Early warning method, electronic equipment and computer program product

Abstract

The invention discloses an early warning method, electronic equipment and a computer program product, and relates to the technical field of data mining. The early warning method comprises the following steps: connecting a plurality of data providers through a data network, wherein each data provider has a corresponding data source; based on the data source of each data provider, a federated learning algorithm is utilized to establish a risk assessment model, the risk assessment model is used for determining the probability that the input data is a positive sample, and the data of each data provider is not out of a domain; determining a risk score of a person to be pre-warned based on the risk assessment model; and carrying out risk early warning based on the risk score.

Description

Technical Field

[0001] This application relates to the field of data mining technology, and in particular to an early warning method, electronic device, and computer program product. Background Technology

[0002] Among related technologies, target behavior recognition methods are mostly based on risk feature engineering, which involves a limited richness of feature variables and a limited accuracy of event auditing. A few methods involve knowledge graphs, but the data sources are relatively singular. Although there are a few cross-sample data sources with the same data structure, the sample and label volume is limited, and due to high compliance costs and insufficient computing power support, data silos are easily formed, resulting in limited coverage of event auditing.

[0003] Therefore, there is an urgent need for a method to detect potential behaviors in advance, and then identify relevant groups of people. Summary of the Invention

[0004] This application provides an early warning method, electronic device, and computer program product to solve the problem of low accuracy in auditing specific events involving specific personnel in the prior art.

[0005] In a first aspect, embodiments of this application provide an early warning method, including: Multiple data providers are connected through a data network, and each data provider has a corresponding data source; Based on the data sources from each data provider, a risk assessment model is established using a federated learning algorithm. The risk assessment model is used to determine the probability that the input data is a positive sample, and the data from each data provider does not leave the domain. Based on the aforementioned risk assessment model, the risk score of the personnel to be warned is determined; Risk warnings are issued based on the risk scores.

[0006] In a second aspect, embodiments of this application provide an electronic device, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0007] Thirdly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0008] Fourthly, embodiments of this application provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, implement the steps of the method described in the first aspect.

[0009] In this embodiment, multiple data providers are first connected via a data network, each with its own data source. Then, based on the data sources from each provider, a federated learning algorithm is used to establish a risk assessment model. This model determines the probability that the input data is a positive sample. The data from each provider remains within its domain. Next, based on the risk assessment model, a risk score for the individual to be warned is determined. Finally, a risk warning is issued based on the risk score. This embodiment expands the training sample size through the data network and, while ensuring the data from each provider remains within its domain, utilizes a federated learning algorithm to build the model. This expands the sample size while maintaining data privacy, improving the accuracy and coverage of the model in identifying specific individuals. Attached Figure Description

[0010] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart of the early warning method provided in the embodiments of this application; Figure 2 This is a schematic diagram of the early warning device provided in the embodiments of this application; Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0011] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0012] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0013] The following is in conjunction with the appendix Figures 1 to 3 The present application provides a detailed description of an early warning method, electronic device, and computer program product through specific embodiments and application scenarios.

[0014] like Figure 1 The diagram shown is a flowchart of an early warning method provided in an embodiment of this application. Figure 1 As shown, the early warning method may include the contents shown in S101 to S104.

[0015] In S101, multiple data providers are connected via a data network, and each data provider has a corresponding data source.

[0016] Multiple data providers can be connected via a dedicated network of the data network with encryption.

[0017] In this embodiment, the trusted node protocol of the data computing private network in the Data Switching Service Network (DSSN) can be used to aggregate multi-party data from different users and operators based on multi-node networked data connection technology. The weakly centralized approach ensures that the data does not leave the domain, while guaranteeing data quality and computing efficiency. At the same time, the model outputs data knowledge, making the data usable but not visible.

[0018] This embodiment differs from the centralized data model in related technologies, which avoids low-quality and inefficient data. Instead, it allows machine learning models to go beyond their domain and transmit pre-trained model parameters back to realize the circulation of data element value. This upgrades the traditional offline "fingerprint" recognition to real-time "digital fingerprint" recognition, forming a digital risk control product that significantly improves the efficiency of various departments.

[0019] In one instance, the early warning method may also include: preprocessing data from multiple data providers, that is, aggregating data from various sectors based on big data integration technology, performing deduplication, dictionary conversion, and field standardization, so as to standardize the data from each data provider and facilitate subsequent model training.

