework based on a refined feature dataset, and uses a graph neural network to generate a risk association graph based on the risk profiling framework. The threat signal marking module is used to predict the changing characteristic values ​​of nodes in the risk correlation graph. If the changing characteristic value exceeds the fluctuation range, the node is marked as a potential threat signal. The risk evolution analysis module is used to classify and store potential threat signals, analyze the evolution path of potential threat signals, mark highly relevant signals, and determine the threat patterns of risk evolution.

Images