Enterprise risk early warning method and device based on big data, equipment and medium

Abstract

The invention relates to an enterprise risk early warning method and device based on big data, equipment and a medium. The method comprises the following steps: respectively extracting time dynamic characteristics and space topological characteristics of nodes through a dynamic heterogeneous risk map, and generating unified space-time embedding representation through cross-modal fusion; an event logic enhanced nonlinear propagation effect of a dynamic heterogeneous graph attention network modeling risk event is adopted, and enhanced node representation and global representation are output; calculating the deviation between the node and the community mean value through topological residual detection to obtain a topological residual score, and calculating the minimum similarity between the node and the known risk prototype through similarity analysis to obtain a representation similarity score; the two scores are linearly combined and normalized to generate an unknown risk score, and a known risk probability is calculated based on a pre-training model; the comprehensive risk index is obtained through maximum value operation, comprehensive monitoring and early warning of known and unknown risks of an enterprise are achieved, and the coverage range, accuracy and timeliness of risk identification are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of computer science and artificial intelligence technology, and in particular relates to a method, device, equipment and medium for enterprise risk early warning based on big data. Background Technology

[0002] With the rapid development of big data and artificial intelligence technologies, enterprise risk early warning systems have shifted from traditional statistical analysis to intelligent early warning models based on deep learning. However, existing enterprise risk early warning technologies still have significant limitations when facing an increasingly complex and volatile economic environment.

[0003] First, while static knowledge graph methods can represent known relationships between enterprises, they struggle to capture the dynamic evolution of risk factors. As mentioned earlier, traditional knowledge graph completion methods primarily address the prediction of known relationship types, but are insufficient in predicting novel risk events that have never appeared in the graph before. This limitation is particularly pronounced when facing "unknown risks" such as new supply chain risks and sudden market fluctuations.

[0004] Secondly, the lack of logical reasoning ability is another shortcoming of existing methods. Most graph neural networks update node representations through neighborhood aggregation, but they are insufficient in modeling the logical connections between different types of risk events. It is pointed out that document-level relation extraction requires multi-sentence reasoning; similarly, enterprise risk warning also needs to understand the logical evolution of event chains, such as how "executive resignation" triggers a chain reaction of "stock price decline" leading to "financing difficulties".

[0005] Furthermore, the lack of an unknown risk identification mechanism is a core deficiency of existing systems. These systems typically can only identify risks of known categories, and are insensitive to the "emergence" of entirely new risk patterns. Although the proposed anomaly detection method can identify anomalous nodes in the attribute graph, it is not specifically designed for the characteristics of "unknown risks" in enterprise risk warnings. Summary of the Invention

[0006] Therefore, it is necessary to provide a method, device, equipment, and medium for enterprise risk early warning based on big data to address the aforementioned technical issues.

[0007] Firstly, this application provides a big data-based enterprise risk early warning method, including:

[0008] S1. Based on multi-source enterprise data, a dynamic heterogeneous enterprise risk map is constructed through data preprocessing and event extraction processing, including enterprise entity nodes, risk event nodes, and environmental factor nodes.

[0009] S2. Based on the dynamic heterogeneous enterprise risk map, the temporal dynamic features of the nodes are extracted by the temporal encoder and the spatial topological features of the nodes are extracted by the graph structure encoder. The cross-modal fusion mechanism is used to fuse the temporal dynamic features and spatial topological features to generate a unified spatiotemporal embedding representation.

[0010] S3. Based on spatiotemporal embedding representation, a dynamic heterogeneous graph attention network enhanced by event logic is used to model the nonlinear impact of risk events on the state and relationships of enterprise nodes, and output enhanced node representation and enhanced global graph representation.

[0011] S4. Based on enhanced node representation and enhanced graph global representation, the deviation between the node representation and the mean of its community is calculated by topological residual detection to generate a topological residual score, and the minimum similarity between the node representation and the known risk prototype is calculated by similarity analysis to generate a representation similarity score.

[0012] S5. Based on topological residual scores and representation similarity scores, unknown risk scores are generated through linear combination and normalization; based on enhanced node representations, the probability of known risks is calculated through a pre-trained risk prediction model.

[0013] S6. Based on the unknown risk score and the known risk probability, generate a comprehensive risk index by calculating the maximum value; when the comprehensive risk index exceeds the threshold, output enterprise risk warning information.

[0014] Secondly, this application also provides a big data-based enterprise risk early warning device for implementing the method described in the first aspect, the device comprising:

[0015] The dynamic risk map generation module is used to construct a dynamic heterogeneous enterprise risk map based on multi-source enterprise data, through data preprocessing and event extraction processing, including enterprise entity nodes, risk event nodes, and environmental factor nodes;

[0016] The spatiotemporal feature fusion engine is used to extract the temporal dynamic features of nodes based on dynamic heterogeneous enterprise risk maps through a temporal encoder and extract the spatial topological features of nodes through a graph structure encoder; it uses a cross-modal fusion mechanism to fuse the temporal dynamic features and spatial topological features to generate a unified spatiotemporal embedding representation.

[0017] The Risk Impact Dynamic Modeling Module is used to model the nonlinear impact of risk events on the state and relationships of enterprise nodes based on spatiotemporal embedding representation and through an event logic-enhanced dynamic heterogeneous graph attention network, and outputs enhanced node representation and enhanced global graph representation.

[0018] The risk anomaly quantification module is used to calculate the deviation between the node representation and the mean of its community based on the enhanced node representation and the enhanced graph global representation, generate the topological residual score by topological residual detection, and calculate the minimum similarity between the node representation and the known risk prototype by similarity analysis, generating the representation similarity score.

[0019] The risk probability assessment module is used to generate unknown risk scores based on topological residual scores and representation similarity scores through linear combination and normalization; and to calculate known risk probabilities based on enhanced node representations using a pre-trained risk prediction model.

[0020] The intelligent early warning decision module is used to generate a comprehensive risk index based on the unknown risk score and the known risk probability by calculating the maximum value; when the comprehensive risk index exceeds the threshold, it outputs enterprise risk warning information.

[0021] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a big data-based enterprise risk warning method as described in the first aspect.

[0022] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a big data-based enterprise risk warning method as described in the first aspect.

[0023] The aforementioned big data-based enterprise risk early warning method, device, equipment, and medium construct a dynamic heterogeneous enterprise risk map containing enterprise entities, risk events, and environmental factors. It extracts the temporal dynamic features and spatial topological features of nodes using a temporal encoder and a graph structure encoder, respectively, and then fuses these features into a unified spatiotemporal embedding representation through a cross-modal fusion mechanism. Next, it models the nonlinear impact of risk events on node states and relationships using an event logic-enhanced dynamic heterogeneous graph attention network, outputting enhanced node and global representations. Based on these enhanced representations, it calculates the deviation between nodes and community means using topological residual detection to generate topological residual scores, and calculates representation similarity scores by calculating the minimum similarity between nodes and known risk prototypes through similarity analysis. Then, it combines these scores through linear combination and normalization to obtain unknown risk scores, while simultaneously calculating known risk probabilities using a pre-trained model. Finally, it generates a comprehensive risk index based on the maximum value of the unknown risk scores and known risk probabilities. When the index exceeds a threshold, it outputs early warning information, thereby achieving comprehensive and accurate early warning of both known and unknown enterprise risks, improving the coverage and timeliness of risk identification. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A flowchart illustrating a big data-based enterprise risk early warning method provided by this invention;

[0026] Figure 2 This is a schematic diagram illustrating the process of outputting enhanced node representations and enhanced global graph representations in an optional embodiment of the present invention;

[0027] Figure 3 This is a schematic diagram of the structure of an enterprise risk early warning device based on big data, provided by the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0029] refer to Figure 1 The document presents a flowchart illustrating a big data-based enterprise risk warning method provided in this application, which includes the following steps:

[0030] S1. Based on multi-source enterprise data, a dynamic heterogeneous enterprise risk map is constructed through data preprocessing and event extraction processing, including enterprise entity nodes, risk event nodes, and environmental factor nodes.

[0031] Specifically, multi-source data includes internal structured data (transaction logs, lending activities, financial statements, etc.), publicly available external relational data (shareholder ownership ratios, supply chain transaction records, etc.), and environmental data (industry policy documents, regional economic indicators, etc., in text or numerical form). The data scale needs to ensure the richness of the data map. A layered processing strategy is adopted in the data preprocessing stage. For numerical fields (such as revenue growth rate), outliers are detected using box plots, and after deleting outlier records, null values ​​are filled with the mean. Fields with high null value rates are directly removed. For character fields (such as the industry to which the company belongs), One-Hot encoding is used to convert them into numerical vectors, and null values ​​are filled with independent encodings. For unstructured text data (such as risk events in news reports), the BERT-CRF model is used for event extraction. Extracted elements include event type (such as "executive resignation," "debt default"), trigger words (such as "resignation," "overdue"), participating entities (involved companies, related parties), and the time of occurrence.

[0032] The graph node design includes three categories: enterprise entity nodes (attributes include enterprise ID, industry classification, financial indicators, etc.), risk event nodes (attributes include event type, occurrence time, and scope of impact), and environmental factor nodes (attributes include factor type, numerical change trend, and effective time). Node relationships are defined according to business logic, such as the "affected" relationship between enterprises and events, the "equity control" and "supply chain dependence" relationships between enterprises, and the "impact" relationship between environmental factors and enterprises. Dynamism is achieved through a time-slicing mechanism, which performs incremental data updates at fixed time intervals, synchronously updating node attributes and relationship weights. For example, the supply chain relationship weight is dynamically adjusted based on the transaction frequency within a certain period, using the ratio of transaction frequency to the maximum frequency threshold.

