Supply chain risk identification method, system, device, storage medium and program product

Abstract

This application relates to a supply chain risk identification method, system, device, storage medium, and program product, belonging to the interdisciplinary field of artificial intelligence and digital supply chain technology. The method includes: performing anomaly detection on supply chain business flow data using a pre-trained anomaly detection model to obtain anomaly detection results; if the anomaly detection results do not conform to known pattern characteristics, converting the anomaly detection results into executable candidate compliance rules; loading the candidate compliance rules into a sandbox environment to obtain running results; evaluating the effectiveness of the candidate compliance rules based on the running results; if the candidate compliance rules are effective, packaging the candidate compliance rules and the pattern characteristic data of the anomaly detection results into a training feedback package; incrementally training the anomaly detection model based on the training feedback package to obtain a trained anomaly detection model. Through an automated collaborative mechanism between anomaly detection and compliance rules, the accuracy of supply chain risk identification is improved.

Description

Technical Field

[0001] This application relates to the field of interdisciplinary technology of artificial intelligence and digital supply chain, and in particular to a supply chain risk identification method, system, device, storage medium and program product. Background Technology

[0002] With the deepening of supply chain digitalization and globalization, business process complexity and data volume have surged, leading to a dynamic evolution of abnormal behaviors and compliance risks across entities and processes. Traditional compliance rule-making, reliant on human experience, lags behind and struggles to adapt to unknown anomaly patterns. Conversely, relying solely on AI models for supply chain risk identification suffers from high false alarm rates, lack of handling rules, and insufficient closed-loop optimization. Therefore, traditional methods suffer from a disconnect between anomaly detection and compliance control, resulting in low accuracy in supply chain risk identification. Summary of the Invention

[0003] Therefore, it is necessary to provide a supply chain risk identification method, system, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical issues, thereby improving the accuracy of supply chain risk identification through an automated collaborative mechanism between anomaly detection and compliance rules.

[0004] Firstly, this application provides a method for identifying supply chain risks, including:

[0005] Anomaly detection results are obtained by using a pre-trained anomaly detection model to detect anomalies in supply chain business flow data.

[0006] If the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are transformed into executable candidate compliance rules;

[0007] Load the candidate compliance rules into the sandbox environment and obtain the execution results;

[0008] Based on the operational results, the effectiveness of the candidate compliance rules is evaluated, and the effectiveness evaluation results are obtained.

[0009] If the validity assessment results indicate that the candidate compliance rules are valid, the pattern feature data of the candidate compliance rules and the anomaly detection results are packaged into a training feedback package. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model.

[0010] In one embodiment, if the anomaly detection result does not conform to known pattern characteristics, the anomaly detection result is transformed into an executable candidate compliance rule, including:

[0011] When the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are processed in a structured manner to obtain a structured rule proposal data package;

[0012] Transform the rule proposal data package into executable candidate compliance rules.

[0013] In one embodiment, before performing structured processing on the anomaly detection results to obtain a structured rule proposal data packet when the anomaly detection results do not conform to known pattern characteristics, the method further includes:

[0014] Extract the core feature combination of anomaly detection results;

[0015] Generate pattern fingerprints based on combinations of core features;

[0016] If no known pattern fingerprint matching the pattern fingerprint is found in the preset rule knowledge base, it is determined that the anomaly detection result does not conform to the known pattern characteristics.

[0017] Accordingly, when the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are processed in a structured manner to obtain a structured rule proposal data package, including:

[0018] In cases where the anomaly detection results do not conform to known pattern characteristics, historical detection results of supply chain business flow data should be obtained.

[0019] If the pattern fingerprint appears more frequently than a preset number of times within a preset time period in the historical detection results, obtain the suggested actions and verification sets that match the pattern fingerprint, and transform the abnormal detection results, suggested actions, and verification sets into a structured rule proposal data package.

[0020] In one embodiment, converting the rule proposal data packet into an executable candidate compliance rule includes:

[0021] The rule proposal data packet is parsed to obtain the parsing results; the parsing results include key entities, key attributes, and constraints.

[0022] Based on the type of the key entity, match the corresponding logical framework from the pre-built rule logic template library;

[0023] Fill the constraints and key attributes into the logical framework to obtain the logical filling framework;

[0024] Instantiate the logic-filling framework into executable candidate compliance rules.

[0025] In one embodiment, the execution results include rule trigger logs and action simulation logs; based on the execution results, the candidate compliance rules are evaluated for effectiveness, and the effectiveness evaluation results are obtained, including:

[0026] For each suggested action in the rule trigger log, determine the adoption status of the suggested action based on the action simulation log;

[0027] Based on the adoption status of multiple suggested actions in the rule trigger log, determine the trigger accuracy of candidate compliance rules;

[0028] The candidate compliance rules are logically conflict-detected against the preset production rule base to obtain the conflict detection results.

[0029] Based on the conflict detection results, determine the conflict coefficient of the candidate compliance rules;

[0030] The effectiveness assessment results are determined based on the trigger accuracy and conflict coefficient.

[0031] In one embodiment, the effectiveness evaluation result is determined based on the trigger accuracy and the conflict coefficient, including:

[0032] If the trigger accuracy is greater than the accuracy threshold and the conflict coefficient is greater than the conflict coefficient threshold, the validity assessment result is determined to be a valid candidate compliance rule.

[0033] Secondly, this application also provides a supply chain risk identification system, including:

[0034] An anomaly detection engine is used to detect anomalies in supply chain business flow data using a pre-trained anomaly detection model and obtain anomaly detection results.

[0035] The rule transformation engine is used to transform anomaly detection results into executable candidate compliance rules when the anomaly detection results do not conform to known pattern characteristics.

[0036] The sandbox management engine is used to load candidate compliance rules into the sandbox environment and obtain the execution results;

[0037] The rule evaluation module is used to evaluate the effectiveness of candidate compliance rules based on the operation results and obtain the effectiveness evaluation results;

[0038] The model feedback training module is used to package the pattern feature data of the candidate compliance rules and the anomaly detection results into a training feedback package when the validity evaluation results indicate that the candidate compliance rules are valid. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model.

[0039] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0040] Anomaly detection results are obtained by using a pre-trained anomaly detection model to detect anomalies in supply chain business flow data.

[0041] If the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are transformed into executable candidate compliance rules;

[0042] Load the candidate compliance rules into the sandbox environment and obtain the execution results;

[0043] Based on the operational results, the effectiveness of the candidate compliance rules is evaluated, and the effectiveness evaluation results are obtained.

[0044] If the validity assessment results indicate that the candidate compliance rules are valid, the pattern feature data of the candidate compliance rules and the anomaly detection results are packaged into a training feedback package. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model.

[0045] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0046] Anomaly detection results are obtained by using a pre-trained anomaly detection model to detect anomalies in supply chain business flow data.

[0047] If the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are transformed into executable candidate compliance rules;

[0048] Load the candidate compliance rules into the sandbox environment and obtain the execution results;

[0049] Based on the operational results, the effectiveness of the candidate compliance rules is evaluated, and the effectiveness evaluation results are obtained.

[0050] If the validity assessment results indicate that the candidate compliance rules are valid, the pattern feature data of the candidate compliance rules and the anomaly detection results are packaged into a training feedback package. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model.

[0051] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0052] Anomaly detection results are obtained by using a pre-trained anomaly detection model to detect anomalies in supply chain business flow data.

