Risk intelligent intervention method and system based on artificial intelligence dynamic node prediction

Abstract

The application discloses a risk intelligent intervention method and system based on artificial intelligence dynamic node prediction, belongs to the technical field of risk management and control, and aims to solve problems of insufficient data support, fuzzy abnormality determination and lagging intervention in traditional risk management and control. The method comprises the following steps: a dynamic data pool is constructed, and scene-based metadata is bound; a related node working condition type is identified, abnormality is screened by combining deviation degree analysis and feature vector similarity matching, a data tracking mechanism is supplemented to close loop process a to-be-confirmed working condition, and an abnormal influence link containing an influence weight is constructed according to a node level; basic indexes are obtained by relying on associated rule mining of historical transmission laws, risk transmission probability and diffusion time are calculated after nonlinear correction is completed through a pre-trained AI dynamic node prediction model, diffusion features such as a sensitive coefficient are extracted, and a risk intervention report with a labeled intervention priority and a time window is generated. The application realizes accurate prediction and timely intervention of risks, and improves the accuracy and timeliness of production supply chain risk management and control.

Description

Technical Field

[0001] This invention relates to the field of risk management technology, and more specifically to a risk intelligent intervention method and system based on artificial intelligence dynamic node prediction. Background Technology

[0002] In complex operational scenarios such as production maintenance and supply chain collaboration, various links such as equipment, transportation routes, and warehousing space are closely interconnected. If an operational problem occurs in one link, it can easily spread along the business process to other links, thus affecting the stability of overall operations. Therefore, risk management in such scenarios is crucial to ensuring the normal operation of business. Existing risk monitoring methods based on semantic analysis can collect multi-source data and conduct risk assessments through task-driven approaches. However, their assessment framework, which relies on preset rules and linear statistical models, cannot capture the nonlinear risk transmission relationships between nodes in complex operational scenarios caused by business coupling, resource competition, and dynamic scheduling. This leads to inaccurate assessment results when business links are frequently adjusted or new nodes are added. Furthermore, their fixed threshold judgment mechanism lacks the ability to adaptively adjust to the long-term operational patterns of nodes, making it difficult to distinguish between normal operating condition fluctuations and actual abnormal deviations. In addition, traditional fixed mathematical calculation methods cannot fit the nonlinear risk coupling relationships between nodes, resulting in significant prediction bias. Therefore, to overcome these limitations, this invention proposes a risk intelligent intervention method and system based on artificial intelligence dynamic node prediction. Summary of the Invention

[0003] In view of the shortcomings of existing technologies, the purpose of this invention is to provide a risk intelligent intervention method and system based on artificial intelligence dynamic node prediction, so as to solve the problem of how to accurately identify the abnormal state of related nodes in the operation scenario, clarify the transmission path, transmission probability and diffusion time of abnormal risks between nodes, and thus achieve timely and effective intervention of risks.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] A risk intelligent intervention method based on artificial intelligence dynamic node prediction includes:

[0006] Collect operational data from each associated node in the target operational scenario and extract historical operational data within the monitoring period to build a dynamic data pool containing real-time operational data and benchmark datasets.

[0007] Based on a dynamic data pool, potential deviation data is screened through deviation analysis, and the working condition type of newly added operational data of each associated node is identified by calculating feature vector similarity and data tracking mechanism. A rule base for judging the status of associated nodes is constructed by combining the benchmark dataset and node type characteristics to identify abnormal associated nodes, and an abnormal impact link is constructed by combining the core information of associated nodes.

[0008] Based on the influence weights of each associated node within the abnormal influence chain, target influencing nodes are screened. Through association rule mining, the basic transmission probability and basic diffusion duration are obtained. These are then input into a pre-trained AI dynamic node prediction model to perform nonlinear correction, outputting the risk transmission probability and risk diffusion time, and generating a risk intervention report.

[0009] Specifically, the steps to build a dynamic data pool that includes real-time operational data and a benchmark dataset include:

[0010] Collect operational data from each associated node in the target operational scenario and bind it to scenario-based metadata, which includes node identifier, data collection timestamp, business scenario tag, and data association factor;

[0011] Implement scenario-based data cleaning and invalid data filtering; and perform standardized processing of operational data, including unified data structure and unified data encoding format.

[0012] Initialize the dynamic data pool, and extract historical operational data of each associated node within the monitoring period in batches based on node identifiers and business scenario tags in the scenario-based metadata of operational data to build a benchmark dataset.

[0013] Historical operational data are categorized by operating condition type, which includes normal operating condition and abnormal operating condition. A normal reference standard and an abnormal feature library are constructed.

[0014] When new operational data is added, the dynamic data pool is incrementally iterated, and the baseline dataset is updated based on the contextualized metadata.

[0015] After the benchmark dataset is updated, the newly added operational data will be associated with the benchmark dataset, and the association link between operational data, normal reference standards, and abnormal feature library will be established through the node identifier in the contextualized metadata.

[0016] A hierarchical storage architecture consisting of a real-time layer, a historical layer, and a relational layer is adopted to store the dynamic data pool. The real-time layer is used to store real-time operational data and establishes a time index based on the data collection timestamp. The historical layer is used to store benchmark datasets and establishes a partition index based on business scenario tags and working condition types. The relational layer is used to establish a mapping relationship between the real-time layer and the historical layer through scenario-based metadata.

[0017] Specifically, determining whether to trigger a baseline dataset update based on contextualized metadata includes:

[0018] If the associated node of the newly added operational data is a newly added associated node, the benchmark dataset will be updated, the historical operational data of the monitoring period of the associated node will be extracted, the benchmark dataset will be added, and the normal reference standard and abnormal feature library will be updated.

[0019] If the associated node of the newly added operational data is not a newly added associated node, the deviation between the newly added operational data and the normal reference standard of the associated node is calculated. If it is greater than the preset deviation threshold, the benchmark dataset is updated, the historical operational data of the monitoring period of the associated node is extracted, and the normal reference standard is updated.

[0020] Specifically, the steps for identifying the operational condition type of newly added operational data for each associated node include:

[0021] Extract the core features of the newly added operational data and calculate the statistical deviation index between the newly added operational data and the normal reference standard. Configure the statistical deviation threshold for each statistical deviation index. If the statistical deviation index of the newly added operational data exceeds the corresponding statistical deviation threshold, the newly added operational data is determined to be potential deviation data. Otherwise, the operating condition type of the newly added operational data is determined to be normal operating condition.

