Risk early warning method, device and equipment and storage medium

Abstract

The application relates to the technical field of risk monitoring, and discloses a risk early warning method, device and equipment and a storage medium, which comprises the following steps: standardizing enterprise operation time sequence data of a target enterprise collected by the application, and generating a time sequence sequence in a preset format; inputting the time sequence sequence into an improved time sequence coding model, and outputting a deep time sequence feature vector of the target enterprise; predicting an operation characteristic value of the target enterprise according to the deep time sequence feature vector, determining a residual error between the operation characteristic value and an actual operation characteristic value, and obtaining a residual error anomaly score; generating a total risk score based on an attention weight and the residual error anomaly score, and performing risk early warning on the target enterprise according to the total risk score. The position coding based on the real time interval calculation of adjacent time steps is introduced to replace the traditional fixed position coding, so that the time sequence coding model can accurately perceive the uneven time interval characteristics caused by different collection granularities, and the timeliness and accuracy of risk early warning are significantly improved.

Description

Technical Field

[0001] This application relates to the field of risk monitoring technology, and in particular to a risk early warning method, device, equipment and storage medium. Background Technology

[0002] Currently, the operational risks of small and medium-sized enterprises (SMEs) are characterized by gradual deterioration and sudden outbreaks. Traditional risk early warning methods rely on static financial data, which cannot capture the temporal changes in business behavior, resulting in significant lag in early warning. Existing time-series early warning models suffer from the vanishing gradient problem when processing long-term operational data, making it difficult to capture long-distance temporal dependencies. While the ordinary Transformer model can alleviate the gradient vanishing problem, it uses a fixed-position encoding method, which can only represent the order of time steps. It cannot truly reflect the time series characteristics of uneven time intervals between adjacent time steps caused by different collection granularities in enterprise operating data. This leads to the distortion of the model's modeling of time series patterns, making it difficult to distinguish between normal fluctuations and gradual risk trends. Minor gradual anomalies are masked by normal fluctuation noise, making it impossible to achieve effective early risk warning. Summary of the Invention

[0003] The main purpose of this application is to provide a risk warning method, device, equipment and storage medium, which aims to solve the technical problem that existing models cannot truly reflect the time series characteristics of uneven time intervals between adjacent time steps caused by different collection granularities in enterprise operating data, and thus cannot achieve effective early risk warning.

[0004] To achieve the above objectives, this application proposes a risk warning method, which includes: The collected time-series data on the business operations of the target companies are standardized to generate time-series sequences in a preset format; The time series sequence is input into the improved time series coding model, and the deep time series representation vector of the target enterprise is output. The position coding in the time series coding model is calculated based on the real time interval between adjacent time steps in the time series sequence. The self-attention mechanism of the time series coding model introduces an operational feature weight matrix to adjust the attention weight of different operational features. Based on the deep temporal representation vector, predict the operating characteristic value of the target enterprise, determine the residual between the operating characteristic value and the actual operating characteristic value, and obtain the residual abnormal score; A total risk score is generated based on the attention weight and the residual abnormal score, and a risk warning is issued to the target enterprise based on the total risk score.

[0005] Optionally, the step of inputting the time series sequence into the improved time series coding model and outputting the deep time series representation vector of the target enterprise includes: The time interval position code is determined based on the actual time interval between each adjacent time step in the time sequence. The time interval position code is superimposed with the original feature vector of the time sequence to obtain the input representation of the fused time interval information; The input representation is fed into the multi-head self-attention layer of the temporal coding model to obtain the self-attention output; The self-attention output is subjected to layer normalization and residual connection, and after multi-layer stacking encoding, the deep temporal representation vector of the target enterprise is output.

[0006] Optionally, determining the time interval position code based on the actual time interval between adjacent time steps in the time series includes: Determine the actual time interval between each time step in the time series and the previous adjacent time step; Based on the actual time interval, the model feature dimension and encoding dimension index of the time-series coding model, the corresponding time interval position encoding values ​​are generated by using sine and cosine functions respectively; The time interval position code is obtained by combining the time interval position code values ​​of each dimension.

[0007] Optionally, the step of inputting the input representation into the multi-head self-attention layer of the temporal coding model to obtain the self-attention output includes: The input representation based on the fusion time interval information generates a query matrix, a key matrix, and a value matrix through linear projection; Determine the initial attention score matrix based on the query matrix and the key matrix; The initial attention score matrix is ​​multiplied element-wise with the business feature weight matrix to obtain the differentiated attention score matrix. The weight values ​​of each business feature in the business feature weight matrix are set differently based on prior business knowledge. The differentiated attention score matrix is ​​normalized, and the normalized attention weight matrix is ​​weighted and summed with the value matrix to obtain the self-attention output.

[0008] Optionally, the step of predicting the operating characteristic value of the target enterprise based on the deep time-series representation vector, and determining the residual between the operating characteristic value and the actual operating characteristic value to obtain a residual abnormality score includes: Based on the deep temporal representation vector, the operational feature value for the next time step is generated through the prediction head network; The time-series residual is obtained based on the deviation between the operating characteristic value and the actual operating characteristic value corresponding to the next time moment; A sliding window is set based on a rolling update mechanism. The time-series residual sequence is traversed to obtain the statistical characteristics of the time-series residuals within each sliding window, and residual abnormal scores are constructed based on the statistical characteristics.

[0009] Optionally, the step of setting a sliding window based on a rolling update mechanism, traversing the time-series residual sequence, obtaining the statistical characteristics of the time-series residuals within each sliding window, and constructing a residual abnormality score based on the statistical characteristics includes: The sliding window moves sequentially over the time-series residual sequence according to a preset sliding step size to obtain the residual subsequence within each sliding window, wherein the sliding window contains a preset number of continuous time steps. Statistical calculations are performed on the residual subsequences within each sliding window to obtain the residual mean, residual standard deviation, and mutation magnitude corresponding to the sliding window. The mean of the residuals, the standard deviation of the residuals, and the magnitude of the abrupt change are respectively weighted and summed with preset first weighting coefficients, second weighting coefficients, and third weighting coefficients to obtain the window anomaly score of the sliding window; The window anomaly scores of each sliding window are combined in chronological order to obtain the residual anomaly score.

[0010] Optionally, the step of generating a total risk score based on the attention weight and the residual abnormal score, and issuing a risk warning to the target enterprise based on the total risk score, includes: Extract the attention weight matrix corresponding to each business feature dimension from the coding layer of the time-series coding model, and determine the maximum attention weight of the attention weight matrix; Based on a preset fusion ratio coefficient, the residual abnormal score and the maximum attention weight are fused to generate a total risk score; The total risk score is compared with a preset risk level threshold, and the risk level of the target enterprise is determined based on the comparison result. When the risk level meets the warning triggering conditions, structured warning information is output. The structured warning information includes the risk level, the abnormal feature type corresponding to the maximum value of the attention weight, the number of sliding windows for the abnormality to persist, and the maximum residual mutation amplitude.

