An AI-based method, device, and electronic device for identifying intelligence risks.

Abstract

This specification discloses an intelligence risk identification method, apparatus, and electronic device based on artificial intelligence, comprising: acquiring multi-source heterogeneous intelligence data to be analyzed; fusing the multi-source heterogeneous intelligence data to be analyzed to obtain fused intelligence data; performing semantic understanding on the fused intelligence data to obtain a semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed; fusing the semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed to obtain a fused feature vector; and inputting the fused feature vector as input to a pre-trained intelligence risk identification model to obtain an intelligence risk identification result, wherein the pre-trained intelligence risk identification model is trained based on a CNN-LSTM model.

Description

Technical Field

[0001] This specification relates to the field of artificial intelligence technology, and in particular to an intelligence risk identification method, device, and electronic device based on artificial intelligence. Background Technology

[0002] Intelligence risk identification is a systematic approach to discovering and analyzing potential legal, security, or compliance risks in intelligence work. Its core lies in identifying the sources of risk, assessing potential impacts, and developing countermeasures. Therefore, intelligence risk identification is crucial for intelligence security and helps protect the security of intelligence information.

[0003] With the development of large-scale models and artificial intelligence, intelligence risk identification has rapidly advanced in existing technologies. However, current intelligence risk identification methods are generally only applicable to a specific domain, resulting in risk identification models trained on these models being heavily reliant on the risk characteristics of that particular domain and unable to be applied to other domains. Consequently, cross-domain general risk identification cannot be achieved, leading to high deployment and maintenance costs for intelligence risk identification.

[0004] Therefore, a new AI-based method for identifying intelligence risks is needed. Summary of the Invention

[0005] This specification provides an artificial intelligence-based intelligence risk identification method, apparatus, and electronic device to address the following technical problem: With the development of large-scale models and artificial intelligence, intelligence risk identification has rapidly advanced in the prior art. However, existing intelligence risk identification methods are generally only applicable to a specific domain, resulting in the risk identification model trained on it being heavily reliant on the risk characteristics of that specific domain and unable to be applied to other domains. Therefore, it is impossible to achieve cross-domain universal risk identification, leading to high deployment and maintenance costs for intelligence risk identification.

[0006] To solve the above-mentioned technical problems, the embodiments in this specification are implemented as follows:

[0007] This specification provides an artificial intelligence-based intelligence risk identification method, including:

[0008] Acquire multi-source heterogeneous intelligence data to be analyzed;

[0009] The multi-source heterogeneous intelligence data to be analyzed is fused to obtain fused intelligence data;

[0010] Semantic understanding is performed on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed;

[0011] The semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed are fused to obtain a fused feature vector.

[0012] The fused feature vector is used as input to a pre-trained intelligence risk identification model to obtain intelligence risk identification results. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model.

[0013] This specification also provides an intelligence risk identification device based on artificial intelligence, comprising:

[0014] The acquisition module acquires multi-source heterogeneous intelligence data to be analyzed.

[0015] The preprocessing module fuses the multi-source heterogeneous intelligence data to be analyzed to obtain fused intelligence data.

[0016] The semantic understanding module performs semantic understanding on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed;

[0017] The feature fusion module fuses the semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed to obtain a fused feature vector.

[0018] The risk identification module takes the fused feature vector as input and feeds it into a pre-trained intelligence risk identification model to obtain the intelligence risk identification result. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model.

[0019] This specification also provides an electronic device, including:

[0020] At least one processor; and,

[0021] A memory communicatively connected to the at least one processor; wherein,

[0022] The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to:

[0023] Acquire multi-source heterogeneous intelligence data to be analyzed;

[0024] The multi-source heterogeneous intelligence data to be analyzed is fused to obtain fused intelligence data;

[0025] Semantic understanding is performed on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed;

[0026] The semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed are fused to obtain a fused feature vector.

[0027] The fused feature vector is used as input to a pre-trained intelligence risk identification model to obtain intelligence risk identification results. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model.

