Method and system for intelligent attribution of process bottlenecks fusing multi-dimensional risks and incidents

Abstract

The present application belongs to the field of computer data processing, and particularly relates to a process bottleneck intelligent attribution method and system fusing multi-dimensional risks and emergencies, aiming to solve the problems that traditional process mining cannot explain bottleneck causes and that risk and process efficiency analysis is fragmented. The present application comprises: generating a fusion data set by fusing process execution data and multi-dimensional risk data; calculating performance indicators of each link based on the process execution data, identifying bottleneck links; monitoring the performance indicators of the bottleneck links, detecting emergencies and generating an event feature vector, extracting corresponding multi-dimensional risk data from the fusion data set to construct a risk vector; inputting the risk vector and the event feature vector into an attribution model to determine the quantitative contribution of each input feature to the performance indicators of the bottleneck links, which is output as an attribution result. The present application can improve business approval decision efficiency and accuracy, and enhance dynamic risk identification and response capabilities.

Description

Technical Field

[0001] This invention belongs to the field of computer data processing, and specifically relates to an intelligent attribution method and system for process bottlenecks that integrates multidimensional risks and emergencies. Background Technology

[0002] In modern service industries such as finance, insurance, and government affairs, the efficiency and risk control of business processes are crucial requirements for enterprises to ensure operational quality and enhance core competitiveness. Process mining technology, as a key tool for analyzing business processes, is widely used in these fields. By analyzing system-generated event logs, it reconstructs the actual process execution trajectory, thereby identifying bottlenecks in the process—those exhibiting the longest average processing time or the highest concentration of resource waiting. However, traditional process mining techniques have significant limitations in their analytical capabilities. They typically only reveal "where the bottleneck is," but cannot deeply explain "why the bottleneck occurs." Their analysis is descriptive rather than diagnostic, lacking insight into the correlation between deep business logic and risk characteristics.

[0003] Meanwhile, independently deployed risk management systems across various industries (such as credit risk control systems in the financial sector and anti-fraud systems in the insurance sector) can achieve micro-risk assessments of individual business cases, such as judging the default risk of a loan through credit scoring models or identifying fraudulent activity in a claim through rule engines. However, these systems generally lack a holistic process perspective, focusing only on the risk attributes of individual cases and failing to reveal the systemic impact on the efficiency of the entire process when cases with specific risk characteristics occur in clusters. For example, when the proportion of high-risk credit applications surges within a certain period, the risk management system can only mark risky cases one by one, but cannot predict that this phenomenon will lead to backlogs in the approval process, extended overall process time, or quantify the correlation between risk concentration and process bottlenecks.

[0004] This reveals significant technical pain points in existing technologies: process efficiency analysis (relying on process mining) and business risk analysis (relying on independent risk control systems) are disconnected. Their data are not integrated, and their analytical logic is not linked, making it impossible to establish a clear causal chain from risk factors to process bottlenecks. More importantly, most existing technologies are based on the assumption that the business system is in a steady state, lacking the ability to model and learn from the impact of "unexpected events" such as market changes and policy adjustments. This leads to delayed decision-making and missed opportunities to learn and optimize from dynamic changes.

[0005] In summary, breaking down data silos between process efficiency data, multidimensional risk data, and dynamic event data, and achieving effective integration and collaborative analysis of these three types of data, in order to build a technical solution that can automatically locate, accurately diagnose, and quantitatively trace process bottlenecks, has become a key technical challenge that urgently needs to be addressed in this field. Summary of the Invention

[0006] To address the aforementioned problems in existing technologies, namely the inability of traditional process mining to explain the causes of bottlenecks and the disconnect between risk analysis and process efficiency analysis, this invention provides an intelligent process bottleneck attribution method that integrates multidimensional risks and unexpected events, comprising the following steps:

[0007] Collect process execution data and multidimensional risk data from business processes, associate them with common identifiers and align them over time to form a fused dataset;

[0008] Calculate performance metrics for each stage of the approval process based on process execution data to identify bottlenecks;

[0009] Monitor one or more performance indicators of the bottleneck link to detect sudden events and generate event feature vectors;

[0010] Record the common identifiers corresponding to the risk characteristics that affect performance indicators during the event, extract the corresponding multidimensional risk data from the fused dataset, and construct a risk vector.

[0011] The risk vector and event feature vector are concatenated and input into a preloaded attribution model to determine the quantitative contribution of one or more input features from the event feature vector and the risk vector to the performance index of the bottleneck link, and the result is output as the attribution result.

[0012] In some preferred embodiments, the process execution data includes an activity name and a timestamp, and the time alignment is achieved through instant connection technology, specifically including:

[0013] For the start time of any activity event in the process execution data, find the risk snapshot record in the multidimensional risk data that matches the common identifier of the activity event and whose timestamp is no later than the start time of the activity event and is the closest in time.

[0014] Associate the risk snapshot records with the activity events.

[0015] In some preferred embodiments, the performance indicators include at least one of the average processing time, waiting time, and resource utilization rate of each stage; the bottleneck identification stage includes:

[0016] Bottleneck candidates for each stage are determined using at least one preset criterion, which includes:

[0017] Absolute duration criterion: The stage with the longest average processing time is listed as a candidate bottleneck;

[0018] Relative contribution criterion: Steps whose average processing time accounts for more than a preset threshold of the total approval process time are listed as candidate bottlenecks;

[0019] Historical baseline criterion: Steps with current processing time exceeding the historical processing time baseline are listed as candidate bottlenecks;

[0020] Based on the determination result of the at least one preset criterion, it is identified as a bottleneck link in the business process.