[0033] S2. Based on the dynamic heterogeneous enterprise risk map, the temporal dynamic features of the nodes are extracted by the temporal encoder and the spatial topological features of the nodes are extracted by the graph structure encoder. The cross-modal fusion mechanism is used to fuse the temporal dynamic features and spatial topological features to generate a unified spatiotemporal embedding representation.

[0034] Specifically, the time-series encoder uses the TimeMixer++ architecture to extract multi-scale temporal dynamic features. In practice, the temporal attributes of each node (such as a company's revenue within a certain period, or the value of environmental factors within a certain period) are divided into multiple scales according to time granularity (day, week, month). The Multi-Resolution Temporal Imaging (MRTI) module folds each scale of time series into a 2D time-series graph (such as folding monthly data into a matrix of a specific dimension). The Time Series Graph Decomposition (TID) module adopts a bidirectional attention mechanism: horizontal axis attention extracts trend features (setting a specific window size), and vertical axis attention extracts seasonal features (setting a specific period). Then, the Multi-Scale Hybridization (MCM) module aggregates seasonal features through convolution operations and refines trend features through deconvolution operations, finally outputting a temporal dynamic feature vector of a specific dimension.

[0035] The graph structure encoder employs a Gaussian-perturbation-enhanced graph attention network (DEGAT) and designs a multi-relation attention mechanism for heterogeneous graphs. Learnable relation transformation matrices (with specific dimensions) are set for different types of relations (e.g., firm-firm, firm-event, etc.). Relation type embeddings are introduced when calculating attention weights, as shown in the following formula:

[0036]

[0037] in, This represents the original attention weights of node i and node j under relation type r; LeakyReLU is the activation function used to introduce non-linear feature transformation to avoid the linear limitations in the feature mapping process. This is the transpose of the attention vector, used to perform a linear transformation on the concatenated feature vector to achieve the initial calculation of the attention weights; This is the node feature weight matrix, used for dimension mapping and feature enhancement of node features, making the node features more suitable for subsequent attention calculations. is the original feature vector of node i, which contains the node's attribute information and basic features after preprocessing; Let j be the original feature vector of node j, and... The structure is consistent, used to reflect the characteristic differences between nodes; is the relation type weight matrix, used to perform dimensional mapping and feature enhancement on relation type features, highlighting the impact of different relation types on node interactions; r is the relation type feature vector between node i and node j, used to distinguish different node association patterns; This is a feature vector concatenation operation used to combine the mapping features and relation type mapping features of node i with the mapping features of node j into a unified feature vector, providing complete input for subsequent attention weight calculation. After parallel computation by multiple attention heads, the vectors are concatenated to generate spatial topological features of a specific dimension.

[0038] Cross-modal fusion employs an attention-weighted fusion mechanism, first calculating temporal features. Spatial features correlation matrix Attention weights A are obtained by Softmax normalization, and features are then fused. Then, through residual connection LayerNorm processing is used to generate a unified-dimensional spatiotemporal embedding representation. This is the time-dynamic feature vector output by the time encoder. Let C be the spatial topological feature vector output by the graph encoder, C be the correlation matrix, used to measure the degree of correlation between temporal features and spatial features; A be the attention weight matrix, used to allocate the contribution ratio of temporal features and spatial features in the fusion process; and I be the identity matrix, used to ensure the basic proportion of temporal features in the fusion process. The fused spatiotemporal embedding representation vector is processed by LayerNorm to normalize the fused features, preventing feature values ​​from being too large or too small and affecting subsequent model calculations.

[0039] S3. Based on spatiotemporal embedding representation, a dynamic heterogeneous graph attention network enhanced by event logic is used to model the nonlinear impact of risk events on the state and relationships of enterprise nodes, and outputs enhanced node representations and enhanced global graph representations.

[0040] Specifically, a risk event logic rule base is first constructed, covering various industry verification rules (such as "executive resignation → stock price decline → financing difficulties," etc.). Each rule includes a premise event, a conclusion event, and causal strength. The network structure adds a logical attention layer to the DEGAT framework. For event chains in the graph that conform to the rules (such as node A experiencing "executive resignation" and node B experiencing "stock price decline" with a correlation), the logical matching degree is calculated using the following formula:

[0041]

[0042] Where m is the logical matching degree of the event chain, which is used to measure the degree of fit between the event chain and the logical rules in the rule base; This represents the summation operation on K relationships in an event chain; The rule weight corresponding to the k-th association is set according to the industry verification credibility of the rule; As an indicator function, when the association relationship The function value is 1 if the rule belongs to the rule set R in the rule base, and 0 otherwise. Let R be the k-th association in the event chain, and R be the set of all associations corresponding to rules in the rule base. The matching degree is incorporated into the edge weight update, and the update formula is: ( (where is the matching degree influence coefficient), For the updated edge weights, The original edge weights before the update are used to reflect the impact of the event chain logic on the strength of the association between nodes.

[0043] Dynamic modeling is achieved through time-step iteration, with a fixed duration as each time step, updating the adjacency matrix based on new events. If a specific type of risk event is added (such as "supply chain disruption"), temporary edges (with specific weights and durations) are added between the involved companies. Nonlinear impact modeling uses a fully connected layer with the GELU activation function, inputting the spatiotemporal embedding and logical features as shown in the following formula:

[0044]

[0045] in, is the enhanced node representation vector for node i, used to reflect the node features after the fusion of logical and spatiotemporal features; GELU is the activation function, which has adaptive activation characteristics and can better capture nonlinear features; This is the weight matrix of the fully connected layer, used to perform linear transformation and feature mapping on the concatenated feature vectors; Let be the spatiotemporal embedding representation vector of node i. Let be the logical matching degree vector associated with node i. This is a feature vector concatenation operation that combines spatiotemporal features and logical features into a complete input. This is the bias term for the fully connected layer, used to adjust the baseline value of the feature map.

[0046] The global representation is generated by attention pooling of the augmented node representations. The attention weights are determined by the node degree and the number of associations with risk events. The final output includes augmented node representations and augmented graph global representations in a specific dimension. During model training, a cross-entropy loss function is used, and a regularization term is introduced to suppress overfitting. The regularization formula is as follows:

[0047]

[0048] in, This is a regularization term used to constrain the size of model parameters and avoid overfitting. This is the regularization coefficient, used to control the degree of influence of the regularization term; is the L2 norm of the weight matrix W, used to measure the parameter size of the weight matrix; This represents the summation of the squared L2 norms of all weight matrices W in the model. During training, a specific batch size and number of iterations are set, and the learning rate decays using a cosine annealing strategy.

[0049] S4. Based on enhanced node representation and enhanced graph global representation, the deviation between the node representation and the mean of its community is calculated by topological residual detection to generate a topological residual score. The minimum similarity between the node representation and the known risk prototype is calculated by similarity analysis to generate a representation similarity score.

[0050] Specifically, the topology residual detection first uses the Louvain algorithm to divide the enhanced graph into communities, setting resolution parameters and a minimum community size. The division criteria include node type, industry attributes, and topology connection density. When calculating the community mean vector, a weighted average is used for enterprise entity node communities, as shown in the following formula:

[0051]

[0052] in, Let be the mean vector of community c, used to represent the average feature level of nodes within the community; This represents the summation operation performed on all nodes i within community c; Let i be the degree of node i (i.e., the number of edges connected to node i in the graph). The square root of the degree of node i is used as a weighting coefficient for node features, reflecting the impact of node degree on the community mean. Let be the enhanced node representation vector of node i, containing comprehensive feature information of the node. An arithmetic mean is applied to the event and environmental factor node communities; the formula for the arithmetic mean is: ,in This represents the count of the number of nodes within community c. The meanings of the other parameters are consistent with the weighted average formula.

[0053] The topological residual score is obtained by normalizing the Euclidean distance between the node representation and the community mean, as shown in the following formula:

[0054]

[0055] in, Let be the topological residual score of node i, with a value range of [0,1]. The larger the value, the higher the degree of topological anomaly of the node. Let be the Euclidean distance between the augmented node representation vector of node i and the mean vector of community c, which is used to measure the difference between the node and the average level of the community. The maximum value of the Euclidean distance between the augmented node representation vector of all nodes j in community c and the community mean vector is used to normalize the Euclidean distance of node i so that the residual score is in a uniform range.

[0056] Similarity analysis requires the pre-construction of a known risk prototype library. Typical features of multiple known risks (such as credit default and liquidity risk) are extracted from historical risk cases, with each prototype being a specific-dimensional vector (e.g., a prototype for a certain risk is generated by averaging the enhanced node representations of multiple companies with that risk). The cosine similarity between a node and its prototype is calculated using the following formula:

[0057]

[0058] in, Let be the cosine similarity between node i and the known risk prototype of the kth class, with a value range of [-1, 1]. The larger the value, the higher the similarity between the node and the risk prototype of that class. The augmented node representation vector of node i and the prototype vector of the k-th risk class The dot product is used to measure how much two vectors are in the same direction; Enhance the L2 norm of the node representation vector for node i. Let L2 norm be the L2 norm of the k-th risk prototype vector. The product of L2 and L2 norm is used to normalize the vector dot product, ensuring the similarity result is within a reasonable range. The minimum similarity value is taken as the similarity score. (K is the number of known risk categories), after linear transformation Mapped to the [0,1] interval, a larger value indicates a greater difference between the node and the known risk. The similarity score is the value after mapping.

[0059] S5. Based on the topological residual score and representation similarity score, an unknown risk score is generated through linear combination and normalization. Based on the enhanced node representation, the probability of known risks is calculated through a pre-trained risk prediction model.

