Big model based big data risk management system and method

Abstract

The application relates to the technical field of big data risk management, in particular to a big model-based big data risk management system and method, which comprises the following steps: acquiring multi-source heterogeneous historical data under a target business scenario, carrying out cleaning and standardization processing, and generating a unified format space-time feature matrix carrying a time stamp and a business entity identifier. A pre-trained large language model is used to carry out deep semantic coding on the matrix, extract hidden implicit risk factor vectors in the data, simulate the dynamic evolution of the risk factors on the time axis, and predict the risk probability distribution in a specific future time window. A state inversion mechanism is triggered with the risk probability as the boundary condition, corresponding historical precondition combinations are reversely deduced, high-dimensional risk traceability feature tensors are spliced and constructed, and risk causal transmission links are identified through a causal relationship judgment network. The application can deeply mine implicit risks, complete dynamic risk prediction, and realize accurate causal tracing.

Description

Technical Field

[0001] This invention relates to the field of big data risk management technology, and in particular to a big data risk management system and method based on a large model. Background Technology

[0002] Existing big data risk management technologies are mostly designed to process structured business data. They integrate data through conventional data cleaning and format conversion, extract manually defined explicit risk features using traditional statistical methods or shallow machine learning models, and calculate risk probability based on forward time extrapolation. Risk analysis is limited to the correlation and association at the data surface level, and multi-source heterogeneous data cannot form a unified spatiotemporal feature matrix that carries timestamps and business entity identifiers.

[0003] Traditional risk management solutions can only capture intuitive risk features in data, but cannot mine hidden risk factors within the data through deep semantic encoding. Risk prediction is limited to one-way deduction and lacks the ability to reverse-engineer the prediction results. It cannot use risk probability as a boundary condition to inversely deduce the historical preconditions corresponding to the risk. Risk features cannot be combined with traceability information to form a high-dimensional feature tensor, making it difficult to identify the causal transmission link between risk causes and risk outcomes through dedicated networks.

[0004] To address the limitations of existing technologies in using large language models to perform deep semantic encoding on spatiotemporal feature matrices in a unified format to extract latent risk factor vectors, and the inability to deduce historical preconditions for risks, construct feature tensors, and identify causal links of risks through state inversion mechanisms, this project aims to achieve in-depth mining and complete source tracing of big data risks. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by proposing a big data risk management system and method based on a large model.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a big data risk management method based on a large model, comprising:

[0007] Acquire multi-source heterogeneous historical data in the target business scenario, perform cleaning and standardization operations on the multi-source heterogeneous historical data, and generate a spatiotemporal feature matrix in a unified format. Each row of data in the spatiotemporal feature matrix carries a timestamp and a business entity identifier.

[0008] The pre-trained large language model is invoked to perform deep semantic encoding on the spatiotemporal feature matrix to extract the hidden risk factor vectors hidden behind the data.

[0009] Based on the implicit risk factor vector, a multi-step inference calculation process is initiated. This process predicts the risk probability distribution within a specific future time window by simulating the dynamic evolution of risk factors on the time axis.

[0010] After obtaining the risk probability distribution, the state inversion mechanism is immediately triggered. The state inversion mechanism uses the predicted risk probability as the boundary condition to deduce the combination of historical preconditions necessary to lead to the risk state.

[0011] The hidden risk factor vector is combined with the historical preconditions output by the state inversion mechanism to construct a high-dimensional risk tracing feature tensor.

[0012] The risk tracing feature tensor is input into the causal relationship discrimination network to identify causal links with high confidence. These causal links describe the transmission path from specific causes to observable risks.

[0013] As a further aspect of the present invention, the multi-source heterogeneous historical data is cleaned and standardized to generate a spatiotemporal feature matrix in a unified format, including:

[0014] The multi-source heterogeneous historical data includes production work order records, equipment sensor logs, operator behavior trajectories, and supply chain public opinion information.

[0015] For the unstructured text fields in the production work order records and supply chain public opinion information, natural language processing technology is used for word segmentation and entity extraction, and the extracted entities are replaced with standardized industry terminology codes.

[0016] The timestamp information in the device sensor logs and the operator behavior trajectory is normalized and converted into a unified millisecond-level timestamp format;

[0017] Aggregate the processed data based on the business entity identifier, and align the records of the same entity in different data sources into the same time slice;

[0018] Calculate the statistics of each indicator within each time slice, including mean, variance, and peak value, and use the statistics as the numerical features of the time slice.

[0019] The processed text encoding, normalized timestamps, and numerical features are assembled in a fixed column order to form the spatiotemporal feature matrix.

