Enterprise compliance management method and system based on violation file detection

Abstract

The present application relates to the technical field of enterprise compliance management, in particular to an enterprise compliance management method and system based on illegal file detection, which comprises image acquisition on a to-be-detected commercial file to obtain image data of the to-be-detected commercial file, illegal element detection on text content based on a commercial illegal feature recognition model, screening of high-suspected files based on a first illegal-suspected degree score, risk assessment on metadata based on an abnormal metadata analysis model, correction of the first illegal-suspected degree score based on a multi-modal risk coefficient and a metadata risk value to obtain a second illegal-suspected degree score, determination of whether the to-be-detected commercial file is compliant based on the second illegal-suspected degree score, and analysis on enterprise risks and employee behaviors based on a compliance judgment result to realize enterprise compliance management. The present application realizes automatic closed-loop management from risk identification to risk disposal by deeply integrating illegal detection results with enterprise management processes.

Description

Technical Field

[0001] This invention relates to the field of document violation management technology in commercial scenarios, specifically to an enterprise compliance management method and system based on violation document detection. Background Technology

[0002] Traditional methods rely solely on single-dimensional information (such as text keyword matching), failing to cover various forms of violations in business scenarios (such as hidden non-compliant clauses in scanned contracts), leading to overlooked business compliance risks (such as breach of contract penalties faced by enterprises due to contract violations, and regulatory penalties faced by financial institutions due to inadequate document risk control). Traditional methods employ simple rule matching (such as fixed keyword lists), making it difficult to adapt to dynamically changing compliance requirements in business scenarios (such as updates to regulatory details across different industries, and differences in compliance standards for cross-border businesses). This can easily result in misjudgments (such as normal business terms being misjudged as non-compliant words) or omissions (such as semantically distorted expressions of non-compliant business practices), increasing the manual review costs of business compliance audits. Traditional methods often require comprehensive and detailed inspection of all documents, resulting in a large workload and low efficiency, especially when processing large numbers of documents, consuming significant time and computing resources. Furthermore, traditional methods lack correlation analysis between non-compliant documents and overall corporate risk, as well as individual employee behavior, making it difficult to further identify potential operational risks and employee violations from document violations, thus hindering the formation of comprehensive corporate compliance management. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide an enterprise compliance management method and system based on the detection of illegal documents.

[0004] The technical solution adopted to solve the above-mentioned technical problems is: an enterprise compliance management method based on the detection of non-compliant documents, including:

[0005] The business document to be inspected is image-captured to obtain image data of the business document to be inspected. The image data is then parsed using image recognition technology to obtain the text content.

[0006] The text content is detected for violations based on a pre-trained commercial violation feature recognition model to obtain a set of violation features of the commercial document to be detected. The first violation suspicion score of the commercial document to be detected is calculated based on the commercial risk weight and frequency of occurrence of each feature in the set of violation features.

[0007] Based on the first violation suspicion score, highly suspected files are selected, and the creation log, propagation trajectory, and storage path metadata of the highly suspected files are obtained;

[0008] The metadata is risk-assessed based on a pre-trained abnormal metadata analysis model to obtain a metadata risk value. The association matching relationship between the violation feature set of the highly suspected file and the metadata risk value is obtained. The risk fit of the association matching relationship is calculated based on a preset multimodal fusion rule to obtain the multimodal risk coefficient of the highly suspected file.

[0009] The first violation suspicion score is corrected based on the multimodal risk coefficient and metadata risk value to obtain a second violation suspicion score. The compliance of the business document to be detected is determined based on the second violation suspicion score to obtain a compliance judgment result. The enterprise risk and employee behavior are analyzed based on the compliance judgment result to achieve enterprise compliance management.

[0010] Preferably, the commercial violation feature identification model includes a text feature extraction layer constructed based on a bidirectional long short-term memory network (BiLSTM) and an attention mechanism, and a violation element classification layer composed of multiple fully connected networks. The text feature extraction layer uses BiLSTM to perform contextual semantic modeling of the text sequence to capture long-distance dependencies and assigns higher weights to key semantic segments based on the attention mechanism to enhance the representation ability of violation features. The violation element classification layer performs multi-label classification of preset violation element categories based on the extracted text features to output the existence probability and confidence of each element, thereby constructing a complete set of violation features.

[0011] Preferably, a pre-trained business violation feature recognition model is used to detect violation elements in the text content to obtain a set of violation features for the business document to be detected, including:

[0012] The text content is divided into several semantic units, wherein each semantic unit contains a continuous sentence or paragraph;

[0013] The semantic unit is input into the business violation feature recognition model, and the deep semantic vector of the semantic unit is obtained based on the text feature extraction layer. The violation element classification layer calculates the existence probability and confidence of each violation element category based on the deep semantic vector.

[0014] Elements whose existence probability is greater than a preset threshold and whose confidence level meets the standard are taken as valid violation features. The valid violation features of all the semantic units are integrated to obtain the violation feature set of the commercial document to be detected. The occurrence position and frequency distribution of each feature in different semantic units in the violation feature set are recorded.