[0060] Specifically, the unknown risk score is obtained by linearly combining the topological residual score and the representation similarity score, using the following formula:

[0061]

[0062] in, Let be the unknown risk score of node i, which measures the likelihood that the node faces unknown risks; These are the weighting coefficients for the topological residual fractions. To represent the weighting coefficients of the similarity scores, both are optimized and determined on the validation set using a grid search method, and satisfy the following conditions: ; Let be the topological residual fraction of node i. Let be the similarity score of the representation after mapping node i.

[0063] The normalization process uses Min-Max normalization, as shown in the following formula:

[0064]

[0065] in, This is the normalized unknown risk score, with a value range of [0,1]. To find the minimum unknown risk score for all nodes in the training set. To obtain the maximum value of the unknown risk scores for all nodes in the training set, the original unknown risk scores are scaled using both methods to ensure that the unknown risk scores of different nodes are comparable.

[0066] The known risk prediction model employs a pre-trained XGBoost model. The pre-training data includes enterprise samples (with risk labels) within a specific period. Input features are concatenated vectors (specific dimensions) of augmented node representations and key financial indicators (such as debt-to-equity ratio and current ratio). The model structure is configured with the number of decision trees, maximum depth, and learning rate. Chi-square binning is used to discretize continuous features (each feature is divided into a specific number of bins), which are then converted into predictive variables using WOE encoding. The prediction output is a probability distribution of multiple known risks; the maximum value is taken as the final probability of the known risk. ,in Let be the known risk probability of node i, used to measure the likelihood that the node faces a known risk. Model evaluation uses AUC (Area Under the Receiver Operating Characteristic) and Kolmogorov-Smirnov (KS) metrics to ensure that the model's predictive performance reaches a high level.

[0067] S6. Based on the unknown risk score and the known risk probability, generate a comprehensive risk index by calculating the maximum value; when the comprehensive risk index exceeds the threshold, output enterprise risk warning information.

[0068] Specifically, the comprehensive risk index uses a maximum value calculation to combine the unknown risk score with the known risk probability, as shown in the following formula:

[0069]

[0070] in, This is the comprehensive risk index for node i, used to comprehensively measure the overall risk level faced by the node; This is a maximum value function used to select the larger value between the unknown risk score and the known risk probability, effectively capturing two types of high-risk scenarios: "unknown risk budding" and "known risk outbreak". This is the normalized score for unknown risks. The probability of the known risk.

[0071] The threshold was determined using ROC curve analysis. The point with the highest Youden index (sensitivity + specificity - 1) on the test set (containing a certain number of enterprise samples) was selected as the optimal threshold. When the threshold is exceeded, an early warning is triggered. The early warning information adopts a three-level structure of "risk level - triggering factor - scope of impact". The risk level refers to a multi-level classification standard, with different comprehensive risk index intervals corresponding to different risk levels (e.g., lower intervals correspond to general risk, medium intervals correspond to major risk, and higher intervals correspond to extremely high risk). The triggering factor is clearly marked as either dominated by unknown risks (residual scores are at a high level) or dominated by known risks (e.g., the probability of a certain type of known risk is at a high level). The scope of impact is combined with the topological analysis of the graph to output the number of affected related enterprises and their geographical distribution.

[0072] Warning information is pushed to the enterprise risk control system in real time via API interface, and a visual report (including risk propagation path diagram and abnormal indicator list) is generated. It supports filtering and viewing by business area (multiple main processes) and geographical dimension (province / city) to meet the needs of "precise positioning and differentiated control".

[0073] The aforementioned big data-based enterprise risk early warning method constructs a dynamic heterogeneous enterprise risk map containing enterprise entities, risk events, and environmental factors. It extracts the temporal dynamic features and spatial topological features of nodes using a temporal encoder and a graph structure encoder, respectively, and then fuses these features into a unified spatiotemporal embedding representation through a cross-modal fusion mechanism. Next, it uses an event-logic-enhanced dynamic heterogeneous graph attention network to model the nonlinear impact of risk events on node states and relationships, outputting enhanced node and global representations. Based on these enhanced representations, it calculates the deviation between nodes and community means using topological residual detection to generate topological residual scores, and calculates representation similarity scores by calculating the minimum similarity between nodes and known risk prototypes through similarity analysis. Then, it combines these scores through linear combination and normalization to obtain unknown risk scores, while simultaneously calculating known risk probabilities using a pre-trained model. Finally, it generates a comprehensive risk index based on the maximum value of the unknown risk scores and known risk probabilities. When the index exceeds a threshold, it outputs an early warning message, thus achieving comprehensive and accurate early warning of both known and unknown enterprise risks, improving the coverage and timeliness of risk identification.

[0074] In one optional embodiment, based on a dynamic heterogeneous enterprise risk graph, temporal dynamic features of nodes are extracted using a temporal encoder, and spatial topological features of nodes are extracted using a graph structure encoder; a cross-modal fusion mechanism is used to fuse the temporal dynamic features and spatial topological features to generate a unified spatiotemporal embedding representation, including the following steps:

[0075] S11. Based on the multivariate time series data of each enterprise node within the time window, a forward hidden state sequence is generated through forward propagation processing using a bidirectional LSTM network; a backward hidden state sequence is generated through backward propagation processing using a bidirectional LSTM network based on the multivariate time series data; and a bidirectional hidden state sequence is generated through state concatenation processing based on the forward and backward hidden state sequences.

[0076] Specifically, an input matrix is ​​constructed based on the multivariate time series data of each enterprise node within a time window. This multivariate time series data covers the dynamic attribute indicators of the enterprise nodes, including but not limited to financial indicators (revenue, profit, debt-to-equity ratio, etc.), operational indicators (order volume, capacity utilization, etc.), and correlation interaction indicators (frequency of transactions with upstream and downstream enterprises, participation in related events, etc.). The time window is set according to the characteristics of the enterprise risk evolution cycle to ensure coverage of the critical time interval from the emergence to the manifestation of risk. The bidirectional LSTM network consists of two independent modules: a forward LSTM and a backward LSTM. They share input data but process in opposite directions.

[0077] The forward LSTM module performs forward propagation processing according to the chronological order of data within the time window (from earlier to more recent). Its core mechanism updates the cell state and hidden state through the synergistic action of the forget gate, input gate, and output gate: the forget gate filters historical information (such as valuable parts of a company's historical financial trends that are relevant to current risk assessment) based on the input data and the hidden state at the previous time step. The formula is as follows: The input gate determines the new information that needs to be updated at the current moment (such as a sudden fluctuation in a company's recent transactions). The formula is as follows: Simultaneously, through candidate cell states Storing new information; the output gate controls the proportion of the cell state outputting to the hidden state, ultimately generating the forward hidden state. ,in This is a forward-facing cell state. The output value of the forward output gate. Here, is the Sigmoid activation function, and tanh is the hyperbolic tangent activation function. , , , These are the weight matrices for the forget gate, input gate, candidate cell state, and output gate, respectively. , , , These are the corresponding bias terms. This is the previous forward-hidden state. The input vector is the multivariate time series data at the current time. After iterating through all time points within the time window, the forward hidden state sequence is obtained. (T represents the number of moments within the time window).

[0078] The backward LSTM module performs backward propagation processing on the data within the time window in reverse order (from most recent to earliest). Its structure is consistent with the forward LSTM, only the data processing direction is reversed. It generates the backward hidden state sequence through the same gating mechanism. ,in This represents the backward hidden state at the current reverse time step. The state concatenation process, for each corresponding time step within the time window, concatenates the forward and backward hidden states along their vector dimensions; that is, for time step t, the bidirectional hidden state... ( (This is a vector concatenation operation), which generates a bidirectional hidden state sequence after traversing all time points. This sequence contains both information about the impact of historical data on the current state and information about the retrospective correlation between future data (relative to forward processing) and the current state, laying the foundation for subsequent time series feature extraction.

[0079] S12. Based on the bidirectional hidden state sequence, the importance weight of each time step is calculated through a temporal self-attention mechanism to generate an attention-weighted temporal embedding representation.

[0080] Specifically, the input feature matrix of the temporal self-attention mechanism is constructed based on the bidirectional hidden state sequence H generated by S11. First, the bidirectional hidden state sequence H is reshaped into a feature matrix. ( The dimension of the bidirectional hidden state is the sum of the dimensions of the forward and backward hidden states, where each row corresponds to the bidirectional hidden state at a time within the time window, and each column corresponds to a feature dimension. The temporal self-attention mechanism captures the dependencies between different time steps by constructing query vectors, key vectors, and value vectors, thereby determining the contribution weight of each time step to the overall temporal features.

[0081] The query vector matrix Q, key vector matrix K, and value vector matrix V are generated by performing a linear transformation on the feature matrix X using three independent learnable weight matrices, as shown in the formulas below. , , ,in , , Weight matrices for query, key, and value, respectively. For the attention dimension, (where the dimension is the value vector). The attention weights are calculated using a scaled dot product attention mechanism. First, the dot product similarity between the query vector and the key vector is calculated, using the formula: ,in For a similarity matrix, the elements are... This represents the similarity between the query vector at time t and the key vector at time t', divided by... Can avoid due to An excessively large value leads to an excessively large dot product result, which in turn affects the stability of the gradient after Softmax normalization.

[0082] The similarity matrix S is subjected to Softmax normalization to obtain the attention weight matrix. ,in ,element Let represent the contribution weight of the information at time t' to the temporal features at time t, satisfying ... Attention-weighted temporal embeddings are generated by a weighted sum of the weight matrix and the value vector matrix, as shown in the formula. ( (For the value vector matrix at row t'), after traversing all time points, the temporal embedding representation sequence is obtained. To further enhance the expressive power of temporal features, a multi-head self-attention mechanism can be employed. This involves executing the above process in parallel M times (M being the number of attention heads), resulting in M ​​temporal embedding representation sequences. These M sequences are then concatenated and linearly transformed using a learnable weight matrix to finally generate the attention-weighted temporal embedding representation. ( (As the final dimension of time series embedding), this representation can effectively focus on key moment information that impacts enterprise risk within a time window, such as sudden transaction fluctuations and policy changes.