[0011] Furthermore, to achieve the above objectives, this application also proposes a risk warning device, which includes: The processing module is used to standardize the collected time-series data of the target enterprise's operations and generate a time-series sequence in a preset format. The output module is used to input the time series sequence into the improved time series coding model and output the deep time series representation vector of the target enterprise. The position coding in the time series coding model is calculated based on the real time interval between adjacent time steps in the time series. The self-attention mechanism of the time series coding model introduces an operational feature weight matrix to adjust the attention weight of different operational features. The determination module is used to predict the operating characteristic value of the target enterprise based on the deep time series representation vector, and determine the residual between the operating characteristic value and the actual operating characteristic value to obtain the residual abnormal score; The early warning module is used to generate a total risk score based on the attention weight and the residual abnormal score, and to issue a risk warning to the target enterprise based on the total risk score.

[0012] In addition, to achieve the above objectives, this application also proposes a risk warning device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the risk warning method as described above.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the risk warning method described above.

[0014] This application introduces positional coding based on the actual time interval between adjacent time steps to replace the fixed positional coding of the traditional Transformer. This enables the time-series coding model to accurately perceive the uneven time interval characteristics caused by different collection granularities in enterprise operating data, solving the problem of distortion in time-series pattern modeling caused by ignoring the actual time interval in traditional models. At the same time, the self-attention mechanism is differentiated by combining the weight matrix of operating features, enabling the model to prioritize the preset core risk features during the coding process. This overcomes the shortcomings of general models that treat all features indiscriminately and are insensitive to small gradual anomalies, thereby achieving early and accurate identification of enterprise operating risks and significantly improving the timeliness and accuracy of risk warning. In validation set testing, this application achieved an accuracy of 89.2% (68.3% for LSTM and 74.8% for a standard Transformer), an anomaly recall of 86.7%, and a false positive rate of 7.3% (a significant decrease from LSTM's 26.8%). The F1 score reached 0.879, balancing accuracy and recall. Particularly noteworthy is its 87% accuracy in identifying the slow deterioration of 3% to 5% per month, a problem difficult to address with traditional methods. This successfully solves the challenge of identifying gradual deterioration and sudden anomalies for SMEs, providing users with more time for risk intervention. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the first embodiment of the risk warning method of this application; Figure 2 This is a logical relationship diagram of the risk warning method in this application; Figure 3 This is a flowchart illustrating the second embodiment of the risk warning method of this application; Figure 4 This is a flowchart illustrating the third embodiment of the risk warning method of this application; Figure 5 This is a flowchart illustrating the fourth embodiment of the risk warning method of this application; Figure 6 This is a simplified flowchart illustrating the risk warning method of this application; Figure 7 This is a schematic diagram of the module structure of the risk warning device according to an embodiment of this application; Figure 8 This is a schematic diagram of the device structure of the hardware operating environment involved in the risk warning method in the embodiments of this application.

[0018] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0020] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0021] Small and medium-sized enterprises (SMEs) have small business scale and weak risk resistance, and their business risks are characterized by "gradual deterioration and sudden outbreak." In addition, their business data is scattered and unstandardized, and traditional risk warning methods have many shortcomings, as follows: Static data reliance: Traditional early warning methods rely heavily on static data such as annual financial statements and static credit ratings, which cannot capture the temporal changes in a company's operations. This results in delayed early warnings, and by the time financial data has deteriorated significantly, financial institutions are already facing the risk of large amounts of non-performing loans.

[0022] Insufficient model adaptability: Existing time-series early warning models are prone to gradient vanishing and insufficient long-distance dependency capture when processing long-cycle business time-series data, and cannot accurately identify "gradual anomalies"; ordinary Transformer models are not adapted to the "non-uniform time interval" characteristics of enterprise business data, and are not sensitive to "small behavioral shifts", which are easily masked by normal fluctuation noise, resulting in delayed early warnings or false alarms.

[0023] Lack of interpretability: Most existing models are "black box" predictions, which cannot clearly identify the source of risk and are difficult to meet the requirements of credit approval intervention and financial regulatory compliance.

[0024] General technology incompatibility: Existing related technologies are only applied to the field of general time series forecasting and do not involve enterprise business risk early warning scenarios, and cannot solve the problems of "identifying minor gradual anomalies" and "risk interpretability output".

[0025] This application relates to an early warning system for enterprise operational risks, designed for SMEs and adaptable to multiple business scenarios in the financial industry. Based on time-series Transformer and sliding residual analysis, it can be widely applied to predicting operational risks in financial fields such as corporate lending risk control, consumer finance credit assessment, enterprise credit rating, financing guarantee supervision, and enterprise credit reporting services. Using enterprise operational time-series data as the core, it learns normal operational behavior patterns through an improved time-series Transformer model, captures deviations between actual and normal patterns using sliding residual analysis, and combines time-series attention weights to determine risk levels and provide early warnings. Specifically, it includes collecting multi-dimensional operational time-series data, standardizing it to construct a unified time-series sequence; using an improved time-series Transformer model with added time interval position encoding to learn normal operational time-series patterns; calculating the residuals between predicted and actual values ​​based on a sliding window; capturing abnormal deviations through residual analysis; and integrating attention weights and residual scores to construct a risk assessment model, outputting risk levels and early warning information.

[0026] It should be noted that the executing entity in this embodiment can be a computing service device with risk monitoring, time-series data processing, and program execution functions, such as a computer, or an electronic device capable of performing the above functions. The following description uses a risk warning system as an example to illustrate this embodiment and the subsequent embodiments.

[0027] Based on this, the embodiments of this application provide a risk warning method, referring to Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the risk warning method of this application.

[0028] In this embodiment, the risk warning method includes: Step S10: Standardize the collected time-series data of the target enterprise's operations to generate a time-series sequence in a preset format.

[0029] It should be noted that the operating data of small and medium-sized enterprises (SMEs) typically comes from multiple heterogeneous systems, including bank transaction systems, tax filing systems, accounting systems, and utility payment platforms. These systems naturally differ in their data collection frequency and recording cycles. For example, bank transactions are usually recorded daily, tax returns are generated monthly, and financial statements are prepared quarterly. This results in an uneven distribution of the target company's original operating data across different time granularities.

[0030] It should be understood that standardizing the collected time-series data of the target companies' operations aims to transform the diverse and heterogeneous raw operational data with varying granularities into a structured time-series sequence with a unified format and fixed time step, eliminating interference from differences in data sources on subsequent model coding. If the raw data is directly input into the model, the overlapping of time steps with different time granularities will prevent the model from accurately capturing the true temporal evolution of operational behavior and making it difficult to distinguish between normal fluctuations and abnormal trends.

[0031] It is understandable that standardization processing includes at least three steps: time granularity unification, missing value imputation, and numerical normalization. Time granularity unification refers to aligning raw data from different collection frequencies to the same target time step through interpolation or aggregation. For example, daily data is summarized monthly, and quarterly data is recalculated monthly, ensuring all feature dimensions remain synchronized on the time axis. Missing value imputation addresses situations where some feature data is missing at certain time steps by using temporal interpolation methods based on known data from adjacent time steps to fill in missing data, preventing data gaps from disrupting the continuity of the sequence. Numerical normalization maps operational features with significantly different dimensions and value ranges to a unified numerical interval, eliminating the unbalanced impact of differences in feature magnitudes on model gradient updates and feature weight allocation.

[0032] Understandably, the pre-formatted time series generated after standardization is a structured time series tensor with the target enterprise as the granularity, fixed time steps as the sequence index, and multi-dimensional business characteristics as the feature dimensions. Each row of this time series tensor corresponds to a time step, and each column corresponds to a standardized business characteristic. There is a definite real time interval between adjacent time steps, which provides an accurate input basis for subsequent positional encoding based on real time intervals.

