Risk early warning method, device and storage medium

Abstract

The application discloses a risk early warning method and device and a storage medium, relates to the technical field of business processes, and comprises the following steps: acquiring a state snapshot (including a processing time length history distribution parameter and a routing result history distribution parameter corresponding to a previous node) of a current process instance in operation; sampling the processing time length history distribution parameter to obtain a plurality of candidate processing time lengths, and sampling the routing result history distribution parameter to obtain a plurality of candidate routing results; combining the plurality of candidate processing time lengths and the plurality of candidate routing results to obtain a plurality of expected simulation paths of the current process instance starting from a current node, inputting the plurality of expected simulation paths into a target prediction model to obtain a predicted completion time corresponding to each expected simulation path, and determining a delay probability; and if the delay probability of at least one expected simulation path exceeds a preset delay probability or the predicted completion time exceeds a preset time threshold, generating a risk early warning signal. The application improves the risk early warning accuracy.

Description

Technical Field

[0001] This application relates to the field of business process technology, and in particular to risk warning methods, electronic devices and storage media. Background Technology

[0002] During process monitoring, existing risk warning methods are based on a preset fixed timeout threshold: an alarm is triggered when the dwell time of a process instance at the current node exceeds the fixed timeout threshold.

[0003] However, a process instance typically needs to pass through multiple subsequent nodes from the current node to the end of the process. The processing time of each subsequent node is uncertain, and after the current node ends, it may lead to multiple different routing branches. Existing methods only check whether the current node has timed out. This can cause the current node to time out slightly due to temporarily waiting for external system responses (such as a brief interface unavailability), but if the subsequent paths are smooth and the remaining nodes are processing efficiently, it can still trigger false alarms. Alternatively, the current node itself may not have timed out, but critical nodes in the subsequent paths may be congested or processing slowly. However, the risk cannot be detected in advance, and an alert can only be issued after the subsequent nodes actually time out, resulting in a delayed response.

[0004] In summary, existing risk warning systems are inaccurate, with high rates of false alarms and missed alarms. Summary of the Invention

[0005] The main purpose of this application is to provide a risk warning method, electronic device and storage medium, which aims to solve the technical problems of poor accuracy and high false alarm and false negative rates in existing risk warning systems.

[0006] To achieve the above objectives, this application proposes a risk warning method applied to a business system, wherein at least one process instance runs in the business system, and the risk warning method includes: Obtain a state snapshot of the current process instance in operation, wherein the state snapshot includes: historical distribution parameters of processing time and historical distribution parameters of routing results corresponding to the current node; The historical distribution parameters of the processing time are sampled to obtain multiple candidate processing times corresponding to the processing time of the current node, and the historical distribution parameters of the routing results are sampled to obtain multiple candidate routing results corresponding to the routing results of the current node. The multiple candidate processing times are combined with the multiple candidate routing results to obtain multiple expected simulated paths for the current process instance starting from the current node; Each expected simulated path is input into the pre-trained target prediction model to obtain the predicted completion time corresponding to each expected simulated path, and the delay probability corresponding to each expected simulated path is determined. If the delay probability of at least one expected simulated path exceeds the preset delay probability, or the predicted completion time exceeds the preset time threshold, a risk warning signal is generated for the current process instance.

[0007] In one embodiment, after the step of generating a risk warning signal for the current process instance, the method includes: The current process instance is cloned to obtain at least one cloned instance; Generate and assign a different processing path to the cloned instance than the current node of the current process instance; The current process instance and the cloned instance are executed in parallel until the current process instance or any cloned instance reaches the end of the process.

[0008] In one embodiment, after the step of generating a risk warning signal for the current process instance, the method further includes: Determine the target handlers for each node after the current node in the target expected simulation path, wherein the target expected simulation path is an expected simulation path of the current process instance, and the delay probability of the target expected simulation path exceeds a preset delay probability, or the predicted completion time exceeds a preset time threshold. The physical location information of the target processor is obtained, as well as the usage status of at least one hardware device associated with the target processor, wherein the hardware device includes a printer, an access control gate, and a meeting room reservation screen; The current spatial region of the target processor is determined based on the physical location information; From the at least one hardware device, select the target hardware device located within the current spatial region, and use the target hardware device as the early warning output device; The risk warning content for the expected simulated path of the target is sent to the warning output device.

[0009] In one embodiment, the step of obtaining the predicted completion time corresponding to each expected simulated path includes: Obtain environmental awareness data for at least one handler associated with the current process instance; The environmental perception data is converted into a time-series feature vector, and the time-series feature vector is time-aligned with the expected simulation path to obtain the aligned time-series feature vector. The aligned temporal feature vectors and the expected simulation paths are input into the pre-trained target prediction model to obtain the predicted completion time for each expected simulation path.

[0010] In one embodiment, prior to the step of inputting each expected simulated path into the pre-trained target prediction model, the method further includes: Obtain historical process log data stored by each participant in the multiple business systems, wherein the historical process log data includes the routing results of the process instances completed by each participant, the processing time of each node, the actual completion time, and the actual delay probability. On the local nodes of each participant, local prediction models are trained using the historical process log data of each participant to obtain the local model parameters of each participant. The local model parameters of each participant are aggregated to obtain the global model parameters; The local prediction models of each participant are updated by updating the global model parameters. The steps of training the local prediction models on the local nodes of each participant using their respective historical process log data are executed to obtain the local model parameters of each participant, until the local prediction models of each participant converge to obtain the target prediction model.

[0011] In one embodiment, the method further includes: Identify at least one target participant that the current process instance depends on; Obtain the current load status information of the target participant, wherein the current load status information includes the number of process instances currently pending processing and the average response time of the target participant; Based on the current load status information, adjust the sampling weight or sampling range of the current node corresponding to the target participant for the status snapshot.

[0012] In one embodiment, after the step of generating a risk warning signal for the current process instance, the method further includes: Determine the warning simulation path that triggers the warning, as well as the predicted completion time and delay probability corresponding to the warning simulation path, from the current process instance; The early warning simulation path, the predicted completion time and delay probability corresponding to the early warning simulation path are input into a pre-constructed process knowledge graph to locate the delay position in the early warning simulation path. Perform causal inference on the location of the delay and output the reason for the delay at that location.

[0013] In one embodiment, prior to the step of obtaining a state snapshot of the currently running process instance, the method includes: Receive natural language requirement descriptions input by the management of the business system; Extract key business entities from the natural language requirement description, wherein the key business entities include field names, field types, business rules, and approval flow; Based on the field name and the field type, the corresponding interface component is matched from the preset component library to generate a form structure, wherein a data model of the process instance to be built is generated based on the form structure; Based on the business rules and the approval flow, generate the node sequence of the process instance to be built and the flow conditions between each node; Based on the data model, the node sequence, and the flow conditions, a process instance is constructed.

[0014] Furthermore, to achieve the above objectives, this application also proposes a risk warning device applied to a business system, wherein at least one process instance runs in the business system, and the risk warning device includes: The acquisition module is used to acquire a state snapshot of the current process instance in operation, wherein the state snapshot includes: historical distribution parameters of processing time and historical distribution parameters of routing results corresponding to the current node; The sampling module is used to sample the historical distribution parameters of the processing time to obtain multiple candidate processing times corresponding to the processing time of the current node, and to sample the historical distribution parameters of the routing results to obtain multiple candidate routing results corresponding to the routing results of the current node. The combination module is used to combine the multiple candidate processing times with the multiple candidate routing results to obtain multiple expected simulated paths for the current process instance starting from the current node; The prediction module is used to input each expected simulated path into the pre-trained target prediction model, obtain the predicted completion time corresponding to each expected simulated path, and determine the delay probability corresponding to each expected simulated path. The early warning module is used to generate a risk warning signal for the current process instance if the delay probability of at least one expected simulated path exceeds a preset delay probability, or the predicted completion time exceeds a preset time threshold.

[0015] In addition, to achieve the above objectives, this application also proposes an electronic device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the risk warning method described above.