[0053] If the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are transformed into executable candidate compliance rules;

[0054] Load the candidate compliance rules into the sandbox environment and obtain the execution results;

[0055] Based on the operational results, the effectiveness of the candidate compliance rules is evaluated, and the effectiveness evaluation results are obtained.

[0056] If the validity assessment results indicate that the candidate compliance rules are valid, the pattern feature data of the candidate compliance rules and the anomaly detection results are packaged into a training feedback package. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model.

[0057] The aforementioned supply chain risk identification methods, systems, computer equipment, computer-readable storage media, and computer program products use pre-trained anomaly detection models to detect anomalies in supply chain business flow data. When the anomaly detection results do not conform to known pattern characteristics, they are transformed into executable candidate compliance rules. This method of generating candidate compliance rules using anomaly detection results identified by the anomaly detection model improves the efficiency and accuracy of compliance rule generation, enabling continuous evolution of compliance rules and dynamic adaptation to changes in supply chain business flow data, thus enhancing the adaptive capability of supply chain risk identification. Furthermore, loading the candidate compliance rules into a sandbox environment and obtaining execution results through independent sandbox verification avoids business interference and misjudgments caused by directly deploying compliance rules, improving compliance efficiency. The system prioritizes the security of rule deployment. Based on the operational results, it evaluates the effectiveness of candidate compliance rules, obtaining validity assessment results. If the validity assessment results indicate that the candidate compliance rules are effective, it packages the candidate compliance rules and the pattern feature data of the anomaly detection results into a training feedback package. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model. In this way, by using effective candidate compliance rules and pattern feature data to incrementally train the anomaly detection model, the model can continuously learn from effective candidate compliance rules, constantly improving the accuracy and adaptability of identifying supply chain risks. This closed-loop mechanism of two-way learning and co-evolution between anomaly detection and compliance rules can enhance the automation, accuracy, and dynamic adaptability of supply chain risk identification and compliance management. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 This is a diagram illustrating the application environment of the supply chain risk identification method in one embodiment;

[0060] Figure 2This is a flowchart illustrating a supply chain risk identification method in one embodiment;

[0061] Figure 3 This is a schematic diagram of a sub-process of step 202 in one embodiment;

[0062] Figure 4 Here is a structural block diagram of a supply chain risk identification system in one embodiment;

[0063] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0065] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0066] The supply chain risk identification method provided in this application can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Terminal 102 performs anomaly detection on supply chain business flow data using a pre-trained anomaly detection model, obtaining anomaly detection results. If the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are transformed into executable candidate compliance rules. The candidate compliance rules are loaded into a sandbox environment to obtain running results. Based on the running results, the candidate compliance rules are evaluated for effectiveness, obtaining effectiveness evaluation results. If the effectiveness evaluation results indicate that the candidate compliance rules are effective, the pattern characteristic data of the candidate compliance rules and the anomaly detection results are packaged into a training feedback package. The anomaly detection model is incrementally trained based on the training feedback package to obtain the trained anomaly detection model. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart vehicle devices, projection devices, etc. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. Server 104 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0067] In one exemplary embodiment, such as Figure 2 As shown, a supply chain risk identification method is provided, which can be applied to... Figure 1 Taking terminal 102 as an example, the explanation includes the following steps 201 to 205.

[0068] Step 201: Perform anomaly detection on the supply chain business flow data using a pre-trained anomaly detection model to obtain anomaly detection results.

[0069] Supply chain business flow data refers to business data within the supply chain. For example, in a procurement scenario, supply chain business flow data includes purchase order flow, logistics tracking signals, warehousing inbound / outbound flow records, contract payment status, and other business data. With the increasing complexity of business processes and the surge in data volume within the supply chain, identifying anomalies in supply chain business flow data becomes increasingly difficult.

[0070] An anomaly detection model is a pre-trained machine learning model specifically designed for anomaly detection in supply chain business flow data. It can employ time-series models, clustering models, etc., such as a time-series anomaly detection model based on LSTMAutoencoder (Long Short-Term Memory Autoencoder). The anomaly detection model is trained using massive amounts of supply chain business flow data samples.

[0071] The anomaly detection result is the output of the anomaly detection model after the supply chain business flow data is input. This output indicates anomalies in the supply chain business flow data. For example, anomaly information includes anomaly type, anomaly time, degree of deviation, risk level, and problem description.

[0072] Step 202: If the anomaly detection result does not conform to the known pattern characteristics, the anomaly detection result is converted into an executable candidate compliance rule.

[0073] Among them, the core feature combination of the anomaly detection result is extracted to obtain the pattern fingerprint of the anomaly detection result. The pattern fingerprint may be a known pattern fingerprint or an unknown pattern fingerprint.

[0074] The pre-defined rule knowledge base stores at least one known pattern fingerprint. Unknown pattern fingerprints refer to entirely new pattern fingerprints that are not stored in the rule knowledge base and do not belong to known anomalies. Known pattern features refer to the characteristics of known pattern fingerprints, indicating the data's abnormal patterns and behavioral characteristics. For example, a known pattern feature is "idle material inventory age > 365 days".

[0075] In some embodiments, a preset rule knowledge base is used to determine whether the anomaly detection result is a known pattern fingerprint. If it is not a known pattern fingerprint, the anomaly detection result is determined to be an unknown pattern fingerprint, i.e., it does not conform to the characteristics of a known pattern. For example, the pattern fingerprint of the anomaly detection result is "project material inventory age > 90 days", which does not conform to the characteristics of a known pattern.

[0076] Candidate compliance rules are rules used to regulate the behavior of supply chain business flow data and prevent data risks. Anomaly detection results are transformed into conditions and actions described in natural language, and these conditions and actions are compiled into executable rule scripts to obtain candidate compliance rules.

[0077] Step 203: Load the candidate compliance rules into the sandbox environment and obtain the running results.

[0078] The sandbox environment refers to a dedicated testing environment that is logically isolated from the production environment but synchronizes data in real time. Candidate compliance rules are loaded into the sandbox environment, and the operation of supply chain business flow data is simulated within the sandbox environment based on these rules to obtain the results. The operation in the sandbox environment does not affect the real supply chain business environment and does not generate actual interception, warning, or other production operations.

[0079] The results indicate anomalies in the supply chain business flow data identified using candidate compliance rules, including anomaly warnings and handling suggestions.

[0080] Step 204: Based on the running results, evaluate the effectiveness of the candidate compliance rules and obtain the effectiveness evaluation results.

[0081] Candidate compliance rules may effectively identify supply chain risks, but they may also contain issues such as misjudgments, omissions, and logical flaws. Effectiveness assessment is used to evaluate whether candidate compliance rules can effectively identify supply chain risks. For example, based on the operational results, multiple assessment indicators for candidate compliance rules are determined, and based on these indicators, the effectiveness assessment results are used to indicate the effectiveness of the candidate compliance rules.

[0082] Optionally, the evaluation metrics include at least one of trigger accuracy, false positive rate, conflict coefficient, etc. For example, if any one or more of the multiple evaluation metrics meet the validity evaluation criteria, the candidate compliance rule is determined to be valid.

[0083] Step 205: If the validity assessment result indicates that the candidate compliance rule is valid, package the candidate compliance rule and the pattern feature data of the anomaly detection result into a training feedback package, and incrementally train the anomaly detection model according to the training feedback package to obtain the trained anomaly detection model.

[0084] Among them, the fact that the candidate compliance rules are valid indicates that the candidate compliance rules can accurately identify abnormal information in the supply chain business flow data and are adapted to the supply chain business.

