An intelligent data security situation awareness and management method and device based on multi-modal fusion

Abstract

The application provides a kind of intelligent data security situation awareness and management method and device based on multi-modal fusion, applied to data processing field.By collecting commercial transactions, contract, supply chain, financial and multi-modal business data of authority operation, configure acquisition node parameters and rely on standard interface and API gateway authentication to realize heterogeneous data security access;After format normalization, redundancy elimination and normalization preprocessing, multi-dimensional business features are extracted and special research data sets are generated;Integrative fusion strategy is constructed by combining business value, real-time, computing power allocation and compliance standards, and data set batch splitting and encrypted edge cloud transmission are completed according to scene;Adaptive dynamic weight algorithm is used to learn feature mapping relationship, optimize model parameters and dynamically adapt research rules, and finally output compliance awareness results and whole-process management scheme.

Description

Technical Field

[0001] This invention relates to the field of data processing, and in particular to an intelligent data security situation awareness and management method and device based on multimodal fusion. Background Technology

[0002] As enterprises continue their digital transformation, the deep integration of multiple business scenarios, such as online-offline integrated transactions, centralized financial accounting, supply chain collaborative operations, and full contract lifecycle management, has led to a surge in the generation of transaction data, financial data, supply chain data, contract data, and access control data. These data are characterized by multi-source heterogeneity, massive growth, and diverse modalities. Traditional data security management methods, which rely on single-source log collection and manual rule verification, are insufficient to cover the entire business process. Problems such as inconsistent data access, misaligned features, delayed analysis, and high rates of missed risk detection are becoming increasingly prominent.

[0003] Existing data acquisition technologies are mostly designed for single business systems and cannot simultaneously adapt to the access needs of heterogeneous systems such as POS transactions, online malls, third-party payment, financial software, supply chain platforms, and contract management systems. Collection parameters are fixed and cannot be dynamically adjusted according to business real-time requirements, data sensitivity levels, and regulatory compliance requirements. They also suffer from poor interface compatibility, inconsistent authentication, and insufficient transmission security, making them prone to data duplication, missing data, tampering, and access conflicts.

[0004] Existing data preprocessing and feature extraction technologies lack unified and standardized protocols. Different business data formats, definitions, and precisions are inconsistent, and temporal features, semantic features, matching features, and verification labels cannot be effectively integrated, making it difficult to form specialized datasets suitable for integrated analysis. Some technologies only support structured data processing and lack the ability to extract unstructured data such as contract texts. Feature correlation is low, making it impossible to support cross-business compliance verification and risk correlation analysis.

[0005] Existing security situation awareness and risk assessment technologies mostly employ fixed weights and static rules, failing to adapt to specific business scenarios. In different scenarios such as real-time clearing, contract fulfillment, supply chain collaboration, and financial accounting, they cannot dynamically allocate feature weights, adjust judgment thresholds, and handle rules, resulting in low assessment accuracy, high false positive rates, and delayed responses. Furthermore, the lack of an edge-cloud collaboration mechanism prevents rapid local assessment of highly real-time tasks and hinders efficient cloud-based computation of highly complex assessments, leading to an overall unreasonable allocation of computing power.

[0006] Existing compliance management solutions fail to achieve closed-loop management across the entire process of data collection, preprocessing, feature fusion, situation assessment, and risk management, and lack a dynamic adaptation mechanism for real-time linkage with industry regulatory rule bases. Faced with constantly evolving regulatory requirements, they cannot automatically calibrate verification benchmarks, update assessment rules, or adjust handling strategies, making it difficult to meet enterprises' continuous compliance and comprehensive data security management needs. Summary of the Invention

[0007] According to one aspect of this application, a method for intelligent data security situation awareness and management based on multimodal fusion is provided, comprising: collecting multimodal business data including business transaction details, digital features of key contract terms, data interaction records of supply chain nodes, structured information of financial vouchers, and permission operation trajectories; configuring dynamic parameters of business data collection nodes, and realizing secure access to heterogeneous business data related to transactions, finance, supply chain, and contracts through standardized interfaces and in conjunction with the business system API gateway authentication mechanism; completing data format regularization, redundant information removal, and compliance field normalization in the preprocessing stage, extracting transaction behavior temporal features, contract term semantic association vectors, supply chain cash flow-logistics matching features, and financial compliance verification tags to generate a business security compliance special analysis dataset; and combining business value levels, real-time transaction clearing requirements, and edge-cloud collaboration... Based on the same computing power allocation scheme and regulatory compliance accuracy standards, an integrated strategy is constructed to combine multi-source data collection, cross-business feature alignment, and intelligent assessment of compliance risks. Data sets are split according to business scenarios to generate processing batches containing standardized operating baselines, compliance risk anomaly labels, and regulatory compliance attribute verification items. Edge-cloud collaborative asynchronous transmission and data synchronization verification are achieved through encrypted channels. Through a business scenario adaptive dynamic weight algorithm, the mapping relationship between multi-dimensional features and business compliance status and transaction risk evolution path is learned. Based on business data credibility classification, feature correlation strength quantification, and dynamic feedback of assessment accuracy, model parameters are optimized. Combined with business scenario type, compliance supervision level, and industry regulatory rule library, compliance risk judgment threshold, cross-business risk matching rules, and tiered disposal instruction triggering conditions are dynamically adapted to generate compliance perception results and full-process compliance management implementation plan.

[0008] Another aspect of this application is a multimodal fusion-based intelligent data security situation awareness and management device, configured to execute a multimodal fusion-based intelligent data security situation awareness and management method by executing the executable instructions.

[0009] According to another aspect of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a second processor, implements the above-described intelligent data security situation awareness and management method based on multimodal fusion.

[0010] The beneficial technical effects of this application are as follows: First, multimodal data is formatted, redundant data is removed, and compliance normalized to extract temporal, semantic, matching, and verification features to form an analysis dataset. Then, constrained by business value, real-time performance, computing power allocation, and compliance standards, an integrated fusion strategy is constructed to complete batch splitting of the dataset and encrypted transmission to the edge cloud. Through an adaptive dynamic weighting algorithm, feature mapping relationships are learned, and the judgment thresholds, association rules, and handling conditions are dynamically calibrated in conjunction with industry regulatory rules. Finally, compliance awareness results and a full-process management solution are output, achieving integrated data security and compliance control.

[0011] This application achieves unified access and standardized processing of multi-source heterogeneous business data, improving data integrity and availability, and reducing access conflicts and data anomalies. Multimodal feature fusion and scenario-adaptive analysis improve the accuracy of risk identification, reducing false positives and false negatives. Edge-cloud collaboration and dynamic parameter calibration balance real-time response and complex calculations, improving system operating efficiency. Dynamic adaptation to regulatory rules meets compliance requirements, reduces enterprise compliance management costs, and forms a closed-loop management system covering all stages of collection, transmission, analysis, and processing, enhancing data security and risk control capabilities.

[0012] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0013] Figure 1 A flowchart of an intelligent data security situation awareness and management method based on multimodal fusion, provided in an embodiment of this application, is shown. Figure 2 This illustration shows a schematic diagram of the structure of an intelligent data security situation awareness and management device based on multimodal fusion, provided in an embodiment of this application. Detailed Implementation

[0014] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0015] The following is combined Figure 1 This application describes an intelligent data security situation awareness and management method based on multimodal fusion, according to an exemplary embodiment of the present application.

[0016] S101 collects multimodal business data, including detailed business transaction records, digital features of key contract terms, data interaction records of supply chain nodes, structured information of financial vouchers, and access control operation trajectories.

[0017] In one implementation, targeting online and offline transaction scenarios for enterprises, this method aims to cover all transaction behaviors, extract all data elements, and retain the entire transaction trajectory. It performs standardized data collection on each transaction, with collection dimensions including timestamp, transaction object, transaction amount, payment method, transaction channel, order number, transaction status, risk control identifier, and settlement result. A unique timestamp is generated based on the transaction initiation time, and transaction fields from different systems are aligned uniformly through field mapping rules to ensure consistent data standards.

[0018] For retail businesses, three types of original transaction records are collected simultaneously: in-store POS machine transactions, online store orders, and third-party payment records. POS machine transaction data includes terminal number, store code, product barcode, actual amount received, change given, and card swipe voucher number. Online store order data includes user ID, product list, coupon deduction amount, shipping address, shipping status, and refund status. Third-party payment record data includes payment institution number, transaction number, transaction fee, settlement status, and arrival time. All data is collected in 5-minute incremental synchronization cycles, using the MD5 checksum algorithm for data deduplication and integrity verification. End-to-end transmission encryption and anti-tampering verification are implemented to defend against cybersecurity threats such as man-in-the-middle attacks and data eavesdropping, fully preserving the time, amount, counterparty, and channel information of each transaction to form a standardized original transaction dataset.

[0019] This process involves the digital extraction and structured transformation of various business contract execution texts for enterprises. Data collection dimensions include contract parties, contract amount, performance period, payment terms, liability for breach of contract, data security agreements, scope of authorization, contract number, signing date, and change records. Extraction is layered by core clauses, supplementary clauses, and compliance clauses. Key entities in the contract text are first identified, then field filling is completed through rule matching, and finally, structured contract data is generated. For sales contracts, the focus is on collecting buyer information, product list, unit price, total price, delivery cycle, and payment terms. For procurement contracts, the focus is on collecting seller qualifications, delivery cycle, quality standards, acceptance clauses, and breach of contract compensation standards. For service agreements, the focus is on collecting service content, service period, payment settlement method, data usage permissions, and confidentiality clauses. Core clauses in paper or electronic documents are converted into structured text and stored uniformly in JSON format. Sensitive information such as customer privacy and trade secrets is automatically anonymized to meet data security and personal information protection requirements. The process retains subject information, term, amount, and liability agreements, forming a contract feature dataset that can be directly used for compliance assessment.

[0020] This system collects data interactions between upstream and downstream entities in the supply chain. Collection dimensions include order delivery, logistics status, reconciliation information, delivery vouchers, inter-node interface call logs, node numbers, interaction times, data types, transmission status, and anomaly indicators. Upstream and downstream data interaction records are collected at a minute-by-minute frequency, establishing a link between logistics and cash flow through order numbers and tracking numbers. For manufacturer-supplier collaboration scenarios, data is collected covering the entire process from order creation, order confirmation, material outbound, logistics transfer, goods receipt, reconciliation initiation, reconciliation confirmation, and voucher upload. Inter-node interface call logs include requester ID, responder ID, interface name, request parameters, response result, time consumption, and failure reason. Real-time monitoring of abnormal communication and unauthorized interface calls between nodes allows for timely detection of cybersecurity risks such as supply chain data hijacking and forged messages. A complete record of the data flow process between nodes is created, forming a supply chain data interaction trajectory database to provide data support for the matching and verification of cash flow and logistics.

[0021] The system collects real-time communication behavior data from upstream and downstream nodes through interface call logs, continuously monitoring for abnormal communication behaviors such as unusual communication frequency, abnormal message format, response timeouts, and illegal request sources. For unauthorized interface access, unauthorized data acquisition, and the issuance of unauthorized commands, a combination of permission verification and identity authentication is used to block these actions in real time. During data transmission, message integrity, source legitimacy, and timing are verified item by item to identify network attacks such as message tampering, identity forgery, and data hijacking. Once a risk is detected, an alarm is immediately triggered and the current communication link is terminated. The system comprehensively records all elements of node interaction information, including the time of interaction, requester and responder identifiers, interface names, transmitted content, processing results, and anomaly types, forming an immutable supply chain data interaction trajectory database. This database can be used for post-event security audits, risk tracing, and liability determination, while providing reliable and timely data support for the matching and verification of cash flow and logistics, ensuring the safe and stable operation of supply chain collaborative businesses.

[0022] The system collects structured data from the financial system, including accounting vouchers, invoice information, income and expenditure details, account classification, settlement documents, tax-related vouchers, voucher numbers, entry time, review status, debit / credit direction, amount accuracy, and tax codes. It supports automatic parsing of XML, Excel, and PDF formats, matches accounts according to first- to third-level accounting subjects, and verifies data legality using debit / credit balance formulas. It extracts structured fields from the financial software, such as accounting voucher number, income and expenditure amount, corresponding account, invoicing information, settlement time, tax rate, tax amount, and deduction status. It triggers real-time reporting of abnormal amounts and frequencies, and implements encrypted storage and access control for core financial data to prevent data leakage and unauthorized tampering, forming financial data directly usable for compliance verification. All financial data is reconciled and verified daily to ensure consistency between accounts and vouchers, and between accounts and actual assets, meeting financial regulatory compliance requirements.

[0023] This system collects behavioral data from user accounts within the business system, including login time, function performed, accessed data range, approval records, permission changes, abnormal operations, account ID, terminal IP, geographical location, and operation results. It monitors the entire account operation process in real time, categorizing and storing data by operation type, and separately marking high-risk operations. For administrator accounts, the system focuses on collecting data on login verification, permission allocation, data export, workflow approval, and system configuration modification operations. For regular user accounts, the system focuses on collecting data query, data submission, data modification, and order operations. It records the operator, time, function, and target of the operation, forming a complete behavioral trajectory. Abnormal behaviors such as consecutive failed logins, unauthorized access, and operations outside of working hours are automatically marked. High-risk account behaviors such as brute-force attacks, unauthorized access, and batch export outside of working hours are blocked and alerted in real time, strengthening identity authentication and access security control, and providing a basis for access compliance auditing and risk identification.