[0021] In some preferred embodiments, the detection of sudden events includes:

[0022] Based on historical data of the performance indicators of the bottleneck link, an exponentially weighted moving average algorithm is used to determine the dynamic baseline, and a normal fluctuation band is established by combining the standard deviation of historical data.

[0023] An anomaly detection algorithm is used to monitor the performance indicators. When the performance indicators continuously exceed the normal fluctuation range, it is determined that a sudden event has occurred.

[0024] In some preferred embodiments, the event feature vector includes at least one or more of the following features:

[0025] The system includes: a time metric representing the time elapsed since the last emergency; an impact score representing the accumulated impact of events that occur within a preset time period and have a positive impact on process performance; an impact score representing the accumulated impact of events that occur within a preset time period and have a negative impact on process performance; and a status feature indicating whether the current business process is currently within the impact period of a specific emergency.

[0026] In some preferred embodiments, the attribution model is an interpretable machine learning model, and the model's prediction results are decomposed using an additional explanation method based on Shapley values ​​to calculate a quantified marginal contribution value for each input feature, and the marginal contribution value is output as the quantified contribution degree.

[0027] In some preferred embodiments, when detecting sudden events, it is also necessary to record the event type, the magnitude of the indicator deviation, and the confidence level calculated based on the magnitude of the deviation. The sudden event type includes one of bottleneck occurrence, performance degradation, bottleneck disappearance, and performance improvement. If the sudden event belongs to a high-learning-value type, the key driving factors that cause the change in performance indicators due to the sudden event are analyzed and identified, and the attribution model is updated based on the identification results.

[0028] In some preferred embodiments, the determination of the high-learning-value sudden event includes:

[0029] Multiple quantitative evaluation dimensions are defined, including at least: type of emergency, magnitude of indicator deviation, statistical confidence level of emergency, and strength of contextual correlation; wherein, in the dimension of emergency type, the quantitative value of a bottleneck disappearance event is greater than the quantitative value of a bottleneck occurrence event;

[0030] The comprehensive learning value score is obtained by weighting the quantitative values ​​of the multiple evaluation dimensions.

[0031] When the comprehensive learning value score exceeds a predefined learning threshold, the sudden event is determined to be an event with high learning value.

[0032] In some preferred embodiments, updating the attribution model based on the identification results specifically includes:

[0033] Based on the key driving factors in the identification results, at least one of the following operations is performed in the attribution model: adjusting the weights of the risk feature dimensions, adding new features, or adding interaction item features.

[0034] In another aspect, the present invention proposes an intelligent attribution system for process bottlenecks that integrates multidimensional risks and emergencies, used to execute the aforementioned intelligent attribution method for process bottlenecks that integrates multidimensional risks and emergencies, comprising:

[0035] The data fusion module is configured to collect process execution data and multidimensional risk data from business processes, associate them with common identifiers and align them over time to form a fused dataset;

[0036] The bottleneck quantification and identification module is configured to calculate the performance indicators of each step of the approval process based on the process execution data in order to identify bottleneck steps.

[0037] An emergency event detection module is configured to monitor one or more performance indicators of the bottleneck link to detect emergencies related to the performance indicators, generate an event feature vector characterizing the emergencies, and record common identifiers corresponding to risk features affecting the performance indicators during the event; extract corresponding multidimensional risk data from the fused dataset to construct a risk vector.

[0038] The attribution analysis module is configured to concatenate the risk vector and the event feature vector and input them into a preloaded attribution model to determine the quantitative contribution of one or more input features from the event feature vector and the risk vector to the performance indicators of the bottleneck link.

[0039] The beneficial effects of this invention are:

[0040] This invention achieves precise quantification of bottleneck location and risk factor contribution by integrating three types of data: process, risk, and event, and utilizing an interpretable machine learning model. It establishes a clear causal chain from risk to bottleneck, realizes deep attribution, and completes the progress from descriptive analysis to diagnostic analysis, breaking through the limitation of traditional methods that can only identify phenomena but cannot explain the causes.

[0041] In the data acquisition and fusion step, a common identifier is used as the primary key to force association and time alignment of process event data and multidimensional risk data from different systems. This successfully integrates the originally scattered and isolated process execution information and static risk profiles of cases into a unified structured dataset. It effectively solves the fundamental problems of process analysis and risk analysis being separated and insufficient data foundation in existing technologies, and lays a solid data foundation for subsequent accurate and cross-domain root cause analysis.

[0042] The design incorporates a mechanism for detecting sudden events and optimizing event-driven models. By monitoring the KPIs of bottleneck processes over time, it automatically captures and categorizes high-value dynamic events such as the disappearance of bottlenecks. It then uses data changes before and after these events to identify key driving factors, thereby automatically adjusting the characteristics and structure of the attribution model. This empowers the system with dynamic perception and self-evolution capabilities, ensuring that the attribution analysis results continuously adapt to changes in the business environment. It elevates process optimization from passive response to proactive management, overcoming the bottleneck of traditional static analysis methods being unable to adapt to the dynamic evolution of processes. Attached Figure Description

[0043] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0044] Figure 1 This is a flowchart of the intelligent attribution method for process bottlenecks that integrates multidimensional risks and emergencies in the embodiments of this application;

[0045] Figure 2 This is a schematic diagram of the intelligent attribution system for process bottlenecks that integrates multi-dimensional risks and emergencies in the embodiments of this application.