[0085] Extract the abnormal patterns and behavioral characteristics of the anomaly detection results as pattern feature data.

[0086] The candidate compliance rules and anomaly detection results' pattern feature data are correlated and integrated, and uniformly packaged into a preset format to obtain a training feedback package. The training feedback package is sent to the model training module, which incrementally trains the anomaly detection model based on the training feedback package to obtain the trained anomaly detection model.

[0087] For example, the pattern feature data of anomaly detection results can be used as training samples and input into the anomaly detection model. Candidate compliance rules can be used as training constraint boundaries to update the model parameters of the anomaly detection model until a preset stopping condition is met, thus obtaining an anomaly detection model after incremental training.

[0088] By learning these anomalous patterns that have been proven to derive effective rules, the model adjusts its internal parameters. In this way, using the trained anomaly detection model to detect anomalies in other supply chain business flow data can improve the model's sensitivity to similar risk patterns and significantly enhance its early identification capabilities.

[0089] Driven by feedback, the anomaly detection model can identify risks earlier. All newly added candidate compliance rules have been validated using real business data in a sandbox environment, ensuring high accuracy and low false alarm rates. Two-way optimization of rules and models significantly improves the signal-to-noise ratio of the entire system's alarms. It can proactively discover new risks, autonomously generate new knowledge, and automatically optimize detection capabilities from constantly changing supply chain business flow data.

[0090] In the aforementioned supply chain risk identification method, a pre-trained anomaly detection model is used to detect anomalies in supply chain business flow data. When the anomaly detection results do not conform to known pattern characteristics, they are transformed into executable candidate compliance rules. This method, which utilizes anomaly detection results identified by the anomaly detection model to generate candidate compliance rules, improves the efficiency and accuracy of compliance rule generation, enabling continuous evolution of compliance rules and dynamic adaptation to changes in supply chain business flow data, thus enhancing the adaptive capability of supply chain risk identification. The candidate compliance rules are then loaded into a sandbox environment to obtain operational results. This method, through independent sandbox verification, avoids business interference and misjudgments caused by directly deploying compliance rules, improving the security of compliance rule deployment. Based on the operational results… As a result, the effectiveness of candidate compliance rules is evaluated, and when the effectiveness evaluation results indicate that the candidate compliance rules are effective, the pattern feature data of the candidate compliance rules and anomaly detection results are packaged into a training feedback package. The anomaly detection model is incrementally trained based on the training feedback package to obtain the trained anomaly detection model. In this way, by using effective candidate compliance rules and pattern feature data to incrementally train the anomaly detection model, the anomaly detection model can continuously learn from effective candidate compliance rules, thereby continuously improving the accuracy and adaptability of supply chain risk identification. This closed-loop mechanism of two-way learning and co-evolution between anomaly detection and compliance rules can improve the automation, accuracy, and dynamic adaptability of supply chain risk identification and compliance management.

[0091] In one exemplary embodiment, such as Figure 3 As shown, when the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are transformed into executable candidate compliance rules, including the following steps.

[0092] Step 302: If the anomaly detection results do not conform to the known pattern characteristics, the anomaly detection results are processed in a structured manner to obtain a structured rule proposal data package.

[0093] Step 304: Transform the rule proposal data package into executable candidate compliance rules.

[0094] If the anomaly detection result does not conform to the known pattern characteristics, it indicates that the anomaly detection result is a new unknown risk, and the preset rule knowledge base does not contain the pattern fingerprint of the anomaly detection result.

[0095] In some embodiments, a pattern fingerprint of the anomaly detection result is retrieved from a preset rule knowledge base. If no pattern fingerprint is found, the anomaly detection result is determined to not conform to known pattern characteristics. The retrieval method may include: traversing known pattern fingerprints in the preset rule knowledge base; for each known pattern fingerprint currently traversed, calculating the similarity between the known pattern fingerprint and the pattern fingerprint of the anomaly detection result; obtaining the similarity calculation result corresponding to the known pattern fingerprint; if the similarity calculation result corresponding to the known pattern fingerprint is not less than a preset similarity, it is determined that a known pattern fingerprint matching the pattern fingerprint of the anomaly detection result has been retrieved, and the anomaly detection result conforms to known pattern characteristics. Conversely, if the similarity calculation result between all known pattern fingerprints in the preset rule knowledge base and the pattern fingerprint of the anomaly detection result is less than a preset similarity, it is determined that no known pattern fingerprint matching the pattern fingerprint of the anomaly detection result has been retrieved, and the anomaly detection result does not conform to known pattern characteristics.

[0096] If the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are transformed into executable candidate compliance rules for the verification of candidate compliance rules and the continuous updating of compliance rules.

[0097] The anomaly detection results are structured to obtain a structured rule proposal data package. In some embodiments, the anomaly detection results also include all feature values ​​that caused the anomaly, the associated business entity IDs (such as material ID, project ID, supplier ID), and the original data snapshot. Structured processing refers to transforming the anomaly detection results into a structured rule proposal data package according to preset structured rules. For example, the preset structured rules define triggering conditions, suggested conditions, and a set of evidence. For instance, the triggering condition might be: Material Usage = "Project Material" AND Inventory Age > 90 days.

[0098] The rule proposal data package contains information such as conditions and actions described in natural language. Using a preset scripting language, the conditions and actions described in natural language in the rule proposal data package are compiled into specific rule scripts to obtain executable candidate compliance rules.

[0099] In this embodiment, when the anomaly detection results do not conform to known pattern characteristics, the anomaly detection results are structured and then transformed into executable candidate compliance rules, thereby realizing the automatic and continuous evolution of compliance rules and continuously improving the adaptive identification capability of unknown risks in supply chain business.

[0100] In an exemplary embodiment, before structuring the anomaly detection result to obtain a structured rule proposal data package when the anomaly detection result does not conform to known pattern characteristics, the method further includes: extracting a core feature combination of the anomaly detection result; generating a pattern fingerprint based on the core feature combination; determining that the anomaly detection result does not conform to known pattern characteristics when no known pattern fingerprint matching the pattern fingerprint is found in a preset rule knowledge base; correspondingly, structuring the anomaly detection result to obtain a structured rule proposal data package when the anomaly detection result does not conform to known pattern characteristics, including: obtaining historical detection results of supply chain business flow data when the anomaly detection result does not conform to known pattern characteristics; obtaining suggested actions and verification sets matching the pattern fingerprint when the frequency of the pattern fingerprint in the historical detection results exceeds a preset number of occurrences within a preset time period; and converting the anomaly detection result, suggested actions, and verification sets into a structured rule proposal data package.

[0101] Among them, abnormal detection results It contains multidimensional features, extracts multiple core features from the anomaly detection results, obtains a core feature combination, and uses feature engineering functions. The core feature combination is mapped to a standardized pattern feature vector. This refers to the pattern fingerprint, which can be generated using the following formula:

[0102]

[0103] The pattern fingerprint's components include anomaly type encoding, anomaly strength scalar, numerical feature vector, and entity embedding vector. The specific meanings of each component are as follows:

[0104] Exception type encoding: , This is the preset total number of exception types.

[0105] Anomaly strength scalar: ,in This is the Sigmoid normalization function.

[0106] Numerical eigenvectors: This includes inventory age, schedule deviation rate, etc. A continuous business metric.

[0107] Entity embedding vector: It contains multiple low-dimensional dense vectors, specifically by mapping discrete entities such as material categories and project types into low-dimensional dense vectors through a pre-trained model.

