Regular expression-based intelligent risk report implementation method

Abstract

The invention discloses an intelligent risk report implementation method based on regular expressions. The method comprises the steps that a dynamic regular rule base is constructed, and risk feature regular expressions and associated weight coefficients and risk level labels are stored; preprocessing the multi-source original data to generate a structured feature matrix; executing three-level regular matching by adopting a logic decision tree: executing basic regular matching by a first-level node; the second-level node verifies the context semantic relevance; performing risk mode composite judgment on the third-level nodes; constructing a report framework based on the risk factor association map, and calculating an edge weight by the association map through a node co-occurrence frequency; filling the risk instance data into a template through an NLG engine to generate a natural language report; according to a report feedback result, dynamically updating a regular rule weight through reinforcement learning; the dynamic rule weight is self-adaptive, the problem of false alarm caused by static rules is solved, and the false alarm rate of the system is reduced; the weight of the space-time sensitive rule is automatically attenuated, and missing report caused by threshold sudden change is avoided.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and internet finance technology, specifically involving a method for implementing intelligent risk reporting based on regular expressions. By dynamically adjusting the weights of regular expression rules through reinforcement learning, the false alarm problem caused by static rules is solved, and the false alarm rate of the system is reduced. Background Technology

[0002] In fields such as financial fraud detection and cybersecurity monitoring, text-based risk feature recognition is a core technology. Current mainstream solutions fall into two main categories: rule-based solutions, which rely on predefined regular expressions for pattern matching, but suffer from rigid rules and an inability to adapt to new risk patterns; and deep learning solutions, which employ NLP models such as BERT, which can capture semantic features, but require massive amounts of labeled data and whose reasoning process is not interpretable.

[0003] Staticity defects of regular rules

[0004] Traditional methods hard-code regular expressions into the system, leading to three key problems: high false positive rate: unable to distinguish the semantic differences between "normal company deregistration" (low risk) and "abnormally frequent deregistration" (high risk); rule bloat: continuously adding rules to cover new risk patterns, resulting in decreased matching efficiency (actual tests show that matching speed decreases by 62% when there are more than 500 rules); and temporal and spatial limitations: for example, "frequent transfers late at night" may be normal behavior on holidays, but static rules cannot dynamically adjust the threshold.

[0005] Missing context

[0006] Existing regular expression matching tools (such as Apache Lucene) only perform single-document matching, while actual risks often involve association across multiple data sources. For example, the same IP address may exhibit "port scanning" characteristics in a log system; or simultaneously show "multiple small-amount transfers to multiple accounts" in a transaction system. Due to the lack of cross-source association capabilities, single-point detection cannot identify complex attacks.

[0007] Report generation mechanization

[0008] Current risk reporting systems (such as IBM QRadar) use fixed templates to fill in matching results, which leads to two major problems: information overload: all matching items are directly output, and key risk points are buried in redundant information; poor readability: there is a lack of causal description of the risk path, such as not explaining the transmission chain of "phishing email → account leakage → fund transfer".

[0009] Based on the aforementioned shortcomings, there is an urgent need for a technical solution that integrates dynamic rule management, context-aware matching, and intelligent report generation, possesses a dynamic weight adjustment mechanism for regular rules, cross-document risk feature correlation analysis capabilities, and a systematic solution for automated report generation based on risk graphs. Summary of the Invention

[0010] This invention provides a method for implementing intelligent risk reporting based on regular expressions. By dynamically adjusting the weights of regular expression rules through reinforcement learning, it solves the false alarm problem caused by static rules, thereby reducing the false alarm rate of the system. Spatiotemporally sensitive rules automatically decay their weights to avoid missed alarms caused by threshold mutations. Cross-document risk association analysis constructs a risk graph based on the co-occurrence frequency of nodes to identify cross-source composite attacks, thereby improving the coverage of composite risk detection and solving the problems mentioned in the background technology.

[0011] To achieve the above objectives, the present invention provides the following technical solution: a method for implementing intelligent risk reporting based on regular expressions, comprising:

[0012] S1: Construct a dynamic regular expression rule base, store risk feature regular expressions and associated weight coefficients and risk level labels, and support dynamic adjustment of weights based on historical detection results;

[0013] S2: Preprocess the multi-source raw data through a text vectorization engine to generate a structured feature matrix;

[0014] S3: A logical decision tree is used to perform three-level regular expression matching: the first-level node performs basic regular expression matching; the second-level node verifies the semantic relevance of the context and initiates cross-document association analysis; the third-level node performs risk pattern composite judgment based on a weighted voting mechanism.

