A large model-based risk discovery and early warning method and system

Abstract

This invention proposes a risk discovery method and apparatus based on large-scale model rule self-generation, comprising the following steps: First, initial risk features described in natural language are input into a pre-trained large-scale language model to generate executable risk judgment rules; second, the generated rules are used to perform semantic analysis and scoring on real-time text intelligence; next, a dynamic risk profile is established for each involved individual, and an individual comprehensive risk score is calculated; then, high-risk information is submitted for manual verification, generating structured case summaries which are stored in a knowledge base; finally, based on the case summaries in the knowledge base, a retrieval-enhanced generation mechanism is used to form a closed-loop feedback and self-iterative optimization. This invention, through deep semantic understanding, rule self-iteration, and dynamic quantitative evaluation, achieves intelligent processing throughout the entire process from rule generation and individual assessment to task backtracking optimization, significantly improving the intelligence level and efficiency of public safety early warning and intervention.

Description

Technical Field

[0001] This invention relates to the field of public safety intelligence analysis technology, specifically to a risk discovery and early warning method and system based on a large model. Background Technology

[0002] As the global public safety situation becomes increasingly complex, traditional intelligence analysis models relying on human experience are no longer sufficient to meet the needs of "early detection, early warning, and early response" of potential risks. In recent years, public safety departments in various countries have successively deployed risk mining systems based on keyword matching or statistical models, attempting to quickly sift out high-risk clues from massive amounts of emergency response records, online public opinion, and social media texts. However, these existing technologies have revealed the following significant shortcomings in practical applications, severely limiting the accuracy and real-time performance of risk identification: 1. Superficial semantic understanding. Keyword matching can only perform literal comparisons and cannot capture synonyms, near-synonyms, metaphors, and colloquial expressions in natural language. For example, the system can hit standard medical terms such as "mental illness" and "depression," but it cannot understand the differences in the level of danger implied by local slang such as "martial madman" and "literary madman," resulting in high-risk individuals being missed. 2. Loss of contextual information. Risk assessment is highly dependent on contextual qualifiers. Taking "arbitrarily assaulting a passerby" as an example, the word "arbitrarily" reveals the unprovoked and unpredictable nature of the behavior and is a core semantic element for assessing social harm. Existing technology only matches "assault," ignoring the "arbitrary" context, resulting in an underestimation of severity. 3. Lack of causal logic. Textual intelligence often describes dynamic evolution processes, such as "after an argument, several people returned armed." Traditional solutions cannot establish a causal chain of "argument → escalation → armed confrontation," and can only treat each event separately, missing the window of opportunity to intervene before the situation deteriorates; 4. The rules are static and outdated. Risk language is constantly evolving, with new words, codes, and abbreviations emerging one after another. Static keyword databases require manual maintenance and have long update cycles, which can lead to the system "not understanding" new types of risks and thus missing reports, or "overthinking" the new meanings of old words and thus issuing false reports. 5. Limited evaluation dimensions. Existing technologies are mostly based on the simple accumulation of word frequency or event count, lacking comprehensive quantitative methods such as behavior intensity, time decay, duplicate alarm deduplication, and frequency acceleration. This makes it difficult to accurately sort millions of entities, and the assessment personnel still need to manually screen them, resulting in a huge workload. 6. Lack of closed-loop optimization. Traditional systems are "deployed once and used for a long time." First-line verification results cannot be fed back into the model, leading to the recurrence of error patterns and the inability to accumulate correct experience. As a result, system performance actually declines over time.

[0003] To address the aforementioned pain points, the industry has attempted to improve the situation by introducing small semantic models or rule engines. However, these efforts are still limited by model capacity, feature engineering, and the cost of manual rule maintenance, preventing the formation of a closed-loop system of "self-generation-self-evaluation-self-iteration." Therefore, there is an urgent need for a new technical solution that can deeply understand natural language, automatically extract risk rules, dynamically quantify and evaluate them, and continuously self-optimize, in order to significantly improve the intelligence level of public safety risk discovery. Summary of the Invention

[0004] The purpose of this invention is to provide a risk discovery and early warning method and system based on a large model, to address the problems mentioned in the background section regarding existing technologies in public safety intelligence analysis, such as reliance on human experience, delayed response, and insufficient coverage. This invention addresses the problems of this method.