[0108] Whether the anomaly detection result conforms to the characteristics of a known pattern can be determined by the similarity calculation between the pattern fingerprint of the anomaly detection result and the known pattern fingerprint, or by the frequency of the anomaly detection result within a preset time window.

[0109] In some embodiments, if the similarity calculation result between all known pattern fingerprints in the preset rule knowledge base and the pattern fingerprint of the anomaly detection result is less than the preset similarity, and the frequency of the anomaly detection result occurring within the preset time window exceeds the preset frequency, it is determined that no known pattern fingerprint matching the pattern fingerprint of the anomaly detection result is found, and the anomaly detection result does not conform to the known pattern characteristics.

[0110] For example, a matrix can be used to represent the pre-defined rule knowledge base: , where each column This corresponds to a feature vector of a known pattern fingerprint. The Mahalanobis distance between the known pattern fingerprint and the pattern fingerprint of the anomaly detection result is calculated using weighted Mahalanobis distance:

[0111]

[0112] in, Let be the feature importance weight matrix, satisfying Σ is the covariance matrix. This represents the Mahalanobis distance.

[0113] Convert Mahalanobis distance into similarity calculation results:

[0114]

[0115] in, This is a temperature parameter used to control the similarity decay rate. This indicates the similarity calculation result.

[0116] Calculate the maximum similarity result :

[0117]

[0118] Novelty determination criteria:

[0119]

[0120] Among them, the preset similarity A value of 0.25 to 0.35 can be used to ensure that the structured processing of the anomaly detection result is triggered when the pattern fingerprint of the anomaly detection result is significantly different from all known pattern features.

[0121] In some embodiments, the preset time window is T days, and λ>0 defines the time decay kernel function as follows:

[0122]

[0123] For abnormal detection results The occurrence time is t=0, and the anomaly detection results are statistically analyzed over the past T days. Pattern fingerprints are the frequency of occurrence of historical detection results for the same pattern. :

[0124]

[0125] in, For a moment The feature vector of the detection result, The pattern matching threshold (can be set to 0.6~0.8). For abnormal intensity differences, For example, the significance criterion for the intensity similarity weighting function, Preset number of times It can be set to 3~5, and combined with the time decay kernel function, it can ensure that the continuously occurring anomaly detection results can be identified.

[0126] The determination of known pattern features can be represented by a binary decision function:

[0127]

[0128] When the binary decision function outputs 1, it indicates that the anomaly detection result does not conform to the known pattern features, and the pattern fingerprint in the historical detection results appears more frequently than a preset number of times within a preset time period, triggering structured processing and constructing a rule proposal data package. .

[0129] Obtain suggested actions and verification sets that match the pattern fingerprint, and transform the anomaly detection results, suggested actions, and verification sets into a structured rule proposal data package according to preset structured rules.

[0130] In this embodiment, a pattern fingerprint is generated by combining the core features of the anomaly detection result. The pattern fingerprint can indicate the core features of the anomaly detection result. By searching the preset rule knowledge base, it is effectively identified whether the pattern fingerprint of the anomaly detection result conforms to the known pattern features. In the case that it does not conform, structured processing is triggered to transform the anomaly detection result into a structured rule proposal data package, which is conducive to the continuous optimization of compliance rules and improves the ability to identify unknown anomalies.

[0131] In an exemplary embodiment, converting a rule proposal data packet into an executable candidate compliance rule includes: parsing the rule proposal data packet to obtain a parsing result; the parsing result encapsulating key entities, key attributes, and constraints; matching the corresponding logical framework from a pre-set rule logic template library according to the type of the key entity; filling the constraints and key attributes into the logical framework to obtain a logical filling framework; and instantiating the logical filling framework into an executable candidate compliance rule.

[0132] Specifically, the rule proposal data packet is parsed according to the preset structured rules to obtain the parsing results, which include key entities, key attributes, and constraints.

[0133] A key entity refers to the core business object targeted by the rule proposal data package. For example, if the trigger condition is "material purpose = "project material", the key entity extracted from the trigger condition is Material, and the ID (identifier) ​​of the key entity is determined by combining it with contextual information.

[0134] Key attributes refer to specific fields that are monitored for key entities. For example, the key attribute extracted from "Inventory age > 90 days" is inventory.lib_age (inventory.inventory age).

[0135] Constraints refer to the specific logical judgments made regarding key attributes. These specific logical judgments include: comparison operators, threshold values, logical connectors, and standardized intermediate representations of the output.

[0136] The comparison operators include GREATER_THAN(>), EQUALS(=), CONTAINS, etc. Thresholds or values ​​include 90, project materials, etc. Logical connectors include AND, OR, etc., used to connect multiple conditions.

[0137] The terminal has a pre-built rule logic template library, which contains a variety of logic frameworks. These logic frameworks are not complete rules, but parameterized rule frameworks for different business scenarios and entity types.

[0138] Based on the type of the key entity, a corresponding logical framework is matched from a pre-defined rule logic template library. Multiple logical frameworks in the pre-defined rule logic template library are traversed, and if the similarity between the name of any logical framework and the type of the key entity is higher than a preset similarity, that logical framework is selected as the logical framework matching the type of the key entity. For example, if the key entity type is Material, Contract, Supplier, the logical framework named MaterialDelayAlertTemplate is retrieved from the rule logic template library.

[0139] Each logical framework includes a condition framework, an action framework, and a metadata framework. The condition framework refers to reserved placeholders used to insert specific attribute constraints. The action framework refers to the standard sequence of actions executed when conditions are met, such as risk assessment, message generation, and work order creation; it includes parameterizable components such as alert receiving roles and message templates. The metadata framework is used to automatically populate the unique ID, version, source proposal ID, creation time, etc., of the rules.

[0140] Constraints and key data are injected into the logical framework. Specifically, constraints and key data are filled into the condition frame to generate rule condition clauses. For example, attribute="inventory.lib_age", operator="">", value=90 are filled into the condition frame to generate specific rule condition clauses.

[0141] The suggested actions in the rule proposal data package are translated into calling code and populated into the action framework to obtain the rule action clause. Based on the strength of the evidence set in the rule proposal data package, an initial confidence weight is automatically calculated and assigned. Using the rule conditional clauses and rule action clauses as a logical filling framework, and based on the logical filling framework and the initial confidence weight, a complete and executable candidate compliance rule, R_candidate, is written using a specific rule engine language, such as Drools' DRL or internal DSL (Domain-Specific Language).

[0142] In this embodiment, by parsing the key entities, key attributes, and constraints from the rule proposal data packet, the constraints and key attributes are filled into a logical framework that matches the type of the key entity, resulting in a logical filling framework, which is then instantiated into an executable candidate compliance rule. This template-based generation method improves the efficiency of candidate compliance rule generation.

[0143] In an exemplary embodiment, the execution results include rule triggering logs and action simulation logs. Based on the execution results, the candidate compliance rules are evaluated for effectiveness, resulting in an effectiveness evaluation result. This includes: for each suggested action in the rule triggering log, determining the adoption status of the suggested action based on the action simulation log; determining the triggering accuracy of the candidate compliance rule based on the adoption status of each suggested action in the rule triggering log; performing logical conflict detection between the candidate compliance rule and a preset production rule base to obtain conflict detection results; determining the conflict coefficient of the candidate compliance rule based on the conflict detection results; and determining the effectiveness evaluation result based on the triggering accuracy and the conflict coefficient.

