Risk prediction method and device based on multi-modal data, equipment and storage medium

Abstract

The embodiment of the invention provides a risk prediction method and device based on multi-modal data, equipment and a storage medium, and belongs to the technical field of artificial intelligence. The method comprises the following steps: acquiring multi-modal data of an insurance system, wherein the multi-modal data comprises at least two of the following data: system log data, network flow data and micro-service calling link data; performing feature extraction on the multi-modal data to obtain a multi-modal feature sequence; performing anomaly prediction based on the multi-modal feature sequence to obtain a time sequence anomaly feature; constructing an asset knowledge graph based on the entity information and the entity attribute information; performing feature extraction on the asset equipment based on the asset knowledge graph to obtain a node feature vector; and performing risk prediction on the insurance system according to the multi-modal feature sequence, the time sequence abnormal feature and the node feature vector. The risk prediction method and device can be applied to business systems needing a large number such as financial science and technology, and the efficiency and accuracy of risk prediction can be improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology and is applied to financial technology scenarios, particularly to a risk prediction method, apparatus, device, and storage medium based on multimodal data. Background Technology

[0002] Insurance companies' core systems carry massive amounts of sensitive data (such as customer information, policy transactions, and claims records). The security and stability of these core systems directly impact business continuity and customer trust. Currently, the security threats facing the insurance industry are becoming more frequent, covert, and complex. For example, malicious attackers may exploit zero-day vulnerabilities to launch APT (Advanced Persistent Threat) attacks to steal data; internal personnel errors or misconfigurations may cause system-level failures. Current operational technologies are lagging in detecting these risks and lack sufficient accuracy. Therefore, improving the efficiency and accuracy of risk prediction has become an urgent problem to be solved. Summary of the Invention

[0003] The main objective of this application is to propose a risk prediction method, apparatus, device, and storage medium based on multimodal data, aiming to improve the efficiency and accuracy of risk prediction.

[0004] To achieve the above objectives, a first aspect of this application proposes a risk prediction method based on multimodal data, the method comprising:

[0005] Acquire multimodal data from the insurance system, wherein the multimodal data includes at least two of the following: system log data, network traffic data, and microservice call chain data, and the insurance system includes at least one of the following asset devices: server, network device, and database;

[0006] Feature extraction is performed on the multimodal data to obtain a multimodal feature sequence;

[0007] Anomaly prediction is performed based on the multimodal feature sequence to obtain temporal anomaly features;

[0008] Obtain entity information and entity attribute information from the insurance system, and construct an asset knowledge graph based on the entity information and entity attribute information;

[0009] Based on the asset knowledge graph, feature extraction is performed on the asset equipment to obtain node feature vectors;

[0010] Risk prediction is performed on the insurance system based on the multimodal feature sequence, the temporal anomaly features, and the node feature vector.

[0011] In some embodiments, the step of performing anomaly prediction based on the multimodal feature sequence to obtain temporal anomaly features includes:

[0012] Based on the multimodal feature sequence, feature alignment is performed to obtain multimodal aligned features;

[0013] The multimodal alignment features are standardized to obtain the multimodal standardized features;

[0014] Anomaly prediction is performed based on the multimodal standardized features to obtain the temporal anomaly features.

[0015] In some embodiments, obtaining entity information and entity attribute information from the insurance system, and constructing an asset knowledge graph based on the entity information and entity attribute information, includes:

[0016] Obtain entity information and entity attribute information of the entity information; wherein, the entity information includes equipment information of the asset equipment and insurance information of the insurance system;

[0017] Graph nodes are determined based on the entity information, and the node attributes of the graph nodes are determined based on the entity attribute information.

[0018] The entity association relationship is obtained based on the entity information, and the entity association relationship is used as the original edge;

[0019] The asset knowledge graph is constructed based on the graph nodes, the node attributes, and the original edges.

[0020] In some embodiments, the step of extracting features from asset devices based on an asset knowledge graph to obtain node feature vectors includes:

[0021] Target nodes are extracted from the asset knowledge graph, and neighbor nodes are obtained by sampling neighbors based on the target nodes;

[0022] Obtain the original features of the neighboring nodes to obtain the neighbor features;

[0023] The neighbor features are aggregated to obtain the neighbor aggregate features;

[0024] The node feature vector is obtained by concatenating the target features of the target node and the neighbor aggregation features.

[0025] In some embodiments, the neighbor features include first-layer neighbor features and second-layer neighbor features, and the aggregation processing of the neighbor features to obtain aggregated neighbor features includes:

[0026] The first-layer neighbor features are aggregated by mean calculation to obtain the first neighbor aggregated features;

[0027] Based on the Long Short-Term Memory network, the second-layer neighbor features are subjected to temporal dependency aggregation to obtain the second-neighbor aggregated features;

[0028] The first neighbor aggregation feature and the second neighbor aggregation feature are nonlinearly transformed based on a preset activation function to obtain the neighbor aggregation feature.

[0029] In some embodiments, the step of predicting risk in the insurance system based on the multimodal feature sequence, the temporal anomaly features, and the node feature vector includes:

[0030] Dimension alignment is performed based on the multimodal feature sequence, temporal anomaly features, and node feature vectors to obtain dimension-aligned features;

[0031] The feature weights are obtained by calculating the weights based on the multimodal feature sequence, temporal anomaly features, and node feature vectors.

[0032] Based on the dimensional alignment features, feature concatenation is performed to obtain multimodal concatenated features;

[0033] The multimodal splicing features are weighted and fused based on the feature weights to obtain weighted fused features;

[0034] Risk prediction is performed based on the weighted fusion features to obtain a risk score.

[0035] In some embodiments, the step of extracting features from the multimodal data to obtain a multimodal feature sequence includes:

[0036] The multimodal data is preprocessed to obtain multimodal preprocessed data;

[0037] The multimodal preprocessed data is segmented into words to obtain multimodal word segmentation information;

[0038] Text encoding is performed based on the multimodal word segmentation information to obtain the multimodal feature sequence.

[0039] To achieve the above objectives, a second aspect of this application provides a risk prediction device based on multimodal data, the device comprising:

[0040] A multimodal data acquisition module is used to acquire multimodal data from an insurance system. The multimodal data includes at least two of the following: system log data, network traffic data, and microservice call chain data. The insurance system includes at least one of the following asset devices: servers, network devices, and databases.

[0041] A multimodal feature extraction module is used to extract features from the multimodal data to obtain a multimodal feature sequence;

[0042] Anomaly prediction module is used to predict anomalies based on the multimodal feature sequence to obtain temporal anomaly features;

[0043] An asset knowledge graph construction module is used to obtain entity information and entity attribute information from the insurance system, and construct an asset knowledge graph based on the entity information and entity attribute information.

[0044] The graph feature extraction module is used to extract features from the asset equipment based on the asset knowledge graph to obtain node feature vectors;

[0045] The risk prediction module is used to predict the risk of the insurance system based on the multimodal feature sequence, the temporal anomaly features, and the node feature vector.

[0046] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described in the first aspect.

[0047] To achieve the above objectives, a fourth aspect of the present application provides a storage medium, which is a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect.