[0022] The core features of the potential deviation data are compared with the abnormal features of the same related nodes in the abnormal feature library to calculate the feature vector similarity. A feature similarity judgment threshold is configured. When the similarity between the potential deviation data and the abnormal feature is greater than the feature similarity judgment threshold, it is judged as a valid match and the working condition type of the newly added operation data is marked as an abnormal working condition; otherwise, it is judged as an invalid match and the working condition type of the newly added operation data is marked as a working condition to be confirmed.

[0023] Specifically, the steps for identifying the operational condition type of newly added operational data for each associated node also include:

[0024] For newly added operational data marked as pending confirmation, its contextualized metadata is associated and stored in the pending confirmation partition of the dynamic data pool. At the same time, a data tracking mechanism is triggered to continuously collect operational data within the anomaly tracking period of the associated node and construct an anomaly assessment set.

[0025] For the operational data in the anomaly assessment set, feature overlay analysis is performed according to data type. Based on the consistency and changing trend of the anomaly characteristics of the operational data, anomaly trend sub-indicators are calculated respectively. The comprehensive anomaly trend index value of the newly added operational data of the working condition to be confirmed is calculated by weighted summation.

[0026] Configure a comprehensive anomaly threshold. If the comprehensive anomaly trend index value of the newly added operational data of the working condition to be confirmed is greater than the comprehensive anomaly threshold, then extract the core features of the newly added operational data of the working condition to be confirmed and the data in the anomaly assessment set, add the associated node identifier and business scenario label to the anomaly feature library, and update the working condition type of the newly added operational data to an abnormal working condition; otherwise, correct the working condition type to a normal working condition.

[0027] Specifically, the steps for identifying abnormal associated nodes and constructing the abnormal impact chain by combining the core information of the associated nodes include:

[0028] When newly added operational data of an associated node is marked as abnormal, the baseline dataset corresponding to the associated node is retrieved from the historical layer of the dynamic data pool, and the core parameters of the associated node status judgment rule base are retrieved according to the business scenario tag of the associated node. This is used to perform multi-dimensional verification on the abnormal operating data of the associated node to determine whether it is an abnormal associated node.

[0029] If so, starting from the abnormal associated node, during the abnormal transmission observation period, the directly associated node is located through the data association factor, and the indirect associated node is located according to the data association factor of the directly associated node. The abnormal impact link is constructed according to the hierarchy of the abnormal source node, the directly associated node and the indirect associated node.

[0030] Extract the core information of all associated nodes during the observation period of abnormal transmission of the abnormal impact link. The core information includes whether it is an abnormal associated node, whether it contains abnormal operating conditions, and the time when the abnormal operating conditions occurred.

[0031] The influence weight of each associated node is obtained by multiplying its basic weight coefficient, operating condition influence coefficient, and time decay coefficient based on whether a basic weight coefficient is set for the abnormal associated node, whether an abnormal operating condition is included, and the time decay coefficient is set based on the occurrence time of the abnormal operating condition.

[0032] Specifically, the rule base for judging the status of associated nodes is divided into layers according to business scenario tags, associated node types, and core parameters. Core parameters refer to quantitative indicators set for various associated node types under different business scenario tags to determine whether an associated node is an abnormal associated node. Based on the benchmark dataset of the dynamic data pool, they are obtained through statistical analysis of operational data under normal working conditions and are used to determine whether the corresponding associated node meets the judgment conditions for an abnormal associated node.

[0033] Specifically, the steps for calculating the probability of risk transmission include:

[0034] Extract the influence weights of all associated nodes from the abnormal influence chain, set an influence weight threshold, and use the associated nodes in the abnormal influence chain of the abnormal associated node whose influence weight is greater than the influence weight threshold as the target influence node;

[0035] For each target impact node in the abnormal impact chain, retrieve the historical transmission records of the corresponding target impact node from the historical layer of the dynamic data pool, extract the number of successful transmissions, the number of failed transmissions, the operational data and core features of the target impact node during transmission, and construct a historical transmission sample set;

[0036] Extract the hierarchical relationship between each target impact node and the anomaly-related node, the current operational data and core characteristics of the target impact node from the anomaly impact chain, and construct the current node feature set;

[0037] Construct association rules between the core features of the target-affected node and the transmission results, including transmission success and transmission failure. Calculate the confidence of each association rule as a historical transmission probability benchmark.

[0038] Calculate the feature matching degree between the core features of the current target's affected nodes and the core features in the historical association rules. Select the association rule as the target's historical association rule based on the feature matching degree, and use the confidence level corresponding to the target's historical association rule as the initial reference probability.

[0039] Calculate the feature difference degree between the current target's influencing node and the core features corresponding to the target's historical association rules. By setting a preset feature difference threshold, match the corresponding difference correction coefficient to dynamically correct the initial reference probability and obtain the corrected probability. Then, set a hierarchical correction coefficient and multiply the corrected probability by the hierarchical correction coefficient to obtain the basic transmission probability.

[0040] The risk transmission probability is obtained by correcting the basic transmission probability through a pre-trained AI dynamic node prediction model.

[0041] Specifically, the steps for calculating the risk diffusion time include:

[0042] Starting from the time when the abnormal associated node is identified as abnormal, the operational data of the abnormal associated node and the target affected node during the abnormal propagation observation period are obtained, and risk diffusion characteristics are extracted, including: the deviation value of the current operational data of the abnormal associated node, the rate of change of operational data, the sensitivity coefficient of the target affected node, and the duration of business connection between nodes;

[0043] Set an anomaly trigger threshold for the target affected node. Combine the current operational data deviation value and operational data change rate of the anomaly-related node to calculate the basic time required for the anomaly-related node to reach the anomaly trigger threshold of the target affected node. Correct the basic time according to the sensitivity coefficient of the target affected node to obtain the propagation time. Then, add the business connection time between the anomaly-related node and the target affected node to obtain the basic diffusion time of the anomaly from the anomaly-related node to the target affected node. Finally, correct the time by using a pre-trained AI dynamic node prediction model to obtain the risk diffusion time.

[0044] A risk intelligent intervention system based on artificial intelligence dynamic node prediction includes a data acquisition module, a working condition identification module, an abnormal link construction module, and a risk prediction module.

[0045] The data acquisition module collects operational data from each associated node in the target operational scenario and extracts historical operational data within the monitoring period to construct a dynamic data pool containing real-time operational data and a benchmark dataset. The operational condition identification module, based on the dynamic data pool, filters potential deviation data through deviation analysis and identifies the operational condition type of newly added operational data for each associated node by calculating feature vector similarity and using a data tracking mechanism. The abnormal link construction module combines the benchmark dataset and node type characteristics to construct a rule base for judging the status of associated nodes, identifies abnormal associated nodes, and constructs an abnormal impact link based on the core information of the associated nodes. The risk prediction module filters target impact nodes based on the impact weights of each associated node within the abnormal impact link, obtains the basic transmission probability and basic diffusion duration through association rule mining, inputs them into a pre-trained AI dynamic node prediction model to perform nonlinear correction, outputs the risk transmission probability and risk diffusion time, and generates a risk intervention report.