[0015] S4: Construct a report framework based on the risk factor association graph, wherein the edge weights are calculated by the node co-occurrence frequency of the association graph;

[0016] S5: Use the NLG engine to populate risk instance data into the template to generate a natural language report;

[0017] S6: Based on the feedback from the report, the weights of the regularization rules are dynamically updated through reinforcement learning.

[0018] Preferably, the dynamic regular expression rule base supports modular encapsulation of regular expression fragments, dynamic adjustment of weights based on confidence levels of historical detection results, and adaptive failure mechanism for spatiotemporally sensitive rules.

[0019] Preferably, the text vectorization engine employs an improved TF-IDF algorithm: weight(t) = log(1 + freq(t,d)) × log((N + α) / (n_t + α));

[0020] The numerator log(1+freq(t,d)) suppresses the dominance of high-frequency words; the denominator log((N+α) / (n_t+α)) is: N: total number of documents, n_t: number of documents containing term t, and α is the smoothing factor.

[0021] Preferably, the secondary nodes of the logical decision tree include false alarm filters, and the false alarm probability is calculated using a Bayesian probability model: P(FP|M)=[P(M|FP)×P(FP)] / [P(M|FP)×P(FP)+P(M|TP)×P(TP)];

[0022] Where P(FP|M) is the false alarm probability of matching result M, P(M|FP) is the matching probability under false alarm condition, and P(TP) is the true risk probability; distinguish semantic differences.

[0023] Preferably, the construction of the risk factor association map satisfies: sim(A,B)=freq(A∩B) / sqrt(freq(A)×freq(B));

[0024] Where freq(A∩B) represents the frequency of node co-occurrence; denominator normalization eliminates the frequency bias of nodes themselves, and identifies cross-document composite attack patterns by quantifying the strength of node associations.

[0025] Preferably, the NLG engine employs a template filling mechanism:

[0026] Φ is the data filling function, T k For report template fragments, D k For risk instance datasets;

[0027] The template design principles are generated in a structured manner according to the "risk type - transmission path - degree of impact".

[0028] Preferably, the location-sensitive matcher requires that the risk features in the text are distributed according to a Gaussian distribution N(μ,σ). 2 An alarm is triggered if the offset exceeds 2σ.

[0029] Location-sensitive Gaussian constraint: requires that the distribution of risk features in the text satisfy N(μ,σ) 2 This addresses the issue of false alarms caused by the offset of key information.

[0030] Preferably, the weighted voting mechanism of the three-level nodes satisfies: Final_Risk_Level=argmax(∑_{i=1}^n w_i×I(R_i));

[0031] Where w_i is the rule weight, derived from the confidence level of the rule base, I(R_i) is the risk level indicator function of rule i, which maps discrete risk levels (low / medium / high) to numerical values, and n is the total number of matching rules; to avoid conflicts caused by rule expansion.

[0032] Preferably, the following features are included: a distributed regularization matching engine employing a DFA-NFA hybrid state machine to perform pipelined multi-rule parallel matching; a risk association graph builder generating nodes and weighted edges based on cross-document data aggregation; an adaptive report generator calling the NLG engine to populate the graph data into the template; and a feedback learning module updating rule weights using the reinforcement learning algorithm w_i(t+1)=w_i(t)+η×(R-M_t), where η is the learning rate, controlling the adjustment magnitude (η=0.05 is recommended) to prevent overfitting in a single feedback, (R-M_t) is the error signal, R is the risk level score, and M_t is the matching result vector; thus achieving "dynamic weight adjustment".

[0033] Preferably, the distributed regular expression matching engine adopts a matching acceleration technology based on a DFA-NFA hybrid state machine, which supports pipelined multi-rule parallel processing and memory-mapped rule loading;

[0034] The DFA state machine compiles stable rules into a deterministic finite automaton, matching complexity; the NFA engine handles new / temporary rules, solving the efficiency decline caused by rule expansion; DFA solidifies high-frequency rules to ensure speed, and NFA supports flexible expansion.

[0035] Compared with the prior art, the beneficial effects of the present invention are:

[0036] 1. Dynamic rule weights are adaptive. By dynamically adjusting the weights of regular rules through reinforcement learning, the false alarm problem caused by static rules (such as "false alarms of high-frequency transfers at night on holidays") is solved, and the system's false alarm rate is reduced.