[0144] The candidate compliance rules are run in a sandbox environment, and the results include rule trigger logs and action simulation logs. Rule trigger logs record the process of the candidate compliance rules running in the sandbox environment, including timestamps, a complete snapshot of the context data at the time of triggering, and suggested actions generated in the sandbox environment. Suggested actions refer to recommended actions or alerts.

[0145] Action simulation logs refer to logs of actions simulated in a sandbox environment. In a sandbox environment, recommended actions are not actually executed, but rather simulated. For example, the action simulation log might record that candidate compliance rule R001 simulates sending a project material backlog warning to user U001 at time T, with the message content stating "project material backlog."

[0146] Adoption status refers to whether the suggested actions corresponding to the candidate compliance rules are adopted. After the candidate compliance rules are run in the sandbox environment, suggested actions are generated. Based on the action simulation logs, it is determined whether any corrective business actions directly responding to the suggested actions have occurred in the sandbox environment. If corrective business actions responding to the suggested actions exist in the sandbox environment, the suggested actions are determined to be adopted; otherwise, they are determined not to be adopted.

[0147] For example, if the suggested action (warning) is "Material A is stuck", and the action simulation log shows "Material A has been issued and put out of the warehouse" or "The planned completion date of related project J has been updated", it indicates that the suggested action (warning) has been adopted.

[0148] In some embodiments, if no corrective business action responds to the suggested action during the observation period, this suggested action can be sampled and pushed to the manual review interface. If the business personnel confirm that it is an invalid warning, and the delay is due to special and reasonable reasons, the suggested action is not adopted. For suggested actions that are not sampled, if there is no response for a long period of time, the adoption status can also be probabilistically labeled based on a statistical model.

[0149] Based on the adoption status of multiple suggested actions in the rule triggering log, the triggering accuracy of the candidate compliance rule is determined. Specifically, the adoption status includes the number of times each suggested action was adopted and the number of times it was not adopted. The triggering accuracy is obtained by dividing the number of adopted actions by the sum of the number of adopted and unadopted actions. The triggering accuracy P can be expressed as follows:

[0150]

[0151] in, and These represent the number of times the proposal was accepted and the number of times it was not accepted.

[0152] In some embodiments, the number of times multiple suggested actions were not adopted can be divided by the sum of the number of adopted actions and the number of unadopted actions, and the result can be used as the false positive rate. The false positive rate (FPR) can be expressed as follows:

[0153]

[0154] Logical conflict detection refers to detecting conflicts between candidate compliance rules and other compliance rules in the pre-defined production rule base. The conflict detection result can be represented as the number of times a candidate compliance rule and any other compliance rule in the pre-defined production rule base produce contradictory conclusions regarding the same data. The quotient between the conflict detection result and the total number of times the candidate compliance rule is triggered can be used as the conflict coefficient. It can be represented as follows:

[0155]

[0156] in, It represents the number of times a candidate compliance rule and any other compliance rule in the pre-defined production rule base produce contradictory conclusions regarding the same data. This represents the total number of times the candidate compliance rules have been triggered.

[0157] The validity assessment result is determined based on the trigger accuracy rate and the conflict coefficient. At least one of the trigger accuracy rate and the conflict coefficient can be used to determine the validity assessment result. For example, if at least one of the trigger accuracy rate and the conflict coefficient meets the validity condition, the validity assessment result is determined to be that the candidate compliance rule is valid; if neither the trigger accuracy rate nor the conflict coefficient meets the validity condition, the validity assessment result is determined to be that the candidate compliance rule is invalid. The validity condition can be flexibly set according to the actual situation. For example, the validity condition can be that the trigger accuracy rate exceeds a preset accuracy rate, or it can be that the conflict coefficient exceeds a preset conflict coefficient.

[0158] If the validity assessment indicates that the candidate compliance rule is valid, it is added to the pre-defined production rule base, and the pattern feature data of the anomaly detection results is added to the pre-defined rule knowledge base. The candidate compliance rule and the pattern feature data of the anomaly detection results are then used as high-quality samples for incremental training of the anomaly detection model. If the validity assessment indicates that the candidate compliance rule is invalid, the reason for the failure will be recorded, such as insufficient trigger accuracy or excessive conflicts. The pattern feature data of the anomaly detection result may enter a cooling-off period or be fed back to the upstream steps as optimization samples.

[0159] In some embodiments, before loading candidate compliance rules into the sandbox environment, the semantic correlation between the candidate compliance rules and each compliance rule in the pre-defined production rule library is determined; if the semantic correlation exceeds a correlation threshold, the candidate compliance rule is loaded into the sandbox environment. This ensures that all newly generated candidate compliance rules are standardized in structure, exception handling, and performance through pre-defined compliance rules that have been validated by best practices. This avoids the problems of inconsistent code quality, poor performance, and even logical errors that can result from manually written rules. The sandbox environment allows candidate compliance rules to undergo comprehensive testing with real, complex, and dynamic production data streams under zero-risk conditions. This solves traditional problems such as business interruptions and false alarms that may bother users when new rules are deployed.

[0160] In this embodiment, the adoption status of multiple suggested actions is determined by the running results of candidate compliance rules in the sandbox environment, thereby determining the trigger accuracy of candidate compliance rules, which is conducive to accurately assessing the effectiveness of candidate compliance rules. At the same time, logical conflict detection is used to identify logical conflict issues in candidate compliance rules, and the trigger accuracy and conflict coefficient are used together as the effectiveness assessment results to ensure the accurate assessment of the effectiveness of candidate compliance rules and improve the reliability of candidate compliance rules.

[0161] In an exemplary embodiment, determining the validity assessment result based on the trigger accuracy and the conflict coefficient includes: if the trigger accuracy is greater than the accuracy threshold and the conflict coefficient is greater than the conflict coefficient threshold, determining the validity assessment result as a valid candidate compliance rule.

[0162] Specifically, if the trigger accuracy is greater than the preset accuracy and the conflict coefficient is less than the preset conflict coefficient, the candidate compliance rule is determined to be valid; otherwise, the candidate compliance rule is determined to be invalid. The determination of the validity assessment result Verdicet can be expressed as follows:

[0163]

[0164] in, To preset the accuracy rate, The default conflict coefficient is set.

[0165] In this embodiment, trigger accuracy and conflict coefficient are used as core criteria to transform the decision-making process for implementing compliance rules from relying on subjective experience to adjudication based on objective data, ensuring the overall high accuracy and low noise of the production rule base. By forcing the conflict coefficient to be lower than a preset conflict coefficient, the new rules are ensured to be logically consistent with the existing rule base, avoiding decision-making confusion. By automatically linking rule triggering with subsequent business correction actions, a complete value loop from risk perception to handling is achieved. Validated rules and their corresponding true positive cases constitute an accurately labeled training sample set, driving the anomaly detection model to achieve a virtuous cycle of becoming more accurate with use.

[0166] In some embodiments, incremental training of the anomaly detection model based on the training feedback package to obtain the trained anomaly detection model includes: using the pattern feature data in the training feedback package as new training samples, and using the trigger accuracy of the candidate compliance rule as the reinforcement learning reward signal of the training samples; using the training samples and the reward signal, updating the parameters of the anomaly detection model through an online learning algorithm to obtain the trained anomaly detection model.