[0048] The risk prediction method, apparatus, device, and storage medium based on multimodal data proposed in this application acquire multimodal data from an insurance system, including at least two types: system log data, network traffic data, and microservice call link data. Features are extracted from the multimodal data to obtain a multimodal feature sequence. Anomaly prediction is then performed based on this multimodal feature sequence to obtain temporal anomaly features. An asset knowledge graph is constructed based on the entity information and entity attribute information. Features are then extracted from the asset devices based on the asset knowledge graph to obtain node feature vectors. This facilitates risk prediction of the insurance system based on the multimodal feature sequence, the temporal anomaly features, and the node feature vectors, enabling cross-source heterogeneous data correlation analysis. This overcomes the limitations of traditional single-point detection and improves the efficiency and accuracy of risk prediction. Attached Figure Description

[0049] Figure 1 This is a flowchart of the risk prediction method based on multimodal data provided in the embodiments of this application;

[0050] Figure 2 yes Figure 1The flowchart for step 102 in the document;

[0051] Figure 3 yes Figure 1 The flowchart for step 103 in the text;

[0052] Figure 4 yes Figure 1 The flowchart for step 104 in the document;

[0053] Figure 5 yes Figure 1 The flowchart for step 105 in the document;

[0054] Figure 6 yes Figure 5 The flowchart for step 503 in the document;

[0055] Figure 7 yes Figure 1 The flowchart for step 106 in the document;

[0056] Figure 8 This is a schematic diagram of the structure of the risk prediction device based on multimodal data provided in the embodiments of this application;

[0057] Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0059] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0061] First, let's analyze some of the terms used in this application:

[0062] Artificial intelligence (AI) is a new branch of computer science that studies, develops, and applies theories, methods, technologies, and systems to simulate, extend, and expand human intelligence. It aims to understand the essence of intelligence and produce intelligent machines that can react in a way similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thought. Furthermore, AI utilizes digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceiving the environment, acquiring knowledge, and using that knowledge to achieve optimal results.

[0063] Natural Language Processing (NLP): NLP uses computers to process, understand, and utilize human language (such as Chinese and English). NLP is a branch of artificial intelligence and an interdisciplinary field of computer science and linguistics, often referred to as computational linguistics. NLP includes syntactic analysis, semantic analysis, and discourse understanding. It is commonly used in machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, intent recognition, information extraction and filtering, text classification and clustering, sentiment analysis, and opinion mining. It involves data mining, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research, and linguistic research related to language computation.

[0064] Switch Port Analyzer (SPAN): SPAN is a network management tool used to monitor and analyze network traffic on switches. By copying traffic from one port to another, SPAN allows network administrators to monitor, analyze, and troubleshoot network traffic in real time. SPAN operates on the principle of port mirroring technology, primarily involving two key steps: port replication and traffic forwarding. Port replication refers to copying data from a specified port (source port) to another port (destination port) for monitoring and analysis. In SPAN configuration, administrators can specify the source port to monitor and the destination port to which the replicated traffic will be sent. Traffic forwarding refers to the switch forwarding the replicated traffic from the source port to the destination port without affecting the transmission of the original traffic. Typically, the destination port is connected to network analysis tools, monitors, or recording devices for analyzing and recording the replicated traffic.

[0065] Graph Neural Networks (GNNs) are deep learning-based algorithmic frameworks for processing graph-structured data. They extract features from nodes, edges, and the graph as a whole to perform tasks such as classification, prediction, and generation. GNNs can transform non-Euclidean graph data (such as social networks, molecular structures, and transportation networks) into standardized representations, applicable to scenarios such as node classification, link prediction, and graph classification. GNNs typically include Graph Convolutional Networks (GCNs), Graph Attention Networks (GATs), and Graph Autoencoders (GAEs). GCNs achieve local perception and weight sharing through convolutional operations, while GATs introduce a multi-head attention mechanism to dynamically identify node relationships. GNNs can be applied to social network analysis (predicting user behavior), recommender systems (personalized recommendations), knowledge graphs (entity classification), and bioinformatics (protein structure prediction).

[0066] GraphSAGE (Graph Sample and Aggregate): GraphSAGE is an inductive graph neural network model that generates node embedding vectors through local neighbor sampling and feature aggregation. The core principle of GraphSAGE consists of three steps: neighbor sampling, feature aggregation, and embedding generation. Neighbor sampling, for each node, randomly samples a fixed number of its neighbors to form a local neighbor set. By controlling the number of samples, computational complexity and information preservation are balanced, making it suitable for large-scale graph data. Feature aggregation uses learnable aggregation functions (such as mean pooling and max pooling) to integrate the feature vectors of the sampled neighbors into the target node. The aggregation operation iterates through multiple layers to gradually expand the node's perceptual range, fusing multi-level neighbor information. Embedding generation combines the node's own features with the aggregated neighbor information, and generates the node's embedding vector through a neural network encoder (such as a fully connected layer or convolutional neural network). This vector can be used for downstream tasks such as classification and link prediction. GraphSAGE solves the problem of traditional graph neural networks (such as GCN) requiring global loading of graph structure data, enabling embedding learning for unseen nodes.

[0067] Insurance companies' core systems carry massive amounts of sensitive data (such as customer information, policy transactions, and claims records). The security and stability of these core systems directly impact business continuity and customer trust. Currently, the security threats facing the insurance industry are becoming more frequent, covert, and complex. For example, malicious attackers may launch APT attacks through zero-day vulnerabilities to steal data, and internal personnel misoperation or configuration errors may cause system-level failures. Current operational technologies are lagging in detecting these risks and lack sufficient accuracy. Furthermore, current operations and maintenance primarily rely on rule-based threshold alerts, manual log analysis, and post-incident review mechanisms. However, these methods have the following drawbacks: the passive response model leads to delayed threat detection, making it difficult to promptly interrupt attack chains; massive logs and alert information contain a large number of false positives, resulting in low efficiency and a high risk of missed detections during manual analysis; and the lack of cross-system and cross-dimensional intelligent collaboration makes it difficult to uncover potential related risks from fragmented data. For example, while traditional SIEM (security information and event management) systems can aggregate logs, their detection logic based on fixed rules is poorly adapted to new attack patterns (such as AI-driven adversarial sample attacks) and cannot quantify the impact of risks on business.

[0068] Based on this, embodiments of this application provide a risk prediction method, apparatus, device, and storage medium based on multimodal data, aiming to improve the efficiency and accuracy of risk prediction.

[0069] The risk prediction method, apparatus, device, and storage medium based on multimodal data provided in this application are specifically described through the following embodiments. First, the risk prediction method based on multimodal data in this application embodiment is described.

[0070] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0071] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0072] The risk prediction method based on multimodal data provided in this application relates to the field of artificial intelligence technology. This method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the risk prediction method based on multimodal data, but is not limited to the above forms.

[0073] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0074] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user audio, user voice, user behavior, user historical data, and user attribute information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to a confirmation page. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0075] Figure 1 This is an optional flowchart of the risk prediction method based on multimodal data provided in the embodiments of this application. Figure 1The method may include, but is not limited to, steps 101 to 106.

[0076] Step 101: Obtain multimodal data from the insurance system. The multimodal data includes at least two of the following: system log data, network traffic data, and microservice call chain data. The insurance system includes at least one of the following assets: servers, network devices, and databases.