[0024] Based on preset user behavior baselines and access control rules, the system monitors account login status, operation scope, and data export behavior in real time throughout the entire process. For brute-force attacks, the system continuously counts the number of failed login attempts per unit time. When the number of failures exceeds a set threshold, the corresponding account is immediately locked and subsequent login attempts are prohibited, while an alarm is pushed to the security control module. For unauthorized access, the system performs permission verification before each operation, checking the match between the current account role and the access data scope. When unauthorized access to data or unauthorized operations are detected, the current operation is directly blocked and details of the violation are recorded. For batch export behavior outside of working hours, the system combines preset working hours and single-time data export volume thresholds for judgment. When a large batch of data is exported outside of permitted hours, the export process is immediately terminated and a level-based alarm is triggered. The system fully records all high-risk behaviors, retaining information such as the operator, account, terminal address, time, operation content, and processing result, forming a traceable behavior log. By continuously blocking in real time and proactively alerting, the security of the identity authentication process and the effectiveness of access control are enhanced, providing accurate and reliable data for access compliance auditing, risk tracing, and situation assessment.

[0025] After the above five types of data are collected, cross-validation is performed through a multi-source data fusion and verification module. Transaction data and contract data are verified by association with order numbers; transaction data and financial data are verified by association with amount and settlement status; supply chain data and transaction data are verified by association with logistics information; and access tracking data and the four types of business data are verified by association with the operating entity. Encrypted transmission is used throughout the collection process, and an API gateway authentication mechanism ensures secure data access. A data security baseline and anomaly monitoring mechanism are established for the collection process, enhancing the security protection capabilities of the entire data collection chain. All collection parameters can be dynamically adjusted according to business scenarios, meeting the data source requirements for enterprise transaction scenario data security situational awareness.

[0026] The data acquisition process uniformly employs the TLS 1.3 encryption protocol to construct the transmission channel, encrypting all business data throughout the transmission process to prevent eavesdropping, tampering, or hijacking. The system relies on the API gateway authentication mechanism to complete access identity verification, performing identity authentication and access control on all access nodes, strictly adhering to the principle of least privilege when allocating data access permissions, and directly denying access to nodes that fail authentication. The system establishes a data security baseline based on historical normal acquisition behavior and business compliance requirements, clearly defining judgment criteria such as acquisition frequency, field integrity, transmission latency, and abnormal access. Real-time anomaly monitoring is continuously conducted throughout the entire acquisition process, identifying and triggering alarms for abnormal behaviors such as acquisition interruptions, repeated reporting, data tampering, unauthorized access, and unauthorized calls. Through security baseline comparison and anomaly monitoring, risks in the acquisition process are detected and addressed early. The system provides dynamic adjustment capabilities based on business scenarios for core parameters such as acquisition frequency, synchronization period field mapping verification rules, and transmission encryption levels, allowing for autonomous parameter configuration adaptation based on transaction real-time requirements, data sensitivity levels, regulatory compliance strength, and computing power allocation. The entire mechanism covers the entire process of data collection, access, transmission, and verification, strengthening the security protection and trusted management of the data collection link, and providing stable, reliable, and compliant data source support for enterprises' data security situation awareness in transaction scenarios.

[0027] S102 configures dynamic parameters for business data collection nodes and enables secure access to heterogeneous business data related to transactions, finance, supply chain, and contracts through standardized interfaces and the business system API gateway authentication mechanism.

[0028] In one implementation, the core parameters for multi-source heterogeneous business data collection are comprehensively set based on the business scenario-adaptive dynamic calibration of data collection node parameter initialization validity, interface adaptation and compatibility, authentication process standardization, and data access security requirements. This generates parameter calibration values ​​and execution rule information for each collection module. Based on the business scenario-adaptive dynamic calibration, a full-dimensional verification process for the collection nodes is initiated. This calibration process relies on a scenario parameter matching algorithm. The algorithm inputs four elements: business scenario type, data sensitivity level, real-time requirements, and regulatory compliance level. The outputs four verification benchmarks: initialization validity threshold, interface compatibility standard, authentication process standardization, and access security level. The algorithm completes the matching through linear weighted calculation, setting the business scenario weight to 0.4, the data sensitivity level weight to 0.3, the real-time requirement weight to 0.2, and the regulatory compliance level weight to 0.1. The weighted sum is then mapped to the corresponding verification standard, ensuring that the calibration results align with actual business needs.

[0029] First, the initialization validity of the acquisition node is verified. This verification includes checking the node's startup status, parameter loading completeness, resource allocation rationality, and data link connectivity. The initialization validity verification uses a node status detection algorithm to check the acquisition node's hardware resources, software processes, configuration files, and network links one by one, outputting a normal or abnormal result. Initialization is considered valid when all four checks pass; otherwise, node restart and parameter reloading are triggered. The initialization validity threshold is uniformly set to 100%, disallowing any partial valid states.

[0030] Next, interface adaptation and compatibility verification is performed. The verification targets the business system interfaces connected to the four types of data collection modules: transaction, finance, supply chain, and contract. Interface adaptation and compatibility verification relies on an interface protocol matching algorithm. The algorithm inputs the data collection module interface type, business system interface protocol, data transmission format, and field definition specifications, and outputs a compatibility or incompatibility result. The algorithm first enumerates and matches the interface protocol, supporting multiple protocol types such as HTTP, HTTPS, WebService, Socket, and RPC. It prioritizes encrypted protocols such as HTTPS and disables HTTP plaintext transmission to reduce network security risks in interface communication. Next, it verifies the data transmission format, supporting multiple formats such as JSON, XML, CSV, and Excel. Finally, it performs a consistency comparison of the name, type, and length of key fields. When the protocol, format, and fields match completely, the interface is considered compatible. If there are mismatches, adaptation and conversion rules are automatically generated to ensure that heterogeneous interfaces can be connected normally.

[0031] Next, the authentication process is validated for compliance. This validation covers all stages: identity authentication, permission verification, access control, and logging. The validation process employs an authentication chain tracing algorithm, starting from the request initiated by the data collection node and tracking the entire process of the API gateway's identity verification, permission judgment, access control execution, and operation log writing, recording the execution time and return result of each step. The authentication timeout is uniformly set to 3 seconds; if authentication is not completed within 3 seconds, it is considered an authentication timeout. Identity authentication must use a dual authentication mode of account, password, and token, enabling multi-factor authentication (MFA) to strengthen the security of high-privilege operations. Permission verification must adhere to the principle of least privilege. Access control must support IP whitelists and time period restrictions. Operation logs must completely record the requester, time, operation content, and result. If all stages meet the requirements, the authentication process is deemed compliant; if any stage is missing, data access is blocked and an alarm is issued.

[0032] Then, a data access security verification is performed. The verification includes four capabilities: transmission encryption, data anonymization, anti-tampering, and anti-replay. The data access security verification relies on an access security detection algorithm. The algorithm inputs are the transmission protocol type, encryption algorithm type, anonymization rule configuration, and checksum type; the output is a secure or insecure result. The transmission process must use the TLS 1.3 encryption protocol, disable weak encryption suites and outdated protocols, defend against SSL / TLS vulnerability attacks, sensitive fields such as amounts and customer information must be anonymized, data packets must be appended with an SHA256 checksum for anti-tampering, and access requests must carry a one-time token for anti-replay. If all four security capabilities are met, the data access is deemed secure; if a security vulnerability exists, data access is rejected and security hardening is initiated.

[0033] After completing four global verifications, the core parameter planning phase begins. The planning includes collection frequency, synchronization cycle, parsing format, monitoring interval, field mapping rules, and verification algorithm. Parameter planning employs a scenario-adaptive algorithm. Inputs are the benchmark standards for successful verification and the characteristics of the business scenario; outputs are the parameter value ranges and effective conditions for each collection module. Collection frequency is categorized by real-time level into seconds, tens of seconds, minutes, and hours. Synchronization cycle is categorized by data volume into 1 minute, 5 minutes, 15 minutes, 30 minutes, and 60 minutes. Parsing format is uniformly set to a standard structured format based on data type. Monitoring interval is categorized by change sensitivity into 10 seconds, 30 seconds, and 60 seconds. Field mapping rules execute a unified standard mapping. The verification algorithm uses a fixed consistency verification and deduplication algorithm. The algorithm automatically matches the optimal parameters based on scenario characteristics, ensuring that parameter values ​​are reasonable and executable.

[0034] After parameter planning is completed, fixed parameter calibration values ​​and executable operating rules are generated for the transaction acquisition module, financial acquisition module, supply chain acquisition module, and contract acquisition module. The parameter calibration values ​​include specific values ​​for acquisition frequency, synchronization period, parsing format, and monitoring interval. The operating rules include parameter activation conditions, exception handling logic, data quality standards, and security constraints. All module parameters and rules adhere to a unified standard, ensuring that each acquisition stage operates under the same specifications.

[0035] For enterprise transaction and financial mixed business scenarios, the scenario is first determined to be a mixed scenario with high real-time requirements, high sensitivity, and high compliance requirements through a scenario parameter matching algorithm, generating corresponding verification benchmarks and parameter planning standards. The interface compatibility protocol is uniformly set to HTTPS. The authentication timeout is uniformly set to 3 seconds. The data encryption method is uniformly set to TLS 1.3 encrypted transmission and AES256 local storage. Subsequently, basic parameters and execution rules are assigned to the four acquisition modules. The transaction acquisition module is set to an acquisition frequency of once per second, a synchronization period of 5 minutes, a parsing format of JSON, a listening interval of 10 seconds, field mapping according to standard transaction fields, and an MD5 consistency check algorithm. The financial acquisition module is set to an acquisition frequency of once per minute, a synchronization period of 15 minutes, a parsing format of XML, a listening interval of 60 seconds, field mapping according to standard financial accounts, and a debit / credit balance check algorithm. The supply chain acquisition module is set to an acquisition frequency of once every two minutes, a synchronization period of 30 minutes, a parsing format of JSON, a listening interval of 30 seconds, field mapping according to logistics and cash flow standards, and an association matching check algorithm. The contract data collection module is set to collect data once per hour, with a synchronization cycle of 60 minutes. The parsing format is structured text, the listening interval is 60 seconds, field mapping follows the core contract terms, and the verification algorithm uses integrity checks. Each module's parameters are configured independently and do not conflict with each other. Interface integration, authentication processes, and security encryption follow unified standards, effectively avoiding parameter conflicts and access anomalies, and ensuring stable and secure access to multi-source heterogeneous data in mixed business scenarios.

[0036] For the transaction data collection phase, the system sets the collection frequency, field mapping rules, incremental synchronization cycle, and flow verification algorithm to obtain fixed parameters and adaptation logic for the transaction data. The collection frequency is configured using a real-time tiered matching algorithm. This algorithm takes the real-time level of the transaction scenario, business settlement timeliness, and peak data pressure as inputs, and outputs the collection frequency level through level mapping and threshold determination. The algorithm divides the transaction scenario into three levels: real-time settlement level, near-real-time level, and ordinary business level. Real-time settlement level corresponds to second-level collection, near-real-time level corresponds to ten-second-level collection, and ordinary business level corresponds to minute-level collection. Key parameters include the real-time threshold, peak flow limiting coefficient, and minimum collection interval. A real-time threshold less than or equal to one second is determined as second-level collection. A real-time threshold greater than one second and less than or equal to ten seconds is determined as ten-second-level collection. A real-time threshold greater than ten seconds is determined as minute-level collection. The peak flow limiting coefficient is used to automatically reduce the collection density in high-concurrency scenarios to avoid system overload. The minimum collection interval is uniformly not less than one hundred milliseconds to ensure stable operation of the collection nodes. This algorithm achieves precise matching between the collection frequency and business requirements, balancing real-time performance and system load.

[0037] The field mapping rules rely on a cross-system standard field alignment algorithm. The algorithm takes as input the original transaction field names, types, lengths, and business meanings from each business system. The output is a unified standard transaction field and mapping relationship table. The algorithm first establishes a standard field library, including order number, transaction timestamp, transaction object identifier, transaction amount, payment method, transaction channel, transaction status, and risk control identifier. Then, it performs semantic matching and format conversion on the fields from each business system. Numeric fields are uniformly accurate to two decimal places. Character fields are uniformly encoded in UTF-8. Time fields are uniformly encoded in UTC+8 timestamp format. The mapping process supports three modes: one-to-one mapping, multi-field merging mapping, and constant padding mapping. One-to-one mapping is used for fields with completely identical meanings. Multi-field merging mapping is used for combining scattered fields. Constant padding mapping is used to supplement missing required fields. All mapping relationships are fixed in a rule table, automatically executed after loading, without manual intervention, ensuring consistent formatting of transaction data from different sources.

[0038] The incremental synchronization cycle is determined using a data volume adaptive cycle algorithm. The algorithm's inputs are the number of transaction data entries per unit time, the data growth rate, the edge-cloud transmission bandwidth, and the system processing capacity. The output is the optimal synchronization cycle. The algorithm categorizes data volume into three levels: small, medium, and large. Small data volume corresponds to a 15-minute synchronization cycle. Medium data volume corresponds to a 5-minute synchronization cycle. Large data volume corresponds to a 1-minute synchronization cycle. Key constraints include the minimum synchronization interval, the maximum synchronization delay, and the upper limit of data volume for a single synchronization. Once the synchronization cycle is determined, it remains fixed when the system load is stable. When the data volume suddenly increases beyond a threshold, the cycle is automatically shortened. When the data volume decreases, the original cycle is restored, achieving a balance between synchronization efficiency and resource consumption.