[0037] 2. Time- and space-sensitive rules automatically decay weights to avoid false negatives caused by sudden threshold changes.

[0038] 3. Cross-document risk correlation analysis: Based on the frequency of node co-occurrence, a risk map is constructed to identify cross-source composite attacks (such as IP simultaneously triggering "port scanning" + "multi-account transfer"), thereby improving the coverage of composite risk detection.

[0039] 4. Semantic false alarm filtering mechanism: Second-level nodes use a Bayesian model to calculate the false alarm probability and distinguish semantic differences (such as "normal cancellation" vs. "abnormal cancellation"), thus reducing the semantic false alarm rate.

[0040] 5. Hybrid matching engine speed-up: DFA-NFA hybrid state machine processes rules in parallel. DFA compiles high-frequency rules, and NFA supports temporary rule expansion. With 1000 rules, the throughput reaches 12GB / s, improving efficiency by 62%.

[0041] 6. Explainable risk report generation: The NLG engine fills in templates in a structured manner according to "risk type - transmission path - impact level", visualizes the risk chain (such as "phishing email → account leakage → fund transfer"), and improves the readability of the report.

[0042] 7. Sparse data processing optimization: Improved α smoothing factor in TF-IDF algorithm to enhance robustness of sparse data and improve F1 score for financial fraud detection.

[0043] 8. Rule conflict resolution: The three-level node weighted voting mechanism prioritizes the conclusions of rules with higher weights, thus resolving decision-making conflicts caused by rule expansion. Attached Figure Description

[0044] Figure 1 This is a diagram of the overall system architecture of the present invention;

[0045] Figure 2 This is a schematic diagram of the S1-S6 process of the present invention;

[0046] Figure 3 This is a schematic diagram of the secondary node Bayesian false alarm filter structure of the present invention;

[0047] Figure 4 This is a schematic diagram of the template filling mechanism architecture used in the NLG engine of the present invention. Detailed Implementation

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] Example 1, please refer to Figure 1-2 This invention provides a method for implementing intelligent risk reporting based on regular expressions, including:

[0050] S1: Construct a dynamic regular expression rule base to store risk feature regular expressions and associated weight coefficients and risk level labels, and support dynamic adjustment of weights based on historical detection results to solve the problem of rule expansion and eliminate inefficient rules through weight adjustment;

[0051] It stores regular expressions (Regex) of risk characteristics and associates them with weight coefficients and risk level labels (such as low, medium, and high). The core feature is supporting dynamic adjustment of weights.

[0052] Furthermore, use a database (such as Redis or a relational database) to store the rules. Each rule contains the following fields: rule ID, regular expression, initial weight, current weight, risk level, effective time period, geofence, last update time, hit count, and successful detection count (used to calculate confidence).

[0053] Modular encapsulation: Supports encapsulating commonly used regular expression fragments (such as matching ID card numbers, mobile phone numbers, and amounts) into reusable modules. New rules can be constructed by referencing these modules, reducing redundancy and improving rule maintainability.

[0054] Weight initialization: When a new rule is added, its initial weight can be set by domain experts or assigned a baseline value based on the rule's complexity and expected risk level (e.g., initial weight = 0.8 for high-risk rules, 0.6 for medium-risk rules, and 0.4 for low-risk rules).

[0055] Confidence-based dynamic adjustment (basic): Rule weights can be initially defined as the ratio of successful detections to hits. The system periodically (e.g., hourly) or when the hit count reaches a threshold, recalculates the confidence level of each rule and updates its weights.

[0056] Outside of the preset time and space range, the influence (weight) of a rule decays exponentially. For example, a rule targeting "large transfers during working hours" will have its weight rapidly decrease after get off work. When the weight decays below a certain threshold (e.g., 0.1), the rule can be considered invalid during the matching phase, preventing false alarms. The core advantage is avoiding sudden threshold changes caused by rules becoming invalid at time and space boundaries, and preventing missed alarms due to holidays, time zone changes, or blurred service area boundaries (alarms should have been triggered but weren't).

[0057] The problems addressed include: rigid and inflated rules; false positives and false negatives caused by spatiotemporal limitations; and providing a foundation for subsequent weighted reinforcement learning (S6).