[0167] In practice, according to the candidate compliance rules During the effectiveness evaluation Internal trigger accuracy and conflict coefficient Combined with reward function Candidate compliance rules The effectiveness is mapped to reward signals. , can be represented as:

[0168]

[0169] The higher the trigger accuracy and the lower the conflict rate, the greater the reward. .

[0170] Training feedback package Construct a set of triples: .in, Pattern feature data representing anomaly detection results, To strengthen the tags, for example, This indicates a high-value anomaly.

[0171] Let the anomaly detection model be a parameterized function. The model parameters are Its basic loss function is the reconstruction loss. The smaller the loss, the more normal the model considers the sample to be. To make the model more sensitive to high-value anomalous patterns, the training objective needs to be adjusted.

[0172] By designing a reward-adjusted weighted loss function, the optimization effort for reconstructing high-reward samples is reduced, maintaining a relatively high level of reconstruction error and thus generating higher anomaly scores in the future. Using training samples, reward signals, and the total loss function, the parameters of the anomaly detection model are updated through an online learning algorithm, resulting in the trained anomaly detection model. The total loss function is defined as follows:

[0173]

[0174] Among them, weight From reward signal Decide:

[0175]

[0176] Among them, hyperparameters Controlling the intensity of the reward's impact, its value ensures all weights are controlled. .award The higher the weight The smaller the value, the better the model optimizes the samples. The smaller the gradient update magnitude of the reconstruction error, the larger the reconstruction error will be after training. Model parameters Incremental updates are performed using gradient descent:

[0177]

[0178] in, For the learning rate, choose a smaller value (e.g., To ensure smooth incremental learning and avoid damaging the model's original capabilities, This represents the model parameters before the update. This represents the updated model parameters.

[0179] To illustrate the supply chain risk identification method and its effectiveness in this solution in detail, a specific embodiment is described below.

[0180] Anomaly detection is performed on supply chain business flow data using a pre-trained anomaly detection model to obtain anomaly detection results. If the anomaly detection results do not conform to known pattern characteristics, they are transformed into executable candidate compliance rules. These candidate compliance rules are then loaded into a sandbox environment to obtain execution results. Based on the execution results, the candidate compliance rules are evaluated for effectiveness to obtain effectiveness evaluation results. If the effectiveness evaluation results indicate that the candidate compliance rules are effective, the pattern characteristic data of the candidate compliance rules and the anomaly detection results are packaged into a training feedback package. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model.

[0181] In one embodiment, when the anomaly detection result does not conform to known pattern characteristics, the anomaly detection result is transformed into an executable candidate compliance rule, including: when the anomaly detection result does not conform to known pattern characteristics, the anomaly detection result is structured to obtain a structured rule proposal data packet; and the rule proposal data packet is transformed into an executable candidate compliance rule.

[0182] In one embodiment, before structuring the anomaly detection result to obtain a structured rule proposal data package when the anomaly detection result does not conform to known pattern characteristics, the method further includes: extracting core feature combinations of the anomaly detection result; generating a pattern fingerprint based on the core feature combinations; determining that the anomaly detection result does not conform to known pattern characteristics when no known pattern fingerprint matching the pattern fingerprint is found in a preset rule knowledge base; correspondingly, structuring the anomaly detection result to obtain a structured rule proposal data package when the anomaly detection result does not conform to known pattern characteristics, including: obtaining historical detection results of supply chain business flow data when the anomaly detection result does not conform to known pattern characteristics; obtaining suggested actions and verification sets matching the pattern fingerprint when the frequency of the pattern fingerprint in the historical detection results exceeds a preset number of occurrences within a preset time period; and converting the anomaly detection result, suggested actions, and verification sets into a structured rule proposal data package.

[0183] In one embodiment, converting a rule proposal data packet into an executable candidate compliance rule includes: parsing the rule proposal data packet to obtain a parsing result; the parsing result encapsulating key entities, key attributes, and constraints; matching the corresponding logical framework from a pre-set rule logic template library based on the type of the key entity; filling the constraints and key attributes into the logical framework to obtain a logical filling framework; and instantiating the logical filling framework into an executable candidate compliance rule.

[0184] In one embodiment, the execution results include rule trigger logs and action simulation logs. Based on the execution results, the candidate compliance rules are evaluated for effectiveness, resulting in an effectiveness evaluation result. This includes: for each suggested action in the rule trigger log, determining the adoption status of the suggested action based on the action simulation log; determining the trigger accuracy of the candidate compliance rule based on the adoption status of each suggested action in the rule trigger log; performing logical conflict detection between the candidate compliance rule and a preset production rule library to obtain conflict detection results; determining the conflict coefficient of the candidate compliance rule based on the conflict detection results; and determining the effectiveness evaluation result based on the trigger accuracy and the conflict coefficient.

[0185] In one embodiment, the validity assessment result is determined based on the trigger accuracy and the conflict coefficient, including: if the trigger accuracy is greater than the accuracy threshold and the conflict coefficient is greater than the conflict coefficient threshold, the validity assessment result is determined to be that the candidate compliance rule is valid.

[0186] Taking a closed-loop management scenario addressing the risk of project materials being held in warehouses for extended periods as an example: In a power grid project, a batch of cables (materials) arrived and were not used or installed for more than three months, accumulating in the warehouse. This not only incurs inventory costs but may also indicate project delays or inaccurate demand planning. The specific process is as follows.

[0187] S1, Anomaly Detection Steps.

[0188] Input: The system continuously monitors the outbound transaction data of the warehouse management system.

[0189] Processing: Based on historical data, the anomaly detection model has learned that the vast majority of project materials will be used within 90 days of being received into inventory. The anomaly detection model calculates the inventory age (current date of receipt) of all materials in inventory in real time.

[0190] Output: The anomaly detection model identified that the batch of cables had reached 95 days of storage age, triggering an anomaly event. This event was marked as overdue project materials and included pattern characteristic data such as material ID, project ID, storage age, and current warehouse location.

[0191] S2, Rule Proposal Generation Steps.

[0192] Processing: The rule proposal generator receives this anomalous event. First, it calculates its feature vector, for example, feature codes generated based on material category, project type, and inventory age. Next, it compares this vector with known pattern fingerprints in a pre-defined rule knowledge base. It is found that existing compliance rules mainly target idle materials, while the overdue storage of project materials based on the project dimension is a new pattern feature with low similarity. Furthermore, statistics show that similar events (project material inventory age > 90 days) have occurred five times recently.

[0193] Output: Due to the high frequency and lack of known pattern characteristics, a rule proposal data package is automatically generated. This rule proposal data package structurally describes the pattern characteristic data of the anomaly detection results: when (material type = project material) and (inventory age > 90 days), an alert is triggered.

[0194] S3, Rule Transformation and Sandbox Execution Steps.

[0195] Processing: The rule transformation engine receives the above rule proposal data packet.

[0196] Parsing and Matching: The key entity is identified as project materials, with the constraint that inventory age > 90 days. A conditional alert logic template is matched. A candidate compliance rule R_candidate is generated: "IF Material Attribute.Material Purpose == 'Project Materials' AND Inventory Age > 90 Days THEN Risk Level = 'Medium', Alert Action = 'Send reminder to Project Manager and Warehouse Supervisor'".

[0197] The candidate compliance rule has a certain semantic relationship with the compliance rule "Warning for Idle Material Inventory Age > 365 Days" in the preset rule knowledge base, but the subjects are different, so a medium initial weight is assigned to it.

[0198] Output: The candidate compliance rule R_candidate is loaded into the sandbox environment. The sandbox environment is a secure mirror of the production environment, capable of receiving the same business data stream in real time, but the triggered alerts are only for observation and logging and will not actually disturb business personnel.