[0028] The intelligence risk identification method based on artificial intelligence provided in this specification involves: acquiring multi-source heterogeneous intelligence data to be analyzed; fusing the multi-source heterogeneous intelligence data to obtain fused intelligence data; performing semantic understanding on the fused intelligence data to obtain semantic feature vectors of the multi-source heterogeneous intelligence data to be analyzed; fusing the semantic feature vectors and the knowledge feature vectors of the multi-source heterogeneous intelligence data to obtain fused feature vectors; and inputting the fused feature vectors into a pre-trained intelligence risk identification model to obtain intelligence risk identification results. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model and can integrate deep semantic information and structured knowledge, thereby accurately and efficiently identifying general risks in cross-domain intelligence information such as finance, military, public health, education, science and technology, and the internet. This solves the problem that intelligence risk identification cannot achieve general risk identification and enables integrated and refined judgment of risk types and levels. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 A schematic diagram of the system architecture of an intelligence risk identification method based on artificial intelligence provided for the embodiments of this specification;

[0031] Figure 2 A flowchart illustrating an intelligence risk identification method based on artificial intelligence, provided as an embodiment of this specification.

[0032] Figure 3 This is a schematic diagram of an intelligence risk identification device based on artificial intelligence, provided as an embodiment of this specification. Detailed Implementation

[0033] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0034] Figure 1 This is a schematic diagram of a system architecture for an intelligence risk identification method based on artificial intelligence, provided as an embodiment of this specification. Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0035] Terminal devices 101, 102, and 103 interact with server 105 via network 104 to receive or send messages, etc. Various client applications can be installed on terminal devices 101, 102, and 103, such as dedicated programs for intelligence risk identification methods based on artificial intelligence.

[0036] Terminal devices 101, 102, and 103 can be either hardware or software. When terminal devices 101, 102, and 103 are hardware, they can be various dedicated or general-purpose electronic devices, including but not limited to smartphones, tablets, laptops, and desktop computers. When terminal devices 101, 102, and 103 are software, they can be installed in the electronic devices listed above. They can be implemented as multiple software programs or software modules (e.g., multiple software programs or software modules used to provide distributed services) or as a single software program or software module.

[0037] Server 105 can be a server that provides various services, such as a backend server that provides services to client applications installed on terminal devices 101, 102, and 103. For example, the server can perform AI-based intelligence risk identification so that the AI-based intelligence risk identification results can be displayed on terminal device servers 101, 102, and 103.

[0038] Server 105 can be either hardware or software. When server 105 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 105 is software, it can be implemented as multiple software programs or software modules (e.g., multiple software programs or software modules used to provide distributed services), or as a single software program or software module.

[0039] Figure 2 This is a flowchart illustrating an artificial intelligence-based intelligence risk identification method provided in an embodiment of this specification. From a programming perspective, the executor of the process can be a program hosted on an application server or application terminal. It is understood that this method can be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities. Figure 2 As shown, this intelligence risk identification method includes:

[0040] Step S201: Obtain multi-source heterogeneous intelligence data to be analyzed.

[0041] In the embodiments of this specification, the multi-source heterogeneous intelligence data to be analyzed is data obtained from multiple preset data sources. Specifically, the preset data sources include, but are not limited to: news portals, social media platforms, industry report databases, and scientific literature databases.

[0042] In the embodiments of this specification, the types of multi-source heterogeneous intelligence data to be analyzed include: financial intelligence data, military intelligence data, public health intelligence data, educational intelligence data, scientific and technological intelligence data, and cyber intelligence data. The multi-source heterogeneous intelligence data to be analyzed is one of the above types.

[0043] The types of multi-source heterogeneous intelligence data to be analyzed can be HTML, PDF, images, or text files.

[0044] Step S203: Perform data fusion on the multi-source heterogeneous intelligence data to be analyzed to obtain fused intelligence data.

[0045] Since the acquired heterogeneous intelligence data from multiple sources differ in terms of data format, source, and data type, the first step is to fuse the heterogeneous intelligence data to ensure the accuracy of subsequent intelligence risk identification results.

