Abnormality risk identification method, device, equipment, storage medium and program product

Abstract

This application provides an anomaly risk identification method applicable to the fields of artificial intelligence and information security, specifically involving the application of large-scale models in fintech scenarios. The method includes: in a pre-prediction phase, acquiring rule text; performing a security assessment on the rule text based on a large-scale language model, outputting risk prediction results, wherein the risk prediction results include at least a potential risk score, a predicted suspicious attack path, a summary of historical cases, and risk control optimization suggestions; and in a real-time identification phase, acquiring external intelligence; performing semantic analysis on the external intelligence and risk prediction results based on a large-scale language model, outputting anomaly analysis results, wherein the anomaly analysis results include at least the rule text correlation degree, risk level, anomaly clue summary, and suspicious expressions. This application also provides an anomaly risk identification device, equipment, storage medium, and program product.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence and information security technology, and to the application of large models in financial technology scenarios, specifically to an anomaly risk identification method, device, equipment, storage medium and program product. Background Technology

[0002] With the rapid development of business models and the fast-changing customer behavior patterns, the necessity of identifying anomaly risks has become increasingly prominent. In business scenarios that heavily rely on data-driven approaches, anomaly risks can arise from multiple dimensions, such as flawed rule texts, external attacks, or abnormal user behavior. Failure to identify these risks in a timely manner can not only lead to direct economic losses but may also damage brand reputation.

[0003] Current anomaly risk identification systems commonly employ two main identification techniques: First, they utilize rule-based monitoring mechanisms, filtering participation based on preset rules (such as daily limits per person, device number restrictions, and internet protocol address frequency restrictions). For example, if a device continuously registers multiple accounts to participate in activities, it is considered suspicious and blocked. Second, they employ traditional machine learning anomaly identification models, training behavioral feature data using models such as logistic regression, random forests, and support vector machines to identify abnormal behavior. For example, participation frequency, path deviation, and geographical location changes are used as criteria. Furthermore, some research has attempted to introduce graph mining algorithms to construct user relationship graphs to identify abnormal user behavior.

[0004] However, the above identification methods have obvious shortcomings, mainly in the following aspects:

[0005] First, existing technical solutions cannot provide risk warnings before the execution of rule texts, cannot effectively identify systemic anomaly risks at the rule text level, and lack the ability to proactively detect early signs of anomalies.

[0006] Secondly, existing technical solutions lack the ability to perceive and process unstructured external intelligence data. Current solutions primarily rely on the analysis of structured data such as user behavior or transaction logs, ignoring the large amount of potential unstructured anomaly information from online platforms and failing to identify attack activities. Furthermore, traditional models lack contextual understanding capabilities, making them difficult to identify risky, anomalous terms or variant expressions.

[0007] Given the numerous problems with existing technical solutions, there is an urgent need to develop a new technical solution that can comprehensively and proactively improve the ability to identify abnormal risks. Summary of the Invention

[0008] In view of the above problems, this application provides methods, apparatus, devices, storage media and program products for identifying abnormal risks that improve the comprehensiveness, foresight and dynamic response capabilities of identification.

[0009] According to the first aspect of this application, an anomaly risk identification method is provided, comprising: in the pre-prediction stage, acquiring rule text; performing a security assessment on the rule text based on a large language model, and outputting risk prediction results, wherein the risk prediction results include at least a potential risk score, a predicted suspicious attack path, a summary of historical cases, and risk control optimization suggestions; and in the in-process identification stage, acquiring external intelligence in real time; performing intelligence semantic analysis on the external intelligence and the risk prediction results based on a large language model, and outputting anomaly analysis results, wherein the anomaly analysis results include at least the rule text correlation degree, risk level, anomaly clue summary, and suspicious expressions.

[0010] According to an embodiment of this application, the method further includes: in the post-learning phase, writing the risk prediction results and anomaly analysis results into a pre-built risk knowledge base; and constructing a fine-tuning corpus based on the risk prediction results and anomaly analysis results to adjust the large language model.

[0011] According to embodiments of this application, performing semantic analysis on the external intelligence and the risk prediction results based on a large language model to output anomaly analysis results includes: obtaining risk prediction results, wherein the risk prediction results serve as auxiliary context for the in-process identification stage; retrieving semantically similar text blocks from a pre-built risk knowledge base based on external intelligence, wherein the text blocks are used to provide contextual semantics for the large language model's inference; substituting the risk prediction results and the text blocks into the prompt word template for the in-process identification stage to obtain the complete semantic context for the in-process identification stage; and inputting the complete semantic context for the in-process identification stage into the large language model to output anomaly analysis results.

[0012] According to an embodiment of this application, the security assessment of the rule text based on the large language model and the output of risk prediction results include: based on the rule text, retrieving semantically similar text blocks from a pre-built risk knowledge base, wherein the text blocks are used to provide contextual semantics for the large language model's reasoning; substituting the rule text and text blocks into the prompt word template of the pre-prediction stage to obtain the complete semantic context of the pre-prediction stage; and inputting the complete semantic context of the pre-prediction stage into the large language model to output the risk prediction results.