[0039] The transaction log verification algorithm employs a combination of consistency checks and deduplication rules. Consistency checks are based on the MD5 hash algorithm. Key fields for each transaction are concatenated to generate a raw string. A unique hash value is then calculated using the MD5 algorithm. The hash value remains unchanged for the same transaction. If a field is tampered with, the hash value changes. This is used to determine data integrity and authenticity. Deduplication is based on a dual-judgment rule. First, it checks if the order number is identical. Second, it checks if the transaction timestamp, transaction object, and transaction amount are completely identical. If all three conditions are met, the data is considered duplicate and removed. Data that fails the verification is automatically entered into an error queue. The error type and original content are recorded. A retry mechanism or alarm notification is triggered to ensure the accuracy of incoming transaction logs.

[0040] For retail transaction scenarios, a real-time tiered matching algorithm determines the transaction to be at the real-time clearing level. The data collection frequency is set to once per second. The minimum collection interval is set to 100 milliseconds. The peak flow limit coefficient is set to 0.8. A cross-system standard field alignment algorithm maps different fields from POS machines, online stores, and third-party payments to standard fields. Order number is mapped to `order_id`, transaction time to `trans_time`, transaction amount to `trans_amt`, and transaction channel to `channel`. A data volume adaptive cycle algorithm determines the data volume to be medium. The incremental synchronization cycle is set to five minutes. The maximum data volume for a single synchronization is set to 10,000 records. An MD5 consistency check algorithm and a double deduplication rule are used. A hash value is calculated by concatenating key fields for each transaction. Completeness is verified for each transaction. Simultaneously, duplicates are determined based on order number and core information. Deduplication and integrity checks are completed. This set of parameters and logic operates stably in retail scenarios, ensuring accurate transaction data collection, timely synchronization, and rigorous verification.

[0041] For the financial data collection stage, voucher parsing formats, account matching dimensions, real-time reporting thresholds, and reconciliation verification rules are defined to clarify the quality assessment standards for financial data. Specifically, for the financial data collection stage, voucher parsing formats, account matching dimensions, real-time reporting thresholds, and reconciliation verification rules are sequentially established to form a complete system of financial data quality assessment standards.

[0042] The voucher parsing format employs a fixed-structure parsing algorithm. The algorithm takes the financial voucher file type, field location, and data encoding as input and outputs a standardized financial voucher structure. This algorithm supports reading both XML and Excel formats. For XML, it extracts core fields such as voucher number, account, amount, and date according to preset tag paths. For Excel, it locates data according to fixed column numbers and sheet pages, automatically skipping headers and comment rows, extracting only valid business data. During parsing, vouchers with missing required fields are automatically marked as abnormal and not included in the normal data collection process, ensuring the integrity and usability of the original data.

[0043] The subject matching dimension relies on a three-tiered accounting subject mapping algorithm. The algorithm takes the company's original subject name, subject code, and business meaning as input, and outputs standard accounting subjects from level one to level three. Level one subjects are divided into five categories: assets, liabilities, equity, costs, and profit and loss. Level two subjects are further subdivided under the level one categories; for example, assets are subdivided into cash, accounts receivable, and inventory. Level three subjects correspond to specific accounting subjects; for example, cash is subdivided into cash and bank deposits. The algorithm uses keyword matching and coding rule comparison to uniformly map subjects from heterogeneous financial systems to the standard subject system, ensuring consistency in subject definitions across systems.

[0044] The real-time reporting threshold employs an anomaly quantification algorithm, setting separate thresholds for single transaction amount and daily frequency. The algorithm inputs historical transaction averages, business scale, and regulatory requirements, with the output being the anomaly trigger limit. The single transaction reporting threshold is set at three times the average of single financial transactions over the past three months. The daily frequency threshold is set at twice the average daily voucher submission volume over the past three months. When a single transaction amount exceeds the threshold or the daily submission frequency exceeds the limit, real-time reporting and anomaly warnings are immediately triggered, enabling early detection and handling of financial risks.

[0045] The reconciliation verification rules employ a dual approach: debit / credit balance verification and voucher correlation verification. Debit / credit balance verification is based on the accounting equation, calculating the difference between the total debit and credit entries. A zero difference indicates a balance, while a non-zero difference indicates an imbalance. Voucher correlation verification matches accounting vouchers with invoices, settlement statements, and tax documents, verifying consistency in voucher numbers, amounts, counterparties, and transaction dates. Both verifications must pass for the financial data to be considered acceptable; failure to pass either verification initiates an anomaly review process.

[0046] For enterprise financial voucher collection scenarios, both XML and Excel formats are used for parsing. A first- to third-level account matching dimension is established based on assets, liabilities, equity, costs, and profit and loss. A single reporting threshold of 50,000 yuan is set, with a daily frequency limit of 200 transactions. The debit and credit balance formula is used to verify the equality of debits and credits in each voucher, and voucher association matching rules are used to verify the consistency of business documents. All data that passes verification is included in the compliance dataset, and abnormal data is reported and locked in real time to ensure accurate, compliant, and traceable financial data collection.

[0047] For the supply chain data collection stage, the sampling frequency of node interactions, logistics-capital flow association rules, delay tolerance intervals, and status update coefficients are set to determine the validity judgment and constraints of supply chain data. Specifically, a system for judging and constraining the validity of supply chain data is formed by sequentially setting the sampling frequency of node interactions, logistics-capital flow association rules, delay tolerance intervals, and status update coefficients. The node interaction sampling frequency adopts a communication frequency adaptive algorithm. The algorithm inputs are the interaction frequency of upstream and downstream nodes, business real-time requirements, and network load, and the output is the optimal sampling interval. The sampling interval is set to one minute for real-time collaboration scenarios and five minutes for non-real-time reconciliation scenarios. The sampling process pulls order transmission, logistics status, reconciliation information, and interface logs at fixed intervals to ensure continuous and traceable data.

[0048] The logistics-funds flow association rule employs a dual-number, two-way binding algorithm, using order number and logistics document number as key fields to establish a unique link between logistics information and funds settlement information. First, the order number is used to match the corresponding logistics document and settlement document; then, the logistics document number is used to reverse-verify the funds settlement progress. Successful association is marked as a data match; failed association is marked as an anomaly, providing a basis for assessing the consistency between funds flow and logistics. The delay tolerance range uses a maximum allowable delay algorithm, setting the maximum waiting time for data reporting and interaction based on the business type. The delay tolerance range is set to three minutes for real-time logistics tracking scenarios and thirty minutes for ordinary reconciliation interaction scenarios. If data is not received within the delay range, it is considered a timeout, automatically triggering retransmission or an anomaly alarm to ensure the timeliness of supply chain data.

[0049] The status update coefficient employs a real-time grading algorithm, classifying levels based on the difference between the data update time and the current time. The coefficient ranges from zero to one, with values ​​closer to one indicating higher real-time performance. Updates within five minutes are rated at 0.9 to 1; updates within thirty minutes are rated at 0.6 to 0.9; and updates more than thirty minutes ago are rated below 0.6. As a core indicator of data validity, the status update coefficient, if below a set threshold, is excluded from risk assessment.

[0050] For manufacturing supply chain scenarios, the sampling frequency for node interactions is set at one-minute intervals. Order numbers and tracking numbers are used to achieve two-way binding of logistics and cash flow. A three-minute latency tolerance interval is set. The status update coefficient threshold is set to 0.7. Order interactions, logistics trajectories, reconciliation information, and API call logs between manufacturers and suppliers are collected in real time. Data is matched according to association rules, validated for latency, and tiered for real-time performance. Only data deemed valid is entered into the database, ensuring the accuracy, synchronization, and reliability of supply chain data.

[0051] For the contract data collection phase, specific constraints are established regarding clause extraction granularity, text structuring standards, change monitoring intervals, and permission association strategies to clearly define the standardized collection of contract data. Specifically, a standardized contract data collection constraint system is formed by sequentially setting clause extraction granularity, text structuring standards, change monitoring intervals, and permission association strategies. Clause extraction granularity employs a core entity location algorithm, extracting clauses layer by layer according to contract subject, subject matter amount, performance period, payment terms, liability for breach of contract, data security agreements, and scope of authorization. Key entities in the text are first identified, then clauses are broken down according to semantic boundaries, preserving complete business meaning and eliminating redundant embellishments. The extraction granularity covers all fields necessary for compliance assessment, ensuring no key risk-related information is overlooked.

[0052] The text structuring standard employs an unstructured-to-structure algorithm to convert unstructured contract texts such as scanned paper documents, Word documents, and PDF documents into unified key-value pair structured data. Fields uniformly include contract number, entity information, amount, term, payment schedule, default clauses, and security agreements. Encoding is uniformly UTF-8, time uses standard timestamps, and amounts are uniformly retained to two decimal places to ensure consistent contract data format. A timed polling detection algorithm is used to scan the contract database at fixed intervals, detecting status changes such as contract revisions, supplementary agreements, cancellations, and renewals. The monitoring interval for high-risk contracts is set at ten minutes, and for ordinary contracts at one hour. Upon detection of a change, clauses are immediately re-extracted and the dataset is updated to ensure contract data is synchronized with the actual business status.

[0053] The access control strategy employs a least privilege algorithm, limiting the scope of contracts that can be collected based on account role, department, and security level. Administrator accounts can collect all contracts. Business department accounts can only collect contracts signed within their own department. Regular accounts can only view publicly available contract terms. Access is verified before collection; unauthorized access is automatically blocked and logged to ensure contract data security.

[0054] For business contract data collection scenarios, the extraction granularity is set according to core clauses to fully extract information such as the subject, amount, term, default conditions, and security agreements. Unstructured contracts are converted into structured data using a unified field specification. The change monitoring interval is set to ten minutes. Only authorized accounts are allowed to collect data within their authorized scope. Contract changes are detected in real time and automatically updated to form a standardized, secure, and traceable contract feature dataset.

[0055] The access results from transaction data collection, financial data collection, supply chain data collection, and contract data collection are integrated to form standardized transaction data, financial data, supply chain data, and contract data covering the entire access process of multi-source business data. The access results from these collections are uniformly integrated, and a multi-source data alignment and fusion algorithm is used to complete format alignment, field unification, time sequence calibration, and permission verification, forming standardized business data covering the entire access process. Format alignment converts transaction logs, financial vouchers, supply chain interaction logs, and structured contract data into a unified JSON structured format, unifying character encoding, numerical precision, and time format to eliminate differences in format from heterogeneous sources. Fields are uniformly renamed and mapped according to the standard business field system, merging synonymous fields from different systems to ensure that the names, types, and meanings of key fields in transaction, financial, supply chain, and contract data are completely consistent.

[0056] Time-series calibration uses transaction occurrence time, voucher generation time, interaction time, and contract signing time as benchmarks, uniformly correcting timestamps and arranging them in ascending order to ensure data continuity and traceability. Access verification applies uniform access marking to four types of data, categorized into four levels of sensitivity: public, internal, confidential, and core. Access and use adhere to access constraints to ensure data security. Data from different sources and formats, such as store POS transactions, online orders, financial vouchers, supply chain logistics, and business contracts, are integrated into a standardized dataset with the same structure, time sequence, and unified permissions. This dataset can be directly input into subsequent preprocessing and feature extraction modules, ensuring data consistency, availability, and security, and supporting multimodal fusion security situation awareness and compliance assessment.

[0057] S103, the preprocessing stage completes data format standardization, redundant information removal and compliance field normalization, extracts transaction behavior time sequence features, contract clause semantic association vectors, supply chain capital flow-logistics matching features, and financial compliance verification labels, and generates a business security and compliance special analysis dataset.

[0058] In one implementation, standardized transaction data, financial data, supply chain data, and contract data undergo a unified format conversion. The conversion process relies on a multi-source format normalization algorithm. The algorithm's input includes data source type, original storage format, encoding method, and field separator; the output is unified structured data and standard encoding. The algorithm uniformly converts text-based, tabular, log-based, and semi-structured data into a JSON structured format. The unified timestamp format is UTC+8. The unified numerical precision is two decimal places. The unified character encoding is UTF-8. The unified date format is year-month-day hour:minute:second. This algorithm eliminates format differences from different business systems, ensuring that subsequent modules can read and parse the data uniformly. Based on duplicate detection and invalid filtering rules, the format-normalized data undergoes cleaning. This step uses a combination of a duplicate data detection algorithm and invalid field filtering rules. The duplicate data detection algorithm calculates a unique hash value for each transaction record, contract clause, supply chain log, and financial document. Data with the same hash value is considered completely duplicated and directly removed. Invalid field filtering rules clean up completely empty fields, zero-space placeholder fields, test identifier fields, and extended memo fields without business meaning. Simultaneously, illegal data containing sensitive privacy information, violations, or redundancy is cleaned up, reducing data leakage and compliance risks. The cleaned data volume is effectively reduced, and data quality is significantly improved.

[0059] In accordance with regulatory requirements and business security assessment standards, compliance fields were normalized. The normalization process employed a unified compliance algorithm to standardize four key fields: amount, term, status, and proportion. Amount fields were uniformly converted to RMB and retained to two decimal places. Contract terms were uniformly converted to standard days. Transaction status, supply chain node status, and contract status were uniformly mapped to standard enumerated values. Account codes, risk levels, and compliance levels were uniformly mapped to a standard coding system. The normalization process simultaneously implemented data classification and grading requirements, marking core sensitive data with security levels to provide a basis for subsequent security control. After normalization, the compliance assessment dimensions for all business data were completely consistent, ensuring unified cross-data verification and assessment standards.