[0046] Figure 3 This is a schematic diagram of the structure of a computer system used to implement the methods, systems, and electronic devices of this application. Detailed Implementation

[0047] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0048] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0049] This invention provides an intelligent attribution method for process bottlenecks that integrates multidimensional risks and emergencies. By deeply fusing process execution data, multidimensional risk data, and dynamic emergencies, it identifies bottleneck links in business processes. Then, through an enhanced interpretable attribution model, it uses the risk characteristics and event feature vectors of the case as input to quantify the contribution of each factor to the bottleneck performance indicators; and it analyzes and learns from emergencies that belong to the high-learning-value type. This method not only solves the problem of not being able to deeply explain the causes of bottlenecks, but also can automatically detect high-value emergencies such as "bottleneck disappearance" and learn from them to form an adaptive intelligent closed loop. The following will use the approval process as an example for detailed explanation, but this should not be construed as limiting the scope of application of this invention.

[0050] To more clearly explain the intelligent attribution method for process bottlenecks that integrates multidimensional risks and emergencies in this invention, the following will be combined with... Figure 1 The steps in the embodiments of the present invention will be described in detail below.

[0051] The intelligent attribution method for process bottlenecks that integrates multidimensional risks and emergencies according to the first embodiment of the present invention includes steps S100-S600, each of which is described in detail below:

[0052] S100: Collect process execution data and multi-dimensional risk data related to the approval process (business process), associate them with common identifiers and align them in time to form a fused dataset.

[0053] Preferably, this step is fundamental to all analyses, and the system collects data from multiple heterogeneous data sources, specifically including:

[0054] Process execution data: mainly obtained from the operation logs of the Business Process Management System (BPMS) or core business system, and includes at least "common identifier", "activity name" and "time stamp" (start and end time of the activity).

[0055] Risk data: Acquired from various risk control engines such as credit approval, anti-fraud, and anti-money laundering, as well as customer relationship management (CRM) systems and third-party credit reporting agencies, covering a wealth of risk features associated with each common identifier, such as hundreds of features including customer credit scores, historical behavior, device fingerprints, associated network information, KYC completeness, etc.

[0056] In this embodiment, the common identifier is a "case ID".

[0057] Preferably, before data processing, data cleaning is performed, including handling missing values. For example, for numerical risk features (such as "monthly income"), imputation can be performed using the mean, median, or regression models based on other features; for categorical features, they can be treated as an independent "unknown" category. In addition, outliers (such as an age of 200 years) need to be identified and handled, which can be done using box plots or the 3-sigma rule for detection and correction.

[0058] In some preferred embodiments, the data formats and time standards of different systems often differ. The "precise matching" here employs mature event stream processing technology to achieve time format unification, with the specific steps as follows:

[0059] All timestamps from all sources (regardless of their original format or time zone) are converted to a unified, time-zone-inclusive standard format, such as the international standard ISO 8601, and unified to Coordinated Universal Time (UTC) to eliminate ambiguity caused by differences in time zones and formats.

[0060] More preferably, the datasets are associated with a common identifier and time-aligned to form a structured fused dataset. This time alignment is achieved through instantaneous connection technology, specifically including:

[0061] For any activity event (such as "credit approval") in the process execution data, find the risk snapshot record in the multidimensional risk data that matches the common identifier (case ID) to which the activity event belongs, and whose timestamp is no later than the start time of the activity event and is the closest in time.

[0062] The risk snapshot records are associated with activity events to form a wide table with a common identifier (case ID) as the primary key, providing a data foundation for subsequent analysis. Each row of the table represents a complete approval case, and each column represents a feature, including process information (such as "initial review time" and "number of reviews") as well as hundreds of risk features (such as "credit score", "fraud score", "KYC completeness", "historical number of overdue payments", "equipment and environmental risk level", etc.).

[0063] S200: Apply process mining technology to analyze process data in the fused dataset, and calculate the performance indicators of each link in the approval process based on process execution data in order to locate and identify bottleneck links.

[0064] In a preferred embodiment, the process mining technique can employ a heuristic mining algorithm (HeuristicMiner), which is robust to common noise and unstructured behaviors in real-world processes. This algorithm can construct a flowchart reflecting the mainstream business path by analyzing the direct follow frequency and dependencies between activities. Alpha-Miner or Inductive Miner algorithms can also be used.

[0065] Specifically, in this embodiment, a heuristic mining algorithm is used to analyze the process data in the fused dataset, including the following:

[0066] 1) Dependency Analysis: By analyzing the sequence of activities in the log, the direct follow frequency between each pair of activities (A, B) is calculated. A high-frequency A -> B sequence suggests a strong dependency between A and B.

[0067] 2) Construct a dependency graph: Based on the calculated dependency metric, construct a directed graph where nodes are activities and edge weights represent dependency strength.

[0068] 3) Noise filtering: The key to heuristic mining is that it does not require all behaviors to perfectly conform to the model. It filters out paths with extremely low frequency, treating them as "noise" or "exceptions," thereby generating a relatively concise flowchart that reflects the mainstream behaviors.