[0020] As a further aspect of the present invention, the step of calling a pre-trained large language model to perform deep semantic encoding on the spatiotemporal feature matrix to extract the latent risk factor vector hidden behind the data includes:

[0021] Switch a finely tuned large language model to feature extraction mode and freeze its top-level classification head parameters;

[0022] The spatiotemporal feature matrix is ​​fed into the embedding layer of the large language model in batches to obtain a high-dimensional dense vector representation of each time slice;

[0023] Within the Transformer architecture of the model, the attention weight matrix is ​​captured, and the strength of the dependency relationship between different time slices is analyzed.

[0024] The vector representations of all time slices are compressed through a temporal pooling layer to aggregate a comprehensive vector representing the entire observation period.

[0025] A nonlinear transformation is applied to the composite vector, and it is mapped to a vector space of a preset dimension through a fully connected layer. The resulting vector is the latent risk factor vector.

[0026] As a further aspect of the present invention, based on the implicit risk factor vector, a multi-step inference calculation process is initiated. This process, by simulating the dynamic evolution of risk factors over time, predicts the risk probability distribution within a specific future time window, including:

[0027] A risk evolution simulator based on a recurrent neural network architecture is constructed, wherein the initial hidden state of the risk evolution simulator is initialized by the hidden risk factor vector;

[0028] Set a sliding time window, the length of which is determined by the sensitivity of the business scenario;

[0029] Inside the risk evolution simulator, multiple iterative calculations are performed, with each iteration representing a one-unit step forward in time, and the hidden state is updated at each step to reflect the cumulative effect of risk factors.

[0030] After the final iteration, the output hidden state of the risk evolution simulator is read and input into a multilayer perceptron;

[0031] The multilayer perceptron outputs a set of discrete probability values, which constitute the risk probability distribution within the specified future time window.

[0032] As a further aspect of the present invention, after obtaining the risk probability distribution, a state inversion mechanism is immediately triggered. This state inversion mechanism uses the predicted risk probability as boundary conditions to inversely derive the combination of historical preconditions necessary to lead to the risk state, including:

[0033] Analyze the risk probability distribution and select specific risk categories with probability values ​​higher than the warning threshold as target risk states.

[0034] The target risk state is transformed into a one-hot encoded vector, which serves as the expected output label of the state inversion mechanism;

[0035] Initialize a random set of candidate historical preconditions, which contains several variables that affect the occurrence of risk;

[0036] Using the principle of gradient backpropagation, the partial derivatives of the desired output label with respect to each variable in the candidate historical precondition set are calculated.

[0037] Based on the direction and magnitude of the partial derivative, the variable values ​​in the candidate historical precondition set are adjusted until the output of the state inversion mechanism approaches the expected output label. At this point, the variable values ​​are the derived historical precondition combination.

[0038] As a further aspect of the present invention, the implicit risk factor vector is concatenated with the historical preconditions output by the state inversion mechanism to construct a high-dimensional risk tracing feature tensor, including:

[0039] The extracted implicit risk factor vectors are reshaped into a two-dimensional matrix, where each column of the matrix represents an abstract risk dimension.

[0040] The derived historical preconditions are combined and expanded into a one-dimensional feature vector, and zeros are padded at the end of the vector to match the dimension of the latent risk factor vector.

[0041] Using the tensor concatenation operator, the two data structures are merged along the feature dimension to generate an expanded feature matrix;

[0042] To preserve causal time-series information, a dimension is added to the top of the feature matrix to indicate whether the feature originates from historical data or is the result of model inference, ultimately forming the high-dimensional risk tracing feature tensor.

[0043] As a further aspect of the present invention, the risk tracing feature tensor is input into a causal relationship discrimination network to identify causal links with high confidence, including:

[0044] A variant of a graph neural network is deployed as the causal relationship discriminant network, wherein the nodes of the graph neural network are instantiated by the feature dimensions in the risk tracing feature tensor;

[0045] Within the causal relationship discrimination network, a message passing mechanism is used to allow nodes representing historical preconditions to transmit feature information to nodes representing risk outcomes.

[0046] After each message is passed, the causal strength coefficient corresponding to the edge connecting the two nodes is calculated. The causal strength coefficient reflects the tightness of the relationship between cause and effect.

[0047] Set a strength threshold, traverse all edges in the causal relationship discrimination network, retain edges with coefficients exceeding the strength threshold, and set the rest of the edges to zero;

[0048] The remaining edges and the two nodes they connect together form the causal link with high confidence.

[0049] As a further aspect of the present invention, it also includes:

[0050] Based on the identified causal links, a compliance verification is performed on the current risk control strategy configuration to check for any policy blind spots.

[0051] In response to the problems found during the verification, a set of strategy adjustment instructions containing correction parameters is generated. This set of strategy adjustment instructions is used to dynamically adjust the existing risk control rules.

[0052] Based on the identified causal links, a compliance verification is performed on the current risk control strategy configuration to check for any policy blind spots, specifically including:

[0053] Analyze the starting node in the causal chain to determine the specific triggering event type and the entity attributes involved;

[0054] Retrieve the currently effective risk control strategy configuration table and check whether there are any blocking rules for the triggered event type;

[0055] Check whether there are consecutive non-blocking nodes in the causal link. A non-blocking node refers to an intermediate link in the link that is not covered by the existing strategy.