[0013] According to an embodiment of this application, retrieving semantically similar text blocks in a pre-built risk knowledge base includes: inputting the text to be retrieved into a pre-trained semantic embedding model and encoding it to generate a corresponding first semantic vector; and retrieving and returning a second semantic vector that is similar to the first semantic vector based on the first semantic vector in the pre-built risk knowledge base using an approximate vector search algorithm, wherein the second semantic vector is pre-encoded by the same semantic embedding model from the text blocks of the risk knowledge base.

[0014] According to embodiments of this application, obtaining external intelligence includes: real-time collection of web page data from active areas of network information based on targeted distributed crawler technology; and feature recognition processing of the collected web page data to generate external intelligence.

[0015] According to embodiments of this application, feature recognition processing of collected web page data to generate external intelligence includes: in response to the web page data being plain text content, data cleaning is performed on the web page data to remove irrelevant noise data and invalid information; in response to the web page data being image content, text recognition processing is performed on the web page data to convert it into a corresponding natural language description; the text similarity of the processed web page data is calculated using a text similarity algorithm; and content whose text similarity meets a preset similarity threshold is removed to generate external intelligence.

[0016] The second aspect of this application provides an anomaly risk identification device, comprising: a pre-event prediction module for acquiring rule text; performing a security assessment on the rule text based on a large language model and outputting risk prediction results, wherein the risk prediction results include at least a potential risk score, a prediction of suspicious attack paths, a summary of historical cases, and risk control optimization suggestions; and an in-event identification module for acquiring external intelligence in real time; performing intelligence semantic analysis on the external intelligence and risk prediction results based on a large language model and outputting anomaly analysis results, wherein the anomaly analysis results include at least the rule text correlation degree, risk level, anomaly clue summary, and suspicious expressions.

[0017] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0018] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0019] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0020] The above-mentioned contents, as well as other objects, features, and advantages of this application, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0021] Figure 1 The illustrations depict application scenarios of the abnormal risk identification method, apparatus, device, medium, and program product according to embodiments of this application.

[0022] Figure 2 A flowchart illustrating an anomaly risk identification method according to an embodiment of this application is shown schematically;

[0023] Figure 3 A flowchart illustrating a method for generating external intelligence according to an embodiment of this application is shown schematically;

[0024] Figure 4 The flowchart illustrating the output of risk prediction results in the pre-prediction stage of the method according to an embodiment of this application is shown in the illustration.

[0025] Figure 5 The flowchart illustrating a method for retrieving semantically similar text blocks from a risk knowledge base according to an embodiment of this application is shown in the illustration.

[0026] Figure 6 A flowchart illustrating the output of anomaly analysis results during the in-process identification phase of a method according to an embodiment of this application is shown in the illustration.

[0027] Figure 7 The diagram illustrates the overall flow of an anomaly risk identification method according to an embodiment of this application.

[0028] Figure 8 A schematic diagram illustrating the structure of an anomaly risk identification device according to an embodiment of this application is shown; and

[0029] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing an anomaly risk identification method according to an embodiment of this application. Detailed Implementation

[0030] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0031] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0032] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0033] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0034] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0035] It should be noted that the abnormal risk identification methods, devices, equipment, storage media, and program products defined in the embodiments of this application relate to the application of large models in fintech scenarios. They can be used in the fields of artificial intelligence and information security technology, and can also be applied to the fintech field or any field other than the fintech field. The application fields of the abnormal risk identification methods, devices, equipment, storage media, and program products of this application are not limited.

[0036] This application provides an abnormal risk identification method, establishing a phased risk control mechanism by dividing the process into two stages: pre-event prediction and in-event identification. This application can identify potential exploitation paths before rule text execution, assisting risk control personnel in formulating more precise pre-event intervention strategies, effectively compensating for the shortcomings of traditional technologies in conducting in-depth risk assessments of the rule text itself. Simultaneously, this application can perform dynamic semantic perception and precise early warning of external intelligence during rule text execution. By acquiring external intelligence in real time and integrating the risk prediction results generated in the pre-event prediction stage, it can leverage a large language model to achieve real-time abnormal risk identification of external intelligence, enabling high-confidence perception before risky behavior forms or at its initial signs.

[0037] Figure 1 The illustrations depict application scenarios of anomaly risk identification methods, apparatus, devices, media, and program products according to embodiments of this application.

[0038] like Figure 1 As shown, application scenario 100 according to this embodiment may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0039] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0040] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0041] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0042] It should be noted that the anomaly risk identification method provided in the embodiments of this application can generally be executed by server 105. Correspondingly, the anomaly risk identification device provided in the embodiments of this application can generally be located in server 105. The anomaly risk identification method provided in the embodiments of this application can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the anomaly risk identification device provided in the embodiments of this application can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0043] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0044] The following will be based on Figure 1 The described scene, through Figures 2-6 An anomaly risk identification method according to embodiments of this application will be described in detail.

[0045] Figure 2 A flowchart illustrating an anomaly risk identification method according to an embodiment of this application is shown schematically.

[0046] like Figure 2 As shown, the abnormal risk identification method 200 of this embodiment includes operations S210 to S220, and the abnormal risk identification method can be executed by the server 105.

[0047] In the S210 operation, during the pre-prediction phase, rule text is acquired; based on a large language model, a security assessment is performed on the rule text, and risk prediction results are output.