[0046] In the embodiments of this specification, the step of fusing the multi-source heterogeneous intelligence data to be analyzed to obtain fused intelligence data specifically includes:

[0047] After standardizing the multi-source heterogeneous intelligence data to be analyzed, standardized intelligence data is obtained.

[0048] After performing entity linking, core referential elimination, and data alignment on the standardized intelligence data, the timeline view is obtained;

[0049] The timeline view is cleaned and entities are named to obtain the fused intelligence data.

[0050] In the embodiments of this specification, the standardization process of the multi-source heterogeneous intelligence data to be analyzed to obtain standardized intelligence data specifically includes:

[0051] Extract the text data of the multi-source heterogeneous intelligence data to be analyzed, convert the text data of the multi-source heterogeneous intelligence data to be analyzed into a preset internal data type, and obtain the standardized intelligence data. The preset internal data type is in Jason format, and the preset internal data includes: unique ID, source, publication time, title, content and original data link.

[0052] The process of performing entity linking, core referential elimination, and data alignment on the standardized intelligence data to obtain the timeline view specifically includes:

[0053] Entity identification is performed on the standardized intelligence data to obtain suspected entities;

[0054] The suspected entities are matched against a preset knowledge base to obtain candidate entities;

[0055] Based on contextual similarity and entity popularity, the candidate entities are identified to obtain the target entity link;

[0056] Based on the target entity link, after dereferencing the standardized intelligence data, with the target entity as the core, the information related to the target entity in the standardized intelligence data is aligned and arranged in chronological order to obtain a timeline view corresponding to the target entity. The information related to the target entity includes: events, statements and data changes related to the target entity.

[0057] The process of cleaning and naming entities in the timeline view to obtain the fused intelligence data specifically includes:

[0058] After processing the timeline view, text segmentation is performed to obtain clean, short sentences;

[0059] The entity linking results of the clean short sentence are corrected by linking them with the target entity to obtain the updated entity;

[0060] The clean short sentences, updated entities, and metadata are fused together to obtain the fused intelligence data, wherein the metadata includes: original data links, publication time, and associated entities.

[0061] In the embodiments of this specification, given the diversity of the types of multi-source heterogeneous intelligence data to be analyzed, the text data of the multi-source heterogeneous intelligence data to be analyzed is extracted, specifically including:

[0062] Use BeautifulSoup to extract the main text and publication time from HTML;

[0063] Use PyMuPDF or pdfplumber to parse PDFs;

[0064] Use OCR technology to extract text from images;

[0065] Text data does not need to be extracted and can be used directly.

[0066] Entity identification is performed on the standardized intelligence data to obtain suspected entities. Specifically, this includes using the NER model to initially identify entities such as names of people, organizations, locations, times, and products.

[0067] The default knowledge base is an entity knowledge base, which specifically includes: the entity's standard name, alias, type, unique ID and its attributes. The type refers to the type to which the entity belongs, specifically including: financial intelligence, military intelligence, public health intelligence, educational intelligence, scientific and technological intelligence and cyber intelligence.

[0068] Based on contextual similarity and entity popularity, the candidate entities are identified and the target entity links are obtained. This can be done using machine learning models or large models, both of which utilize existing technologies and will not be elaborated further here.

[0069] Core referential elimination is used to resolve the question of which linked entity a pronoun ("he", "the company") or alias within the same document refers to.

[0070] Based on the target entity link, after dereferencing the standardized intelligence data, with the target entity as the core, the information related to the target entity in the standardized intelligence data is aligned and arranged in chronological order to obtain a timeline view corresponding to the target entity. In this process, standard timestamps are used.

[0071] In the embodiments of this specification, data processing of the timeline view specifically includes: removing irrelevant noise and text normalization. Removing irrelevant noise includes: clearing HTML / XML tags, special characters, advertising text, and meaningless garbled characters; text normalization includes: unifying character encoding (UTF-8), unifying capitalization, and correcting common spelling errors.

[0072] The method for processing the timeline view and then segmenting the text to obtain clean, short sentences uses existing technology and will not be described in detail here.