[0056] If there are uncovered intermediate links, the intermediate links are determined to be policy blind spots, and the link path where the policy blind spot is located is recorded.

[0057] Generate a verification list containing the locations of the policy blind spots and their associated risk levels.

[0058] As a further aspect of the present invention, in response to the problems discovered during verification, a strategy adjustment instruction set containing correction parameters is generated. This strategy adjustment instruction set is used to dynamically adjust existing risk control rules, including:

[0059] Read the policy blind spot locations from the verification list and extract the entity attribute key-value pairs corresponding to the policy blind spot locations;

[0060] According to the preset risk handling level mapping table, the risk level associated with the strategy blind spot is converted into the corresponding handling action code;

[0061] Construct a rule insertion instruction, which includes a conditional expression that matches the entity attribute key-value pairs and an execution body that executes the disposal action code;

[0062] If there are multiple consecutive blind spots in the causal link, the multiple rule insertion instructions are merged into a single composite rule instruction.

[0063] All generated instructions are aggregated and encapsulated into the policy adjustment instruction set.

[0064] As a further aspect of the present invention, the present invention also includes a big data risk management system based on a large model, the system including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, it implements the steps of the big data risk management method based on the large model described above.

[0065] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0066] The system performs cleaning and standardization operations on multi-source heterogeneous historical data in the target business scenario, generating a unified-format spatiotemporal feature matrix carrying timestamps and business entity identifiers. It then calls a pre-trained large language model to perform deep semantic encoding on the spatiotemporal feature matrix, which can directly extract the hidden risk factor vectors in the data. This breaks through the boundaries of traditional explicit risk feature extraction, fully preserves the time attributes and business entity attributes of the data, and transforms discrete heterogeneous data into risk feature expressions with unified semantics, accurately capturing implicit risk association information that cannot be identified by conventional methods.

[0067] Based on the simulation of the dynamic evolution of risk factors over time using latent risk factor vectors, the risk probability distribution within a specific time window is obtained. This risk probability is used as a boundary condition to trigger a state inversion mechanism, which inversely derives the historical precondition combinations corresponding to the risk. The latent risk factor vectors and historical precondition combinations are concatenated to construct a high-dimensional risk tracing feature tensor. The feature tensor is then input into a causal relationship discrimination network, which can directly identify high-confidence risk causal links, clearly present the transmission path from specific inducements to observable risks, distinguish between the correlation and causal relationships of risks, and achieve reverse tracing and accurate attribution of risks. Attached Figure Description

[0068] Figure 1 This is a flowchart of the big data risk management method based on a large model as described in this invention;

[0069] Figure 2A flowchart for generating a unified format spatiotemporal feature matrix;

[0070] Figure 3 A flowchart for predicting the probability distribution of future risks;

[0071] Figure 4 A bar chart comparing the dimensions of the risk tracing feature tensors;

[0072] Figure 5 This is a 72-hour production sequence diagram for a smart production line scenario. Detailed Implementation

[0073] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0074] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0075] See Figure 1 The process involves acquiring multi-source heterogeneous historical data from the target business scenario, cleaning and standardizing the data to generate a unified-format spatiotemporal feature matrix. Each row in this matrix carries a timestamp and a business entity identifier. A pre-trained large language model is then used to perform deep semantic encoding on the spatiotemporal feature matrix, extracting latent risk factor vectors hidden behind the data. Based on these latent risk factor vectors, a multi-step inference calculation process is initiated. This process simulates the dynamic evolution of risk factors over time to predict the risk probability distribution within a specific future time window. After obtaining the risk probability distribution, a state inversion mechanism is immediately triggered. This mechanism uses the predicted risk probability as boundary conditions to inversely derive the necessary historical preconditions that lead to the risk state. The latent risk factor vectors are concatenated with the historical preconditions output by the state inversion mechanism to construct a high-dimensional risk tracing feature tensor. This risk tracing feature tensor is then input into a causal relationship discriminant network to identify causal links with high confidence. These causal links describe the transmission path from a specific trigger to an observable risk.

[0076] In one embodiment of the present invention, the big data risk management method based on a large model can be applied to quality risk control scenarios in intelligent manufacturing production lines. In this scenario, the multi-source heterogeneous historical data that needs to be acquired includes production work order records generated by the manufacturing execution system, equipment sensor logs collected by the industrial IoT platform, operator behavior trajectories recorded by the human-machine interface, and relevant supply chain public opinion information crawled from the public network. The "process remarks" field in the production work order records and the news text in the supply chain public opinion information are both unstructured text fields. See also... Figure 2 For these unstructured text fields, natural language processing technology is used for word segmentation and entity extraction. For example, the entity "tool wear alarm" is extracted from "process notes" and the entity "key component supplier XX factory shutdown" is extracted from public opinion information. Based on the preset terminology mapping table, the extracted entities are replaced with standardized industry terminology codes.