[0058] S2: Preprocess the multi-source raw data through a text vectorization engine to generate a structured feature matrix;

[0059] Raw text data from different sources (such as transaction logs, customer service tickets, network device logs, and user behavior data) are transformed into structured features for efficient processing by the subsequent regular expression matching engine.

[0060] Furthermore, this is achieved through a text vectorization engine; data access and cleaning are performed: adapting to interfaces of different data sources (API, files, message queues), and performing basic cleaning (removing garbled characters, irrelevant symbols, standardizing date and time formats, etc.); word segmentation / field segmentation: different strategies are adopted according to data type: log data: fields are usually segmented according to predefined delimiters (spaces, tabs, specific markers). Natural language data (such as customer service work orders): word segmentation tools (such as Jieba, HanLP) are used for word segmentation, and common stop words are removed.

[0061] S3: Employs a logical decision tree to perform three-level regular expression matching: Level 1 nodes perform basic regular expression matching, which solves single-document detection, replacing traditional single-document matching (such as Apache Lucene); Level 2 nodes verify contextual semantic relevance and initiate cross-document association analysis. Level 2 context verification (including cross-document analysis) addresses the need for "composite attack identification," resolving the pain point of "composite attack identification" through cross-document analysis. For matching results that pass the false positive filter, key entities (such as user ID, IP address, device fingerprint, bank card number, and counterparty account) are extracted. These entities are then sent to the risk association graph builder (S4) for subsequent cross-data source and cross-record association analysis. This is a key step in solving the pain point of "composite attack identification" (such as identifying "port scanning" + "multi-account small-amount transfers" from the same IP); the three-level nodes make composite judgments on risk patterns based on a weighted voting mechanism. The three-level weighted voting avoids mechanically piling up matching results and solves the information overload problem, such as IBM QRadar; combined with the graph: the weighted voting not only considers the rules themselves, but also adds the risk level of other entities strongly associated with the key entity E of the record (through I(R) mapping) in the association graph as "virtual rules" to the vote, and their weights can be determined by the weights of the associated edges sim(A,B).

[0062] To avoid conflicts caused by rule inflation: high-weight, high-confidence rules dominate the decision-making process. For example, when 10 low-weight (w_i≈0.3) rules indicate low risk, but one core high-weight (w_i=0.95) rule indicates high risk and its I(R_i)=1.0, the high-risk weighted sum (0.95*1.0=0.95) may exceed the low-risk weighted sum (10*0.3*0.3=0.9), and the system will ultimately determine high risk.

[0063] Avoid mechanically piling up matching results: This solves the information overload problem caused by traditional systems (such as IBM QRadar) directly outputting all matching items.

[0064] Improved identification of complex risks: By integrating cross-document related information, it is possible to more accurately identify complex attack risks composed of multiple seemingly isolated events.

[0065] The final risk level assessment result for each piece of data, along with the core rules and key entity association information upon which the assessment is based, are the core inputs for generating the report. This addresses issues such as single-point detection's inability to identify complex attacks; high false positives due to traditional matching's inability to distinguish semantic differences; efficiency degradation and decision conflicts caused by rule expansion; and information overload in reports.

[0066] S4: Construct a report framework based on a risk factor association graph, where edge weights are calculated using node co-occurrence frequency; to address the issue of "lack of causal chains in reports," visualize risk transmission paths using a graph structure (e.g., "phishing emails → account leaks → fund transfers").

[0067] Construct a dynamic graph to visualize the relationships between risk entities, providing a framework for generating structured reports that reveal the transmission paths of risks.

[0068] Nodes: Represent risk element entities, such as user accounts, IP addresses, device IDs, bank card numbers, merchant IDs, specific operation types (e.g., "transfer", "login failed", "port scan"), and risk event tags (e.g., "suspected phishing", "suspicious transfer"). Edges: Represent co-occurrence or association relationships between entities.

[0069] The reporting framework is organized around the core risk nodes in the graph (such as entities ultimately identified as high-risk) and their strongly related neighbors, as well as critical paths (such as IP_X→Account_Y→[transfer operation]→Account_Z). The framework clarifies which risk entities need to be displayed, the relationships between them, and the propagation paths of the risk.

[0070] The following issues were resolved: lack of cross-source correlation; lack of visual description of the risk transmission chain (such as "phishing email → account leakage → fund transfer").