[0020] Furthermore, the pooled data can be stored in the Hive data warehouse as the data foundation for model training. Data access is divided into two methods: real-time access based on distributed Kafka message queues and offline access based on ETL extraction tasks. This prepares data for multiple risk control scenarios and is beneficial for the data infrastructure of digital products.

[0021] In S102, a risk assessment model is built using a federated learning algorithm based on the data sources of each data provider. The risk assessment model is used to determine the probability that the input data is a positive sample, and the data from each data provider does not leave the domain.

[0022] This embodiment uses data from various data providers and a federated learning algorithm to build a risk assessment model. In other words, it uses a federated approach with multiple participants to train a machine learning model from the data sources owned by each participant. This model is used for case reasoning to improve the accuracy of auditing specific events.

[0023] In S103, risk scores for individuals requiring early warning are determined based on a risk assessment model.

[0024] In this embodiment, after the model training is completed, a probability value can be generated based on any sample to determine if that sample is a valid sample. This allows for the determination of the risk score for the individual to be warned. This risk score represents the likelihood of that individual engaging in the corresponding event at the next point in time. A higher score indicates a greater probability that the individual is a Class I gambling offender, allowing for early warning and appropriate intervention.

[0025] In S104, risk warnings are issued based on risk scores.

[0026] Among them, risk warnings can be selected according to needs, such as being pushed to preset recipients.

[0027] In this embodiment, multiple data providers are first connected via a data network, each with its own data source. Then, based on the data sources from each provider, a federated learning algorithm is used to establish a risk assessment model. This model determines the probability that the input data is a positive sample. The data from each provider remains within its domain. Next, based on the risk assessment model, a risk score for the individual to be warned is determined. Finally, a risk warning is issued based on the risk score. This embodiment expands the training sample size through the data network and, while ensuring the data from each provider remains within its domain, utilizes a federated learning algorithm to build the model. This expands the sample size while maintaining data privacy, improving the accuracy and coverage of the model in identifying specific individuals.

[0028] In one possible implementation of this application, a risk assessment model is established using a federated learning algorithm based on the data sources of each data provider, including: arranging the data from each data provider into the same directory; and training an initial risk assessment model using a federated learning algorithm based on the arranged data to obtain the risk assessment model.

[0029] In this embodiment, the data from each data provider is arranged into a common directory based on identity authentication identifiers. This allows each data provider to train its model using local data and federated learning algorithms, and to exchange intermediate computation results, such as model gradients and various parameters, until the loss function converges or a fixed number of iterations are reached, resulting in a risk assessment model. That is, without needing to acquire data from each data provider, each provider downloads the model to its local machine and trains it using its local data. The updated content from the trained model is then uploaded. By fusing and evenly distributing the updates from multiple data providers, the initial general model is optimized. Each data provider then downloads the updated general model and performs the same processing. This process is repeated until a predetermined standard is reached to complete model training.

[0030] Using the delivery service platform in DSSN, it provides services such as data computing network and resource orchestration and scheduling, distributed collaborative computing, node security management, and full-link control of data circulation. Based on the support of underlying protocols such as multi-party secure computation (MPC) and homomorphic encryption (HE), it constructs a federated learning algorithm, which is to train a machine learning model from the data sources owned by each of the multiple participants in a federation, and use the model to perform case inference.

[0031] The model in this embodiment can be a CatBoost (CategoricalBoosting, a gradient boosting algorithm based on decision trees) model, which ensures data privacy and security throughout the modeling process. The gradient information used for model training is transmitted through communication, and the model is updated locally on each participant. It takes cross-feature federated learning as an innovative approach, that is, the features of a data point come from different participants, and the data encryption and exchange order are configured to complete the model training.

[0032] During model training, multiple participants with different data structures, such as N participants, have multiple labeled data, where N>3, and each labeled data is possessed by at least one participant. The CatBoost model is collaboratively learned through a dedicated data computing network, as shown below: The first step is sample alignment: Since the sample groups of N participants are different, the system uses EC-ElGamal homomorphic encryption user identifier (ID) alignment technology, such as mobile phone number and ID card number, to identify the common users of multiple parties. Each party will not expose its own data, and in the above user identifier alignment, i.e. entity alignment process, the system will not disclose users that do not overlap with each other.