[0077] Step 102: Extract features from the multimodal data to obtain a multimodal feature sequence;

[0078] Step 103: Perform anomaly prediction based on multimodal feature sequences to obtain temporal anomaly features;

[0079] Step 104: Obtain entity information and entity attribute information from the insurance system, and construct an asset knowledge graph based on the entity information and entity attribute information;

[0080] Step 105: Extract features from asset equipment based on the asset knowledge graph to obtain node feature vectors;

[0081] Step 106: Perform risk prediction on the insurance system based on multimodal feature sequences, temporal anomaly features, and node feature vectors.

[0082] Steps 101 to 106 as illustrated in this embodiment involve acquiring multimodal data from an insurance system, including at least two types of data: system log data, network traffic data, and microservice call chain data. Feature extraction is performed on the multimodal data to obtain a multimodal feature sequence. Anomaly prediction is then performed based on this sequence to obtain temporal anomaly features. An asset knowledge graph is constructed based on entity information and entity attribute information. Feature extraction is then performed on asset devices based on the asset knowledge graph to obtain node feature vectors. This facilitates risk prediction of the insurance system based on the multimodal feature sequence, temporal anomaly features, and node feature vectors, enabling cross-source heterogeneous data correlation analysis. This overcomes the limitations of traditional single-point detection and improves the efficiency and accuracy of risk prediction.

[0083] In step 101 of some embodiments, the insurance system is a system used by insurance companies to manage insurance-related business processes, process customer information, and support the sales and services of insurance products. It can be used to manage policies, underwriting, claims, etc. The policy typically includes the basic information of the policyholder, the basic information of the insurer, the type of insurance product, the sum insured, the insurance period, the payment method, etc. The basic information of the policyholder and the insurer includes, for example, name and ID number. The type of insurance product includes, for example, car insurance, life insurance, health insurance, etc. Underwriting is used to assess the risk of the policyholder to determine whether to underwrite and the underwriting conditions. Claims are used to process customer claims, record reporting information, claim progress, calculate compensation amount, etc.

[0084] In some embodiments, the insurance system includes at least one of the following assets: a server, network equipment, and a database. The server is the core computing power carrier for the operation of insurance business. It is the core hardware of the insurance system that carries business logic and processes data calculations, supporting the stable operation of the entire insurance business process. The server can be used to run core logic such as policy entry, query, modification, and renewal, ensuring that electronic policies can be generated in real time after customers purchase insurance. The server can also be used to run risk assessment methods in underwriting to analyze the policyholder's health data (such as medical examination reports in health insurance underwriting) and driving records (traffic violation information in car insurance underwriting). The server can also be used to process claims application review and compensation amount calculation to ensure the efficient progress of claims. Network devices serve as bridges for data transmission between various modules within an insurance system and between internal and external entities (such as customer terminals and partner institutions). They are responsible for ensuring the smoothness and security of data transmission. Network devices can include switches, routers, and firewalls. They enable data transmission and routing, facilitating data flow distribution between different devices and business modules within the insurance system and ensuring efficient data transfer. For example, the core switch forwards insurance applications submitted by customers through online sales platforms (such as insurance apps) to the server of the backend policy management system, and forwards underwriting results generated by the underwriting system server to customer terminals or agent management systems. To ensure a smooth insurance application process, the core switch also mirrors bidirectional network traffic to the Suricata tool via SPAN ports, providing a data source for full traffic capture and DNS request log extraction. Network devices can implement network access control and security isolation. By dividing the insurance system's network into zones (such as core business areas, office areas, and internet access areas), unauthorized access between different zones is restricted, and external network attacks are defended. For example, firewalls can set access rules to allow customer terminals to access specific ports of the online sales platform only, prohibiting direct access to the core policy database. When a malicious IP is detected, the firewall can receive blocking rules from the SOAR (Security Orchestration, Automation and Response) platform, blocking communication between the malicious IP and the insurance system and preventing the attack from spreading. Network devices can also perform network status monitoring and anomaly interception. By monitoring network traffic status in real time (such as traffic peaks and the number of abnormal connections), suspicious network behavior can be identified and intercepted. For example, the Intrusion Prevention System (IPS) can detect DDoS attack traffic and filter attack packets through traffic scrubbing and rate limiting policies to prevent core business servers from crashing due to traffic overload. The database is the secure storage and management center for core insurance data. It serves as a repository for massive amounts of sensitive data (such as customer information and policy data) in the insurance system. It is responsible for the structured storage, efficient querying, and secure management of data, and is the core guarantee for the continuity of insurance business and data security.

[0085] In some embodiments, system log data may include, but is not limited to, system logs ( / var / log / , event logs) and process information (CPU / memory, etc.) of the insurance system. In one application scenario, system log data may include, but is not limited to, authentication logs from the Linux server's auth.log, login failure records in the event log, and host performance logs (such as CPU and memory consumption information). Network traffic data may include, but is not limited to, timestamps, source IP / port, destination IP / port, DNS query domain names, and a list of responding IPs in DNS requests. Microservice call chain data may include, but is not limited to, time-consuming relationships such as abnormal SQL injection requests and upstream / downstream calls in the call chain of policy query transactions.

[0086] In one application scenario, multimodal data can be collected in the following ways: Install a lightweight Filebeat Agent on a physical machine or cloud host to collect system log data; Filebeat is a lightweight log collector. Configure a SPAN port on the core switch and use the Suricata tool to capture full traffic, thereby collecting network traffic data and extracting DNS request logs. Inject OpenTelemetry probes into microservice gateways (such as Nginx Ingress) to collect microservice call chain data, including trace IDs and span times.

[0087] In some embodiments, configuring the SPAN port may include, but is not limited to:

[0088] Enable the SPAN function on the core switch to mirror the physical port or VLAN traffic that needs to be monitored to a dedicated monitoring port.

[0089] When configuring, ensure that the mirrored traffic direction is "bidirectional" (capture both inbound and outbound traffic simultaneously) to avoid missing critical communications;

[0090] Configure the mirroring session through the switch management interface or CLI commands;

[0091] Verify that the mirrored traffic is being transmitted normally to the designated monitoring device.

[0092] In one application scenario, the mirroring session can be configured via the switch management interface or CLI commands, as shown in Table 1:

[0093]

[0094] Table 1

[0095] In some embodiments, configuring the Suricata tool may include, but is not limited to:

[0096] On the server where Suricata is deployed, configure the network interface to promiscuous mode; by configuring the network interface to promiscuous mode, you can ensure that mirrored traffic is received.

[0097] Modify the Suricata configuration file to specify the capture interface as the network interface card for receiving mirrored traffic; the Suricata configuration file can be a suricata.yaml file.

[0098] Enable full traffic capture mode and disable traffic truncation settings to ensure integrity.

[0099] A DNS request log is a log file that records detailed information about how a DNS server processes domain name resolution requests. DNS request logs are primarily used for troubleshooting, performance optimization, and security auditing. A DNS request log may include, but is not limited to, the requesting domain name, client IP address, response IP address, and response time. The requesting domain name records the domain name the user attempted to access, the client IP address is the address of the client initiating the request, the response IP address is the IP address returned by the DNS server after resolution, and the response time is the time it took for the DNS server to process the request. Error codes (if any): the error type when resolution fails.

[0100] In some embodiments, retrieving DNS request logs may include, but is not limited to:

[0101] Enable the DNS protocol resolution module in the Suricata rules set (rules directory);

[0102] Configure the log output module to record DNS requests in eve-log format;

[0103] The log fields should include key elements such as: timestamp, source IP / port, destination IP / port, DNS query domain name, and list of responding IPs.