[0060] Based on normalized transaction data, a time-series feature extraction algorithm is used to extract time-series features of transaction behavior. The algorithm uses a fixed time window as the statistical unit, with inputs including transaction time, transaction amount, transaction channel, transaction object, and transaction result, and outputting a time-series feature vector. The extracted content includes transaction frequency per unit time, fluctuation value of transaction time interval, maximum transaction amount, minimum transaction amount, variance of transaction amount fluctuation, frequency of transaction channel switching, frequency of transaction object change, and percentage of abnormal transactions. This set of time-series features is used to characterize the patterns of transaction behavior, providing a temporal basis for abnormal transaction identification and risk assessment.

[0061] A semantic association parsing algorithm is used to analyze structured contract data, generating a high-dimensional semantic association vector. The algorithm's input includes the contract parties, contract amount, performance period, payment terms, liability for breach of contract, data security provisions, and scope of authorization. The output is a semantic feature vector of the contract. The algorithm first encodes the entities in each clause field, then calculates the strength of the association between entities, and finally associates the parties with the amount, the performance period with breach of contract, and the liability with authorization, forming a semantic vector that characterizes the overall compliance attributes and potential risks of the contract.

[0062] Based on supply chain data, a logistics-to-funds matching algorithm is used to establish the correspondence between logistics nodes and funds settlement nodes and extract matching features. The algorithm uses order number and logistics document number as the association key, with inputs including logistics node time, logistics completion percentage, funds settlement time, and funds settlement percentage. Outputs include matching degree features, synchronicity features, and deviation features. Matching degree characterizes the degree of consistency between logistics and funds flow. Synchronicity characterizes the time difference between logistics and funds flow. Abnormal deviation identifies mismatched data that exceeds the normal range.

[0063] Based on financial regulations and regulatory rules, a financial compliance verification algorithm is used to verify each item of financial voucher data and generate compliance tags. Verification includes debit / credit balance verification, account attribution verification, invoice validity verification, and settlement compliance verification. Debit / credit balance verification calculates the difference between the total debit amount and the total credit amount; a difference of zero indicates compliance, while a non-zero difference indicates anomaly. Account attribution verification compares the voucher account with the standard account system; consistency indicates compliance, while inconsistency indicates anomaly. Invoice and settlement verification are performed according to tax and financial rules, ultimately generating a unique compliance verification tag for each piece of financial data. Transaction time-series features, contract semantic vectors, supply chain matching features, and financial compliance tags are integrated using a feature fusion and assembly algorithm. The algorithm aligns fields, completes dimensions, correlates time sequences, and binds primary keys for the four types of features according to a unified data structure, forming a business security and compliance-specific assessment dataset containing complete business features and compliance identifiers. This dataset serves as the standard input for subsequent integrated strategy construction, batch splitting of datasets, and security situation assessment, ensuring data standardization, feature completeness, and reliability throughout the entire process.

[0064] S104 combines business value levels, real-time transaction clearing requirements, edge-cloud collaborative computing power allocation schemes, and regulatory compliance accuracy standards to construct an integrated strategy for multi-source data collection, cross-business feature alignment, and intelligent assessment of compliance risks.

[0065] In one implementation, multi-dimensional constraint matching technology is used to integrate and process the constraints of business security posture fusion, generating business value weight coefficients, real-time settlement thresholds, computing power scheduling quotas, and regulatory compliance verification benchmarks. This multi-dimensional constraint matching technology collects, analyzes, and quantifies all constraints of business security posture fusion, transforming business importance, real-time requirements, resource allocation limits, and compliance judgment standards into calculable and configurable parameters. All constraints are categorized into business-layer constraints, real-time constraints, resource-layer constraints, and compliance-layer constraints. Business-layer constraints characterize data value and impact scope. Real-time constraints limit the timeliness of processing and transmission. Resource-layer constraints define the usage boundaries of edge-cloud computing power. A new network security layer constraint is added, incorporating security resource allocation requirements such as DDoS defense, port protection, and unauthorized access interception. The compliance-layer constraint clarifies the minimum standards for regulatory verification. All four types of constraints are uniformly processed and quantified, converted into numerical parameters through standardized mapping, providing a calculable basis for subsequent strategy construction.

[0066] The integration is achieved through a weighted matching algorithm. The algorithm's inputs include the scope of business impact, data sensitivity level, real-time response requirements, computing power load limit, and compliance requirements. The algorithm internally uses fixed weighting coefficients to linearly weight the five inputs. The weighting coefficient for the scope of business impact is set to 0.25. The weighting coefficient for data sensitivity level is set to 0.25. The weighting coefficient for real-time response requirements is set to 0.2. The weighting coefficient for computing power load limit is set to 0.15. The weighting coefficient for compliance requirements is set to 0.15. First, each input is normalized, mapping the original values ​​to the range of 0 to 1. Then, a linear weighted sum is performed according to the aforementioned coefficients. Finally, the calculation results are mapped to four key benchmark parameters: business value weight coefficient, clearing real-time threshold, computing power scheduling quota, and regulatory compliance verification benchmark. The algorithm operates without human intervention, and the output can be directly used for strategy configuration.

[0067] The business value weighting coefficient is assigned based on the sensitivity level and impact scope of the business data. This coefficient is used to identify the importance of different business data in the integrated analysis. The assignment rule adopts a hierarchical quantification method. Data sensitivity levels are divided into four levels: core sensitive, important sensitive, generally sensitive, and non-sensitive. The business impact scope is divided into four levels: enterprise level, department level, team level, and single-point level. The two indicators are added together with equal weight to calculate the final coefficient. Core sensitive business with enterprise-level impact is assigned a weight of 1. Important sensitive business with department-level impact is assigned a weight of 0.75. Generally sensitive business with team-level impact is assigned a weight of 0.5. Non-sensitive business with single-point impact is assigned a weight of 0.25. Core transaction business belongs to core sensitive business with enterprise-level impact, so it is assigned a higher weight. Ordinary query business belongs to non-sensitive business with single-point impact, so it is assigned a lower weight. This forms a differentiated weighting system to ensure that high-value data occupies a higher priority in the analysis.

[0068] The real-time settlement threshold sets the maximum allowable delay based on transaction settlement timeliness requirements. This threshold constrains the upper limit of data processing and transmission time. The setting rules adopt a timeliness level matching method. Real-time settlement services include payment, settlement, and withdrawal scenarios, requiring no significant delay in data processing and transmission; the threshold is set at the second level, specifically ranging from 1 to 5 seconds. Near-real-time services include reconciliation, write-off, and synchronization scenarios, allowing for shorter delays; the threshold is set at the ten-second level, specifically ranging from 10 to 30 seconds. Ordinary services include statistics, archiving, and query scenarios, allowing for delays at the minute level; the threshold is set at the minute level, specifically ranging from 1 to 5 minutes. Real-time settlement services have the highest timeliness requirements, therefore a second-level threshold is used. Ordinary reconciliation services have lower timeliness requirements, therefore a minute-level threshold is used. Different thresholds effectively control the processing sequence, ensuring that high-timeliness services are executed first.

[0069] The computing power scheduling quota is allocated based on the hardware resources of edge nodes and cloud nodes, determining the proportion of computing power usage. This quota is used for resource scheduling in three stages: data processing, feature extraction, and model evaluation. The allocation rules are determined based on the node deployment location and task type. Edge nodes, located close to the data source, undertake real-time computing, lightweight evaluation, and local verification tasks, making them suitable for a high proportion of computing power allocation. Cloud nodes, possessing powerful computing capabilities, undertake complex computing, model training, and global evaluation tasks, making them suitable for a low proportion of computing power allocation. Edge-cloud computing power scheduling also considers the reservation of secure computing resources, ensuring priority execution of encrypted operations, risk detection, and security auditing tasks, with a standard allocation ratio of 70% for edge nodes and 30% for cloud nodes. When performing resource allocation, edge-cloud collaborative computing power scheduling will separately allocate dedicated security computing resources to support high-priority security tasks such as encrypted data transmission, message integrity verification, real-time risk identification, and compliance security auditing, ensuring that security-related computing is not squeezed out by ordinary business computing power. Encryption operations are used to ensure the confidentiality and integrity of multimodal data during edge-cloud transmission and storage; risk detection is used to identify security risks such as abnormal access, unauthorized operations, and data tampering in real time; and security auditing is used to retain the entire process operation trajectory and analysis records to meet regulatory traceability requirements. All of the above security tasks are included in the priority execution queue of computing power scheduling, ensuring priority supply of computing power during resource competition.

[0070] In the standard computing power allocation model, edge nodes undertake 70% of the computing power quota, mainly responsible for low-latency tasks such as real-time data acquisition, lightweight feature extraction, local risk assessment, and immediate security verification. Cloud nodes undertake 30% of the computing power quota, mainly responsible for computationally intensive tasks such as complex feature fusion, large-scale sample training, global situational analysis, cross-business risk correlation assessment, and compliance strategy iteration.

[0071] In high real-time scenarios, the edge node quota can be increased to 80%, while the cloud node quota can be reduced to 20%. In scenarios such as real-time transaction clearing, instant permission verification, and real-time supply chain reconciliation, to ensure millisecond-level response and rapid local processing, the computing power of edge nodes will be increased to 80%, strengthening the real-time encryption verification, anomaly blocking, and local analysis capabilities at the edge. The computing power of cloud nodes will be reduced to 20%, only undertaking necessary global aggregation and rule synchronization.

[0072] In highly complex assessment scenarios, the allocation of edge node power can be reduced to 60%, while the allocation of cloud node power can be increased to 40%. In complex computing scenarios such as deep fusion of multimodal features, compliance simulation across the entire business chain, long-term risk trend prediction, and cross-scenario correlation modeling, the computing power of edge nodes will be reduced to 60%, focusing on data preprocessing and basic feature extraction, while the computing power of cloud nodes will be increased to 40%, used to support high-precision model calculations, large-scale data comparisons, and in-depth risk analysis.

[0073] Allocating computing power quotas by 70% to edge nodes and 30% to cloud nodes ensures real-time performance while fully leveraging the advantages of cloud computing power, achieving optimal efficiency in edge-cloud collaboration. This standard allocation meets the low-latency, high-response business and security requirements of the edge, while also enabling the cloud to handle highly complex and computationally intensive analysis and management tasks. It balances data security control, real-time business processing, and global situational awareness, achieving simultaneous improvement in edge-cloud collaboration efficiency and security protection capabilities.

[0074] The regulatory compliance verification benchmark sets minimum standards for compliance judgment based on industry regulatory requirements. The benchmark content includes field completeness, operational legality, risk tolerance, data accuracy, and process traceability. The financial data verification benchmark specifies a zero deviation in the balance of debit and credit in financial documents. The contract data verification benchmark specifies a 100% completeness rate for key contract terms. The transaction data verification benchmark specifies a transaction element missing rate of less than 1%. The supply chain data verification benchmark specifies a logistics and cash flow matching deviation of less than 2%. The authorized operation verification benchmark specifies a zero rate of unauthorized operations. All benchmark values ​​are mandatory judgment standards; only by meeting the benchmarks can compliance be determined. Failure to meet the benchmarks results in direct marking as abnormal, triggering a verification failure prompt and risk handling process. This benchmark provides a unified standard for compliance assessment throughout the entire process, ensuring that the assessment results comply with industry regulatory requirements.

[0075] The process integrates the requirements for building an integrated strategy, cross-business feature alignment rules, intelligent judgment execution timing, and edge-cloud collaboration adaptation logic. It establishes quantitative mapping relationships across the data collection, alignment, judgment, and collaboration dimensions, generating a strategy construction benchmark adapted to business scenarios and regulatory requirements. The overall requirements for building the integrated strategy, cross-business feature alignment rules, intelligent judgment execution timing, and edge-cloud collaboration adaptation logic are systematically integrated. This integration process relies on a four-dimensional strategy fusion algorithm. The algorithm's inputs are the strategy construction objective, feature alignment standard, judgment execution cycle, and edge-cloud collaboration mode. The output is a quantitative mapping relationship table for the data collection, alignment, judgment, and collaboration dimensions. The algorithm decomposes the four requirements into quantifiable indicators, eliminates dimensional differences through normalization, and then performs fusion calculations with fixed weights to form a unified four-dimensional mapping rule, providing a stable benchmark for subsequent strategy construction.

[0076] The data collection dimension corresponds to the sources and types of multi-source data, covering transaction data sources, financial data sources, supply chain data sources, contract data sources, and access control data sources. Each data source is labeled with its source system, data type, update frequency, and sensitivity level. The alignment dimension corresponds to unified matching rules for different business characteristics, including alignment of transaction time sequence features, contract semantic features, supply chain cash flow and logistics features, and financial compliance features. All features are matched according to a unified timeline and unified field standards. The analysis dimension corresponds to the computational logic of risk identification, including four types of computational rules: anomaly detection, compliance verification, correlation analysis, and trend prediction. Each rule is bound to input features and output results. The collaboration dimension corresponds to the division of labor and cooperation between edge and cloud nodes, clarifying that edge nodes are responsible for real-time computation and local response, while cloud nodes are responsible for global analysis and model iteration, and defining data interaction formats and scheduling instructions.

[0077] The correspondence between the four dimensions is established through a dimensional mapping formula. The dimensional mapping formula is as follows: the output value of the acquisition dimension multiplied by the feature matching coefficient, plus the output value of the alignment dimension multiplied by the correlation coefficient, equals the input value of the judgment dimension; the output value of the judgment dimension multiplied by the collaborative scheduling coefficient equals the execution parameter of the collaborative dimension. The feature matching coefficient, correlation coefficient, and collaborative scheduling coefficient are all pre-calculated by a constraint-weighted matching algorithm. Using the acquisition dimension as the basic input, the alignment dimension as the matching condition, the judgment dimension as the output target, and the collaborative dimension as the execution guarantee, a stable and reusable strategy construction benchmark is formed. For hybrid business scenarios involving transactions, finance, and supply chain, the algorithm automatically establishes a one-to-one correspondence between transaction data acquisition, cross-domain feature alignment, real-time risk assessment, and edge-cloud collaborative execution, binding transaction data input, feature alignment rules, risk assessment models, and edge-cloud scheduling methods item by item to form a dedicated strategy construction benchmark adapted to this scenario.