[0015] Preferably, a first violation suspicion score is calculated for the business document to be detected based on the business risk weight and frequency of occurrence of each feature in the violation feature set, including:

[0016] Determine the business risk weight of each violation feature in the business document to be detected, and dynamically adjust the business risk weight based on the importance of the violation features in the industry sector to obtain the final business risk weight;

[0017] Obtain the frequency of occurrence of each feature in the text content from the set of violation features;

[0018] The product of the business risk weights and the frequency of occurrence is weighted and then normalized to obtain the first violation suspicion score.

[0019] Preferably, the abnormal metadata analysis model includes a metadata feature extraction module, a time-series anomaly detection layer, and a risk level assessment layer. The metadata feature extraction module performs structured feature extraction on the metadata to obtain a metadata feature vector containing time-series features, network behavior features, and storage attribute features. The time-series anomaly detection layer performs trend prediction on the time-series features based on a Long Short-Term Memory (LSTM) network to obtain abnormal time nodes. Based on the abnormal time nodes and the Isolation Forest algorithm, it performs outlier detection on the network behavior features and storage attribute features to obtain a preliminary anomaly probability. The risk level assessment layer compares the preliminary anomaly probability output by the time-series anomaly detection layer with a preset metadata risk threshold. Based on the comparison result and the risk contribution weights of each dimension of the metadata feature vector, a weighted summation is performed to obtain the final metadata risk value.

[0020] Preferably, the association and matching relationship between the violation feature set and metadata risk value of the highly suspected files includes:

[0021] Construct a mapping matrix between violation features and metadata dimensions, wherein the row vectors of the mapping matrix are each feature item in the violation feature set, and the column vectors of the mapping matrix are the key dimensions of the metadata, including creation timestamp, propagation node IP, and storage path level.

[0022] The association strength value between each violation feature and each dimension of the metadata in the mapping matrix is ​​calculated based on the cosine similarity algorithm. When the association strength value exceeds the preset association threshold, it is determined that there is a significant coupling relationship between the violation feature and the metadata dimension.

[0023] All coupling relationships are grouped and aggregated according to feature categories and metadata dimensions to obtain an association matching relationship network with violation feature clusters and metadata dimension groups as basic units;

[0024] Based on the aforementioned association matching network, the association matching relationship between the violation feature set and metadata risk value of the highly suspected files is obtained.

[0025] Preferably, the risk fit of the association matching relationship is calculated based on a preset multimodal fusion rule to obtain the multimodal risk coefficient of the highly suspected file, including:

[0026] The multimodal fusion rules include feature contribution weight allocation and risk attenuation factor settings;

[0027] Each violation feature cluster-metadata dimension group unit in the association matching relationship network is taken as an independent evaluation node. The feature contribution weight and risk attenuation coefficient of the independent evaluation node are extracted. The feature contribution weight and risk attenuation coefficient are weighted and summed to obtain the local risk fit of the independent evaluation node. Based on the association strength of the independent evaluation node, the local risk fit is used for global risk transmission to obtain the global risk fit of the association matching relationship network.

[0028] The global risk fit is normalized to the 0-1 range to obtain the multimodal risk coefficient.

[0029] Preferably, the first violation suspicion score is corrected based on the multimodal risk coefficient and metadata risk value to obtain a second violation suspicion score, including:

[0030] The multimodal risk coefficient and the metadata risk value are weighted and fused to obtain a fused risk value;

[0031] A nonlinear mapping is performed on the fused risk value and the first violation suspicion score to obtain the violation suspicion mapping result;

[0032] The violation suspicion mapping result is calibrated based on a preset correction coefficient matrix to obtain a calibrated second violation suspicion score. The element values ​​of the correction coefficient matrix are optimized in reverse based on the false positive rate and false negative rate of historical violation document detection cases.

[0033] Preferably, based on the compliance determination results, the enterprise risks and employee behaviors are analyzed to achieve enterprise compliance management, including:

[0034] Based on the compliance assessment results, obtain the violation characteristics, frequency of occurrence, departments involved, and associated employees of the violation documents;

[0035] Obtain the frequency of file operations and the number of times non-compliant files are involved for the associated employees, and provide key compliance training to employees who frequently access high-risk files;

[0036] Based on the propagation trajectory and storage path of the illegal files, the risk spread nodes are traced, and the risk spread nodes are subject to hierarchical control, prioritizing the blocking of information interaction between core business systems and high-risk nodes;

[0037] The compliance assessment results are interfaced with the enterprise human resources management system to obtain automatic marking, isolation, and early warning notifications for non-compliant documents. Risk management strategies are executed based on a preset workflow engine. These risk management strategies include sending violation warnings to the employees involved, pushing risk reports to the compliance management department, and imposing access restrictions on high-risk documents.