[0069] After generating the process model, the system performs performance analysis; that is, it iterates through all cases and calculates the processing time for each activity (such as "initial review of documents"), which is the difference between the start and end times of the activity. Then, it aggregates the processing times of the same activity for all cases and calculates statistics such as the mean, median, P90, and P95.

[0070] Preferably, the performance indicators include at least one of the average processing time, waiting time, and resource utilization rate of each stage; the bottleneck identification stage includes:

[0071] Bottleneck candidates for each stage are determined using at least one preset criterion, which includes:

[0072] Absolute duration criterion: The one or more steps with the longest average processing time are listed as candidate bottlenecks;

[0073] Relative contribution criterion: Steps whose average processing time accounts for more than a preset threshold of the total approval process time are listed as candidate bottlenecks;

[0074] Historical baseline criteria: Processes with current processing time (average processing time in the current time window) higher than the historical processing time baseline (the average of a longer historical period, such as the average of the past three months) are listed as candidate bottlenecks.

[0075] Based on the determination result of the at least one preset criterion, it is identified as a bottleneck link in the business process.

[0076] Further preferably, the resource waiting criterion is as follows: In addition to processing time, the system will also analyze the waiting time of activities (i.e., the time from the end of the previous activity to the start of this activity). High waiting time usually means insufficient resources (human or system), which is another form of bottleneck.

[0077] More preferably, the performance index uses the average processing time of each stage as the core indicator.

[0078] In a preferred embodiment, weights can be assigned to each criterion, and a weighted overall bottleneck score can be calculated to identify the process with the highest score as the core bottleneck. Each sub-score is a standardized score calculated based on the relationship between process indicators and thresholds; ultimately, only processes with "bottleneck scores" exceeding a preset total threshold will be identified by the system as core bottlenecks requiring priority attention.

[0079] More preferably, in this embodiment, the preset ratio threshold is 40%.

[0080] S300: Monitor one or more performance indicators of the bottleneck link to detect sudden events related to the performance indicators and generate an event feature vector characterizing the sudden events.

[0081] The performance indicators of the bottleneck process (such as average daily processing time) are treated as a time series data point. Anomaly detection algorithms are used to monitor the time series data to determine whether any sudden changes have occurred.

[0082] Preferably, the detection of sudden events includes:

[0083] Based on historical data of the performance indicators (detected) of the bottleneck link, an exponentially weighted moving average algorithm is used to determine the dynamic baseline.

[0084] Based on the baseline, calculate the historical standard deviation, and combine the dynamic baseline with the standard deviation of historical data to establish a normal fluctuation band (e.g., baseline ± 2 * standard deviation).

[0085] An anomaly detection algorithm is used to monitor the performance indicators. When the performance indicators continuously exceed the normal fluctuation range, it is determined that a sudden event has occurred.

[0086] More preferably, the dynamic baseline can be a 7-day moving average or an exponentially weighted moving average (EWMA). EWMA gives higher weight to recent data, allowing it to reflect the latest trends while being less susceptible to short-term noise.

[0087] In a preferred embodiment, determining that an emergency has occurred specifically includes:

[0088] When the key performance indicators continuously exceed the upper limit of the normal fluctuation range, a negative sudden event (such as the appearance of a bottleneck or performance deterioration) is triggered.

[0089] When the aforementioned key performance indicators continuously break through the lower limit of the normal fluctuation range, a positive sudden event (such as the disappearance of the bottleneck or performance improvement) is triggered.

[0090] Preferably, once a sudden event is detected, the system records its relevant information and generates an event feature vector to allow the model to perceive the current dynamic background of the process; the event feature vector includes at least one or more of the following features:

[0091] Time-based measurement characteristics: These characteristics represent the time elapsed between the current emergency and the last emergency.

[0092] Cumulative Impact Score Characteristics: Represents the cumulative impact score of events that occur within a preset time period and have a positive impact on process performance (such as the disappearance of bottlenecks); Represents the cumulative impact score of events that occur within a preset time period and have a negative impact on process performance (such as performance deterioration), and this score can decay over time;

[0093] State characteristic: A binary characteristic used to identify whether the current business process is under the influence of a specific event (such as "new product launch promotion period").

[0094] The preset time period is set according to different business or different usage volume, and different time dimensions are selected, such as 24 hours, 48 ​​hours, and 168 hours.

[0095] Preferably, when detecting sudden events, it is also necessary to record the event type, the deviation of the indicator, and the confidence level calculated based on the deviation. The sudden event type includes one of the following: bottleneck occurrence, performance degradation, bottleneck disappearance, and performance improvement.

[0096] S400: Record the common identifiers corresponding to the risk characteristics affecting performance indicators during the event period, extract the multidimensional risk data corresponding to the recorded common identifiers from the fused dataset, and construct a risk vector. This aims to transform the original risk characteristics of each case into a numerical vector that can be processed by a machine learning model.

[0097] Preferably, the risk data obtained from step S100 is standardized and quantified, such as Z-score standardization for continuous value features and one-hot encoding for categorical features, ultimately forming a high-dimensional risk vector.

[0098] More preferably, feature numeration includes the following:

[0099] 1) Numerical features, such as "age," "income," and "credit score," typically require standardization or normalization. Standardization (e.g., Z-score) transforms the data into a distribution with a mean of 0 and a standard deviation of 1, suitable for data distributions that approximate a Gaussian distribution. Normalization (e.g., Min-Max Scaling) scales the data to the [0, 1] interval, suitable for algorithms that require limiting the data range. The choice of method depends on the characteristics of the subsequent model.

