Abnormal risk processing method and device, electronic equipment, medium and program product

Abstract

The application provides an abnormal risk processing method and device, electronic equipment, medium and program product, which can be applied to the field of artificial intelligence technology. The method comprises the following steps: acquiring multi-source data of a target object, determining an event anchor point corresponding to the target object and risk evolution data associated with the event anchor point based on the multi-source data; acquiring a coupling relationship graph associated with the target object, calibrating the coupling relationship graph based on data representing resource flow change in the risk evolution data to obtain a calibrated coupling relationship graph; determining an evolution risk feature of the target object based on the risk evolution data, and determining a graph risk feature of the target object based on the calibrated coupling relationship graph; inputting the evolution risk feature and the graph risk feature into an abnormal risk processing model to obtain a comprehensive risk result; and determining an abnormal risk processing level of the target object based on the comprehensive risk result, and performing a corresponding abnormal risk processing action according to the abnormal risk processing level.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, to the application of large models in business processing, and more specifically to an anomaly risk handling method, apparatus, equipment, medium, and program product. Background Technology

[0002] Existing methods for identifying abnormal risks typically rely on the static attributes of the target object, historical behavior records, single resource transfer records, or preset scoring rules for judgment. Some solutions identify relationships between objects through relationship graphs or discover abnormal patterns through resource transfer information such as transaction structures and funding paths. However, these methods often treat object relationships, resource transfer relationships, and temporal behavioral changes separately, making it difficult to depict the continuous risk evolution process of the target object around key events. For example, the target object may exhibit abnormal states at different stages before and after resource application, resource allocation, resource disbursement, resource transfer, or changes in performance. Relying solely on features from a single point in time or a fixed window can easily lead to identification delays or misjudgments. Furthermore, existing risk graphs are usually constructed primarily based on static relationships, failing to fully utilize the resource transfer results after the event to dynamically calibrate the relationships in the graph, resulting in a disconnect between graph-based risk assessment and actual risk evolution. Summary of the Invention

[0003] In view of the above problems, embodiments of this application provide an anomaly risk handling method, apparatus, device, medium, and program product.

[0004] According to a first aspect of this application, an anomaly risk handling method is provided, the method comprising: acquiring multi-source data of a target object; determining, based on the multi-source data, an event anchor point corresponding to the target object and risk evolution data associated with the event anchor point, wherein the event anchor point is used to determine the segmented position or alignment position of the risk evolution data in the time dimension; acquiring a coupling relationship graph associated with the target object; calibrating the coupling relationship graph based on data representing resource flow changes in the risk evolution data to obtain a calibrated coupling relationship graph, wherein the coupling relationship graph is used to represent the coupling relationship between object association relationships and resource flow relationships; determining the evolutionary risk characteristics of the target object based on the risk evolution data, and determining the graph risk characteristics of the target object based on the calibrated coupling relationship graph; inputting the evolutionary risk characteristics and the graph risk characteristics into an anomaly risk handling model, wherein the anomaly risk handling model performs gating adjustment on the feature fusion process according to the synergistic relationship between the evolutionary risk characteristics and the graph risk characteristics to obtain a comprehensive risk result; and determining the anomaly risk handling level of the target object based on the comprehensive risk result, and executing corresponding anomaly risk handling actions according to the anomaly risk handling level.

[0005] According to an embodiment of this application, the step of obtaining a coupling relationship graph associated with the target object, and calibrating the coupling relationship graph based on data representing resource flow changes in the risk evolution data to obtain a calibrated coupling relationship graph, wherein the coupling relationship graph is used to represent the coupling relationship between object association and resource flow relationship, includes: inputting the user request into a semantic embedding model to obtain a request semantic vector corresponding to the request semantic representation; calculating the semantic distance between the request semantic vector and the attack intent category node or attack sample node in the attack intent semantic graph; and determining the attack intent matching result based on the semantic distance, wherein the attack intent matching result includes attack intent category, attack similarity, or risk matching level.

[0006] According to an embodiment of this application, the defense model is trained based on an adversarial sample set, which is determined as follows: the evolutionary risk characteristics of the target object are determined based on risk evolution data, wherein the candidate attack variants and the original attack sample satisfy the semantic consistency condition; and the candidate attack variants are input into an initial defense model to obtain the candidate attack variants that will cause the initial defense model to generate a missed judgment or a low confidence judgment and form the adversarial sample set.

[0007] According to an embodiment of this application, determining the evolutionary risk characteristics of a target object based on risk evolution data includes: determining a vulnerable intent cluster based on the vulnerability evaluation characteristics of each attack intent cluster in the attack intent semantic graph, wherein the vulnerability evaluation characteristics include at least one of the number of samples, the false negative rate, the discrimination confidence level, and the number of new attack variants; determining an original attack sample from the attack sample nodes corresponding to the vulnerable intent cluster, and determining an attack variant generation strategy based on the attack intent category corresponding to the vulnerable intent cluster; and performing semantic preservation replacement, syntactic structure reorganization, interference context insertion, and / or logical trap injection on the original attack sample based on the attack variant generation strategy to obtain the candidate attack variant.

[0008] According to an embodiment of this application, the attack intent semantic graph is pre-constructed in the following manner: acquiring multi-source attack texts, performing data cleaning and standardization on the multi-source attack texts to obtain an attack text set; performing semantic vectorization on the attack text set to obtain attack semantic vectors, determining attack intent clusters based on the semantic similarity relationships between the attack semantic vectors; and generating attack intent category nodes based on the attack intent clusters, using the attack texts in the attack intent clusters as attack sample nodes, establishing semantic association edges between the attack intent category nodes and the corresponding attack sample nodes, thereby obtaining the attack intent semantic graph.

[0009] According to an embodiment of this application, the method further includes: generating a central intent description corresponding to the attack intent cluster based on the attack text in the same attack intent cluster, and using the central intent description as a node attribute of the attack intent category node corresponding to the attack intent cluster; determining the semantic distance between the new attack sample and an existing attack intent category node or an existing attack sample node when a new attack sample is obtained; and, if the semantic distance satisfies the inclusion condition, treating the new attack sample as a new attack sample node, and establishing a semantic association edge between the new attack sample node and the corresponding existing attack intent category node.

[0010] According to an embodiment of this application, the method further includes: obtaining the discrimination confidence level output by the defense model in response to the user request; marking the user request as a boundary sample when the discrimination confidence level is within a preset uncertainty range; and updating the defense model and / or the attack intent semantic graph based on the boundary sample.

[0011] According to an embodiment of this application, determining the security handling strategy for the user request based on the attack intent matching result and the risk discrimination result includes: determining a graph-side risk assessment result based on the attack intent category, attack similarity, and risk matching level in the attack intent matching result; determining a model-side risk assessment result based on at least one of the security category, risk probability, attack intent, and discrimination reason in the risk discrimination result; and determining the security handling strategy based on the consistency between the graph-side risk assessment result and the model-side risk assessment result.

[0012] A second aspect of this application provides an anomaly risk handling apparatus, the apparatus comprising: a data acquisition module, configured to: acquire multi-source data of a target object, and determine, based on the multi-source data, an event anchor point corresponding to the target object and risk evolution data associated with the event anchor point, wherein the event anchor point is used to determine the segmented position or alignment position of the risk evolution data in the time dimension; and a graph calibration module, configured to: acquire a coupling relationship graph associated with the target object, and calibrate the coupling relationship graph based on data representing resource flow changes in the risk evolution data to obtain a calibrated coupling relationship graph, wherein the coupling relationship graph is used to represent object association relationships and resource flow. The coupling relationship between relationships; a gating adjustment module, used to: determine the evolutionary risk characteristics of the target object based on the risk evolution data, and determine the spectral risk characteristics of the target object based on the calibrated coupling relationship graph; input the evolutionary risk characteristics and the spectral risk characteristics into an anomaly risk processing model, and have the anomaly risk processing model gating the feature fusion process according to the synergistic relationship between the evolutionary risk characteristics and the spectral risk characteristics to obtain a comprehensive risk result; and an anomaly processing module, used to: determine the anomaly risk processing level of the target object based on the comprehensive risk result, and execute the corresponding anomaly risk processing action according to the anomaly risk processing level.

[0013] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0014] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0015] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0016] According to embodiments of this application, event anchor points are used to determine the segmented or aligned positions of risk evolution data in the time dimension. This allows the state changes and resource flow changes of the target object before and after key events to be uniformly incorporated into the continuous risk evolution process for processing, avoiding identification lag or misjudgment caused by judging solely based on static features or a single time window. Simultaneously, the coupling relationship graph is calibrated using data representing resource flow changes in the risk evolution data, enabling the coupling relationship between object associations and resource flow relationships to be dynamically updated according to actual resource flow results, thereby improving the accuracy of graph risk features. Furthermore, the feature fusion process is gated and adjusted by an abnormal risk handling model based on the synergistic relationship between evolutionary risk features and graph risk features, so that the comprehensive risk result can reflect the degree of abnormality under the combined effect of event-driven risk evolution and graph-related risks, thereby improving the accuracy, dynamic adaptability, and interpretability of abnormal risk handling level determination and abnormal risk handling action execution. Attached Figure Description

[0017] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0018] Figure 1 The illustrations depict application scenarios of the anomaly risk handling methods, apparatus, devices, media, and program products based on embodiments of this application.