[0083] S13. Based on the topology of the dynamic heterogeneous enterprise risk map, extract node degree, clustering coefficient and centrality index through graph topology attention network to generate topological feature representation.

[0084] Specifically, the node set includes enterprise entity nodes, risk event nodes, and environmental factor nodes, while the edge set includes different types of relationships (such as "equity control" and "supply chain dependence" between enterprises, "affected" between enterprises and events, and "impact" between environmental factors and enterprises), with each edge having a dynamic weight (updated dynamically based on the strength of the relationship). The graph topology attention network, designed to address the characteristics of heterogeneous graphs, employs a type-aware attention mechanism to extract topological features of nodes (node ​​degree, clustering coefficient, centrality index) and generate topological feature representations.

[0085] The calculation of node degree needs to distinguish the edge type. For each node u, its out-degree and in-degree are calculated according to the edge type r, using the following formula: , ( (where E is the indicator function, V is the set of edges, and V is the set of nodes), and then type weights are used. (The importance of risk warning is set according to edge type) The degree of different types is weighted and summed to obtain the comprehensive degree of node u. The clustering coefficient measures the degree of clustering of a node's neighbors. For node u, its clustering coefficient is... ( For node u (The actual number of edges between each neighbor) in a heterogeneous graph. Only the number of edges between neighbors with the same edge type as node u is counted to ensure that the clustering coefficient can reflect the clustering characteristics of the same type of association.

[0086] The centrality indices chosen are betweenness centrality and degree centrality. Betweenness centrality measures the mediating role of a node in the shortest path of the graph, and the formula is: ( Let be the total number of shortest paths from s to t. (This represents the number of shortest paths from s to t via u), and degree centrality, which is the overall degree of a node. The two are weighted , Weighted fusion as a centrality feature .

[0087] Graph topology attention networks fuse features of the aforementioned topology metrics through attention layers, first by determining the degree of node u. Clustering coefficient Centrality characteristics Concatenate to form the initial topological feature vector The calculation process for the attention layer is as follows: For node u and its neighboring nodes v, calculate the attention coefficient. ( (where 'a' is the topological feature weight matrix and 'a' is the attention vector) is obtained by Softmax normalization to obtain the neighborhood attention weights. Then, the topological feature representation of node u is generated by weighted summation. ( Let be the set of neighboring nodes of node u, and ReLU be the activation function. After performing the above process on all nodes, we obtain the set of topological feature representations of all nodes in the graph. This representation can characterize the positional characteristics and importance of nodes in the graph topology. For example, enterprise nodes with high centrality may have a stronger influence on risk propagation.

[0088] S14. Based on topological feature representation and node features, neighborhood information is aggregated through a topology-enhanced cross-attention mechanism to generate a graph structure embedding representation.

[0089] Specifically, the topological feature representation generated based on S13 This is related to the original characteristics of the nodes themselves (such as the industry attributes and scale attributes of enterprise nodes, and the event type and scope of impact of risk event nodes). First, the two are concatenated and then a linear transformation is performed to generate the fused features of the nodes. ( To fuse the weight matrix, (As a bias term), this fusion feature includes both node attribute information and topological location information, laying the foundation for neighborhood aggregation.

[0090] The topology-enhanced cross-attention mechanism aims to aggregate neighborhood information while simultaneously considering the topological feature differences between a node and its neighbors. Its core is the construction of "self-neighborhood" cross-attention weights. Specifically, for node u and its neighboring nodes v, the fused features of node u are... as query vector Fusion characteristics of neighboring node v as a key vector AND value vector First, calculate the cross-similarity between the query vector and the key vector, using the formula: (D_f is the dimension of fused features). This similarity not only reflects the similarity at the feature level, but also reflects the correlation of topological location because the fused features contain topological information. For example, neighboring nodes with similar topological structures (such as those belonging to the same supply chain sub-network) will have higher similarity.

[0091] To further enhance the impact of topological correlation, a topological similarity modifier is introduced. Its calculation is based on the topological feature representation of nodes u and v. , The formula is (Cosine similarity) measures the degree of similarity in topological position between two elements. Combining cross-similarity with a topological similarity adjustment factor yields an enhanced similarity score. Cross-attention weights are obtained through Softmax normalization. This weight takes into account both feature similarity and strengthens the contribution of topologically similar neighboring nodes.

[0092] Neighborhood information aggregation is achieved through a weighted summation of attention weights and value vectors, as shown in the formula: ,in Let be the neighborhood aggregation feature of node u. To preserve the core information of the node's own features, residual connections are used to combine the neighborhood aggregation feature with the node's own fused features to generate a graph structure embedding representation. Then, LayerNorm is used for normalization to avoid eigenvalue shifts affecting subsequent calculations. After performing the above neighborhood aggregation process on all nodes in the graph, a set of graph structure embedding representations for all nodes is obtained. This representation can fully integrate the node's own attributes, topological features, and neighborhood information to characterize the structural association characteristics of nodes in dynamic heterogeneous graphs.

[0093] S15. Based on temporal embedding representation and graph structure embedding representation, adaptive weights are calculated through a cross-modal gating fusion mechanism to generate a unified spatiotemporal embedding representation.

[0094] Specifically, the attention-weighted temporal embedding representation generated by S12 (Temporal modality) and graph structure embedding representation generated by S14 (Graph structure modality) represents features from different modalities. Cross-modal gating fusion mechanisms, through adaptive weight allocation, effectively fuse features from two modalities, avoiding the problems of insufficient or redundant information from a single modality. First, the dimensions of the two modal features need to be unified. If temporal embedding representation... In sequence form (dimension) The temporal feature vector needs to be transformed into a vector with the same dimension as the graph structure embedding representation through temporal pooling operations (such as mean pooling, max pooling, or attention pooling). Taking mean pooling as an example, the temporal feature vector after temporal pooling... ( (where t is the vector of the time-series embedding sequence) so that and All Dimension (D stands for uniform feature dimension).

[0095] The core of the cross-modal gating fusion mechanism is the gating unit, whose function is to dynamically generate temporal modal weights and graph structure modal weights based on the information value of the features from the two modalities. The input to the gating unit is the temporal feature vector. With graph structure eigenvectors The concatenated vector is given by the formula: ,in For the gated vector, For the gated weight matrix, For gated bias terms, The Sigmoid activation function has a gate vector element value range of [0,1], which is used to control the fusion ratio of the two modal features.

[0096] The weight vector of the time-series mode is The weight vector of the graph structure mode is (1 represents an all-1 vector). Adaptive weighting is achieved by element-wise multiplication of the weight vector with the corresponding modality feature vector. The formulas are as follows: , ( (For element-wise multiplication). The unified spatiotemporal embedding representation is generated by adding the weighted feature vectors of the two modalities, as shown in the formula: ,in This is the spatiotemporal embedding representation of node u, which includes both dynamic change information in the time-series dimension (such as fluctuations in enterprise indicators over time) and topological relationship information in the graph structure dimension (such as the relationship between the enterprise and risk events, and other enterprises).

[0097] To further optimize the fusion effect, residual join and regularization can be introduced. The residual join formula is as follows: ( The residual weight matrix is... (This is a residual bias term) used to alleviate the gradient vanishing problem during deep fusion. Regularization uses Dropout or LayerNorm; taking Dropout as an example, it enhances the generalization ability of spatiotemporal embedding representations by randomly discarding some feature dimensions (the discard probability is set according to model complexity). After performing the above fusion process on all nodes in the graph, a unified spatiotemporal embedding representation set for all nodes is obtained. This representation provides comprehensive spatiotemporal feature support for subsequent risk modeling and prediction, effectively characterizing the risk correlation characteristics of enterprise nodes under the dual dimensions of temporal dynamics and spatial topology.

[0098] refer to Figure 2 In one optional embodiment, based on spatiotemporal embedding representation, a dynamic heterogeneous graph attention network enhanced by event logic is used to model the nonlinear impact of risk events on the state and relationships of enterprise nodes, outputting enhanced node representations and enhanced global graph representations, including the following steps:

[0099] S21. Based on the event type, trigger word, and timestamp in the risk event quadruple of the dynamic heterogeneous enterprise risk map, the event encoder processes them to generate an event vector representation.

[0100] Specifically, the event encoder input is constructed based on the risk event quadruple (containing event type, trigger word, timestamp, and associated enterprise entity node) of the dynamic heterogeneous enterprise risk map. The event encoder adopts a fusion architecture of "BERT + temporal embedding" to simultaneously capture the semantic and temporal features of the event. First, the event quadruple is preprocessed: the event type (such as "debt default" or "executive resignation") is converted into a type feature vector T using one-hot encoding; the trigger word (such as "overdue" or "resignation") serves as the core semantic identifier and is processed using a masked language model (MLM) strategy, replacing the trigger word with [MASK] and concatenating it with the event description text (such as "Company A had a debt default in 202X") to form a semantic input sequence S; the timestamp (such as the year / month / day of the event) is converted into a temporal feature vector Ti using sine / cosine time encoding, and the encoding formula can be:

[0101]

[0102]

[0103] in, Let k be the time feature vector corresponding to timestamp t, and k be the feature dimension index. ), Given the time feature vector dimension, t represents the numerical representation of the timestamp (e.g., the number of days from the base time). This encoding can transform discrete timestamps into continuous vectors, preserving the chronological order and periodicity of time.