[0033] In one possible implementation of this application, arranging the data of various data providers into the same directory includes: determining a common user among multiple data providers using a homomorphic encryption user identifier alignment method; and arranging the data of various data providers into the same directory based on the common user and the user identifier.

[0034] In this embodiment, the user ID is set to an integer U (such as the value of a mobile phone number or ID card number). 1. For U ∈ Z* (integer field), perform a modulo operation on U; 2. P, Q ∈ G. G is a point on the elliptic curve, and P and Q are randomly selected points on the elliptic curve, where, Public key: G ← P, Q Private key: x ← x' ∈ Z* C ← [U^x]P + U^x Q x is the private key, U^x is the product of U and x, which is the user IDU's custom function operation based on the private key x; [U^x]P is the product of P and U^x, U^x Q is the product of Q and U^x; C is the encrypted user ID.

[0035] During decryption, the following operations need to be performed: U' ← [C]Q That is, [C]Q is Q multiplied by C, which is the decrypted user ID.

[0036] The second step is model training: After identifying the common entities, the data from these entities can be used to train a machine learning model. The core of model training lies in the continuous interaction of intermediate computational results, such as model gradients and tree split point information, among N participants using encryption, differential privacy, or secret sharing techniques, until the loss function converges or a fixed number of iterations are reached.

[0037] In one possible implementation of this application, an initial risk assessment model is trained using a federated learning algorithm based on the sorted data to obtain the risk assessment model. This includes: training an initial risk assessment model for any data provider based on the sorted data, wherein the initial risk assessment model is a CatBoost model; and during the training process, interacting the model gradients and model parameters of each data provider until preset conditions are met to obtain the risk assessment model.

[0038] In this embodiment, for the training group dataset ,in It is a multidimensional random variable with m characteristics, and Let R be the target value, and R be the set of real numbers. The loss function is constructed based on the samples. And achieve minimum loss through gradient descent: .

[0039] Where H is the decision tree, L is the loss function, E is the expected value, y is the target value, F(x) is the predicted value, and h is the regression tree.

[0040] This model uses CatBoost binary decision trees as the basic predictor and is built by recursively splitting the feature space. Based on the value of the splitting attribute 'a', the feature space is divided into several disjoint regions (tree nodes). Attributes are typically binary variables used to identify certain features. When it exceeds a certain threshold t, i.e. , indicating if x k If a is greater than t, then a is 1; otherwise, it is 0. Are they numerical or binary features, in In the case of binary features, t=0.5. Each final region (leaf of the tree) is assigned a value, b. j It is the estimated value of the response y within a region in a regression task, or the predicted class label in a classification problem. A decision tree H can be represented as: .

[0041] in, This indicates that if x is in space Rj, it is 1, otherwise it is 0; J is the number of tree nodes.

[0042] The third step is model inference: After each participant performs a round of local computation, the local computation results are securely aggregated to obtain a sum, and then each participant performs cross-feature secure aggregation inference based on this sum.

[0043] The data network utilizes the federated learning CatBoost algorithm to train models, improving model accuracy and efficiency, and enhancing business relevance. Graph data visualization helps identify criminal groups, seeing both the trees and the forest. This can improve the accuracy and breadth of identifying specific individuals in data circulation and other scenarios.

[0044] In one possible implementation of this application, the risk score of the person to be warned is determined based on a risk assessment model, including: upon receiving the user identifier of the person to be warned, inputting the user identifier into the risk assessment model to obtain the probability that the user identifier is a positive sample; and obtaining the risk score of the person to be warned based on the probability.

[0045] In this embodiment, after training is completed, each sample will generate a probability value calculated by the model as a positive sample. Multiplying this value by 100 gives the risk score, which represents the likelihood that the person will perform a specific action at the next time point.

[0046] In one possible implementation of this application, risk warning is performed based on risk scores, including: if the risk score exceeds a first risk threshold, identifying the person to be warned as a first category of personnel; if the risk score is lower than the first risk threshold but higher than a second risk threshold, identifying the person to be warned as a second category of personnel, where the first risk threshold is greater than the second risk threshold; if the risk score is lower than the second risk threshold, identifying the person to be warned as a third category of personnel; and adopting different warning methods based on the classification of the person to be warned.