[0019] Figure 2 A flowchart illustrating an anomaly risk handling method based on an embodiment of this application is shown schematically.

[0020] Figure 3 The flowchart illustrates a method for determining the evolutionary risk characteristics of a target object based on risk evolution data, according to some exemplary embodiments of this application.

[0021] Figure 4 The flowchart schematically illustrates a method for determining the map risk characteristics of a target object based on a calibrated coupling relationship graph, according to some exemplary embodiments of this application.

[0022] Figure 5 A schematic diagram illustrating the structure of an anomaly risk handling device based on an embodiment of this application is shown; and

[0023] Figure 6 A block diagram of an electronic device suitable for implementing an anomaly risk handling method based on an embodiment of this application is shown schematically. Detailed Implementation

[0024] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0027] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0028] First, the terminology used in this article will be described and explained.

[0029] Event anchors are key events identified from multi-source data and used for time segmentation or alignment of risk evolution data. Event anchors can correspond to changes in the status of a target object, changes in resource allocation, changes in resource flow, or changes in performance status. Event anchors are not limited to a specific business event, as long as they can serve as the segmentation or alignment position of risk evolution data in the time dimension.

[0030] Risk evolution data refers to data associated with an event anchor point that reflects changes in the target object's state, behavior, resource allocation, resource flow, or performance before, after, or during the period covering the event anchor point. Risk evolution data is used to characterize the continuous risk changes that a target object experiences around an event anchor point.

[0031] Resource flow records refer to data used to record the flow of resources from one object or node to another. Resource flow records may include one or more of the following information: resource flow direction, resource flow object, resource flow intensity, occurrence time, number of flows, flow path, and convergence node or transit node.

[0032] A coupling graph is a graph structure used to represent the coupling relationship between object associations and resource flow relationships. A coupling graph can include nodes representing objects or resource flow objects, and connecting edges representing object associations, resource flow relationships, or mappings between the two. Coupling graphs can be pre-generated or dynamically generated based on multi-source data of the target object.

[0033] It's important to note that the term "neural network" can refer to a machine learning network based on deep learning. A neural network processes input and provides corresponding output, typically consisting of an input layer, an output layer, and one or more hidden layers between them. Neural networks used in deep learning applications often include many hidden layers, increasing the network's depth. The layers of a neural network are connected sequentially, so that the output of the previous layer serves as the input to the next layer. The input layer receives the input to the neural network, while the output layer's output becomes the final output. Each layer of a neural network includes one or more nodes (also called processing nodes or neurons), each processing the input from the layer above.

[0034] It should be understood that machine learning generally includes three phases: training, testing, and application (also known as inference). In the training phase, a given model is trained using a large amount of training data, iteratively updating parameter values ​​until the model can consistently generate inferences that meet the expected goals from the training data. Through training, the model can be considered to have learned the relationship between inputs and outputs (also known as the input-output mapping) from the training data. The parameter values ​​of the trained model are determined. In the testing phase, test inputs are applied to the trained model to test whether it can provide the correct output, thus determining the model's performance. In the application phase, the model can be used to process actual inputs based on the trained parameter values ​​to determine the corresponding output.

[0035] With the continuous expansion of online business processing and resource allocation scenarios, the identification and handling of abnormal risk objects increasingly rely on multi-source data fusion, relationship graph analysis, and risk scoring models. Existing technologies typically construct a risk feature set by collecting basic information, behavioral data, transaction data, device data, and relational data of the target object, and output a risk score based on rule models, statistical models, or machine learning models. Then, appropriate handling strategies are determined based on the risk score. These methods can identify single points of abnormal behavior or known risk patterns to a certain extent.

[0036] However, in real-world abnormal risk scenarios, the risk of a target object is often not manifested by a single static characteristic, but rather presents a continuous evolutionary process around key events. For example, at different stages such as resource application, resource allocation, resource distribution, resource transfer, resource splitting, and changes in performance status, the changes in the target object's status, behavior, and resource flow may be interconnected and jointly constitute an abnormal risk chain. Existing methods mostly use data from a single point in time or within a single statistical window as the basis for identification, making it difficult to uniformly characterize the state transitions and resource migrations that occur before and after key events, resulting in an incomplete identification of the risk formation process.

[0037] Meanwhile, existing graph-based risk identification methods typically focus on static relationships between objects, such as shared devices, shared addresses, shared contacts, shared accounts, or other shared relationships; or they focus on resource flow relationships, such as transfer paths, aggregation nodes, and transit nodes. While these methods can describe object associations or resource flows separately, they often lack an expression of the coupling relationship between the two. It is difficult to determine whether the static associations between objects will be verified in the resource flow results, and it is also difficult to use the resource flow results to reverse-engineer the credibility of object associations.

[0038] Furthermore, existing risk scoring models typically employ fixed weights, fixed rules, or a single model output to simply fuse different risk characteristics. This approach struggles to dynamically adjust the fusion process based on the synergistic relationship between risk evolution characteristics and graph risk characteristics. When the target object simultaneously experiences abrupt state changes before and after an event, abnormal resource flows, and enhanced graph correlations, the fixed fusion method may fail to adequately reflect the risk amplification effect resulting from the co-occurrence of multiple risk characteristics; conversely, when only static correlations exist without corroborating resource flows, misjudgments may occur.

[0039] Based on this, embodiments of this application provide an anomaly risk handling method, including: acquiring multi-source data of a target object; determining event anchor points corresponding to the target object and risk evolution data associated with the event anchor points based on the multi-source data, wherein the event anchor points are used to determine the segmented or aligned positions of the risk evolution data in the time dimension; acquiring a coupling relationship graph associated with the target object; calibrating the coupling relationship graph based on data representing resource flow changes in the risk evolution data to obtain a calibrated coupling relationship graph, wherein the coupling relationship graph is used to represent the coupling relationship between object association relationships and resource flow relationships; determining the evolutionary risk characteristics of the target object based on the risk evolution data, and determining the graph risk characteristics of the target object based on the calibrated coupling relationship graph; inputting the evolutionary risk characteristics and graph risk characteristics into an anomaly risk handling model, wherein the anomaly risk handling model performs gating adjustment on the feature fusion process according to the synergistic relationship between the evolutionary risk characteristics and the graph risk characteristics to obtain a comprehensive risk result; and determining the anomaly risk handling level of the target object based on the comprehensive risk result, and executing the corresponding anomaly risk handling action according to the anomaly risk handling level.

[0040] It should be noted that the abnormal risk handling methods, apparatus, devices, media, and program products defined in this application can be used in the fields of artificial intelligence technology and fintech, and can also be used in a variety of other fields besides artificial intelligence technology and fintech. The application fields of the abnormal risk handling methods, apparatus, devices, media, and program products provided in the embodiments of this application are not limited.

[0041] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0042] In scenarios where personal information is used for automated decision-making, the methods, devices, and systems provided in this application all provide users with corresponding operation entry points for users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process enters the expert decision-making process.

[0043] Figure 1 The illustration shows an application scenario diagram of the abnormal risk handling method, apparatus, device, medium and program product based on the embodiments of this application.

[0044] like Figure 1As shown, application scenario 100 based on embodiments of this application may include a first terminal device 101, a second terminal device 102, a database 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the database 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables. For example, a user can use the first terminal device 101 and the second terminal device 102 to interact with the server 105 and / or the database 103 through the network 104 to receive or send information, etc.

[0045] The first terminal device 101 and the second terminal device 102 can be electronic devices such as smartphones, wearable devices, personal computers, intelligent voice interaction devices, smart home appliances, intelligent vehicles, in-vehicle terminals, aircraft, unmanned vending terminals, and extended reality devices. Extended reality devices can include virtual reality devices, augmented reality devices, and mixed reality devices. A client application for the target application can be installed and run on the terminal device. This target application can include, but is not limited to, financial transaction applications, payment applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, and social media platform software (these are just examples). Furthermore, this application embodiment does not limit the form of the target application, including but not limited to applications, mini-programs, etc., installed on the terminal device, and can also be in web page form.

[0046] Server 105 can be a server providing various services, such as a backend management server supporting websites browsed by users using the first terminal device 101 and the second terminal device 102 (this is just an example). The backend management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated based on user requests) to the terminal devices. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and big data. The server can be a backend server for the aforementioned target application, used to provide backend services to the clients of the target application.