[0073] The entity recognition result of clean short sentences refers to the entity recognition of clean short sentences using a more accurate entity recognition model, and is the entity recognition result of clean short sentences.

[0074] The entity recognition result of the clean short sentence is compared with the target entity link to correct the entity link and obtain an updated entity. Specifically, this means comparing the clean short sentence entity recognition result with the target entity link, improving the content of the target entity link, and obtaining an updated entity. For example, if the entity types of the clean short sentence entity recognition result and the target entity link are inconsistent, the target entity link is corrected based on confidence level. If the confidence level of the clean short sentence entity recognition result is higher than that of the target entity link, the entity in the target entity link is replaced with the clean short sentence entity recognition result. If the confidence level of the clean short sentence entity recognition result is lower than that of the target entity link, no correction is needed for the target entity link.

[0075] Step S205: Perform semantic understanding on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed.

[0076] In this illustrative embodiment, semantic understanding is performed on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed. This can be achieved by concatenating and fusing, which directly connects the semantic feature vector and the knowledge feature vector in terms of dimension; or by using an attention mechanism, which introduces an attention network to learn the relative importance of semantic features and knowledge features under the current risk assessment task and perform weighted fusion.

[0077] Both splicing fusion and attention mechanism fusion are existing technologies and will not be elaborated here.

[0078] Step S207: Perform feature fusion on the semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed to obtain a fused feature vector.

[0079] In the embodiments of this specification, the acquisition of the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed includes:

[0080] After performing entity recognition on the multi-source heterogeneous intelligence data to be analyzed, the entity information of the multi-source heterogeneous intelligence data to be analyzed is obtained;

[0081] Extract structured knowledge features related to entity information in the multi-source heterogeneous intelligence data to be analyzed, and obtain structured knowledge feature extraction results;

[0082] The structured knowledge feature extraction results are then embedded into a graph to generate a knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed.

[0083] In the embodiments of this specification, the step of fusing the semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed to obtain a fused feature vector specifically includes:

[0084] The semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed are weighted and fused through an attention mechanism to obtain the fused feature vector;

[0085] in,

[0086] The weight of the semantic feature vector plus the weight of the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed equals 1.

[0087] In the embodiments of this specification, the weight of the semantic feature vector is 0.4, and the weight of the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed is 0.6.

[0088] Step S209: The fused feature vector is used as input to the pre-trained intelligence risk identification model to obtain the intelligence risk identification result, wherein the pre-trained intelligence risk identification model is trained based on the CNN-LSTM model.

[0089] In the embodiments of this specification, during the model training process, the pre-trained intelligence risk identification model augments the original training set by back-translation, and / or synonym replacement, and / or entity replacement, in order to expand the sample size of the original training set.

[0090] In the embodiments of this specification, the step of using the fused feature vector as input to a pre-trained intelligence risk identification model to obtain an intelligence risk identification result specifically includes:

[0091] The fused feature vector is used as input and passed through the CNN layer of the pre-trained intelligence risk identification model to generate a local feature map, which includes: intelligence risk-related keywords and phrase combinations.

[0092] The local feature map is input into the LSTM layer, and the intelligence risk identification result is obtained through the LSTM layer. The intelligence risk identification result includes: intelligence risk type, intelligence risk level, prediction confidence, and intelligence risk content.

[0093] In the embodiments described in this specification, the intelligence risk identification method further includes:

[0094] If the prediction confidence level of the intelligence risk identification result is lower than the preset confidence threshold, the intelligence risk identification result will be judged as a low confidence anomaly, and an anomaly warning will be generated.

[0095] The process involves: acquiring multi-source heterogeneous intelligence data to be analyzed; fusing the multi-source heterogeneous intelligence data to obtain fused intelligence data; performing semantic understanding on the fused intelligence data to obtain semantic feature vectors of the multi-source heterogeneous intelligence data to be analyzed; fusing the semantic feature vectors and the knowledge feature vectors of the multi-source heterogeneous intelligence data to obtain fused feature vectors; and inputting the fused feature vectors into a pre-trained intelligence risk identification model to obtain intelligence risk identification results. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model and can integrate deep semantic information and structured knowledge to accurately and efficiently identify general risks in cross-domain intelligence information such as finance, military, public health, education, science and technology, and the internet. This solves the problem that intelligence risk identification cannot achieve general risk identification and enables integrated and refined judgment of risk types and levels.