[0047] In this embodiment, a threshold range is set based on risk scores, which can be used to classify people into three categories: Category 1, Category 2, and Category 3. Visual statistical charts are deployed. For example, in scenarios that record specific people, [90, 100] can be set as Category 1 people, and offline crackdown measures can be deployed; [80, 90) can be set as Category 2 people, and monitoring and investigation can be carried out; [60, 80) can be set as Category 3 people, with education as the main focus, and relevant text messages, outbound calls, and other information pushed as appropriate.

[0048] In one possible implementation of this application, the early warning method may further include: updating the risk assessment model based on the occurrence of the early warning event and the historical risk scores of the person to be warned.

[0049] In this embodiment, the model update frequency is set in the saved model. The model will automatically execute the training cycle task (such as once a month) according to the parameters in the above steps, and iteratively update to improve the inference effect.

[0050] In one example, a trained risk assessment model is selected, a dynamic control set is constructed, and early warnings are issued for records of specific personnel. Intelligence is then sent to relevant area staff for verification and feedback based on real-time location services (LBS), and the results are used to optimize the integral model. Details are as follows: Dynamic control set management. Select the above-trained risk assessment model. The initial control set is the deduplicated result of the population whose score is greater than a certain threshold (such as the first category). The set will change synchronously with the model update results and supports manual correction. It will be periodically reduced based on the verification feedback results to realize the dynamic updating of the control set.

[0051] Real-time comparison and early warning. LBS records are retrieved from Kafka in real time, and the deployment set is loaded using Flink for comparison and calculation. The system outputs the matched LBS records and corresponding metrics, generating early warning events.

[0052] Intelligence feedback. Based on the location of the early warning event's LBS (Location Based on Location) system, intelligence is sent to the relevant personnel. The results of the feedback on the target behavior are verified and fed back to the model to revise the training set of the risk assessment model for the next time, thereby optimizing the model's accuracy.

[0053] The graph data provides a global relationship map. Phone numbers with first-type attributes are output through multi-party negotiation as entities. Edges between entities are constructed based on relationships such as funds, traffic, and social behavior. A visual analysis graph of entity-edge relationships is then created. The convergence direction is determined by points; for example, a many-to-one convergence occurs from superior to subordinate, and then a many-to-one convergence from subordinate to superior further identifies personnel levels, types, and potential participants.

[0054] like Figure 2 The diagram shown is a schematic representation of an early warning device provided in an embodiment of this application. Figure 2 As shown, the early warning device may include: a connection module 201, a model building module 202, a determination module 203, and an early warning module 204.

[0055] The system includes a connection module 201 for connecting multiple data providers via a data network, each with a corresponding data source; a model building module 202 for building a risk assessment model based on the data sources of each data provider using a federated learning algorithm, wherein the risk assessment model is used to determine the probability that the input data is a positive sample, and the data from each data provider is not outside the domain; a determination module 203 for determining the risk score of the personnel to be warned based on the risk assessment model; and a warning module 204 for issuing a risk warning based on the risk score.

[0056] In this embodiment, the connection module 201 first connects to multiple data providers via a data network, each with its own data source. Next, the model building module 202, based on the data sources from each provider, uses a federated learning algorithm to build a risk assessment model. This model determines the probability that the input data is a positive sample, and the data from each provider remains within its domain. Then, the determination module 203, based on the risk assessment model, determines the risk score of the individuals to be warned. Finally, the warning module 204, based on the risk score, issues a risk warning. This embodiment expands the training sample size through a data network and, while ensuring the data from each provider remains within its domain, utilizes a federated learning algorithm to build the model. This expands the sample size while maintaining data privacy, improving the accuracy and coverage of the model in identifying specific individuals.

[0057] In one possible implementation of this application, the model building module 202 is used to arrange the data from various data providers into the same directory; based on the arranged data, an initial risk assessment model is trained using a federated learning algorithm to obtain the risk assessment model.

[0058] In one possible implementation of this application, the model building module 202 is used to determine the common user of the multiple data providers using a homomorphic encryption user identifier alignment method; and to arrange the data of each data provider into the same directory based on the common user and user identifier.