[0104] In one application scenario, DNS requests can be recorded as shown in Table 2.

[0105]

[0106] Table 2

[0107] Please see Figure 2 In some embodiments, step 102 may include, but is not limited to:

[0108] Step 201: Preprocess the multimodal data to obtain multimodal preprocessed data;

[0109] Step 202: Perform word segmentation on the multimodal preprocessed data to obtain multimodal word segmentation information;

[0110] Step 203: Perform text encoding based on multimodal word segmentation information to obtain a multimodal feature sequence.

[0111] In step 201 of some embodiments, multimodal data is received via Kafka and preprocessed. Specifically, step 201 may include, but is not limited to, the following:

[0112] Multimodal data is consumed in real time via Kafka Consumer. Regular expressions and field mapping rules are used to clean invalid logs (e.g., duplicate content), remove redundant records, and repair missing values. Standardization is then applied to these logs, ensuring data uniformity despite the dispersed nature of the multimodal data sources. Kafka Consumer is the client application in the Kafka messaging system responsible for pulling and processing messages from topics, actively acquiring data using a pull pattern. Data cleaning and format standardization in one application scenario includes filtering garbled characters from logs and mapping Windows event IDs (e.g., account login failure 4625) to unified threat tags.

[0113] In step 202 of some embodiments, multimodal preprocessed data is segmented into token information that the model can recognize, thereby obtaining multimodal segmentation information. For example, the date text in the multimodal preprocessed data is segmented. Furthermore, step 202 may also include, but is not limited to, adding delimiters to the token information, such as adding delimiters like CLS and SEP. Additionally, step 202 may also include, but is not limited to, adding attention masks to mark valid tokens; this application embodiment does not limit this.

[0114] In step 203 of some embodiments, the multimodal word segmentation information is text-encoded to convert it into semantic embedding vectors, thereby obtaining a multimodal feature sequence. Furthermore, to ensure that the vectors from different logs have the same modulus length and to avoid the impact of vector length differences on subsequent model calculations, step 203 also includes standardizing the embedding vectors to obtain vectors with the same modulus length.

[0115] Furthermore, in this embodiment of the application, unstructured log text is embedded and encoded using a pre-trained language model (such as BERT), for example, the log text "Failed login attempt for user admin from 192.168.1.100" is converted into n-dimensional text vector features.

[0116] In this embodiment of the application, in order to implement the time-series feature engineering in step 102, sliding window statistics are performed on relevant indicator data (e.g., CPU / memory) and network traffic data (e.g., requests per second) in the system log data. Specifically, the implementation method may include: using the Flink stream processing engine to calculate the mean / variance within a 30-minute window, and using the volatility of the time-series statistical variables as a metric feature as the input feature for anomaly prediction in step 103.

[0117] In some embodiments, step 103 can employ the Informer model for anomaly prediction. The Informer model is a deep learning model based on an improved Transformer architecture, used to predict long-sequence time series data. The Informer model includes techniques such as Probable Sparse Attention and generative decoders, which significantly reduce computational complexity and improve prediction efficiency.

[0118] Please see Figure 3 In some embodiments, step 103 may include, but is not limited to:

[0119] Step 301: Perform feature alignment based on the multimodal feature sequence to obtain multimodal aligned features;

[0120] Step 302: Standardize the multimodal alignment features to obtain multimodal standardized features;

[0121] Step 303: Perform anomaly prediction based on multimodal standardized features to obtain temporal anomaly features.

[0122] In step 301 of some embodiments, feature alignment of the multimodal feature sequence can be performed based on timestamps. For example, all features in the multimodal feature sequence can be aligned uniformly according to a 10-second sampling interval, with millisecond-level timestamps as indices, to ensure that the same timestamp contains complete temporal features, semantic features, and topological features. For example, in an insurance system, the feature group corresponding to timestamp 1690000000000 is: CPU utilization rate of 85%, QPS of 1200, and log feature vectors with mean values ​​(e.g., 0.32, 0.15, ...).

[0123] In other embodiments, step 103 may include, but is not limited to, integrating feature dimensions and concatenating the corresponding multimodal features into a single time series. For example, using 8 basic time series features (e.g., CPU, memory, QPS, DNS query, policy rate, number of claims, login success rate, number of database connections, etc.), 10 semantic features (e.g., extracting the top 10 key features from log vectors), and 5 topological features (e.g., number of high-vulnerability assets, shortest path, neighbor risk ratio, etc.), a 23-dimensional / 10-second time series is finally formed.

[0124] In step 302 of some embodiments, the multimodal alignment features can be Z-score standardized, for example, each feature dimension can be standardized separately, and the following standardization formula can be used: Standardized value = (Original value - Feature mean) / Feature standard deviation, where the mean and standard deviation are from the historical data of the insurance system over the past 3 months, in order to avoid the impact of differences in units on model training (such as CPU utilization as a percentage, QPS as the number of times).

[0125] In step 303 of some embodiments, the multimodal standardized features are used as input to the Informer model. Anomaly prediction is then performed using the Informer model to predict temporal anomalies, such as those occurring in the next 5 minutes. In one application scenario, the sequence window parameters of the Informer model include the input window length, prediction window length, and sliding step. The input window length can be set to 30 minutes (i.e., 30 × 6 = 180 10-second sampling points) to cover short-cycle fluctuations in insurance business (such as peak policy inquiry periods during the morning rush hour). The prediction window length can be set to 5 minutes (e.g., 30 10-second sampling points), and the sliding step can be set to 10 seconds to ensure that a new input sequence is generated every 10 seconds to meet real-time detection requirements. Specifically, the input sequence with timestamp 1690000000000 contains 180 sampling points from 1690000000000-179×10000 to 16900000000000, to predict 30 sampling points from 1690000000000+1×10000 to 16900000000000+30×10000.

[0126] In step 103 of an application scenario, taking an insurance system suffering a DDoS attack as an example: During a promotional event, an insurance company's online sales platform (such as an insurance APP) suffers an external DDoS attack. The attack traffic causes a sharp increase in the CPU utilization of the core server and a significant decrease in QPS, affecting customer insurance purchase operations. The Informer model receives a 30-minute multimodal feature sequence, which includes: temporal features, semantic features, and topological features. The temporal features include: CPU utilization increasing from the normal 40% to 90%, QPS decreasing from the normal 1000 to 100, and DNS query count increasing from the normal 500 to 2000. The semantic features include: BERT vectors showing a large number of invalid request logs and a surge in connection timeout logs. The topological features include: the number of abnormal IPs connected to the core server increasing from 0 to 50, and the connection status with the load balancer being abnormal. The Informer model predicts the following time-series anomalies over the next 5 minutes: CPU utilization will continue to rise to 95% and QPS will drop to 50. These anomalies deviate significantly from the normal thresholds, thus identifying it as a DDoS attack. The core features of these anomalies are QPS and CPU, both of which show abnormalities. This will trigger a high-risk alert and a coordinated response in subsequent steps. For example, the SOAR platform can invoke the firewall to execute a "traffic scrubbing + rate limiting" policy to block the attack traffic. At the same time, the operations team can be notified to monitor the server to ensure that the insured business returns to normal within 5 minutes, thereby achieving real-time blocking of the attack chain and ensuring business continuity.