[0047] Database 103 is a professional storage system for storing and managing data. It can store various types of data related to the target application, such as user account information, business transaction records, and content resource data. It supports structured, semi-structured, or unstructured data storage and has management capabilities such as data creation, deletion, modification, querying, backup, and recovery. In this application scenario, database 103 can be connected to server 105 via a communication link. Server 105 can retrieve the required data from database 103 for processing based on requests from the first terminal device 101 and the second terminal device 102. It can also synchronously store new data generated by the operations of the first terminal device 101 and the second terminal device 102 into database 103, thereby achieving data persistence and efficient retrieval.

[0048] It should be noted that the anomaly risk handling method provided in this application embodiment can generally be executed by server 105 and / or terminal devices 101-102. Accordingly, the anomaly risk handling device provided in this application embodiment can generally be set in server 105 and / or terminal devices 101-102.

[0049] It should be understood that Figure 1 The number of terminal devices, networks, databases, and servers shown is merely illustrative. Depending on implementation needs, there can be any number of terminal devices, networks, databases, and servers.

[0050] The following will be based on Figure 1 The described scene, through Figures 2-4 The abnormal risk handling method of the embodiments of this application will be described in detail.

[0051] Figure 2 A flowchart illustrating an anomaly risk handling method based on an embodiment of this application is shown.

[0052] like Figure 2 As shown, the abnormal risk handling method 200 of this embodiment includes steps S210 to S240.

[0053] In step S210, multi-source data of the target object is obtained, and event anchors corresponding to the target object and risk evolution data associated with the event anchors are determined based on the multi-source data. The event anchors are used to determine the segmented or aligned positions of the risk evolution data in the time dimension.

[0054] In the embodiments of this application, the target object can be a user, account, merchant, institution, device, or other business entity that requires abnormal risk handling. Multi-source data can come from different business processes or different data systems, such as basic object information, behavior records, resource configuration records, resource flow records, device environment records, network environment records, relationship records, performance status records, and historical processing records. By acquiring multi-source data of the target object, subsequent processing no longer relies on a single data source, but rather forms a complete data foundation from multiple dimensions such as the target object's status, behavior, resource changes, and performance changes.

[0055] In the embodiments of this application, event anchors are key events identified from multi-source data, used to provide a time reference for risk evolution data. Event anchors can be events that cause a change in the state of a target object, or events corresponding to changes in resource allocation, resource allocation, resource transfer, resource splitting, resource aggregation, or performance status. The role of event anchors is not to limit a specific business event, but to provide a unified segmentation or alignment position for data from different sources and with different time granularities, enabling data generated around the same key event to be categorized into the same risk evolution process.

[0056] In some embodiments, event anchors can be determined based on event type, event occurrence time, event impact scope, or the correspondence between events and resource changes in multi-source data. For example, when the resource transfer frequency, resource transfer object, status record, or performance status of a target object changes continuously after a certain event, that event can be identified as an event anchor. As another example, when multiple candidate events exist simultaneously, an event with a higher correlation to changes in resource configuration, resource transfer, or performance status can be selected as the event anchor, thereby enabling risk evolution data to more accurately reflect the abnormal change process of the target object.

[0057] In embodiments of this application, the risk evolution data associated with an event anchor point may include data prior to the event anchor point, data after the event anchor point, and data covering the period in which the event anchor point occurs. Data prior to the event anchor point can be used to characterize the baseline state or preceding changes of the target object before the occurrence of the critical event; data after the event anchor point can be used to characterize state transitions or resource migrations after the occurrence of the critical event; and data covering the event anchor point can be used to characterize real-time changes during the occurrence of the critical event. In this way, data scattered across different time periods can be organized into continuous risk evolution data.

[0058] In some embodiments, risk evolution data can be segmented or aligned in time according to event anchor points. Time segmentation refers to dividing multi-source data into different stages such as before, during, and after the event; time alignment refers to arranging data from different sources using the same event anchor point as a reference, enabling data from different data sources that occur at slightly different times to be compared within the same risk evolution framework. Thus, the system can identify the direction, sequence, and correlation of changes in the target object before and after key events.

[0059] In the embodiments of this application, generating risk evolution data based on event anchors helps avoid relying solely on static features or a single statistical window for judgment. When a target object behaves normally before a critical event, but experiences rapid resource turnover, an increase in associated objects, changes in performance status, or abrupt changes in behavior after the critical event, the risk evolution data can reflect this before-and-after difference. Conversely, when a target object only has isolated anomalous records, but no continuous chain of changes forms before and after the event anchor, the risk evolution data can also provide more sufficient basis for subsequent model judgment, thereby improving the accuracy and stability of anomalous risk handling.

[0060] In step S220, a coupling relationship diagram associated with the target object is obtained. The coupling relationship diagram is calibrated based on the data representing resource flow changes in the risk evolution data to obtain a calibrated coupling relationship diagram. The coupling relationship diagram is used to represent the coupling relationship between object association and resource flow relationship.

[0061] In the embodiments of this application, the coupling relationship diagram associated with the target object can be generated based on multi-source data, or it can be formed by extracting the parts related to the target object from an existing relationship diagram. The coupling relationship diagram is used to express two types of relationships simultaneously: one type is the association relationship between objects, such as sharing a certain type of identifier, appearing together in the same business channel, having similar behavior patterns, or having other computable associations; the other type is the resource flow relationship, such as resources flowing from one object to another, being transferred through a certain object, being split among multiple objects, or converging towards a certain object.

[0062] In some embodiments, the coupling graph may include nodes and connecting edges. Nodes can represent target objects, associated objects related to the target object, resource transfer objects, resource receiving objects, resource transit objects, or resource aggregation objects. Connecting edges can represent object associations, resource transfer relationships, and mapping relationships between object associations and resource transfer relationships. For example, when two objects share a common identifier or common behavior, an object association connection can be formed; when resources flow from one object to another, a resource transfer connection can be formed; when there is a corresponding relationship between an object association connection and a subsequent resource transfer connection, a coupling connection can be formed.

[0063] In the embodiments of this application, after obtaining the coupling graph, the graph can be calibrated using data characterizing resource flow changes in the risk evolution data. This resource flow change data can include resource flow direction, resource flow object, resource flow intensity, number of resource flows, resource flow time interval, resource splitting, resource aggregation, or resource transfer status. Since the risk evolution data is generated around event anchor points, the resource flow change data can reflect the changes in the resource flow status of the target object before and after a critical event. Using this change to calibrate the coupling graph allows the graph structure to reflect not only static associations but also the actual resource flow results after the critical event.

[0064] In some embodiments, calibrating the coupling graph may include adjusting the connection parameters. For example, if a target object and an associated object initially have only a weak object association, but risk evolution data indicates that their resource flows after the event anchor point point to the same resource flow object or the same set of resource flow objects, then the connection parameters of the edges between them can be increased. Conversely, if a target object and an associated object have an object association, but risk evolution data indicates a lack of intersection between their resource flow directions, resource flow objects, or resource flow paths, then the connection parameters of the edges between them can be decreased. In this way, the coupling graph can dynamically adjust the reliability of object associations based on resource flow results.

[0065] In embodiments of this application, calibrating the coupling graph may further include adjusting the risk attributes of nodes. For example, if a resource transfer object frequently acts as a resource aggregation object in multiple resource transfer records, or repeatedly acts as a transit object in multiple resource transfer paths, the risk attribute of the node corresponding to that resource transfer object can be increased. As another example, if a node is connected to a target object but does not exhibit resource transfer concentration, splitting, or transit characteristics in the risk evolution data, the risk attribute of that node can be maintained or reduced. Thus, the node risk attributes in the coupling graph can be updated as the resource transfer results change.

[0066] In some embodiments, the calibrated coupling graph can be used to subsequently determine graph risk characteristics. Because the calibration process introduces resource flow change data associated with event anchors, the calibrated coupling graph can reflect the impact of resource flow changes of the target object and associated objects before and after critical events on the graph structure. Compared to a graph built solely based on static object associations, this approach reduces misjudgments caused by isolated associations and strengthens abnormal associations confirmed by resource flow results, thus providing a more reliable graph foundation for subsequent abnormal risk handling models.

[0067] In step S230, the evolutionary risk characteristics of the target object are determined based on the risk evolution data, and the graph risk characteristics of the target object are determined based on the calibrated coupling relationship graph. The evolutionary risk characteristics and graph risk characteristics are input into the anomaly risk processing model, and the anomaly risk processing model performs gating adjustment on the feature fusion process according to the synergistic relationship between the evolutionary risk characteristics and the graph risk characteristics to obtain the comprehensive risk result.

[0068] In embodiments of this application, evolutionary risk characteristics can be determined based on risk evolution data, used to characterize the risk change process of a target object around an event anchor point. Risk evolution data may include state data, behavioral data, resource allocation data, resource flow data, and performance status data before, after, or during the period covering the event anchor point. By processing the above data, the state change characteristics, behavioral change characteristics, resource migration characteristics, resource usage characteristics, or performance change characteristics of the target object before and after a critical event can be obtained, thereby forming evolutionary risk characteristics that reflect the risk evolution process.