[0104] The type feature vector T, the semantic input sequence S, and the temporal feature vector Ti are concatenated to form the encoder input matrix. ,in The semantic feature vector output by the BERT encoder from the semantic input sequence (taking the [CLS] position vector, dimension...) The event encoder contains L Transformer encoder blocks, each consisting of a multi-head self-attention layer and a feedforward neural network layer: the multi-head self-attention layer computes the semantic and temporal associations of the input matrix in parallel using M attention heads, as shown in the formula. ,in ( Let be the query, key, and value weight matrix for the i-th attention head. (This refers to the concatenated linear transformation matrix); the feedforward neural network layer uses... Structure ( This is the weight matrix. (as a bias term), enhancing the nonlinear expressive power of features.

[0105] After layer normalization, the encoder output is used to obtain the event vector representation. ( (This refers to the event vector dimension), which must be consistent with the spatiotemporal embedding representation dimension of the enterprise entity node (i.e., ...). , (For spatiotemporal embedding dimension), to ensure that vectors can be operated compatiblely when calculating the intensity of subsequent influence.

[0106] S22. Based on the event vector representation and the spatiotemporal embedding representation of the corresponding enterprise entity nodes, calculate the basic impact strength of the event, the enterprise correlation degree, and the time decay factor; based on the basic impact strength of the event, the enterprise correlation degree, and the time decay factor, calculate the impact strength of the event.

[0107] Specifically, calculating the intensity of an event's impact requires integrating the event's inherent attributes, the company's related characteristics, and the time decay effect, and involves two steps: "single-factor calculation" and "multi-factor fusion." First, three core factors are calculated:

[0108] 1) Basic Impact Strength of the Event: Reflects the risk level of the event type itself, based on the event vector representation e and a pre-trained event risk level vector library. The cosine similarity of the vectors (including standard risk vectors for various events, such as "debt default" corresponding to a high-risk vector and "normal resignation of senior executives" corresponding to a low-risk vector) is determined by the following formula:

[0109]

[0110] in, The basic impact strength of the event (value range [0,1]). The cosine similarity between the event vector and the risk level vector is calculated using the max operation, which selects the best-matching risk level vector to ensure that the basic impact strength accurately reflects the inherent risk level of the event.

[0111] 2) Enterprise Relevance: This measures the degree of topological association between the event-related enterprises and the target enterprise node. It is calculated based on the shortest path length between two nodes and the edge type weights on the path in a dynamic heterogeneous enterprise risk graph. The formula is as follows:

[0112]

[0113] in, Let P be the enterprise relevance (value range [0,1]), and let P be the shortest path between the event-related enterprise node and the target enterprise node. It is the sum of the weights of all edges on path P (edge ​​weights are set according to the association type, such as the weight of equity control edges being higher than that of business cooperation edges). The length of the path (number of edges) is the length of the path. The larger the denominator, the weaker the connection between the two nodes and the lower the degree of connection.

[0114] 3) Time decay factor: Reflects the decay effect of an event's impact over time, based on the event's timestamp. With current timestamp The time difference is calculated using an exponential decay model, and the formula is as follows:

[0115]

[0116] in, This is the time decay factor (value range (0,1]). The attenuation coefficient (set according to the risk attenuation characteristics of the industry, such as the financial industry) Larger than traditional industries) The absolute value of the time difference (units consistent with timestamps) is the exponential function, which ensures that the longer the time, the smaller the decay factor and the weaker the impact of the event.

[0117] The multi-factor fusion model uses a weighted product model to calculate the intensity of an event's impact. The formula is as follows:

[0118]

[0119] in, The intensity of the event's impact (range [0,1]) can be directly multiplied to simultaneously reflect the high impact characteristics of "high-risk events, strongly related enterprises, and recent events," avoiding the bias caused by a single factor (such as low-risk events, even if they have a high degree of correlation, still have a low overall impact intensity).

[0120] S23. Based on the intensity of the event's impact, the event's impact is diffused along the edges of the dynamic heterogeneous enterprise risk graph through event propagation operations, generating an event impact field.

[0121] Specifically, the event impact field is the "impact area" formed by the spread of event impact along the graph edges. It needs to be implemented in two steps: "diffusion path selection" and "impact value calculation", taking into account the graph topology and edge type characteristics.

[0122] 1) First, perform event propagation: use the enterprise node associated with the event as the starting point for propagation (denoted as...). The risk propagation occurs along the edges of the dynamic heterogeneous enterprise risk graph, spreading to neighboring nodes. The propagation path follows the principles of "edge type priority" and "distance decay." Edge type priority is determined by the edge's contribution to risk propagation (e.g., supply chain edges and equity edges have higher priority than ordinary cooperation edges), prioritizing propagation along higher-priority edges. Distance decay refers to the rate of propagation at each layer (i.e., from node...) arrive The influence intensity decreases by a fixed ratio, and the decrease ratio is... Related to edge type (high priority edge) Smaller, low-priority edges (relatively large)

[0123] During the diffusion process, for each node Calculate the impact value of the events it receives. The formula is:

[0124]

[0125] in, For nodes The event impact value, where m is the value from the diffusion origin. To the node The path length (number of edges). Let k be the decay ratio of the k-th edge. This is the weight of the k-th edge (consistent with the edge weights in S22). This is the path attenuation coefficient, ensuring that the greater the distance and the lower the edge priority, the smaller the impact on node reception.

[0126] Once the propagation range covers all nodes in the graph that have paths with the event-related nodes, the propagation stops, and the event impact value of each node is recorded. Spatiotemporal embedding representation of this node Combined, an event influence field is generated. The event's influence field is represented as a set of "node-influence value" key-value pairs, i.e. ,in For nodes The feature offset vector under the influence of the event reflects the corrective effect of the event on the node features (the larger the influence value, the more significant the feature offset).

[0127] S24. Based on a preset logical rule base, calculate the logical association probability between events and enterprise entity nodes through logical rule reasoning, and generate logical reasoning results.

[0128] Specifically, logical rule reasoning relies on a pre-set logical rule base, combines event vectors and enterprise node characteristics, and calculates the logical correlation probability between events and enterprise nodes. It is divided into two parts: "rule base construction" and "reasoning calculation".

[0129] 1) First, construct a pre-defined logical rule base: The rule base contains K industry-verified risk logic rules, each rule in the form of "Premise → Conclusion (Confidence Level)". The premise is a combination of event type and company attributes (e.g., "Event type = debt default ∧ company attributes = high debt → conclusion = company has liquidity risk"), confidence level (Value range [0,1]) Set based on the probability of rule effectiveness in historical risk cases (e.g., 85 out of 100 cases meeting the preconditions result in a risky conclusion). The rule base supports dynamic updates, and rules and confidence levels can be adjusted by adding historical cases or industry policies.

[0130] 2) Logical rule reasoning adopts the process of "feature matching - rule activation - probability calculation":

[0131] Extracting event type features from event vector e (through linear transformation) , (for event type weighting matrices), and the attribute features of enterprise nodes (from spatiotemporal embedding representations). Extract from, the formula is: , (Extract weight matrices for attributes) to form "event-enterprise" feature pairs .

[0132] Traverse the logical rule base and determine whether the preconditions of each rule match the features. Matching – if event type characteristics Consistent with the event type in the premise, and with the characteristics of the enterprise attributes. The attribute conditions in the premise are met (such as...) If the "debt ratio" value is higher than the threshold, the rule is activated.

[0133] For all activated rules, a weighted summation model is used to calculate the logical association probability between the event and the enterprise node, as shown in the formula:

[0134]

[0135] in, This represents the logical association probability (with a value range of [0,1]). For the set of rules to be activated, Let r be the confidence level of the r-th rule. The matching degree between rule r and feature pair (value range [0,1], 1 for complete match, 0.5~1 for partial match, set according to the degree of satisfaction of attribute conditions), the numerator is the weighted matching score, and the denominator is the sum of the confidence scores of activation rules, to ensure that the association probability can comprehensively reflect the contribution of all activation rules.

[0136] After the reasoning is completed, a logical reasoning result is generated, which is a set of key-value pairs in the form of "enterprise node - logical association probability". ,in For enterprise nodes The logical correlation probability.

[0137] S25. Based on the event impact field and logical reasoning results, update the node representation of each node in the dynamic heterogeneous enterprise risk graph through a dynamic heterogeneous graph attention network to generate enhanced node representations.

[0138] Specifically, the first step is to calculate dynamic attention weights. Unlike traditional GAT, DHGAT's attention weights need to incorporate event impact values. Probability of logical association As a regulating factor, the attention coefficient formula for node u and its neighboring nodes v is:

[0139]

[0140] in, Let be the attention coefficient of node u to node v, LeakyReLU be the activation function, and 'a' be the attention vector (dimension 'v'). ), Node feature weight matrix (dimensions) , (output dimension for attention layer) Let u and v be the spatiotemporal embedding representations of nodes u and v, respectively. The event impact value for node u. Let be the logical association probability of node u. The product of and is used to enhance the attention contribution of nodes with "high influence and high logical association".

[0141] The attention coefficients are then Softmax normalized to obtain the attention weights:

[0142]

[0143] in, The normalized attention weights (values ​​in the range [0,1]). N(u) is the set of neighboring nodes of node u.

[0144] Then, the node representation is updated by summing the features of neighboring nodes according to their attention weights, and then fusing the node's own event influence features and logical reasoning features. The formula is as follows:

[0145]

[0146] in, Augmented node representation of node u (dimension) ReLU is the activation function. Weighted sum of neighborhood features, This represents the impact characteristics of the event (the event vector is scaled according to the impact value). Logical feature weight matrix (dimensions) ), The three elements—"neighborhood topology information + event impact + logical association"—are combined to achieve a triple feature fusion, ensuring that the enhanced node representation can comprehensively reflect the risk association status of enterprise nodes.