[0078] Based on the strategy, core configuration elements are extracted using benchmarks. The system uses business value level as the stratification basis, real-time settlement as the timing constraint, computing power allocation as the resource boundary, and compliance accuracy as the judgment benchmark. Parameter definitions for the data collection link, alignment window, analysis model, and collaborative nodes are defined sequentially. Business value level is divided into four layers: core business, important business, general business, and ordinary business. Real-time settlement is divided into four levels: seconds, tens of seconds, minutes, and hours. Computing power allocation has its upper limit determined by the ratio of edge to cloud. Compliance accuracy is set with judgment thresholds in three levels: high, medium, and low. These four benchmarks jointly constrain the entire parameter definition process, ensuring that parameters meet business and regulatory requirements.

[0079] The data acquisition link prioritizes data acquisition and determines transmission paths based on business value levels. Core businesses are configured with dedicated acquisition links and independent transmission channels, with the highest priority. Important businesses are configured with dedicated links, with the second highest priority. General and ordinary businesses share common links, with priorities decreasing sequentially. High-value business data prioritizes transmission resources to ensure uninterrupted and delay-free acquisition. The alignment window sets the feature alignment time window based on the real-time threshold of clearing. Real-time clearing businesses use short windows of one to five seconds to ensure rapid feature alignment. Near-real-time businesses use medium windows of ten to thirty seconds. Non-real-time businesses use long windows of one to five minutes to reduce computational pressure. The window length directly determines the timeliness and accuracy of feature matching. The analysis model limits model complexity and computational load according to computing power scheduling quotas. Edge nodes have lower computing power quotas, using lightweight rule models and shallow neural networks to ensure resource consumption does not exceed limits. Cloud nodes have sufficient computing power to run deep feature extraction models and correlation analysis models. The model scale and computing power resources are strictly matched to ensure stable and continuous operation.

[0080] Collaborative nodes allocate execution responsibilities between edge nodes and cloud nodes based on compliance accuracy benchmarks. Judgment tasks requiring high compliance accuracy and real-time response are executed on edge nodes. Analysis tasks requiring high compliance accuracy and complex computations are executed on cloud nodes. Edge nodes are responsible for real-time result return, while cloud nodes are responsible for model optimization and global situational awareness aggregation. For high-value real-time clearing operations, the system automatically configures high-priority dedicated data collection links, sets a three-second short alignment window, adopts a lightweight real-time analysis model, and allocates 80% of edge computing power, forming a collaborative approach with edge nodes as the primary and cloud as the secondary, meeting both real-time and security requirements. Based on business data scale, real-time edge and cloud computing load, regulatory response time requirements, and feature association complexity, the defined core strategy parameters are dynamically calibrated and iteratively optimized. The calibration and optimization process uses a real-time feedback calibration algorithm. The algorithm inputs current data volume, edge CPU utilization, cloud memory usage, regulatory response time, and feature association quantity, and outputs parameter correction values. The algorithm adjusts based on the deviation between current operating indicators and target indicators, periodically correcting data collection parallelism, computing power utilization ratio, analysis priority, and interaction protocol.

[0081] As the scale of business data increases, the algorithm automatically increases the parallelism of data collection and the number of synchronization threads to avoid data backlog. When the edge cloud computing load is too high, the algorithm reduces the computing power usage of non-core tasks and suspends unnecessary statistical calculations to ensure the normal operation of core analysis tasks. When regulatory response timelines tighten, the algorithm prioritizes analysis execution, shortens the analysis cycle, and accelerates result output. When the complexity of feature associations increases, the algorithm optimizes feature matching rules, simplifies redundant association calculations, and improves execution efficiency. After multiple rounds of iterative optimization, the execution priorities, interaction protocols, and scheduling mechanisms for multi-source data collection, cross-business feature alignment, and intelligent compliance risk analysis are clearly defined, forming an integrated strategy for multi-source data collection, cross-business feature alignment, and intelligent compliance risk analysis that covers the entire process, is dynamically adaptable, and meets the needs of business security situation awareness and management. This strategy can automatically adjust with changes in business scenarios, always maintaining efficient, stable, and compliant operation.

[0082] S105 splits the dataset according to business scenarios, generates processing batches containing standardized operating baselines, compliance risk anomaly labels, and regulatory compliance attribute verification items, and achieves edge-cloud collaborative asynchronous transmission and data synchronization verification through an encrypted channel.

[0083] In one implementation, multi-dimensional constraint analysis technology is used to integrate and process the standardization requirements of the business security assessment dataset, generating standardized operational baselines, compliance risk anomaly labels, regulatory compliance attribute verification items, and business scenario classification benchmark data. Multi-dimensional constraint analysis technology is used to uniformly collect and parse the standardization requirements of the business security assessment dataset, transforming the four core requirements of data standardization, anomaly identification, compliance verification, and scenario classification into executable processing rules. The collection process covers five types of data: transactions, finance, supply chain, contracts, and permission operations. The parsing process transforms business language into field rules, threshold rules, logical rules, and classification rules, forming a rule base that can be directly loaded and run. All standardization operations are processed through a multi-dimensional feature standardization algorithm. The input items of the multi-dimensional feature standardization algorithm include four items: operational behavior, risk status, compliance attributes, and scenario type within the dataset. Operational behavior is taken from transaction time sequence characteristics and permission operation trajectories. Risk status is taken from anomaly identification results and deviation characteristics. Compliance attributes are taken from financial verification labels and contract compliance markers. Scenario type is taken from business source and data purpose. The algorithm sequentially executes five steps: feature extraction, rule matching, standardized mapping, label generation, and scenario classification. It ultimately outputs four types of benchmark data: standardized operation baseline, compliance risk anomaly labels, regulatory compliance attribute verification items, and business scenario classification benchmark.

[0084] Standardized operational baselines are used to establish reference standards for normal business operations. These baselines are generated based on a baseline statistical algorithm. The algorithm takes historical normal data from fifteen consecutive calendar days as input, and statistically analyzes characteristic values ​​such as transaction frequency, transaction amount range, operational procedures, contract fulfillment milestones, and frequency of permission usage at fixed intervals. It then calculates the mean and fluctuation range to form a normal behavior range. Normal behavior data, such as transaction frequency, permission operation procedures, contract fulfillment procedures, supply chain reconciliation cycles, and financial accounting patterns within a fixed period, are then uniformly standardized into standard business operation baseline data. For example, in a retail transaction scenario, a normal transaction cycle is defined as 900 to 1800 seconds per day, and a normal transaction frequency is defined as five to twenty transactions per minute, thus forming the transaction operation baseline.

[0085] Compliance risk anomaly tags are used to identify abnormal behaviors that deviate from the baseline. These tags are generated based on an anomaly deviation judgment algorithm, which compares real-time data with standardized operational baselines item by item to calculate the degree of deviation. Deviations exceeding a set threshold are marked as abnormal and categorized into three levels: mild, moderate, and severe. Transactions exceeding normal amounts, unauthorized permission changes, missing key contract terms, mismatches between supply chain logistics and cash flow, and imbalances in financial document debits and credits are tagged with the corresponding level of anomaly. For example, a single transaction exceeding three times the baseline average is marked as a severe anomaly, outbound permission operations outside of working hours are marked as moderate anomalies, and missing contract payment terms are marked as severe anomalies. Regulatory compliance attribute verification items are used to record whether regulatory requirements are met. These verification items are generated based on a compliance item-by-item verification algorithm. The algorithm sets verification rules according to industry regulatory provisions and performs item-by-item judgment on each piece of data, with the judgment result categorized as compliant or non-compliant. Fixed verification items include the completeness of financial documents, the legality of contract terms, the traceability of supply chain data flow, the completeness of transaction elements, and the compliance of permission operations. For example, financial document verification items include debit and credit balance, correct account entries, and valid invoices. Contract verification items include legal parties, clear amounts, and complete liability for breach of contract. Supply chain verification items include traceable nodes and complete interaction logs. If all verification items are met, the system is marked as compliant; if any item is not met, the system is marked as non-compliant.

[0086] Business scenario classification benchmark data is used to distinguish different business types. This benchmark is generated based on a scenario feature matching algorithm. The algorithm divides data into five major scenarios—transaction settlement, contract management, supply chain collaboration, financial accounting, and access control—according to data source, business purpose, processing flow, and regulatory attributes. Each scenario is assigned a unique scenario code and name, forming the scenario classification benchmark. For example, store POS transactions, online orders, and third-party payment records are classified into the transaction settlement scenario. Sales contracts, purchase contracts, and service agreements are classified into the contract management scenario. Manufacturer and supplier order interactions, logistics trajectories, and interface logs are classified into the supply chain collaboration scenario. Accounting vouchers, invoices, and income and expenditure details are classified into the financial accounting scenario. User login, permission allocation, and data export are classified into the access control scenario. The scenario classification results serve as the basis for subsequent dataset splitting, edge-cloud transmission, and analysis and execution.

[0087] This process integrates and processes the requirements for batch splitting of datasets, edge-cloud collaborative transmission constraints, feature verification rules, and encryption channel adaptation requirements. It establishes precise splitting relationships among baseline features, anomaly features, compliance features, and scenario features, generating a batch splitting strategy adapted for edge-cloud collaboration and real-time analysis. The process systematically integrates these requirements. The splitting process adheres to the principle of minimum necessity for data security, preventing unauthorized cross-scenario dissemination of sensitive data and reducing the risk of data leakage in the transmission link. The integration process relies on a full-process constraint aggregation algorithm. The algorithm's inputs are batch splitting rules, edge-cloud node bandwidth, feature verification dimensions, and encryption algorithm type. The outputs are four full-process constraints: data splitting conditions, transmission rate limit, verification trigger timing, and encryption channel configuration. The algorithm decomposes these four requirements into executable parameters and integrates them into a unified scheduling and control system, providing a complete constraint basis for subsequent feature splitting and batch construction.

[0088] The principle of minimum necessity for data security is applied throughout the entire dataset splitting process. The system extracts only the minimum set of fields required for security assessment and compliance verification, and does not collect business information irrelevant to the current scenario. For different business scenarios such as transactions, finance, supply chain, contracts, and access control, the scope of data use and flow boundaries are strictly limited, prohibiting the cross-reuse of core sensitive data in unauthorized scenarios, thus blocking unauthorized data flow and unnecessary dissemination at the source. In the edge-cloud transmission stage, multiple measures such as field anonymization, scope limitation, and access isolation are used to further reduce the potential risks of data theft, tampering, or leakage during transmission, ensuring the security of multimodal business data throughout its entire lifecycle of splitting, transmission, and use.

[0089] The end-to-end constraint aggregation algorithm uniformly handles all constraints related to dataset splitting, edge-cloud transmission, feature verification, and encryption adaptation. It takes pre-defined batch splitting rules, actual bandwidth resources of edge-cloud nodes, required dimensions for feature verification, and the type of encryption algorithm used as input. Through internal quantization and rule mapping, it outputs four directly executable end-to-end constraints: data splitting conditions, transmission rate cap, verification trigger timing, and encryption channel configuration. The data splitting conditions clarify the criteria and boundary rules for dividing data in different scenarios and risk levels. The transmission rate cap is set based on edge-cloud bandwidth and real-time business requirements to ensure stable and uncongested transmission. The verification trigger timing determines the verification nodes and execution sequence before and after data transmission and analysis. The encryption channel configuration specifies the encryption protocol, encryption strength, and key management method used for transmission.

[0090] The algorithm breaks down the four core requirements mentioned above into configurable, schedulable, and executable runtime parameters. All parameters are uniformly incorporated into the system's scheduling and control framework, achieving unified rules, timing, permissions, and security. This process provides a complete and consistent set of constraints for subsequent precise feature segmentation, batch data construction, asynchronous edge-cloud transmission, and security verification, ensuring that the entire processing flow complies with data security standards, regulatory compliance requirements, and business operation logic, thereby improving the security, standardization, and reliability of multimodal data processing.

[0091] A precise feature splitting algorithm establishes the correspondence and segmentation relationships between baseline features, anomaly features, compliance features, and scenario features. The algorithm takes four types of features as input, first calculating the correlation between features, and then defining splitting boundaries based on independence and analytical purpose. Baseline features, used to characterize normal business behavior, are separately classified into a basic feature group. Anomaly features, used to identify deviations, are classified into a risk feature group. Compliance features, used for regulatory verification and judgment, are classified into a compliance feature group. Scenario features, used to distinguish business types, are classified into a classification feature group. The algorithm determines the field range, storage structure, concatenation method, and isolation rules for each type of feature, forming a batch splitting strategy for datasets adapted to edge-cloud collaborative computing and real-time risk assessment. For scenarios where enterprises simultaneously possess four types of data—transaction, financial, contract, and supply chain—splitting is performed according to dual constraints of scenario and feature type. Baseline features, anomaly features, and compliance features within the same business scenario are merged into one group. Different scenarios are independently split using physical isolation. The transaction scenario data group includes transaction time-series baselines, transaction anomaly labels, and transaction compliance items. The financial scenario data group includes financial accounting baselines, financial anomaly labels, and financial compliance items. The supply chain scenario data group includes logistics collaboration baselines, supply chain deviation tags, and circulation compliance items. The contract scenario data group includes performance baselines, contract missing tags, and clause compliance items. Each data group is stored and transmitted independently to ensure data integrity and non-interference during edge-cloud transmission.