[0016] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the risk warning method described above.

[0017] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the risk warning method described above.

[0018] One or more technical solutions proposed in this application have at least the following technical effects: By obtaining a state snapshot of the current process instance in operation, which includes the historical distribution parameters of the processing time and the historical distribution parameters of the routing results corresponding to the current node, sampling these two types of distribution parameters respectively, multiple candidate processing times and multiple candidate routing results are obtained. Then, the candidate processing times and candidate routing results are combined to generate multiple expected simulation paths starting from the current node, thereby quantifying the uncertainty of the processing time of subsequent nodes and the uncertainty of routing branches into multiple possible expected simulation paths.

[0019] Then, each expected simulated path is input into the pre-trained target prediction model to obtain the predicted completion time for each expected simulated path and determine the delay probability for each expected simulated path. A risk warning is triggered by determining whether at least one expected simulated path has a delay probability exceeding a preset delay probability or a predicted completion time exceeding a preset time threshold. In this way, if the current node slightly times out due to temporarily waiting for an external system response, but subsequent paths are smooth and the remaining nodes are highly efficient, no false alarm will be triggered because the predicted completion times of all expected simulated paths do not exceed the threshold and the delay probabilities are low. Conversely, even if the current node has not timed out, but the predicted completion time of a subsequent key node in an expected simulated path times out or the delay probability is too high (i.e., congestion or slow processing occurs at subsequent key nodes), an early warning can be issued. This avoids the problems of false alarms and missed alarms caused by only issuing warnings based on whether the current node times out, ignoring the uncertainty of subsequent nodes, and multiple branch paths, and significantly improves the accuracy of risk warnings. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating an embodiment of the risk warning method of this application; Figure 2A schematic diagram provided for an embodiment of the risk warning method of this application Figure 1 ; Figure 3 A schematic diagram of another embodiment of the risk warning method of this application Figure 2 ; Figure 4 This is a schematic diagram of the module structure of the risk warning device of this application; Figure 5 This is a schematic diagram of the equipment structure of the hardware operating environment involved in the risk warning method of this application.

[0023] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0024] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of this application and are not intended to limit this application.

[0025] Because the current system only provides warnings based on whether the current node has timed out, without considering the uncertainty of the processing time of subsequent nodes (which may be congested or smooth) and the uncertainty of routing branches (which may lead to different paths), false alarms (the current node timed out but the subsequent nodes are smooth) and false negatives (the current node did not time out but the subsequent nodes were congested) will occur if the current node status is inconsistent with the actual risk.

[0026] This application obtains the historical distribution parameters of the processing time of the current node and the historical distribution parameters of the routing results, samples multiple candidate values ​​and combines them into multiple expected simulation paths, and explicitly models the uncertainty and multi-branch possibility of subsequent nodes; then, it uses the target prediction model to give the predicted completion time for each path and determines the delay probability.

[0027] Because the technical solution of this application no longer only considers whether the current node has timed out, but also assesses whether any of the possible subsequent paths have a high risk of delay (predicting timeout or high probability of delay), if the current node briefly times out but all subsequent paths are clear, the prediction results of all expected simulated paths will be normal, and no warning will be triggered, thus eliminating false alarms. If the current node does not time out but a certain subsequent path is congested, the prediction result of that expected simulated path will exceed the limit, triggering a warning, thus eliminating missed alarms and significantly improving the accuracy of risk warnings.

[0028] It should be noted that the executing entity in this embodiment can be an electronic device (which may be called a risk warning device), such as a server, industrial control computer, embedded edge computing device, etc., or a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or a dedicated integrated circuit or field-programmable gate array capable of realizing the above functions. The following uses an electronic device as an example to describe this embodiment and the following embodiments.

[0029] Based on this, the embodiments of this application provide a risk warning method, referring to Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the risk warning method of this application.

[0030] In one feasible embodiment, the application scenarios of the technical solution of this application can be: enterprise business process monitoring, financial transaction approval, production execution system, logistics and transportation scheduling, etc.

[0031] In this embodiment, the risk warning method is applied to a business system, where at least one process instance is running, and the risk warning device is used to perform real-time risk assessment and warning on the running process instance.

[0032] In this embodiment, the risk warning method includes steps S1 to S5: Step S1: Obtain a state snapshot of the current process instance in operation, wherein the state snapshot includes: historical distribution parameters of processing time and historical distribution parameters of routing results corresponding to the current node; It should be noted that during the execution of the process instance, the processing time (i.e., processing duration) at each node and the branching path (i.e., routing result) after the node is completed are both random. Traditional methods can only detect anomalies after a timeout occurs, and cannot predict risks before the process ends. Therefore, this step obtains a state snapshot of the current process instance. The state snapshot includes the historical distribution parameters of the processing duration and routing results corresponding to the current node, as well as the node identifier of the current node, providing input data for subsequent risk simulation.

[0033] Optionally, the risk warning device can obtain the node identifier of the active node (i.e., the current node) that is currently being executed but not yet completed in a specific process instance (i.e., the current process instance) in the running state by real-time monitoring the event interface of the process engine or polling the process database. At the same time, based on the node identifier, it can obtain the historical distribution parameters of the processing time and the historical distribution parameters of the routing results corresponding to the current node from the historical process log.

[0034] Optionally, the historical distribution parameter of processing time is a set of statistics, such as the average, variance, and quantile of the time that all historical process instances stayed at the current node over a period of time, which is used to describe the probability distribution of the processing time of the current node.

[0035] Optionally, the historical distribution parameters of the routing results are another set of statistics, such as the historical frequency or probability value of the current node moving to various possible downstream branches after completion, which are used to describe the uncertainty of the routing selection.

[0036] Understandably, by acquiring these two distribution parameters, risk warning devices can quantify the uncertainty of the current node in future processing time and trajectory, thereby improving the data integrity and accuracy of subsequent random simulations.

[0037] Step S2: Sample the historical distribution parameters of the processing time to obtain multiple candidate processing times corresponding to the processing time of the current node, and sample the historical distribution parameters of the routing results to obtain multiple candidate routing results corresponding to the routing results of the current node; It should be noted that there are multiple possibilities for the future development path of a single process instance (such as different processing speeds or different branching paths). Predicting only one certain result will lead to missed or false alarms. Therefore, multiple possible future segments can be generated by random sampling.

[0038] Optionally, sampling involves randomly selecting a value from the probability distribution described by the historical distribution parameters of the processing duration. This value represents the possible processing duration of the current node. Repeating the sampling multiple times will yield multiple candidate processing durations.

[0039] Optionally, the candidate processing time is the time taken from start to finish for each sample obtained.

[0040] Similarly, based on the probability of each downstream branch recorded in the historical distribution parameters of the routing results, a branch result is randomly selected, and this process is repeated multiple times to obtain multiple candidate routing results.

[0041] Optionally, the candidate route result is the identifier or branch number of the next node to which the current node will turn after each sampling.

[0042] Understandably, the number of samplings can be pre-configured (e.g., one hundred or five hundred times), and the more samplings, the more comprehensive the path diversity will be in the simulation coverage.

[0043] Through this step, the risk warning equipment transforms the probability distribution into a specific, calculable numerical sequence, thereby increasing the diversity of subsequent path simulations.

[0044] Step S3: Combine the multiple candidate processing times with the multiple candidate routing results to obtain multiple expected simulated paths for the current process instance starting from the current node; It should be noted that the processing time of a single candidate and the routing result of a single candidate can only describe the local behavior of the current node and cannot reflect the complete trajectory from the current node to the end of the process. Therefore, the two can be paired and combined into a complete path.

[0045] Optionally, the combination involves binding the candidate processing time obtained from each sampling with the candidate routing result obtained from the same sampling to form a combined result that includes "simulation time of the current node" and "simulation of the branch to be traversed".

[0046] Optionally, the expected simulation path is a complete predicted trajectory that starts from the current node, continues forward along the combined results described above, and ends at the end node of the process.