[0100] 2) Categorical features: such as "occupation," "education level," and "product type," need to be converted to numerical values. A common method is one-hot encoding, which creates a new binary feature column for each category. For high cardinality features with too many categories (such as "city"), target encoding or frequency encoding can be used to avoid dimensionality explosion.

[0101] 3) Feature Derivation and Dimensionality Reduction: To capture more complex relationships, new derived features can be created based on the original features, such as calculating the "Debt-to-Income Ratio". When the risk features have extremely high dimensionality and multicollinearity exists, dimensionality reduction techniques such as principal component analysis (PCA) can be considered to extract the principal components with the most information as new features, thereby improving the training efficiency and stability of the model.

[0102] After the above processing, each approval case is represented as a unique, high-dimensional fusion risk vector V = [f1, f2, f3, ..., fn], where each element fi is a standardized value. This vector forms the basis for all subsequent analyses.

[0103] S500: The risk vector and event feature vector are concatenated and input into a preloaded attribution model to determine the quantitative contribution of one or more input features from the event feature vector and the risk vector to the performance indicators of the bottleneck link.

[0104] In this embodiment, the event feature vector generated in step S300 and the risk vector generated in step S400 are concatenated and used as independent variables (input features). The performance indicators of the bottleneck link (such as processing time) are used as dependent variables and input into the pre-trained attribution model.

[0105] Preferably, during the analysis, the contextual information before and after the event will also be queried and correlated, such as system change logs (whether there was new code deployment, system update, or risk model launch within 24 hours before the event), business operation calendars (whether it coincided with a holiday, a large marketing event, or a product promotion period, resulting in a drastic change in workload or customer profile?), and risk strategy change records (whether new risk control rules were activated or a key threshold was adjusted?).

[0106] By inputting these three types of features into the model, the model can not only learn "what kind of risk cases are handled slowly", but also "what kind of risk cases are handled slowly at what time and in what event context". Its depth and accuracy of analysis far exceed those of traditional models.

[0107] Preferably, in this embodiment, the attribution model is an interpretable machine learning model, such as a gradient boosting decision tree model (e.g., XGBoost, LightGBM). Before executing the method, the model is pre-trained, specifically including the following:

[0108] Data Sample Selection: Historical cases are selected from the fused dataset, requiring that cases "enter a bottleneck stage and have stabilized processing time (e.g., excluding cases during periods of abnormal fluctuations)". The sample size needs to cover different risk levels and event backgrounds to ensure sample quality. For example, all cases that triggered bottleneck identification within the past 6 months are selected, totaling 500,000+ samples. Each sample includes a dependent variable: the processing time of the bottleneck stage (e.g., average processing time); and independent variables: fused risk vector (based on the risk vector construction logic of step S400, standardizing the risk features in the fused dataset) + historical event features (based on the event feature construction logic, extracting historical event features).

[0109] Data preprocessing: Logarithmic transformation is used to eliminate skewed distribution for continuous features (such as processing time); one-hot encoding or target encoding is performed for categorical features (such as "product type"); training set / validation set / test set are divided (ratio 7:1:2), and methods such as SMOTE are applied to handle sample imbalance (if the proportion of bottleneck cases is low).

[0110] Training objective: To optimize the model's fitting ability using "mean squared error (MSE)" or "mean absolute error (MAE)" as the loss function;

[0111] Hyperparameter tuning: Adjust key parameters (such as learning rate 0.1, number of trees 100, L1 regularization coefficient 0.01) through grid search or Bayesian optimization with the goal of minimizing the validation set MSE;

[0112] Model validation: Five-fold cross-validation is used to ensure the stability of the model on different training / test subsets, and the MAE on the test set is controlled within a threshold (e.g., within 15%). If the model's performance on the validation set (e.g., MSE < threshold) meets the requirements, training is completed and the model is stored in the model library for direct use later; if it does not meet the requirements, features are re-optimized or model parameters are adjusted until the requirements are met.

[0113] After model training, the performance metrics of the bottleneck (such as processing time) are used as the dependent variable and input into the pre-trained attribution model. A pre-defined attribution algorithm, such as SHAP (Shapley Additive exPlanations), is used to decompose the model's predictions. For each input feature (whether risk or event), the model's predictions are fairly allocated to each input risk factor and event feature. This accurately calculates and outputs the quantitative contribution of each factor leading to the bottleneck. This value clearly indicates how much the feature pushes the prediction up or down from the baseline value. The system outputs this marginal contribution value as the quantitative contribution, thus precisely revealing the specific impact of each factor on the bottleneck duration.

[0114] In this embodiment, the prediction results are decomposed based on SHAP, and the method is as follows:

[0115] 1) Attribution analysis of a single case: For a case that takes a particularly long time, a "ForcePlot" can be generated to clearly show which risk factors (such as "high fraud score" and "multiple borrowing") pushed up its predicted duration, and which factors (such as "complete KYC information") played a mitigating role.

[0116] 2) Global Feature Importance Analysis: By taking the average absolute value of the SHAP values ​​of all cases, a more reliable global ranking can be obtained than the traditional feature importance analysis, to understand which risk factors have the greatest impact on the bottleneck as a whole.