[0033] In one example, the collected multi-dimensional operational time-series data for SMEs can cover bank transaction time-series (such as transaction amounts, frequency, and cash collection cycles), financial indicator time-series (such as operating revenue, net profit, and debt-to-asset ratio), operational behavior time-series (such as tax payments, utility bill payments, and payroll), credit and debt time-series (such as loan balances, guarantee balances, and default records), and external correlation time-series (such as industry prosperity and regional economic indicators). Data standardization can include: unifying the time granularity to interpolate data from different periods to a fixed time step; using time-series interpolation to fill in missing data; normalization processing, using Min-Max normalization to eliminate the influence of units; and sequence construction to obtain data organized by enterprise. A time-series tensor in the format, where, Indicates a time step. Representing features, such as collecting 18 months of data and standardizing them. The tensor represents 18 months × 15 features.

[0034] Step S20: Input the time series sequence into the improved time series coding model and output the deep time series representation vector of the target enterprise. The position coding in the time series coding model is calculated based on the real time interval between adjacent time steps in the time series. The self-attention mechanism of the time series coding model introduces an operational feature weight matrix to adjust the attention weight of different operational features.

[0035] It should be noted that... The improved time-series coding model, based on a time-series input format, aims to extract deep time-series representation vectors containing patterns and dependencies in business operations from raw operational time-series data through an encoder. This provides an information foundation for subsequent prediction of normal operating characteristics and residual analysis. The improved time-series coding model is based on the Transformer encoder architecture, but incorporates two key improvements to address the uneven temporal granularity of operational time-series data and the significant differences in the importance of risk features.

[0036] It should be understood that in traditional Transformer models, positional encoding uses a fixed encoding method based on sequential indexing, which can only represent the order of time steps and cannot reflect the true time interval between adjacent time steps due to different data collection cycles. However, time steps in enterprise operational time series data are not uniformly distributed. For example, bank transaction data is recorded daily, tax data is generated monthly, and financial statements are compiled quarterly. The interval between adjacent time steps may be 1 day, 30 days, or 90 days. In this embodiment, the positional encoding of the time series encoding model is calculated based on the true time interval between adjacent time steps in the time series sequence, and the true time interval is mapped to a continuous vector that matches the model's feature dimensions. The encoded value generated in this way can inherently reflect the proximity of time intervals, allowing the model to perceive the essential difference in time series dependency between "monthly tax data with a 30-day interval" and "daily transaction data with a 1-day interval" during the encoding stage, thereby avoiding distortion in time series pattern modeling caused by ignoring time intervals.

[0037] It is understandable that enterprise operational time-series data contains multiple dimensions of operational characteristics, and the contribution of different characteristics to risk warning varies significantly. For example, bank transaction history and tax payment characteristics are far more indicative of operational anomalies than general operational behavior characteristics. The traditional Transformer's self-attention mechanism treats all features indiscriminately when calculating the correlation between features, easily diluting the key information of core risk features. This embodiment introduces an operational feature weight matrix into the self-attention mechanism. This weight matrix is ​​multiplied element-wise with the initial attention score matrix, applying a positive adjustment to the attention scores corresponding to the preset core risk features. This allows the model to prioritize features highly correlated with operational risk, such as bank transactions and tax payments, during the encoding process, suppressing interference from non-critical features. The values ​​of this operational feature weight matrix can be initially set by risk control business experience and jointly optimized with the target task through gradient backpropagation during model training to achieve adaptive feature importance allocation.

[0038] It is understandable that after the time series is input into the improved time series coding model, the positional encoding based on the real time interval is first superimposed with the original feature vector to form an input representation that integrates the time interval information. Then, it is processed by a multi-head self-attention layer containing the operational feature weight matrix for feature interaction and importance weighting. After multi-layer stacked coding processing of layer normalization and feedforward network, the final output deep time series representation vector has integrated the information of non-uniform time interval perception and risk feature differentiation. It can accurately depict the time series behavior pattern of the target enterprise under normal operating conditions, laying an accurate foundation for subsequent prediction and residual analysis.

[0039] Step S30: Predict the operating characteristic value of the target enterprise based on the deep time series representation vector, and determine the residual between the operating characteristic value and the actual operating characteristic value to obtain the residual abnormal score.

[0040] It should be noted that the deep temporal representation vector extracts the temporal behavioral pattern features of the target enterprise under normal operating conditions. By comparing the degree of deviation between the predicted value and the actual observed value, the abnormal changes in the enterprise's business behavior are quantified into measurable residual abnormality scores, providing a quantitative basis for measuring the degree of abnormality in subsequent risk fusion judgment.

[0041] It should be understood that predicting operational feature values ​​based on deep temporal representation vectors is specifically achieved through a prediction head network connected after the temporal coding model. The prediction head network takes the deep temporal representation vector as input and, through structures such as fully connected layers or linear mappings, decodes the high-dimensional temporal feature representations back to the predicted operational feature values ​​corresponding to the original operational feature dimensions. These predicted values ​​represent the theoretically expected levels of various operational features in the next time step, assuming the target company continues its normal operating model.

[0042] It's important to note that determining the residual between the operating characteristic value and the actual operating characteristic value refers to calculating the deviation along each feature dimension between the predicted operating characteristic value generated by the prediction head network and the actual operating characteristic value observed by the target company at the same time step. When the target company's operating behavior remains normal, the deviation between the actual and predicted values ​​is small, and the residual remains at a low level. However, when the operating behavior deviates abnormally, a significant deviation will occur between the actual and predicted values, and the residual will increase accordingly. Therefore, the magnitude of the residual directly reflects the degree to which the target company's operating behavior deviates from the normal pattern.

[0043] Step S40: Generate a total risk score based on the attention weight and the residual abnormal score, and issue a risk warning to the target enterprise based on the total risk score.

[0044] It should be noted that the residual anomaly score measures the degree of abnormality in the target company's business behavior deviating from the normal pattern. The improved temporal coding model simultaneously generates attention weights reflecting the importance of each business characteristic during the generation of deep temporal representation vectors. By organically integrating the two, the residual anomaly score is used to quantify the magnitude of risk on the one hand, and the attention weights are used to locate the source of risk on the other. This generates a total risk score that combines quantitative accuracy and business interpretability, and based on this score, tiered early warnings are implemented for the target company.

[0045] In one example, reference Figure 2 , Figure 2This is a logical diagram of the risk warning method in this application. It captures the dynamic evolution of enterprise operating data through time-interval-aware time-series coding, and combines residual analysis and feature attribution to generate interpretable risk decisions. The specific process is as follows: First, multi-dimensional operational data collection serves as the system's input, comprehensively gathering enterprises' bank statements, financial indicators, tax records, and credit data to construct a panoramic data view covering cash flow, operating efficiency, and credit history.

[0046] Secondly, the system moves to the time interval location encoding stage. Addressing the issue of traditional models neglecting the non-uniformity of sampling intervals, the system extracts the true time intervals (such as monthly, quarterly, or event-driven intervals) between adjacent time steps in the time series and transforms them into vector representations with periodicity and scale adaptability. This encoding, superimposed on the original features, forms the input representation of the fused time interval, ensuring the model can accurately perceive the impact of "data gap periods" on operational status.