[0047] Specifically, the risk warning device takes the current node as the starting point, determines the next node according to the candidate routing results, and then recursively uses the historical distribution parameters (processing time distribution parameters and routing result distribution parameters) of each downstream node to continue simulating the processing time and routing of subsequent nodes until the termination node of the process is reached; each expected simulation path includes the simulated dwell time of each node on the expected simulation path and the direction of the entire path.

[0048] Alternatively, multiple expected simulation paths are a set of complete trajectories generated through multiple sampling and recursion, with each trajectory representing a possible future outcome.

[0049] Understandably, this step generates a complete path sequence from the current node to the end node of the process, enabling subsequent prediction models to obtain the temporal information of the entire path.

[0050] Step S4: Input each expected simulated path into the pre-trained target prediction model to obtain the predicted completion time corresponding to each expected simulated path, and determine the delay probability corresponding to each expected simulated path. It should be noted that the completion time of only one expected simulation path is insufficient to assess the overall risk, because the probabilities and time consumption of different expected simulation paths vary greatly. Therefore, it is necessary to conduct a quantitative assessment of each expected simulation path separately.

[0051] Optionally, the pre-trained target prediction model is a pre-trained deep learning model (such as a Long Short-Term Memory network model LSTM or a Transformer model based on a self-attention mechanism). The target prediction model takes a complete expected simulated path (i.e., the sequence of time consumption of each node and the routing order) as input. First, it outputs the predicted completion time corresponding to the expected simulated path, where the predicted completion time represents the estimated total duration from the current moment to the end of the process, in minutes or hours. Then, the target prediction model compares the predicted completion time with a preset service level agreement time threshold to calculate the probability that the expected simulated path will be delayed. The probability value ranges from 0 to 1.

[0052] Optionally, the delay probability can be calculated as follows: the target prediction model outputs parameters (such as mean and variance) representing the distribution of completion time, and then the cumulative distribution function is used to calculate the probability that the completion time exceeds the service level agreement time threshold, and this probability is used as the delay probability for the corresponding completion time.

[0053] Understandably, by predicting multiple expected simulation paths separately, this step can obtain a set of predicted completion times and their corresponding delay probabilities, thereby more comprehensively reflecting the risk situation of the current process instance in terms of completion time and delay.

[0054] Step S5: If the delay probability of at least one expected simulated path exceeds the preset delay probability, or the predicted completion time exceeds the preset time threshold, a risk warning signal is generated for the current process instance.

[0055] It should be noted that if there is a simulated path in the current process instance that is expected to cause a delay, it indicates that the current process instance has a potential risk and an alert should be issued in advance.

[0056] Optionally, the preset delay probability is a pre-configured threshold (e.g., 0.85 or 85%) used to determine whether the delay probability of the expected simulated path reaches the condition for triggering an early warning.

[0057] Optionally, the preset time threshold is a pre-configured service level agreement time (e.g., 24 hours) used to determine whether the predicted completion time of the expected simulated path exceeds the deadline promised by the business.

[0058] Optionally, the risk warning device traverses all the prediction results (i.e., the predicted completion time and its corresponding delay probability). If it finds that the delay probability of at least one expected simulated path is greater than the preset delay probability, or the predicted completion time of at least one expected simulated path is greater than the preset time threshold, then a risk warning signal is generated for the current process instance.

[0059] Optionally, the risk warning signal may include information such as the identifier of the current process instance, the expected timeout, and key nodes of the high-risk path, and be pushed to the administrator via messages, emails, or other means.

[0060] Understandably, this step checks all expected simulation paths one by one. If any expected simulation path has a delay probability exceeding the preset delay probability or a predicted completion time exceeding the preset time threshold, an early warning is triggered. This checking method can cover the vast majority of potential timeout scenarios, reducing the risk of missed reports. At the same time, by setting the delay probability, it excludes extremely rare abnormal paths, avoiding frequent false alarms caused by extreme situations.

[0061] In this embodiment, a state snapshot of the current process instance is obtained, which includes historical distribution parameters of processing time and routing results corresponding to the current node. These two types of distribution parameters are sampled to obtain multiple candidate processing times and multiple candidate routing results. The candidate processing times and candidate routing results are then combined to generate multiple expected simulation paths starting from the current node, thereby quantifying the uncertainty of subsequent node processing times and routing branch uncertainties into multiple possible expected simulation paths.

[0062] Then, each expected simulated path is input into the pre-trained target prediction model to obtain the predicted completion time for each expected simulated path and determine the delay probability for each expected simulated path. A risk warning is triggered by determining whether at least one expected simulated path has a delay probability exceeding a preset delay probability or a predicted completion time exceeding a preset time threshold. In this way, if the current node slightly times out due to temporarily waiting for an external system response, but subsequent paths are smooth and the remaining nodes are highly efficient, no false alarm will be triggered because the predicted completion times of all expected simulated paths do not exceed the threshold and the delay probabilities are low. Conversely, even if the current node has not timed out, but the predicted completion time of a subsequent key node in an expected simulated path times out or the delay probability is too high (i.e., congestion or slow processing occurs at subsequent key nodes), an early warning can be issued. This avoids the problems of false alarms and missed alarms caused by only issuing warnings based on whether the current node times out, ignoring the uncertainty of subsequent nodes, and multiple branch paths, and significantly improves the accuracy of risk warnings.

[0063] In one feasible implementation, a response plan for risk warning signals is proposed, specifically, after step S5, including: Step A51: Clone the current process instance to obtain at least one cloned instance; It should be noted that when the risk warning device issues a warning signal, it indicates that the current process instance has a high risk of delay. However, a single process instance can only execute along a fixed path and cannot simultaneously try other potentially faster branch paths. Therefore, this step generates one or more identical copies of the current process instance by copying all its state information (including the current node position, filled-in form data, context variables, etc.). This allows the current process instance and the cloned instance to be assigned to different candidate paths for parallel execution.

[0064] Alternatively, cloning involves making a copy of the current process instance and assigning a new instance identifier to create an independent process instance.

[0065] Optionally, the cloned instance and the current process instance have the exact same state at the time of cloning, including the current node, historical execution records, and carried business data.

[0066] Understandably, through cloning, the risk warning device can create multiple independently controllable branch copies without affecting the normal execution of the original process instance, thereby improving the parallelism of multiple paths and making the overall processing time no longer limited by the blockage of a single path.

[0067] Step A52: Generate and assign a different processing path to the cloned instance than the current node of the current process instance; It's important to note that if the cloned instance continues execution along the exact same path as the current process instance, the cloning operation is meaningless and won't yield better results. Therefore, this step specifies an alternative route for each cloned instance, different from the expected path of the current process instance, to explore other potentially faster branches or processing methods.

[0068] Optionally, generating a processing path refers to selecting a downstream branch that is different from the branch currently sampled in the current process instance, based on the historical distribution parameters of the routing results of the current node, or specifying an alternative path that bypasses the known bottleneck node.

[0069] Optionally, the processing path can consist of different nodes. Different next approval nodes, different node execution orders, different branch combinations, etc., can be assigned to clone instances to generate and assign different processing paths to clone instances.

[0070] Optionally, allocation allows cloned instances to flow along this path during subsequent execution.

[0071] Understandably, by assigning different processing paths, cloned instances can try multiple possible process directions in parallel, increasing the probability of eventually finding a fast completion path.

[0072] Step A53: Execute the current process instance and the cloned instance in parallel until the current process instance or any cloned instance reaches the process endpoint.

[0073] It should be noted that executing multiple different paths sequentially consumes additional time and fails to achieve the goal of shortening the overall completion time. Therefore, this step allows the current process instance and all cloned instances to run simultaneously without blocking each other, each advancing along its assigned processing path.

[0074] Optionally, parallel execution refers to the risk warning device submitting multiple process instances (including the current process instance and cloned instances) to the process engine at the same time, and the process engine allocating independent execution threads or resources to the current process instance and cloned instances so that they run concurrently within the same time period.