[0127] In step 104 of some embodiments, an asset knowledge graph can be constructed based on the Neo4j graph database. See also... Figure 4 In some embodiments, step 104 may include, but is not limited to:

[0128] Step 401: Obtain entity information and entity attribute information of entity information. Entity information includes equipment information of assets and equipment and insurance information of the insurance system.

[0129] Step 402: Determine the graph nodes based on the entity information, and determine the node attributes of the graph nodes based on the entity attribute information;

[0130] Step 403: Obtain entity association relationships based on entity information and use the entity association relationships as the original edges;

[0131] Step 404: Construct an asset knowledge graph based on graph nodes, node attributes, and original edges.

[0132] In step 401 of some embodiments, the entity information of the asset knowledge graph includes entity objects corresponding to asset devices, i.e., device information, such as databases, servers, network devices, cloud hosts, etc., where network devices may include, but are not limited to, switches, routers, firewalls, etc.; the entity information of the asset knowledge graph includes entity objects related to insurance policies in the insurance system, i.e., insurance information, such as insurance contract entities, insurers, policyholders, premiums, etc. In one application scenario, device information may specifically include, but is not limited to, hardware fingerprints (CPU / GPU ID), software environment (operating system version, browser fingerprint), and network identifiers (MAC address, IP address).

[0133] In some embodiments, entity attribute information is used to describe the characteristics of the entity object, which may include, for example, network identifier (MAC address, IP address, etc.), asset type, vulnerability score, operating system version, real-time CPU utilization, etc. The asset type is used to characterize the asset device as a server, network device, or database. The vulnerability score is derived from the Common Vulnerability Scoring System. System (CVSS) provides a severity rating of 0-10 for computer system vulnerabilities using three dimensions: fundamental metrics, time metrics, and environmental metrics. These metrics include core indicators such as attack vector, exploitability, and impact scope, and are dynamically adjusted based on the vulnerability remediation status and organizational environment characteristics. Fundamental metrics reflect the inherent attributes of the vulnerability, including exploitability indicators such as attack vector (e.g., network / neighborhood / local), attack complexity (low / high), and privilege requirements (none / low / high), as well as confidentiality, integrity, and availability impact indicators. Time metrics dynamically assess the vulnerability remediation status, covering dimensions such as exploitability verification code maturity (unverified / proof of concept / exploitable), and patch availability. Environmental metrics adjust the score based on scenario characteristics such as organizational asset value and security requirements; for example, in financial systems, the weight of confidentiality impact can be increased.

[0134] The entity information in step 401 can be used to determine the graph nodes and their node attributes in step 402. Specifically, the entity information is used as the nodes of the asset knowledge graph to obtain the graph nodes, and the entity attribute information is used as the node attributes of the graph nodes.

[0135] Please refer to Table 3 and use Database A, Application Server B, and Load Balancer C as examples to illustrate. Database A is an Oracle database with a CVSS vulnerability score of 9.0, indicating that Database A has an unpatched Oracle Coherence deserialization vulnerability. Application Server B is a Java application server with a CVSS vulnerability score of 7.5, indicating that Application Server B has a WebLogic middleware vulnerability. Load Balancer C is a network device with a CVSS vulnerability score of 5.0, indicating that Load Balancer C has weak TLS 1.0 encryption.

[0136]

[0137] Table 3

[0138] In steps 403 and 404 of some embodiments, entity relationships are used to represent business dependencies, risk transmission relationships, physical connection relationships, etc., between entity objects, and are used as the original edges in the asset knowledge graph. For example, there is a physical connection between core switch C (192.168.1.1) and application server B (192.168.1.10), so the constructed edge structure can be represented as: load balancer C -> application server B; or, there is a service dependency between application server B and database A, so the constructed edge structure can be represented as: application server B -> database server A (JDBC database connection). Therefore, according to step 404, a knowledge graph is constructed from graph nodes, node attributes, and original edges to obtain the asset knowledge graph.

[0139] Please see Figure 5 In some embodiments, step 105 may include, but is not limited to:

[0140] Step 501: Extract the target node from the asset knowledge graph, and obtain the neighbor node by sampling the neighbor based on the target node;

[0141] Step 502: Obtain the original features of neighboring nodes to obtain neighbor features;

[0142] Step 503: Aggregate the neighbor features to obtain the aggregated neighbor features;

[0143] Step 504: Perform feature concatenation based on the target features and neighbor aggregation features of the target node to obtain the node feature vector.

[0144] In step 501 of some embodiments, a target node is extracted from the asset knowledge graph. The target node is a node for risk assessment, such as database server D (192.168.1.10). Then, neighbor sampling is performed based on the target node. The obtained neighbor nodes include two layers, as shown in Table 4, for example, including a first layer of neighbor nodes and a second layer of neighbor nodes.

[0145]

[0146] Table 4

[0147] In step 502 of some embodiments, the original characteristics of neighboring nodes are obtained to obtain neighbor characteristics. For example, the original characteristics of application server B include: number of abnormal logins = 5, CPU slope = 0.8, and the original characteristics of load balancer C include: traffic surge.

[0148] Please see Figure 6 In some embodiments, step 503 may include, but is not limited to:

[0149] Step 601: Perform mean aggregation on the features of the first-layer neighbors to obtain the aggregated features of the first neighbors;

[0150] Step 602: Perform temporal dependency aggregation on the second-layer neighbor features based on the Long Short-Term Memory network to obtain the second-neighbor aggregated features;

[0151] Step 603: Perform a nonlinear transformation on the first neighbor aggregation feature and the second neighbor aggregation feature based on a preset activation function to obtain the neighbor aggregation feature.

[0152] In step 601 of some embodiments, the first-layer neighbor features can be aggregated using a mean aggregator to integrate the original features of neighbor nodes. In step 602 of some embodiments, the Long Short-Term Memory network uses an LSTM aggregator, which can be used to aggregate the second-layer neighbor features based on temporal dependencies to capture the temporal dependencies of neighbor features. In step 603 of some embodiments, the preset activation function can be the LeakyReLU function, which performs a nonlinear transformation on the first and second neighbor aggregate features to obtain a 128-dimensional node vector of neighbor aggregate features.

[0153] In step 504 of some embodiments, the target features of the target node are obtained, and the target features and the neighbor aggregated features are concatenated and input into a fully connected layer for processing to obtain a node feature vector. This node feature vector can be used to represent the risk level, such as low risk, medium risk, and high risk.

[0154] In a specific application scenario, the target node is database server A, and its target feature is [CVSS = 9.0]. The first-layer neighbor features include the original features of application server B and the external attack IP features. The original features of application server B are: [abnormal login count = 5, CPU slope = 0.8], and the external attack IP features are: [threat type = DNS tunnel, request frequency = 120 times / minute]. The first-layer neighbor features are then averaged and aggregated, resulting in the first-layer neighbor aggregated feature representation: [2.5, 0.4, DNS tunnel, 60]. The second-layer neighbor features are the time-series features (traffic surge) of load balancer C, which are encoded using LSTM to obtain a 128-dimensional neighbor aggregated feature vector. Finally, these features are concatenated with the target features of database server A and input into the fully connected layer for processing, resulting in a 128-dimensional node feature vector: [0.7, -0.2, 1.3, ..., 0.9]. This 128-dimensional node feature vector indicates a high-risk situation.