[0005] To achieve the above objectives, the present invention provides the following technical solution: A risk detection and early warning method based on a large model includes: Step S1, Rule Generation: Input the initial risk features described in natural language into the pre-trained large language model, and the large language model outputs at least one executable risk determination rule, wherein the risk determination rule is a composite condition that includes behavioral patterns, semantic combinations and / or logical relationships. Step S2, Semantic Recognition: The real-time text intelligence is fed into the large language model, which performs semantic parsing according to the risk judgment rules, identifies the risk type, extracts the target entity, and gives a single event severity score. Step S3, Risk Profile: Using the unique entity identifier as an index, establish a dynamic risk profile, and calculate the individual comprehensive risk score based on the severity score of the single event, the event time sequence distribution and frequency change factor, by introducing time decay weight and repeated alarm weight. Step S4, Closed-loop feedback: Submit the high-ranking risk profile for manual verification, and send the verification results and reasons back to the system. The large language model automatically generates a structured case summary and writes it into the knowledge base. For cases that are confirmed to be false alarms, automatically extract the keywords or semantic features that caused the false alarms, and use them as negative samples in subsequent rule iteration steps to suppress similar misjudgments. Step S5, Rule Iteration: When adding or updating risk assessment rules, the system adopts the retrieval enhancement generation RAG mechanism to recall relevant case summaries from the knowledge base as context, and drives the large language model to generate or optimize risk assessment rules again, thereby forming a rule self-iteration closed loop.

[0006] Furthermore, the initial risk characteristics are derived from policy documents, laws and regulations, expert experience, or a combination thereof, and are then assembled using a prompt template and input into the large language model.

[0007] Furthermore, risk assessment rules are stored in the rule base in at least one of the following forms: pseudocode, structured query statements, or graphical logic trees.

[0008] Furthermore, individual comprehensive risk score Calculations shall be performed according to the following rules:

[0009] in, The frequency variation factor is calculated through regression analysis of historical event time intervals; The baseline score for the severity of a single incident; The weight for repeated alarms is used to adjust the contribution of repeated events within a short period of time. This is a time-lapse weight, used to reflect the higher impact of recent events on the risk score.

[0010] Furthermore, the weight of repeated alarms Calculated using the following formula:

[0011] in, Let k be the time interval between the kth police incident involving person p and the previous k-1 police incident.

[0012] Furthermore, time decay weights It employs an arctangent decay curve and supports adjustable half-life parameter K and reference number of days. ,and Calculated using the following formula:

[0013] in, for Number of days from the current time , These are adjustable or fitted empirical parameters.

[0014] A risk detection system based on rule self-generation from a large language model includes: The rule generation module is used to generate risk assessment rules based on initial risk characteristics; The risk identification and extraction module is used for semantic parsing of text intelligence, risk type identification, extraction of relevant information, and event scoring. The profile building and sorting module is used to calculate an individual's comprehensive risk score and generate a risk assessment profile; The feedback processing module is used to receive manual verification feedback and generate case summaries; The knowledge base management module is used to store case summaries and risk rules; The rule optimization module is used to optimize or generate new rules based on knowledge base content through a retrieval-enhanced generation mechanism. The system includes a management unit, a rule base, a knowledge base, computing nodes, and a result push interface. These modules are connected via a bus or network communication to realize a risk discovery and early warning method based on a large model.

[0015] Furthermore, the rule generation module and the rule iteration module share the same large language model inference engine, and the inference engine is deployed in a containerized microservice manner, supporting elastic scaling; the large language model and the knowledge base are deployed on a federated learning framework, enabling multiple regional nodes to share rule update gradients or encrypted case vectors without data leaving the domain.

[0016] Furthermore, the closed-loop feedback module includes a human-machine collaborative interface, which allows inspectors to confirm, correct, or reject risk warnings with a single click and write back correction labels.

[0017] Furthermore, the results push interface supports connecting high-value risk profiles to external police platforms or city brain systems via RESTful APIs, message queues, or blockchain oracles.

[0018] Compared with the prior art, the beneficial effects of the present invention are: (1) Significant improvement in recognition accuracy. By leveraging the deep semantic capabilities of large language models, "keyword matching" is upgraded to "contextual understanding", which can accurately analyze slang, metaphors, causal chains and emotional coloring, significantly reducing false negatives and false positives.