[0075] Understandably, parallel execution allows multiple candidate paths to be processed simultaneously, reducing overall latency caused by blocking a single path.

[0076] It should be noted that once any instance (the current process instance or a cloned instance) successfully reaches its destination, the business request is considered complete. Other running instances (the current process instance or cloned instances) no longer need to continue execution, and early termination can release system resources. Therefore, this step can immediately stop other incomplete instances upon detecting the completion of any instance.

[0077] Optionally, reaching the end of the process means that the process instance has executed to a predefined end node. Then, the risk warning device sends a cancellation command to the process engine to stop the execution of the remaining instances and reclaim the memory, database connections, and other resources they occupied.

[0078] Understandably, this step ensures that the overall response time is determined by the first path to complete, while avoiding the waste of system resources due to invalid computation.

[0079] In one possible implementation, after step S5, the method further includes: Step B51: Determine the target handlers for each node after the current node in the target expected simulation path, wherein the target expected simulation path is an expected simulation path of the current process instance, and the delay probability of the target expected simulation path exceeds a preset delay probability, or the predicted completion time exceeds a preset time threshold. It should be noted that when the risk warning equipment detects a high risk of delay on a simulated path, simply issuing a general warning message is insufficient for relevant personnel to quickly pinpoint the root cause of the problem. Therefore, this step first extracts the specific personnel responsible for performing tasks at each subsequent node from the simulated path with risk, so that the warning content can be accurately pushed to the locations of these key personnel.

[0080] Optionally, the target expected simulation path refers to one of the multiple expected simulation paths that satisfies either a delay probability exceeding a preset delay probability or a predicted completion time exceeding a preset time threshold.

[0081] Optionally, each node after the current node refers to all active nodes located downstream of the current node on the expected simulation path, up to the end of the process.

[0082] Optionally, the target processor refers to the processing role or specific person bound to each downstream node in the process definition, such as the approver Zhang San corresponding to the "financial approval" node.

[0083] Optionally, the method for determining the target handler can be: based on the node-role mapping relationship in the process definition, combined with the context data of the current process instance (such as department, amount range, etc.), query the personnel identifier that actually undertakes the task of that node from the organizational structure database.

[0084] Understandably, by identifying all those involved in subsequent actions along the risk path, the accuracy and coverage of subsequent early warning notifications are improved.

[0085] Step B52: Obtain the physical location information of the target processor and the usage status of at least one hardware device associated with the target processor, wherein the hardware device includes a printer, an access control gate, and a meeting room reservation screen. It should be noted that simply knowing the identity of the person handling the alert is insufficient to deliver the alert in the most effective way, because different people may be in different physical locations at different times, and the availability of surrounding hardware devices will also affect the effectiveness of information delivery. Therefore, this step simultaneously collects the spatial coordinates of the person and the operational status of the associated devices.

[0086] Optionally, physical location information refers to the real-time location data of the target processor in the office environment, such as the floor, room number, or coordinates obtained through enterprise access control systems, Wi-Fi, or Bluetooth.

[0087] Optionally, hardware devices refer to physical terminals associated with the daily office activities of the target handler, including printers (for outputting paper warning slips), access control gates (for displaying reminders during passage), and meeting room reservation screens (for displaying warnings on the reservation interface).

[0088] Optionally, usage status refers to whether each hardware device is currently online, idle, or occupied, such as whether the printer is out of paper, whether the access control gate is malfunctioning, or whether the conference room screen is in standby mode.

[0089] Alternatively, the above information can be obtained by calling the device management interface of the enterprise IoT platform to query the real-time status code of each device.

[0090] Understandably, obtaining both location and device status simultaneously improves environmental adaptability when selecting warning output devices.

[0091] Step B53: Determine the current spatial area of ​​the target processor based on the physical location information; It should be noted that physical location information is typically data such as coordinates or room numbers, while hardware devices are generally deployed within a fixed spatial area (e.g., a specific floor or workstation area). Any person within the same spatial area can use the hardware devices within that area. Therefore, this step categorizes the physical location information into the corresponding preset spatial area to determine the current spatial range of the person handling the target.

[0092] Optionally, the current spatial area is the spatial range of the target processor's current location, such as "the office area on the east side of the 12th floor of Building A" or "the corridor in front of Meeting Room C".

[0093] Optionally, the current spatial region can be determined by spatially matching the physical location information with a pre-divided regional map and calculating which polygonal region the physical location information falls within.

[0094] Understandably, by transforming point-like physical location information into surface-like spatial regions, the selection criteria for subsequent hardware devices are simplified.

[0095] Step B54: Select target hardware devices located within the current spatial region from the at least one hardware device, and use the target hardware devices as early warning output devices; It should be noted that not all hardware devices associated with the target user are located within their current spatial area. Sending alerts to remote, unoccupied hardware devices would not provide timely notification. Therefore, this step only retains hardware devices that overlap with the target user's current spatial area.

[0096] Optionally, the filtering process involves sequentially determining whether the deployment location of each hardware device belongs to the current spatial region, and if so, marking it as the target hardware device.

[0097] Optionally, the target hardware device is one or more of a printer, access control gate, or meeting room reservation screen located within the current spatial area of ​​the target processor, as determined by spatial matching.

[0098] Optionally, the early warning output device is a physical terminal used to display risk warning content or send messages. Understandably, spatial filtering improves the timeliness and accuracy of early warning information delivery, avoiding the sending of invalid data to irrelevant devices.

[0099] Step B55: Send the risk warning content for the expected simulated path of the target to the warning output device.

[0100] It should be noted that simply selecting the output device without providing specific warning information is insufficient for the target handler to understand the risk details and take action. Therefore, this step pushes the specific content of the risk warning signal generated in step S5 to the target hardware device selected in step B54 for presentation.

[0101] Optionally, the risk warning content should include at least the identifier of the current process instance, the expected delay duration, the name of the high-risk node, and the recommended actions (such as prioritizing the processing of this document).

[0102] Optionally, the method of sending the message depends on the type of target hardware device: for printers, the warning content is formatted and printed as a paper notice; for access control gates, the warning text is displayed scrolling on their screens; for meeting room booking screens, a pop-up notification is displayed on the booking interface.

[0103] Understandably, by outputting the warning information to the physical devices in the space where the person is currently located, the probability of the person missing the warning is reduced, and at the same time, it does not require the person to actively check the computer or mobile phone messages.

[0104] For example, to help understand the implementation process of the risk warning method obtained by combining the above embodiments, please refer to... Figure 2 , Figure 2 This document provides a schematic diagram of a risk warning method. Specifically, it demonstrates how to filter target hardware devices located within the current activity range of a target user from multiple associated hardware devices based on the user's physical location, thereby achieving targeted risk warning delivery. The current spatial area is determined based on the physical location information of the target user—Zhang San. This spatial area includes the target user and a printer. Outside this spatial area, other associated hardware devices are distributed, such as a first access control gate, a second access control gate, and a designated screen in the conference room. Then, the risk warning is generated from all associated devices (including…). Figure 2 The printer, two access control gates, and the reserved screen in the conference room (as shown) are selected for filtering. Figure 2As shown, only printers located within the current spatial area are selected as target hardware devices, i.e., warning output devices. Access control gates and designated screens in meeting rooms located outside the current spatial area are not selected. Ultimately, warnings regarding the risk of process delays will be sent to the selected printer (e.g., by printing a reminder document or displaying a warning message on the printer screen), ensuring that the warning information is directly and promptly delivered to the target handler, Zhang San, achieving a precise combination of spatial awareness and warning push.

[0105] Based on the above embodiments of this application, in another embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter. In addition, step S4 further includes: Step S41: Obtain environmental awareness data of at least one handler associated with the current process instance; It should be noted that in previous embodiments, the prediction of process completion time and delay probability relied solely on statistical distribution parameters in historical logs and randomly sampled expected simulation paths, without considering the real-time status of the current handlers. For example, whether the handler is processing other high-priority tasks, is off-duty, or if there are interferences in their work environment. These real-time factors affect the actual processing time of nodes, leading to biases in predictions based solely on historical data. Therefore, this step introduces environmentally aware data to dynamically correct the predictions.