[0046] The beneficial effects of this invention are:

[0047] This application constructs a dynamic data pool containing real-time operational data and a benchmark dataset that can be dynamically updated. This provides a systematic and adaptable reference standard for judging the operational status of each link in the operational scenario. Combined with deviation analysis to screen potential deviation data, feature vector similarity matching to identify anomalies, and a data tracking mechanism to handle pending confirmation statuses in a closed loop, it effectively improves the accuracy of anomaly status identification and avoids the problems of misjudging normal fluctuations or missing real anomalies. By constructing anomaly impact chains according to the anomaly source, direct association, and indirect association, and calculating the impact weight based on node attributes, operating conditions, and anomaly occurrence time, the diffusion path of anomaly risks is clearly identified. At the same time, by using association rules to mine historical transmission patterns to calculate basic indicators, and by performing nonlinear correction through a pre-trained AI dynamic node prediction model, the risk transmission probability and risk diffusion time are obtained, which greatly improves the accuracy of risk prediction and accurately predicts the scope and time window of risk impact. Finally, by generating a risk intervention report, key intervention nodes and the best intervention time are identified, which solves the problems of passive intervention and blind resource investment in traditional risk management, realizes the precision and timeliness of risk management, and effectively ensures the stable operation of complex operational scenarios such as production maintenance and supply chain collaboration. Attached Figure Description

[0048] Figure 1 This is a flowchart of the intelligent risk intervention method based on artificial intelligence dynamic node prediction according to the present invention;

[0049] Figure 2 A flowchart illustrating the construction of a dynamic data pool comprising real-time operational data and a benchmark dataset for this invention;

[0050] Figure 3This is a flowchart illustrating the process of determining whether to trigger a benchmark dataset update based on contextualized metadata, as described in this invention.

[0051] Figure 4 This is a flowchart illustrating the process of identifying the operational data type of each associated node in this invention.

[0052] Figure 5 This invention identifies abnormal associated nodes and constructs a flowchart of the abnormal impact chain. Detailed Implementation

[0053] Please see Figure 1 This embodiment introduces a risk intelligent intervention method based on artificial intelligence dynamic node prediction, including:

[0054] Step S1: For each risk-affecting node in the target operation scenario, a lightweight data acquisition technology system is used to construct a multi-dimensional data input channel to collect operational data from each related node. In this embodiment, the target operation scenario refers to the production operation and supply chain collaboration scenario, covering key links in the core business chain that require risk management, including production equipment operation and maintenance, raw material supply chain flow, finished product warehousing and scheduling, and customer order fulfillment. Operational data refers to structured and unstructured data in the target operation scenario that is directly related to risk management and can reflect the operating status of related nodes and the interaction between nodes. It has real-time and historical continuity and is used to support risk node identification, status prediction, and intervention decisions. This includes equipment operating parameter data, environmental impact data, supply chain flow data, warehousing inventory data, and order fulfillment data. Specifically, this includes collecting production equipment operating parameter data, such as motor speed, equipment surface temperature, core component load current, and equipment operating time, through distributed IoT sensing devices; and warehousing environmental impact data, such as warehouse space temperature and humidity, and shelf load-bearing pressure. The data includes environmental dust concentration; real-time supply chain data such as the location information of raw material transport vehicles, the status of goods in transit, and warehouse entry and exit barcode scanning records; and historical operational data within the monitoring period to construct a benchmark dataset covering the performance of related nodes under normal and abnormal operating conditions. This dataset provides a historical reference standard for judging the abnormal state of related nodes, provides comparative samples of normal and abnormal operating conditions for subsequent node prediction model training, and supports the mining and verification of risk transmission relationships between nodes. In this embodiment, the monitoring period refers to the historical data extraction time span set to ensure that the benchmark dataset can cover the entire business cycle and contain a sufficient number of normal and abnormal operating condition samples. It is set in combination with the business cycle characteristics of the target operation scenario, including the monthly cycle of the production process and the quarterly cycle of the supply chain process. At the same time, the collected operational data is subjected to standardized preprocessing to remove invalid data and perform unified data format conversion. Finally, a dynamic data pool containing real-time operational data and the benchmark dataset is constructed to provide a structured and highly available data foundation for subsequent dynamic updates and node prediction.

[0055] In this embodiment, the collaborative application of distributed IoT sensing devices and a lightweight data acquisition technology system enables real-time data acquisition and full coverage of data from multiple interconnected nodes in production operations, supply chain flow, warehouse scheduling, and order fulfillment. Compared to the traditional manual, decentralized data acquisition model, this effectively eliminates data acquisition blind spots and significantly improves data response timeliness and coverage completeness. By constructing a benchmark dataset covering both normal and abnormal operating conditions, it provides accurate historical references for determining abnormal states of interconnected nodes and offers rich comparative samples for subsequent predictive model training, solving the problem of ambiguous judgment criteria due to a lack of historical data support in traditional risk management. Standardized preprocessing removes invalid data and unifies data formats, significantly improving the structuring and usability of the data and avoiding the inefficiency of subsequent processing caused by chaotic multi-source data formats. The resulting unified data pool integrates real-time dynamic data and historical benchmark data, effectively breaking down data silos and providing a structured, highly available data foundation for subsequent edge-end and cloud-based collaborative dynamic updates and multi-node correlation predictions, ensuring consistent and accurate data support throughout the entire risk management process.

[0056] Please see Figure 2 Preferably, the steps for constructing a dynamic data pool containing real-time operational data and a benchmark dataset include:

[0057] Operational data from various related nodes within the target operational scenario is collected and bound to scenario-based metadata to establish a precise correlation between data and scenarios / business links, laying the foundation for subsequent data classification and benchmark construction. Scenario-based metadata includes node identifiers, data collection timestamps, business scenario tags, and data association factors. Node identifiers are codes used to uniquely distinguish related nodes within a scenario, such as equipment numbers for production equipment, line IDs for supply chain routes, and area codes for warehouse spaces, ensuring data can be accurately located to specific nodes. Data collection timestamps record the precise time information of data generation or collection, used for subsequent time-series analysis and data timeliness determination. Business scenario tags are identifiers representing the business link and scenario attributes to which the data belongs, enabling data classification by business dimension. Data association factors are key information in the business link to which the associated data belongs, such as the production line number associated with production data, the order ID associated with supply chain data, and the batch number associated with warehouse data, used for cross-link data interaction.