[0019] (2) Rules are self-generated and self-iterated. No manual maintenance of the keyword library is required. The system automatically accumulates expert experience through "historical cases → large model → executable rules" and continuously optimizes it with the help of verification feedback, so as to realize the synchronous evolution of risk patterns and model evolution.

[0020] (3) Multidimensional dynamic quantitative ranking. A four-dimensional scoring formula of "intensity-frequency-timeliness-repeated alarm" is introduced to update individual risk in seconds and automatically generate an interpretable Top-N high-risk list, directly focusing resources for disposal.

[0021] (4) Closed-loop feedback to accumulate knowledge. The verification results are automatically fed back to generate structured case summaries, build a searchable knowledge base, support the rapid reuse of successful / failed experiences by the RAG mechanism, and form a positive cycle of "the more you use it, the smarter you become".

[0022] (5) Reduced resource consumption and costs. Reduced invalid warnings, allowing analysts to shift from "massive screening of clues" to "precise confirmation", saving manpower; at the same time, the cloud-edge collaborative architecture reduces storage and computing power redundancy.

[0023] (6) Enhanced scenario adaptation and compliance. Supports multiple languages, federated learning, trusted execution of TEE, and chip-level edge deployment, which not only meets the compliance requirements of cross-regional data not leaving the domain, but can also run independently in offline environments, making it suitable for various scenarios such as public safety, security for major events, and enterprise internal control. Attached Figure Description

[0024] Figure 1 This is a flowchart of a risk discovery and early warning method based on a large model according to the present invention; Figure 2 This is a structural block diagram of a risk detection and early warning system based on a multimodal large model according to the present invention; Figure 3 This is a schematic diagram illustrating the configuration, process arrangement, and testing of an intelligent agent template for a risk detection and early warning system based on a multimodal large model according to the present invention. Figure 4 This is a common processing flow for a risk discovery and early warning method based on a large model, as described in this invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Please see Figure 2 This invention provides a technical solution: a risk detection system based on the self-generation of rules from a large language model, comprising: The rule generation module is used to generate risk assessment rules based on initial risk characteristics; The risk identification and extraction module is used for semantic parsing of text intelligence, risk type identification, extraction of relevant information, and event scoring. The profile building and sorting module is used to calculate an individual's comprehensive risk score and generate a risk assessment profile; The feedback processing module is used to receive manual verification feedback and generate case summaries; The knowledge base management module is used to store case summaries and risk rules; The rule optimization module is used to optimize or generate new rules based on knowledge base content through a retrieval-enhanced generation mechanism. It also includes a prompt management unit, a rule base, a knowledge base, computing nodes, and a result push interface, all of which are connected via a bus or network communication.

[0027] Furthermore, the rule generation module and the rule iteration module share the same large language model inference engine, which is deployed as a containerized microservice, supporting elastic scaling. The large language model and the knowledge base are deployed on a federated learning framework, enabling multiple regional nodes to share rule update gradients or encrypted case vectors without data leaving their respective domains. The closed-loop feedback module includes a human-machine collaboration interface, which allows inspectors to confirm, correct, or reject risk warnings with a single click and write back correction tags.

[0028] The results push interface supports connecting high-value risk profiles to external police platforms or city brain systems via RESTful APIs, message queues, or blockchain oracles.

[0029] Please see Figure 1 The implementation method of the present invention is as follows: Step 1: Generate large-scale model rules based on initial risk characteristics This step aims to transform the domain knowledge of human experts into machine-executable, refined data mining rules. First, the system receives pre-defined risk behavior characteristics and judgment rules. These characteristics may originate from authoritative policy documents, legal provisions, or be summarized by domain experts based on practical experience. These initial characteristics are described using high-level, generalized natural language. Subsequently, these pre-defined risk behavior characteristics are constructed into structured large-scale model instructions (i.e., Prompts) and input into a pre-trained large-scale language model.

[0030] Based on received instructions, the large language model autonomously analyzes and generates a series of specific and actionable risk assessment rules. These rules are no longer simple keywords, but complex conditions that describe specific behavioral patterns, logical relationships, or semantic combinations. For example, based on the initial characteristics of "abnormal behavior," the model may generate multiple detailed rules such as "wandering aimlessly in inappropriate places" and "incoherent speech and emotional agitation." This process achieves automated generation from abstract concepts to concrete rules.