[0106] Optionally, at least one handler associated with the current process instance refers to one or more specific individuals responsible for handling specific matters (such as approvals) at the current or downstream node of the instance.

[0107] Optionally, environmental sensing data includes real-time data collected from office systems, sensor networks, or wearable devices, such as the activity status of a worker's computer mouse and keyboard, the online status of instant messaging software, the occupancy of meeting rooms, the noise level near the workstation, and physiological signals such as heart rate or fatigue.

[0108] Alternatively, the data can be obtained by periodically pulling or subscribing to the latest values ​​from the aforementioned various sensing data sources.

[0109] Understandably, by introducing environmental perception data, the prediction model can perceive the real-time workload of the personnel and environmental interference, thereby improving the sensitivity of subsequent prediction results to dynamic changes.

[0110] Step S42: Convert the environmental perception data into a time-series feature vector, and align the time-series feature vector with the expected simulation path in time to obtain the aligned time-series feature vector; It should be noted that the acquired environmental perception data is usually discrete event records or unstructured numerical values, which cannot be directly compatible with the input format required by deep learning models. Furthermore, the timestamps of the environmental perception data may not match the time positions of the nodes in the expected simulation path, necessitating a unified time reference. Therefore, this step first encodes the environmental perception data into a fixed-length numerical vector sequence, and then interpolates or resamples it according to the timeline of the expected simulation path.

[0111] Optionally, the temporal feature vector refers to the environmental perception data arranged in chronological order and then converted into a multi-dimensional numerical matrix through normalization, sliding window statistics, or encoding. Each row of the matrix corresponds to a time step, and each column corresponds to a type of perception indicator (such as mouse activity frequency, online status code, noise value, etc.).

[0112] Optionally, time alignment uses the expected start time of each node in the expected simulation path as a reference time, extracts the sensing data value closest to the reference time from the time-series feature vector, or performs linear interpolation on the sensing data of two adjacent time steps, so that each node can be matched with a set of corresponding environmental sensing data.

[0113] Optionally, the aligned temporal feature vector is a feature sequence with the same length as the expected number of simulated path nodes, obtained after the above time matching, where the i-th element represents the summary of the environmental state within the time period of the i-th node.

[0114] Understandably, by aligning the time, the environmental perception data corresponds one-to-one with each node in the expected simulation path in time, thus ensuring the consistency of the structure of the subsequent model input.

[0115] Step S43: Input the aligned temporal feature vector and the expected simulation path into the pre-trained target prediction model to obtain the prediction completion time corresponding to each expected simulation path.

[0116] It should be noted that the original target prediction model only uses the expected simulated path (i.e., the time sequence and routing order of each node) as input and cannot utilize the real-time status information of the processing personnel. This step uses the aligned environmental features as an additional input channel, which, together with the expected simulated path, is input into the pre-trained target prediction model, enabling the target prediction model to re-evaluate by integrating historical statistical patterns and the current real-time status.

[0117] Optionally, the pre-trained target prediction model is a pre-trained multimodal deep learning model whose input layer accepts two branches simultaneously: one is the node time sequence and routing code of the expected simulated path, and the other is the aligned temporal feature vector; the target prediction model integrates the two types of information through a feature fusion layer and outputs the predicted completion time (the estimated total time from the current moment to the end of the process). Optionally, in the process of outputting the predicted completion time, the delay probability (the possibility that the completion time exceeds the service level agreement threshold) is obtained.

[0118] Optionally, the predicted completion time and delay probability obtained in this step refer to the new values ​​obtained after correction by environmental perception data, compared to the original prediction results based solely on the expected simulated path in step S4.

[0119] Understandably, by incorporating the real-time environmental status of the personnel, this step enables the prediction results to dynamically reflect the current workload and environmental interference of the personnel, reducing the prediction errors introduced by the inability to capture real-time changes using historical static distribution data.

[0120] Based on the above embodiments of this application, in another embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter.

[0121] It should be noted that this embodiment applies to business process scenarios involving multiple organizations and stakeholders (such as order approval processes jointly completed by multiple companies in supply chain finance). Different stakeholders (such as suppliers, logistics providers, and banks) each hold sensitive process log data. Due to data privacy and security compliance requirements, this data cannot be centrally hosted on a single server for model training. Furthermore, the dynamic changes in the workload of each stakeholder directly affect the processing time distribution of process nodes. Therefore, a model training method that can both protect data privacy and integrate the experience of multiple parties is needed, as well as an adaptive mechanism that can adjust risk simulation parameters based on real-time load. The following explanation uses a risk warning device as the coordinating entity for federated learning.

[0122] Based on this, prior to step S4, the method further includes: Step D1: Obtain the historical process log data stored by each participant in the multiple business systems. The historical process log data includes the routing results of the process instances completed by each participant, the processing time of each node, the actual completion time, and the actual delay probability. It should be noted that the amount of historical data from a single participant is limited and subject to domain bias, making it impossible to train a predictive model with strong generalization ability. However, directly aggregating the raw data of all participants (i.e., historical process log data) would pose a data leakage risk. Therefore, in this step, the risk warning device initiates a data acquisition request to each participant, but the actual data remains in the local storage of each participant.

[0123] Optionally, the participants in a business system refer to entities or departments that participate in the same cross-organizational business process, such as suppliers, distributors, and banks.

[0124] Optionally, historical process log data consists of execution trajectory information of completed process instances recorded in the local databases of each participant.

[0125] Optionally, the routing result refers to the downstream path actually selected by each process instance at each branch node.

[0126] Optionally, the processing time for each node refers to the actual time consumed by each active node from start to finish.

[0127] Optionally, the actual completion time refers to the total time taken for the entire process instance from start to finish.

[0128] Optionally, the actual delay probability is a label value indicating whether the process instance has timed out (e.g., if the actual completion time exceeds the service level agreement threshold, it is marked as 1, otherwise it is marked as 0).

[0129] Understandably, not transmitting the original log content improves the level of data privacy protection during subsequent federated learning processes.

[0130] Step D2: On the local nodes of each participant, train the local prediction model using the historical process log data of each participant to obtain the local model parameters of each participant. It should be noted that directly using the raw data of each participant to train the model would expose sensitive information. Therefore, in this step, each participant independently completes model training within its own network boundary, producing only irreversible model parameters.

[0131] Optionally, a local node refers to a server or computing device deployed within each participating party. This device communicates with the risk warning device through an encrypted channel, but the original data remains on the local node.

[0132] Optionally, the local prediction model refers to the model to be trained that has the same neural network structure as the target prediction model in step S4.

[0133] Optionally, training refers to using the historical process log data of each participant as training samples, and iteratively updating the model weights through the backpropagation algorithm to minimize the error between the predicted completion time and the actual completion time.

[0134] Optionally, the local model parameters are the weight matrix and bias vector obtained after training, such as the weight coefficients of each gate in an LSTM network.

[0135] Understandably, the participants only share model parameters rather than raw data, thus avoiding the leakage of business process details and commercially sensitive information.

[0136] Step D3: Aggregate the local model parameters of each participant to obtain the global model parameters; It should be noted that the local model parameters of a single participant only reflect the process rules under its own business scenario and cannot cover the data distribution of other participants. Therefore, it is necessary to merge all local parameters into global parameters with greater generalization capabilities.

[0137] Optionally, aggregation involves the risk warning device collecting local model parameters uploaded by all participants and then performing a weighted average based on the number of samples or data quality of each participant. For example, a federated average algorithm can be used, where the parameters of each participant are multiplied by the proportion of that participant's sample size to the total sample size, and then summed.

[0138] Optionally, the global model parameters are a set of model weights obtained by aggregation, which integrates the historical process experience of all participants.