[0058] For the collected operational data, differentiated cleaning strategies are formulated according to data type. Scenario-based data cleaning and invalid data filtering are implemented to remove interfering data and supplement missing information, ensuring data quality meets subsequent processing needs. For example, for numerical data, such as equipment temperature, load current, and warehouse temperature and humidity, standard ranges are set based on scenario business standards. Outliers exceeding the range are identified and removed. Missing data is supplemented using historical data trend interpolation at the same node to ensure that the supplemented data conforms to the node's operational patterns. For status data, such as equipment operating status and goods in transit status, standard status expressions within the scenario are sorted out, such as running, stopped, in transit, and already in storage, eliminating vague expressions and irrelevant data. For textual data, such as equipment fault descriptions and supply chain anomaly records, core semantics are extracted using terminology segmentation algorithms in the production supply chain field, meaningless function words and redundant content are removed, and key information related to risk assessment is retained.

[0059] Standardize operational data processing, including unifying data structure and encoding format, to eliminate differences in data formats from multiple sources and ensure data comparability and system compatibility across different stages. Unified data structure refers to converting unstructured text data and semi-structured sensor data into a unified structured format, clearly defining field definitions and types. Unified data encoding format refers to constructing a scenario-based data mapping dictionary and adopting a universal encoding standard to avoid data garbled characters caused by encoding incompatibility.

[0060] Initialize a dynamic data pool. Based on node identifiers and business scenario tags in the scenario-based metadata of operational data, batch extract historical operational data of each associated node within the monitoring period to construct a benchmark dataset. Classify each historical operational data according to operating condition type, including normal operating condition and abnormal operating condition. Calculate statistical indicators under normal operating conditions and extract abnormal features under abnormal operating conditions to construct a normal reference standard and an abnormal feature library. Statistical indicators refer to quantitative parameters that reflect the operating rules of associated nodes under normal operating conditions, including mean and fluctuation range. For example, the average temperature of a production motor during normal operation is ±5℃ and the load current fluctuation range is ±10A. Abnormal features refer to key manifestations of node operating deviations under abnormal operating conditions, such as the sudden increase in temperature when equipment malfunctions or the delay in flow when the supply chain is abnormal.

[0061] Please see Figure 3 When new operational data is added, the dynamic data pool is incrementally iterated, and the baseline dataset is updated based on contextualized metadata to determine whether to trigger an update.

[0062] If the associated node of the newly added operational data is a newly added associated node, the benchmark dataset will be updated, the historical operational data of the monitoring period of the associated node will be extracted, the benchmark dataset will be added, and the normal reference standard and abnormal feature library will be updated.

[0063] If the associated node of the newly added operational data is not a newly added associated node, then a deviation analysis is performed between the newly added operational data and the normal reference standard of that associated node. The deviation is calculated, and if it exceeds a preset deviation threshold, the benchmark dataset is updated. Historical operational data of the monitoring period for that associated node is extracted, and statistical indicators under normal operating conditions are recalculated to ensure that the normal reference standard is consistent with the current operating pattern of the node. The preset deviation threshold is a critical deviation value set based on the statistical fluctuation range of historical normal operating data in the dynamic data pool and the acceptable risk deviation level of the corresponding business scenario. It is used to determine whether the newly added operational data needs to trigger a benchmark dataset update.

[0064] After the benchmark dataset is updated, the newly added operational data will be linked and integrated with the benchmark dataset. The link between operational data, normal reference standards, and abnormal feature library will be established through the node identifiers in the scenario-based metadata. Data subsets will be divided according to business scenario tags. Each data subset will achieve cross-business linkage through the data association factors in the scenario-based metadata, forming a full-link data reference system to provide a basis for comparison in subsequent risk assessment.

[0065] A hierarchical storage architecture consisting of a real-time layer, a historical layer, and a correlation layer is adopted to store the dynamic data pool. The real-time layer is used to store standardized operational data and a time index is built according to the data collection timestamp. The historical layer is used to store the benchmark dataset and a partition index is built according to the business scenario tags and working condition types. The correlation layer is used to establish the mapping relationship between the real-time layer and the historical layer through the correlation fields of scenario-based metadata, so that the corresponding benchmark data can be automatically associated when querying operational data.

[0066] The real-time layer adopts an incremental update mode. Newly collected real-time operational data, after being cleaned and standardized, is automatically and incrementally written to the corresponding partition, and the time index and the mapping relationship of the related layers are updated synchronously to ensure that the operational data is accessed without delay. The historical layer performs iterative updates according to the monitoring cycle and conditions, updates the benchmark dataset and removes historical operational data that is too long-term and has no reference value. During the update process, a scenario-based update log is generated to record the update time, update type, update scope, and triggering conditions, which facilitates subsequent data version management and traceability, and ensures that the dynamic data pool always keeps pace with business changes in production operation and maintenance and supply chain collaboration scenarios. The update type refers to the category based on the updated content of the benchmark dataset, including normal reference standard update, abnormal feature library update, and supplementation of benchmark data for newly added related nodes; the update scope refers to the related nodes and business links involved in the benchmark dataset update, specifically including the related node identifier, corresponding business scenario label, and data dimension; the triggering condition refers to the preconditions for starting the benchmark dataset update, including but not limited to the scenario of adding new related nodes, the deviation of non-new node data from the normal reference standard exceeding a preset threshold, and the addition of unrecorded abnormal operating condition types. All triggering conditions must be confirmed through scenario-based metadata and data feature analysis to ensure the necessity and accuracy of the update.

[0067] Step S2: Based on the dynamic data pool, firstly, the operating condition type of newly added operational data for each associated node is identified through multi-dimensional data comparison. Then, a rule base for judging the status of associated nodes is constructed by combining the benchmark dataset of the dynamic data pool with the characteristics of node types to identify abnormal associated nodes and construct an abnormal impact chain. Specifically, for newly added operational data, the operating condition type is first determined by a combination of deviation analysis and feature matching algorithms: the deviation analysis calculates the statistical deviation between the newly added operational data and the normal reference standard in the benchmark dataset of the dynamic data pool, and initially filters data that deviates from the normal range; then, the feature matching algorithm compares the similarity between the filtered data and the abnormal feature library in the benchmark dataset to clarify whether the operating condition type corresponding to the data is normal or abnormal. Subsequently, based on the differentiated characteristics of associated nodes corresponding to business scenario tags such as production equipment operation and maintenance, supply chain flow, warehousing, and scheduling, a classified status judgment rule base is constructed. The core parameters of the rule base directly call the benchmark data of the dynamic data pool and are automatically updated with incremental iterations of the data pool: when the dynamic data pool updates the benchmark dataset due to changes in the business of newly added nodes, the rule base synchronously updates the judgment parameters of the corresponding nodes; when the data pool accumulates new abnormal features, the rule base automatically supplements the corresponding abnormal judgment sub-logic. Finally, the operating condition type of the newly added operational data is verified and the status is output through the rule base, clearly marking the normal or abnormal status and abnormal level of each related node, providing accurate preliminary judgment basis for subsequent multi-node correlation prediction and scenario-based risk intervention.