[0059] In one possible implementation of this application, the model building module 202 is used to train an initial risk assessment model for any data provider based on the sorted data. The initial risk assessment model is a CatBoost model. During the training process, the model gradients and model parameters of each data provider are interacted until preset conditions are met to obtain the risk assessment model.

[0060] In one possible implementation of this application, the determining module 203 is used to input the user identifier of the person to be warned into the risk assessment model when the user identifier of the person to be warned is received, to obtain the probability that the user identifier is a positive sample; and to obtain the risk score of the person to be warned based on the probability.

[0061] In one possible implementation of this application, the early warning module 204 is used to determine the person to be warned as a first type of person when the risk score exceeds a first risk threshold; to determine the person to be warned as a second type of person when the risk score is lower than the first risk threshold but higher than a second risk threshold, wherein the first risk threshold is greater than the second risk threshold; to determine the person to be warned as a third type of person when the risk score is lower than the second risk threshold; and to adopt different early warning methods based on the classification of the person to be warned.

[0062] In one possible implementation of this application, the early warning device may further include an update module.

[0063] The update module is used to update the risk assessment model based on the historical risk scores of the early warning events and the individuals subject to early warning.

[0064] The function of the early warning device in this application has already been implemented. Figure 1 The method embodiments shown are described in detail. Therefore, for any parts not covered in detail in this embodiment, please refer to the relevant descriptions in the foregoing embodiments, which will not be repeated here.

[0065] Benru Figure 3 As shown, this application embodiment also provides an electronic device 300, including a processor 301, a memory 302, and a program or instructions stored in the memory 302 and executable on the processor 301. When the program or instructions are executed by the processor 301, they implement the various processes of the above-described early warning processing method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0066] Optionally, embodiments of this application also provide a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the aforementioned early warning method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0067] Optionally, this application embodiment also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, which, when executed by a computer, implement the various processes of the above-described early warning method embodiment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0068] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0069] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0070] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. An early warning method, characterized in that, include: Multiple data providers are connected through a data network, and each data provider has a corresponding data source; Based on the data sources from each data provider, a risk assessment model is established using a federated learning algorithm. The risk assessment model is used to determine the probability that the input data is a positive sample, and the data from each data provider does not leave the domain. Based on the aforementioned risk assessment model, the risk score of the personnel to be warned is determined; Risk warnings are issued based on the risk scores.

2. The method according to claim 1, characterized in that, The risk assessment model, built using a federated learning algorithm based on the data sources from various data providers, includes: Arrange the data from each data provider into the same directory; Based on the sorted data, an initial risk assessment model is trained using a federated learning algorithm to obtain the risk assessment model.

3. The method according to claim 2, characterized in that, The arrangement of data from various data providers into the same directory includes: The common user among the multiple data providers is determined by using homomorphic encryption to align user identifiers. Based on the common users and user identifiers, the data from each data provider is arranged into the same directory.

4. The method according to claim 2, characterized in that, The process involves training an initial risk assessment model using a federated learning algorithm based on the permuted data, resulting in a risk assessment model that includes: For any data provider, an initial risk assessment model is trained based on the sorted data, wherein the initial risk assessment model is a CatBoost model; During training, the model gradients and model parameters from various data providers are interacted until preset conditions are met to obtain the risk assessment model.

5. The method according to claim 1, characterized in that, The process of determining the risk score of individuals subject to early warning based on the risk assessment model includes: Upon receiving the user identifier of the person to be warned, the user identifier is input into the risk assessment model to obtain the probability that the user identifier is a positive sample; Based on the probability, a risk score is obtained for the person to be warned.

6. The method according to claim 1, characterized in that, The risk warning based on the risk score includes: If the risk score exceeds the first risk threshold, the person to be warned is identified as a first category of person. If the risk score is lower than the first risk threshold but higher than the second risk threshold, the person to be warned is determined to be a second type of person, where the first risk threshold is greater than the second risk threshold. If the risk score is lower than the second risk threshold, the person to be warned is identified as a third category of personnel. Based on the classification of the personnel to be warned, different warning methods will be adopted.

7. The method according to claim 1, characterized in that, The method further includes: The risk assessment model is updated based on the historical risk scores of the warning events and the individuals subject to warnings.

8. An electronic device, characterized in that, It includes a processor, a memory, a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, implement the steps of the method as described in any one of claims 1 to 7.

Images