[0199] S4. Results tracking and evaluation steps.

[0200] Handling: During the two-week observation period, the candidate compliance rule R_candidate triggered 15 alerts in the sandbox environment. The effect tracking module recorded each trigger: 12 of these alerts corresponded to actual project delays, 2 were due to delays in procedural approvals, and 1 was due to a data entry error.

[0201] Assessment calculations show that the trigger accuracy is 12 / 15 = 80%, and the false positive rate is 1 / 15 ≈ 6.7%. Furthermore, the review found that the candidate compliance rule does not directly conflict with existing compliance rules.

[0202] Output: The evaluation report shows that the trigger accuracy of the candidate compliance rule R_candidate is higher than the preset accuracy, and the conflict coefficient is lower than the preset conflict coefficient, thus confirming that the candidate compliance rule is valid.

[0203] S5, Feedback and Model Update Steps.

[0204] Rule migration: The candidate compliance rule R_candidate has been officially migrated to the preset production rule library. From then on, all newly generated situations with "project material inventory age > 90 days" will trigger a real warning.

[0205] Model Feedback: The 12 anomalous events corresponding to the candidate compliance rule R_candidate, along with their pattern feature data, are packaged into a training feedback package and sent to the anomaly detection model. The feedback package explicitly states that identifying such patterns is valuable (reward signal).

[0206] Output / Effect: Rule Base Evolution: A precise compliance rule has been added to the preset production rule base, enhancing compliance monitoring capabilities.

[0207] Model Evolution: The anomaly detection model uses this feedback data for incremental training. The next time data with similar characteristics (such as other project materials being close to 90 days old) appears, the model can more sensitively and earlier identify it as an anomaly, even issuing a warning before reaching the hard threshold (90 days). This means that the level of intelligence in anomaly detection has improved.

[0208] The aforementioned supply chain risk identification method uses a pre-trained anomaly detection model to detect anomalies in supply chain business flow data. When the anomaly detection results do not conform to known pattern characteristics, they are transformed into executable candidate compliance rules. This method, which utilizes anomaly detection results identified by the model to generate candidate compliance rules, improves the efficiency and accuracy of compliance rule generation, enabling continuous evolution of compliance rules and dynamic adaptation to changes in supply chain business flow data, thus enhancing the adaptive capability of supply chain risk identification. The candidate compliance rules are then loaded into a sandbox environment to obtain operational results. This method, through independent sandbox verification, avoids business interference and misjudgments caused by directly deploying compliance rules, improving the security of compliance rule deployment. Based on the operational results… The effectiveness of candidate compliance rules is evaluated, and if the evaluation results indicate that the candidate compliance rules are effective, the pattern feature data of the candidate compliance rules and anomaly detection results are packaged into a training feedback package. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model. In this way, by using effective candidate compliance rules and pattern feature data to incrementally train the anomaly detection model, the anomaly detection model can continuously learn from effective candidate compliance rules, thereby continuously improving the accuracy and adaptability of supply chain risk identification. This closed-loop mechanism of two-way learning and co-evolution between anomaly detection and compliance rules can improve the automation, accuracy, and dynamic adaptability of supply chain risk identification and compliance management.

[0209] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0210] Based on the same inventive concept, this application also provides a supply chain risk identification system for implementing the supply chain risk identification method described above. The solution provided by this system is similar to the implementation scheme described in the above method; therefore, the specific limitations of one or more supply chain risk identification system embodiments provided below can be found in the limitations of the supply chain risk identification method described above, and will not be repeated here.

[0211] In one exemplary embodiment, such as Figure 4 As shown, a supply chain risk identification system 400 is provided, including: an anomaly detection engine 410, a rule conversion engine 420, a sandbox management engine 430, a rule evaluation module 440, and a model feedback training module 450.

[0212] The anomaly detection engine 410 is used to detect anomalies in supply chain business flow data using a pre-trained anomaly detection model and obtain anomaly detection results.

[0213] The rule transformation engine 420 is used to transform anomaly detection results into executable candidate compliance rules when the anomaly detection results do not conform to known pattern characteristics.

[0214] The Sandbox Management Engine 430 is used to load candidate compliance rules into the sandbox environment and obtain the running results.

[0215] The rule evaluation module 440 is used to evaluate the effectiveness of candidate compliance rules based on the running results and obtain the effectiveness evaluation results.

[0216] The model feedback training module 450 is used to package the pattern feature data of the candidate compliance rules and the anomaly detection results into a training feedback package when the validity evaluation results indicate that the candidate compliance rules are valid. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model.

[0217] The aforementioned supply chain risk identification system uses a pre-trained anomaly detection model to detect anomalies in supply chain business flow data. When the anomaly detection results do not conform to known pattern characteristics, they are transformed into executable candidate compliance rules. This method of generating candidate compliance rules using anomaly detection results improves the efficiency and accuracy of compliance rule generation, enabling continuous evolution of compliance rules and dynamic adaptation to changes in supply chain business flow data, thus enhancing the adaptive capability of supply chain risk identification. The candidate compliance rules are then loaded into a sandbox environment to obtain operational results. This method of independent sandbox verification avoids business interference and misjudgments caused by directly deploying compliance rules, improving the security of compliance rule deployment. Based on the operational results… The effectiveness of candidate compliance rules is evaluated, and if the evaluation results indicate that the candidate compliance rules are effective, the pattern feature data of the candidate compliance rules and anomaly detection results are packaged into a training feedback package. The anomaly detection model is then incrementally trained based on the training feedback package to obtain the trained anomaly detection model. In this way, by using effective candidate compliance rules and pattern feature data to incrementally train the anomaly detection model, the anomaly detection model can continuously learn from effective candidate compliance rules, thereby continuously improving the accuracy and adaptability of supply chain risk identification. This closed-loop mechanism of two-way learning and co-evolution between anomaly detection and compliance rules can improve the automation, accuracy, and dynamic adaptability of supply chain risk identification and compliance management.

[0218] In one embodiment, when the anomaly detection result does not conform to the known pattern characteristics, the anomaly detection result is transformed into an executable candidate compliance rule. The rule transformation engine 420 is further configured to: perform structured processing on the anomaly detection result to obtain a structured rule proposal data packet when the anomaly detection result does not conform to the known pattern characteristics; and transform the rule proposal data packet into an executable candidate compliance rule.

[0219] In one embodiment, before structuring the anomaly detection result to obtain a structured rule proposal data package when the anomaly detection result does not conform to known pattern characteristics, the rule conversion engine 420 is further configured to: extract the core feature combination of the anomaly detection result; generate a pattern fingerprint based on the core feature combination; determine that the anomaly detection result does not conform to known pattern characteristics when no known pattern fingerprint matching the pattern fingerprint is found in the preset rule knowledge base; correspondingly, the rule conversion engine 420 is further configured to: obtain historical detection results of supply chain business flow data when the anomaly detection result does not conform to known pattern characteristics; and obtain suggested actions and verification sets matching the pattern fingerprint when the frequency of the pattern fingerprint in the historical detection results exceeds a preset number of times within a preset time period, and convert the anomaly detection result, suggested actions, and verification sets into a structured rule proposal data package.