[0096] The above describes in detail an intelligence risk identification method based on artificial intelligence. Correspondingly, this specification also provides an intelligence risk identification device based on artificial intelligence, such as... Figure 3 As shown. Figure 3 This is a schematic diagram of an intelligence risk identification device based on artificial intelligence, provided as an embodiment of this specification. The intelligence risk identification device includes:

[0097] Module 301 acquires multi-source heterogeneous intelligence data to be analyzed;

[0098] The preprocessing module 303 performs data fusion on the multi-source heterogeneous intelligence data to be analyzed to obtain fused intelligence data;

[0099] The semantic understanding module 305 performs semantic understanding on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed;

[0100] The feature fusion module 307 fuses the semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed to obtain a fused feature vector.

[0101] The risk identification module 309 takes the fused feature vector as input and inputs it into a pre-trained intelligence risk identification model to obtain the intelligence risk identification result. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model.

[0102] This specification also provides an electronic device, including:

[0103] At least one processor; and,

[0104] A memory communicatively connected to the at least one processor; wherein,

[0105] The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to:

[0106] Acquire multi-source heterogeneous intelligence data to be analyzed;

[0107] The multi-source heterogeneous intelligence data to be analyzed is fused to obtain fused intelligence data;

[0108] Semantic understanding is performed on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed;

[0109] The semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed are fused to obtain a fused feature vector.

[0110] The fused feature vector is used as input to a pre-trained intelligence risk identification model to obtain intelligence risk identification results. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model.

[0111] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0112] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for apparatus, electronic devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0113] The apparatus, electronic device, and non-volatile computer storage medium and method provided in the embodiments of this specification are corresponding. Therefore, the apparatus, electronic device, and non-volatile computer storage medium also have similar beneficial technical effects as the corresponding method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the corresponding apparatus, electronic device, and non-volatile computer storage medium will not be repeated here.

[0114] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0115] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0116] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0117] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0118] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0120] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0121] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0122] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0123] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0124] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0125] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0126] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside on local and remote computer storage media, including storage devices.

[0127] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0128] The above description is merely an embodiment of this specification and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. An intelligence risk identification method based on artificial intelligence, characterized in that, The intelligence risk identification method includes: Acquire multi-source heterogeneous intelligence data to be analyzed; The multi-source heterogeneous intelligence data to be analyzed is fused to obtain fused intelligence data; Semantic understanding is performed on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed; The semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed are fused to obtain a fused feature vector. The fused feature vector is used as input to a pre-trained intelligence risk identification model to obtain intelligence risk identification results. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model.

2. The intelligence risk identification method as described in claim 1, characterized in that, The process of fusing the multi-source heterogeneous intelligence data to be analyzed to obtain fused intelligence data specifically includes: After standardizing the multi-source heterogeneous intelligence data to be analyzed, standardized intelligence data is obtained. After performing entity linking, core referential elimination, and data alignment on the standardized intelligence data, the timeline view is obtained; The timeline view is cleaned and entities are named to obtain the fused intelligence data.