[0038] The technical solution adopted to solve the above-mentioned technical problems is: an enterprise compliance management system based on violation document detection, which is applicable to the aforementioned enterprise compliance management method based on violation document detection, including:

[0039] The data acquisition unit is used to acquire images of the commercial document to be inspected in order to obtain image data of the commercial document to be inspected, and to perform text parsing on the image data based on image recognition technology to obtain text content;

[0040] The scoring calculation unit is used to detect illegal elements in the text content based on a pre-trained commercial violation feature recognition model to obtain a set of illegal features of the commercial document to be detected, and to calculate the first violation suspicion score of the commercial document to be detected based on the commercial risk weight and frequency of occurrence of each feature in the set of illegal features.

[0041] The file filtering unit is used to filter out highly suspected files based on the first violation suspicion score, and obtain the metadata of the creation log, propagation trajectory and storage path of the highly suspected files;

[0042] The risk assessment unit is used to assess the risk of the metadata based on a pre-trained abnormal metadata analysis model to obtain the metadata risk value, obtain the association matching relationship between the violation feature set of the highly suspected file and the metadata risk value, and calculate the risk fit degree of the association matching relationship based on the preset multimodal fusion rules to obtain the multimodal risk coefficient of the highly suspected file.

[0043] The compliance management unit is used to correct the first violation suspicion score based on the multimodal risk coefficient and metadata risk value to obtain a second violation suspicion score, determine whether the business document to be detected is compliant based on the second violation suspicion score to obtain a compliance judgment result, and analyze enterprise risks and employee behavior based on the compliance judgment result to achieve enterprise compliance management.

[0044] The beneficial effects of this invention are as follows: (1) This invention parses text based on a pre-trained commercial violation feature recognition model, which can accurately identify the violation elements and potential risks in the file. Furthermore, through risk assessment of metadata, it can more comprehensively grasp the risk situation of the file. It not only relies on the text content, but also combines information such as the file's propagation path and creation logs to conduct more refined analysis and ensure the accuracy of the detection results; (2) This invention can greatly improve the efficiency of commercial document compliance detection through automated image acquisition and text parsing. Traditional manual review requires a lot of manpower and time, while with this technology, the file content can be quickly acquired and intelligently identified and analyzed, thereby improving the efficiency of document compliance detection. (3) The present invention modifies the parameters of the first violation suspicion scoring model based on multimodal risk coefficients and metadata risk values ​​to obtain the second suspicion scoring model. This dynamic parameter correction mechanism can make the model better adapt to different data situations and changes in violation characteristics, thereby improving the accuracy of violation document detection in industrial Internet security management. (4) The present invention makes the final compliance judgment based on the second violation suspicion score after modification on the basis of the first violation suspicion score. The dynamic adjustment of this scoring mechanism can be optimized in real time according to risk changes, which helps to identify potential risk points in the detection process and to process and monitor high-risk documents in a timely manner. (5) The present invention deeply integrates the violation detection results with the enterprise management process, realizes the automated and intelligent closed-loop management from risk identification to risk disposal, and significantly improves the execution efficiency and accuracy of enterprise compliance management. Attached Figure Description

[0045] Figure 1 This is a schematic diagram of the overall method steps in one embodiment of the present invention;

[0046] Figure 2 This is a schematic diagram of the overall system flow in one embodiment of the present invention;

[0047] Attached labels: 1. Data acquisition unit; 2. Scoring calculation unit; 3. Document screening unit; 4. Risk assessment unit; 5. Compliance management unit. Detailed Implementation

[0048] Example 1, as Figure 1 As shown, the enterprise compliance management method based on violation document detection proposed in this invention includes:

[0049] S1. Acquire images of the commercial document to be inspected to obtain image data of the commercial document to be inspected. Then, perform text parsing on the image data based on image recognition technology to obtain the text content.

[0050] S2. Based on the pre-trained business violation feature recognition model, the text content is used to detect violation elements to obtain the violation feature set of the business document to be detected. The first violation suspicion score of the business document to be detected is calculated based on the business risk weight and frequency of occurrence of each feature in the violation feature set.

[0051] S3. Based on the first violation suspicion score, filter out high-suspect files and obtain the metadata of the creation log, propagation trajectory and storage path of the high-suspect files;

[0052] S4. Based on the pre-trained abnormal metadata analysis model, perform risk assessment on metadata to obtain metadata risk value, obtain the correlation matching relationship between the violation feature set of high-suspect files and metadata risk value, and calculate the risk fit of the correlation matching relationship based on the preset multimodal fusion rules to obtain the multimodal risk coefficient of high-suspect files.

[0053] S5. Based on the multimodal risk coefficient and metadata risk value, the first violation suspicion score is corrected to obtain the second violation suspicion score. Based on the second violation suspicion score, it is determined whether the business document to be tested is compliant to obtain the compliance judgment result. Based on the compliance judgment result, the enterprise risk and employee behavior are analyzed to achieve enterprise compliance management.