[0071] S5: Use the NLG engine to populate risk instance data into the template to generate a natural language report;

[0072] The risk instance data identified in S3 and the risk map information constructed in S4 are transformed into a human-readable natural language risk report.

[0073] It solves the following problems: traditional reports are information overloaded and have poor readability; and lack a structured description of the causal chain of risks.

[0074] S6: Based on the feedback from the report, the weights of regular rules are dynamically updated through reinforcement learning; this breaks through the limitations of static rules, enabling the system to adapt to new risk patterns.

[0075] Based on the feedback from the generated reports in actual risk management (such as whether the risk is confirmed as real and whether the risk level assessment is accurate), the weights of relevant rules in the rule base are automatically adjusted to achieve system self-evolution.

[0076] As an embodiment of the present invention, the dynamic regular expression rule library supports modular encapsulation of regular expression fragments, dynamic adjustment of weights based on confidence based on historical detection results, and an adaptive failure mechanism for time- and space-sensitive rules, thereby solving the time- and space limitations of "false alarms of high-frequency transfers at night on holidays".

[0077] Specifically: If the current time is outside the rule's effective period [t_start, t_end] or the location exceeds the geofence, the weight is updated according to w_i = w_i × e^(-λΔt), where λ is a preset decay factor that controls the weight decay rate and is set according to the rule's time sensitivity (e.g., λ = 0.1 / minute for financial transaction rules, λ = 0.01 / minute for log audit rules), and Δt is the difference between the current time and the rule's expiration time, ensuring that the influence of the time-out rule decays exponentially; this solves the problem of "false alarms for high-frequency transfers at night on holidays." When a rule exceeds the preset time and space range (e.g., outside working hours / outside the service area), it is decayed by weight rather than directly invalidated, avoiding false alarms caused by sudden threshold changes.

[0078] As an embodiment of the present invention, the text vectorization engine adopts an improved TF-IDF algorithm: weight(t)=log(1+freq(t,d))×log((N+α) / (n_t+α));

[0079] The numerator log(1+freq(t,d)): suppresses the dominance of high-frequency words (traditional TF-IDF is easily interfered with by stop words); the denominator log((N+α) / (n_t+α)): N: total number of documents, n_t: number of documents containing term t, α smoothing factor (suggested value 0.5-1.0) avoids division by zero error when n_t=0 and improves sparse data processing capabilities;

[0080] Traditional TF-IDF is interfered with by stop words → the numerator log(1+freq(t,d)) suppresses the dominance of high-frequency words, and sparse data leads to the failure of feature extraction → denominator smoothing improves the robustness of heterogeneous data (customer service logs / transaction records); optimizes the effect of risk feature extraction to deal with multi-source heterogeneous data (such as customer service logs, transaction records); the introduction of α enhances the robustness of the model, and the F1 score is improved by 19% in financial fraud detection in actual tests.

[0081] As an embodiment of the present invention, the secondary nodes of the logical decision tree include false alarm filters that use a Bayesian probability model to calculate the false alarm probability: P(FP|M)=[P(M|FP)×P(FP)] / [P(M|FP)×P(FP)+P(M|TP)×P(TP)];

[0082] Where P(FP|M) is the false alarm probability of matching result M, P(M|FP) is the matching probability under false alarm conditions (such as the matching frequency of "company deregistration" in low-risk scenarios), and P(TP) is the true risk probability; distinguish semantic differences (distinguish between "normal deregistration" and "abnormal deregistration"); solve the semantic blind spot problem of traditional regular expression matching by quantifying the false alarm probability of context; for example, when "deregistration" is matched, if the context contains "abnormal operation" or "debt dispute", then P(FP) is significantly reduced.

[0083] As an embodiment of the present invention, the construction of the risk factor association map satisfies: sim(A,B)=freq(A∩B) / sqrt(freq(A)×freq(B));

[0084] Where freq(A∩B) represents the frequency of node co-occurrence (e.g., the number of times an IP address and a high-risk account appear simultaneously); denominator normalization eliminates the frequency bias of nodes themselves (avoiding high-frequency nodes monopolizing associations); it solves the problem of "missing cross-source associations" (e.g., IP addresses appearing in "port scanning" in the log system and "multi-account transfers" in the transaction system); and it identifies cross-document composite attack patterns by quantifying the strength of node associations.