[0077] In practice, the timestamp information in equipment sensor logs and operator behavior trajectories is normalized. The timestamp format of the equipment sensor logs is "DD-MM-YYYYHH:MM:SS", and the timestamp format of the operator behavior trajectories is a Unix timestamp. The normalization process converts these two timestamps into a millisecond-level timestamp format starting from midnight on January 1, 1970, UTC. Based on the business entity identifier, such as the production equipment number or product batch number, the processed data from four data sources—production work order records, equipment sensor logs, operator behavior trajectories, and supply chain sentiment information—is aggregated. The aggregation operation aligns records with the same user account ID in different data sources within the same minute time window to the same time slice.

[0078] In some embodiments, statistics for each indicator within each time slice are calculated. For readings of key process parameters, the mean, variance, and peak value of all readings within that time slice are calculated. For equipment alarm frequency or operator-specific action frequency indicators, the mean of the number of occurrences within that time slice is calculated. The processed standard industry terminology encoding, normalized millisecond-level timestamps, and numerical features including mean, variance, and peak value are assembled in a fixed column order of "timestamp, entity identifier, encoded field, numerical feature field..." to form a spatiotemporal feature matrix in a unified format where each row of data carries a timestamp and a business entity identifier. It can be understood that this process converts multi-source heterogeneous data into a regular integer value matrix that the model can directly process.

[0079] In practical implementation, to more accurately characterize the distribution characteristics of data within a time slice, the calculation of statistics can be further refined. For a data slice containing... A time slice of an observation, containing a certain indicator The peak value can be quantified using the following formula:

[0080]

[0081] in: This represents the calculated peak statistic. Indicates the index within this time slice The maximum observed value, Indicators The minimum observed value, the denominator is the index. The formula for calculating the standard deviation within this time slice is as follows: Indicators The mean, Indicates the index within this time slice The number of observations, It is a very small positive number used to prevent the denominator from being zero. Optionally, the calculation of the standard deviation in the formula ensures that the peak statistic reflects both the range and dispersion of the data. Ultimately, the mean, variance, and peak statistic together serve as the numerical characteristics of this time slice.

[0082] In one embodiment of the present invention, when the big data risk management method based on a large model is applied to the quality risk control scenario in a smart manufacturing production line, the deep semantic encoding process needs to call a specific pre-trained large language model. For example, a variant of the BERT model pre-trained on a general corpus and fine-tuned on quality risk control text can be used. In specific implementation, this large language model is switched to feature extraction mode, and its top-level classification head parameters are frozen, so that the forward propagation of the model is only used to calculate feature representations and not to perform the final classification output.

[0083] In practical implementation, the spatiotemporal feature matrix is ​​fed into the embedding layer of the large language model in batches. Each row of the spatiotemporal feature matrix represents a time slice data containing timestamps, entity identifiers, and multiple features. The embedding layer converts the numerical values ​​and encoded sequences of each time slice into a high-dimensional dense vector representation. In some embodiments, during the forward propagation process within the Transformer architecture of the model, the attention weight matrix generated by the attention module is captured. The attention weight matrix quantifies the strength of the dependency relationship between different time slices. By analyzing the attention weight matrix, the historical time segments most relevant to the current risk assessment can be identified.

[0084] In practice, the high-dimensional dense vector representations of all time slices are compressed using a temporal pooling layer. The temporal pooling layer aggregates a comprehensive vector representing the entire observation period. Optional pooling strategies include max pooling or attention-weighted average pooling. The attention-weighted average pooling operation can be implemented using the following formula:

[0085]

[0086] in: This represents the composite vector obtained through aggregation. This indicates the total number of time slices. Indicates the first A high-dimensional dense vector representation of a time slice Indicates the first The attention weights corresponding to each time slice vector are determined by another independent attention network based on the vector. The pooling is calculated from its own content. This pooling method allows the model to dynamically assign importance to different points in time.

[0087] In practice, a nonlinear transformation is applied to the composite vector, for example, through a multilayer perceptron block with GeLU activation function. The nonlinearly transformed features are fed into a fully connected layer, which maps the features to a vector space of a preset dimension, such as 256 dimensions. The resulting 256-dimensional vector is the latent risk factor vector. In some embodiments, the weight parameters of the fully connected layer are fine-tuned during the training phase along with the downstream task, while the backbone parameters of the large language model can be frozen or fine-tuned with a very low learning rate to balance feature generality and task adaptability. Optionally, the choice of the preset dimension needs to match the structure of the subsequent risk evolution simulator.