[0054] In this invention, image acquisition refers to taking pictures or screenshots of the commercial documents to be inspected to obtain image data; image recognition technology refers to processing image data using computer vision technology to extract text content, which typically includes Optical Character Recognition (OCR) technology to convert text in images into processable text data; the commercial violation feature recognition model refers to a model trained on a large amount of data that can identify violation content in text, such as sensitive information, illegal or non-compliant statements; violation element detection refers to automatically detecting potentially violation elements in the text based on the commercial violation feature recognition model, such as specific words, phrases, or expressions; the violation feature set refers to the set of all violation elements detected in the document, and these features are assigned violation weights according to preset rules; the suspicion score model refers to calculating the violation weight and frequency of occurrence of elements in the violation feature set. A file's "suspected violation score" indicates that the higher the score, the more potentially illegal content the file may contain. An abnormal metadata analysis model is an analytical model used to assess abnormal behavior in file metadata, such as whether the file's propagation pattern is abnormal or the storage path is reasonable. The metadata risk value is a risk value calculated using the abnormal metadata analysis model, representing the degree of risk that may exist in the file's metadata. Multimodal fusion rules combine data from different sources (such as text content and metadata) for comprehensive analysis, resulting in a more accurate risk assessment. The multimodal risk coefficient is a comprehensive risk coefficient calculated by combining the illegal characteristics of the text content and the file's metadata, representing the overall violation risk of the file. The second suspicion score model is a revised score model that adjusts the metadata risk and multimodal risk coefficients, used to more accurately assess the degree of violation of a file.

[0055] Example 2: The enterprise compliance management method based on violation document detection proposed in this invention, compared with Example 1, further includes:

[0056] A1. Using image recognition technology to parse image data into text to obtain text content, including:

[0057] A2. Perform preprocessing operations on the image data to obtain standardized image data. The preprocessing operations include grayscale conversion, noise reduction, and tilt correction.

[0058] A3. Based on OCR technology, extract characters from standardized image data to obtain the text sequence corresponding to the standardized image data;

[0059] A4. Perform semantic error correction and format normalization on the text sequence to obtain the final text content.

[0060] In this embodiment, grayscale conversion refers to converting a color image into a grayscale image (black and white image), simplifying the color information of the image and retaining only the brightness information, which helps to highlight the structural features of the text; noise reduction refers to removing noise in the image to reduce irrelevant interference, so that the text recognition can be clearer; tilt correction refers to adjusting the image if the text in the image is tilted, so that the text becomes horizontal or vertical, which facilitates subsequent character extraction; text sequence refers to the text sequence extracted from the image by OCR, in which the position and order of each character or word in the image are preserved, and the generated text sequence represents the original text content in the image; format normalization processing refers to formatting the extracted text to conform to certain typesetting rules, such as adjusting the text's line breaks, the correct use of punctuation marks, paragraph structure, etc., so that it becomes standardized, easy-to-process and easy-to-understand text.

[0061] In an optional embodiment, the commercial violation feature identification model includes a text feature extraction layer built on a bidirectional long short-term memory network (BiLSTM) and an attention mechanism, and a violation element classification layer composed of multiple fully connected networks. The text feature extraction layer uses BiLSTM to perform contextual semantic modeling of the text sequence to capture long-distance dependencies and assigns higher weights to key semantic segments based on the attention mechanism to enhance the representation ability of violation features. The violation element classification layer performs multi-label classification of preset violation element categories based on the extracted text features to output the existence probability and confidence of each element, thereby constructing a complete set of violation features.

[0062] It should be noted that bidirectional long short-term memory networks refer to techniques that process text simultaneously from both forward and backward directions. This allows the model to fully utilize contextual information, improve the understanding of text sequences, and more accurately understand the meaning of sentences by considering the context of preceding and following words, especially when long-distance dependencies need to be identified. Attention mechanisms mimic human visual focusing, allowing the model to automatically focus on more important information when processing input data. In text processing, attention mechanisms can identify key information in the text (such as sensitive words or illegal elements) and assign higher weights to these information, enabling the model to identify violations more accurately. The text feature extraction layer extracts meaningful features from the input text data through bidirectional long short-term memory networks and attention mechanisms. Its goal is to model the contextual relationships in the text, capture long-distance semantic dependencies, and emphasize those text parts that are crucial for violation identification.

[0063] In an optional embodiment, a pre-trained business violation feature recognition model is used to detect violation elements in the text content to obtain a set of violation features for the business document to be detected, including:

[0064] B1. Divide the text content into several semantic units, where each semantic unit contains a series of sentences or paragraphs;

[0065] B2. Input the semantic unit into the business violation feature recognition model, obtain the deep semantic vector of the semantic unit based on the text feature extraction layer, and calculate the existence probability and confidence of each violation element category based on the deep semantic vector.

[0066] B3. Elements with a probability greater than the preset threshold and a confidence level that meet the standard are taken as valid violation features. The valid violation features of all semantic units are integrated to obtain the violation feature set of the commercial document to be detected. The occurrence position and frequency distribution of each feature in different semantic units in the violation feature set are recorded.

[0067] It should be noted that a valid violation feature refers to a violation element that has a probability higher than a preset threshold and meets the confidence level; frequency distribution refers to the statistical analysis of the number of times a violation element occurs and its distribution, which helps to assess the severity or concentration of the violation.