[0069] In some embodiments, evolutionary risk characteristics can reflect the changing relationships of a target object across different time stages. For example, a baseline state of the target object can be determined based on data before the event anchor point, and subsequent states can be determined based on data after the event anchor point. Then, state change characteristics can be determined based on the differences between the baseline state and subsequent states. As another example, resource migration characteristics can be determined based on the direction, object, intensity, frequency, or time interval of resource flow after the event anchor point. In this way, evolutionary risk characteristics do not simply describe the state at a single point in time, but rather the continuous changes the target object undergoes around the event anchor point.

[0070] In the embodiments of this application, the graph risk characteristics can be determined based on a calibrated coupling graph, used to characterize the risk status of a target object in the coupled structure of object association and resource flow relationships. The calibrated coupling graph has been updated based on data representing changes in resource flow in the risk evolution data; therefore, the graph risk characteristics can reflect the combined effect between static object associations and actual resource flow results. For example, the graph risk characteristics of a target object can be determined based on the neighboring nodes, connection edge strength, path length, resource convergence nodes, resource transfer nodes, or the distance to risk nodes of the target object's corresponding node.

[0071] In some embodiments, graph risk characteristics may include the connection strength between the target object and high-risk nodes, the degree of clustering in the local graph structure where the target object is located, the coupling connection strength between the target object and associated objects, the number of transit nodes traversed by the resource flow path, or the risk attributes of the resource flow objects. Since the coupling relationship graph has been calibrated by resource flow change data, the above graph risk characteristics can more accurately reflect whether the object association is confirmed by the resource flow results, avoiding judgment based solely on the superficial association between objects.

[0072] In the embodiments of this application, the anomaly risk handling model is used to comprehensively process evolutionary risk features and graph risk features. The anomaly risk handling model can be implemented using rule-based models, statistical models, machine learning models, graph computing models, or a combination of multiple models. The model input includes evolutionary risk features and graph risk features, and the model output includes a comprehensive risk result. The comprehensive risk result can be expressed as a risk score, risk probability, risk level, risk label, or a combination of multiple results, used to subsequently determine the anomaly risk handling level.

[0073] In some embodiments, the anomaly risk handling model gates the feature fusion process based on the synergistic relationship between evolutionary risk features and graph risk features. The synergistic relationship can represent the co-occurrence, mutual reinforcement, or mutual corroboration of two types of features within the same time segment. For example, when evolutionary risk features indicate a significant resource migration change in the target object after the event anchor point, and graph risk features indicate that this resource migration is coupled with high-risk nodes or high-risk association structures, the model can increase the contribution of the relevant features in the fusion process. Conversely, when graph risk features are high but evolutionary risk features do not reflect corresponding resource changes, the model can reduce the contribution of some graph features.

[0074] In the embodiments of this application, gating adjustment is not limited to a fixed calculation method, but can manifest as adjusting feature weights, selecting feature channels, triggering feature combinations, changing the fusion order, or adjusting feature contributions. Through gating adjustment, the anomaly risk processing model can dynamically change the fusion process according to the synergy between different risk features, so that the comprehensive risk result considers both event-driven risk evolution and spectral risk in the calibrated coupling graph, thereby improving the accuracy and adaptability of the comprehensive risk result.

[0075] In step S240, the abnormal risk handling level of the target object is determined based on the comprehensive risk results, and the corresponding abnormal risk handling action is executed according to the abnormal risk handling level.

[0076] In the embodiments of this application, the comprehensive risk result can be used as the basis for determining the abnormal risk handling level of the target object. The comprehensive risk result can be a risk score, risk probability, risk label, risk level, or a combination of multiple results. The system can determine the abnormal risk handling level corresponding to the target object based on the relationship between the comprehensive risk result and risk thresholds, risk ranges, risk rules, or historical handling results. The abnormal risk handling level is used to characterize the degree of risk that the target object currently needs to handle and serves as the basis for subsequently selecting abnormal risk handling actions.

[0077] In some embodiments, the anomaly risk handling level can be divided into multiple levels according to the degree of risk, or into different handling tiers according to different business processing requirements. For example, when the overall risk result is in a low range, the target object can be determined to be in the normal handling level; when the overall risk result is in the middle range, the target object can be determined to be in the verification handling level; when the overall risk result is in a high range, the target object can be determined to be in the restricted handling level or the key handling level. The above level names and numbers can be configured according to the actual processing scenario and do not constitute a limitation on the scope of protection.

[0078] In the embodiments of this application, executing corresponding abnormal risk handling actions according to the abnormal risk handling level allows the risk identification results to directly affect subsequent processing procedures. Abnormal risk handling actions may include verification, supplementary verification, manual review, limit adjustment, resource flow restriction, early warning notification, list monitoring, delayed processing, rejection, or other risk control actions. Different abnormal risk handling levels may correspond to different handling actions, or combinations of multiple handling actions, to adapt to the processing needs of different risk levels and different business stages.

[0079] In some embodiments, the system can generate dynamic risk results based on comprehensive risk results before determining the abnormal risk handling level. For example, the current comprehensive risk results can be merged with the historical risk results of the target object to reduce the impact of a single abnormal fluctuation on the handling level. When the risk status of the target object continues to rise, the dynamic risk results can drive the handling level up; when the subsequent performance of the target object tends to stabilize, the dynamic risk results can also cause the handling level to gradually fall back. Thus, the abnormal risk handling level can reflect the continuous change of risk status, rather than just reflecting a single model output.

[0080] In the embodiments of this application, the execution of anomaly risk handling actions can be associated with a chain of evidence or triggering criteria. When executing a handling action, the system can record the comprehensive risk result, evolutionary risk characteristics, graph risk characteristics, event anchors, and calibrated coupling relationship diagram information that led to the action. By retaining the aforementioned triggering criteria, subsequent review, attribution, and parameter updates can be facilitated, enabling anomaly risk handling not only to output processing results but also to support the interpretation and continuous optimization of the processing process.

[0081] In some embodiments, after an anomaly risk handling action is executed, the execution result can be obtained as a basis for subsequent updates. The execution result may include information such as whether the handling was successful, whether further verification is required, whether there has been a change in performance status, whether it has been manually confirmed, and whether the handling action was effective. The system can adjust the risk threshold, handling level classification method, handling action selection method, or model parameters based on the execution result, so that the anomaly risk handling method can adapt to new risk patterns and handling needs during continuous operation.

[0082] Based on the embodiments of this application, event anchor points can be used as time segmentation or alignment criteria to organize the state changes and resource flow changes of target objects before and after key events into risk evolution data; and the coupling relationship diagram can be calibrated using the data representing resource flow changes in the risk evolution data, so that the coupling relationship between object association and resource flow relationship can be dynamically updated with the actual flow results; further, through the collaborative gating fusion of evolutionary risk features and graph risk features, a comprehensive risk result that better reflects the degree of abnormal risk can be obtained, and the abnormal risk handling level can be determined and the corresponding handling action can be executed accordingly, thereby improving the accuracy, dynamic adaptability and interpretability of abnormal risk handling.

[0083] The abnormal risk handling method of this application will be described below by way of specific embodiments.

[0084] In the embodiments of this application, to address the problem of scattered records and inconsistent time granularity in multi-source data, which makes it difficult to form continuous risk evolution data around key change processes, candidate events corresponding to changes in the state, resource allocation, resource transfer, or performance of the target object can be extracted from the multi-source data, and the occurrence time of each candidate event can be determined. Candidate events can be events reflecting changes in the state of the target object, or events reflecting changes in resource allocation, resource transfer, resource splitting, resource aggregation, or performance status. By first extracting candidate events, ordinary records in the multi-source data can be distinguished from events with risk evolution indicative significance, providing a basis for subsequently determining event anchor points.

[0085] In the embodiments of this application, event anchors for time segmentation or time alignment of multi-source data can be determined from candidate events based on the event type and occurrence time of the candidate events. The event type characterizes the role of the candidate event in the risk evolution process, and the occurrence time determines the position of the candidate event in the time dimension. When multiple candidate events exist, an event anchor that represents a key change in the target object's state, key resource allocation, key resource flow, or key performance can be selected. Therefore, the event anchor is not merely an ordinary time point, but a key event that can provide a segmentation or alignment benchmark for subsequent risk evolution data.

[0086] In the embodiments of this application, after determining the event anchor point, data located before, after, or covering the event anchor point can be extracted from multi-source data based on the event anchor point to obtain risk evolution data. Specifically, data located before the event anchor point can be used to characterize the basic state or prior changes of the target object before the occurrence of a critical event; data located after the event anchor point can be used to characterize state transitions, resource migrations, or performance changes after the occurrence of a critical event; and data covering the event anchor point can be used to characterize immediate changes during the occurrence of a critical event. Through this method, data from different sources and with different time granularities can be organized according to the same event anchor point to form continuous and comparable risk evolution data.