[0088] In one embodiment of the present invention, the big data risk management method based on a large model initiates the simulation and inverse derivation of risk evolution after extracting the implicit risk factor vectors. In specific implementations, for quality risk control scenarios in intelligent manufacturing production lines, please refer to... Figure 3 A risk evolution simulator based on a long short-term memory network architecture is constructed. The initial hidden state of the risk evolution simulator is initialized by the hidden risk factor vector extracted in the previous step. A sliding time window is set, the length of which is determined by the sensitivity of the business scenario. For example, for real-time fraud detection, the sliding time window length can be set to the next hour, which means that it is necessary to predict the risk probability change within the next sixty minutes.

[0089] In practice, the risk evolution simulator performs multiple iterative calculations, with each iteration representing a unit step forward in time, which can be set to ten minutes. In each iteration, the simulator calculates the hidden state for the next step based on the current hidden state and external environmental characteristics, thus updating the hidden state to reflect the cumulative effect of risk factors. After the final iteration, the output hidden state of the simulator is read and input into a multilayer perceptron containing two hidden layers. The multilayer perceptron outputs a set of discrete probability values, corresponding to different risk categories, such as "high risk," "medium risk," and "low risk," constituting the risk probability distribution for the next hour. The iterative process of the risk evolution simulator can be described by the following formula, which outlines its core calculation steps:

[0090]

[0091] in: Indicates at time step The updated hidden state vector. It represents the nonlinear combination function within a long short-term memory network unit (including calculations for input gate, forget gate, output gate, etc.). The weight matrix represents the hidden state transition. Indicates the previous time step The hidden state vector. This represents the corresponding bias term. This calculation is repeated at each time step to achieve recursive updates of the hidden state.

[0092] After obtaining the risk probability distribution, the state inversion mechanism is immediately triggered. The risk probability distribution is analyzed, and specific risk categories with probability values ​​higher than the warning threshold are selected as target risk states; for example, the probability of the "high-risk" category exceeds 0.7. The target risk state is transformed into a one-hot encoded vector, which serves as the expected output label of the state inversion mechanism; for example, the one-hot encoding for the high-risk category is [1,0,0]. A random set of candidate historical preconditions is initialized. This set contains several variables that influence the occurrence of risks, such as "the variance of equipment vibration amplitude in the past hour," "the number of times key temperature parameters exceeded the process upper limit in the past shift," and "the inventory duration of the currently used raw material batch."

[0093] In some embodiments, the principle of gradient backpropagation is used to calculate the partial derivatives of the desired output label with respect to each variable in the candidate historical precondition set. Based on the direction and magnitude of the partial derivatives, the values ​​of the variables in the candidate historical precondition set are adjusted, following the gradient ascent principle to increase the model's output probability for the target risk state, until the output of the state inversion mechanism (usually a network symmetrical to the risk evolution simulator structure but running in reverse) approaches the desired output label. The variable values ​​at this point are the derived combination of historical preconditions. Optionally, the adjustment process can be terminated by setting an upper limit on the number of iterations or an error tolerance threshold. It can be understood that the state inversion mechanism, through reverse solving, locates the key combination of historical variable values ​​that leads to a specific high-risk prediction.

[0094] In one embodiment of the present invention, the big data risk management method based on a large model needs to perform feature fusion and causal identification after obtaining the latent risk factor vector and the combination of historical preconditions. In a specific implementation, for the quality risk control scenario in a smart manufacturing production line, the latent risk factor vector extracted from the coding network is a 256-dimensional vector. The extracted latent risk factor vector is reshaped into a two-dimensional matrix, where each column of the matrix represents an abstract risk dimension. For example, it can be reshaped into a 16-row, 16-column matrix, where the 16 columns correspond to 16 abstract risk patterns. The variable values ​​derived from the combination of historical preconditions include "device vibration amplitude variance > 0.5g² in the past hour", "number of temperature exceedances in the past shift >= 3 times", and "raw material batch inventory duration > 30 days". The derived combination of historical preconditions is expanded into a one-dimensional feature vector. Each variable value is standardized and used as an element of the vector, and zeros are padded at the end of the vector to match the total dimension of 256 of the latent risk factor vector.

[0095] In some embodiments, a tensor concatenation operator is used to fuse a two-dimensional matrix obtained by reshaping the latent risk factor vector along the feature dimension with a one-dimensional feature vector obtained by expanding and padding with zeros from the historical preconditions. The concatenation operation generates an expanded feature matrix with a shape of 16 rows and 17 columns, where the first 16 columns come from the latent risk factor matrix and the 17th column comes from the zero-padded historical precondition vector. To preserve causal time-series information, a dimension is added to the top of the feature matrix to indicate whether the feature originates from historical data or is the result of model inference. This marking can be understood as being achieved through a binary mask matrix, where positions corresponding to historical data are 0 and positions corresponding to model inference results are 1, ultimately forming a high-dimensional risk tracing feature tensor with a shape of 2×16×17. Refer to Table 1 for the structure of the risk tracing feature tensor.