[0147] Perform the above update process on all nodes (including enterprise entity nodes, risk event nodes, and environmental factor nodes) in the dynamic heterogeneous enterprise risk graph to obtain an enhanced node representation set for all nodes. .

[0148] S26. Based on the enhanced node representation of all enterprise entity nodes, calculate the mean through graph pooling operations to generate an enhanced global graph representation.

[0149] Specifically, the first step is to filter nodes, since the augmented node representation set... It includes enterprise entity nodes, risk event nodes, and environmental factor nodes. Since the global representation needs to focus on the risk status of the enterprise group, it is necessary to filter out the enhanced node representations corresponding to all enterprise entity nodes, denoted as... ,in By excluding non-enterprise nodes (such as event nodes and environmental factor nodes) from the set of enterprise entity nodes, the interference of non-target nodes on the global representation can be avoided (such as a single high-risk event node may exaggerate the overall risk level).

[0150] Then, graph pooling is performed, and the mean pooling strategy is used to calculate the mean of the augmented representation of all enterprise entity nodes. The formula is as follows:

[0151]

[0152] in, To enhance the global representation of graphs (dimensions) ), The number of enterprise entity nodes, The vector sum of the augmented representations of all enterprise entity nodes. The advantage of mean pooling is that, compared to max pooling (which is susceptible to extreme values) or summation pooling (which is affected by the number of nodes), mean pooling can more evenly reflect the average risk status of all enterprises, and the dimension is consistent with the augmented node representation, which facilitates subsequent collaborative participation with the augmented node representation in risk calculation (such as topology residual detection in S4 and risk probability prediction in S5).

[0153] After pooling, the global representation needs to be normalized using the following formula:

[0154]

[0155] in, For the normalized augmented graph global representation, The mean of the global representation ( (This represents the value of the d-th dimension in the global representation). For variance, Minimum value (e.g.) This is used to avoid a denominator of 0. Normalization ensures that the feature values ​​of the global representation are within a reasonable range, avoiding excessive differences from the numerical range of the enhanced node representation, which could affect the accuracy of subsequent risk calculations.

[0156] In one optional embodiment, based on the event vector representation and the spatiotemporal embedding representation of the corresponding enterprise entity node, the basic impact strength of the event, the enterprise correlation, and the time decay factor are calculated; the impact strength of the event is calculated based on the basic impact strength of the event, the enterprise correlation, and the time decay factor, including the following steps:

[0157] S31. Perform a linear transformation on the event vector representation to obtain a linear change result; process the linear change result with the sigmoid function to generate the basic influence strength of the event.

[0158] Specifically, the input data is the event vector representation generated by S21. ( The event vector dimension is the spatiotemporal embedding representation dimension of the enterprise entity node. (Consistent) This vector integrates multi-dimensional features such as event type, trigger word, and timestamp, providing comprehensive event attribute support for the calculation of basic influence intensity.

[0159] The linear transformation step maps the event vector from the original feature space to the influence intensity calculation space, eliminating the dimensional differences between different feature dimensions. The formula is as follows:

[0160]

[0161] Where x is the result of the linear transformation (dimension) (i.e., scalar) For linear transformation weight matrix (dimension) This is used to assign weights to the features of each dimension of the event vector—for example, the event type feature dimension has a higher weight than the timestamp feature dimension, ensuring that the inherent attributes of the event play a dominant role in the strength of the basic influence. This is a linear transformation bias term (scalar) used to adjust the baseline value of the linear transformation result, avoiding bias in intensity calculation caused by shifts in the event vector mean. Weight matrix. With bias term Through pre-training optimization, the pre-training dataset uses historical risk event cases (including event vectors and manually labeled basic risk levels), and the loss function is the mean squared error (MSE). ( The basic risk level of the i-th event is manually labeled (N is the number of samples), and the parameters are iteratively updated using the gradient descent algorithm until the loss function converges.

[0162] The Sigmoid function normalizes the linear transformation result x to the [0,1] interval, as shown in the formula:

[0163]

[0164] in, The basic impact strength of the event (value range [0,1]). The Sigmoid function is an exponential function. Its non-linear characteristic allows for a mapping effect where "the intensity approaches 0 when the linear transformation result of a low-risk event is negative, and the intensity approaches 1 when the linear transformation result of a high-risk event is positive." In this step, care must be taken to avoid the Sigmoid function saturating (i.e., the intensity approaches 0 or 1, making it impossible to distinguish subtle risk differences between similar events) due to excessively large absolute values ​​of the linear transformation result x. Therefore, during pre-training, data standardization (normalizing each dimension of the event vector to [-1, 1]) and learning rate adjustment (using a small learning rate, such as...) are necessary. This ensures that the value of x is concentrated in the range of [-5,5], thus preserving the distinguishability of the intensity.

[0165] S32. Using a pre-trained event type mapping network, the event vector representation is converted into an event influence vector in the same semantic space as the spatiotemporal embedding representation; based on the event influence vector and the spatiotemporal embedding representation of the corresponding enterprise entity node, the enterprise correlation is obtained by calculating cosine similarity; the expression of the event type mapping network is:

[0166]

[0167] in, This is the event impact vector. and Learnable parameters of the network are mapped to event types. This is an event vector representation associated with the enterprise entity node v.

[0168] Specifically, the core of enterprise correlation calculation is to achieve semantic space alignment and correlation quantification between events and enterprise nodes through an "event type mapping network + cosine similarity," thus overcoming the shortcomings of traditional topological correlation that only relies on path length and ignores semantic matching. This step is implemented in two parts: "event influence vector generation" and "cosine similarity calculation," with the input data being event vector representations. Spatiotemporal embedding representation of enterprise entity node v ( ).

[0169] First, the event type mapping network is executed. This network is a single-hidden-layer linear mapping model, and its function is to map event vectors... Transformation from event feature space to spatiotemporal embedding representation Using the same semantic space ensures the validity of subsequent similarity calculations; the formula is as follows: ;in, For the event impact vector (and) (consistent dimensions) For the mapping weight matrix (because) Therefore, it is a square array. This is the mapping bias vector. The network achieves semantic space alignment through pre-training. The pre-training dataset consists of "event-enterprise related samples," with each sample containing an event vector. Enterprise spatiotemporal embedding In addition to manually labeled semantic association tags (such as "strong association", "weak association", "no association", corresponding to tag values ​​of 1, 0.5, and 0), the cross-entropy loss function was selected, and optimization was performed. and To make the same associated tag and They are closer in semantic space. For example, the "supply chain disruption" event. Need to work with upstream and downstream enterprises Small semantic distance, with companies that have no supply chain relationship Large semantic distance.

[0170] Then, cosine similarity calculation is performed, which is used for quantization. and The degree of semantic relevance is expressed by the formula:

[0171]

[0172] in, For enterprise correlation (value range [-1, 1]), numerator The dot product of two vectors (reflecting the degree of their shared direction; the larger the value, the stronger the shared direction), and the denominator... for L2 norm ( , for (values ​​of the d-th dimension) for L2 norm (calculated in the same way) The denominator is used to normalize the dot product result, avoiding similarity bias caused by differences in vector magnitudes. For example: if and When the two events are completely in the same direction (e.g., the company is a direct upstream of the "supply chain disruption" event), the dot product equals the product of the two norms, and the similarity is 1; if they are completely in opposite directions (e.g., the company and the event have no business connection), the similarity is -1. In practical applications, a linear transformation is used to map the similarity to the [0,1] interval (the formula is...). This makes the results more consistent with the intuitive understanding of "relevance," and the mapped results... This is the final enterprise relevance.

[0173] S33. Based on the current time and the event timestamp in the event vector representation, generate a time decay factor through an exponential decay function.

[0174] Specifically, the core of calculating the time decay factor is to quantify the decay effect of an event's influence over time using an exponential decay function, with the input data being the current time. With event vectors Event timestamps First, the timestamp format must be standardized and the difference calculated before the decay function is executed.

[0175] First, timestamp preprocessing is performed on the event timestamp. From event vectors Extracted from, the extraction method is through a predefined timestamp feature dimension index (e.g., ... The Wei Zhi Di The dimension corresponds to the time feature vector Ti in S21, from which the original timestamp of the event is parsed. The original timestamp format must be uniformly Unix timestamp (seconds or milliseconds) to ensure consistency with the current time. The format is consistent. Current time The acquisition of this data needs to be synchronized with the update time of the dynamic heterogeneous enterprise risk map (e.g., when the map is updated at 3:00 AM daily). (Set to the Unix timestamp at that moment) to avoid errors in time difference calculation. The time difference calculation formula is: It is necessary to ensure (If it appears) This indicates that the event timestamp is incorrect and needs to be corrected. At this point, the decay factor is 1, meaning the event is "currently occurring" and there is no decay.

[0176] Then, the exponential decay function is applied, as shown in the formula: ;in, This is the time decay factor (value range (0,1]). This is the time decay coefficient (a positive number, with a dimension of "1 / time unit", e.g., if the time unit is days). The unit is "1 / day". It is a natural exponential function. The value is set based on the characteristics of industry risk decay: for industries where the impact of risk decays quickly (such as the financial industry, the impact of sudden credit events may weaken significantly within a few weeks). The value is relatively large; for industries where the impact of risk decays slowly (such as manufacturing, the impact of supply chain problems may last for several months). The value is relatively small.