[0092] Based on a batch-based splitting strategy, core configuration requirements are extracted. Using business scenario type as the input dimension, compliance risk level as the key parameter, and regulatory verification timing as the splitting basis, four core parameters—batch length, feature dimensions, tag embedding position, and transmission timing—are scientifically set. Batch length is determined based on the data volume of the business scenario. High-real-time scenarios have strict data processing latency requirements and use shorter batch lengths. Non-real-time scenarios have less data processing pressure and use longer batch lengths. For real-time transaction clearing scenarios, the batch length is set to 100 to 500 records. For ordinary financial reconciliation scenarios, the batch length is set to 1000 to 2000 records. Feature dimensions are divided according to transaction timing features, contract semantic features, supply chain matching features, and financial verification tags. Each type of feature remains independent and does not overlap or merge. Transaction scenarios retain complete timing feature dimensions. Contract scenarios retain complete semantic feature dimensions. Supply chain scenarios retain complete matching feature dimensions. Financial scenarios retain complete verification tag dimensions.

[0093] The label embedding location embeds compliance risk anomaly labels and regulatory compliance attribute verification items into fixed positions within the corresponding batch of data. Anomaly labels are uniformly embedded in the header of each data entry. Compliance verification items are uniformly embedded in the tail of each data entry. Fixed position settings improve reading and identification efficiency and reduce analysis time. Transmission sequence follows the regulatory verification sequence. High-priority risk data is allocated transmission resources first and transmitted first. Ordinary compliance data is transmitted later. The higher the risk level, the earlier the transmission sequence. For real-time transaction clearing scenarios, a shorter batch length of 100 to 500 records is set. Complete transaction feature dimensions are preserved. Anomaly labels are embedded in the data header. The transmission order is set according to the real-time clearing sequence. This ensures that data can be immediately analyzed upon arrival at the edge node, meeting real-time and identification efficiency requirements. Combining data transmission throughput, real-time analysis computational intensity, and compliance verification accuracy priority requirements, the set core splitting parameters are quantitatively adjusted through a batch parameter calibration optimization algorithm. The batch parameter calibration optimization algorithm aims to improve transmission efficiency, computational load, and verification accuracy. It takes current bandwidth throughput, edge CPU utilization, and compliance verification priority as input, and outputs the corrected batch weight, segmentation range, and synchronization transmission rules. Batch weights are allocated according to compliance verification accuracy priority. High-risk scenarios are assigned higher weights, prioritizing the allocation of transmission bandwidth and computational resources. Normal scenarios have correspondingly lower batch weights.

[0094] The segmentation range is determined based on the transmission throughput. When the transmission throughput is high, the segmentation range is appropriately expanded. When the transmission throughput is low, the segmentation range is narrowed. This avoids transmission congestion and processing delays caused by excessively large batches of data. Synchronous transmission rules are formulated according to the edge-cloud collaborative computing power allocation requirements. Edge nodes are responsible for real-time data reception and rapid analysis. Cloud nodes are responsible for global aggregation and in-depth analysis. The rules clearly define the data transmission timing, synchronization cycle, and response mechanism between edge nodes and cloud nodes. After calibration and optimization, the batch weights, segmentation ranges, and synchronous transmission rules for various features are clarified, ultimately generating standardized security analysis data processing batches that meet the requirements of multimodal business data processing, edge-cloud collaborative asynchronous transmission, and data synchronization verification. In high-concurrency business scenarios, the batch parameter calibration and optimization algorithm automatically reduces the batch segmentation range to within two hundred entries. The batch weight of high-risk data is increased to above 0.8. A timed synchronization mechanism is set between edge nodes and cloud nodes every thirty seconds. This ensures stable data transmission, real-time analysis, and accurate verification, supporting continuous awareness of business security posture under high concurrency conditions.

[0095] S106 learns the mapping relationship between multi-dimensional features and business compliance status and transaction risk evolution path through a business scenario adaptive dynamic weight algorithm. Based on the business data credibility classification, feature correlation strength quantification, and dynamic feedback of judgment accuracy, it optimizes model parameters. Combined with business scenario type, compliance supervision level, and industry regulatory rule library, it dynamically adapts compliance risk judgment threshold, cross-business risk matching rules, and graded disposal instruction triggering conditions to generate compliance perception results and full-process compliance management implementation plan.

[0096] In one implementation, multi-dimensional constraint analysis technology is used to uniformly analyze and quantify the various requirements for assessing business compliance status. This transforms four core requirements—data reliability, feature correlation, assessment accuracy, and risk change trends—into calculable indicators. The analysis process covers five categories of business data: transactions, finance, supply chain, contracts, and access control. It converts business compliance judgment rules into numerical scoring standards and threshold conditions, forming a quantitative system that can be directly used for model calculations. The entire quantification process is implemented using a multi-dimensional status quantification algorithm.

[0097] The multi-dimensional situational quantification algorithm uses business data integrity, feature matching degree, historical judgment accuracy, and continuous risk change value as fixed inputs. The algorithm has a four-layer computational structure: an input standardization layer, a weighted calculation layer, a trend fitting layer, and an output mapping layer. The input standardization layer maps the four types of input data to the zero-to-one interval, eliminating dimensional differences. The weighted calculation layer performs weighted summation according to preset weights: business data integrity (0.3), feature matching degree (0.3), historical judgment accuracy (0.25), and continuous risk change value (0.15). The trend fitting layer performs sliding window calculation on the continuous risk change value, extracting the risk escalation rate, descent rate, and stability features. The output mapping layer combines the weighted results with trend features, outputting four quantitative data items: business feature credibility index, feature correlation strength coefficient, judgment accuracy benchmark, and risk evolution trend quantitative data. The algorithm is fully automated, and the output results are directly used for subsequent dynamic weight learning and model optimization.

[0098] The Business Feature Credibility Index measures the authenticity and validity of collected data. This index is calculated by an algorithm based on the completeness of business data, ranging from zero to one; the closer the value is to one, the more credible the data. The index is generated by dividing the number of complete fields by the total number of key fields, and then adjusting for data source legitimacy and verification results. Data with complete transaction logs and passing MD5 verification, legitimate financial documents and passing loan balance verification, complete contract terms and valid signatures, complete and uninterrupted supply chain logs, and continuous and unbroken access operation traces are assigned a credibility value close to one. Data with more than 10% missing fields, sources that have not passed authentication verification, or data that has been tampered with or repeatedly reported, has a credibility value reduced accordingly based on the proportion of missing fields and the degree of anomaly. For example, a complete and verified transaction log has a credibility value of 0.95. A financial document missing one key field has a credibility value of 0.7. Data with an unknown source and signs of tampering has a credibility value below 0.5. This index provides a direct basis for data filtering and weight allocation.

[0099] The feature association strength coefficient characterizes the degree of association between four types of features: transaction, contract, supply chain, and finance. This coefficient is calculated by an algorithm based on feature matching degree, and its value ranges from zero to one; a higher value indicates a stronger association. The coefficient is generated by comparing the consistency of cross-business features field by field, calculating the proportion of matching fields to the total number of associated fields. For example, if the transaction amount is completely consistent with the contract amount, the transaction order number is completely consistent with the supply chain order number, the financial settlement amount is completely consistent with the actual transaction amount received, and the contract performance period is completely consistent with the supply chain delivery period, the association strength of these features is assigned a value higher than 0.9. If there is a deviation between the transaction amount and the contract amount, an incomplete matching of the order number, or a difference between the settlement amount and the actual amount received, the association strength of these features is reduced proportionally to the deviation. For instance, if the transaction amount is completely consistent with the contract amount, the association strength coefficient is 0.95. If the deviation is within one percent, the association strength coefficient is 0.8. If the deviation exceeds five percent, the association strength coefficient is lower than 0.6. This coefficient determines the weighted proportion of cross-business features in the analysis.

[0100] The accuracy benchmark is a value set based on historical correct judgment results and serves as a reference standard for this model optimization. This benchmark is calculated by the algorithm based on historical judgment accuracy and ranges from zero to one. The benchmark generation rule is to select historical judgment data from the past thirty days, calculate the number of correct judgments divided by the total number of judgments, and obtain the historical accuracy rate. The historical accuracy rate is then multiplied by a correction coefficient, which is dynamically adjusted according to the stability of the business scenario to generate the judgment accuracy benchmark. If the scenario is stable and without significant changes, the correction coefficient is set to one. If the scenario fluctuates significantly, the correction coefficient is set to 0.95. If all historical judgments were correct, the benchmark value is set to 0.95. If the historical accuracy rate is higher than 90%, the benchmark value is set to 0.9. If the historical accuracy rate is lower than 80%, the benchmark value is set to 0.8. This benchmark serves as a target reference for model optimization, used to determine whether the current judgment effect meets the standard.

[0101] The risk evolution trend quantification data numerically represents the trends of risk increase, decrease, and stagnation, used to determine risk direction. This data is calculated by an algorithm based on continuous risk changes and a trend fitting layer, with values ​​ranging from -1 to +1. A positive value indicates increasing risk, with a larger value indicating a faster rate of increase. A negative value indicates decreasing risk, with a smaller value indicating a faster rate of decrease. A value of zero indicates stable risk. The trend generation rule involves selecting risk scores at ten consecutive time points, calculating the risk difference between adjacent time points, obtaining the average rate of change, and then normalizing the result. If the risk score continuously increases and the average rate of change is higher than 0.05, the quantification data is set to 0.8 to 1. If the risk score continuously decreases and the average rate of change is lower than -0.05, the quantification data is set to -1 to -0.8. If the risk score fluctuates less than 0.02, the quantification data is set to -0.2 to 0.2. For example, a continuously rapidly increasing risk score is quantified as 0.9. A continuously decreasing risk score is quantified as -0.8. No significant fluctuation in the risk score is quantified as 0.1. This data provides a trend basis for risk warning and response strategies.

[0102] This process integrates and processes adaptive dynamic weight learning requirements, scenario adaptation standards, cross-business feature association rules, and situation assessment adaptation requirements. It establishes a precise matching relationship between feature input, weight allocation, situation mapping, and risk assessment, generating a dynamic weight learning strategy adapted to specific business scenarios. The integration process relies on a four-dimensional requirement fusion algorithm. The algorithm's inputs are the learning objective, scenario type, feature association relationship, and assessment accuracy requirements. The output consists of four core execution elements: feature input rules, weight allocation logic, situation mapping method, and risk assessment conditions. The algorithm decomposes these four requirements into quantifiable configuration items, forming unified constraints through normalization and weighted fusion. This clarifies the fixed correspondence between feature input, weight allocation, situation mapping, and risk assessment, providing a stable execution framework for dynamic weight learning.

[0103] A stable mapping relationship is established through a feature-weight precise matching algorithm, forming a dynamic weight learning strategy. The feature-weight precise matching algorithm comprises a four-layer structure: a feature input layer, a weight calculation layer, a situation mapping layer, and a risk assessment layer. Data is transmitted between layers using a fully connected approach, with the output of the upper layer directly serving as the input of the lower layer. The feature input layer receives transaction time-series features, contract semantic vectors, supply chain matching features, and financial compliance labels. The weight calculation layer calculates dynamic weighting coefficients based on business scenarios and data credibility. The situation mapping layer maps the weighted features to a compliance situation score, and the risk assessment layer outputs the risk level based on the situation score and a threshold.

[0104] The algorithm training process consists of four steps. The first step loads historical business data and analysis results to construct a training sample library. The second step initializes the weight coefficients of each feature, with the analysis accuracy as the optimization objective. The third step uses gradient descent to iteratively update the weights, reducing analysis error. The fourth step saves the converged weight mapping relationship, forming a dynamic weight learning strategy that can be run online. Key parameters include the learning rate, number of iterations, weight decay coefficient, and mapping error threshold. The learning rate is set to 0.01, the number of iterations to 100 rounds, the weight decay coefficient to 0.001, and the mapping error threshold to 0.02. This strategy guides the algorithm to automatically adjust the importance of each feature according to different business scenarios, achieving a precise alignment between the analysis logic and actual business. The strategy incorporates scenario feature priority rules, with different feature weight configurations corresponding to different business scenarios.

[0105] Real-time clearing scenarios prioritize transaction timeliness and fund security, increasing the weight of transaction timing features while decreasing the weight of other features, focusing on identifying risks such as abnormal transaction frequency, sudden changes in amount, and unauthorized channel switching. Contract performance scenarios prioritize clause compliance and liability stipulations, increasing the weight of semantic features in contract clauses, focusing on identifying risks such as missing parties, abnormal amounts, conflicting deadlines, and invalid default clauses. Supply chain collaboration scenarios prioritize the matching of logistics and capital flows, increasing the weight of capital flow-logistics matching features, focusing on identifying risks such as delivery delays, settlement anomalies, and inconsistent node data. Financial accounting scenarios prioritize voucher compliance and account balance, increasing the weight of financial compliance verification labels, focusing on identifying risks such as loan and debit imbalances, incorrect accounts, and invalid invoices. Multi-business hybrid scenarios dynamically allocate the proportion of each feature according to the business value weight coefficient to ensure accurate overall analysis.