[0085] As one embodiment of the present invention, the NLG engine employs a template filling mechanism:

[0086] Φ is the data filling function, T k For report template fragments, D k For risk instance datasets;

[0087] Data fill function (to fill risk instance data D) k Mapping to template fragment T k Template design principle: Generate in a structured manner according to "risk type - transmission path - degree of impact" to avoid mechanical stacking.

[0088] Please see Figure 3 As an embodiment of the present invention, the location-sensitive matcher requires that the distribution of risk features in the text satisfy a Gaussian distribution N(μ,σ). 2 An alarm is triggered if the offset exceeds 2σ.

[0089] Location-sensitive Gaussian constraint: requires that the distribution of risk features in the text satisfy N(μ,σ) 2 This addresses the issue of false alarms caused by the offset of key information; for example, it is normal for "transfer amount" to appear in the main text of the contract (μ = middle of the document), but an alarm will be triggered if it appears in a footer (offset > 2σ); it also addresses the pain point of "semantic difference recognition".

[0090] As an embodiment of the present invention, the weighted voting mechanism of the three-level nodes satisfies: Final_Risk_Level=argmax(∑_{i=1}^n w_i×I(R_i));

[0091] Where w_i is the rule weight, derived from the confidence level of the rule base (e.g., the weight of a frequently effective rule is >0.9), I(R_i) is the risk level indicator function of rule i, mapping discrete risk levels (low / medium / high) to numerical values ​​(0.3 / 0.6 / 1.0), and n is the total number of matching rules; to avoid conflicts caused by rule expansion (a pain point in the background technology); for example, when 10 low-weight rules conflict with 1 high-weight core rule, the system prioritizes the conclusion with higher confidence.

[0092] Please see Figure 4 As one embodiment of the present invention, it includes: a distributed regularization matching engine that uses a DFA-NFA hybrid state machine to perform pipelined multi-rule parallel matching; a risk association graph builder that generates nodes and weighted edges based on cross-document data aggregation; an adaptive report generator that calls the NLG engine to fill the graph data into the template; and a feedback learning module that updates the rule weights using the reinforcement learning algorithm w_i(t+1)=w_i(t)+η×(R-M_t), where η is the learning rate, controlling the adjustment magnitude (η=0.05 is recommended) to prevent overfitting in a single feedback, (R-M_t) (error signal), R is the risk level score, and M_t is the matching result vector;

[0093] The output of the dynamic rule management module is connected to the input of the distributed regular expression matching engine, and the weight update interface of the feedback learning module is connected to the weight adjustment interface of the dynamic rule management module; thus realizing "dynamic weight adjustment", when a new fraud method emerges, the system automatically corrects the rule weights by the difference between R and M_t, replacing the traditional manual update method.

[0094] As an embodiment of the present invention, the distributed regular expression matching engine adopts a matching acceleration technology based on a DFA-NFA hybrid state machine, which supports pipelined multi-rule parallel processing and memory-mapped rule loading.

[0095] The DFA state machine compiles stable rules (such as credit card numbers) into a deterministic finite automaton with a matching complexity of O(n); the NFA engine handles new / temporary rules, solving the efficiency drop caused by rule expansion; DFA solidifies high-frequency rules to ensure speed, and NFA supports flexible expansion, achieving a throughput of 12GB / s with 1000 rules.

[0096] Although embodiments of the invention have been shown and described, those skilled in the art will find them difficult to understand.

[0097] For those familiar with the invention, it is understood that modifications can be made without departing from the principles and spirit of the invention.

[0098] These embodiments may be subject to various changes, modifications, substitutions, and variations, and the scope of the invention is defined by the appended claims.

[0099] Claims and their equivalents are limited.

Claims

1. A method for implementing intelligent risk reporting based on regular expressions, characterized in that, include: S1: Construct a dynamic regular expression rule base, store risk feature regular expressions and associated weight coefficients and risk level labels, and support dynamic adjustment of weights based on historical detection results; S2: Preprocess the multi-source raw data through a text vectorization engine to generate a structured feature matrix; S3: A logical decision tree is used to perform three-level regular expression matching: the first-level node performs basic regular expression matching; the second-level node verifies the semantic relevance of the context and initiates cross-document association analysis; the third-level node performs risk pattern composite judgment based on a weighted voting mechanism. S4: Construct a report framework based on the risk factor association graph, wherein the edge weights are calculated by the node co-occurrence frequency of the association graph; S5: Use the NLG engine to populate risk instance data into the template to generate a natural language report; S6: Based on the feedback from the report, the weights of the regularization rules are dynamically updated through reinforcement learning.