[0068] In an optional embodiment, a first violation suspicion score for the business document to be detected is calculated based on the business risk weight and frequency of occurrence of each feature in the violation feature set, including:

[0069] C1. Determine the business risk weight of each violation feature in the business document to be detected, and dynamically adjust the business risk weight based on the importance of the violation features in the industry sector to obtain the final business risk weight;

[0070] C2. Obtain the frequency of occurrence of each feature in the text content in the set of violation features;

[0071] C3. The product of the business risk weight and the frequency of occurrence is weighted and normalized to obtain the first violation suspicion score.

[0072] It should be noted that violation characteristics refer to specific identifiers or patterns in business documents that may indicate the presence of violations. These characteristics can include non-compliant clauses, wording, overly vague terms, etc., which can imply business risks. For example, unclear or flawed clauses in a contract are violation characteristics. Business risk weights are assigned to each characteristic based on its degree of risk within the business document. Some violation characteristics may indicate more serious risks and are therefore given higher weights. Industry-specific violation characteristic importance refers to the fact that violation characteristics may have different severity or importance depending on the specific requirements and rules of the industry. For example, violations in the financial industry differ from those in the manufacturing industry. Therefore, industry-specific violation characteristics should have different importance, and the weights will be dynamically adjusted according to the industry. Frequency of occurrence refers to the number of times a violation characteristic appears in the business document to be tested. The higher the frequency, the more frequently the characteristic appears in the document, which may indicate a more serious risk. The first violation suspicion score is a comprehensive score representing the potential violation risk in the document, obtained by calculating the weighted product of each violation characteristic and normalizing it. It indicates the probability of the existence of violations in the document. The higher the score, the greater the violation risk.

[0073] In an optional embodiment, the abnormal metadata analysis model includes a metadata feature extraction module, a time-series anomaly detection layer, and a risk level assessment layer. The metadata feature extraction module performs structured feature extraction on the metadata to obtain a metadata feature vector containing time-series features, network behavior features, and storage attribute features. The time-series anomaly detection layer performs trend prediction on the time-series features based on a Long Short-Term Memory network to obtain abnormal time nodes. Based on the abnormal time nodes and the Isolation Forest algorithm, it performs outlier detection on the network behavior features and storage attribute features to obtain a preliminary anomaly probability. The risk level assessment layer compares the preliminary anomaly probability output by the time-series anomaly detection layer with a preset metadata risk threshold. Based on the comparison result and the risk contribution weights of each dimension of the metadata feature vector, a weighted summation is performed to calculate the final metadata risk value.

[0074] It should be noted that the Isolation Forest algorithm is an unsupervised learning algorithm commonly used for anomaly detection, particularly suitable for outlier detection in big data. It is mainly used to detect outliers in network behavior features and storage attribute features, identifying abnormal values ​​among these features. The preliminary anomaly probability refers to the probability that the model calculates for each data point using the Isolation Forest algorithm. This preliminary anomaly probability reflects the "degree of anomalousness" of the data point in the feature space; the higher the probability value, the more likely the data point is to be anomalous. The metadata risk value refers to the result calculated through the risk level assessment layer, representing the overall risk level of the metadata.

[0075] In an optional embodiment, obtaining the association matching relationship between the set of violation features of highly suspected files and the metadata risk value includes:

[0076] D1. Construct a mapping matrix between violation features and metadata dimensions, where the row vectors of the mapping matrix are the feature items in the violation feature set, and the column vectors of the mapping matrix are the key dimensions of the metadata, including creation timestamp, propagation node IP, and storage path level.

[0077] D2. Calculate the association strength value between each violation feature and each dimension of the metadata in the mapping matrix based on the cosine similarity algorithm. When the association strength value exceeds the preset association threshold, it is determined that there is a significant coupling relationship between the violation feature and the metadata dimension.

[0078] D3. Group and aggregate all coupling relationships according to feature categories and metadata dimensions to obtain an association matching relationship network with "violation feature clusters - metadata dimension groups" as the basic units;

[0079] D4. Obtain the association matching relationship between the set of violation features and the metadata risk value of highly suspected files based on the association matching relationship network.

[0080] It's important to note that metadata dimensions refer to several key aspects included in metadata, such as creation timestamp (the specific time the data was created), propagation node IPs (the IP addresses of nodes the data passes through during its propagation in the network), and storage path hierarchy (the location path of the data in the storage system). A mapping matrix is ​​used to represent the relationship between violation features and metadata dimensions. In this matrix, rows represent individual feature items in the violation feature set, and columns represent key dimensions of the metadata. Cosine similarity is an indicator that measures the degree of similarity between two vectors in a direction. It is used to calculate the similarity between two documents or data points. The value of cosine similarity ranges from -1 to 1; the closer the value is to 1, the more similar the two vectors are, and the closer the value is to -1, the less similar they are. A preset association threshold is a pre-defined value used to determine violations. The presence of a significant coupling relationship between violation features and metadata dimensions is considered significant when the calculated association strength value exceeds a threshold. Grouping aggregation refers to grouping violation features and metadata dimensions with similar characteristics and summarizing or analyzing the data within each group. It is performed according to feature categories and metadata dimensions to obtain clearer association matching relationships. The association matching relationship network is a network composed of multiple "violation feature clusters" and "metadata dimension groups" and the association relationships between them. In this network, each "violation feature cluster" contains a set of related violation features, each "metadata dimension group" contains a set of related metadata dimensions, and the association relationships between them indicate which violation features are significantly coupled with which metadata dimensions.