[0139] Understandably, through aggregation operations, global model parameters can capture common process patterns across organizations, improving the adaptability of subsequent predictive models to different stakeholders' business scenarios.

[0140] Step D4: Update the local prediction model of each participant through the global model parameters, and execute the step of training the local prediction model on the local node of each participant through the historical process log data of each participant to obtain the local model parameters of each participant, until the local prediction model of each participant converges to obtain the target prediction model.

[0141] It should be noted that the global model parameters obtained from a single aggregation may not yet be optimal because the local data distributions of each participant vary significantly. Therefore, this step returns the global parameters to each participant, replacing their original local model parameters, and then repeats the iterative process of local training and global aggregation until the model performance no longer improves.

[0142] Optionally, the update involves the risk warning device broadcasting global model parameters to all participants, and each participant using these global model parameters to overwrite the current model parameters of its local prediction model.

[0143] Optionally, convergence is defined as the change in global model parameters being less than a preset change threshold in multiple consecutive iterations, or the prediction error on the validation set no longer decreasing.

[0144] Optionally, the target prediction model is a prediction model that is finally obtained after multiple rounds of federated training and can be used to predict the completion time and delay probability in step S4.

[0145] Understandably, through multiple rounds of iterative training, the target prediction model, while protecting the data privacy of all participants, integrates business knowledge from multiple parties, thereby improving the prediction accuracy and generalization ability for cross-organizational process instances.

[0146] For example, to help understand the implementation process of the risk warning method obtained by combining the above embodiments, please refer to... Figure 3 , Figure 3 A schematic diagram of a risk warning method is provided, specifically illustrating the process of collaborative model training based on a federated learning framework. This method aggregates model parameters from multiple parties to build a more powerful target prediction model while protecting the data privacy of all participants.

[0147] The "Federated Learning Coordinator," acting as the central coordinator, is responsible for initiating and managing each training iteration and can function as a risk warning device, such as a server. Each participating party ( Figure 3 (Only "Party A" and "Party B" are shown in the example; the number of participants depends on the actual process instance.) Each participant trains its local prediction model using its own private historical process log data (containing information such as process instance routing, processing time, and delays) to obtain local model parameters. Subsequently, each participant encrypts and uploads these "local model parameters" without sharing historical process log data.

[0148] After collecting local model parameters from multiple participants, the coordinator performs an "aggregation" operation (e.g., using a federated averaging algorithm) to integrate the knowledge gained from training by each party, forming "global model parameters." These global model parameters are then distributed to each participant to update their local prediction models, enabling them to start the next round of training. This process continues until the performance of each participant's local prediction model converges and stabilizes, ultimately resulting in a powerful and generalizable "target prediction model" for subsequent process risk warnings.

[0149] In one feasible implementation, the method further includes: Step D5: Identify at least one target participant that the current process instance depends on; It should be noted that the current process instance may span multiple participants (for example, a procurement process requires supplier confirmation, logistics provider delivery, and bank payment), but not all participants will affect the processing time of the current process instance. Therefore, it is necessary to identify the key participants who actually participate in the current process instance.

[0150] Optionally, a target participant refers to a participant entity that has appeared or is about to appear in the current process instance, in its subordinate nodes (such as the "Supplier Confirmation" node).

[0151] Optionally, the determination method may be: parsing the process definition or runtime context features of the current process instance (such as the time consumption of the preceding nodes, the current handler's load rate, the complexity and priority of the process instance), extracting all nodes that have not yet been executed and are the responsibility of external participants, and taking the participants to which these nodes belong as the target participants.

[0152] Understandably, by locating the target participants, unnecessary data requests are avoided when obtaining subsequent load status, thus reducing resource waste.

[0153] Step D6: Obtain the current load status information of the target participant, wherein the current load status information includes the number of process instances currently pending processing and the average response time of the target participant; It should be noted that the processing capacity of the target participants is dynamic. If a participant currently has a large backlog of tasks, its processing time distribution will deviate from the historical average, thus affecting the accuracy of risk prediction. Therefore, this step collects load indicators in real time.

[0154] Optionally, the current load status information is a set of data reflecting the current busy level of the target participant.

[0155] Optionally, the number of currently pending process instances refers to the total number of all process instances that have not yet been completed within the participant, such as the number of documents pending approval.

[0156] Optionally, average response time refers to the average time taken for the participant to complete processing from receiving the task in a recent period (e.g., the past hour).

[0157] Alternatively, the acquisition method may be: the risk warning device can obtain real-time statistical values ​​by calling the load query interface provided by the target participant or by reading the values ​​from its task queue management system.

[0158] Understandably, introducing real-time load status information allows subsequent risk simulations to reflect the current actual processing capacity rather than relying solely on historical static distribution data.

[0159] Step D7: Based on the current load status information, adjust the sampling weight or sampling range of the current node corresponding to the target participant for the status snapshot.

[0160] It should be noted that if the current load of a target participant is significantly higher than its historical average, its future processing time tends to increase; conversely, if the current load is low, the processing time tends to decrease. Therefore, this step dynamically adjusts the sampling strategy for the processing time distribution parameters to make the generated candidate processing times more consistent with the current reality. The historical distribution parameters of the routing results are not directly related to the load status and do not require adjustment.

[0161] Optionally, adjusting the sampling weight refers to changing the degree of preference for different quantile intervals when sampling from the historical distribution parameters of processing time. For example, when the load is too high, the sampling weight of the high latency interval is increased, so that the probability of larger values ​​appearing in the candidate processing time is increased.

[0162] Optionally, adjusting the sampling range refers to truncating or expanding the range of sampled values, for example, expanding the upper limit of sampling from the historical maximum value to a larger numerical range when the load is too high.

[0163] Optionally, the current node corresponding to the target participant refers to the activity node in the process instance that the participant is responsible for handling, such as the "bank approval" node.

[0164] Optionally, the historical distribution parameters of the processing time for the state snapshot will be dynamically scaled or remapped according to the load status.

[0165] Understandably, by adjusting the sampling parameters (i.e., sampling weights or sampling range) according to the real-time load, the subsequently generated expected simulation path is made closer to the current actual operating environment, thereby improving the real-time performance and accuracy of risk warnings.

[0166] Based on the above embodiments of this application, in another embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter.

[0167] It should be noted that the technical solution of this application is applied to the root cause analysis stage after process risk warning. Traditional methods can only indicate the existence of delay risk, but cannot point out which node the delay occurred at or why it occurred, making it difficult for managers to take effective intervention measures. Therefore, this embodiment uses a knowledge graph to locate and reason about the path that triggers the warning, and outputs an explainable cause of the delay.

[0168] Based on this, after step S5, the following is included: Step C51: Determine the early warning simulation path that triggers the early warning, as well as the predicted completion time and delay probability corresponding to the early warning simulation path, from the current process instance. It should be noted that in step S5, multiple expected simulation paths may simultaneously meet the warning conditions, but the risk level and delay location of each expected simulation path may differ. It is necessary to determine which expected simulation path is the primary path causing the warning. Therefore, this step selects one or more expected simulation paths from all expected simulation paths in the current process instance that cause the warning to be triggered in step S5.

[0169] Optionally, the early warning simulation path refers to any one of the multiple expected simulation paths whose delay probability exceeds a preset delay probability or whose predicted completion time exceeds a preset time threshold.

[0170] Optionally, the predicted completion time and delay probability are the output values ​​corresponding to the early warning simulation path in step S4.

[0171] Optionally, the determination method may be: when the warning is triggered in step S5, record the currently traversed path identifier and its corresponding prediction result (i.e., prediction completion time and delay probability).

[0172] Understandably, locking the early warning simulation path improves the accuracy of subsequent root cause analysis and avoids indiscriminate searching on all expected simulation paths.