[0177] S34. Based on the event's basic impact strength, corporate relevance, and time decay factor, calculate the event's impact strength using the event impact decay mechanism; the calculation formula for the event impact decay mechanism is:

[0178]

[0179] in, This indicates the intensity of the event's impact on the enterprise entity node v. Based on the intensity of the event's fundamental impact, For enterprise relevance, This is the time decay factor; For learnable matrices, The cosine similarity function is used. For the spatiotemporal embedding representation of enterprise entity node v, The time decay coefficient, For the current time, This is the event timestamp.

[0180] Specifically, the core of calculating the intensity of an event's impact is to integrate the basic impact intensity of the event (S31), the enterprise relevance (S32), and the time decay factor (S33) through the event impact decay mechanism to generate a quantitative value of the actual impact of the event on the enterprise node.

[0181] During the calculation process, attention should be paid to the consistency of the factor value range: if the enterprise correlation has not been mapped to [0,1] (the original cosine similarity is [-1,1]), it is necessary to perform the following first. The mapping should avoid negative correlations leading to negative influence strength (which is meaningless). Simultaneously, the learnable parameters need to be optimized through model training. , , , The training dataset consists of historical "event-enterprise-risk outcome" samples (including event vectors, enterprise spatiotemporal embeddings, and event impact strength labels). The loss function used is mean squared error (MSE), i.e. ( The labeling influence strength of the i-th sample. (Calculated values ​​for the model) The parameters are iteratively updated using the gradient descent algorithm until the loss function converges, ensuring the accuracy and generalization ability of the event impact strength calculation.

[0182] In one optional embodiment, based on the enhanced node representation and the enhanced graph global representation, a topological residual score is generated by calculating the deviation between the node representation and the mean of its community through topological residual detection, and a representation similarity score is generated by calculating the minimum similarity between the node representation and the known risk prototype through similarity analysis, including the following steps:

[0183] S41. Based on the enhanced node representation, the nodes are divided into multiple communities using a graph clustering algorithm to generate community partitioning results. Based on the community partitioning results, the arithmetic mean of all node representations in each community is calculated to generate the mean representation vector of each community.

[0184] Specifically, community partitioning aims to determine the topological associations of nodes using graph clustering algorithms, providing a group benchmark for residual calculation. The input is the set of augmented node representations. ( Let V be the augmented representation of node v, where V is the set of nodes in the graph. Considering the scale and heterogeneity of the graph, the Louvain algorithm is chosen to implement community partitioning. This algorithm balances partitioning efficiency and accuracy by iteratively optimizing the modularity index and is suitable for large-scale heterogeneous graphs.

[0185] The core process of the Louvain algorithm consists of two steps: First, local modularity optimization, where each node is initially treated as an independent community, attempts to merge it into the communities of adjacent nodes and calculates the change in modularity, retaining the merging operations that increase modularity; second, community aggregation and global optimization, where the locally optimized communities are used as supernodes to construct a coarse-grained graph, repeating local optimization until modularity no longer increases, and outputting the community partitioning result. (C(v) represents the community to which node v belongs).

[0186] The community mean representation vector is generated based on the partitioning results. First, valid nodes within community C(v) are selected (nodes with abnormal representations are removed). Then, the enhanced representations of the valid nodes are averaged dimension by dimension. The formula is as follows:

[0187]

[0188] in, Let C(v) be the mean vector of the community, C'(v) be the set of valid nodes, and |C'(v)| be the number of valid nodes. This vector serves as the group benchmark for subsequent residual calculations, reflecting the average characteristic level of nodes within the community.

[0189] S42. Based on the enhanced node representation of each node and the mean representation vector of its community, the degree of difference is calculated using the Euclidean distance formula to generate the topological residual score; the formula for calculating the topological residual score is:

[0190]

[0191] in, Let be the topological residual fraction of node v. For the augmented node representation of node v, Let v be the set of community nodes to which node v belongs. This indicates the number of nodes in the community node set.

[0192] Specifically, the topological residual score is used to quantify the difference between a node's augmented representation and the mean vector of its community. The greater the difference, the stronger the node's topological anomaly. The calculation formula includes... Let be the topological residual fraction of node v. Let C(v) be the augmented representation of node v, where C(v) is the community to which node v belongs, and |C(v)| is the number of nodes in the community. Let the community mean be represented by a vector. This is a square operation for Euclidean distance, which reduces computation and preserves the monotonicity of the distance.

[0193] In actual calculations, two points need to be noted: First, the residual scores of isolated communities (|C(v)|=1) need to be corrected to the baseline value to avoid score distortion due to their own mean; second, the residual scores should be normalized and mapped to a fixed interval to facilitate subsequent fusion with other scores and avoid the influence of numerical range differences on weight allocation.

[0194] S43. Based on the training samples of known risk categories, sum the representations of all nodes under each risk category and divide by the number of nodes to generate the prototype representation vector of each known risk category.

[0195] Specifically, known risk prototypes are used to construct feature benchmarks for each risk category, which are then used for subsequent similarity comparisons. The core is to calculate the category mean based on the enhanced representations of historical training samples. The training samples come from a historical risk case library, containing explicit risk labels and corresponding enhanced node representations. The risk category division follows the principle of mutual exclusion and exhaustiveness, covering all known risk scenarios.

[0196] For each known risk category (k=1,2,...,M, where M is the number of risk categories), filter the set of training sample nodes under this category. The augmented representations of nodes within the set are averaged dimension-wise to generate the prototype representation vector, as shown in the formula:

[0197]

[0198] in, Risk Category prototype vector, The number of training samples. This is an enhanced representation of sample node u. To ensure the timeliness of the prototype, the prototype vector is updated periodically with new cases to maintain the accuracy of similarity analysis.

[0199] S44. Based on the enhanced node representation of each node and the prototype representation vector of all known risk categories, calculate the similarity value between each node and each known risk category using cosine similarity, and generate a set of similarity values.

[0200] Specifically, the similarity value set is constructed by calculating the similarity between a node and all known risk prototypes. The higher the similarity, the greater the likelihood that the node belongs to the corresponding risk category. The core calculation method uses cosine similarity, and the formula is as follows:

[0201]

[0202] In the formula, For node v and risk category The similarity value, For the augmented representation of node v, Risk Category prototype vector, For the dot product of two vectors, and These are the L2 norms of the two vectors, used to normalize the dot product result.

[0203] When generating the similarity value set, for each node v, the similarity value is calculated by traversing all known risk categories and then organized into a set. This provides raw data for subsequent score conversion. If an anomaly is encountered in the zero norm of a vector, the corresponding similarity value will be set as a preset baseline value to avoid calculation errors.

[0204] S45. Select the maximum similarity value from the set of similarity values, and subtract the maximum similarity value from 1 to obtain the similarity score.

[0205] Specifically, the similarity score is used to quantify the difference between a node and a known risk category. The greater the difference, the higher the probability that the node has unknown risks. The core process includes two steps: first, from the set of similarity values... Select the maximum similarity value This value reflects the highest degree of matching between a node and a known risk; secondly, it converts the matching degree into a difference degree through score transformation, using the following formula:

[0206]

[0207] in, Let be the similarity score for node v. The original value range is related to the similarity value. To facilitate subsequent fusion, this score needs to be normalized and mapped to a fixed interval so that it is consistent with the topological residual score in numerical range, thus jointly supporting the calculation of the unknown risk score.

[0208] The aforementioned big data-based enterprise risk early warning method constructs a dynamic heterogeneous enterprise risk map containing enterprise entities, risk events, and environmental factors. It extracts the temporal dynamic features and spatial topological features of nodes using a temporal encoder and a graph structure encoder, respectively, and then fuses these features into a unified spatiotemporal embedding representation through a cross-modal fusion mechanism. Next, it uses an event-logic-enhanced dynamic heterogeneous graph attention network to model the nonlinear impact of risk events on node states and relationships, outputting enhanced node and global representations. Based on these enhanced representations, it calculates the deviation between nodes and community means using topological residual detection to generate topological residual scores, and calculates representation similarity scores by calculating the minimum similarity between nodes and known risk prototypes through similarity analysis. Then, it combines these scores through linear combination and normalization to obtain unknown risk scores, while simultaneously calculating known risk probabilities using a pre-trained model. Finally, it generates a comprehensive risk index based on the maximum value of the unknown risk scores and known risk probabilities. When the index exceeds a threshold, it outputs an early warning message, thus achieving comprehensive and accurate early warning of both known and unknown enterprise risks, improving the coverage and timeliness of risk identification.

[0209] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0210] Based on the same inventive concept, this application also provides an apparatus for implementing the above-mentioned enterprise risk warning method based on big data. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more embodiments of the enterprise risk warning apparatus based on big data provided below can be found in the limitations of the enterprise risk warning method based on big data described above, and will not be repeated here.

[0211] In one exemplary embodiment, such as Figure 3 As shown, a big data-based enterprise risk early warning device 30 is provided to implement the methods in the above-described method embodiments. The device includes:

[0212] The dynamic risk map generation module 31 is used to construct a dynamic heterogeneous enterprise risk map, including enterprise entity nodes, risk event nodes, and environmental factor nodes, based on multi-source enterprise data and through data preprocessing and event extraction processing.

[0213] The spatiotemporal feature fusion engine 32 is used to extract the temporal dynamic features of nodes based on the dynamic heterogeneous enterprise risk map, and extract the spatial topological features of nodes through the temporal encoder and the graph structure encoder. It uses a cross-modal fusion mechanism to fuse the temporal dynamic features and spatial topological features to generate a unified spatiotemporal embedding representation.

[0214] The Risk Impact Dynamic Modeling Module 33 is used to model the nonlinear impact of risk events on the state and relationships of enterprise nodes based on spatiotemporal embedding representation and through an event logic-enhanced dynamic heterogeneous graph attention network, and outputs enhanced node representation and enhanced global graph representation.