[0096] Table 1: Example Table of Risk Source Tracing Feature Tensor Structure

[0097] Historical data (0) 16-dimensional risk feature values ​​obtained from historical data encoding 0 (fill with zeros) Model inference (1) 16-dimensional eigenvalues ​​obtained from latent factor vector analysis Inferred value from combination of historical preconditions

[0098] In practice, a graph attention network is deployed as the causal relationship discrimination network. The nodes of the graph attention network are instantiated from the feature dimensions in the risk tracing feature tensor. Specifically, each column of features in the risk tracing feature tensor (a total of 17 columns) corresponds to a graph node, and each node has two feature values, one from the source label dimension of "historical data" and the other from "model inference". Inside the causal relationship discrimination network, a message passing mechanism allows the node representing the historical preconditions (i.e., node number 17) to pass feature information to the nodes representing the risk outcome (i.e., nodes related to the risk category from nodes numbered 1 to 16).

[0099] After each message pass, the causal strength coefficient corresponding to the edge connecting the two nodes is calculated. The causal strength coefficient can be obtained by calculating the attention score between node features, specifically using the following formula:

[0100]

[0101] in: Indicates from node Pointing to node The causality strength coefficient of the edge, This represents the LeakyReLU activation function. This represents a learnable attention weight vector. This represents a shared linear transformation weight matrix. and Representing the target node respectively and source node eigenvectors, This represents the feature vector of neighbor node n. This represents a vector concatenation operation. Represents a node The set of all neighboring nodes. The larger the value, the more likely it is to be a node. For nodes The stronger the impact, the closer the connection between cause and effect.

[0102] See Figure 4This is a bar chart comparing the tensor dimensions of risk tracing features, focusing on the feature fusion stage of big data risk management. Its core purpose is to compare the sum of feature values ​​across 17 dimensions for two types of features: "historical data" and "model inference." In most dimensions, the model inference feature values ​​are higher than the historical data feature values, reflecting the large model's deep encoding ability of implicit risk factors—the model can uncover risk correlation patterns not directly reflected in historical data. Column 8 shows the peak value of the model inference feature value, representing the node with the highest risk inference intensity across all dimensions, signifying the core impact of this risk dimension on the model's prediction results. Column 12 shows the lowest historical data feature value across the entire chart, and the model inference feature value for this dimension is also at a low level, indicating that this risk dimension has a low risk contribution in the current scenario.

[0103] In one embodiment of the present invention, after identifying a high-confidence causal link, the big data risk management method based on a large model performs a compliance check on the current risk control strategy configuration based on the identified causal link. In a specific implementation, taking an identified causal link as an example, "(Event: In three consecutive production batches, the reading of a certain sensor continuously drifts) leading to -> (Risk: High risk of the final product's dimensional tolerance exceeding the limit)," the starting node in the causal link is analyzed to determine the specific triggering event type as "continuous drift of critical sensor readings." The entity attributes involved include "sensor number," "production station to which it belongs," "associated process parameters," and "duration." The currently effective quality control strategy configuration table is retrieved to check whether there are any interception rules for the triggering event type "continuous drift of critical sensor readings." It can be understood that the strategy configuration table is stored in the form of a rule list, and each rule contains matching conditions and handling actions.

[0104] In practice, it is necessary to check whether there are consecutive non-blocking nodes in the causal link. A non-blocking node refers to an intermediate link in the link that is not covered by the existing policy. Compliance verification can introduce quantitative coverage calculations, for example, by calculating the coverage of the existing policy to the set of preconditions of the causal link using the following formula:

[0105]

[0106] in: Indicates policy coverage. This represents the set of attributes involved in all current risk control strategy matching conditions. This represents the set of all precondition attributes parsed from the starting and intermediate nodes of the causal link. The cardinality (number of elements) of a set. When this occurs, it indicates the existence of attributes not covered by the policy, i.e., a policy blind spot. This calculation can be understood as helping to systematically identify coverage gaps.

[0107] In practical implementation, a set of policy adjustment instructions containing correction parameters is generated for the issues found in the verification checklist. The policy blind spot locations in the verification checklist are read, and the corresponding entity attribute key-value pairs are extracted, for example, the key-value pair {"sensor_id":"PT-101","parameter":"temperature","trend_duration":"3 batches","trend_direction":"rising"} is extracted. According to the preset risk handling level mapping table, the risk level associated with the policy blind spot is converted into the corresponding handling action code, for example, a high-risk level is mapped to the action code REJECT_AND_ALERT (reject and alarm). In practical implementation, a rule insertion instruction is constructed, which includes a conditional expression matching the entity attribute key-value pairs and an execution body for executing the handling action code. The conditional expression may be IF sensor_id=="PT-101" AND parameter=="temperature" AND consencutive_batches_with_trend(sensor_id,"rising")>=3THEN. The execution body is ACTION=ALERT_AND_HOLD_BATCH (alarm and temporarily detain the batch of products). If multiple consecutive blind spots exist in the causal chain, multiple rule insertion instructions are merged into a composite rule instruction. The condition of the composite rule instruction is a logical OR combination of the conditions of multiple blind spot paths. All generated instructions are summarized and encapsulated into a strategy adjustment instruction set. The strategy adjustment instruction set can be in JSON or XML format and includes metadata such as instruction sequence, effective time, and target strategy set ID. Optionally, the strategy adjustment instruction set can be sent to the risk control strategy engine through a message queue, where the engine parses and dynamically loads it to complete the dynamic adjustment of existing risk control rules.