[0155] Please see Figure 7 In some embodiments, step 106 may include, but is not limited to:

[0156] Step 701: Perform dimension alignment based on the multimodal feature sequence, temporal anomaly features, and node feature vectors to obtain dimension-aligned features;

[0157] Step 702: Calculate the weights based on the multimodal feature sequence, temporal anomaly features, and node feature vectors to obtain the feature weights;

[0158] Step 703: Perform feature concatenation based on dimension alignment features to obtain multimodal concatenated features;

[0159] Step 704: Perform weighted fusion of multimodal splicing features based on feature weights to obtain weighted fused features;

[0160] Step 705: Perform risk prediction based on weighted fusion features to obtain a risk score.

[0161] In step 701 of some embodiments, dimension alignment is used to ensure that the multimodal feature sequence, temporal anomaly features and node feature vectors are all of the same dimension, for example, 128 dimensions, so as to facilitate feature splicing in step 703.

[0162] In step 702 of some embodiments, an attention mechanism can be used to calculate the weights of the multimodal feature sequence, temporal anomaly features, and node feature vectors to obtain the feature weight of each feature. This application does not limit this calculation; for example, the feature weight of the multimodal feature sequence is 0.4, the feature weight of the temporal anomaly features is 0.2, and the feature weight of the node feature vector is 0.4. In this embodiment, the feature weights are dynamic. When SQL injection text features are detected, the feature weight of the multimodal feature sequence is increased from 0.4 to 0.6, the feature weight of the temporal anomaly features is decreased to 0.1, and the feature weight of the node feature vector is decreased to 0.3.

[0163] In step 703 of some embodiments, feature concatenation can be performed on the dimension-aligned features based on a distributed gradient boosting algorithm. This distributed gradient boosting algorithm uses the XGBoost (eXtreme Gradient Boosting) algorithm. In one application scenario, the dimension-aligned features include high-risk probabilities, CVSS (9.0), CPU slope, SQL injection markers, etc., among the time-series anomaly features. The multimodal concatenation features are: [0.1, 0.3, 0.6, 9.0, 0.8, 0.75].

[0164] In step 704 of some embodiments, the multimodal splicing features are weighted and summed based on the current feature weights to obtain weighted fused features.

[0165] In step 705 of some embodiments, risk prediction is performed on the weighted fusion features based on XGBoost to obtain a risk score. In one application scenario, the weighted fusion features include: CVSS = 9.0, 5 abnormal logins within 30 minutes, "Failed login for admin" in the log, and a probability of 0.85 for the node feature vector to represent [high risk]. Then, [0.85, 9.0, 5, 0.85] is input into XGBoost for risk prediction, and the final risk score is 92 points.

[0166] In some embodiments, step 106 can be based on a risk assessment model for risk prediction. Specifically, user behavior data and device fingerprint data can be combined to construct a distributed risk assessment model through federated learning, thereby adjusting access control policies in real time. User behavior data may include, but is not limited to, login time, access frequency, operation path, and sensitive command call patterns; device fingerprint data may include, but is not limited to, hardware fingerprints (CPU / GPU ID), software environment (operating system version, browser fingerprint), and network identifiers (MAC address, IP address). The federated learning framework can be built based on the following methods: deploying localized risk assessment model nodes in each branch / business system; encrypting gradient parameters through homomorphic encryption technology; and aggregating encrypted gradients in the cloud to update global model parameters (periodic synchronization, such as daily updates). Specifically, this embodiment does not impose limitations. For example, if an employee accesses sensitive data (such as customer information, policy transactions, etc.) from an unused device outside of working hours, multi-factor authentication (MFA) is triggered, and the user's data export permissions are restricted.

[0167] In one application scenario, real-time adjustment of access control policies may include, but is not limited to: triggering multi-factor authentication (such as SMS verification code + biometric verification) when the risk score is greater than or equal to a preset score; implementing dynamic access control for high-risk access (such as prohibiting data export and limiting API call frequency); automatically creating SOAR tickets and marking risk factors (such as abnormal device model + infrequent access time); where the preset score can be set to, for example, 90.

[0168] Step 106 in this embodiment further includes dynamically adjusting the risk score by combining user behavior data and device fingerprint data. Specifically, it also dynamically adjusts the risk score by combining user behavior data, device fingerprint data, and asset sensitivity weights. User behavior data includes behavior deviation, and device fingerprint data includes device anomaly. The risk score is calculated as α * behavior deviation + β * device anomaly + γ * (asset sensitivity), where α + β + γ = 1. The behavior deviation is the difference between the user's current behavior and the historical baseline (0-100 points), and the device anomaly is the difference between the current access score and the historical baseline. Missing similarity values ​​between the current access device and historical access devices (0-100 points). A similarity of <85% between the current access device and historical access devices can be marked as an anomaly. In one application scenario, user A's historical login time averages 09:40 (μ = 580 minutes) and standard deviation σ = 45 minutes, resulting in a baseline interval for user A of [08:10, 11:10]. If user A is detected logging into the core financial system at 03:30, then the Z-score is calculated as |210 minutes(03:30) - 580| / 4. 5≈8.22, then the deviation of user A's behavior = min(100, 8.22×20) = 100 points; User A's frequently used device fingerprints: iOS16 + Safari + MAC address XX (historical similarity 90%), User A's login device at a certain time: Android13 + Chrome + new MAC address, then the similarity is 40%, so User A's device anomaly score = 100×(1-0.4) = 60 points; Assets include internal announcement system, customer information query platform and underwriting system, The internal announcement system is classified as low sensitivity with a weight γ = 1, the customer information query platform as medium sensitivity with a weight γ = 1.5, and the underwriting system as high sensitivity with a weight γ = 3. If the customer information query platform is attacked recently, the weight γ will be increased from 1.5 to 2. The initial values ​​of α and β are 0.7 and 0.2 respectively. The risk score calculated by combining behavioral deviation, equipment anomaly, and the sensitivity of the underwriting system is 0.7 × 100 + 0.2 × 60 + 3.0 = 70 + 12 + 3.0 = 85 points.

[0169] In some embodiments, step 106 may include, but is not limited to, automating response and collaborative handling based on risk scoring. Specifically, it may include generating dynamic handling strategies. Specifically, dynamic handling strategies are generated through a decision model, which can be trained using reinforcement learning. By learning from historical handling cases in a simulated environment, the optimal handling path is output. These historical handling cases may include, for example, isolating infected hosts, blocking malicious IPs, and rolling back configurations. In one application scenario, when a DDoS attack is detected, the decision model can dynamically select a dynamic handling strategy of traffic scrubbing and rate limiting, rather than directly blocking, thereby avoiding impact on normal business operations. In this embodiment, Prometheus can be used to monitor the handling effect (such as traffic blocking success rate and host isolation time) and collect handling result data (such as false isolation rate and handling time) to feed back into the reinforcement learning model for training. This embodiment can integrate the SOAR platform and use RPA (Robotic Process Automation) to call tools such as firewalls, EDR, and work order systems to achieve second-level isolation of threat nodes, automatic creation of handling work orders, and notification of responsible persons. Specifically, when the risk score exceeds 75, the SOAR platform's automated workflow is triggered. The attack path inferred using CausalGNN (Causal Augmented Graph Neural Network) is used as the basis for handling the situation, and a pre-defined handling strategy library is invoked. SOAR platform orchestration includes: firewall linkage, EDR control, and work order system integration. Firewall linkage can specifically involve: issuing threat IP blocking rules to the firewall via API; EDR control can specifically involve: calling the EDR vendor's SDK to isolate infected hosts; and work order system integration can specifically involve: using an RPA bot to automatically populate event details (including threat type, asset impact range, etc.).