[0087] By adopting the above approach, risk assessment can be avoided by relying solely on static features or fixed statistical windows, ensuring that the changes of the target object before, during, and after key events are uniformly depicted. At the same time, by determining event anchor points through event type and event occurrence time, the temporal consistency and business relevance of risk evolution data can be improved, providing a more reliable data foundation for subsequent risk feature extraction, coupling relationship diagram calibration, and abnormal risk handling model fusion, thereby improving the accuracy and stability of abnormal risk handling.

[0088] In the embodiments of this application, to address the problem that existing anomaly risk handling methods typically model object association relationships and resource flow relationships separately, making it difficult to reflect the mutual corroboration between the two, entity parsing can be performed on multi-source data to obtain a set of entities associated with the target object, as well as the object association relationships and resource flow relationships between the entities in the entity set. Entity parsing can be used to identify data records in multi-source data that point to the same or related objects, enabling data from different sources to be mapped to corresponding entities. The entity set may include the target object itself, objects that are directly or indirectly associated with the target object, resource flow objects, and other entities that can participate in association analysis.

[0089] In the embodiments of this application, object association relationships can be used to characterize the relationships between entities based on identity attributes, device environment, network environment, contact information, location characteristics, behavioral similarity, business channels, or other association criteria. Resource flow relationships can be used to characterize the relationships between entities based on resource sending, receiving, relaying, splitting, aggregating, or recycling. By determining object association relationships and resource flow relationships simultaneously after entity parsing, the static association characteristics and dynamic flow characteristics of the target object can be expressed on the same entity basis, avoiding the inability to perform linked analysis between different relationship types due to entity inconsistencies.

[0090] In the embodiments of this application, a first relational structure for representing object associations can be determined based on object associations, and a second relational structure for representing resource flow relationships can be determined based on resource flow relationships. The first relational structure can indicate whether there is an association between entities and the strength of the association, while the second relational structure can indicate the flow direction, flow object, flow intensity, or flow path of resources between different entities. Both the first and second relational structures can be represented by graph structures, table structures, matrix structures, or other computable relational structures, and the embodiments of this application do not limit this.

[0091] In the embodiments of this application, a coupling connection can be established between a first relational structure and a second relational structure to obtain a coupling relationship graph associated with the target object. The coupling connection can be used to represent the mapping relationship between object association relationships and resource flow relationships. For example, when two entities in the first relational structure have an object association relationship, and a resource flow relationship related to these two entities exists in the second relational structure, a coupling connection can be established between the two relational structures. As another example, when an associated object of the target object participates in resource reception, transfer, or aggregation, the object association relationship can also be associated with the resource flow relationship through a coupling connection.

[0092] By employing the above method, object associations and resource flow relationships can be unified into a coupling graph. This enables subsequent processing to identify both the associations between target objects and other entities, as well as whether resources flow along the association structure. Compared to constructing only object association graphs or only resource flow graphs, this approach improves the ability to identify implicit association risks and resource flow anomalies, and provides a structural foundation for subsequent calibration of the coupling graph based on risk evolution data.

[0093] In the embodiments of this application, to address the problem that coupling graphs tend to remain static after construction, making it difficult to reflect the impact of resource flow changes before and after key events on the risk status of the graph structure, resource flow records associated with event anchors can be extracted from risk evolution data. These resource flow records can be records of resource transfers, resource receptions, resource transfers, resource splits, resource aggregations, or resource recycling that occur before, after, or during the period surrounding the event anchor. Since the risk evolution data has already been segmented or aligned time based on event anchors, the extracted resource flow records can reflect the resource changes of the target object near key events.

[0094] In the embodiments of this application, the resource flow direction, resource flow objects, and resource flow intensity corresponding to the target object and associated objects with object association relationships with the target object can be determined based on resource flow records. The resource flow direction can be used to characterize from which object the resource flows to which object; the resource flow objects can be used to characterize the objects involved in sending, receiving, relaying, splitting, or aggregating resources; and the resource flow intensity can be used to characterize the quantity, frequency, proportion, duration, or other strength indicators of resource flow. By simultaneously determining the resource flow status of the target object and associated objects, it is possible to identify whether the object association relationship is further confirmed by the resource flow results.

[0095] In the embodiments of this application, target nodes corresponding to resource flow objects and target connection edges corresponding to resource flow direction or intensity can be determined in the coupling relationship graph. Target nodes can be resource receiving nodes, resource sending nodes, resource relay nodes, resource aggregation nodes, or other nodes corresponding to resource flow objects. Target connection edges can be edges representing resource flow from one node to another, or edges representing the degree of coupling between object association relationships and resource flow relationships. By locating target nodes and target connection edges in the coupling relationship graph, resource flow changes in risk evolution data can be mapped to the graph structure.

[0096] In the embodiments of this application, the risk attributes of target nodes or the connection parameters of target connection edges can be calibrated based on resource flow records to obtain a calibrated coupling graph. Node risk attributes can be used to characterize the risk level of a node when it acts as a resource receiver, relay, aggregation, or abnormally associated object. Connection parameters can be used to characterize the strength of the connection, the strength of resource flow, the degree of coupling, or the degree of trust between two nodes. For example, when resource flow records show that the resource flows of both the target object and the associated object point to the same resource flow object, the relevant connection parameters can be improved; when resource flow records show that a certain resource flow object repeatedly acts as a relay or aggregation object, the risk attribute of the corresponding node can be improved.

[0097] In some embodiments, calibration is not limited to increasing risk attributes or strengthening connection parameters; it may also include decreasing risk attributes or weakening connection parameters. For example, when object associations exist in the coupling graph, but the resource flow records do not show that the target object and the associated object have the same or similar resource flow directions, the relevant connection parameters can be reduced to decrease the graph structure's dependence on static associations. As another example, when a resource flow object no longer exhibits centralized receiving, relaying, or converging characteristics in the resource flow records associated with an event anchor point, the risk attributes of that node can be reduced.

[0098] The above method enables dynamic calibration of the coupling graph using resource flow records associated with event anchors, ensuring that the coupling between object associations and resource flow relationships updates as actual resource flow changes. Compared to graph analysis based solely on static associations or original resource flow relationships, this method strengthens risk associations validated by resource flow results and weakens associations lacking resource flow support, thereby improving the accuracy of subsequent graph risk feature identification and anomaly risk handling.

[0099] In the embodiments of this application, to address the problem that object relationships in a coupling graph are difficult to differentiate based on actual resource flow results, the risk attributes of target nodes or the connection parameters of target edges can be calibrated based on resource flow records. A coupling graph may contain numerous object relationships based on identity, device, location, contact information, behavioral similarity, or business channels, but these relationships do not necessarily represent abnormal risks. Therefore, it is necessary to further combine resource flow records to determine whether object relationships are verified by actual resource flow results, thereby improving the accuracy of the graph structure representation.

[0100] In the embodiments of this application, when the resource flow record represents the resource flow direction of the target object and at least one associated object pointing to the same resource flow object or the same set of resource flow objects, the connection parameters of the target object and at least one associated object in the coupling relationship graph can be enhanced. Here, the same resource flow object can be the same resource receiving object, the same resource transit object, the same resource aggregation object, or other objects undertaking resource flow; the same set of resource flow objects can be multiple objects with the same aggregation characteristics, the same transit characteristics, or the same association characteristics. By enhancing the connection parameters, it can be shown that the static association relationship between the target object and the associated object has been further confirmed by similar or common resource flow results.

[0101] In the embodiments of this application, when a resource transfer record represents an object association relationship between a target object and at least one associated object, but they do not point to the same resource transfer object or the same set of resource transfer objects, the connection parameters of the target object and at least one associated object in the coupling relationship graph can be reduced. That is, for cases where only an object association exists but resource transfer intersections are lacking, the association is not directly treated as a strong risk relationship; instead, the impact of this relationship on subsequent graph risk characteristics is reduced by lowering the connection parameters. This reduces the risk of misjudgment caused by accidental associations, weak associations, or historical associations.

[0102] In the embodiments of this application, when a resource transfer object satisfies convergence or transit conditions based on multiple resource transfer records, the risk attribute of the corresponding node of the resource transfer object can be increased. Convergence conditions can indicate that resources in multiple resource transfer records flow centrally to the same resource transfer object or the same type of resource transfer object; transit conditions can indicate that the resource transfer object repeatedly acts as an intermediate receiving object or a transferring object in multiple resource transfer paths. By increasing the risk attribute of the corresponding node, the coupling graph can identify nodes that play a role in centralized receiving, repeated transit, or abnormal connection in the resource transfer structure.

[0103] In some embodiments, connection parameters may include edge weights, connection strength, coupling degree, trust level, or other parameters used to represent the strength of the relationship between nodes. Node risk attributes may include node risk scores, node risk levels, node risk labels, or the degree to which a node participates in abnormal flows. By adjusting the connection parameters and node risk attributes respectively, the coupling graph can be calibrated simultaneously at both the relationship and node levels, enabling the coupling graph to more accurately express the dynamic coupling state between object associations and resource flow relationships.