[0048] The rules text is a detailed description of the terms and conditions for participation in a specific scenario, such as an event, game, transaction, or competition. It is formulated to regulate related behaviors, clarify rights and obligations, define operating procedures, protect the rights and interests of all parties, and ensure the orderly operation of the system or event. Its content generally includes: time arrangement, participation conditions, preferential methods, reward distribution mechanism, and disclaimers, etc., aiming to ensure that the event is fair, transparent, legal, and compliant, while achieving the goals of the specific scenario.

[0049] For example, rule text can be activity-related rule text, such as the rules for a marketing campaign. A marketing campaign is a series of organized and targeted promotional activities planned by a company or brand to promote products, increase sales, enhance user loyalty, or expand market influence. Examples include coupon distribution, instant discounts, and registration gifts, used to stimulate customer activity and promote business growth. Marketing campaign rule text is a written document that details the requirements, processes, participation conditions, and reward mechanisms of a marketing campaign; it is a crucial basis for the smooth implementation of the campaign. Large language models can be used to conduct security assessments on marketing campaign rule texts and output risk prediction results.

[0050] For example, rule text can also be game-related rule text. Game rule text is formulated by game designers or operators to clearly explain the core gameplay logic, operational norms, behavioral boundaries, and the rights and responsibilities of each party in a game. A large language model can be used to perform a security assessment on the game rule text and output risk prediction results.

[0051] Optionally, the specific scenario targeted by the rule text can be determined according to actual needs, and no restrictions are imposed here.

[0052] In the embodiments of this application, during the pre-prediction stage, specific rule text content can be obtained, and a large language model can be used to perform a security assessment on the rule text, outputting risk prediction results. These risk prediction results include at least a potential risk score, a suspected attack path prediction, a historical case summary, and risk control optimization suggestions. The potential risk score determines the severity of the risk by quantitatively assessing the probability and impact of its occurrence. A suspected attack path refers to a specific technical route or behavioral chain adopted by certain participants during operation, such as a behavioral pattern of obtaining benefits through unconventional methods like bulk registration or automated coupon-grabbing tools. A historical case summary is a condensed summary of key information, execution processes, and impact results of past rule texts (including successful and failed cases) related to this rule text, providing a reference for risk prediction and strategy optimization. Risk control optimization suggestions refer to systematic improvement opinions proposed for the potential risk.

[0053] The following will be combined Figure 4 The process of outputting the risk prediction results of operation S210 is explained in detail.

[0054] The risk prediction results output in the pre-prediction stage can not only be used for risk warnings before the execution of rule texts, but also be used as intermediate knowledge outputs to be transmitted to the in-process identification stage to strengthen the understanding of the context of rule texts and the determination of semantic relevance in in-process judgment, thereby realizing information linkage between the front and back stages and the transfer of risk identification capabilities.

[0055] During the operation of S220, in the event identification phase, external intelligence is acquired in real time; based on a large language model, semantic analysis of external intelligence and risk prediction results is performed, and anomaly analysis results are output.

[0056] On online platforms, there exist specific communities or communication platforms primarily used for disseminating trading exchanges related to unusual operational strategies, sensitive information, technical methods, and related tools that target specific rule texts. These platforms often serve as important sources of intelligence on unusual activities, providing crucial clues for risk monitoring and prevention.

[0057] Figure 3 A flowchart illustrating a method for generating external intelligence according to an embodiment of this application is shown.

[0058] like Figure 3 As shown, the method 300 of this embodiment includes operations S310 to S320.

[0059] When operating the S310, web page data from active areas of the network are collected in real time based on targeted distributed crawler technology.

[0060] In the embodiments of this application, webpage data from active network information areas is collected in real time based on targeted distributed crawler technology. All data is authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data comply with relevant laws, regulations, and standards, and necessary confidentiality measures are taken. This process does not violate public order and good morals, and corresponding operation entry points are provided for users to choose to authorize or refuse. For example, before operation S310, a request to obtain data can be sent to the user. If the user agrees or authorizes the acquisition of data, operation 310 is executed.

[0061] In the embodiments of this application, web page data from active online information areas is collected in real time based on targeted distributed crawling technology. The active online information areas for data collection are preferentially selected from the aforementioned specific communities or communication platforms. Additionally, they can also be online social platforms with high interactivity, strong timeliness, and broad information coverage, such as social media topic pages that can quickly gather a large number of users to participate in topic discussions. The collected web page data content covers plain text, emoticons, images, and disguised character expressions, in order to capture potentially abnormal communication content.

[0062] Optionally, the active network information area and the content of the collected data can be determined according to actual needs, and are not restricted here.

[0063] The S320 is used to perform feature recognition processing on the collected web page data to generate external intelligence.

[0064] After web page data collection is completed, feature recognition processing is performed on the collected web page data to generate external intelligence. Considering that data from different sources may have format differences, all collected data will be standardized to a standard format to facilitate subsequent analysis. When the collected web page data is plain text content, data cleaning is performed to remove irrelevant noise and invalid information. Special characters or encoding issues that may exist in the web page data will also be converted and cleaned accordingly. When the collected web page data is image-based content, text recognition processing is performed on the web page data to convert it into corresponding natural language descriptions. For example, Optical Character Recognition (OCR) technology or image-to-text generation models can be used for text recognition. After the web page data is standardized and uniformly converted into a text structure, text similarity algorithms can be used to calculate the text similarity of the processed web page data. Content with text similarity that meets a preset similarity threshold is removed to generate external intelligence. For example, a similarity hash algorithm can be used to calculate text similarity. Based on the text similarity, the redundancy of the processed web page data is evaluated. When the similarity threshold meets a specified threshold, it is determined to be redundant content and removed to obtain external intelligence.