[0081] In an optional embodiment, the risk fit of the association matching relationship is calculated based on a preset multimodal fusion rule to obtain the multimodal risk coefficient of highly suspected documents, including:

[0082] E1. The multimodal fusion rules include feature contribution weight allocation and risk attenuation factor settings;

[0083] E2. Treat each "violation feature cluster - metadata dimension group" unit in the association matching relationship network as an independent evaluation node, extract the feature contribution weight and risk attenuation coefficient of the independent evaluation node, and perform a weighted sum of the feature contribution weight and risk attenuation coefficient to obtain the local risk fit of the independent evaluation node. Based on the association strength of the independent evaluation node, the local risk fit is used for global risk transmission to obtain the global risk fit of the association matching relationship network.

[0084] E3. Normalize the global risk fit to the 0-1 range to obtain the multimodal risk coefficient.

[0085] It should be noted that feature contribution weight refers to the magnitude of the contribution of a single feature to the overall risk; local risk fit refers to the risk fit of each independent assessment node by weighted summation of feature contribution and risk attenuation factor; correlation strength refers to the strength of the connection between independent assessment nodes and other nodes; global risk fit refers to the overall risk fit of the entire correlation matching network by weighted summation of the local risk fit of all independent assessment nodes according to correlation strength.

[0086] In an optional embodiment, the first violation suspicion score is corrected based on the multimodal risk coefficient and metadata risk value to obtain a second violation suspicion score, including:

[0087] F1. The multimodal risk coefficient and the metadata risk value are weighted and fused to obtain the fused risk value;

[0088] F2. Perform a nonlinear mapping on the fused risk value and the first violation suspicion score to obtain the violation suspicion mapping result;

[0089] F3. Based on the preset correction coefficient matrix, the violation suspicion mapping result is calibrated to obtain the calibrated second violation suspicion score. The element values ​​of the correction coefficient matrix are optimized in reverse according to the false positive rate and false negative rate of historical violation document detection cases.

[0090] It should be noted that weighted fusion refers to combining multimodal risk coefficients and metadata risk values ​​according to their respective importance or weights, resulting in a comprehensive risk assessment value. Nonlinear mapping is used to nonlinearly process the relationship between the fused risk value and the first violation suspicion score, making the result more in line with the actual violation risk assessment needs. The correction coefficient matrix is ​​a parameter matrix used to calibrate the violation suspicion mapping result. The element values ​​of the correction coefficient matrix are iteratively optimized according to the actual risk prediction accuracy under different feature combinations. When the association combination of a certain type of violation feature and metadata dimension has a high misjudgment in historical detection, the corresponding correction coefficient will be lowered, and vice versa.

[0091] In an optional embodiment, enterprise risks and employee behavior are analyzed based on compliance determination results to achieve enterprise compliance management, including:

[0092] G1. Based on the compliance assessment results, obtain the violation characteristics, frequency of occurrence, departments involved, and related employees of the violation documents;

[0093] G2. Obtain the frequency of file operations and the number of times non-compliant files are involved by related employees, and provide key compliance training to employees who frequently access high-risk files;

[0094] G3. Based on the propagation trajectory and storage path of the illegal documents, trace the risk spread nodes, implement hierarchical control of the risk spread nodes, and prioritize blocking information interaction between core business systems and high-risk nodes;

[0095] G4. Interface the compliance assessment results with the enterprise human resources management system to obtain automatic marking, isolation and early warning notifications of non-compliant documents. Execute risk management strategies based on the preset workflow engine. Risk management strategies include sending violation warnings to the employees involved, pushing risk reports to the compliance management department, and imposing access restrictions on high-risk documents.

[0096] It should be noted that the frequency of file operations and the number of times the offending file was involved are key quantitative indicators for assessing the risk of individual employee behavior. Combining these two indicators (e.g., calculating the "violation rate" or identifying employees with "high operation frequency and high violation involvement") can accurately screen out individuals with high-risk behaviors from all employees. Tiered control refers to taking different levels of control measures based on the importance and risk level of nodes. For example, strict measures such as priority blocking are taken for core business systems and high-risk nodes to immediately terminate their information interaction with the outside world and prevent the risk from spreading to core business. Milder measures such as monitoring and auditing or traffic restriction are taken for general risk nodes. The workflow engine is a software module that can predefine and configure business processes. It runs according to the logic that if event A occurs, actions B and C will be automatically executed. For example, if the system determines that a file is a high-risk violation and the associated employee belongs to the sales department, the risk management strategy will be automatically executed.