[0104] The above methods enable differentiated calibration of the coupling graph based on resource flow records: strengthening the relationships between objects verified by shared resource flows, weakening the relationships between objects lacking resource flow verification, and increasing the risk attributes of resource flow objects exhibiting convergence or transit characteristics across multiple resource flow records. Therefore, the calibrated coupling graph reduces reliance on static object relationships, strengthens the support of actual resource flow results for risk assessment, and thus improves the accuracy of subsequent graph risk feature determination and anomaly risk handling.

[0105] To address the problem that relying solely on the state of a target object at a single point in time is insufficient to reflect the process of risk change, risk evolution data can be used to determine the state change characteristics of the target object before and after the event anchor point.

[0106] Figure 3The flowchart illustrates a method for determining the evolutionary risk characteristics of a target object based on risk evolution data, according to some exemplary embodiments of this application.

[0107] like Figure 3 As shown, the method for determining the evolutionary risk characteristics of a target object based on risk evolution data includes steps S310 to S330.

[0108] In step S310, the state change characteristics of the target object before and after the event anchor point are determined based on the risk evolution data.

[0109] In step S320, the resource migration characteristics of the target object after the event anchor point are determined based on the risk evolution data.

[0110] In step S330, the state change characteristics and resource migration characteristics are fused to obtain the evolution risk characteristics.

[0111] Risk evolution data has been segmented or aligned over time around event anchors, allowing for the extraction of state data before and after the event anchors, and a comparison of the changes between the two. State change features can be used to characterize whether the target object's behavioral state, resource allocation state, association state, or performance state has changed before and after a critical event, as well as the direction and extent of these changes.

[0112] In some embodiments, state change characteristics can be determined based on multiple types of data before and after an event anchor point. For example, state change characteristics can be determined based on changes in behavior frequency, resource configuration, number of associated objects, performance status, or processing records before and after the event anchor point. State change characteristics are not limited to a single indicator; they can also be a set of features consisting of multiple sub-features. In this way, the system can identify potential abnormal changes from the state differences of the target object before and after a critical event, rather than judging solely based on static states.

[0113] In embodiments of this application, resource migration characteristics of the target object after the event anchor point can also be determined based on risk evolution data. Resource migration characteristics can be used to characterize the flow direction, flow object, flow intensity, flow frequency, flow time interval, splitting, convergence, or transit status of resources corresponding to the target object after a critical event occurs. Since some abnormal risks often manifest themselves after a critical event through rapid resource transfer, concentrated flow to specific objects, transit through multiple objects, or abnormal splitting, resource migration characteristics after the event anchor point can more directly reflect subsequent risk evolution.

[0114] In some embodiments, resource migration characteristics can be determined based on resource flow records after the event anchor point. For example, the direction and intensity of resources flowing from the target object to different resource transfer objects can be statistically analyzed. It can also be determined whether resources are transferred multiple times in a short period of time, whether they are concentrated on a certain resource transfer object or a set of resource transfer objects, or whether they pass through multiple transfer objects. Resource migration characteristics can complement state change characteristics, so that evolutionary risk characteristics reflect both the state changes of the target object and the resource migration results after key events.

[0115] In the embodiments of this application, state change features and resource migration features can be fused to obtain evolutionary risk features. The fusion method can include weighted fusion, splicing fusion, rule fusion, model fusion, or other methods that can combine multiple types of features into a unified feature representation. Evolutionary risk features are used to describe the risk evolution process of a target object around an event anchor point and serve as one of the inputs to an anomaly risk handling model. Since evolutionary risk features simultaneously include state changes before and after the event anchor point and resource migration changes after the event anchor point, they can express the risk formation process more completely than a single state feature or a single resource flow feature.

[0116] Through the above methods, the embodiments of this application can convert risk evolution data into evolutionary risk features that can be processed by the model, enabling a unified expression of state changes before and after critical events and resource migration changes after critical events. Therefore, subsequent abnormal risk handling models can combine evolutionary risk features and graphical risk features for collaborative judgment, improving the ability of comprehensive risk results to characterize continuous risk evolution processes, thereby enhancing the accuracy and stability of abnormal risk handling.

[0117] To address the issue that traditional graph risk features, determined solely by static adjacency relationships or single connection strengths, fail to reflect the combined effects of object associations and resource flow relationships, a calibrated coupling graph can identify the neighboring nodes, coupling edges, and risk propagation paths of the node corresponding to the target object. Since the calibrated coupling graph has been updated based on resource flow changes in the risk evolution data, the graph structure surrounding the node corresponding to the target object not only reflects the associations between the target object and other objects but also the impact of resource flow outcomes on these associations.

[0118] Figure 4 The flowchart illustrates a method for determining the map risk characteristics of a target object based on a calibrated coupling graph, according to some exemplary embodiments of this application.

[0119] like Figure 4 As shown, the method for determining the map risk characteristics of a target object based on the calibrated coupling relationship map includes steps S410 to S430.

[0120] In step S410, the neighboring nodes, coupling connection edges, and risk propagation paths of the node corresponding to the target object are determined in the calibrated coupling relationship graph.

[0121] In step S420, the graph association strength of the target object is determined based on the risk attributes of the neighboring nodes, the connection strength of the coupled connection edges, and the path length of the risk propagation path.

[0122] In step S430, a map risk feature is generated based on the map association strength.

[0123] In some embodiments, neighboring nodes may include object nodes, resource flow object nodes, transit nodes, aggregation nodes, or risk nodes that are directly or indirectly connected to the node corresponding to the target object. Coupled connection edges can be used to characterize the degree of coupling between object association relationships and resource flow relationships, such as whether there is a common resource flow direction between the target object and associated objects, or whether the associated objects participate in resource reception, transit, or aggregation. Risk propagation paths can be used to characterize the path relationship from risk nodes, aggregation nodes, or transit nodes to the node corresponding to the target object. By simultaneously determining neighboring nodes, coupled connection edges, and risk propagation paths, graph information can be extracted from multiple levels of nodes, connections, and paths.

[0124] In the embodiments of this application, the graph association strength of a target object can be determined based on the risk attributes of neighboring nodes, the connection strength of coupled edges, and the path length of the risk propagation path. The risk attributes of neighboring nodes represent the risk level of the node itself; the connection strength of coupled edges represents the degree of coupling between the target object and neighboring nodes in terms of object association and resource flow; and the path length of the risk propagation path represents the distance from which the risk impact is transmitted from the relevant nodes to the target object. Generally, the higher the risk attributes of neighboring nodes, the stronger the connection strength of coupled edges, and the shorter the risk propagation path, the higher the graph association strength of the target object.

[0125] In some embodiments, the graph association strength can be obtained through rule-based calculation, weighted calculation, path decay calculation, or model calculation. For example, the risk attributes of different neighboring nodes can be weighted and corrected by combining the connection strength of the coupled edges; alternatively, a decay factor can be set according to the path length of the risk propagation path, so that risk nodes closer to the target object have a greater impact on the graph association strength. The above calculation methods can be configured according to different application scenarios, as long as the degree of graph association of the target object can be determined using the node risk, connection strength, and path relationship in the calibrated coupling graph.

[0126] In embodiments of this application, graph risk features can be generated based on graph association strength. Graph risk features may include the graph association strength itself, or further risk levels, risk labels, risk vectors, or risk components derived from the graph association strength. Graph risk features are used as input to anomaly risk processing models and, together with evolutionary risk features, participate in the generation of comprehensive risk results.

[0127] Through the above methods, the embodiments of this application can extract graph risk features from the calibrated coupling relationship graph that better reflect the impact of actual resource flow, avoiding the determination of graph risk solely based on static object associations. Therefore, the graph risk features of the target object can simultaneously reflect the risk of neighboring nodes, the strength of coupling connections, and the risk propagation path, helping to improve the accuracy and interpretability of subsequent comprehensive risk results.

[0128] In the embodiments of this application, to address the problem that traditional anomaly risk handling models typically use fixed weights or fixed rules to fuse different risk features, making it difficult to reflect the risk amplification effect when multiple risk features coexist at the same time, the anomaly risk handling model can perform gating adjustment on the feature fusion process based on the synergistic relationship between evolutionary risk features and graph risk features. Evolutionary risk features are used to characterize the state changes and resource migration changes of the target object around the event anchor point, while graph risk features are used to characterize the associated risks of the target object in the calibrated coupling relationship graph. These two types of features can describe the anomaly risk state of the target object from different perspectives.

[0129] In the embodiments of this application, gating parameters can be determined based on the co-occurrence state of evolutionary risk features and spectroscopic risk features within the same time segment. The same time segment can be determined by event anchors to ensure the comparability of the two types of features in the temporal dimension. The co-occurrence state can indicate whether evolutionary risk features and spectroscopic risk features simultaneously enhance within the same time segment, whether they mutually corroborate each other, whether only one type of feature is anomalous, or whether both are within the normal range. Gating parameters can be generated based on the co-occurrence state to control the subsequent feature fusion process.