[0068] In this embodiment, a dynamic data pool is constructed as the core support. By combining deviation analysis and feature matching algorithms, the misjudgment problem that is prone to occur in single data judgment is effectively avoided, and the accuracy of the judgment of the working condition type of associated nodes is greatly improved. The classification status judgment rule library constructed by combining the node characteristics under the tags of various business scenarios avoids the defect of poor adaptability of traditional general rules and ensures that the judgment of various node statuses fits the actual business scenarios. The mechanism of automatic updating of the rule library with the incremental iteration of the dynamic data pool solves the pain point of the fixed parameters of the traditional rule library and the need for frequent manual adjustment, ensuring that the judgment logic adapts to the node operation rules in the long term. Finally, it realizes the accurate identification and level labeling of abnormal associated nodes, providing a reliable pre-judgment basis for subsequent multi-node association prediction and scenario-based risk intervention, and significantly improving the timeliness and accuracy of risk management.

[0069] Please see Figure 4 Preferably, the specific steps for identifying the operational condition type of newly added operational data for each associated node include:

[0070] For newly added operational data that has undergone scenario-based cleaning and standardization, preprocessing is performed in conjunction with scenario-based metadata from the dynamic data pool to extract core features of the operational data. This includes: extracting the trend and fluctuation features of numerical data within a unit of time; converting state data into a standardized state coding sequence; and extracting core semantic feature vectors for text data. This ensures that the data features are consistent with the feature dimensions of the benchmark dataset in the dynamic data pool, laying the foundation for subsequent comparisons.

[0071] Based on a dynamic data pool, a deviation analysis is performed using a normal reference standard. This involves calculating statistical deviation indicators between newly added operational data and the normal reference standard. For numerical data, this includes quantifying the degree of deviation by calculating indicators such as mean deviation and range coverage. For state-based data, deviation is determined by comparing the matching degree between standardized coded sequences and normal state sequences. For text-based data, semantic similarity calculations are used to determine differences from normal descriptions. This process initially filters out newly added operational data that deviates from the normal reference standard. Specifically, range coverage refers to the proportion of overlap between the numerical value ranges of the newly added operational data and the numerical value ranges of the normal reference standard, used to quantify the degree of deviation of numerical data from its value range.

[0072] Based on the distribution characteristics of historical normal operating data in the dynamic data pool, the statistical deviation thresholds of each statistical deviation indicator are configured to distinguish between normal fluctuations and significant deviations, avoid misjudging random fluctuations within the normal range as data deviations, and ensure the accuracy of deviation data screening. When the statistical deviation indicator of newly added operating data exceeds the corresponding statistical deviation threshold, the newly added operating data is determined to be potential deviation data; otherwise, the operating condition type of the newly added operating data is determined to be normal operating condition.

[0073] For the initially screened potential deviation data, a feature matching algorithm is used to compare it with the abnormal feature library of the dynamic data pool. The feature vector similarity is calculated between the core features of the potential deviation data and the abnormal features of the same related nodes in the abnormal feature library. At the same time, the matching range is preset by combining the business scenario tags in the contextualized metadata to limit the matching objects to abnormal features of the same business process, avoid misjudgment caused by cross-scenario feature matching, and improve the matching accuracy.

[0074] Based on the feature matching results of historical anomaly cases in the dynamic data pool, a feature similarity judgment threshold is configured to distinguish between valid and invalid matches: when the similarity between potential deviation data and anomaly features is greater than the feature similarity judgment threshold, it is judged as a valid match, and the working condition type of the newly added operational data is marked as an abnormal working condition; otherwise, it is judged as an invalid match, and the working condition type of the newly added operational data is temporarily marked as a working condition to be confirmed, so as to avoid misjudging unrecorded anomaly types as normal or forcibly classifying them into existing anomaly types.

[0075] For newly added operational data marked as pending confirmation, its contextual metadata is temporarily stored in the pending confirmation partition of the dynamic data pool. At the same time, a data tracking mechanism is triggered to continuously collect operational data within the anomaly tracking period of the associated node and construct an anomaly assessment set. The anomaly tracking period refers to the continuous data collection duration set to fully observe the evolution trend of pending confirmation data and avoid misjudgment due to too short an observation period. It needs to be determined in combination with the type of associated node and the characteristics of the business process.

[0076] For operational data in the anomaly assessment set, feature overlay analysis is performed according to data type. Anomaly trend sub-indicators are calculated based on the consistency and trend of anomaly features in the operational data. The comprehensive anomaly trend index value of the newly added operational data for the work condition to be confirmed is calculated by weighted summation. For example, for numerical data, the sliding window method is used to calculate the percentage of consistency of anomaly features between each batch of data and the newly added operational data for the work condition to be confirmed, and then the mean of the consistency percentage within the sliding window is calculated as the numerical sub-indicator. For status data, the proportion of matching bits between each standardized coding sequence in the anomaly assessment set and the initial coding sequence of the newly added operational data for the work condition to be confirmed is statistically analyzed, and the minimum value of the proportion of three consecutive matching bits is taken as the status sub-indicator. For text data, the similarity between the core semantic feature vector of each batch and the initial vector to be confirmed is calculated by semantic clustering algorithm, and the average value of all similarities is taken as the text sub-indicator. Then, the sub-indicator weights are assigned according to the type of associated nodes, and each sub-indicator is multiplied by its corresponding weight and summed to obtain the comprehensive anomaly trend index value.

[0077] Based on the statistical analysis of historical pending work condition processing cases in the dynamic data pool and the configuration of comprehensive anomaly thresholds based on the business importance of associated nodes, if the comprehensive anomaly trend index value of newly added operational data for pending work conditions exceeds the comprehensive anomaly threshold, the core features of the newly added operational data for pending work conditions and the data in the anomaly assessment set are extracted, and the associated node identifiers and business scenario tags are added to the anomaly feature library. At the same time, the work condition type of the newly added operational data is updated to an abnormal work condition; otherwise, the work condition type is corrected to a normal work condition, thus realizing the dynamic closed-loop processing of pending data.