[0220] In one embodiment, the rule proposal data packet is converted into an executable candidate compliance rule. The rule conversion engine 420 is further configured to: parse the rule proposal data packet to obtain a parsing result; the parsing result includes key entities, key attributes, and constraints; match the corresponding logical framework from a pre-set rule logic template library according to the type of key entities; fill the constraints and key attributes into the logical framework to obtain a logical filling framework; and instantiate the logical filling framework into an executable candidate compliance rule.

[0221] In one embodiment, the execution results include rule trigger logs and action simulation logs. Based on the execution results, the candidate compliance rules are evaluated for effectiveness, and an effectiveness evaluation result is obtained. The rule evaluation module 440 is further configured to: determine the adoption status of each suggested action in the rule trigger log based on the action simulation log; determine the trigger accuracy of the candidate compliance rule based on the adoption status of each of the multiple suggested actions in the rule trigger log; perform logical conflict detection between the candidate compliance rule and the preset production rule library to obtain conflict detection results; determine the conflict coefficient of the candidate compliance rule based on the conflict detection results; and determine the effectiveness evaluation result based on the trigger accuracy and the conflict coefficient.

[0222] In one embodiment, the validity assessment result is determined based on the trigger accuracy and the conflict coefficient. The rule assessment module 440 is further configured to: determine the validity assessment result as valid for the candidate compliance rule if the trigger accuracy is greater than the accuracy threshold and the conflict coefficient is greater than the conflict coefficient threshold.

[0223] Each module in the aforementioned supply chain risk identification system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0224] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a supply chain risk identification method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0225] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0226] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0227] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0228] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0229] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0230] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0231] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0232] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A supply chain risk identification method, characterized in that, The method includes: Anomaly detection results are obtained by using a pre-trained anomaly detection model to detect anomalies in supply chain business flow data. If the anomaly detection result does not conform to known pattern characteristics, the anomaly detection result is transformed into an executable candidate compliance rule. The candidate compliance rule is a rule used to regulate the behavior of the supply chain business flow data and prevent data risks. The candidate compliance rules are loaded into the sandbox environment to obtain the execution results; Based on the operational results, the effectiveness of the candidate compliance rules is evaluated to obtain the effectiveness evaluation results; If the validity evaluation result indicates that the candidate compliance rule is valid, the candidate compliance rule and the pattern feature data of the anomaly detection result are packaged into a training feedback package, and the anomaly detection model is incrementally trained according to the training feedback package to obtain the trained anomaly detection model. The step of incrementally training the anomaly detection model based on the training feedback package to obtain the trained anomaly detection model includes: The pattern feature data of the anomaly detection results are used as training samples and input into the anomaly detection model. The candidate compliance rules are used as training constraint boundaries to update the model parameters of the anomaly detection model until a preset stopping condition is met, thus obtaining the trained anomaly detection model. When the anomaly detection result does not conform to known pattern characteristics, converting the anomaly detection result into an executable candidate compliance rule includes: If the anomaly detection result does not conform to the known pattern characteristics, the anomaly detection result is subjected to structured processing to obtain a structured rule proposal data packet, which contains conditions and actions described in natural language. The rule proposal data package is converted into executable candidate compliance rules using a preset scripting language.

2. The method according to claim 1, characterized in that, Before performing structured processing on the anomaly detection results to obtain a structured rule proposal data packet when the anomaly detection results do not conform to known pattern characteristics, the method further includes: Extract the core feature combination of the anomaly detection results; Based on the combination of the core features, a pattern fingerprint is generated; If no known pattern fingerprint matching the pattern fingerprint is found in the preset rule knowledge base, it is determined that the anomaly detection result does not conform to the known pattern characteristics. Accordingly, when the anomaly detection result does not conform to known pattern characteristics, the anomaly detection result is subjected to structured processing to obtain a structured rule proposal data packet, including: If the anomaly detection result does not conform to known pattern characteristics, obtain the historical detection results of the supply chain business flow data; If the pattern fingerprint appears more frequently than a preset number of times within a preset time period in the historical detection results, a suggested action and a verification set matching the pattern fingerprint are obtained, and the anomaly detection results, the suggested action, and the verification set are converted into a structured rule proposal data package.

3. The method according to claim 2, characterized in that, When no known pattern fingerprint matching the pattern fingerprint is found in the preset rule knowledge base, determining that the anomaly detection result does not conform to known pattern characteristics includes: If the similarity calculation results between all known pattern fingerprints in the preset rule knowledge base and the pattern fingerprint of the anomaly detection result are all less than the preset similarity, and the frequency of the anomaly detection result occurring within the preset time window exceeds the preset frequency, then it is determined that the anomaly detection result does not conform to the known pattern features.

4. The method according to claim 1, characterized in that, The step of using a preset scripting language to convert the rule proposal data package into executable candidate compliance rules includes: The rule proposal data packet is parsed to obtain the parsing result; the parsing result includes key entities, key attributes, and constraints. Based on the type of the key entity, the corresponding logical framework is matched from the pre-set rule logic template library; The constraints and key attributes are filled into the logical framework to obtain the logical filling framework; Instantiate the logic-filling framework into executable candidate compliance rules.

5. The method according to claim 1, characterized in that, The execution results include rule trigger logs and action simulation logs; based on the execution results, the candidate compliance rules are evaluated for effectiveness to obtain effectiveness evaluation results, including: For each suggested action in the rule trigger log, the adoption status of the suggested action is determined based on the action simulation log; The triggering accuracy of the candidate compliance rule is determined based on the adoption status of each of the suggested actions in the rule triggering log. The candidate compliance rules are logically conflict-detected with the preset production rule base to obtain the conflict detection results. Based on the conflict detection results, the conflict coefficient of the candidate compliance rule is determined; The effectiveness evaluation result is determined based on the trigger accuracy and the conflict coefficient.

6. The method according to claim 5, characterized in that, The determination of the effectiveness evaluation result based on the trigger accuracy and the conflict coefficient includes: If the trigger accuracy is greater than the accuracy threshold and the conflict coefficient is greater than the conflict coefficient threshold, the validity assessment result is determined to be valid for the candidate compliance rule.

7. A supply chain risk identification system, characterized in that, The system includes: An anomaly detection engine is used to detect anomalies in supply chain business flow data using a pre-trained anomaly detection model and obtain anomaly detection results. The rule conversion engine is used to convert the anomaly detection result into an executable candidate compliance rule when the anomaly detection result does not conform to the known pattern characteristics. The candidate compliance rule is a rule used to regulate the behavior of the supply chain business flow data and prevent data risks. The sandbox management engine is used to load the candidate compliance rules into the sandbox environment and obtain the running results; The rule evaluation module is used to evaluate the effectiveness of the candidate compliance rules based on the running results, and obtain the effectiveness evaluation results; The model feedback training module is used to package the candidate compliance rule and the pattern feature data of the anomaly detection result into a training feedback package when the validity evaluation result indicates that the candidate compliance rule is valid, and to perform incremental training on the anomaly detection model based on the training feedback package to obtain the trained anomaly detection model. The model feedback training module is also used to input the pattern feature data of the anomaly detection result as training samples into the anomaly detection model, and use the candidate compliance rules as training constraint boundaries to update the model parameters of the anomaly detection model until a preset stopping condition is met, so as to obtain the trained anomaly detection model. The rule conversion engine is also used to perform structured processing on the anomaly detection results when the anomaly detection results do not conform to known pattern characteristics, to obtain a structured rule proposal data package, wherein the rule proposal data package contains conditions and actions described in natural language; and to convert the rule proposal data package into executable candidate compliance rules using a preset scripting language.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images