[0047] Subsequently, the fused representation is input into the improved temporal Transformer encoding layer. This module employs a multi-head self-attention mechanism, which not only captures the dependencies between global time steps but also dynamically strengthens the focus on key risk control dimensions such as bank statements and tax payments by injecting a weight matrix of prior business characteristics. The encoded output is a deep temporal representation vector, and the system simultaneously extracts the attention weight matrix to locate the core driving features that trigger risk warnings. In the prediction and residual analysis phase, the deep representation vector is used by the prediction head network to deduce the normal operating baseline value for the next time step. The deviation between this baseline value and the actual value constitutes a temporal residual sequence. The system then initiates a sliding window mechanism, traversing the residual sequence and calculating the statistical characteristics within each window: including the residual mean reflecting overall fluctuations, the residual standard deviation characterizing the degree of drastic change, and the residual abrupt change magnitude identifying abrupt change points. These three types of statistics are weighted and fused to generate a residual abnormality score, accurately quantifying the degree to which the enterprise's operations deviate from the normal pattern.

[0048] Finally, the system enters the risk score fusion and early warning output stage. The residual anomaly score and the maximum attention weight extracted by the attention mechanism are dynamically weighted to generate a comprehensive total risk score. This score not only reflects the intensity of the anomaly but also clearly points to the root cause of the risk. Ultimately, the system classifies risk levels according to preset thresholds and outputs structured early warning information, including risk level, anomaly characteristic type, anomaly duration, and maximum mutation magnitude, providing enterprise managers and financial institutions with intelligent decision support that is both accurate and interpretable.

[0049] In this embodiment, by introducing position coding based on the actual time interval between adjacent time steps to replace the fixed position coding of the traditional Transformer, the time-series coding model can accurately perceive the non-uniform time interval characteristics caused by different collection granularities in enterprise operation data, improve the ability to capture long-term data over long distances, thereby achieving early and accurate identification of enterprise operation risks and significantly improving the timeliness and accuracy of risk warning.

[0050] Reference Figure 3 , Figure 3 This is a flowchart illustrating the second embodiment of the risk warning method of this application. Based on the first embodiment described above, a second embodiment of the risk warning method of this application is proposed.

[0051] In the second embodiment, step S20 includes: Step S201: Determine the time interval position code based on the actual time interval between each adjacent time step in the time sequence.

[0052] It should be noted that in enterprise operational time-series data, the actual time intervals between adjacent time steps exhibit significant unevenness. For example, when the target time step is uniformly set to monthly granularity, the actual interval between a time step aggregated from daily bank transaction data and its preceding time step is 30 or 31 days; the interval between time steps directly sampled from monthly tax data is 1 month; and the interval between time steps calculated from quarterly financial statement interpolation may include interval differences spanning the end of the quarter. Traditional fixed-position coding assigns the same interval code based on integer sequence numbers to each time step, failing to distinguish the temporal density characteristics of the data from the aforementioned different sources. This causes the model to treat time steps with 1-day and 90-day intervals as equidistant, resulting in distortion in the modeling of time-series dependencies.

[0053] Optionally, to address the differences in time granularity across different business scenarios, the actual time interval can be normalized before participating in the location encoding calculation. For example, the actual time interval can be divided by a preset maximum reference time interval to control the numerical range of the encoded value and enhance the numerical stability of the model training.

[0054] In the specific implementation process, the true time interval between adjacent time steps can be encoded into a continuous vector matching the model dimension using sine and cosine functions. This enables the model to distinguish the temporal information differences between daily granular data, monthly granular data, and other sampling periods, solving the modeling distortion problem caused by traditional fixed-position encoding, which can only represent sequential relationships but cannot reflect time intervals. Step S201 may include: Determine the actual time interval between each time step in the time series and the previous adjacent time step; Based on the actual time interval, the model feature dimension and encoding dimension index of the time-series coding model, the corresponding time interval position encoding values ​​are generated by using sine and cosine functions respectively; The time interval position code is obtained by combining the time interval position code values ​​of each dimension.

[0055] It should be noted that the actual time interval This refers to the difference in the actual number of days or other physical time units between adjacent time steps, which are pre-recorded in the metadata of the time series. For example, when bank transaction data is aggregated from daily to monthly, the difference in the number of days in a calendar month between adjacent time steps may be 28, 30, or 31 days; tax data is naturally collected monthly, and the interval between adjacent time steps is one calendar month; while when quarterly financial statements are converted to monthly, each month within the same quarter corresponds to a different interval conversion relationship.

[0056] Understandably, this is based on actual time intervals. Model feature dimensions and encoding dimension index The corresponding time interval position encoding values ​​are generated using sine and cosine functions, respectively. This can be seen as mapping a one-dimensional time interval scalar to a high-dimensional continuous vector that matches the model's embedding space dimension. For each encoding dimension index at each time step, the encoding value is calculated using a sine function when the dimension index is even and a cosine function when the dimension index is odd. The independent variable of the encoding value consists of the true time interval and a scaling factor. This scaling factor is jointly determined by the model feature dimension and the current encoding dimension index, ensuring that the encoding values ​​corresponding to lower-dimensional indices change less frequently and tend to capture long-period time dependencies, while the encoding values ​​corresponding to higher-dimensional indices change more frequently and tend to capture short-period time dependencies. In this way, the same true time interval produces response values ​​with different frequencies on different encoding dimensions, enabling the position encoding vector to represent the physical meaning of time intervals at multiple scales as a whole.

[0057] Specifically, the time interval location code is calculated by combining the actual time interval, as shown in the following formula:

[0058]

[0059] in, The actual number of days between adjacent time steps is adapted to uneven time granularities such as "daily transaction volume" and "monthly tax payment". This refers to the feature dimension of the model, such as the hidden layer dimension of the Transformer. The encoding dimension index represents the i-th dimension of the position encoding; This represents the position encoding value at the t-th time step and in the 2i-th dimension. This represents the position encoding value of the (2i+1)th dimension at the t-th time step.

[0060] Optionally, if a certain time step in the time sequence is the starting step of the sequence and there is no preceding adjacent time step, the actual time interval of that time step can be set to zero or set to the default value of the preset target time step.

[0061] It is understandable that by combining the time interval position encoding values ​​of each dimension according to the dimension index order, a time interval position encoding vector with the same dimension as the model embedding dimension is obtained. This vector is fundamentally different from traditional fixed position encoding: traditional fixed position encoding only encodes the sequential information of "step 1, step 2, step 3", and the difference in encoding between adjacent steps depends only on the difference in step order, which cannot reflect the real physical time interval; while the time interval position encoding generated in this embodiment shows that the difference in encoding between adjacent steps is proportional to the real time interval. The larger the time interval, the greater the encoding difference, and the smaller the time interval, the smaller the encoding difference. This allows the model to accurately perceive the essential difference in the temporal evolution of "monthly tax data with an interval of 30 days" and "daily transaction data with an interval of 1 day" in subsequent self-attention calculations.

[0062] Step S202: The time interval position code is superimposed with the original feature vector of the time sequence to obtain the input representation of the fused time interval information.

[0063] It should be understood that the time interval location encoding vector contains the actual physical time interval information between adjacent time steps, while the original feature vector of the time series carries the specific numerical information of each business feature at each time step. Superimposing and fusing the two in the vector space ensures that the representation vector input to the subsequent encoding layer contains not only the values ​​of the business features themselves, but also the temporal context information of the time interval at which these feature values ​​were observed. This provides a complete input foundation for the time series coding model to accurately capture the business evolution patterns under non-uniform time granularity.