[0031] Step 2: Risk identification and information extraction based on generation rules and the semantic capabilities of large models

[0032] This step utilizes the rules generated in the previous step to perform in-depth analysis and information extraction on massive amounts of textual intelligence (such as emergency call records) through semantic analysis. The system inputs the text entries to be analyzed one by one into the large language model in a loop. The large language model, combined with the generated risk assessment rules, leverages its deep semantic understanding capabilities to analyze each text and perform the following operations: Identify specific risk types: Analyze whether the text content matches the rule types in the rule base to determine the risk category to which the event belongs.

[0033] Extracting information of involved persons: Automatically identify and extract key identity information (such as name, ID card number and other unique identifiers), related information (such as contact information, online account and other profile elements) of involved persons from the text.

[0034] The severity of the risk event is scored based on details such as the intensity of the behavior, consequences, and whether tools were used, as described in the text. The severity of the event is assessed and mapped to a standardized numerical score, which serves as the "base score for a single event" (e.g., severe: 3 points, moderate: 2 points, low: 1 point).

[0035] Step 3: Constructing Risk Assessment Profiles and Dynamic Quantitative Ranking

[0036] This step aims to comprehensively and dynamically quantify the risk of each identified incident, enabling precise prioritization and focus. The system establishes a dynamic risk assessment profile for each uniquely identified individual. The core of this profile is their "personal comprehensive risk score," which is calculated by accumulating all historical risk events associated with that individual. The calculation method is as follows:

[0037] in: — The set of identification alerts for the person involved, p, totaling n; —Frequency variation factor: This factor analyzes the time intervals between each risk event for individual p to determine if there is an accelerating trend in the frequency of their behavior. Individuals with increasing frequency have a higher weight, and vice versa. The calculation method involves sorting events by time to obtain the interval between adjacent alarms. , for interval For linear regression, the slope This indicates the trend of the interval changing with the alarm sequence number. The shorter the alarm interval and the higher the frequency, the greater the risk.

[0038] — The baseline score for the severity level of a single event (corresponding to "severe", "moderate" and "lower") is used to reflect the static risk background of an individual.

[0039] — Duplicate alarm weighting: For multiple records related to the same cause that occur within a very short time window (e.g., 24 hours), the system will identify them as an independent event cluster and assign very low weights to subsequent records to avoid inflated risk scores due to duplicate reports.

[0040]

[0041] in Let k be the time interval between the kth police incident involving person p and the previous k-1 police incident.

[0042] — The time-decrease weight reflects the "recency effect," meaning that the more recent an event is, the greater its impact on the current risk assessment.

[0043]

[0044] in for Number of days from the current time =0.06、 =100 These are adjustable or fitted empirical parameters.

[0045] Step 4: Manual verification and feedback, and knowledge base accumulation.

[0046] This step aims to combine the system's intelligent analysis with real-world verification results, forming a closed-loop feedback and learning mechanism. The system will distribute high-ranking risk information from the risk assessment profile to relevant personnel for verification or assessment in the form of early warnings or analysis reports. Verifying personnel will then input the final verification results (e.g., confirming the existence of a risk, eliminating the risk, or identifying it as a false alarm) along with detailed explanations back into the system as feedback.

[0047] After receiving the feedback, the system again invokes the large language model to summarize, refine, and describe the complete "early warning-verification-feedback" process, generating a structured case summary. This summary includes the original text features that triggered the warning, the logic behind the system's judgment, and the final conclusions and basis for manual verification. This complete case summary is then stored in a dedicated, searchable knowledge base.

[0048] Step 5: Rule self-generation and iterative optimization based on knowledge base

[0049] This step is crucial for enabling the self-evolution and continuous performance improvement of the method of this invention. When the system needs to generate new risk mining rules or optimize existing rules, it will activate the Retrieval-Augmented Generation (RAG) mechanism. First, based on the optimization goal (such as "improving the ability to identify a certain type of risk pattern"), the system searches the knowledge base established in step four to find all relevant historical successful and failed cases. Then, these retrieved case summaries with clear verification results are provided as rich, practice-tested contextual information, along with the initial instructions, to the large language model.

[0050] After "learning" from these real-world cases, large language models can gain a deeper understanding of the subtle differences between various risk patterns, thereby generating new, more accurate, and robust risk assessment rules, or supplementing, revising, and refining existing rules. For example, the model can learn new risk behavior codes or camouflage techniques from successful cases and automatically add them to the rule base; at the same time, it can also summarize the characteristics that lead to misjudgments from failed cases (false alarms), thereby adding stricter constraints to relevant rules.