[0065] Optionally, the text similarity threshold can be determined according to actual needs, and no restrictions are imposed here.

[0066] In the web page data processing workflow, by accurately identifying web page data and filtering out duplicate data, the uniqueness of the dataset can be guaranteed, data redundancy can be effectively avoided, and the workload of subsequent data processing can be reduced, thereby simultaneously improving the overall process efficiency and the accuracy of risk identification.

[0067] After the rule text is officially launched and made available to users in the specific scenarios to which it applies (i.e., the rule text begins to take effect), the real-time identification phase begins. This phase involves acquiring external intelligence in real time, performing semantic analysis on the external intelligence and risk prediction results based on a large language model, and outputting anomaly analysis results. This allows for the identification of potential abnormal intentions and attack behaviors targeting the rule text. The anomaly analysis results include at least the rule text relevance, risk level, anomaly clue summary, and suspicious expressions. Rule text relevance is a quantitative indicator measuring the correlation between webpage data and a specific rule text. The large language model analyzes the matching of various information in the webpage data with the rule text's target, content, audience, and other multi-dimensional elements, presenting the degree of correlation between the two in numerical form. Risk level is a classification based on a comprehensive assessment of the potential impact and likelihood of a risk, used to intuitively reflect the severity and urgency of the risk. Anomaly clue summary refers to identified suspicious operations or potential risk issues. Suspicious expressions refer to potentially abnormal statements found in the webpage data.

[0068] The following will be combined Figure 6 The process of outputting the risk prediction results of operation S220 is explained in detail.

[0069] The embodiments of this application provide an anomaly risk identification method, establishing a phased risk management mechanism by dividing the process into two stages: pre-event prediction and in-event identification. The pre-event prediction stage, through intelligent security assessment before rule text execution, can identify potential exploitation paths before rule text execution, assisting risk control personnel in formulating more precise pre-event intervention strategies. The in-event identification stage can dynamically perceive the semantics of external intelligence and provide precise early warnings, achieving high-confidence perception before risky behavior occurs or when it first emerges.

[0070] Figure 4 The flowchart illustrating the output of risk prediction results in the pre-prediction stage of the method according to an embodiment of this application is shown in the illustration.

[0071] like Figure 4 As shown, this embodiment is one embodiment of operation S210, including operations S211 to S213.

[0072] In operation S211, based on rule text, semantically similar text blocks are retrieved from a pre-built risk knowledge base.

[0073] In embodiments of this application, text blocks are used to provide contextual semantics for large language model inference.

[0074] Figure 5 The flowchart illustrating a method for retrieving semantically similar text blocks from a risk knowledge base according to an embodiment of this application is shown.

[0075] like Figure 5 As shown, the method 500 of this embodiment includes operations S510 to S520.

[0076] In operation S510, the text to be retrieved is input into a pre-trained semantic embedding model, which encodes and generates the corresponding first semantic vector.

[0077] In the embodiments of this application, a pre-trained semantic embedding model is used to semantically encode the input rule text, converting it into a high-dimensional semantic vector representation to form a first semantic vector, namely the rule text vector. This vectorization operation can capture deep semantic information in the rule text and provide a standardized semantic representation basis for risk identification of rule text.

[0078] There are several feasible options for selecting a semantic embedding model, such as word vector models, context-sensitive models, or lightweight models. The specific semantic embedding model can be determined according to actual needs and is not limited here.

[0079] In operation S520, in the pre-built risk knowledge base, the approximate vector search algorithm is used to retrieve and return a second semantic vector that is similar to the first semantic vector based on the first semantic vector.

[0080] The pre-built risk knowledge base includes documents such as historical risk anomaly cases, risk control experience, and anomaly terminology analysis. The content is processed through semantic segmentation and then vectorized using a semantic embedding model to generate high-dimensional semantic vectors, which are then stored in a vector database to support subsequent semantic similarity retrieval.

[0081] It should be noted that, in the embodiments of this application, the same pre-trained semantic embedding model is used to ensure the consistency of semantic representation. Therefore, the second semantic vector is generated by pre-encoding text blocks of the risk knowledge base using the same semantic embedding model.

[0082] In the embodiments of this application, based on the first semantic vector, an approximate vector search algorithm (e.g., a method based on cosine similarity) is used to retrieve the second semantic vector, which is the semantically most similar text block, from the pre-built risk knowledge base. The second semantic vector is a vectorized representation of the text block and is used to provide contextual semantics for large language model reasoning.

[0083] In operation S212, the rule text and text block are substituted into the prompt word template of the pre-prediction stage to obtain the complete semantic context of the pre-prediction stage.

[0084] Retrieval-Augmented Generation (RAG) is a technique that combines retrieval and generative models. It improves the accuracy and timeliness of generated results by retrieving relevant information from external knowledge bases and providing it along with the input to a large model.