[0097] Example 3, as Figure 2 As shown, the enterprise compliance management system based on violation document detection proposed in this invention, and its applicable enterprise compliance management method based on violation document detection, include:

[0098] Data acquisition unit 1 is used to acquire images of the commercial document to be inspected in order to obtain image data of the commercial document to be inspected, and to perform text parsing on the image data based on image recognition technology to obtain text content;

[0099] The scoring calculation unit 2 is used to detect illegal elements in the text content based on the pre-trained commercial violation feature recognition model to obtain the set of illegal features of the commercial document to be detected, and to calculate the first violation suspicion score of the commercial document to be detected based on the commercial risk weight and frequency of occurrence of each feature in the set of illegal features.

[0100] File filtering unit 3 is used to filter out highly suspected files based on the first suspected violation score and obtain metadata such as the creation log, propagation trajectory and storage path of the highly suspected files;

[0101] Risk assessment unit 4 is used to assess the risk of metadata based on a pre-trained abnormal metadata analysis model to obtain metadata risk values, acquire the correlation matching relationship between the violation feature set of highly suspected files and metadata risk values, and calculate the risk fit of the correlation matching relationship based on preset multimodal fusion rules to obtain the multimodal risk coefficient of highly suspected files.

[0102] The compliance management unit 5 is used to correct the first violation suspicion score based on the multimodal risk coefficient and metadata risk value to obtain a second violation suspicion score. Based on the second violation suspicion score, it determines whether the business document to be inspected is compliant to obtain a compliance judgment result. Based on the compliance judgment result, it analyzes enterprise risks and employee behavior to achieve enterprise compliance management.

[0103] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited thereto. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of the present invention.

Claims

1. A corporate compliance management method based on the detection of non-compliant documents, characterized in that, include: The business document to be inspected is image-captured to obtain image data of the business document to be inspected. The image data is then parsed using image recognition technology to obtain the text content. The text content is detected for violations based on a pre-trained commercial violation feature recognition model to obtain a set of violation features of the commercial document to be detected. The first violation suspicion score of the commercial document to be detected is calculated based on the commercial risk weight and frequency of occurrence of each feature in the set of violation features. Based on the first violation suspicion score, highly suspected files are selected, and the creation log, propagation trajectory, and storage path metadata of the highly suspected files are obtained; The metadata is risk-assessed based on a pre-trained abnormal metadata analysis model to obtain a metadata risk value. The association matching relationship between the violation feature set of the high-suspect file and the metadata risk value is obtained. The step of obtaining the association matching relationship includes constructing a mapping matrix between violation features and metadata dimensions. The row vector of the mapping matrix is ​​each feature item in the violation feature set, and the column vector of the mapping matrix is ​​the key dimensions of the metadata, including creation timestamp, propagation node IP, and storage path level. The association strength value between each violation feature and each dimension of the metadata in the mapping matrix is ​​calculated based on the cosine similarity algorithm. When the association strength value exceeds the preset association threshold, it is determined that there is a significant coupling relationship between the violation feature and the metadata dimension. All coupling relationships are grouped and aggregated according to feature categories and metadata dimensions to obtain an association matching relationship network with violation feature clusters and metadata dimension groups as basic units; Based on the aforementioned association matching network, the association matching relationship between the set of violation features and the metadata risk value of the highly suspected files is obtained; The risk fit of the association matching relationship is calculated based on the preset multimodal fusion rules to obtain the multimodal risk coefficient of the highly suspected file. The multimodal fusion rules include feature contribution weight allocation and risk attenuation factor setting. Each violation feature cluster-metadata dimension group unit in the association matching relationship network is taken as an independent evaluation node. The feature contribution weight and risk attenuation coefficient of the independent evaluation node are extracted. The feature contribution weight and risk attenuation coefficient are weighted and summed to obtain the local risk fit of the independent evaluation node. Based on the association strength of the independent evaluation node, the local risk fit is used for global risk transmission to obtain the global risk fit of the association matching relationship network. The global risk fit is normalized to the 0-1 range to obtain the multimodal risk coefficient; The first violation suspicion score is corrected based on the multimodal risk coefficient and metadata risk value to obtain a second violation suspicion score. The compliance of the business document to be detected is determined based on the second violation suspicion score to obtain a compliance judgment result. The enterprise risk and employee behavior are analyzed based on the compliance judgment result to achieve enterprise compliance management.

2. The enterprise compliance management method based on violation document detection according to claim 1, characterized in that, The business violation feature identification model includes a text feature extraction layer built on a bidirectional long short-term memory network (BiLSTM) and an attention mechanism, and a violation element classification layer composed of multiple fully connected networks. The text feature extraction layer uses BiLSTM to perform contextual semantic modeling of the text sequence to capture long-distance dependencies and assigns higher weights to key semantic segments based on the attention mechanism to enhance the representation ability of violation features. The violation element classification layer performs multi-label classification of preset violation element categories based on the extracted text features to output the existence probability and confidence of each element, thereby constructing a complete set of violation features.