[0108] See Figure 5This is a 72-hour production timeline diagram in a smart production line scenario, used to illustrate the dynamic changes in key process parameter readings and production cycle time. It falls under the data preprocessing and feature extraction stage of big data risk management. The key process parameter readings exhibit a periodic fluctuation of approximately 10 hours, with peak values ​​stabilizing between 10,000 and 20,000, and the fluctuation range is relatively small, consistent with normal business rhythms. The production cycle time also shows periodicity, but with a larger fluctuation range, reaching peak values ​​of 80,000 to 90,000 and trough values ​​of approximately 20,000. The peak / trough values ​​of the key process parameter readings and the production cycle time are not completely synchronized, indicating the existence of a "non-standard operating procedure" behavior pattern, a key characteristic that needs to be monitored in production quality risk control scenarios. For example, around the 10, 30, and 50-hour marks, the production cycle time shows sharp spikes, but the key process parameter readings do not increase significantly in sync, suggesting possible simplification of processes or accelerated operations to meet deadlines. During the approximately 65-70 hour range, the production cycle time shows continuous high peaks, and the readings of key process parameters also rise simultaneously. This may be a signal that the equipment is operating under overload or that a systemic quality risk is about to occur.

[0109] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A big data risk management method based on a large model, characterized in that, include: Acquire multi-source heterogeneous historical data in the target business scenario, perform cleaning and standardization operations on the multi-source heterogeneous historical data, and generate a spatiotemporal feature matrix in a unified format. Each row of data in the spatiotemporal feature matrix carries a timestamp and a business entity identifier. The multi-source heterogeneous historical data includes production work order records, equipment sensor logs, operator behavior trajectories, and supply chain public opinion information. The pre-trained large language model is invoked to perform deep semantic encoding on the spatiotemporal feature matrix to extract the hidden risk factor vectors hidden behind the data, where the risk is the quality risk in the production line. Based on the implicit risk factor vector, a multi-step inference calculation process is initiated. This process predicts the risk probability distribution within a specific future time window by simulating the dynamic evolution of risk factors over time, including: A risk evolution simulator based on a recurrent neural network architecture is constructed, wherein the initial hidden state of the risk evolution simulator is initialized by the hidden risk factor vector; Set a sliding time window, the length of which is determined by the sensitivity of the business scenario; Inside the risk evolution simulator, multiple iterative calculations are performed, with each iteration representing a one-unit step forward in time, and the hidden state is updated at each step to reflect the cumulative effect of risk factors. After the final iteration, the output hidden state of the risk evolution simulator is read and input into a multilayer perceptron; The multilayer perceptron outputs a set of discrete probability values, which constitute the risk probability distribution within the specific future time window. After obtaining the risk probability distribution, a state inversion mechanism is immediately triggered. This mechanism uses the predicted risk probability as boundary conditions to deduce the necessary combination of historical preconditions leading to the risk state, including: Analyze the risk probability distribution and select specific risk categories with probability values ​​higher than the warning threshold as target risk states. The target risk state is transformed into a one-hot encoded vector, which serves as the expected output label of the state inversion mechanism; Initialize a random set of candidate historical preconditions, which contains several variables that affect the occurrence of risk; Using the principle of gradient backpropagation, the partial derivatives of the desired output label with respect to each variable in the candidate historical precondition set are calculated. Based on the direction and magnitude of the partial derivative, the variable values ​​in the candidate historical precondition set are adjusted until the output of the state inversion mechanism approaches the expected output label. At this point, the variable values ​​are the derived historical precondition combination. The hidden risk factor vector is combined with the historical preconditions output by the state inversion mechanism to construct a high-dimensional risk tracing feature tensor. The risk tracing feature tensor is input into the causal relationship discrimination network to identify causal links with high confidence. These causal links describe the transmission path from specific causes to observable risks.