[0173] Step C52: Input the early warning simulation path and the predicted completion time and delay probability corresponding to the early warning simulation path into the pre-constructed process knowledge graph to locate the delay position in the early warning simulation path; It should be noted that the early warning simulation path includes a time-series of nodes, but which nodes are the key bottlenecks actually causing delays cannot be directly identified from the time-series of nodes. Therefore, this step utilizes the historical performance benchmarks and dependencies of nodes stored in the knowledge graph to identify the locations in the early warning simulation path that deviate from the normal range.

[0174] Optionally, the pre-built process knowledge graph is a graph database containing entities such as process nodes, roles, departments, systems, and resources, as well as their relationships (such as "responsible for", "belonging to", "restricted by").

[0175] Optionally, the localization process involves comparing each node in the early warning simulation path, along with the predicted completion time and delay probability of each node, with the historical processing time distribution (such as mean and standard deviation) of the corresponding node type in the knowledge graph. The localization process calculates the degree of deviation between the simulated dwell time of the current node in the early warning simulation path and the historical mean, and marks the node with the largest deviation as the delay location.

[0176] Optionally, the delay location is a set of key nodes or nodes in the early warning simulation path that cause the overall completion time to exceed the limit.

[0177] Understandably, benchmark comparison with knowledge graphs allows delays to be pinpointed to specific nodes, improving the precision of root cause analysis.

[0178] Step C53: Perform causal inference on the delay location and output the reason for the delay at the delay location.

[0179] It's important to note that simply knowing which node experienced the delay is insufficient to guide improvements; it's necessary to understand why the delay occurred at that node. Therefore, this step utilizes the relationships within the knowledge graph to trace the root cause of the performance degradation at that node.

[0180] Optionally, causal inference involves retrieving entities and their attributes related to the delayed location node in the knowledge graph, starting from the delayed location node and following relational edges such as "limited by," "dependent on," and "associated with." For example, if the current load rate of the "processing role" entity associated with the delayed location node exceeds a threshold, the inferred cause is "processor overload"; if the effective time of the associated "rules and regulations" entity is close to the time of the delay, the inferred cause is "new rules leading to unfamiliarity with operation"; and if the status of the associated "resource" entity is unavailable, the inferred cause is "resource shortage."

[0181] Optionally, the output reason is to return the text description obtained from the reasoning as the result.

[0182] Understandably, by using causal inference through knowledge graphs, delays at the data level can be transformed into understandable reasons at the business level, thereby improving the targeting of optimization suggestions and making risk management more targeted and faster.

[0183] Based on the above embodiments of this application, in another embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter.

[0184] It should be noted that this embodiment is applied to the initial construction phase of a business process. Traditional methods require business personnel to manually configure form fields, validation rules, and process nodes through drag-and-drop editors or template libraries, which has drawbacks such as high construction threshold, slow response to business changes, and lack of semantic understanding. Therefore, this embodiment uses natural language processing technology to directly transform users' colloquial requirements into executable process definitions and form structures.

[0185] Based on this, prior to step S1, the following is included: Step S11: Receive the natural language requirement description input by the management of the business system; It should be noted that business personnel or administrators cannot directly write structured process definitions, but they typically use natural language to describe business requirements. Therefore, this step provides a text input interface to obtain unstructured raw requirements.

[0186] Optionally, the administrator of the business system refers to personnel with process definition permissions, such as department heads or process administrators.

[0187] Optionally, the natural language requirement description is text entered by the user in a spoken or written manner, such as "Create a business trip expense report, including the applicant, department, departure point, transportation expenses, and accommodation expenses. The total amount exceeds 5,000 yuan and requires approval from the finance director."

[0188] Optionally, the risk warning device receives the natural language requirement description through a text box or speech-to-text module in the interface.

[0189] Understandably, directly receiving natural language input lowers the expression threshold for process construction, allowing non-professionals to build processes that better meet the business needs of the corresponding departments.

[0190] Step S12: Extract key business entities from the natural language requirement description, wherein the key business entities include field names, field types, business rules, and approval flow. It should be noted that natural language descriptions contain a large amount of unstructured information, which cannot be directly used to generate forms and processes. They need to be transformed into structured business elements. Therefore, this step uses a pre-trained semantic parsing model (such as a named entity recognition model based on BERT fine-tuning, where BERT stands for Bidirectional Encoder Representations from Transformers) to analyze the input text.

[0191] Optionally, the field name refers to the business data item that appears in the natural language requirement description, such as "Applicant", "Department", and "Place of Departure".

[0192] Optionally, the field type is a data format inferred from the field name and context, such as "Amount" being mapped to a numeric type and "Date" being mapped to a date type.

[0193] Optionally, business rules refer to constraints on field values ​​or relationships between fields, such as the comparison logic in "total amount exceeds 5000 yuan".

[0194] Optionally, the approval flow refers to the task execution order and decision branches implied in the description. For example, "requires CFO approval" means that the process moves to the CFO node when the conditions are met.

[0195] Optionally, the extraction method includes: performing word segmentation, part-of-speech tagging, and dependency parsing on the text, and then matching it with a predefined business entity dictionary and rule template.

[0196] Understandably, by extracting key business entities and converting natural language into structured parameters, the automation level of subsequent form and process generation is improved.

[0197] Step S13: Based on the field name and the field type, match the corresponding interface component from the preset component library to generate a form structure, wherein a data model for the process instance to be built is generated based on the form structure; It's important to note that different field types require different user interface components to collect data. For example, a monetary field should use a numeric input box with thousands separators, and a date field should use a date picker. Therefore, this step automatically assembles the form based on the extracted field metadata.

[0198] Optionally, the default component library is a collection of resources containing various UI components (such as input boxes, drop-down selectors, date pickers, and file upload components) and their mapping relationships with field types.

[0199] Optionally, matching involves searching for the corresponding component type in the component library based on the field type. For example, the field type "Amount" matches the "Number Input Box" component.

[0200] Optionally, generating the form structure involves determining the order of the components in the form, the layout (such as single or double columns), and the attributes of the components (such as whether they are required, default values, and validation regular expressions).

[0201] Optionally, the data model is a set of structured data based on the form structure definition, such as JSON Schema, which contains the name, data type, validation rules, etc. of each field, for storing and validating user input data during subsequent process instance runtime.

[0202] Understandably, automatically matching components and generating form structures eliminates the need for manual drag-and-drop configuration, thus improving the efficiency and consistency of form construction.

[0203] Step S14: Based on the business rules and the approval flow, generate the node sequence of the process instance to be built and the flow conditions between each node; It's important to note that a data model alone cannot define the execution order and branching logic of a business process; business rules and approval flows need to be transformed into an executable process topology. Therefore, this step maps business rules and approval flows to nodes and edges in a process definition language.

[0204] Optionally, a node sequence refers to an ordered list of activity nodes in a process, such as "submit application, department approval, financial approval, end".

[0205] Optionally, the flow condition refers to the logical expression that must be satisfied to move from one node to the next, such as "if the total amount is greater than 5,000 yuan, it will be approved by the financial director; otherwise, it will be approved by the finance department directly."

[0206] Optionally, the generation method includes: converting the condition judgment in the business rules into the outgoing edge condition expression of the node, and converting the role allocation in the approval flow into the assignment rule of user task.

[0207] Understandably, automatically generating node sequences and flow conditions ensures that the process definition directly corresponds to the business requirement description, reducing the deviations introduced when manually configuring the process engine.

[0208] Step S15: Construct a process instance based on the data model, the node sequence, and the flow conditions.

[0209] It should be noted that the data model, node sequence, and flow conditions correspond to the runtime data structure, activity topology, and routing logic of the process instance, respectively, and are all necessary factors for constructing the process instance.

[0210] Optionally, building a process instance involves registering the data model (form structure) as the input variable definition of the process, compiling the node sequence and flow conditions into a description of the business process execution language, and instantiating a process template that can be run.

[0211] Optionally, a process instance is a concrete execution entity of a process template, and the "current process instance" mentioned in the subsequent step S1 is generated from this construction process.

[0212] Understandably, by automatically building complete process instances, the fully automated conversion from natural language requirements to runnable processes is achieved, improving business response speed and the accuracy of process definitions.