[0170] In one application scenario, modeling historical handling cases includes:

[0171] Construct a knowledge graph for handling cases; specifically, break down historical handling cases into triplets of [threat characteristics -> handling actions -> effect evaluation].

[0172] BERT was used to encode the disposal description text and extract key features such as threat type, asset type, and disposal priority.

[0173] Establish a Markov Decision Process (MDP) model, in which the state space S includes key attributes (such as CVSS score, business importance, etc.), threat stage, resource constraints, etc.

[0174] In one application scenario, building a reinforcement learning framework can include:

[0175] The Proximal Policy Optimization (PPO) algorithm is used to design a dual-network architecture: a policy network and a value function network. The policy network takes the current state s as input and outputs the action probability distribution. The value function network is used to evaluate the long-term disposition benefit of the current state s.

[0176] The action space is defined as a set of atomic disposal operations. Referring to Table 5, the action space is denoted as A, and action space A serves as the set of atomic disposal operations [0, 1, 2, 3, 4]. Here, 0 represents isolating the host (blocking the IP), 1 represents rolling back the configuration to version T-1, 2 represents elevating the access control level, 3 represents initiating honeypot trapping, and 4 represents blocking specific protocol communication. This application's embodiment uses reinforcement learning to train the decision model, learning from historical disposal cases in a simulated environment to output the optimal disposal path.

[0177]

[0178]

[0179] Table 5

[0180] The embodiments of this application also include strategy optimization and verification, which can be: adopting a course learning strategy to gradually transition from simple scenarios (such as single asset disposal) to complex scenarios, introducing an attention mechanism to distinguish the spatiotemporal correlation of disposal actions, and ensuring the generalization ability of the strategy through cross-validation (time series partitioning).

[0181]

[0182] Table 6

[0183] In some embodiments, step 106 may include, but is not limited to, generating a risk prediction report. Specifically, the risk prediction report can be generated based on a large-scale visual language model, which can be the Qwen model. The Qwen model possesses capabilities for image and text recognition, description, question answering, and dialogue. It also has capabilities for visual positioning and text understanding in images, and can be used in scenarios such as knowledge-based question answering, image title generation, image question answering, document question answering, and fine-grained visual positioning. Referring to Table 6, a business narrative report generated based on the Qwen model is shown. This business narrative report, an insurance business risk assessment report, includes four parts: event overview, business impact analysis, handling recommendations, and source tracing analysis.

[0184] This application's embodiments are based on multimodal + AI collaborative perception. By using Informer and GNN models, it achieves correlation analysis of cross-source heterogeneous data, breaking through the limitations of traditional single-point detection and greatly improving the efficiency of threat discovery. This application's embodiments also construct a causal attack chain inference engine based on graph neural networks, shortening the time for locating insurance security threats and thus reducing threat impact. Furthermore, this application's embodiments use reinforcement learning to intelligently generate automatic response mechanisms based on historical handling cases, thereby proactively adapting to new threats and effectively improving security handling efficiency. In addition, this application's embodiments effectively ensure business continuity and meet multi-dimensional compliance requirements through real-time attack chain blocking and dynamic risk assessment, providing risk quantification support for cybersecurity insurance products.

[0185] Please see Figure 8 This application also provides a risk prediction device based on multimodal data, which can implement the above-mentioned risk prediction method based on multimodal data. The device includes:

[0186] The multimodal data acquisition module is used to acquire multimodal data from the insurance system. The multimodal data includes at least two of the following: system log data, network traffic data, and microservice call chain data. The insurance system includes at least one of the following assets: servers, network devices, and databases.

[0187] The multimodal feature extraction module is used to extract features from multimodal data to obtain multimodal feature sequences;

[0188] The anomaly prediction module is used to predict anomalies based on multimodal feature sequences to obtain temporal anomaly features;

[0189] The asset knowledge graph construction module is used to obtain entity information and entity attribute information from the insurance system, and to construct an asset knowledge graph based on the entity information and entity attribute information.

[0190] The graph feature extraction module is used to extract features from asset equipment based on the asset knowledge graph to obtain node feature vectors;

[0191] The risk prediction module is used to predict the risk of the insurance system based on multimodal feature sequences, time-series anomaly features, and node feature vectors.

[0192] In some embodiments, the multimodal feature extraction module can specifically be used to implement:

[0193] The multimodal data is preprocessed to obtain multimodal preprocessed data;

[0194] Multimodal preprocessed data is segmented into words to obtain multimodal word segmentation information;

[0195] Text encoding is performed based on multimodal word segmentation information to obtain multimodal feature sequences.

[0196] Specifically, the multimodal feature extraction module can be used to implement steps 201 to 203 above, which will not be described in detail here.

[0197] In some embodiments, the anomaly prediction module can specifically be used to implement:

[0198] Multimodal aligned features are obtained by aligning features based on multimodal feature sequences.

[0199] The multimodal alignment features are standardized to obtain multimodal standardized features;

[0200] Anomaly prediction is performed based on multimodal standardized features to obtain temporal anomaly features.

[0201] Specifically, the anomaly prediction module can be used to implement steps 301 to 303 above, which will not be described in detail here.

[0202] In some embodiments, the asset knowledge graph construction module can be specifically used to implement:

[0203] Obtain entity information and entity attribute information. Entity information includes equipment information of assets and equipment and insurance information of the insurance system.

[0204] Graph nodes are determined based on entity information, and node attributes are determined based on entity attribute information.

[0205] Obtain entity relationships based on entity information and use these entity relationships as the original edges;

[0206] Construct an asset knowledge graph based on graph nodes, node attributes, and original edges.

[0207] Specifically, the asset knowledge graph construction module can be used to implement steps 401 to 404 above, which will not be elaborated here.

[0208] In some embodiments, the map feature extraction module can specifically be used to implement:

[0209] Obtain entity information and entity attribute information. Entity information includes equipment information of assets and equipment and insurance information of the insurance system.

[0210] Graph nodes are determined based on entity information, and node attributes are determined based on entity attribute information.

[0211] Obtain entity relationships based on entity information and use these entity relationships as the original edges;

[0212] Construct an asset knowledge graph based on graph nodes, node attributes, and original edges.

[0213] Specifically, the map feature extraction module can be used to implement steps 501 to 504 above, which will not be described in detail here.

[0214] In some embodiments, the map feature extraction module can specifically be used to implement:

[0215] The first-layer neighbor features are aggregated by mean aggregation to obtain the first-neighbor aggregated features.

[0216] The second-layer neighbor features are aggregated based on the temporal dependency of the long short-term memory network to obtain the second-neighbor aggregated features.

[0217] The first and second neighbor aggregation features are nonlinearly transformed based on a preset activation function to obtain the neighbor aggregation features.

[0218] Specifically, the map feature extraction module can be used to implement steps 601 to 603 above, which will not be described in detail here.