[0078] Please see Figure 5 Preferably, the specific steps for identifying abnormal associated nodes and constructing abnormal impact links include:

[0079] When newly added operational data of an associated node is marked as abnormal, the corresponding benchmark dataset for that associated node is automatically retrieved from the historical layer of the dynamic data pool to provide accurate reference for the determination of abnormal nodes.

[0080] Based on the contextualized metadata of associated nodes, core parameters of the associated node status judgment rule base are retrieved to perform multi-dimensional verification of abnormal operating condition data of associated nodes to determine whether they are abnormal associated nodes. For example, core parameters are retrieved differently according to the type of associated node: for equipment nodes, operating parameter thresholds, duration thresholds, and auxiliary node consistency verification standards are retrieved; for supply chain nodes, time deviation thresholds and resource redundancy classification standards are retrieved; and for environmental nodes, environmental parameter out-of-range thresholds and scenario impact weights are retrieved. During verification, abnormal operating condition data is compared with core parameters one by one. If all core parameters meet the abnormal judgment conditions, the node is determined to be an abnormal associated node. Starting from the abnormal associated node, within the abnormal transmission observation period set based on the characteristics of the business process, an abnormal impact chain is constructed based on the data correlation factors in the contextualized metadata.

[0081] Directly related nodes are located by data association factors, such as raw material supply nodes corresponding to abnormal production equipment, order fulfillment nodes corresponding to abnormal supply chain lines, and goods storage nodes corresponding to abnormal warehousing environments; and indirectly related nodes are located based on the data association factors of directly related nodes, and anomaly impact links are constructed according to the hierarchy of anomaly source nodes, directly related nodes, and indirectly related nodes.

[0082] Extract core information from all associated nodes within the anomaly propagation observation period of the anomaly impact link. This core information includes whether the node is an anomalous associated node, whether it contains an anomalous operating condition, and the time of occurrence of the anomalous operating condition. Based on the direction of the anomaly impact link, calculate the impact weight of each associated node within that link sequentially.

[0083] Based on whether or not a base weight coefficient is set for abnormally associated nodes, for example, among abnormally associated nodes, the base weight coefficient of core nodes is higher than that of auxiliary nodes; the base weight coefficient of non-abnormally associated nodes is generally lower than that of abnormally associated nodes, and the base weight coefficient of core nodes is slightly higher than that of auxiliary nodes, assigned sequentially according to the direction of the abnormal impact link. Here, a core node refers to an associated node that occupies a critical hub position in the business link of the target operational scenario, has a significant impact on overall operational stability, and is closely related to other nodes. An auxiliary node refers to an associated node that plays a supporting and auxiliary role in the business link of the target operational scenario, has a relatively small impact on overall operational stability, and has a limited number of associated nodes.

[0084] The operating condition influence coefficient is set based on whether abnormal operating conditions are included. For example, in abnormal associated nodes, the greater the deviation between the data and the normal reference standard of the dynamic data pool, the higher the operating condition influence coefficient, and the smaller the deviation, the lower the coefficient. If non-abnormal associated nodes include operating conditions to be confirmed, the lower value of the corresponding interval is taken according to the degree of data deviation. If there are no abnormal operating conditions, the coefficient is set to the lowest value. The calculation is performed for each node along the link direction.

[0085] The time decay coefficient is set based on the occurrence time of abnormal operating conditions: taking the occurrence time of the abnormality of the source node as the benchmark, the time difference between the occurrence time of the abnormality of subsequent nodes and the benchmark time is calculated along the link direction. The smaller the time difference, the higher the time decay coefficient. The basic weight coefficient, operating condition influence coefficient and time decay coefficient of each associated node are multiplied to obtain the influence weight of the associated node. The weight calculation of all associated nodes is completed in sequence along the abnormal influence link direction.

[0086] Preferably, the rule base for judging the status of associated nodes is hierarchically divided according to business scenario tags, associated node types, and core parameters. Core parameters refer to quantitative indicators set for various associated node types under different business scenario tags to determine whether an associated node is an abnormal associated node. These are obtained through statistical analysis of operational data under normal operating conditions, based on a benchmark dataset from a dynamic data pool. They are used to determine whether the corresponding associated node meets the judgment conditions for an abnormal associated node through core parameter comparison, logical verification, and other methods, ultimately clarifying the node's abnormal attribute. Specifically, the operational data of each node under normal operating conditions in the benchmark dataset are statistically analyzed to determine the normal range of core parameters; and critical values ​​constituting anomalies are extracted from historical anomaly cases, such as the duration threshold for triggering an anomaly if the equipment temperature exceeds the threshold by 5 minutes; consistency verification standards are determined, thereby forming the core judgment parameters for various types of nodes.

[0087] Step S3: Based on the abnormal associated nodes and abnormal impact links, and combined with the influence weights of each associated node within the abnormal impact link, target impact nodes are screened from the abnormal impact link, with a focus on core nodes directly associated with the abnormal source node. Through association rule mining, the basic transmission probability and basic diffusion duration are obtained. The basic transmission probability, node level identifier, and multi-dimensional feature vector of the entire link are concatenated and normalized to the [0,1] feature interval. This is then input into a pre-trained AI dynamic node prediction model to perform nonlinear correction, outputting the risk transmission probability and risk diffusion time to generate a risk intervention report. This serves as the basis for identifying the target impact nodes that need priority intervention and the precise intervention time for subsequent scenario-based risk interventions. For example, the AI ​​dynamic node prediction model is a lightweight three-layer fully connected neural network. The complete training process, network structure, and constraint rules of the model are as follows:

[0088] The AI ​​dynamic node prediction model employs a lightweight three-layer fully connected network structure: the input layer dimension matches the dimension of the concatenated and normalized multi-dimensional feature vector. Input features include basic propagation probability, basic diffusion duration, node-level one-hot encoding, target-affected node sensitivity coefficient, operational data deviation and change rate of abnormally associated nodes, and business connection duration between nodes. The node-level one-hot encoding refers to a discretized one-hot encoding representation of the target-affected node's hierarchical position in the abnormal impact chain. The hierarchical position includes, but is not limited to, the anomaly source node, directly associated nodes, and indirectly associated nodes. The hierarchical category features are converted into binary numerical vectors that match the neural network input dimension, enabling the model to distinguish the different characteristics of nodes at different levels in the risk propagation path. The hidden layer has 12 neurons and uses the ReLU non-linear activation function, with weights initialized using Xavier uniformity. A distributed initialization strategy is used to ensure stable gradient propagation in the early stages of training. The output layer has two independent output channels with the Sigmoid activation function, corresponding to the correction propagation probability and correction diffusion duration, respectively. The output range of the propagation probability is constrained to [0,1], and the output range of the diffusion duration is constrained to [0,Tmax]. Tmax is the maximum observation period preset for the related business scenario. Its setting is based on the statistical value of the maximum actual diffusion duration of historical risk cases in the target operation scenario and the characteristics of the business cycle: the maximum actual diffusion duration of historical risk propagation cases in the related business scenario in the historical layer of the dynamic data pool is used as the basic reference. Combined with the characteristics of the business cycle, such as the monthly cycle of the production process and the quarterly cycle of the supply chain process, the larger value between the historical maximum diffusion duration and the business cycle duration is taken as the upper limit boundary to ensure that Tmax can cover the historical extreme value situation and adapt to the actual business cycle, so as to avoid the model output from exceeding the interpretable range of the business.

[0089] Using complete historical risk transmission cases in production operations and supply chain scenarios as supervised training samples, each sample includes multi-dimensional features of the abnormal impact chain, basic transmission probability and basic diffusion duration, and real risk transmission probability and actual diffusion duration verified by backtracking based on actual operational data. The training set and validation set are split by time dimension to avoid data leakage and ensure the model's ability to generalize to future risk cases.

[0090] The Adam optimizer is used with an initial learning rate of 0.001 and a learning rate decay strategy. The mean squared error (MSE) is used as the loss function for iterative training. At the same time, the changes in the validation set loss are monitored, and an early stopping strategy is set. When the validation set loss does not decrease for 10 consecutive training cycles, training is automatically stopped and the model parameters are rolled back to the optimal parameters to prevent overfitting. After training, model pruning and weight quantization techniques are used to compress the model size, so that the AI ​​dynamic node prediction model can be deployed and run on edge computing nodes, meeting the low latency requirements of real-time risk prediction.

[0091] The output layer adds a value range constraint, locking the transmission probability output in the [0,1] range and setting the lower limit of the diffusion duration output to 0; a preset correction deviation tolerance threshold is set. If the absolute difference between the model output result and the input basic index exceeds the threshold, the backoff logic is automatically triggered, and the basic transmission probability and basic diffusion duration without AI correction are directly output, ensuring that the evaluation results are interpretable and do not deviate from the business logic.

[0092] The tolerance thresholds for correction deviations are divided into two categories: a threshold specifically for transmission probability and a threshold specifically for risk diffusion duration. Their settings are based on a comprehensive consideration of historical risk case statistics for the target operational scenario, business control tolerance requirements, and the error range of manual verification. For transmission probability, an upper limit is set based on the average error between the calculated value from traditional association rules in historical samples and the actual risk probability. For diffusion duration, threshold boundaries are defined based on the allowable risk prediction error duration in production and supply chain settings. The threshold values ​​can be flexibly configured according to different business scenarios and different levels of related nodes. For example, the tolerance threshold for transmission probability correction deviations for production equipment-related related nodes is set to 0.08, and the tolerance threshold for risk diffusion duration correction deviations is set to 30 minutes; the tolerance threshold for transmission probability correction deviations for supply chain transshipment-related related nodes is set to 0.12, and the tolerance threshold for risk diffusion duration correction deviations is set to 120 minutes.

[0093] In this embodiment, by accurately screening target impact nodes, quantifying risk transmission probability and time windows, and relying on an AI dynamic node prediction model to correct the nonlinear coupling risk relationship of nodes that cannot be fitted by traditional fixed formulas, the prediction accuracy is greatly improved. This not only provides early warning of anomaly spread compared to the traditional post-event response mode, allowing sufficient preparation time for risk intervention, but also accurately identifies nodes that need priority intervention and the timing of intervention, avoiding resource misallocation. At the same time, the clear risk transmission path and level classification output make subsequent scenario-based risk intervention more targeted, effectively reducing the business impact of anomalies on production operation and maintenance and supply chain collaboration scenarios.

[0094] Preferably, the steps for calculating the risk transmission probability include:

[0095] Extract the influence weights of all associated nodes from the abnormal influence chain. Based on the statistical values ​​of the influence weights of the abnormal influence chains in the historical layer of the dynamic data pool, set an influence weight threshold to filter the associated nodes in the abnormal influence chains of abnormal associated nodes whose influence weights are greater than the influence weight threshold, and use them as target influence nodes to reduce unnecessary monitoring objects.

[0096] For each target impact node in the anomaly impact chain, retrieve the historical transmission records of the corresponding target impact node from the historical layer of the dynamic data pool, including the transmission data from the anomaly associated node to the target impact node, extract the number of successful transmissions, the number of failed transmissions, the operational data and core features of the target impact node during transmission, and construct a historical transmission sample set;

[0097] Simultaneously, the hierarchical relationship between each target impact node and the anomaly-related node, the current operational data and core characteristics of the target impact nodes are extracted from the anomaly impact chain to construct the current node feature set;

[0098] The association rule mining algorithm is used to analyze the historical transmission sample set, and the association rules between the core features of the target influencing node and the transmission result are constructed. The transmission result includes transmission success and transmission failure. The confidence of each association rule is calculated by dividing the number of successful transmission samples in the historical transmission samples that satisfy a certain core feature combination by the total number of samples of that core feature combination, which serves as the historical transmission probability benchmark.

[0099] The core features of the current target's influencing node are matched with the core features in the historical association rules to calculate the feature matching degree. For numerical features, the difference is quantified by calculating the relative deviation rate between the current value and the mean of historical features. For state features, the similarity is determined by matching the consistency rate of state codes. Combining the matching results of numerical and state features, the historical association rule with the highest matching degree is selected as the target's historical association rule, and the confidence level corresponding to the target's historical association rule is used as the initial reference probability.

[0100] The algorithm calculates the degree of feature difference between the core features of the current target-affected node and the target's historical association rules. By setting a preset feature difference threshold and matching the corresponding difference correction coefficient, the initial reference probability is dynamically corrected to obtain the corrected probability. The feature difference threshold is a critical value used to distinguish the degree of difference between the core features of the current target-affected node and the core features of the target's historical association rules. For numerical features, it is the critical interval of the relative deviation rate, and for state features, it is the critical value of the state coding consistency rate. The threshold is set by the correlation analysis results of the degree of feature difference and the actual deviation of the propagation probability in the historical layer of the dynamic data pool. That is, based on the average deviation amplitude of the propagation probability under different feature difference intervals in historical data, the critical value that can effectively distinguish the influence of deviation is determined.