[0085] In the embodiments of this application, the RAG framework is adopted to retrieve text blocks with semantic similarity to the rule text from the risk knowledge base as external knowledge supplements. These text blocks are then embedded together with the rule text into the prompt word template in the pre-prediction stage to construct the complete semantic context of the large language model in the pre-prediction stage. The prompt word template explicitly defines the input and output specifications of the large language model through a structured framework. The prompt word template in the prediction stage explicitly states that the reasoning goal is to identify whether there are potential exploitable risk points in the rule text, such as rule defects, incentive mechanism abuse, or behavioral manipulation space.

[0086] In operation S213, the complete semantic context of the pre-prediction stage is input into the large language model, and the risk prediction result is output.

[0087] In the embodiments of this application, the above-mentioned complete semantic context is input into the large language model. The large language model performs deep semantic reasoning based on the complete semantic context and outputs risk prediction results, including but not limited to: potential risk scores, suspicious attack path predictions, relevant historical case summaries, and targeted risk control optimization suggestions.

[0088] By retrieving semantically similar text blocks from a pre-built risk knowledge base, contextual semantics can be provided for reasoning in large language models, reducing the probability of models fabricating false information and improving the reasoning quality of large language models.

[0089] Figure 6 A flowchart illustrating the output of anomaly analysis results during the in-process identification phase of a method according to an embodiment of this application is shown.

[0090] like Figure 6 As shown, this embodiment is one embodiment of operation S220, including operations S221 to S224.

[0091] In operation S221, obtain the risk prediction results.

[0092] In the embodiments of this application, the risk prediction results output during the pre-prediction stage are obtained, including potential risk scores, suspected attack path predictions, historical case summaries, and risk control optimization suggestions. These risk prediction results serve as auxiliary context in the in-process identification stage, enhancing the understanding of the rule text context and the determination of semantic relevance in in-process judgment.

[0093] In operation S222, based on external intelligence, semantically similar text blocks are retrieved from a pre-built risk knowledge base.

[0094] In the embodiments of this application, a pre-trained semantic embedding model is used to semantically encode external intelligence, converting it into a high-dimensional semantic vector representation to form an external intelligence vector. Then, operation S222 employs... Figure 5 The same processing flow shown retrieves text blocks from the risk knowledge base that are semantically similar to the external intelligence vector. These text blocks are used to provide contextual semantics for large language model inference.

[0095] In operation S223, the risk prediction results and text blocks are substituted into the prompt word template of the in-process identification stage to obtain the complete semantic context of the in-process identification stage.

[0096] In the embodiments of this application, the risk prediction results and text blocks output in the pre-prediction stage are substituted into the prompt word template in the in-process identification stage to obtain the complete semantic context of the in-process identification stage. The prompt word template in the in-process identification stage clearly defines the reasoning objective as determining the correlation between external intelligence and specific rule text, identifying the level of abnormal risk, and identifying suspicious expressions, etc.

[0097] In operation S224, the complete semantic context of the in-process identification stage is input into the large language model, and the anomaly analysis results are output.

[0098] In the embodiments of this application, the large language model infers the correlation and risk level between external intelligence and specific rule text based on the complete semantic context of the in-process identification stage, and generates anomaly analysis results, including but not limited to: rule text correlation degree, risk level, anomaly clue summary, suspicious expression, etc.

[0099] Areas with high activity on the network are more likely to see unusual discussions. By acquiring and identifying this data in real time, potential anomalies can be detected in a timely manner, and attack activities can be identified. This allows for high-confidence perception before risky behavior takes shape or when it first appears. Furthermore, by reusing the risk prediction results from the pre-event stage, contextual semantics can be provided for reasoning in large language models, thereby improving the accuracy of model identification.

[0100] Furthermore, after outputting the anomaly analysis results during the in-process identification phase, the risk level in the anomaly analysis results can be determined. When the risk level is a high-risk anomaly signal, the early warning process can be initiated and a structured risk report can be generated. The structured risk report includes elements such as suspected anomaly content, the correlation of corresponding rule text, strategy guidance, and summaries of similar historical cases. The structured risk report is also sent to the risk control platform simultaneously, and the risk control team can decide whether to trigger further inspections or risk control measures based on this.

[0101] Furthermore, in the embodiments of this application, a post-learning phase can also be set. After the rule text is executed, the post-learning phase begins, during which risk prediction results and anomaly analysis results are written into a pre-built risk knowledge base; and fine-tuning corpora are constructed based on the risk prediction results and anomaly analysis results to adjust the large language model. Specifically, in the post-learning phase, key data generated throughout the entire process of rule text formulation, execution, and completion can be uniformly and structurally archived, including but not limited to: pre-rule text analysis results, in-process anomaly intelligence identification records, risk warning trigger information, actual risk control handling logs, and manual review feedback. The archived text content is vectorized using a pre-trained semantic embedding model and updated to the vector database in the risk knowledge base. In the post-learning phase, fine-tuning corpora can also be constructed based on manually annotated high-confidence cases, and parameter-efficient fine-tuning techniques can be used to perform targeted fine-tuning of the large language model; based on feedback and inference success and failure case samples for specific scenarios applicable to the rule text, the prompt word template design logic can be updated to enhance task awareness and structured response capabilities.