[0215] The risk anomaly quantification module 34 is used to calculate the deviation between the node representation and the mean of its community based on the enhanced node representation and the enhanced graph global representation, generate the topological residual score, and calculate the minimum similarity between the node representation and the known risk prototype through similarity analysis, thereby generating the representation similarity score.

[0216] The risk probability assessment module 35 is used to generate unknown risk scores based on topological residual scores and representation similarity scores through linear combination and normalization; and to calculate known risk probabilities based on enhanced node representations through a pre-trained risk prediction model.

[0217] The intelligent early warning decision module 36 is used to generate a comprehensive risk index based on the unknown risk score and the known risk probability through maximum value calculation; when the comprehensive risk index exceeds the threshold, it outputs enterprise risk warning information.

[0218] Embodiments of this application also provide a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the aforementioned method embodiments.

[0219] Embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-described method embodiments.

[0220] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0221] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A big data-based enterprise risk early warning method, characterized in that, The method includes: S1. Based on multi-source enterprise data, a dynamic heterogeneous enterprise risk map is constructed through data preprocessing and event extraction processing, including enterprise entity nodes, risk event nodes, and environmental factor nodes. S2. Based on the dynamic heterogeneous enterprise risk map, extract the temporal dynamic features of the nodes through a time-series encoder and extract the spatial topological features of the nodes through a graph structure encoder; use a cross-modal fusion mechanism to fuse the temporal dynamic features and the spatial topological features to generate a unified spatiotemporal embedding representation. S3. Based on the spatiotemporal embedding representation, through an event logic-enhanced dynamic heterogeneous graph attention network, model the nonlinear impact of risk events on the state and relationships of enterprise nodes, and output enhanced node representations and enhanced global graph representations; S4. Based on the enhanced node representation and the enhanced graph global representation, the deviation between the node representation and the mean of its community is calculated by topological residual detection to generate a topological residual score, and the minimum similarity between the node representation and the known risk prototype is calculated by similarity analysis to generate a representation similarity score. S5. Based on the topological residual score and the representation similarity score, generate an unknown risk score through linear combination and normalization; based on the enhanced node representation, calculate the known risk probability through a pre-trained risk prediction model. S6. Based on the unknown risk score and the known risk probability, generate a comprehensive risk index by calculating the maximum value; when the comprehensive risk index exceeds the threshold, output enterprise risk warning information.

2. The method according to claim 1, characterized in that, Based on the dynamic heterogeneous enterprise risk map, the temporal dynamic features of the nodes are extracted by a time-series encoder, and the spatial topological features of the nodes are extracted by a graph structure encoder. The temporal dynamic features and spatial topological features are fused using a cross-modal fusion mechanism to generate a unified spatiotemporal embedding representation, including: S11. Based on the multivariate time series data of each enterprise node within the time window, a forward hidden state sequence is generated through forward propagation processing using a bidirectional LSTM network; based on the multivariate time series data, a backward hidden state sequence is generated through backward propagation processing using a bidirectional LSTM network; based on the forward hidden state sequence and the backward hidden state sequence, a bidirectional hidden state sequence is generated through state concatenation processing. S12. Based on the bidirectional hidden state sequence, the importance weight of each time step is calculated through a temporal self-attention mechanism to generate an attention-weighted temporal embedding representation; S13. Based on the topology of the dynamic heterogeneous enterprise risk map, extract node degree, clustering coefficient and centrality index through graph topology attention network to generate topological feature representation; S14. Based on the topological feature representation and node features, neighborhood information is aggregated through a topology-enhanced cross-attention mechanism to generate a graph structure embedding representation; S15. Based on the temporal embedding representation and the graph structure embedding representation, adaptive weights are calculated through a cross-modal gating fusion mechanism to generate a unified spatiotemporal embedding representation.

3. The method according to claim 1, characterized in that, The method, based on the spatiotemporal embedding representation, models the nonlinear impact of risk events on the state and relationships of enterprise nodes through an event logic-enhanced dynamic heterogeneous graph attention network, and outputs enhanced node representations and enhanced global graph representations, including: S21. Based on the event type, trigger word, and timestamp in the risk event quadruple of the dynamic heterogeneous enterprise risk map, the event encoder processes the data to generate an event vector representation. S22. Based on the event vector representation and the spatiotemporal embedding representation of the corresponding enterprise entity node, calculate the basic impact intensity of the event, the enterprise correlation degree, and the time decay factor; based on the basic impact intensity of the event, the enterprise correlation degree, and the time decay factor, calculate the impact intensity of the event. S23. Based on the intensity of the event's impact, the impact is diffused along the edges of the dynamic heterogeneous enterprise risk graph through event propagation operations to generate an event impact field; S24. Based on a preset logical rule base, calculate the logical association probability between the event and the enterprise entity node through logical rule reasoning, and generate logical reasoning results; S25. Based on the event impact field and logical reasoning results, update the node representation of each node in the dynamic heterogeneous enterprise risk graph through a dynamic heterogeneous graph attention network to generate the enhanced node representation; S26. Based on the enhanced node representations of all the enterprise entity nodes, the mean is calculated through graph pooling operations to generate the global representation of the enhanced graph.

4. The method according to claim 3, characterized in that, The event's basic impact intensity, enterprise correlation, and time decay factor are calculated based on the event vector representation and the spatiotemporal embedding representation corresponding to the enterprise entity node. Based on the event's basic impact strength, the enterprise's relevance, and the time decay factor, the event's impact strength is calculated, including: S31. Perform a linear transformation on the event vector representation to obtain a linear transformation result; process the linear transformation result with the sigmoid function to generate the basic influence strength of the event; S32. Using a pre-trained event type mapping network, the event vector representation is converted into an event influence vector in the same semantic space as the spatiotemporal embedding representation; based on the event influence vector and the spatiotemporal embedding representation of the corresponding enterprise entity node, the enterprise correlation is obtained by calculating cosine similarity; the expression of the event type mapping network is: in, Let be the event impact vector. and The learnable parameters of the event type mapping network, The event vector representation associated with the enterprise entity node v; S33. Based on the current time and the event timestamp in the event vector representation, generate a time decay factor using an exponential decay function; S34. Based on the event's basic impact intensity, the enterprise's relevance, and the time decay factor, calculate the event's impact intensity using an event impact decay mechanism; the calculation formula for the event impact decay mechanism is: in, This indicates the intensity of the impact of the event on enterprise entity node v. The basic impact strength of the event, The degree of enterprise relevance, The time decay factor is mentioned above; For learnable matrices, The cosine similarity function is used. The spatiotemporal embedding representation of the enterprise entity node v, The time decay coefficient, The current time, This is the timestamp of the event.

5. The method according to any one of claims 1 to 4, characterized in that, Based on the enhanced node representation and the enhanced graph global representation, the method generates a topological residual score by calculating the deviation between the node representation and the mean of its community through topological residual detection, and generates a representation similarity score by calculating the minimum similarity between the node representation and the known risk prototype through similarity analysis. This includes: S41. Based on the enhanced node representation, the nodes are divided into multiple communities using a graph clustering algorithm to generate community division results; based on the community division results, the arithmetic mean of all node representations in each community is calculated to generate the mean representation vector of each community. S42. Based on the enhanced node representation of each node and the mean representation vector of its community, the degree of difference is calculated using the Euclidean distance formula to generate a topological residual score; the formula for calculating the topological residual score is: in, The topological residual fraction for node v. The enhanced node representation for node v, Let v be the set of community nodes to which node v belongs. This indicates the number of nodes in the community node set; S43. Based on the training samples of known risk categories, sum all node representations under each risk category and divide by the number of nodes to generate the prototype representation vector of each known risk category. S44. Based on the enhanced node representation of each node and the prototype representation vector of all known risk categories, calculate the similarity value between each node and each known risk category using cosine similarity, and generate a set of similarity values; S45. Select the maximum similarity value from the set of similarity values, and subtract the maximum similarity value from 1 to obtain the similarity score.

6. A big data-based enterprise risk early warning device, used to implement the method according to any one of claims 1 to 5, characterized in that, The device includes: The dynamic risk map generation module is used to construct a dynamic heterogeneous enterprise risk map based on multi-source enterprise data, through data preprocessing and event extraction processing, including enterprise entity nodes, risk event nodes, and environmental factor nodes; A spatiotemporal feature fusion engine is used to extract the temporal dynamic features of nodes based on the dynamic heterogeneous enterprise risk map through a temporal encoder and extract the spatial topological features of nodes through a graph structure encoder; and to fuse the temporal dynamic features and the spatial topological features using a cross-modal fusion mechanism to generate a unified spatiotemporal embedding representation. The risk impact dynamic modeling module is used to model the nonlinear impact of risk events on the state and relationships of enterprise nodes based on the spatiotemporal embedded representation and through an event logic-enhanced dynamic heterogeneous graph attention network, and outputs enhanced node representation and enhanced graph global representation. The risk anomaly quantification module is used to calculate the deviation between the node representation and the mean of its community through topological residual detection based on the enhanced node representation and the enhanced graph global representation, and to generate a topological residual score by calculating the minimum similarity between the node representation and the known risk prototype through similarity analysis. The risk probability assessment module is used to generate an unknown risk score based on the topological residual score and the representation similarity score through linear combination and normalization; and to calculate the known risk probability based on the enhanced node representation through a pre-trained risk prediction model. The intelligent early warning decision module is used to generate a comprehensive risk index based on the unknown risk score and the known risk probability through maximum value calculation; when the comprehensive risk index exceeds the threshold, it outputs enterprise risk warning information.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 5.

Images