[0219] In some embodiments, the risk prediction module can specifically be used to implement:

[0220] Dimension alignment is performed based on multimodal feature sequences, temporal anomaly features, and node feature vectors to obtain dimension-aligned features;

[0221] The feature weights are obtained by calculating the weights based on the multimodal feature sequence, temporal anomaly features, and node feature vectors.

[0222] Multimodal spliced ​​features are obtained by concatenating features based on dimension alignment features;

[0223] The multimodal spliced ​​features are weighted and fused based on feature weights to obtain weighted fused features;

[0224] Risk prediction is performed based on weighted fusion features to obtain a risk score.

[0225] Specifically, the risk prediction module can be used to implement steps 701 to 705 above, which will not be described in detail here.

[0226] The specific implementation of this risk prediction device based on multimodal data is basically the same as the specific implementation of the risk prediction method based on multimodal data described above, and will not be repeated here.

[0227] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned risk prediction method based on multimodal data. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0228] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0229] The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0230] The memory 902 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 902 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the risk prediction method based on multimodal data according to the embodiments of this application.

[0231] The input / output interface 903 is used to implement information input and output;

[0232] The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0233] Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904);

[0234] The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0235] This application also provides a storage medium, which is a computer-readable storage medium, storing a computer program that, when executed by a processor, implements the above-described risk prediction method based on multimodal data.

[0236] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0237] The risk prediction method, apparatus, device, and storage medium based on multimodal data provided in this application acquire multimodal data from an insurance system, including at least two types: system log data, network traffic data, and microservice call chain data. Feature extraction is performed on the multimodal data to obtain a multimodal feature sequence. Anomaly prediction is then performed based on this multimodal feature sequence to obtain temporal anomaly features. An asset knowledge graph is constructed based on entity information and entity attribute information. Features are then extracted from the asset knowledge graph to obtain node feature vectors. This facilitates risk prediction of the insurance system based on the multimodal feature sequence, temporal anomaly features, and node feature vectors, enabling cross-source heterogeneous data correlation analysis. This overcomes the limitations of traditional single-point detection, improving the efficiency and accuracy of risk prediction. This application embodiment, based on multimodal + AI collaborative perception, uses Informer and GNN models to achieve cross-source heterogeneous data correlation analysis, overcoming the limitations of traditional single-point detection and significantly improving the efficiency and accuracy of threat detection. This application also effectively ensures business continuity and meets multi-dimensional compliance requirements by blocking attack chains in real time and conducting dynamic risk assessments, providing risk quantification support for cybersecurity insurance products.

[0238] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0239] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0240] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0241] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0242] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0243] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0244] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0245] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0246] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0247] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0248] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A risk prediction method based on multimodal data, characterized in that, The method includes: Acquire multimodal data from the insurance system, wherein the multimodal data includes at least two of the following: system log data, network traffic data, and microservice call chain data, and the insurance system includes at least one of the following asset devices: server, network device, and database; Feature extraction is performed on the multimodal data to obtain a multimodal feature sequence; Anomaly prediction is performed based on the multimodal feature sequence to obtain temporal anomaly features; Obtain entity information and entity attribute information from the insurance system, and construct an asset knowledge graph based on the entity information and entity attribute information; Based on the asset knowledge graph, feature extraction is performed on the asset equipment to obtain node feature vectors; Risk prediction is performed on the insurance system based on the multimodal feature sequence, the temporal anomaly features, and the node feature vector.

2. The method according to claim 1, characterized in that, The anomaly prediction based on the multimodal feature sequence, to obtain temporal anomaly features, includes: Based on the multimodal feature sequence, feature alignment is performed to obtain multimodal aligned features; The multimodal alignment features are standardized to obtain the multimodal standardized features; Anomaly prediction is performed based on the multimodal standardized features to obtain the temporal anomaly features.

3. The method according to claim 1, characterized in that, The step of obtaining entity information and entity attribute information from the insurance system, and constructing an asset knowledge graph based on the entity information and entity attribute information, includes: Obtain entity information and entity attribute information of the entity information; wherein, the entity information includes equipment information of the asset equipment and insurance information of the insurance system; Graph nodes are determined based on the entity information, and the node attributes of the graph nodes are determined based on the entity attribute information. The entity association relationship is obtained based on the entity information, and the entity association relationship is used as the original edge; The asset knowledge graph is constructed based on the graph nodes, the node attributes, and the original edges.

4. The method according to claim 1, characterized in that, The feature extraction of assets and equipment based on the asset knowledge graph to obtain node feature vectors includes: Target nodes are extracted from the asset knowledge graph, and neighbor nodes are obtained by sampling neighbors based on the target nodes; Obtain the original features of the neighboring nodes to obtain the neighbor features; The neighbor features are aggregated to obtain the neighbor aggregate features; The node feature vector is obtained by concatenating the target features of the target node and the neighbor aggregation features.

5. The method according to claim 4, characterized in that, The neighbor features include first-layer neighbor features and second-layer neighbor features. The aggregation process of the neighbor features to obtain aggregated neighbor features includes: The first-layer neighbor features are aggregated by mean calculation to obtain the first neighbor aggregated features; Based on the Long Short-Term Memory network, the second-layer neighbor features are subjected to temporal dependency aggregation to obtain the second-neighbor aggregated features; The first neighbor aggregation feature and the second neighbor aggregation feature are nonlinearly transformed based on a preset activation function to obtain the neighbor aggregation feature.

6. The method according to any one of claims 1 to 5, characterized in that, The step of predicting risk in the insurance system based on the multimodal feature sequence, the temporal anomaly features, and the node feature vector includes: Dimension alignment is performed based on the multimodal feature sequence, temporal anomaly features, and node feature vectors to obtain dimension-aligned features; The feature weights are obtained by calculating the weights based on the multimodal feature sequence, temporal anomaly features, and node feature vectors. Based on the dimensional alignment features, feature concatenation is performed to obtain multimodal concatenated features; The multimodal splicing features are weighted and fused based on the feature weights to obtain weighted fused features; Risk prediction is performed based on the weighted fusion features to obtain a risk score.

7. The method according to any one of claims 1 to 5, characterized in that, The step of extracting features from the multimodal data to obtain a multimodal feature sequence includes: The multimodal data is preprocessed to obtain multimodal preprocessed data; The multimodal preprocessed data is segmented into words to obtain multimodal word segmentation information; Text encoding is performed based on the multimodal word segmentation information to obtain the multimodal feature sequence.

8. A risk prediction device based on multimodal data, characterized in that, The device includes: A multimodal data acquisition module is used to acquire multimodal data from an insurance system. The multimodal data includes at least two of the following: system log data, network traffic data, and microservice call chain data. The insurance system includes at least one of the following asset devices: servers, network devices, and databases. A multimodal feature extraction module is used to extract features from the multimodal data to obtain a multimodal feature sequence; Anomaly prediction module is used to predict anomalies based on the multimodal feature sequence to obtain temporal anomaly features; An asset knowledge graph construction module is used to obtain entity information and entity attribute information from the insurance system, and construct an asset knowledge graph based on the entity information and entity attribute information. The graph feature extraction module is used to extract features from the asset equipment based on the asset knowledge graph to obtain node feature vectors; The risk prediction module is used to predict the risk of the insurance system based on the multimodal feature sequence, the temporal anomaly features, and the node feature vector.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images