[0117] 3) Feature Dependency Analysis: SHAP dependency graphs can be drawn to reveal how the value of a feature (such as "credit score") affects its contribution to bottleneck duration, and whether this effect is moderated by another feature (such as "whether a new model is used").

[0118] For a specific case, SHAP can explain its longer processing time, with "credit score below 600" contributing +3.2 hours and "being within the period affected by recent performance improvement events" contributing -1.5 hours.

[0119] S600: In response to the detection that a sudden event belongs to a high-learning-value type, the model update process is triggered.

[0120] Determine whether an event has high learning value. If so, analyze and identify the key driving factors that lead to changes in performance indicators, and update the attribution model based on the identification results.

[0121] Preferably, the determination of the high-learning-value sudden event includes:

[0122] Define multiple quantitative evaluation dimensions, which include at least: the type of emergency, the magnitude of indicator deviation, the statistical confidence level of the emergency, and the strength of contextual correlation.

[0123] The comprehensive learning value score is obtained by weighting the quantitative values ​​of the multiple evaluation dimensions:

[0124] Learning value score = w1 × event type quantification value + w2 × change magnitude quantification value + w3 × confidence quantification value + w4 × association strength quantification value; where w1 + w2 + w3 + w4 = 1;

[0125] The system will sort all detected incidents in descending order based on this score. When the comprehensive learning value score exceeds the predefined learning threshold, the incident will be judged as an event with high learning value.

[0126] Within the event type dimension, different types of events possess different fundamental learning values. Generally, positive events (such as bottleneck disappearance) contain more replicable success stories than negative events (such as bottleneck worsening), and are therefore typically assigned higher quantitative values. The greater the deviation of the indicator, the richer the information contained in the event, and the higher its value. For example, an event with a 70% decrease in processing time is far more valuable than one with a 10% decrease. Events with higher confidence levels demonstrate stronger analytical reliability and thus higher value.

[0127] More preferably, the contextual association strength includes at least one of the following:

[0128] The event rarity index is quantified by the time metric feature in the event feature vector that represents the time elapsed since the last occurrence of the event. The longer the time interval, the rarer the event may be and the higher its value.

[0129] The process stability index is measured in reverse by the features in the event feature vector that represent the cumulative impact score of recent events. For example, if a long-term stable process suddenly changes, its learning value is higher.

[0130] Preferably, the key driving factors leading to changes in performance indicators are analyzed and identified as follows: the system defines cases before and after the event (e.g., within a time window) as the control group and the experimental group, respectively, and automatically applies statistical testing methods to systematically compare the differences between the two groups across all dimensions of the "fusion risk vector":

[0131] For numerical features, use the t-test or Mann-Whitney U test to determine whether there is a significant difference between the means or medians of the two groups;

[0132] For categorical features, the chi-square test is used to determine whether there is a significant difference in the distributions of the two groups;

[0133] For comparisons across the entire distribution, the Kolmogorov-Smirnov (KS) test can be used to determine whether two samples come from the same distribution.

[0134] This allows the system to compare the distribution of various risk characteristics between the two groups of cases to identify any significant differences. In this way, the system can use data to pinpoint key drivers leading to process improvement, such as a newly launched anti-fraud model version or an adjustment to a risk rule, and then incorporate this successful experience as structured knowledge into subsequent model optimization steps.

[0135] Preferably, updating the attribution model based on the recognition result specifically includes:

[0136] Based on key drivers in the identification results (e.g., through statistical tests comparing the distribution of case features before and after the event), attribution models perform at least one of the following operations: adjusting the weights of risk feature dimensions, adding new features (such as "new model version number"), or adding interaction item features.

[0137] For example, after identifying the key driving factors (e.g., discovering that "the launch of the new anti-fraud model V3" is the core reason for the bottleneck disappearance), optimization instructions for the attribution model are automatically generated. These instructions could be: adding "anti-fraud model version" as a new strong feature to the model; automatically adjusting the weights of relevant features in the attribution model (such as "fraud score"); or adding new interaction items to the model (such as the interaction between "new model version" and "customer age") to capture more complex effects. In this way, the attribution model is no longer static, but can continuously adjust and update its structure based on real-world feedback, achieving self-learning and continuous optimization of the model.

[0138] More preferably, the system will attempt to extract patterns that can be used for early warning from successful events. For example, if the continuous improvement of the two indicators "fraud score" and "device risk level" is found to be a strong precursor to the disappearance of the bottleneck, the system can establish a new early warning rule: "When the fraud score and device risk are observed to decrease for three consecutive days, it is predicted that the bottleneck has an 85% probability of being alleviated within the next 24 hours."

[0139] In a preferred embodiment, optimization instructions and effects are recorded, forming a structured and continuously expanding "process optimization knowledge base." This knowledge base explicitly defines entities and their relationships, typically stored in a graph database or relational model. Its core entity and relationship definitions are as follows:

[0140] 1) Entity definition:

[0141] Event: Records the attributes of sudden events, such as event type, occurrence time, magnitude of change, confidence level, etc.

[0142] Driving Factor: Records the identified causes that led to the event, such as "risk model update" or "system parameter adjustment".

[0143] Optimization Instruction: Records specific model optimization actions generated based on insights, such as "add features", "adjust weights", "add interactive items", etc.

[0144] Effectiveness Evaluation: Record the effects after the optimization instructions are executed, such as "percentage increase in model accuracy" and "reduction in prediction error".