[0102] In the post-event learning phase, continuous knowledge injection and optimization of the core model and risk identification strategy based on this knowledge can improve the adaptability and response efficiency of subsequent rule text anomaly risk identification.

[0103] In the embodiments of this application, a highly automated and continuously optimized risk identification closed loop can be formed, from risk assessment before rule text execution to risk monitoring and dynamic control during rule text execution, and then to knowledge archiving and model optimization after rule text execution. By performing semantic modeling and external risk anomaly knowledge fusion analysis on the rule text, potential exploitation risk paths can be discovered before rule text execution, assisting risk control personnel in formulating more accurate pre-intervention strategies, effectively making up for the shortcomings of traditional technologies that cannot conduct in-depth risk assessment of the rule text itself. During rule text execution, web page data in active areas of network information is collected in a targeted manner, combined with pre-generated risk prediction results, and a retrieval-enhanced generation mechanism is used to identify abnormal intentions of external intelligence in real time. It has the ability to understand complex expressions such as semantic variations and image / text disguises, and can achieve high-confidence perception and timely early warning before risk behavior is formed or when it first appears. After the rule text is executed, the data of the entire rule text execution process is archived and analyzed. The identification results and risk control feedback are used to expand the risk knowledge base and fine-tune the large language model, continuously enhancing the model's adaptability to new risk patterns and building a continuously evolving risk identification learning mechanism. This breaks through the structural limitations of traditional static rules that are easy to age and difficult to update.

[0104] Figure 7The diagram illustrates the overall flow of an anomaly risk identification method according to an embodiment of this application.

[0105] like Figure 7 As shown, in the overall process 700 of the abnormal risk identification method in this embodiment, the pre-prediction stage 710 may include: a semantic encoding sub-stage, a vector retrieval sub-stage, and a large model risk assessment sub-stage.

[0106] In the semantic encoding sub-stage, a pre-trained semantic embedding model is used to encode the rule text, converting it into a high-dimensional semantic vector representation to capture the deep semantic information in the rule text. To ensure semantic space consistency and avoid cross-model embedding bias, the embedding model used in this module is completely consistent with the vectorization model used when constructing the "risk knowledge base".

[0107] In the vector retrieval sub-stage, the rule text vector generated in the semantic encoding sub-stage is obtained, and the approximate vector search algorithm is used to retrieve the text block with the closest semantics from the pre-built risk knowledge base.

[0108] In the risk assessment sub-stage of the large model, the text blocks retrieved in the vector retrieval sub-stage are used as external knowledge supplements and embedded together with the rule text into the structured prompt word template to construct the complete semantic context of the large language model. The large language model outputs the risk prediction results based on this complete semantic context.

[0109] The in-process identification phase 720 may include: an external intelligence gathering sub-phase, a gathered information preprocessing sub-phase, an abnormal intent identification sub-phase, and a risk warning feedback sub-phase.

[0110] In the external intelligence gathering sub-stage, web page data from active network information areas is collected in real time based on targeted distributed crawler technology. In the information preprocessing sub-stage, the collected web page data is first standardized and uniformly converted into a text structure. After batch organization, external intelligence is generated as input for subsequent modules. For plain text content, the system uses a rule model or a lightweight language model for simple cleaning; for image content, the system calls optical character recognition technology to identify embedded text, or converts it into corresponding natural language descriptions through an image-text generation model.

[0111] In the anomaly intent identification sub-stage, semantic understanding and risk assessment are performed on external intelligence to accurately identify whether the information involves unusual discussion, strategy dissemination, or action organization intent regarding the current rule text. The anomaly intent identification sub-stage is consistent with the pre-prediction stage 710 and also includes a semantic encoding sub-stage, a vector retrieval sub-stage, and a large-scale model risk assessment sub-stage. The specific workflow of the anomaly intent identification sub-stage includes: using external intelligence as a query vector, retrieving semantically similar text blocks from the risk knowledge base, embedding these text blocks along with the risk prediction results output from the pre-prediction stage into a prompt word template, and using the large language model to infer the correlation and risk level between the current information and the specific rule text, generating structured anomaly analysis results.

[0112] In the risk warning feedback sub-stage, the anomaly analysis results from the abnormal intent identification sub-stage are obtained and judged. Once a high-risk abnormal signal is identified, this sub-stage initiates the warning process, generates a structured risk report, including suspected abnormal content, the correlation of corresponding rule text, strategy guidance, and summaries of similar historical cases, and sends the results synchronously to the risk control platform. The risk control team can then decide whether to trigger further inspections or risk control measures.

[0113] The post-learning phase 730 may include: a data archiving and knowledge updating sub-phase, and a model fine-tuning and optimization sub-phase.

[0114] In the data archiving and knowledge update sub-stage, key data generated throughout the entire rule text execution process is uniformly and structurally archived, including but not limited to: risk prediction results output in the pre-prediction stage 710, anomaly analysis results output in the in-process identification stage 720, risk warning trigger information, actual risk control handling logs, and manual review feedback. The archived text content undergoes semantic segmentation and is vectorized using a pre-trained semantic embedding model, supplementing and updating the vector database in the risk knowledge base to ensure the breadth and timeliness of knowledge coverage.