[0106] In real-time clearing scenarios, the algorithm increases the weight of transaction timing features to above 0.5, decreases the weight of contract features to below 0.1, decreases the weight of supply chain features to below 0.1, and sets the weight of financial features to 0.2 to 0.3, emphasizing the identification of abnormal transaction behavior. In contract performance scenarios, the algorithm increases the weight of contract clause semantic features to above 0.5, decreases the weight of transaction features to below 0.2, decreases the weight of supply chain features to below 0.1, and sets the weight of financial features to 0.2 to 0.3, emphasizing the identification of contract compliance. In supply chain collaboration scenarios, the algorithm increases the weight of cash flow-logistics matching features to above 0.5, decreases the weight of transaction features to below 0.2, decreases the weight of contract features to below 0.1, and sets the weight of financial features to 0.2 to 0.3, emphasizing the identification of consistency among the three flows (cash, logistics, and funds). Through these dynamic weight adjustments, the analysis output aligns with actual business needs, improving the accuracy of anomaly identification and the rationality of compliance determination.

[0107] Based on a dynamic weighted learning strategy, core configuration requirements are extracted. Using multimodal business features as input dimensions, data credibility grading as a key parameter, and feature association strength as the criterion, a parameter adaptive configuration model is constructed. This model comprises an input parsing module, a parameter calculation module, a rule constraint module, and an output solidification module, which are executed sequentially. The input parsing module receives transaction time-series features, contract semantic vectors, supply chain matching features, and financial compliance labels. The parameter calculation module performs numerical calculations based on data credibility and feature association strength. The rule constraint module limits parameter value boundaries based on business scenarios and regulatory requirements. The output solidification module converts the calculation results into executable parameters. Through hierarchical calculation and constraint verification, the model achieves scientific setting of the three core parameters: adaptive learning rate, dynamic weighting coefficient, and situational mapping accuracy.

[0108] The adaptive learning rate adjusts the learning speed based on the data's reliability. The learning rate configuration uses a reliability-based segmented mapping method. Data reliability values ​​range from 0 to 1. High-quality data with a reliability higher than 0.9 has a learning rate set to 0.001 to 0.005. Qualified data with a reliability between 0.7 and 0.9 has a learning rate set to 0.01 to 0.03. Low-quality data with a reliability lower than 0.7 has a learning rate set to 0.05 to 0.1. A smaller learning rate is used for high-reliability data to ensure smoother model weight updates and improve judgment stability. A larger learning rate is used for low-reliability data to accelerate model convergence and quickly correct biases. The learning rate update cycle is synchronized with the dataset batches; the learning rate is automatically recalculated and updated after each batch of data is evaluated.

[0109] Dynamic weighted coefficients are assigned values ​​based on the strength of feature correlation to determine the degree of influence of each feature on the assessment results. The weighted coefficient allocation adopts a linear mapping rule based on correlation strength. The feature correlation strength ranges from 0 to 1. Strongly correlated features (correlation strength above 0.9) have coefficients set to 0.5 to 0.7. Moderately correlated features (correlation strength between 0.6 and 0.9) have coefficients set to 0.2 to 0.4. Weakly correlated features (correlation strength below 0.6) have coefficients set to 0.05 to 0.1. The sum of all feature weighted coefficients is one. Transaction time-series features, contract semantic features, supply chain matching features, and financial compliance labels each receive corresponding coefficients based on their correlation strength; the higher the strength, the larger the coefficient, and the greater its contribution to the final compliance status score and risk assessment results.

[0110] The situation mapping accuracy is used to set the allowable range of mapping error between features and compliance situations, ensuring accurate and reliable judgment results. The mapping accuracy setting adopts an error threshold constraint rule. The accuracy value range is 0 to 0.1. The allowable mapping error range for high-precision scenarios is set to within 0.02. The allowable mapping error range for medium-precision scenarios is set to within 0.05. The allowable mapping error range for general-precision scenarios is set to within 0.1. The higher the mapping accuracy, the more rigorous the fit between features and situations. During the situation mapping process, the model calculates the deviation between the predicted value and the actual value in real time. When the deviation exceeds the allowable accuracy range, weight recalibration is immediately triggered to ensure stable and reliable output results. Example parameter settings are performed for core transaction data with high credibility and high correlation strength. Data credibility is higher than 0.9, and the adaptive learning rate is set to 0.002. Feature correlation strength is higher than 0.9, and the dynamic weighting coefficient is set to 0.6. The situation mapping accuracy is set to 0.02. A small learning rate makes model updates smoother and avoids weight oscillations. A high weighting coefficient highlights the core position of transaction time-series features. High-precision constraints ensure that the situation scoring error is extremely small. The combination of three parameters enables the model to make stable and accurate judgments on core transaction data, and effectively identify high-risk behaviors such as abnormal transaction frequency, sudden changes in amount, and illegal switching of channels.

[0111] By combining model optimization and adaptation strength with compliance assessment priority requirements, the core configuration parameters are quantitatively calibrated and optimized. The allocation rules for learning weights, mapping coefficients, and matching accuracy, the feature association range, and the comprehensive assessment logic are clarified, generating dynamic weight optimization and compliance assessment parameters that meet the adaptive requirements of business scenarios. Combining model optimization and adaptation strength with compliance assessment priority, a dynamic weight adaptive calibration algorithm is used to quantitatively adjust the three core parameters: adaptive learning rate, dynamic weighting coefficients, and situation mapping accuracy. The algorithm aims to improve assessment accuracy. Using business scenario type, data credibility, feature association strength, and compliance verification level as input conditions, it unifies and clarifies the rules for learning weight allocation, mapping coefficient calculation, matching accuracy constraints, feature association range, and comprehensive assessment logic, ultimately generating dynamic weight optimization and compliance assessment parameters that meet the adaptive requirements of business scenarios.

[0112] The dynamic weighted adaptive calibration algorithm comprises four layers: a parameter input layer, a bias calculation layer, an adaptive correction layer, and a parameter output layer. These layers are connected sequentially, with the output of one layer directly serving as the input to the next. The parameter input layer receives three initial parameters: the adaptive learning rate, the dynamic weighting coefficients, and the situation mapping accuracy. The bias calculation layer calculates the error between the current assessment result and historical accurate results in real time, obtaining the parameter bias value. The adaptive correction layer performs segmented corrections to the three parameters based on the model optimization adaptation strength and compliance assessment priority. The parameter output layer solidifies the corrected parameters into an executable configuration for use in subsequent assessment processes.

[0113] The algorithm training and execution process consists of five steps. Step 1: Load the current batch of data and corresponding judgment results to construct real-time verification samples. Step 2: Calculate the current judgment accuracy and compare it with the judgment accuracy benchmark to obtain the accuracy deviation. Step 3: Initiate parameter correction based on the deviation value; the larger the deviation, the larger the correction. Step 4: Synchronously adjust the learning weights, mapping coefficients, and matching accuracy to maintain consistency among parameters. Step 5: Save the optimized parameters and apply them to the next batch of data processing, forming a closed-loop iterative mechanism. Key parameters include correction step size, deviation threshold, priority coefficient, and adaptation strength coefficient. The correction step size is set to 0.005. The deviation threshold is set to 0.05. The priority coefficient is divided into high, medium, and low levels according to compliance level. The adaptation strength coefficient is dynamically adjusted according to the scenario complexity.

[0114] The algorithm prioritizes improving accuracy, calculating the deviation between current and optimal parameters in real time and continuously adjusting weight allocation and feature mapping based on the direction and magnitude of the deviation. When accuracy exceeds the benchmark, parameters are slightly adjusted to maintain stability. When accuracy falls below the benchmark, parameters are significantly adjusted for rapid improvement. The adjustment process follows compliance-based assessment priorities, with higher-priority parameters receiving larger adjustments and faster responses. When transaction feature assessment is insufficient, the algorithm automatically increases the learning weight of transaction time-series features. Simultaneously, other feature weights decrease proportionally to ensure the sum of all feature weights equals one. This increased weighting enhances the impact of transaction features on the final assessment result, enabling more sensitive identification of risky behaviors such as abnormal transaction frequency, sudden changes in transaction amount, and illegal switching of transaction channels.

[0115] When contract features are misjudged, the algorithm automatically narrows the scope of semantic features associated with the contract, retaining only core key fields such as the subject, amount, term, and default clauses. Simultaneously, it improves the accuracy of situational mapping, reducing the allowable error range and making the mapping relationship between features and compliance situations more rigorous. This narrowing of the scope and improvement of accuracy effectively reduces misjudgments of contract clauses and enhances the accuracy of assessments of subject legitimacy, amount accuracy, and clause completeness. Through continuous iterative correction, the algorithm automatically generates dynamically optimized parameters fully adapted to the current business scenario. These parameters can match data features from multiple types, including transactions, finance, supply chain, and contracts, adapting to different scenario requirements such as high real-time performance, high compliance, and high complexity. This provides stable and reliable parameter support for subsequent compliance risk assessment, cross-business risk matching, and the triggering of tiered handling instructions.

[0116] Based on optimized parameters and industry regulatory rule base, compliance risk judgment thresholds, cross-business risk matching rules, and tiered handling instruction triggering conditions are dynamically calibrated to form compliance perception results and a full-process compliance management implementation plan. The compliance risk judgment thresholds are dynamically adjusted according to business scenario type and compliance regulatory level. Higher regulatory level scenarios use stricter judgment thresholds, while lower regulatory level scenarios use standard thresholds. Threshold adjustments employ a level sensitivity mapping algorithm, dividing regulatory levels into four tiers: high, medium, general, and low. For high regulatory level scenarios, the threshold sensitivity is increased to above 0.9, lowering the anomaly identification threshold; even minor deviations can trigger anomaly marking. For medium regulatory level scenarios, the threshold sensitivity is set to 0.7 to 0.9. For general regulatory level scenarios, the threshold sensitivity is set to 0.5 to 0.7. For low regulatory level scenarios, the threshold sensitivity is set below 0.5. The thresholds cover all anomaly judgment items, including transaction amount deviation, operational behavior deviation, document verification anomalies, missing clause ratio, and logistics-funding mismatch rate, achieving unified control over the intensity of all-dimensional risk identification.

[0117] Cross-business risk matching rules optimize the risk correlation matching methods between four types of data: transactions, contracts, supply chain, and finance, based on business scenarios. Rule calibration employs a scenario-based correlation adaptation algorithm, adjusting the correlation verification dimensions and matching strength according to the key aspects of each scenario. For transaction and finance scenarios, verification of amount consistency, settlement sequence, and voucher correspondence is strengthened. For transaction and contract scenarios, two-way verification of order subject matter, transaction amount, performance period, and payment terms is strengthened. For supply chain and finance scenarios, closed-loop verification of logistics nodes, reconciliation information, settlement documents, and delivery vouchers is strengthened. For contract and supply chain scenarios, consistency verification of performance period, delivery requirements, liability for breach of contract, and data security agreements is strengthened. The algorithm automatically activates the optimal correlation combination for the current scenario, improving the accuracy of cross-data risk identification.

[0118] The triggering conditions for tiered handling instructions are set according to risk levels, establishing triggering criteria for handling instructions such as early warnings, alarms, blocking, isolation, and reporting. The condition setting uses a risk level instruction mapping algorithm to classify risks into four levels: general risk, significant risk, major risk, and extremely significant risk. General risks trigger low-level early warnings, only recording the information. Significant risks trigger system alarms and push notifications to the relevant business personnel. Major risks trigger process blocking and temporary access restrictions. Extremely significant risks trigger full process blocking, data isolation, and regulatory reporting. Triggering conditions include the number of consecutive anomalies, the deviation from the baseline percentage, risk scoring thresholds, and mandatory regulatory requirements. Once all conditions are met, the corresponding handling action is executed immediately.

[0119] Three rules are implemented to calibrate highly regulated financial scenarios. First, a risk assessment threshold sensitivity is raised to 0.95% through a level-sensitivity mapping algorithm, indicating an anomaly is detected when a single transaction deviates from the baseline by 10%. Second, a scenario-related adaptation algorithm strengthens the cross-validation of four types of data: transaction, financial, contract, and supply chain data; any mismatch between any two categories directly flags the risk. Third, a risk level instruction mapping algorithm increases the trigger level, escalating significant risks to process blockades and immediately initiating reporting procedures for major risks. This combination of strict rules enables early detection, rapid handling, and rigorous control of risks in highly sensitive scenarios.

[0120] After calibrating the three assessment rules, the system generates a business compliance awareness result by integrating individual assessment conclusions, risk levels, anomaly types, and correlations. The result includes an overall compliance score, a list of high-risk points, detailed anomaly data, trend change assessments, and regulatory compliance status. Combining data lifecycle management requirements, the principle of least privilege, business process control nodes, and regulatory reporting standards and frequency requirements, a compliance management implementation plan covering the entire process of data collection, transmission, preprocessing, feature extraction, assessment, handling, and archiving is formed. The plan clearly defines the execution standards, responsible entities, anomaly handling procedures, periodic verification mechanisms, and continuous optimization paths for each stage, providing comprehensive support for enterprise business data security and compliant operations.