3. The intelligence risk identification method as described in claim 2, characterized in that, The standardized intelligence data obtained after standardizing the multi-source heterogeneous intelligence data to be analyzed specifically includes: Extract the text data of the multi-source heterogeneous intelligence data to be analyzed, convert the text data of the multi-source heterogeneous intelligence data to be analyzed into a preset internal data type, and obtain the standardized intelligence data. The preset internal data type is in Jason format, and the preset internal data includes: unique ID, source, publication time, title, content and original data link. The process of performing entity linking, core referential elimination, and data alignment on the standardized intelligence data to obtain the timeline view specifically includes: Entity identification is performed on the standardized intelligence data to obtain suspected entities; The suspected entities are matched against a preset knowledge base to obtain candidate entities; Based on contextual similarity and entity popularity, the candidate entities are identified to obtain the target entity link; Based on the target entity link, after dereferencing the standardized intelligence data, with the target entity as the core, the information related to the target entity in the standardized intelligence data is aligned and arranged in chronological order to obtain a timeline view corresponding to the target entity. The information related to the target entity includes: events, statements and data changes related to the target entity. The process of cleaning and naming entities in the timeline view to obtain the fused intelligence data specifically includes: After processing the timeline view, text segmentation is performed to obtain clean, short sentences; The entity linking results of the clean short sentence are corrected by linking them with the target entity to obtain the updated entity; The clean short sentences, updated entities, and metadata are fused together to obtain the fused intelligence data, wherein the metadata includes: original data links, publication time, and associated entities.

4. The intelligence risk identification method as described in claim 1, characterized in that, The acquisition of the knowledge feature vectors of the multi-source heterogeneous intelligence data to be analyzed includes: After performing entity recognition on the multi-source heterogeneous intelligence data to be analyzed, the entity information of the multi-source heterogeneous intelligence data to be analyzed is obtained; Extract structured knowledge features related to entity information in the multi-source heterogeneous intelligence data to be analyzed, and obtain structured knowledge feature extraction results; The structured knowledge feature extraction results are then embedded into a graph to generate a knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed.

5. The intelligence risk identification method as described in claim 1, characterized in that, The step of fusing the semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed to obtain a fused feature vector specifically includes: The semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed are weighted and fused through an attention mechanism to obtain the fused feature vector; in, The weight of the semantic feature vector plus the weight of the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed equals 1.

6. The intelligence risk identification method as described in claim 1, characterized in that, During the training process, the pre-trained intelligence risk identification model augments the original training set by back-translation, and / or synonym replacement, and / or entity replacement, in order to expand the sample size of the original training set.

7. The intelligence risk identification method as described in claim 1, characterized in that, The step of using the fused feature vector as input to a pre-trained intelligence risk identification model to obtain intelligence risk identification results specifically includes: The fused feature vector is used as input and passed through the CNN layer of the pre-trained intelligence risk identification model to generate a local feature map, which includes: intelligence risk-related keywords and phrase combinations. The local feature map is input into the LSTM layer, and the intelligence risk identification result is obtained through the LSTM layer. The intelligence risk identification result includes: intelligence risk type, intelligence risk level, prediction confidence, and intelligence risk content.

8. The intelligence risk identification method as described in claim 7, characterized in that, The intelligence risk identification method further includes: If the prediction confidence level of the intelligence risk identification result is lower than the preset confidence threshold, the intelligence risk identification result will be judged as a low confidence anomaly, and an anomaly warning will be generated.

9. An intelligence risk identification device based on artificial intelligence, characterized in that, The intelligence risk identification device includes: The acquisition module acquires multi-source heterogeneous intelligence data to be analyzed. The preprocessing module fuses the multi-source heterogeneous intelligence data to be analyzed to obtain fused intelligence data. The semantic understanding module performs semantic understanding on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed; The feature fusion module fuses the semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed to obtain a fused feature vector. The risk identification module takes the fused feature vector as input and feeds it into a pre-trained intelligence risk identification model to obtain the intelligence risk identification result. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model.

10. An electronic device, comprising: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: Acquire multi-source heterogeneous intelligence data to be analyzed; The multi-source heterogeneous intelligence data to be analyzed is fused to obtain fused intelligence data; Semantic understanding is performed on the fused intelligence data to obtain the semantic feature vector of the multi-source heterogeneous intelligence data to be analyzed; The semantic feature vector and the knowledge feature vector of the multi-source heterogeneous intelligence data to be analyzed are fused to obtain a fused feature vector. The fused feature vector is used as input to a pre-trained intelligence risk identification model to obtain intelligence risk identification results. The pre-trained intelligence risk identification model is trained based on a CNN-LSTM model.

Images