[0064] Understandably, the original feature vector of a time series is a vector representation of the multi-dimensional operational feature values ​​corresponding to each time step in the structured time series tensor obtained after standardization. Its dimension matches the number of operational features. Before being input into the time series coding model, an embedding layer is typically needed to map each feature value to an embedding space that matches the model's feature dimensions, obtaining the original feature vector for each time step. This original feature vector can express the relative values ​​and relationships of various operational indicators at the current time step, but it cannot reflect the temporal density between the current time step and the preceding and following time steps.

[0065] Specifically, the time interval position encoding can be superimposed on the original feature vector by adding it element by element. For example... + ,in , represents the original feature vector at time step t. , is the position code for the t-th time step. This serves as the input representation for the fusion time interval information.

[0066] Optionally, the superposition of the time interval position encoding and the original feature vector can also adopt a weighted summation method, and the contribution ratio of the time interval information to the original feature information in the input representation can be controlled by a preset fusion weight coefficient.

[0067] Step S203: Input the input representation into the multi-head self-attention layer of the temporal coding model to obtain the self-attention output.

[0068] It's important to note that the multi-head self-attention layer is a core component of the temporal coding model. Its basic operational logic involves generating a query matrix, key matrix, and value matrix through linear projection of the input representation. The dot product of the query matrix and key matrix is ​​used to calculate the correlation strength between any two time steps, and this correlation strength is then used as a weight to perform weighted aggregation of the value matrix. Compared to traditional temporal models such as recurrent neural networks, the self-attention mechanism can directly model the dependency between any two positions in the sequence, without being limited by the distance between time steps, effectively overcoming the gradient vanishing problem in long sequence processing.

[0069] In the specific implementation process, the attention score in the self-attention mechanism can be differentiated by introducing an operational feature weight matrix. This allows the model to prioritize core risk features such as bank statements and tax payments during the encoding process, avoiding the dispersion of attention resources by non-critical operational features and improving the model's sensitivity and ability to capture risk-related business behavior patterns. Step S203 at this point may include: The input representation based on the fusion time interval information generates a query matrix, a key matrix, and a value matrix through linear projection; Determine the initial attention score matrix based on the query matrix and the key matrix; The initial attention score matrix is ​​multiplied element-wise with the business feature weight matrix to obtain the differentiated attention score matrix. The weight values ​​of each business feature in the business feature weight matrix are set differently based on prior business knowledge. The differentiated attention score matrix is ​​normalized, and the normalized attention weight matrix is ​​weighted and summed with the value matrix to obtain the self-attention output.

[0070] It should be noted that the query matrix determines what information the current time step hopes to obtain from other time steps, the key matrix determines the type of information that other time steps can provide, and the value matrix is ​​the feature information actually carried by other time steps. The three sets of linear projections can be implemented using three sets of learnable parameter matrices. Each attention head can use an independent set of projection matrices, enabling different attention heads to capture different types of temporal dependencies in parallel within different representation subspaces. For example, some heads may focus on short-term operational fluctuation patterns, while others may capture long-term periodic patterns.

[0071] Understandably, determining the initial attention score matrix based on the query matrix and key matrix allows us to measure the correlation strength between any two time steps in the sequence using dot product operations. Specifically, we multiply the transposes of the query matrix and key matrix to obtain the original attention score matrix, then scale it by the square root of the key vector dimension to prevent the dot product from becoming too large and causing gradient saturation during subsequent normalization. Each element of this initial attention score matrix reflects the original correlation strength between the corresponding pair of time steps, but at this point, the contributions of all operational feature dimensions to the attention score are treated indiscriminately, without incorporating prior knowledge of the differences in importance among different operational features.

[0072] It should be understood that in the weight matrix of operational features, the weight values ​​of each position corresponding to each operational feature are set differently based on the prior business knowledge in the field of financial risk control. After element-wise multiplication, the attention score of the position corresponding to the core risk feature is positively amplified, while the attention score of the position corresponding to the non-critical feature is relatively suppressed. Thus, in the attention aggregation stage, the model is guided to focus more information capacity on the feature dimensions that are highly related to operational risk.

[0073] It is understandable that by weighting and summing the normalized attention weight matrix and the value matrix, the output of each time step is the attention weighted combination of the value vectors of all time steps. The time step with the larger attention weight contributes more to the output. The resulting self-attention output not only aggregates the global context in the time dimension, but also achieves differentiated attention to the core risk features in the feature dimension.

[0074] In one example, the input representation based on the fused time interval information generates a query matrix through linear projection. Key matrix Sum matrix ,as follows: in, , and These are the learnable projection matrices.

[0075] By introducing operational characteristic weighting factors, the attention weight matrix can be calculated as follows:

[0076] in, The weight matrix for operational characteristics is jointly optimized by business experience and model training; This represents the dimension of each attention head. For the number of attention heads. This is the normalized attention weight matrix as the output. (The sentence is incomplete and requires further context.) With the value matrix The self-attention output is obtained by performing a weighted summation. .

[0077] Step S204: Perform layer normalization and residual connection on the self-attention output, and output the deep temporal representation vector of the target enterprise after multi-layer stacked encoding.

[0078] It should be noted that the self-attention output has completed the aggregation of temporal global context and feature differentiation attention, but the expressive power of a single-layer self-attention mechanism is limited. The complex nonlinear temporal patterns and deep feature interactions in business operations need to be fully extracted through the stacking of multi-layer coding structures and layer-by-layer abstraction.

[0079] Specifically, in each coding layer, the output of the previous coding layer is first received as the input representation of this layer. This input representation is then fed into a multi-head self-attention layer to obtain the self-attention output. Next, the self-attention output is residually concatenated with the original input representation of this layer, i.e., element-wise addition is performed, so that the global interaction information extracted by self-attention complements the untransformed original input information. Then, layer normalization is performed on the result after residual concatenation to obtain a normalized intermediate representation. Subsequently, this intermediate representation is fed into a feedforward network layer for nonlinear transformation and feature space mapping. The output of the feedforward network layer is again added to the intermediate representation of this layer through residual concatenation, and then undergoes a second layer normalization process to obtain the final output of this coding layer. The above process constitutes the complete computation flow of a single coding layer.

[0080] It is understood that multi-layer stacked encoding refers to repeatedly concatenating the computation process of a single encoding layer multiple times, with the output of the previous encoding layer directly serving as the input of the next encoding layer. After multi-layer stacked encoding, the output of the last encoding layer is the deep temporal representation vector of the target enterprise. In this embodiment, the multi-layer stacked encoding layer structure can refer to the Transformer model, but this embodiment is not limited thereto.

[0081] In this embodiment, the improved temporal Transformer model adapts to the uneven time interval characteristics of enterprise operating data. By superimposing and fusing time interval position encoding with the original feature vector, the model can perceive the uneven time interval information in the time series data, accurately capture the temporal dependencies at uneven time granularity, improve the ability to capture long-distance dependencies in long-cycle data, and solve the problem of distortion in modeling financial time series data by general models. This enhances the ability to capture long-distance dependencies in long-cycle data.

[0082] Reference Figure 4 , Figure 4 This is a flowchart illustrating the third embodiment of the risk warning method of this application. Based on the first embodiment described above, a third embodiment of the risk warning method of this application is proposed.