[0130] In some embodiments, the contributions of evolutionary risk features and graph risk features in the feature fusion process can be adjusted based on gating parameters. For example, when evolutionary risk features show that the target object undergoes significant resource migration changes after an event anchor point, while graph risk features show that this resource migration is related to high-risk nodes or strongly coupled structures, the contributions of both types of features can be increased. When graph risk features are high but evolutionary risk features do not show corresponding changes, the contribution of graph risk features can be reduced to decrease misjudgments caused by static associations.

[0131] In the embodiments of this application, evolutionary risk features and graph risk features can be fused based on the adjusted contribution to obtain a comprehensive risk result. The fusion process can be implemented using weighted fusion, model fusion, rule fusion, or a combination of these methods. Through these methods, the comprehensive risk result can reflect the synergistic effect between evolutionary risk features and graph risk features, rather than simply superimposing the two types of features. Therefore, the embodiments of this application can improve the ability of the anomaly risk handling model to identify the combined effects of continuous risk evolution and graph-related risks, thereby enhancing the accuracy and stability of anomaly risk handling.

[0132] In the embodiments of this application, to address the problem that determining processing actions based solely on a single comprehensive risk result is easily affected by short-term fluctuations, a dynamic risk result can be generated based on the comprehensive risk result and the historical risk results of the target object. The comprehensive risk result reflects the abnormal risk status of the target object at the current moment or within the current processing cycle, while the historical risk result reflects the risk changes of the target object in past processing cycles. By combining the current comprehensive risk result with the historical risk result, the dynamic risk result can simultaneously reflect the current risk level and the risk change trend.

[0133] In the embodiments of this application, dynamic risk results can be generated through smoothing, weighted fusion, trend correction, or rule correction. For example, when the target object has high risk results for multiple consecutive processing cycles, the dynamic risk result can increase accordingly; when the target object only experiences a brief anomaly in a single cycle and its historical risk results are low, the dynamic risk result can reduce the impact of a single anomaly on the processing level. Thus, the dynamic risk result can more stably reflect the overall risk status of the target object.

[0134] In the embodiments of this application, the abnormal risk handling level of a target object can be determined based on the matching relationship between dynamic risk results and preset risk thresholds. The preset risk thresholds may include one or more thresholds, or correspond to different risk ranges. Different abnormal risk handling levels can be used to represent different handling intensities, such as routine handling, supplementary verification, manual review, restriction handling, warning handling, or rejection handling. By setting risk thresholds, continuous or probabilistic risk results can be converted into executable handling levels.

[0135] In the embodiments of this application, an abnormal risk handling action corresponding to the abnormal risk handling level can be determined from the set of handling actions, and the abnormal risk handling action can be executed. The set of handling actions may include actions such as verification, supplementary verification, manual review, quota adjustment, resource flow restriction, early warning, list observation, delayed processing, or rejection. The higher the abnormal risk handling level, the more stringent the corresponding handling action can be, and multiple handling actions can also be triggered in combination.

[0136] Through the above implementation methods, the embodiments of this application can avoid the instability caused by a single comprehensive risk result directly triggering the processing action, making the abnormal risk processing level smoother and more reliable; at the same time, through the matching relationship between the processing action set and the abnormal risk processing level, the automatic connection from the risk identification result to the specific processing action can be realized, improving the stability, accuracy and execution efficiency of abnormal risk processing.

[0137] Corresponding to the above-described method for handling abnormal risks, embodiments of this application also provide an apparatus for handling abnormal risks.

[0138] Figure 5 A schematic diagram of the structure of an anomaly risk handling device based on an embodiment of this application is shown.

[0139] like Figure 5 As shown, the abnormal risk handling device 500 of this embodiment includes a data acquisition module 510, a spectrum calibration module 520, a gating adjustment module 530, and an abnormal handling module 540.

[0140] The data acquisition module 510 can be used to acquire multi-source data of the target object, and determine the event anchor point corresponding to the target object and the risk evolution data associated with the event anchor point based on the multi-source data. The event anchor point is used to determine the segmented or aligned position of the risk evolution data in the time dimension. In one embodiment, the data acquisition module 510 can be used to execute step S210 described above, which will not be repeated here.

[0141] The graph calibration module 520 can be used to obtain a coupling relationship graph associated with the target object. Based on data representing resource flow changes in the risk evolution data, the coupling relationship graph is calibrated to obtain a calibrated coupling relationship graph. The coupling relationship graph represents the coupling relationship between object associations and resource flow relationships. In one embodiment, the graph calibration module 520 can be used to execute step S220 described above, which will not be repeated here.

[0142] The gating adjustment module 530 can be used to determine the evolutionary risk characteristics of the target object based on risk evolution data, and to determine the spectral risk characteristics of the target object based on the calibrated coupling relationship graph. The evolutionary risk characteristics and spectral risk characteristics are input into the anomaly risk processing model, which then performs gating adjustment on the feature fusion process according to the synergistic relationship between the evolutionary risk characteristics and the spectral risk characteristics to obtain a comprehensive risk result. In one embodiment, the gating adjustment module 530 can be used to execute step S230 described above, which will not be repeated here.

[0143] The exception handling module 540 can be used to determine the exception risk handling level of the target object based on the comprehensive risk result, and execute the corresponding exception risk handling action according to the exception risk handling level. In one embodiment, the exception handling module 540 can be used to execute the step S240 described above, which will not be repeated here.

[0144] Based on the embodiments of this application, the data acquisition module 510 can also be used to extract candidate events corresponding to changes in the state of the target object, changes in resource allocation, changes in resource flow, or changes in performance from multi-source data, and determine the occurrence time of each candidate event; based on the event type and occurrence time of the candidate events, determine event anchors from the candidate events for time segmentation or time alignment of the multi-source data; and based on the event anchors, extract data located before, after, or covering the event anchors from the multi-source data to obtain risk evolution data.

[0145] Based on the embodiments of this application, the map calibration module 520 can also be used to perform entity parsing on multi-source data to obtain a set of entities associated with the target object, as well as object association relationships and resource flow relationships between entities in the entity set; based on the object association relationships and resource flow relationships, determine a first relation structure for representing object association relationships and a second relation structure for representing resource flow relationships; and establish a coupling connection between the first relation structure and the second relation structure to obtain a coupling relationship graph associated with the target object.

[0146] Based on the embodiments of this application, the graph calibration module 520 can also be used to extract resource flow records associated with event anchors from risk evolution data, and determine the target object and the resource flow direction, resource flow object, and resource flow intensity corresponding to the associated object that has an object association relationship with the target object based on the resource flow records; determine the target node corresponding to the resource flow object and the target connection edge corresponding to the resource flow direction or resource flow intensity in the coupling relationship graph; and calibrate the risk attributes of the target node or the connection parameters of the target connection edge based on the resource flow records to obtain the calibrated coupling relationship graph.

[0147] Based on the embodiments of this application, the graph calibration module 520 can also be used to enhance the connection parameters of the target object and at least one associated object in the coupling graph when the resource flow direction of the target object and at least one associated object represented by the resource flow record points to the same resource flow object or the same set of resource flow objects; reduce the connection parameters of the target object and at least one associated object in the coupling graph when there is an object association relationship between the target object and at least one associated object represented by the resource flow record but they do not point to the same resource flow object or the same set of resource flow objects; and improve the risk attribute of the corresponding node of the resource flow object when the resource flow object satisfies the convergence condition or transit condition based on multiple resource flow records.

[0148] Based on the embodiments of this application, the gating adjustment module 530 can also be used to determine the state change characteristics of the target object before and after the event anchor point based on risk evolution data; determine the resource migration characteristics of the target object after the event anchor point based on risk evolution data; and fuse the state change characteristics and resource migration characteristics to obtain the evolutionary risk characteristics.

[0149] Based on the embodiments of this application, the gating adjustment module 530 can also be used to determine the neighboring nodes, coupling connection edges, and risk propagation paths of the node corresponding to the target object in the calibrated coupling relationship graph; determine the graph association strength of the target object based on the risk attributes of the neighboring nodes, the connection strength of the coupling connection edges, and the path length of the risk propagation path; and generate graph risk features based on the graph association strength.

[0150] Based on the embodiments of this application, the gating adjustment module 530 can also be used to determine the gating adjustment parameters based on the co-occurrence state of evolutionary risk features and map risk features in the same time segment; adjust the contribution of evolutionary risk features and map risk features in the feature fusion process based on the gating adjustment parameters; and perform fusion processing on evolutionary risk features and map risk features based on the adjusted contribution to obtain a comprehensive risk result.

[0151] Based on the embodiments of this application, the anomaly handling module 540 can also be used to generate dynamic risk results based on comprehensive risk results and historical risk results of the target object; determine the anomaly risk handling level of the target object based on the matching relationship between the dynamic risk results and preset risk thresholds; and determine the anomaly risk handling action corresponding to the anomaly risk handling level from the set of handling actions, and execute the anomaly risk handling action.