[0121] In one implementation, such as Figure 2 As shown, this application also provides an intelligent data security situation awareness and management device based on multimodal fusion, comprising: The multimodal business data acquisition module 201 is used to collect detailed business transaction records, digital features of key contract terms, data interaction records of supply chain nodes, structured information of financial vouchers, and permission operation trajectories to build a multimodal business security awareness data source. The business data access configuration module 202 is used to configure the dynamic parameters of the business data collection node. Through standardized interfaces and the business system API gateway authentication mechanism, it enables secure access to heterogeneous business data related to transactions, finance, supply chain, and contracts. The data preprocessing and feature extraction module 203 is used to perform format regularization, redundant information removal and compliance field normalization on multimodal business data, extract transaction behavior time sequence features, contract clause semantic association vectors, supply chain capital flow-logistics matching features, and financial compliance verification labels to generate a business security and compliance special analysis dataset. The integrated strategy construction module 204 is used to combine business value levels, real-time transaction clearing requirements, edge-cloud collaborative computing power allocation schemes, and regulatory compliance accuracy standards to build an integrated strategy of multi-source data collection, cross-business feature alignment, and intelligent assessment of compliance risks. The dataset batch processing and transmission module 205 is used to split the dataset according to the business scenario, generate processing batches containing standardized operating baselines, compliance risk anomaly labels, and regulatory compliance attribute verification items, and realize edge-cloud collaborative asynchronous transmission and data synchronization verification through an encrypted channel; The adaptive judgment and management generation module 206 is used to learn the mapping relationship between multi-dimensional features and business compliance status and transaction risk evolution path through a business scenario adaptive dynamic weight algorithm. Based on the business data credibility level, feature correlation strength quantification, and dynamic feedback of judgment accuracy, it optimizes model parameters. Combined with business scenario type, compliance supervision level, and industry regulatory rule library, it dynamically adapts to compliance risk judgment threshold, cross-business risk matching rules, and level disposal instruction triggering conditions to generate compliance perception results and full-process compliance management implementation plan.

[0122] The various embodiments in this application are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for evaluating the intelligent data security situation awareness and management method, electronic device, electronic device, and readable storage medium based on multimodal fusion are basically similar to the above-described embodiments of the intelligent data security situation awareness and management method based on multimodal fusion, and therefore the description is relatively simple. Relevant parts can be referred to in the descriptions of the above-described embodiments of the intelligent data security situation awareness and management method based on multimodal fusion.

Claims

1. A method for intelligent data security situation awareness and management based on multimodal fusion, characterized in that, include: The data collected includes multimodal business data such as detailed business transaction records, digital features of key contract terms, data interaction records of supply chain nodes, structured information of financial vouchers, and access control operation trajectories. Configure dynamic parameters for business data collection nodes, and through standardized interfaces, combined with the business system API gateway authentication mechanism, enable secure access to heterogeneous business data related to transactions, finance, supply chain, and contracts. The preprocessing stage completes data format standardization, redundant information removal and compliance field normalization, extracts transaction behavior temporal features, contract clause semantic association vectors, supply chain cash flow-logistics matching features, and financial compliance verification labels, and generates a business security and compliance special analysis dataset. By combining business value levels, real-time transaction clearing requirements, edge-cloud collaborative computing power allocation schemes, and regulatory compliance accuracy standards, an integrated strategy is constructed that combines multi-source data collection, cross-business feature alignment, and intelligent assessment of compliance risks. This includes using multi-dimensional constraint matching technology to integrate and process business security posture constraints, generating business value weight coefficients, clearing real-time thresholds, computing power scheduling quotas, and regulatory compliance verification benchmarks. Furthermore, the integrated strategy construction requirements, cross-business feature alignment rules, intelligent assessment execution sequence, and edge-cloud collaborative adaptation logic are integrated and processed to establish quantitative mapping relationships among collection, alignment, assessment, and collaboration dimensions, generating suitable business scenarios. The strategy is built on a benchmark that aligns with regulatory requirements. Based on this benchmark, core configuration elements are extracted, and parameters for the data collection link, alignment window, analysis model, and collaborative nodes are defined using business value level as the hierarchical basis, real-time settlement as the time constraint, computing power allocation as the resource boundary, and compliance accuracy as the judgment benchmark. The core strategy parameters are dynamically calibrated and iteratively optimized in conjunction with business data scale, edge-cloud computing power load, regulatory response timeliness, and feature correlation complexity. The execution priority, interaction protocol, and scheduling mechanism for multi-source data collection, cross-business feature alignment, and intelligent compliance risk analysis are clarified, generating an integrated strategy that meets the needs of business security situation awareness and management. Data sets are split according to business scenarios to generate processing batches containing standardized operating baselines, compliance risk anomaly labels, and regulatory compliance attribute verification items. Edge-cloud collaborative asynchronous transmission and data synchronization verification are achieved through encrypted channels. This includes integrating and processing the business security and compliance special assessment dataset according to the standardization requirements using multi-dimensional constraint analysis technology to generate standardized operating baselines, compliance risk anomaly labels, regulatory compliance attribute verification items, and business scenario classification benchmark data. The requirements for batch splitting of datasets, constraints on edge-cloud collaborative transmission, feature verification rules and encryption channel adaptation requirements are integrated and processed to establish accurate splitting relationships among baseline features, abnormal features, compliance features and scenario features, and generate a batch splitting strategy for datasets that is adapted to edge-cloud collaboration and real-time analysis. Based on a batch-based splitting strategy, core configuration requirements are extracted. Business scenario type is used as the input dimension, compliance risk level as the key parameter, and regulatory verification timing as the splitting basis. This enables the scientific setting of batch length, feature dimension, tag embedding position, and transmission timing. Combining data transmission throughput, real-time analysis calculation intensity, and compliance verification accuracy priority requirements, the set core splitting parameters are quantitatively calibrated and optimized. The batch weights, segmentation ranges, and synchronous transmission rules of baseline features, abnormal features, compliance features, and scenario features are clarified. This generates standardized security analysis data processing batches that meet the requirements of multimodal business data processing and edge-cloud collaborative transmission. Through a business scenario-adaptive dynamic weighting algorithm, the model learns the mapping relationship between multi-dimensional features and business compliance status and transaction risk evolution path. Based on the business data credibility classification, feature correlation strength quantification, and dynamic feedback of judgment accuracy, the model parameters are optimized. Combined with business scenario type, compliance supervision level, and industry regulatory rule library, the model dynamically adapts to compliance risk judgment threshold, cross-business risk matching rules, and graded disposal instruction triggering conditions to generate compliance perception results and full-process compliance management implementation plan.

2. The method as described in claim 1, characterized in that, Configure dynamic parameters for business data collection nodes, and through standardized interfaces combined with the business system API gateway authentication mechanism, achieve secure access to heterogeneous business data related to transactions, finance, supply chain, and contracts, including: Based on the business scenario adaptive dynamic calibration of data acquisition node parameter initialization validity, interface adaptation and compatibility, authentication process standardization, and data access security requirements, the core parameters of multi-source heterogeneous business data acquisition are set in a unified manner, and parameter calibration values ​​and execution rule information corresponding to each acquisition module are generated. For the transaction data collection stage, set the collection frequency, field mapping rules, incremental synchronization cycle, and transaction verification algorithm to obtain fixed parameters and adaptation logic for the transaction data; For the financial data collection process, we set up voucher parsing formats, account matching dimensions, real-time reporting thresholds, and reconciliation verification rules to clarify the quality judgment standards for financial data. For the supply chain data collection process, the sampling frequency of node interaction, the rules for the association between logistics and capital flow, the delay tolerance range, and the status update coefficient are set to determine the validity judgment and constraints of supply chain data. For the contract data collection process, we set the granularity of clause extraction, text structuring standards, change monitoring intervals, and permission association strategies to clarify the standardized collection constraints of contract data. The results of collecting transaction data, financial data, supply chain data, and contract data are integrated to form standardized transaction data, financial data, supply chain data, and contract data covering the entire access process of multi-source business data.

3. The method as described in claim 1, characterized in that, Through a business scenario-adaptive dynamic weighting algorithm, the system learns the mapping relationship between multi-dimensional features and business compliance status and transaction risk evolution paths. Based on business data credibility grading, feature correlation strength quantification, and dynamic feedback of judgment accuracy, the model parameters are optimized. Combined with business scenario types, compliance regulatory levels, and industry regulatory rule bases, the system dynamically adapts compliance risk judgment thresholds, cross-business risk matching rules, and tiered handling instruction triggering conditions to generate compliance perception results and a full-process compliance management implementation plan, including: Multi-dimensional constraint analysis technology is used to integrate and process the requirements for assessing business compliance status, and generate business feature credibility indicators, feature correlation strength coefficients, assessment accuracy benchmarks, and quantitative data on risk evolution trends. The adaptive dynamic weight learning requirements, scenario adaptation standards, cross-business feature association rules, and situation assessment adaptation requirements are integrated and processed to establish a precise matching relationship between feature input, weight allocation, situation mapping, and risk judgment, and to generate a dynamic weight learning strategy adapted to business scenarios. Based on the dynamic weight learning strategy, the core configuration requirements are extracted. Multimodal business features are used as the input dimension, data credibility level is used as the key parameter, and feature association strength is used as the judgment criterion. This enables the scientific setting of adaptive learning rate, dynamic weighting coefficient, and situation mapping accuracy. Combining the model optimization and adaptation strength with the priority requirements of compliance assessment, the core configuration parameters are quantitatively calibrated and optimized, clarifying the allocation rules, feature association range, and comprehensive assessment logic for learning weights, mapping coefficients, and matching accuracy, and generating dynamic weight optimization and compliance assessment parameters that meet the adaptive requirements of business scenarios. Based on optimized parameters and industry regulatory rule base, the compliance risk identification threshold, cross-business risk matching rules, and tiered handling instruction triggering conditions are dynamically calibrated to form compliance perception results and full-process compliance management implementation plan.

4. An intelligent data security situation awareness and management device based on multimodal fusion, characterized in that, The device includes: The multimodal business data acquisition module 201 is used to collect detailed business transaction records, digital features of key contract terms, data interaction records of supply chain nodes, structured information of financial vouchers, and permission operation trajectories to build a multimodal business security awareness data source. The business data access configuration module 202 is used to configure the dynamic parameters of the business data collection node. Through standardized interfaces and the business system API gateway authentication mechanism, it enables secure access to heterogeneous business data related to transactions, finance, supply chain, and contracts. The data preprocessing and feature extraction module 203 is used to perform format regularization, redundant information removal and compliance field normalization on multimodal business data, extract transaction behavior time sequence features, contract clause semantic association vectors, supply chain capital flow-logistics matching features, and financial compliance verification labels to generate a business security and compliance special analysis dataset. The integrated strategy construction module 204 is used to construct an integrated strategy encompassing multi-source data collection, cross-business feature alignment, and intelligent compliance risk assessment, by combining business value levels, real-time transaction clearing requirements, edge-cloud collaborative computing power allocation schemes, and regulatory compliance accuracy standards. This includes integrating and processing business security posture fusion constraints using multi-dimensional constraint matching technology to generate business value weight coefficients, clearing real-time thresholds, computing power scheduling quotas, and regulatory compliance verification benchmarks. It also integrates and processes the integrated strategy construction requirements, cross-business feature alignment rules, intelligent assessment execution sequence, and edge-cloud collaborative adaptation logic, establishing quantitative mapping relationships among the collection, alignment, assessment, and collaboration dimensions. Generate a strategy construction benchmark adapted to business scenarios and regulatory requirements; extract core configuration elements based on the strategy construction benchmark, using business value level as the hierarchical basis, real-time settlement as the time constraint, computing power allocation as the resource boundary, and compliance accuracy as the judgment benchmark, and complete the parameter definition of the collection link, alignment window, judgment model, and collaborative nodes; combine business data scale, edge cloud computing power load, regulatory response timeliness, and feature correlation complexity to dynamically calibrate and iteratively optimize the defined core strategy parameters, clarify the execution priority, interaction protocol, and scheduling mechanism of multi-source data collection, cross-business feature alignment, and intelligent judgment of compliance risks, and generate an integrated fusion strategy that meets the needs of business security situation awareness and management; The dataset batch processing and transmission module 205 is used to split the dataset according to business scenarios, generate processing batches containing standardized operating baselines, compliance risk anomaly labels, and regulatory compliance attribute verification items, and realize edge-cloud collaborative asynchronous transmission and data synchronization verification through an encrypted channel. This includes integrating and processing the data set standardization requirements of the business security and compliance special assessment dataset using multi-dimensional constraint analysis technology, and generating standardized operating baselines, compliance risk anomaly labels, regulatory compliance attribute verification items, and business scenario classification benchmark data. The requirements for batch splitting of datasets, constraints on edge-cloud collaborative transmission, feature verification rules and encryption channel adaptation requirements are integrated and processed to establish accurate splitting relationships among baseline features, abnormal features, compliance features and scenario features, and generate a batch splitting strategy for datasets that is adapted to edge-cloud collaboration and real-time analysis. Based on a batch-based splitting strategy, core configuration requirements are extracted. Business scenario type is used as the input dimension, compliance risk level as the key parameter, and regulatory verification timing as the splitting basis. This enables the scientific setting of batch length, feature dimension, tag embedding position, and transmission timing. Combining data transmission throughput, real-time analysis calculation intensity, and compliance verification accuracy priority requirements, the set core splitting parameters are quantitatively calibrated and optimized. The batch weights, segmentation ranges, and synchronous transmission rules of baseline features, abnormal features, compliance features, and scenario features are clarified. This generates standardized security analysis data processing batches that meet the requirements of multimodal business data processing and edge-cloud collaborative transmission. The adaptive judgment and management generation module 206 is used to learn the mapping relationship between multi-dimensional features and business compliance status and transaction risk evolution path through a business scenario adaptive dynamic weight algorithm. Based on the business data credibility level, feature correlation strength quantification, and dynamic feedback of judgment accuracy, it optimizes model parameters. Combined with business scenario type, compliance supervision level, and industry regulatory rule library, it dynamically adapts to compliance risk judgment threshold, cross-business risk matching rules, and level disposal instruction triggering conditions to generate compliance perception results and full-process compliance management implementation plan.

5. An electronic device, characterized in that, include: First processor; The processor also includes a memory for storing executable instructions of the first processor; wherein the first processor is configured to execute the intelligent data security situation awareness and management method based on multimodal fusion as described in any one of claims 1 to 3 by executing the executable instructions.

Images