[0083] In the third embodiment, step S30 includes: Step S301: Based on the deep temporal representation vector, generate the operating feature value for the next time step through the prediction head network.

[0084] Step S302: Obtain the time-series residual based on the deviation between the operating characteristic value and the actual operating characteristic value corresponding to the next time moment.

[0085] It should be noted that the input to the prediction head network is a deep time-series representation vector, and the output is a vector of predicted values ​​corresponding to each of the standardized business feature dimensions. Each element in this predicted value vector represents the expected level of a certain business feature that the target company should achieve at the next time step under the assumption of continued normal operation. For example, the element corresponding to bank statements represents the predicted amount of the company's revenue for the next month, the element corresponding to tax features represents the predicted amount of tax payable by the company in the next period, and the element corresponding to the debt-to-equity ratio represents the predicted ratio of the debt-to-equity ratio for the next quarter.

[0086] Specifically, in one optional implementation, the prediction head network consists of stacked fully connected layers and activation functions. The deep temporal representation vector is first mapped to an intermediate hidden space via a linear transformation. A non-linear activation function is then used to increase the network's expressive capacity. Finally, an output projection layer maps the hidden space to the business feature dimension space, ultimately generating a prediction output with the same number of dimensions as the original business features. The parameters of this prediction head network are optimized along with the encoder parameters through backpropagation during model training. The loss function considers both the deviation between the predicted and actual values ​​and the accuracy of subsequent risk classification.

[0087] Optionally, the prediction head network can also employ a multilayer perceptron structure, where the representation vectors are compressed in dimension before being input into the deep temporal representation vectors to remove redundant dimensions introduced during the encoding process, and then gradually projected to the target output dimension. Dropout regularization layers can also be added to the prediction head network to prevent the model from overfitting to specific business models in the training set, thereby improving the generalization prediction ability for companies of different industries and sizes. This embodiment does not impose any limitations on this.

[0088] In one example, based on deep temporal representation vectors, the prediction head network encodes the output to predict the normal operation feature value at the next time step. And obtain the actual value at the corresponding time. The residual at each time step within the window is calculated using the L1 norm:

[0089] Understandably, the next-moment operational characteristic value generated by the predictive head network is not the actual operational data of the target company at the next moment, but rather a theoretical prediction under the assumption that "the target company continues to maintain a normal operating model." When the target company's operating behavior is stable and there are no abnormal fluctuations, the deviation between the predicted value and the actual value is small; when the operating behavior deviates adversely, the actual value will deviate significantly from the predicted value, and the resulting deviation is the time-series residual used for anomaly quantification in subsequent steps. Therefore, the accuracy of this predicted value directly determines the sensitivity of residual analysis to anomaly deviations and the false alarm rate. The closer the prediction is to the company's true normal operating trajectory, the more accurately the subsequent residual anomaly score can distinguish between normal fluctuations and real risk signals.

[0090] Step S303: Set a sliding window based on the rolling update mechanism, traverse the time series residual sequence, obtain the statistical characteristics of the time series residuals in each sliding window, and construct residual abnormal scores based on the statistical characteristics.

[0091] It should be noted that single-point residuals are easily affected by normal operational fluctuations, seasonal cyclical changes, or data acquisition noise. Isolated residuals alone are insufficient to reliably distinguish between normal fluctuations and genuine operational anomalies. This embodiment introduces a sliding window mechanism to aggregate single-point residuals into multi-dimensional statistical features within the window. Based on these statistical features, a comprehensive residual anomaly score is constructed, effectively filtering out transient noise interference, amplifying persistent abnormal trends, and enabling sensitive capture of subtle, gradual anomalies.

[0092] It should be noted that setting a sliding window based on a rolling update mechanism means defining a fixed-length observation window on the time-series residual sequence. This window slides forward successively along the time dimension, and each slide extracts a new subsequence of residuals within the window for analysis. The window size determines the number of consecutive time steps participating in a single statistical analysis; for example, it can be set to contain 3 to 6 consecutive time steps.

[0093] It is understood that the statistical characteristics may include the residual mean, residual standard deviation, and abrupt change.

[0094] In the specific implementation process, sliding residual analysis can be used to accurately identify minute deviations and gradual anomalies in enterprise operations, filter out normal fluctuation noise, and reduce the false alarm rate and missed alarm rate of early warnings. Step S303 at this point includes: The sliding window moves sequentially over the time-series residual sequence according to a preset sliding step size to obtain the residual subsequence within each sliding window, wherein the sliding window contains a preset number of continuous time steps. Statistical calculations are performed on the residual subsequences within each sliding window to obtain the residual mean, residual standard deviation, and mutation magnitude corresponding to the sliding window. The mean of the residuals, the standard deviation of the residuals, and the magnitude of the abrupt change are respectively weighted and summed with preset first weighting coefficients, second weighting coefficients, and third weighting coefficients to obtain the window anomaly score of the sliding window; The window anomaly scores of each sliding window are combined in chronological order to obtain the residual anomaly score.

[0095] It should be noted that statistical calculations of the residual subsequence within each sliding window yield the residual mean, residual standard deviation, and abrupt change magnitude. The residual mean is obtained by taking the arithmetic mean of all residual values ​​within the window, reflecting the average strength of the deviation of the enterprise's business behavior from the normal prediction pattern during that window period. The residual standard deviation is obtained by calculating the dispersion of each residual value within the window relative to the residual mean, reflecting the stability of abnormal fluctuations in business operations during that period. A smaller standard deviation indicates that the anomaly is evenly distributed across time steps, while a larger standard deviation indicates that the anomaly is concentrated in individual time steps, exhibiting intermittent characteristics. The abrupt change magnitude is obtained by dividing the difference between the residual at the current time step and the residual at the previous time step by the residual at the previous time step, or by calculating the absolute value of the difference, reflecting the rate of change and the degree of acceleration of deterioration of the residual at the current moment relative to the previous moment.

[0096] In one example, a sliding window is defined as Given a window size of w, calculate the mean, standard deviation, and magnitude of the residuals within the window to construct anomaly scores, as follows:

[0097] in, These are the weighting coefficients. The mean of the residuals, The standard deviation of the residuals. This represents the magnitude of the current residual mutation. A sliding window can use an exponential moving average to mitigate the impact of isolated noise points.

[0098] The formula for calculating the mean residual is as follows:

[0099] The formula for calculating the standard deviation of residuals is as follows:

[0100] The magnitude of the current residual mutation can be calculated as the absolute value of the difference, such as... . This is the residual abnormal score at the t-th time step.

[0101] In this embodiment, the predictive head network generates predicted values ​​of business characteristics and calculates the time-series residuals. Furthermore, based on a sliding window, statistical features are extracted from the residual sequence, and the single-point prediction deviation is transformed into a comprehensive anomaly score of multi-dimensional statistics within the window. This can effectively capture small, gradual shifts in business behavior and overcome the technical deficiency of traditional methods that rely solely on single-point prediction thresholds and cannot identify slowly accumulating anomalies.

[0102] Reference Figure 5 , Figure 5 This is a flowchart illustrating the fourth embodiment of the risk warning method of this application. Based on the first embodiment described above, the fourth embodiment of the risk warning method of this application is proposed.