2. The big data risk management method based on a large model as described in claim 1, characterized in that, The multi-source heterogeneous historical data is cleaned and standardized to generate a spatiotemporal feature matrix in a unified format, including: For the unstructured text fields in the production work order records and supply chain public opinion information, natural language processing technology is used for word segmentation and entity extraction, and the extracted entities are replaced with standardized industry terminology codes. The timestamp information in the device sensor logs and the operator behavior trajectory is normalized and converted into a unified millisecond-level timestamp format; Aggregate the processed data based on the business entity identifier, and align the records of the same entity in different data sources into the same time slice; Calculate the statistics of each indicator within each time slice, including mean, variance, and peak value, and use the statistics as the numerical features of the time slice. The processed text encoding, normalized timestamps, and numerical features are assembled in a fixed column order to form the spatiotemporal feature matrix.

3. The big data risk management method based on a large model as described in claim 2, characterized in that, The process involves calling a pre-trained large language model to perform deep semantic encoding on the spatiotemporal feature matrix, extracting latent risk factor vectors hidden behind the data, including: Switch a finely tuned large language model to feature extraction mode and freeze its top-level classification head parameters; The spatiotemporal feature matrix is ​​fed into the embedding layer of the large language model in batches to obtain a high-dimensional dense vector representation of each time slice; Within the Transformer architecture of the model, the attention weight matrix is ​​captured, and the strength of the dependency relationship between different time slices is analyzed. The vector representations of all time slices are compressed through a temporal pooling layer to aggregate a comprehensive vector representing the entire observation period. A nonlinear transformation is applied to the composite vector, and it is mapped to a vector space of a preset dimension through a fully connected layer. The resulting vector is the latent risk factor vector.

4. The big data risk management method based on a large model as described in claim 3, characterized in that, The implicit risk factor vector is concatenated with the historical preconditions output by the state inversion mechanism to construct a high-dimensional risk tracing feature tensor, including: The extracted implicit risk factor vectors are reshaped into a two-dimensional matrix, where each column of the matrix represents an abstract risk dimension. The derived historical preconditions are combined and expanded into a one-dimensional feature vector, and zeros are padded at the end of the vector to match the dimension of the latent risk factor vector. Using the tensor concatenation operator, the two data structures are merged along the feature dimension to generate an expanded feature matrix; To preserve causal time-series information, a dimension is added to the top of the feature matrix to indicate whether the feature originates from historical data or is the result of model inference, ultimately forming the high-dimensional risk tracing feature tensor.

5. The big data risk management method based on a large model as described in claim 4, characterized in that, The risk tracing feature tensor is input into a causal relationship discrimination network to identify causal links with high confidence, including: A variant of a graph neural network is deployed as the causal relationship discriminant network, wherein the nodes of the graph neural network are instantiated by the feature dimensions in the risk tracing feature tensor; Within the causal relationship discrimination network, a message passing mechanism is used to allow nodes representing historical preconditions to transmit feature information to nodes representing risk outcomes. After each message is passed, the causal strength coefficient corresponding to the edge connecting the two nodes is calculated. The causal strength coefficient reflects the tightness of the relationship between cause and effect. Set a strength threshold, traverse all edges in the causal relationship discrimination network, retain edges with coefficients exceeding the strength threshold, and set the rest of the edges to zero; The remaining edges and the two nodes they connect together form the causal link with high confidence.

6. The big data risk management method based on a large model as described in claim 5, characterized in that, Also includes: Based on the identified causal links, a compliance verification is performed on the current risk control strategy configuration to check for any policy blind spots. In response to the problems found during the verification, a set of strategy adjustment instructions containing correction parameters is generated. This set of strategy adjustment instructions is used to dynamically adjust the existing risk control rules. Based on the identified causal links, a compliance verification is performed on the current risk control strategy configuration to check for any policy blind spots, specifically including: Analyze the starting node in the causal chain to determine the specific triggering event type and the entity attributes involved; Retrieve the currently effective risk control strategy configuration table and check whether there are any blocking rules for the triggered event type; Check whether there are consecutive non-blocking nodes in the causal link. A non-blocking node refers to an intermediate link in the link that is not covered by the existing strategy. If there are uncovered intermediate links, the intermediate links are determined to be policy blind spots, and the link path where the policy blind spot is located is recorded. Generate a verification list containing the locations of the policy blind spots and their associated risk levels.

7. The big data risk management method based on a large model as described in claim 6, characterized in that, In response to the issues discovered during the verification process, a strategy adjustment instruction set containing correction parameters is generated. This instruction set is used to dynamically adjust existing risk control rules, including: Read the policy blind spot locations from the verification list and extract the entity attribute key-value pairs corresponding to the policy blind spot locations; According to the preset risk handling level mapping table, the risk level associated with the strategy blind spot is converted into the corresponding handling action code; Construct a rule insertion instruction, which includes a conditional expression that matches the entity attribute key-value pairs and an execution body that executes the disposal action code; If there are multiple consecutive blind spots in the causal link, the multiple rule insertion instructions are merged into a single composite rule instruction. All generated instructions are aggregated and encapsulated into the policy adjustment instruction set.

8. A big data risk management system based on a large model, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the big data risk management method based on a large model as described in any one of claims 1 to 7.

Images