[0115] In the model fine-tuning and optimization sub-stage, a fine-tuning corpus is constructed based on manually annotated high-confidence cases, and a parameter-efficient fine-tuning technique is used to perform targeted fine-tuning of the large language; based on feedback and inference success and failure case samples of specific scenarios applicable to the rule text, the design logic of the prompt word template is updated.

[0116] Based on the above-described method for identifying abnormal risks, this application also provides an apparatus for identifying abnormal risks. The following will be combined with... Figure 8 The device is described in detail.

[0117] Figure 8 A schematic block diagram of an anomaly risk identification device according to an embodiment of this application is shown.

[0118] like Figure 8As shown, the abnormal risk identification device 800 of this embodiment includes a pre-prediction module 810 and a real-time identification module 820.

[0119] The pre-prediction module 810 is used to acquire rule text; perform security assessment on the rule text based on a large language model, and output risk prediction results, wherein the risk prediction results include at least a potential risk score, a prediction of suspicious attack paths, a summary of historical cases, and risk control optimization suggestions. In one embodiment, the pre-prediction module 810 can be used to perform the operation S210 described above, which will not be repeated here.

[0120] The real-time identification module 820 is used to acquire external intelligence in real time; based on a large language model, it performs semantic analysis on the external intelligence and risk prediction results, and outputs anomaly analysis results, wherein the anomaly analysis results include at least rule text correlation, risk level, anomaly clue summary, and suspicious expressions. In one embodiment, the real-time identification module 820 can be used to perform the operation S220 described above, which will not be repeated here.

[0121] According to an embodiment of this application, the pre-prediction module 810 may include a risk prediction result generation submodule.

[0122] The risk prediction result generation submodule is used to retrieve semantically similar text blocks from a pre-built risk knowledge base based on rule text. These text blocks are used to provide contextual semantics for the large language model's inference. The rule text and text blocks are then substituted into the prompt word template in the pre-prediction stage to obtain the complete semantic context of the pre-prediction stage. Finally, the complete semantic context of the pre-prediction stage is input into the large language model to output the risk prediction result.

[0123] According to an embodiment of this application, the in-process identification module 820 may include an anomaly analysis result generation submodule.

[0124] The anomaly analysis result generation submodule is used to obtain risk prediction results, which serve as auxiliary context for the in-process identification stage. Based on external intelligence, it retrieves semantically similar text blocks from a pre-built risk knowledge base, where the text blocks are used to provide contextual semantics for the large language model's inference. The risk prediction results and text blocks are substituted into the prompt word template of the in-process identification stage to obtain the complete semantic context of the in-process identification stage. Finally, the complete semantic context of the in-process identification stage is input into the large language model to output the anomaly analysis results.

[0125] The anomaly analysis result generation submodule may include: an external intelligence acquisition submodule.

[0126] The external intelligence acquisition submodule is used to collect web page data from active areas of the network in real time based on targeted distributed crawler technology; and to perform feature recognition processing on the collected web page data to generate external intelligence.

[0127] The external intelligence acquisition submodule may include an external intelligence generation submodule.

[0128] The external intelligence generation submodule is used to perform data cleaning on web page data when the web page data is plain text content, removing irrelevant noise data and invalid information; to perform text recognition processing on web page data when the web page data is image content, converting it into corresponding natural language descriptions; to calculate the text similarity of the processed web page data using a text similarity algorithm; and to remove content whose text similarity meets a preset similarity threshold, thereby generating external intelligence.

[0129] The above-mentioned anomaly analysis result generation submodule and risk prediction result generation submodule can both include a text block retrieval submodule.

[0130] The text block retrieval submodule is used to input the text to be retrieved into a pre-trained semantic embedding model and encode it to generate the corresponding first semantic vector; and to retrieve and return a second semantic vector that is similar to the first semantic vector based on the first semantic vector in the pre-built risk knowledge base using an approximate vector search algorithm, wherein the second semantic vector is generated by the same semantic embedding model by pre-encoding the text blocks of the risk knowledge base.

[0131] According to embodiments of this application, the anomaly risk identification device 800 may further include a post-learning module.

[0132] The post-event learning module is used to write the risk prediction results and anomaly analysis results into a pre-built risk knowledge base; and to build a fine-tuning corpus based on the risk prediction results and anomaly analysis results to adjust the large language model.

[0133] According to embodiments of this application, the device 800 can form an intelligent closed-loop system for identifying abnormal risks throughout the entire process of "pre-event prediction—in-event monitoring—post-event learning," which can improve the comprehensiveness, foresight, and dynamic response capabilities of abnormal risk identification. Through proactive risk warning, potential exploitation paths can be identified before the rule text is executed, assisting risk control personnel in formulating more precise pre-event intervention strategies, effectively compensating for the shortcomings of traditional technologies that cannot conduct in-depth risk assessments of the rule text itself. During rule text execution, dynamic semantic perception and precise early warning of external intelligence are achieved. The system collects webpage data in a targeted manner, combines it with pre-generated rule context information, and uses a retrieval-enhanced generation mechanism to perform real-time abnormal intent identification of external intelligence. It has the ability to understand complex expressions such as semantic variations and graphic / textual disguises, enabling high-confidence perception and timely early warning before risky behavior is formed or when it first appears. After the rule text execution is completed, knowledge accumulation and capability iteration are achieved. The system archives and analyzes the data from the entire execution process of the rule text, and uses the identification results and risk control feedback to expand the risk knowledge base and fine-tune the large language model. This continuously enhances the model's adaptability to new risk patterns and builds a continuously evolving anomaly identification learning mechanism, breaking through the structural limitations of traditional static rules that are prone to aging and difficult to update.