[0103] In the fourth embodiment, step S40 includes: Step S401: Extract the attention weight matrix corresponding to each business feature dimension from the coding layer of the temporal coding model, and determine the maximum attention weight of the attention weight matrix.

[0104] Step S402: Based on a preset fusion ratio coefficient, the residual abnormal score and the maximum attention weight are fused to generate a total risk score.

[0105] It should be noted that in the multi-head self-attention calculation process, the attention weight matrix obtained after differential adjustment and normalization of the business feature weight matrix records the distribution of attention given to other time steps at the feature interaction level at each time step. In the attention weight matrix, different business feature dimensions correspond to different attention weight magnitudes, reflecting the differentiated emphasis the model assigns to different business features during the encoding stage. This embodiment aims to extract the distribution information of this attention weight from the trained time-series coding model as a quantitative basis for identifying core risk features and explaining risk sources.

[0106] It should be noted that attention weights are typically extracted from the last encoding layer of the temporal coding model. Compared to shallow encoding layers, the attention weights output by the last encoding layer have undergone multiple layers of feature abstraction and contextual interaction, enabling them to more accurately and globally reflect the final importance of each business feature in the encoding of the target company's business behavior. For multi-head self-attention mechanisms, multiple attention heads independently calculate attention weights in different representation subspaces. The attention weights of each attention head on the same feature dimension can be averaged or the maximum value can be taken to obtain the fused attention weight vector for each business feature dimension.

[0107] It should be noted that the maximum attention weight refers to the largest value selected from the extracted attention weights of each business characteristic dimension. It represents the risk-sensitive feature most discriminative of the current business status identified by the time-series coding model during the encoding process, such as monthly income changes in bank statements or fluctuations in tax payments. A larger maximum attention weight indicates a higher degree of dependence of the model on the corresponding business characteristic during encoding, and a stronger interpretability of that feature in subsequent risk assessment.

[0108] Optionally, the fusion ratio coefficient can be optimized end-to-end as a learnable parameter through gradient backpropagation during the model training phase, or it can be manually set by risk control experts based on experience data from historical risk cases. In one implementation, the fusion ratio coefficient can be set between 0.6 and 0.8, which can ensure that the degree of anomaly dominates risk judgment while appropriately introducing attention weights to provide a directional contribution to the source of risk.

[0109] Specifically, attention weights are assigned based on various operational characteristics and time steps. The total risk score is obtained by weighted fusion of residual abnormality scores and attention weights:

[0110] in, This is the fusion coefficient.

[0111] Step S403: Compare the total risk score with a preset risk level threshold, and determine the risk level of the target enterprise based on the comparison result.

[0112] Step S404: When the risk level meets the warning triggering conditions, output structured warning information. The structured warning information includes the risk level, the abnormal feature type corresponding to the maximum value of the attention weight, the number of sliding windows for the abnormality to persist, and the maximum residual mutation amplitude.

[0113] It should be noted that the specific number and value of the preset risk level thresholds can be differentiated based on the financial institution's risk appetite, business type, and historical default data distribution. In one implementation, two dividing points—a low-risk threshold, a medium-risk threshold, and a high-risk threshold—can be set to divide the total risk score into three levels: low-risk, medium-risk, and high-risk. When the total risk score is below the low-risk threshold, it indicates that the target company's business behavior is basically in line with normal patterns and the risk is controllable; when the total risk score is between the low-risk and medium-risk thresholds, it indicates that there is a certain degree of deviation in business behavior, which requires attention; when the total risk score is between the medium-risk and high-risk thresholds, it indicates that the business behavior has become significantly abnormal, requiring intervention measures; when the total risk score is above the high-risk threshold, it indicates that the business has deteriorated severely, and an emergency risk control process needs to be initiated immediately.

[0114] It should be understood that even after determining the current risk level of a target enterprise, if the risk level is known but the source and evolution characteristics of the risk are unknown, risk control personnel still find it difficult to formulate targeted intervention measures. Traditional black-box models only output a single risk score or level, failing to explain key questions such as "why this risk level was determined," "what type of business characteristics the risk stems from," "how long has the anomaly lasted," and "how fast it is deteriorating." This embodiment can output structured early warning information containing multi-dimensional risk elements when the risk level reaches a level requiring warning, such as core anomaly characteristics, duration, and magnitude of change. This provides risk control personnel with traceable, explainable, and interventionable decision-making basis, meeting the compliance requirements of financial regulators regarding the explainability and auditability of risk warnings.

[0115] In this embodiment, a total risk score is generated by fusing residual anomaly scores with the maximum attention weight extracted through a self-attention mechanism. This not only highlights the degree of risk associated with residual anomalies but also identifies the source of risk through attention weights, distinguishing it from the "black box prediction" approach of existing models. Furthermore, through structured and interpretable early warning outputs, risk control personnel are clearly informed of "where the risk is, how serious it is, and how long it will last," meeting the compliance requirements of financial regulation for "explainability and auditability."

[0116] For example, to help understand the implementation process of the risk warning method obtained by combining this embodiment with the above embodiment one, please refer to... Figure 6 , Figure 6 This is a simplified flowchart of the risk warning method proposed in this application. Specifically: First, data is collected and uniformly serialized into a time series, transforming multi-source heterogeneous enterprise operating data into a continuous, improved time series. Then, the improved time series encoding stage is entered. On the one hand, time interval position encoding captures the dynamic impact of non-uniform sampling intervals; on the other hand, a time series self-attention mechanism is used to mine deep dependencies, obtaining attention weights and core risk features. These two elements collaboratively generate a deep time series representation vector. This vector is then branched to two key analysis links: first, a sliding window residual analysis (including residual calculation and residual abnormality score quantification) captures the degree of deviation in operating status; second, the data is directly input into the risk judgment module, which, combined with the residual abnormality score and core risk feature output, can provide analytical output, such as risk feature type, abnormal duration, and residual mutation magnitude. Simultaneously, the residual abnormality score and core risk features are fused into a risk score to obtain a total risk score driving the warning output, ensuring that the warning results provide both decision-making basis and business transparency.

[0117] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the risk warning method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0118] This application also provides a risk warning device, please refer to... Figure 7 The risk warning device includes: The processing module 10 is used to standardize the collected time-series data of the target enterprise's business operations and generate a time-series sequence in a preset format.

[0119] The output module 20 is used to input the time series sequence into the improved time series coding model and output the deep time series representation vector of the target enterprise. The position coding in the time series coding model is calculated based on the real time interval between adjacent time steps in the time series. The self-attention mechanism of the time series coding model introduces an operational feature weight matrix to adjust the attention weight of different operational features.

[0120] The determination module 30 is used to predict the operating characteristic value of the target enterprise based on the deep time series representation vector, and determine the residual between the operating characteristic value and the actual operating characteristic value to obtain the residual abnormal score.

[0121] The early warning module 40 is used to generate a total risk score based on the attention weight and the residual abnormal score, and to issue a risk warning to the target enterprise based on the total risk score.

[0122] The risk warning device provided in this application, employing the risk warning method described in the above embodiments, can solve the technical problem that existing models cannot accurately reflect the time-series characteristics of uneven time intervals between adjacent time steps caused by different collection granularities in enterprise operating data, thus failing to achieve effective early risk warning. Compared with the prior art, the beneficial effects of the risk warning device provided in this application are the same as those of the risk warning method provided in the above embodiments, and other technical features in the risk warning device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0123] This application provides a risk warning device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the risk warning method in the first embodiment described above.