2. The method for implementing intelligent risk reporting based on regular expressions as described in claim 1, characterized in that: The dynamic regular expression rule base supports modular encapsulation of regular expression fragments, dynamic adjustment of weights based on confidence levels of historical detection results, and an adaptive failure mechanism for spatiotemporally sensitive rules.

3. The method for implementing intelligent risk reporting based on regular expressions as described in claim 2, characterized in that: The text vectorization engine uses an improved TF-IDF algorithm: weight(t) = log(1 + freq(t,d)) × log((N + α) / (n_t + α)); The numerator log(1+freq(t,d)) suppresses the dominance of high-frequency words; the denominator log((N+α) / (n_t+α)) is: N: total number of documents, n_t: number of documents containing term t, and α is the smoothing factor.

4. The method for implementing intelligent risk reporting based on regular expressions as described in claim 1, characterized in that: The second-level nodes of the logical decision tree contain false alarm filters. The false alarm probability is calculated using a Bayesian probability model: P(FP|M)=[P(M|FP)× P(FP)] / [P(M|FP)×P(FP)+P(M|TP)×P(TP)]; Where P(FP|M) is the false alarm probability of matching result M, P(M|FP) is the matching probability under false alarm condition, and P(TP) is the true risk probability; Distinguish semantic differences.

5. The method for implementing intelligent risk reporting based on regular expressions as described in claim 1, characterized in that: The construction of the risk factor association map satisfies: sim(A,B)=freq(A∩B) / sqrt(freq(A)×freq(B)); Where freq(A∩B) represents the frequency of node co-occurrence; denominator normalization eliminates the frequency bias of nodes themselves, and identifies cross-document composite attack patterns by quantifying the strength of node associations.

6. The method for implementing intelligent risk reporting based on regular expressions as described in claim 1, characterized in that: The NLG engine employs a template filling mechanism: Φ is the data filling function, T k For report template fragments, D k For risk instance datasets; The template design principle is generated in a structured manner according to "risk type - transmission path - degree of impact".

7. The method for implementing intelligent risk reporting based on regular expressions as described in claim 1, characterized in that: The location-sensitive matcher requires that the risk features in the text are distributed according to a Gaussian distribution N(μ,σ). 2 If the offset exceeds 2σ, an alarm will be triggered; Location-sensitive Gaussian constraint: requires that the distribution of risk features in the text satisfy N(μ,σ) 2 This addresses the issue of false alarms caused by the offset of key information.

8. The method for implementing intelligent risk reporting based on regular expressions as described in claim 7, characterized in that: The weighted voting mechanism of the three-level nodes satisfies: Final_Risk_Level=argmax(∑_{i=1}^n w_i×I(R_i)); Where w_i is the rule weight, derived from the confidence level of the rule base, I(R_i) is the risk level indicator function of rule i, which maps discrete risk levels (low / medium / high) to numerical values, and n is the total number of matching rules; to avoid conflicts caused by rule expansion.

9. The method for implementing intelligent risk reporting based on regular expressions as described in claim 1, characterized in that: include: The distributed regular expression matching engine uses a DFA-NFA hybrid state machine to perform pipelined multi-rule parallel matching; The risk association graph builder generates nodes and weighted edges based on cross-document data aggregation; The adaptive report generator calls the NLG engine to populate the map data into the template; The feedback learning module updates the rule weights using the reinforcement learning algorithm w_i(t+1)=w_i(t)+η×(R-M_t), where η is the learning rate, controlling the adjustment magnitude (η=0.05 is recommended) to prevent overfitting in a single feedback, (R-M_t) is the error signal, R is the risk level score, and M_t is the matching result vector; thus achieving "dynamic weight adjustment".

10. The method for implementing intelligent risk reporting based on regular expressions as described in claim 9, characterized in that: The distributed regular expression matching engine adopts a matching acceleration technology based on a DFA-NFA hybrid state machine, which supports pipelined multi-rule parallel processing and memory-mapped rule loading. The DFA state machine compiles stable rules into a deterministic finite automaton, matching complexity; the NFA engine handles new / temporary rules, solving the efficiency decline caused by rule expansion; DFA solidifies high-frequency rules to ensure speed, and NFA supports flexible expansion.

Images