3. The enterprise compliance management method based on violation document detection according to claim 2, characterized in that, The text content is analyzed using a pre-trained business violation feature recognition model to detect violation elements, resulting in a set of violation features for the business document to be detected, including: The text content is divided into several semantic units, wherein each semantic unit contains a continuous sentence or paragraph; The semantic unit is input into the business violation feature recognition model, and the deep semantic vector of the semantic unit is obtained based on the text feature extraction layer. The violation element classification layer calculates the existence probability and confidence of each violation element category based on the deep semantic vector. Elements whose existence probability is greater than a preset threshold and whose confidence level meets the standard are taken as valid violation features. The valid violation features of all the semantic units are integrated to obtain the violation feature set of the commercial document to be detected. The occurrence position and frequency distribution of each feature in different semantic units in the violation feature set are recorded.

4. The enterprise compliance management method based on violation document detection according to claim 3, characterized in that, The first violation suspicion score of the business document to be detected is calculated based on the business risk weight and frequency of occurrence of each feature in the violation feature set, including: Determine the business risk weight of each violation feature in the business document to be detected, and dynamically adjust the business risk weight based on the importance of the violation features in the industry sector to obtain the final business risk weight; Obtain the frequency of occurrence of each feature in the text content from the set of violation features; The product of the business risk weights and the frequency of occurrence is weighted and then normalized to obtain the first violation suspicion score.

5. The enterprise compliance management method based on violation document detection according to claim 4, characterized in that, The abnormal metadata analysis model includes a metadata feature extraction module, a time-series anomaly detection layer, and a risk level assessment layer. The metadata feature extraction module performs structured feature extraction on the metadata to obtain a metadata feature vector containing time-series features, network behavior features, and storage attribute features. The time-series anomaly detection layer uses a Long Short-Term Memory (LSTM) network to predict the trends of the time-series features to obtain abnormal time nodes. Based on these abnormal time nodes and the Isolation Forest algorithm, it performs outlier detection on the network behavior features and storage attribute features to obtain a preliminary anomaly probability. The risk level assessment layer compares the preliminary anomaly probability output by the time-series anomaly detection layer with a preset metadata risk threshold. Based on the comparison result and the risk contribution weights of each dimension of the metadata feature vector, a weighted summation is performed to obtain the final metadata risk value.

6. The enterprise compliance management method based on violation document detection according to claim 5, characterized in that, The first violation suspicion score is revised based on the multimodal risk coefficient and metadata risk value to obtain the second violation suspicion score, including: The multimodal risk coefficient and the metadata risk value are weighted and fused to obtain a fused risk value; A nonlinear mapping is performed on the fused risk value and the first violation suspicion score to obtain the violation suspicion mapping result; The violation suspicion mapping result is calibrated based on a preset correction coefficient matrix to obtain a calibrated second violation suspicion score. The element values ​​of the correction coefficient matrix are optimized in reverse based on the false positive rate and false negative rate of historical violation document detection cases.

7. The enterprise compliance management method based on violation document detection according to claim 6, characterized in that, Analyzing corporate risks and employee behavior based on compliance assessment results to achieve corporate compliance management, including: Based on the compliance assessment results, obtain the violation characteristics, frequency of occurrence, departments involved, and associated employees of the violation documents; Obtain the frequency of file operations and the number of times non-compliant files are involved for the associated employees, and provide key compliance training to employees who frequently access high-risk files; Based on the propagation trajectory and storage path of the illegal files, the risk spread nodes are traced, and the risk spread nodes are subject to hierarchical control, prioritizing the blocking of information interaction between core business systems and high-risk nodes; The compliance assessment results are interfaced with the enterprise human resources management system to obtain automatic marking, isolation, and early warning notifications for non-compliant documents. Risk management strategies are executed based on a preset workflow engine. These risk management strategies include sending violation warnings to the employees involved, pushing risk reports to the compliance management department, and imposing access restrictions on high-risk documents.

8. A corporate compliance management system based on violation document detection, applicable to the corporate compliance management method based on violation document detection as described in any one of claims 1-7, characterized in that, include: The data acquisition unit (1) is used to acquire images of the commercial document to be detected in order to obtain image data of the commercial document to be detected, and to perform text parsing on the image data based on image recognition technology to obtain text content; The scoring calculation unit (2) is used to detect illegal elements in the text content based on the pre-trained commercial violation feature recognition model to obtain the set of illegal features of the commercial document to be detected, and to calculate the first violation suspicion score of the commercial document to be detected based on the commercial risk weight and frequency of occurrence of each feature in the set of illegal features. The file filtering unit (3) is used to filter out highly suspected files based on the first violation suspicion score and obtain the metadata of the creation log, propagation trajectory and storage path of the highly suspected files; The risk assessment unit (4) is used to assess the risk of the metadata based on a pre-trained abnormal metadata analysis model to obtain the metadata risk value, obtain the association matching relationship between the violation feature set of the highly suspected file and the metadata risk value, and calculate the risk fit of the association matching relationship based on the preset multimodal fusion rules to obtain the multimodal risk coefficient of the highly suspected file. The compliance management unit (5) is used to correct the first violation suspicion score based on the multimodal risk coefficient and metadata risk value to obtain a second violation suspicion score, determine whether the business document to be detected is compliant based on the second violation suspicion score to obtain a compliance judgment result, and analyze enterprise risks and employee behavior based on the compliance judgment result to achieve enterprise compliance management.

Images