[0152] Based on embodiments of this application, any multiple modules among the data acquisition module 510, spectrum calibration module 520, gating adjustment module 530, and anomaly handling module 540 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. Based on embodiments of this application, at least one of the data acquisition module 510, spectrum calibration module 520, gating adjustment module 530, and anomaly handling module 540 can be at least partially implemented as hardware circuitry, such as field-programmable gate arrays, programmable logic arrays, systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits, or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the data acquisition module 510, the spectrum calibration module 520, the gating adjustment module 530, and the anomaly handling module 540 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0153] Figure 6 A block diagram of an electronic device suitable for implementing an anomaly risk handling method based on an embodiment of this application is shown schematically.

[0154] like Figure 6 As shown, an electronic device 600 based on an embodiment of this application includes a processor 601, which can perform various appropriate actions and processes based on a program stored in a read-only memory 602 or a program loaded from a storage portion 608 into a random access memory 603. The processor 601 may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a dedicated microprocessor. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for executing different steps of the method flow based on an embodiment of this application.

[0155] Random access memory 603 stores various programs and data required for the operation of electronic device 600. Processor 601, read-only memory 602, and random access memory 603 are interconnected via bus 604. Processor 601 executes various steps of the method flow based on embodiments of this application by executing programs in read-only memory 602 and / or random access memory 603. It should be noted that the programs may also be stored in one or more memories other than read-only memory 602 and random access memory 603. Processor 601 may also execute various steps of the method flow based on embodiments of this application by executing programs stored in said one or more memories.

[0156] Based on embodiments of this application, the electronic device 600 may further include an input / output interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube, liquid crystal display, etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card, such as a local area network card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0157] Embodiments of this application also provide a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method based on the embodiments of this application.

[0158] Based on embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In embodiments of this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, based on embodiments of this application, the computer-readable storage medium may include the read-only memory 602 described above, and / or random access memory 603, and / or one or more memories other than read-only memory 602 and random access memory 603.

[0159] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0160] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0161] In embodiments of this application, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611. When the computer program is executed by processor 601, it performs the functions defined in the system of embodiments of this application. Based on embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0162] Based on embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0163] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0164] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for handling abnormal risks, characterized in that, The method includes: Acquire multi-source data of the target object, and determine the event anchor point corresponding to the target object and the risk evolution data associated with the event anchor point based on the multi-source data, wherein the event anchor point is used to determine the segment position or alignment position of the risk evolution data in the time dimension; Obtain a coupling relationship graph associated with the target object, and calibrate the coupling relationship graph based on the data representing resource flow changes in the risk evolution data to obtain a calibrated coupling relationship graph, wherein the coupling relationship graph is used to represent the coupling relationship between object association relationship and resource flow relationship; Based on the risk evolution data, the evolutionary risk characteristics of the target object are determined, and based on the calibrated coupling relationship graph, the spectral risk characteristics of the target object are determined. The evolutionary risk characteristics and the spectral risk characteristics are input into an anomaly risk processing model, which then gates and adjusts the feature fusion process according to the synergistic relationship between the evolutionary risk characteristics and the spectral risk characteristics to obtain a comprehensive risk result. Based on the comprehensive risk results, the abnormal risk handling level of the target object is determined, and the corresponding abnormal risk handling action is executed according to the abnormal risk handling level.

2. The method according to claim 1, characterized in that, The step of determining the event anchor point corresponding to the target object and the risk evolution data associated with the event anchor point based on the multi-source data includes: Extract candidate events corresponding to changes in the state, resource allocation, resource flow, or performance of the target object from the multi-source data, and determine the occurrence time of each candidate event; Based on the event type and occurrence time of the candidate events, event anchor points are determined from the candidate events for time segmentation or time alignment of the multi-source data; and Based on the event anchor, data located before, after, or covering the event anchor are extracted from the multi-source data to obtain the risk evolution data.

3. The method according to claim 1, characterized in that, The step of obtaining the coupling relationship graph associated with the target object includes: Entity parsing is performed on the multi-source data to obtain a set of entities that are associated with the target object, as well as the object association relationships and resource flow relationships between the entities in the entity set; Based on the object associations and resource flow relationships, a first relation structure for representing object associations and a second relation structure for representing resource flow relationships are determined; and Establish a coupling connection between the first relation structure and the second relation structure to obtain a coupling relationship graph associated with the target object.

4. The method according to claim 1, characterized in that, The process of calibrating the coupling relationship diagram based on data representing resource flow changes in the risk evolution data to obtain a calibrated coupling relationship diagram includes: Extract resource flow records associated with the event anchor from the risk evolution data, and determine the resource flow direction, resource flow object, and resource flow intensity of the target object and the associated objects that have an object association relationship with the target object based on the resource flow records; In the coupling graph, target nodes corresponding to the resource flow objects and target connection edges corresponding to the resource flow direction or the resource flow intensity are determined; and Based on the resource flow records, the risk attributes of the target node or the connection parameters of the target connection edge are calibrated to obtain the calibrated coupling relationship graph.

5. The method according to claim 4, characterized in that, The calibration of the risk attributes of the target node or the connection parameters of the target connection edge based on the resource flow record includes: When the resource flow record indicates that the resource flow direction of the target object and at least one associated object points to the same resource flow object or the same set of resource flow objects, the connection parameters of the target object and the at least one associated object in the coupling relationship graph are enhanced; When the resource flow record indicates that there is an object association relationship between the target object and at least one associated object, but they do not point to the same resource flow object or the same set of resource flow objects, the connection parameter of the target object and the at least one associated object in the coupling relationship graph is reduced; When the resource transfer object meets the convergence or transit conditions based on multiple resource transfer records, the risk attribute of the node corresponding to the resource transfer object is increased.

6. The method according to claim 1, characterized in that, Determining the evolutionary risk characteristics of the target object based on the risk evolution data includes: Based on the risk evolution data, determine the state change characteristics of the target object before and after the event anchor point; Based on the risk evolution data, determine the resource migration characteristics of the target object after the event anchor point; and The evolution risk characteristics are obtained by fusing the state change characteristics and the resource migration characteristics.

7. The method according to claim 1, characterized in that, The determination of the spectral risk characteristics of the target object based on the calibrated coupling graph includes: In the calibrated coupling graph, determine the neighboring nodes, coupling edges, and risk propagation paths of the node corresponding to the target object; Based on the risk attributes of the neighboring nodes, the connection strength of the coupled edges, and the path length of the risk propagation path, the graph association strength of the target object is determined; and The risk features of the graph are generated based on the correlation strength of the graph.

8. The method according to claim 1, characterized in that, The anomaly risk processing model gates and adjusts the feature fusion process based on the synergistic relationship between the evolutionary risk features and the map risk features to obtain a comprehensive risk result, including: Based on the co-occurrence state of the evolutionary risk characteristics and the map risk characteristics within the same time segment, the gating adjustment parameters are determined; The contribution of the evolutionary risk feature and the map risk feature in the feature fusion process is adjusted based on the gating adjustment parameters; and Based on the adjusted contribution, the evolutionary risk features and the map risk features are fused to obtain the comprehensive risk result.

9. The method according to claim 1, characterized in that, The step of determining the abnormal risk handling level of the target object based on the comprehensive risk result, and executing the corresponding abnormal risk handling action according to the abnormal risk handling level, includes: Based on the comprehensive risk results and the historical risk results of the target object, a dynamic risk result is generated; Based on the matching relationship between the dynamic risk results and the preset risk threshold, the abnormal risk handling level of the target object is determined; and Determine the abnormal risk handling action corresponding to the abnormal risk handling level from the set of handling actions, and execute the abnormal risk handling action.

10. An abnormal risk handling device, characterized in that, The device includes: The data acquisition module is used to: acquire multi-source data of the target object, and determine the event anchor point corresponding to the target object and the risk evolution data associated with the event anchor point based on the multi-source data, wherein the event anchor point is used to determine the segment position or alignment position of the risk evolution data in the time dimension; The graph calibration module is used to: acquire a coupling relationship graph associated with the target object, calibrate the coupling relationship graph based on the data representing resource flow changes in the risk evolution data, and obtain a calibrated coupling relationship graph, wherein the coupling relationship graph is used to represent the coupling relationship between object association and resource flow relationship; A gating adjustment module is used to: determine the evolutionary risk characteristics of the target object based on the risk evolution data, and determine the spectral risk characteristics of the target object based on the calibrated coupling relationship graph; input the evolutionary risk characteristics and the spectral risk characteristics into an anomaly risk processing model, and have the anomaly risk processing model gating the feature fusion process according to the synergistic relationship between the evolutionary risk characteristics and the spectral risk characteristics to obtain a comprehensive risk result; and An anomaly handling module is used to: determine the anomaly risk handling level of the target object based on the comprehensive risk result, and execute the corresponding anomaly risk handling action according to the anomaly risk handling level.

11. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 9.

Images