[0145] 2) Relationship definition:

[0146] `CAUSED_BY`: Connects the "Event" entity and the "Driving Factor" entity, indicating what factors caused the event; the system defines the cases before and after the event as the "control group" and the "experimental group" respectively, and uses statistical test methods (t-test, chi-square test, etc.) to systematically compare the differences between the two groups of cases on all risk characteristic dimensions, thereby identifying the key driving factors that led to the event.

[0147] `TRIGGERS`: Connects the "driving factor" entity and the "optimization instruction" entity, indicating what kind of model optimization was triggered by the factor.

[0148] `RESULTS_IN`: Connects the "Optimization Instruction" entity and the "Effect Evaluation" entity, indicating what quantifiable effects the optimization action brought about.

[0149] For example, the system will "remember" in a structured way: (Event: Bottleneck disappears) - [CAUSED_BY]-> (Driving factor: New anti-fraud model V3 goes live) - [TRIGGERS]-> (Optimization instructions: Add "anti-fraud model version" as a new feature to the model, adjust the feature weight of "fraud score", and add an interaction item between "new model version" and "customer age") - [RESULTS_IN]-> (Effect evaluation: Attribution model accuracy improves by 18%).

[0150] The intelligent process bottleneck attribution system integrating multi-dimensional risks and emergencies, as described in the second embodiment of the present invention, is used to execute the aforementioned intelligent process bottleneck attribution method integrating multi-dimensional risks and emergencies, combined with... Figure 2 A more detailed explanation is provided, including:

[0151] The data fusion module is configured to collect process execution data and multidimensional risk data from business processes, associate them with common identifiers and align them over time to form a fused dataset;

[0152] The bottleneck quantification and identification module is configured to calculate the performance indicators of each step of the approval process based on the process execution data in order to identify bottleneck steps.

[0153] An emergency event detection module is configured to monitor one or more performance indicators of the bottleneck link to detect emergencies related to the performance indicators, generate an event feature vector characterizing the emergencies, and record common identifiers corresponding to risk features affecting the performance indicators during the event; extract corresponding multidimensional risk data from the fused dataset to construct a risk vector.

[0154] The attribution analysis module is configured to concatenate the risk vector and the event feature vector and input them into a preloaded attribution model to determine the quantitative contribution of one or more input features from the event feature vector and the risk vector to the performance indicators of the bottleneck link.

[0155] Preferably, it also includes a model optimization module, configured to analyze and identify the key driving factors that cause changes in performance indicators if the sudden event belongs to a high learning value type, and update the attribution model based on the identification results.

[0156] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process and related explanations of the methods described above can be found in the corresponding processes in the foregoing system embodiments, and will not be repeated here.

[0157] It should be noted that the intelligent attribution method and system for process bottlenecks that integrates multi-dimensional risks and emergencies provided in the above embodiments are only illustrative examples of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the modules or steps in the embodiments of the present invention can be further decomposed or combined. For example, the modules in the above embodiments can be merged into one module, or further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present invention are only for distinguishing the various modules or steps and are not considered as an improper limitation of the present invention.

[0158] A device according to a third embodiment of the present invention includes:

[0159] At least one processor;

[0160] and a memory communicatively connected to at least one of the processors;

[0161] The memory stores instructions that can be executed by the processor to implement the above-mentioned intelligent attribution method for process bottlenecks that integrates multi-dimensional risks and emergencies.

[0162] A fourth embodiment of the present invention provides a computer-readable storage medium storing computer instructions, which are executed by the computer to implement the above-described intelligent attribution method for process bottlenecks that integrates multidimensional risks and emergencies.

[0163] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process and related descriptions of the storage device and processing device described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0164] The following is for reference. Figure 3 It shows a schematic diagram of the structure of a computer system for implementing embodiments of the systems, methods, and electronic devices of this application. Figure 3 The server shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0165] like Figure 3As shown, the computer system includes a Central Processing Unit (CPU) 301, which can perform various appropriate actions and processes based on programs stored in Read Only Memory (ROM) 302 or programs loaded from storage section 308 into Random Access Memory (RAM) 303. The RAM 303 also stores various programs and data required for system operation. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An Input / Output (I / O) interface 305 is also connected to the bus 304.

[0166] The following components are connected to I / O interface 305: an input section 306 including a keyboard, mouse, etc.; an output section 307 including a cathode ray tube (CRT), liquid crystal display (LCD), and speakers, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN (Local Area Network) card and a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to I / O interface 305 as needed. Removable media 311, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0167] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by central processing unit (CPU) 301, it performs the functions defined in the methods of this application. It should be noted that the computer-readable medium described above in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on a computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0168] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0169] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0170] The terms “first”, “second”, etc., are used to distinguish similar objects, not to describe or indicate a specific order or sequence.

[0171] The term "comprising" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent in such process, method, article, or apparatus / device.

[0172] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A method for intelligent attribution of process bottlenecks that integrates multidimensional risks and emergencies, characterized in that, Includes the following steps: Collect process execution data and multidimensional risk data from business processes, associate them with common identifiers and align them over time to form a fused dataset; Calculate performance metrics for each stage of the approval process based on process execution data to identify bottlenecks; Monitor one or more performance indicators of the bottleneck link to detect sudden events and generate event feature vectors; Record the common identifiers corresponding to the risk characteristics that affect performance indicators during the event, extract the corresponding multidimensional risk data from the fused dataset, and construct a risk vector. The risk vector and event feature vector are concatenated and input into a preloaded attribution model to determine the quantitative contribution of one or more input features from the event feature vector and the risk vector to the performance index of the bottleneck link, and the attribution result is output. The process execution data includes the activity name and timestamp, and the time alignment is achieved through instant connection technology, specifically including: For the start time of any activity event in the process execution data, find the risk snapshot record in the multidimensional risk data that matches the common identifier of the activity event and whose timestamp is no later than the start time of the activity event and is the closest in time. Associate the risk snapshot records with the activity events.