[0213] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the risk warning method of this application. Any simple modifications based on this technical concept, such as the interaction and combination of various embodiments, are all within the protection scope of this application.

[0214] This application also provides a risk warning device applied to a business system, wherein at least one process instance is running in the business system. Please refer to [reference needed]. Figure 4 The risk warning device includes: The acquisition module 10 is used to acquire a state snapshot of the current process instance in operation, wherein the state snapshot includes: historical distribution parameters of processing time and historical distribution parameters of routing results corresponding to the current node; The sampling module 20 is used to sample the historical distribution parameters of the processing time to obtain multiple candidate processing times corresponding to the processing time of the current node, and to sample the historical distribution parameters of the routing results to obtain multiple candidate routing results corresponding to the routing results of the current node. The combination module 30 is used to combine the multiple candidate processing times with the multiple candidate routing results to obtain multiple expected simulated paths for the current process instance starting from the current node; The prediction module 40 is used to input each expected simulated path into the pre-trained target prediction model, obtain the predicted completion time corresponding to each expected simulated path, and determine the delay probability corresponding to each expected simulated path. The early warning module 50 is used to generate a risk warning signal for the current process instance if the delay probability of at least one expected simulated path exceeds a preset delay probability, or the predicted completion time exceeds a preset time threshold.

[0215] The risk warning device provided in this application, employing the risk warning method described in the above embodiments, can solve the technical problems of poor accuracy and high false alarm and false negative rates in existing risk warning systems. Compared with the prior art, the beneficial effects of the risk warning device provided in this application are the same as those of the risk warning method provided in the above embodiments, and other technical features in the risk warning device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0216] This application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the risk warning method described in the first embodiment above.

[0217] The following is for reference. Figure 5 The diagram illustrates a structural schematic of an electronic device suitable for implementing embodiments of this application. The electronic devices in these embodiments may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, and PDAs (Personal Digital Assistants), as well as fixed terminals such as digital TVs and desktop computers. Figure 5 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0218] like Figure 5As shown, the electronic device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the electronic device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. The communication device 1009 allows the electronic device to communicate wirelessly or wiredly with other devices to exchange data. Although the diagrams show electronic devices with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems may be implemented alternatively.

[0219] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0220] The electronic device provided in this application, employing the risk warning method described in the above embodiments, can solve the technical problems of poor accuracy and high false alarm and false negative rates in existing risk warning systems. Compared with the prior art, the beneficial effects of the electronic device provided in this application are the same as those of the risk warning method provided in the above embodiments, and other technical features of the electronic device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0221] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0222] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0223] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the risk warning method in the above embodiments.

[0224] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0225] The aforementioned computer-readable storage medium may be included in an electronic device or may exist independently without being assembled into an electronic device.

[0226] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0227] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0228] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0229] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described risk warning method. This solves the technical problems of poor accuracy and high false alarm and false negative rates in existing risk warning methods. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the risk warning method provided in the above embodiments, and will not be repeated here.

[0230] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the risk warning method described above.

[0231] The computer program product provided in this application can solve the technical problems of poor accuracy and high false alarm and false negative rates in existing risk warning systems. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the risk warning method provided in the above embodiments, and will not be repeated here.

[0232] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A risk warning method, characterized in that, The risk warning method is applied to a business system in which at least one process instance runs, and includes: Obtain a state snapshot of the current process instance in operation, wherein the state snapshot includes: historical distribution parameters of processing time and historical distribution parameters of routing results corresponding to the current node; The historical distribution parameters of the processing time are sampled to obtain multiple candidate processing times corresponding to the processing time of the current node, and the historical distribution parameters of the routing results are sampled to obtain multiple candidate routing results corresponding to the routing results of the current node. The multiple candidate processing times are combined with the multiple candidate routing results to obtain multiple expected simulated paths for the current process instance starting from the current node; Each expected simulated path is input into the pre-trained target prediction model to obtain the predicted completion time corresponding to each expected simulated path, and the delay probability corresponding to each expected simulated path is determined. If the delay probability of at least one expected simulated path exceeds the preset delay probability, or the predicted completion time exceeds the preset time threshold, a risk warning signal is generated for the current process instance.

2. The method as described in claim 1, characterized in that, Following the step of generating a risk warning signal for the current process instance, the following is included: The current process instance is cloned to obtain at least one cloned instance; Generate and assign a different processing path to the cloned instance than the current node of the current process instance; The current process instance and the cloned instance are executed in parallel until the current process instance or any cloned instance reaches the end of the process.

3. The method as described in claim 1, characterized in that, Following the step of generating a risk warning signal for the current process instance, the method further includes: Determine the target handlers for each node after the current node in the target expected simulation path, wherein the target expected simulation path is an expected simulation path of the current process instance, and the delay probability of the target expected simulation path exceeds a preset delay probability, or the predicted completion time exceeds a preset time threshold. The physical location information of the target processor is obtained, as well as the usage status of at least one hardware device associated with the target processor, wherein the hardware device includes a printer, an access control gate, and a meeting room reservation screen. The current spatial region of the target processor is determined based on the physical location information; From the at least one hardware device, select the target hardware device located within the current spatial region, and use the target hardware device as the early warning output device; The risk warning content for the expected simulated path of the target is sent to the warning output device.

4. The method as described in claim 1, characterized in that, The steps for obtaining the predicted completion time for each expected simulation path include: Obtain environmental awareness data for at least one handler associated with the current process instance; The environmental perception data is converted into a time-series feature vector, and the time-series feature vector is time-aligned with the expected simulation path to obtain the aligned time-series feature vector. The aligned temporal feature vectors and the expected simulation paths are input into the pre-trained target prediction model to obtain the predicted completion time for each expected simulation path.

5. The method as described in claim 1, characterized in that, Prior to the step of inputting each expected simulated path into the pre-trained target prediction model, the method further includes: Obtain historical process log data stored by each participant in the multiple business systems, wherein the historical process log data includes the routing results of the process instances completed by each participant, the processing time of each node, the actual completion time, and the actual delay probability. On the local nodes of each participant, local prediction models are trained using the historical process log data of each participant to obtain the local model parameters of each participant. The local model parameters of each participant are aggregated to obtain the global model parameters; The local prediction models of each participant are updated by updating the global model parameters. The steps of training the local prediction models on the local nodes of each participant using their respective historical process log data are executed to obtain the local model parameters of each participant, until the local prediction models of each participant converge to obtain the target prediction model.

6. The method as described in claim 5, characterized in that, The method further includes: Identify at least one target participant that the current process instance depends on; Obtain the current load status information of the target participant, wherein the current load status information includes the number of process instances currently pending processing and the average response time of the target participant; Based on the current load status information, adjust the sampling weight or sampling range of the current node corresponding to the target participant for the status snapshot.

7. The method as described in claim 1, characterized in that, Following the step of generating a risk warning signal for the current process instance, the method further includes: Determine the warning simulation path that triggers the warning, as well as the predicted completion time and delay probability corresponding to the warning simulation path, from the current process instance; The early warning simulation path, the predicted completion time and delay probability corresponding to the early warning simulation path are input into a pre-constructed process knowledge graph to locate the delay position in the early warning simulation path. Perform causal inference on the location of the delay and output the reason for the delay at that location.

8. The method as described in claim 1, characterized in that, Prior to the step of obtaining a state snapshot of the currently running process instance, the following is included: Receive natural language requirement descriptions input by the management of the business system; Extract key business entities from the natural language requirement description, wherein the key business entities include field names, field types, business rules, and approval flow; Based on the field name and the field type, the corresponding interface component is matched from the preset component library to generate a form structure, wherein a data model of the process instance to be built is generated based on the form structure; Based on the business rules and the approval flow, generate the node sequence of the process instance to be built and the flow conditions between each node; Based on the data model, the node sequence, and the flow conditions, a process instance is constructed.

9. An electronic device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the risk warning method as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the risk warning method as described in any one of claims 1 to 8.

Images