[0051] A common specific processing flow is as follows: Figure 3 and Figure 4 As shown.

[0052] By repeating the above five steps, the method of this invention can form an intelligent closed loop of automatic rule generation, application, verification, feedback, and iteration, thereby continuously improving the accuracy and efficiency of risk discovery in a constantly changing real-world environment.

[0053] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A risk detection and early warning method based on a large model, characterized in that, include: Step S1, Rule Generation: Input the initial risk features described in natural language into the pre-trained large language model, and the large language model outputs at least one executable risk determination rule, wherein the risk determination rule is a composite condition that includes behavioral patterns, semantic combinations and / or logical relationships. Step S2, Semantic Recognition: The real-time text intelligence is fed into the large language model, which performs semantic parsing according to the risk judgment rules, identifies the risk type, extracts the target entity, and gives a single event severity score. Step S3, Risk Profile: Using the unique entity identifier as an index, establish a dynamic risk profile, and calculate the individual comprehensive risk score based on the severity score of the single event, the event time sequence distribution and frequency change factor, by introducing time decay weight and repeated alarm weight. Step S4, Closed-loop feedback: Submit the high-ranking risk profile for manual verification, and send the verification results and reasons back to the system. The large language model automatically generates a structured case summary and writes it into the knowledge base. For cases that are confirmed to be false alarms, automatically extract the keywords or semantic features that caused the false alarms, and use them as negative samples in subsequent rule iteration steps to suppress similar misjudgments. Step S5, Rule Iteration: When adding or updating risk assessment rules, the system adopts the retrieval enhancement generation RAG mechanism to recall relevant case summaries from the knowledge base as context, and drives the large language model to generate or optimize risk assessment rules again, thereby forming a rule self-iteration closed loop. The initial risk characteristics are derived from policy documents, laws and regulations, expert experience, or a combination thereof, and are then concatenated using a prompt template and input into the large language model. The risk assessment rules are stored in the rule base in at least one of the following forms: pseudocode, structured query statements, or graphical logic trees. The individual comprehensive risk score Calculations shall be performed according to the following rules: ； in, The frequency variation factor is calculated through regression analysis of historical event time intervals; The baseline score for the severity of a single incident; The weight for repeated alarms is used to adjust the contribution of repeated events within a short period of time. This is a time-lapse weight, used to reflect the higher impact of recent events on the risk score; The weight of repeated alarms Calculated using the following formula: ； in, Let k be the time interval between the kth police incident involving person p and the previous k-1 police incident. The time decay weight It employs an arctangent decay curve and supports adjustable half-life parameter K and reference number of days. ,and Calculated using the following formula: ； in, for Number of days from the current time , These are adjustable or fitted empirical parameters.

2. A risk detection system based on the self-generation of rules from a large language model, characterized in that, include: The rule generation module is used to generate risk assessment rules based on initial risk characteristics; The risk identification and extraction module is used for semantic parsing of text intelligence, risk type identification, extraction of relevant information, and event scoring. The profile building and sorting module is used to calculate an individual's comprehensive risk score and generate a risk assessment profile; The closed-loop feedback module is used to receive feedback from manual verification and generate case summaries; The knowledge base management module is used to store case summaries and risk rules; The rule optimization module is used to optimize or generate new rules based on knowledge base content through a retrieval-enhanced generation mechanism. The system includes a management unit, a rule base, a knowledge base, computing nodes, and a result push interface. These modules are connected via a bus or network communication to realize the risk discovery and early warning method based on a large model as described in claim 1. The rule generation module and the rule iteration module share the same large language model inference engine, and the inference engine is deployed in a containerized microservice manner, supporting elastic scaling. The large language model and the knowledge base are deployed in a federated learning framework, enabling multiple regional nodes to share rule update gradients or encrypted case vectors without data leaving the domain.

3. The risk detection system based on the self-generation of rules from a large language model according to claim 2, characterized in that, The closed-loop feedback module includes a human-machine collaborative interface, which allows inspectors to confirm, correct, or reject risk warnings with one click and write back correction labels.

4. The risk detection system based on the self-generation of rules from a large language model according to claim 2, characterized in that, The result push interface supports connecting high-value risk profiles to external police platforms or city brain systems via RESTful APIs, message queues, or blockchain oracles.

Images