2. The intelligent attribution method for process bottlenecks that integrates multidimensional risks and emergencies as described in claim 1, characterized in that, The performance indicators include at least one of the following: average processing time, waiting time, and resource utilization rate for each stage. The bottleneck identification process includes: Bottleneck candidates for each stage are determined using at least one preset criterion, which includes: Absolute duration criterion: The stage with the longest average processing time is listed as a candidate bottleneck; Relative contribution criterion: Steps whose average processing time accounts for more than a preset threshold of the total approval process time are listed as candidate bottlenecks; Historical baseline criterion: Steps with current processing time exceeding the historical processing time baseline are listed as candidate bottlenecks; Based on the determination result of the at least one preset criterion, it is identified as a bottleneck link in the business process.

3. The intelligent attribution method for process bottlenecks integrating multi-dimensional risks and emergencies as described in claim 1, characterized in that, The detection of sudden events includes: Based on historical data of the performance indicators of the bottleneck link, an exponentially weighted moving average algorithm is used to determine the dynamic baseline, and a normal fluctuation band is established by combining the standard deviation of historical data. An anomaly detection algorithm is used to monitor the performance indicators. When the performance indicators continuously exceed the normal fluctuation range, it is determined that a sudden event has occurred.

4. The intelligent attribution method for process bottlenecks integrating multi-dimensional risks and emergencies as described in claim 1, characterized in that, The event feature vector contains at least one or more of the following features: The system includes: a time metric representing the time elapsed since the last emergency; an impact score representing the accumulated impact of events that occur within a preset time period and have a positive impact on process performance; an impact score representing the accumulated impact of events that occur within a preset time period and have a negative impact on process performance; and a status feature indicating whether the current business process is currently within the impact period of a specific emergency.

5. The intelligent attribution method for process bottlenecks integrating multi-dimensional risks and emergencies as described in claim 4, characterized in that, The attribution model is an interpretable machine learning model, and the model's prediction results are decomposed using an additional explanation method based on Shapley values. A quantified marginal contribution value is calculated for each input feature, and the marginal contribution value is output as the quantified contribution degree.

6. The intelligent attribution method for process bottlenecks that integrates multidimensional risks and emergencies as described in claim 4, characterized in that, When detecting sudden events, it is also necessary to record the event type, the deviation of the indicator, and the confidence level calculated based on the deviation. The sudden event type includes one of the following: bottleneck occurrence, performance degradation, bottleneck disappearance, and performance improvement. If the sudden event is of high learning value, analyze and identify the key driving factors that cause changes in performance indicators due to the sudden event, and update the attribution model based on the identification results.

7. The intelligent attribution method for process bottlenecks integrating multi-dimensional risks and emergencies as described in claim 6, characterized in that, The determination of high-learning-value emergencies includes: Multiple quantitative evaluation dimensions are defined, including at least: type of emergency, magnitude of indicator deviation, statistical confidence level of emergency, and strength of contextual correlation; wherein, in the dimension of emergency type, the quantitative value of a bottleneck disappearance event is greater than the quantitative value of a bottleneck occurrence event; The comprehensive learning value score is obtained by weighting the quantitative values ​​of the multiple evaluation dimensions. When the comprehensive learning value score exceeds a predefined learning threshold, the sudden event is determined to be an event with high learning value.

8. The intelligent attribution method for process bottlenecks that integrates multidimensional risks and emergencies as described in claim 7, characterized in that, The step of updating the attribution model based on the recognition results specifically includes: Based on the key driving factors in the identification results, at least one of the following operations is performed in the attribution model: adjusting the weights of the risk feature dimensions, adding new features, or adding interaction feature.

9. A process bottleneck intelligent attribution device integrating multi-dimensional risks and emergencies, characterized in that, include: The data fusion module is configured to collect process execution data and multidimensional risk data from business processes, associate them with common identifiers and align them over time to form a fused dataset; The bottleneck quantification and identification module is configured to calculate the performance indicators of each step of the approval process based on the process execution data in order to identify bottleneck steps. An emergency event detection module is configured to monitor one or more performance indicators of the bottleneck link to detect emergencies related to the performance indicators, generate an event feature vector characterizing the emergencies, and record common identifiers corresponding to risk features affecting the performance indicators during the event; extract corresponding multidimensional risk data from the fused dataset to construct a risk vector. The attribution analysis module is configured to concatenate the risk vector and the event feature vector and input them into a preloaded attribution model to determine the quantitative contribution of one or more input features from the event feature vector and the risk vector to the performance indicators of the bottleneck process. The process execution data includes the activity name and timestamp, and the time alignment is achieved through instant connection technology, specifically including: For the start time of any activity event in the process execution data, find the risk snapshot record in the multidimensional risk data that matches the common identifier of the activity event and whose timestamp is no later than the start time of the activity event and is the closest in time. Associate the risk snapshot records with the activity events.

Images