[0124] The following is for reference. Figure 8 The diagram illustrates a structural schematic suitable for implementing the risk warning device in the embodiments of this application. The risk warning device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 8 The risk warning device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0125] like Figure 8As shown, the risk warning device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the risk warning device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the risk warning device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows risk warning devices with various systems, it should be understood that it is not required to implement or possess all of the systems shown. More or fewer systems may be implemented alternatively.

[0126] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0127] The risk warning device provided in this application, employing the risk warning method described in the above embodiments, can solve the technical problem that existing models cannot accurately reflect the time-series characteristics of uneven time intervals between adjacent time steps caused by different collection granularities in enterprise operating data, thus failing to achieve effective early risk warning. Compared with the prior art, the beneficial effects of the risk warning device provided in this application are the same as those of the risk warning method provided in the above embodiments, and other technical features of this risk warning device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0128] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0129] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0130] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the risk warning method in the above embodiments.

[0131] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0132] The aforementioned computer-readable storage medium may be included in the risk warning device; or it may exist independently and not be assembled into the risk warning device.

[0133] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the risk warning device, cause the risk warning device to perform the risk warning method described above.

[0134] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0135] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0136] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0137] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned risk warning method. This addresses the technical problem that existing models cannot accurately reflect the uneven time intervals between adjacent time steps in enterprise operational data due to different data collection granularities, thus failing to achieve effective early risk warning. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the risk warning method provided in the above embodiments, and will not be elaborated upon here.

[0138] The above description is only a part of the embodiments of this application and does not limit the scope of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included within the protection scope of this application.

Claims

1. A risk warning method, characterized in that, The risk warning method includes: The collected time-series data on the business operations of the target companies are standardized to generate time-series sequences in a preset format; The time series sequence is input into the improved time series coding model, and the deep time series representation vector of the target enterprise is output. The position coding in the time series coding model is calculated based on the real time interval between adjacent time steps in the time series sequence. The self-attention mechanism of the time series coding model introduces an operational feature weight matrix to adjust the attention weight of different operational features. Based on the deep temporal representation vector, predict the operating characteristic value of the target enterprise, determine the residual between the operating characteristic value and the actual operating characteristic value, and obtain the residual abnormal score; A total risk score is generated based on the attention weight and the residual abnormal score, and a risk warning is issued to the target enterprise based on the total risk score.

2. The risk warning method as described in claim 1, characterized in that, The step of inputting the time series sequence into the improved time series coding model and outputting the deep time series representation vector of the target enterprise includes: The time interval position code is determined based on the actual time interval between each adjacent time step in the time sequence. The time interval position code is superimposed with the original feature vector of the time sequence to obtain the input representation of the fused time interval information; The input representation is fed into the multi-head self-attention layer of the temporal coding model to obtain the self-attention output; The self-attention output is subjected to layer normalization and residual connection, and after multi-layer stacking encoding, the deep temporal representation vector of the target enterprise is output.

3. The risk warning method as described in claim 2, characterized in that, The step of determining the time interval position code based on the actual time interval of each adjacent time step in the time series includes: Determine the actual time interval between each time step in the time series and the previous adjacent time step; Based on the actual time interval, the model feature dimension and encoding dimension index of the time-series coding model, the corresponding time interval position encoding values ​​are generated by using sine and cosine functions respectively; The time interval position code is obtained by combining the time interval position code values ​​of each dimension.

4. The risk warning method as described in claim 2, characterized in that, The step of inputting the input representation into the multi-head self-attention layer of the temporal coding model to obtain the self-attention output includes: The input representation based on the fusion time interval information generates a query matrix, a key matrix, and a value matrix through linear projection; Determine the initial attention score matrix based on the query matrix and the key matrix; The initial attention score matrix is ​​multiplied element-wise with the business feature weight matrix to obtain the differentiated attention score matrix. The weight values ​​of each business feature in the business feature weight matrix are set differently based on prior business knowledge. The differentiated attention score matrix is ​​normalized, and the normalized attention weight matrix is ​​weighted and summed with the value matrix to obtain the self-attention output.

5. The risk warning method as described in claim 1, characterized in that, The step of predicting the operating characteristic value of the target enterprise based on the deep time series representation vector, and determining the residual between the operating characteristic value and the actual operating characteristic value to obtain the residual abnormal score includes: Based on the deep temporal representation vector, the operational feature value for the next time step is generated through the prediction head network; The time-series residual is obtained based on the deviation between the operating characteristic value and the actual operating characteristic value corresponding to the next time moment; A sliding window is set based on a rolling update mechanism. The time-series residual sequence is traversed to obtain the statistical characteristics of the time-series residuals within each sliding window, and residual abnormal scores are constructed based on the statistical characteristics.

6. The risk warning method as described in claim 5, characterized in that, The method involves setting a sliding window based on a rolling update mechanism, traversing the time-series residual sequence, obtaining the statistical characteristics of the time-series residuals within each sliding window, and constructing a residual abnormality score based on the statistical characteristics, including: The sliding window moves sequentially over the time-series residual sequence according to a preset sliding step size to obtain the residual subsequence within each sliding window, wherein the sliding window contains a preset number of continuous time steps. Statistical calculations are performed on the residual subsequences within each sliding window to obtain the residual mean, residual standard deviation, and mutation magnitude corresponding to the sliding window. The mean of the residuals, the standard deviation of the residuals, and the magnitude of the abrupt change are respectively weighted and summed with preset first weighting coefficients, second weighting coefficients, and third weighting coefficients to obtain the window anomaly score of the sliding window; The window anomaly scores of each sliding window are combined in chronological order to obtain the residual anomaly score.

7. The risk warning method as described in claim 1, characterized in that, The process of generating a total risk score based on the attention weight and the residual abnormal score, and issuing a risk warning to the target enterprise based on the total risk score, includes: Extract the attention weight matrix corresponding to each business feature dimension from the coding layer of the time-series coding model, and determine the maximum attention weight of the attention weight matrix; Based on a preset fusion ratio coefficient, the residual abnormal score and the maximum attention weight are fused to generate a total risk score; The total risk score is compared with a preset risk level threshold, and the risk level of the target enterprise is determined based on the comparison result. When the risk level meets the warning triggering conditions, structured warning information is output. The structured warning information includes the risk level, the abnormal feature type corresponding to the maximum value of the attention weight, the number of sliding windows for the abnormality to persist, and the maximum residual mutation amplitude.

8. A risk warning device, characterized in that, The device includes: The processing module is used to standardize the collected time-series data of the target enterprise's operations and generate a time-series sequence in a preset format. The output module is used to input the time series sequence into the improved time series coding model and output the deep time series representation vector of the target enterprise. The position coding in the time series coding model is calculated based on the real time interval between adjacent time steps in the time series. The self-attention mechanism of the time series coding model introduces an operational feature weight matrix to adjust the attention weight of different operational features. The determination module is used to predict the operating characteristic value of the target enterprise based on the deep time series representation vector, and determine the residual between the operating characteristic value and the actual operating characteristic value to obtain the residual abnormal score; The early warning module is used to generate a total risk score based on the attention weight and the residual abnormal score, and to issue a risk warning to the target enterprise based on the total risk score.

9. A risk warning device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the risk warning method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the risk warning method as described in any one of claims 1 to 7.

Images