[0134] According to embodiments of this application, any plurality of modules in the pre-prediction module 810 and the in-process identification module 820 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules can be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the pre-prediction module 810 and the in-process identification module 820 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented by any other reasonable means of integrating or packaging the circuit, or implemented in any one of the three methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the pre-prediction module 810 and the in-process identification module 820 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0135] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing an anomaly risk identification method according to an embodiment of this application.

[0136] like Figure 9As shown, an electronic device 900 according to an embodiment of this application includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0137] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0138] According to embodiments of this application, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the input / output (I / O) interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0139] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0140] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0141] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the anomaly risk identification method provided by the embodiments of this application.

[0142] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of the embodiments of this application. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0143] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0144] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of the embodiments of this application. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0145] According to embodiments of this application, program code for executing the computer programs provided in embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0146] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0147] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. An abnormal risk identification method, characterized in that, The method includes: In the pre-prediction phase, rule text is obtained; a security assessment is performed on the rule text based on a large language model, and risk prediction results are output. These risk prediction results include at least a potential risk score, a predicted suspicious attack path, a summary of historical cases, and risk control optimization suggestions. During the identification phase, external intelligence is acquired in real time; based on a large language model, semantic analysis of the external intelligence and the risk prediction results is performed to output anomaly analysis results, wherein the anomaly analysis results include at least rule text correlation degree, risk level, anomaly clue summary and suspicious expression.

2. The method according to claim 1, characterized in that, The method further includes: In the post-learning phase, the risk prediction results and the anomaly analysis results are written into a pre-built risk knowledge base; and the large language model is adjusted based on the risk prediction results and the anomaly analysis results by constructing a fine-tuning corpus.

3. The method according to claim 1, characterized in that, The intelligence semantic analysis based on the large language model on the external intelligence and the risk prediction results outputs anomaly analysis results, including: Obtain the risk prediction result, wherein the risk prediction result serves as auxiliary context for the in-process identification stage; Based on the external intelligence, semantically similar text blocks are retrieved from a pre-built risk knowledge base, wherein the text blocks are used to provide contextual semantics for large language model reasoning; Substituting the risk prediction results and the text block into the prompt word template of the in-process identification stage, the complete semantic context of the in-process identification stage is obtained; and The complete semantic context of the in-process identification stage is input into the large language model, and the anomaly analysis results are output.

4. The method according to claim 1, characterized in that, The security assessment of the rule text based on the large language model, and the output of risk prediction results, include: Based on the rule text, semantically similar text blocks are retrieved from a pre-built risk knowledge base, wherein the text blocks are used to provide contextual semantics for large language model reasoning; Substituting the rule text and the text block into the prompt word template of the pre-prediction stage, the complete semantic context of the pre-prediction stage is obtained; and The complete semantic context of the pre-prediction stage is input into the large language model, and the risk prediction result is output.

5. The method according to any one of claims 3 to 4, characterized in that, The step of retrieving semantically similar text blocks from a pre-built risk knowledge base includes: The text to be retrieved is input into a pre-trained semantic embedding model, which encodes and generates the corresponding first semantic vector; and In a pre-built risk knowledge base, an approximate vector search algorithm is used to retrieve and return a second semantic vector that is similar to the first semantic vector, wherein the second semantic vector is generated by pre-encoding text blocks of the risk knowledge base using the same semantic embedding model.

6. The method according to claim 1, characterized in that, The acquisition of external intelligence includes: Real-time collection of webpage data from active areas of the network based on targeted distributed crawler technology; and The collected web page data is processed for feature recognition to generate external intelligence.

7. The method according to claim 6, characterized in that, The step of performing feature recognition processing on the collected webpage data to generate external intelligence includes: In response to the fact that the webpage data is plain text content, the webpage data is cleaned to remove irrelevant noise data and invalid information; In response to the fact that the webpage data is image content, the webpage data is subjected to text recognition processing and converted into a corresponding natural language description; The text similarity of the processed webpage data is calculated using a text similarity algorithm; and Content whose text similarity meets a preset similarity threshold is removed to generate external intelligence.

8. An anomaly risk identification device, characterized in that, The device includes: The pre-prediction module is used to obtain rule text; perform security assessment on the rule text based on a large language model, and output risk prediction results, wherein the risk prediction results include at least a potential risk score, a prediction of suspicious attack paths, a summary of historical cases, and risk control optimization suggestions. The real-time identification module is used to acquire external intelligence in real time; based on a large language model, it performs intelligence semantic analysis on the external intelligence and the risk prediction results from the pre-prediction stage, and outputs anomaly analysis results, wherein the anomaly analysis results include at least rule text correlation, risk level, anomaly clue summary, and suspicious expressions; and Post-event learning module: used to write the risk prediction results and the anomaly analysis results into a pre-built risk knowledge base.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images