[0101] By combining the hierarchical relationship between abnormal associated nodes and target affected nodes, a hierarchical correction coefficient is set. Specifically, the coefficient for directly associated nodes is higher than that for indirectly associated nodes. Based on the historical transmission efficiency statistics of nodes at different levels, the correction probability is multiplied by the hierarchical correction coefficient to obtain the basic transmission probability.

[0102] The basic propagation probability, node hierarchy identifier, and current node multidimensional feature vector are concatenated. The node hierarchy identifier uses one-hot encoding to convert the hierarchical position of the target affected node in the anomaly impact chain into a binary vector. The current node multidimensional feature vector includes the core features of the target affected node's current operational data, operational data deviation value, operating condition code, and data correlation factor. The concatenated joint feature vector is uniformly mapped to the [0,1] interval through Min-Max normalization to eliminate the dimensional differences between different feature dimensions. The normalized joint feature vector is input into the input layer of the pre-trained AI dynamic node prediction model, and after ReLU nonlinear activation in the hidden layer, forward propagation calculation is performed. The model's two independent output paths... The system generates the original values ​​of the correction propagation probability and the correction diffusion duration, respectively. The original value of the correction propagation probability is compressed to the [0,1] interval by the output layer Sigmoid activation function. The absolute deviation between the correction propagation probability and the input base propagation probability is compared. If the absolute deviation does not exceed the preset propagation probability correction deviation tolerance threshold, the correction propagation probability is used as the final risk propagation probability. If the absolute deviation exceeds the tolerance threshold, it is determined that the model correction range exceeds the acceptable range of the business, triggering a rollback mechanism. The original base propagation probability is directly used as the final risk propagation probability. At the same time, this rollback event is recorded in the system log as feedback data for subsequent model iteration optimization, ensuring the interpretability of the output results and the consistency of business logic.

[0103] The transmission probability correction deviation tolerance threshold is divided into a two-level system: a general basic threshold and a scenario-specific threshold. The general basic threshold is determined based on the average absolute error (MAE) between the traditional association rule calculation value of all historical risk transmission cases in the historical layer of the dynamic data pool and the manually labeled true risk probability. The scenario-specific threshold is adjusted based on the general basic threshold, combined with the risk control tolerance requirements of nodes under each business scenario label and the distribution of historical correction deviation amplitude. For example, the transmission probability correction deviation tolerance threshold for production equipment-related nodes is 0.08, and the corresponding preset tolerance range is [basic transmission probability - 0.08, basic transmission probability + 0.08]; the transmission probability correction deviation tolerance threshold for supply chain transshipment-related nodes is 0.12, and the corresponding preset tolerance range is [basic transmission probability - 0.12, basic transmission probability + 0.12]. The upper and lower limits of the tolerance range are jointly determined by the statistical data of historical risk sample errors in the scenario and the fault tolerance standard for business risk management. The allowable fluctuation range is defined based on the basic transmission probability: the upper limit of the range is the tolerance threshold for the correction deviation of the transmission probability of the corresponding node plus the basic transmission probability, and the lower limit of the range is the tolerance threshold for the correction deviation of the transmission probability of the corresponding node minus the basic transmission probability. When the risk transmission probability after AI correction falls within the preset tolerance range, it indicates that the correction range is within the normal fluctuation range of historical errors, and the model output value is used as the final risk transmission probability. If the correction value is less than the lower limit of the range or greater than the upper limit of the range, it is determined that the correction range exceeds the acceptable range of business, triggering the rollback mechanism, and the original basic transmission probability is directly used as the output result.

[0104] Preferably, the risk diffusion time calculation steps include:

[0105] Starting from the time when the abnormal associated node is identified as abnormal, the operational data of the abnormal associated node and the target affected node during the anomaly propagation observation period are acquired, and risk diffusion characteristics are extracted, including: the current operational data deviation value of the abnormal associated node, the rate of change of operational data, the sensitivity coefficient of the target affected node, and the duration of business connection between nodes. Among them, the sensitivity coefficient of the target affected node refers to the responsiveness of the operational data parameters of the target affected node to changes in the operational data parameters of the abnormal associated node during the anomaly propagation observation period. It is used to quantify the sensitivity of the target affected node to the risk of the abnormal node. Specifically, it is the proportion of the change in the parameters of the target affected node when the parameters of the abnormal associated node change by a unit magnitude. During the anomaly propagation observation period, real-time operational data parameters of the abnormal associated node and the target affected node are synchronously collected from the real-time layer of the dynamic data pool. The changes in the parameters of both are extracted at the same time granularity. The ratio of the change in the parameters of the target affected node to the change in the parameters of the abnormal node is calculated. The abnormal ratio caused by temporary interference during the observation period is removed, and the average of the remaining effective ratios is obtained.

[0106] Based on the normal reference standard in the dynamic data pool, an anomaly trigger threshold is set for the target affected node. When the operational data parameters of the target affected node reach this threshold, it can be determined that it is affected by an anomaly propagation. Combining the current operational data deviation value and operational data change rate of the anomaly-related node, the base time required for the anomaly-related node to reach the anomaly trigger threshold of the target affected node is calculated. The base time is then adjusted based on the sensitivity coefficient of the target affected node: if the target affected node is more sensitive to anomaly response, the base time is shortened; if the response is slower, the base time is extended, resulting in the adjusted propagation time. Finally, the inter-node business connection time between the anomaly-related node and the target affected node is added together to obtain the base propagation time.

[0107] The basic diffusion duration, the sensitivity coefficient of the target impact node, and the real-time operational deviation features are concatenated and normalized to form the model input vector, which is then fed into the pre-trained AI dynamic node prediction model. The sensitivity coefficient of the target impact node is obtained by statistically analyzing the ratio of the linkage changes in operational parameters between the target impact node and the abnormally associated node during the anomaly propagation observation period. The real-time operational deviation features include the current operational data deviation value of the abnormally associated node, the rate of change of operational data, and the duration of business connection between nodes. The concatenated multi-dimensional input vector is then normalized using Min-Max and fed into the AI ​​dynamic node prediction model. The model learns the temporal deviation pattern between the basic diffusion duration and the actual risk diffusion time through the nonlinear mapping capability of its hidden layer, generating a corrected diffusion duration raw value from the second independent output channel. This raw value is then output... After transformation by the Sigmoid activation function, the model is mapped back to the actual time dimension through a preset duration scaling factor. The model has built-in dual duration constraint boundaries: the first constraint is a lower limit constraint, the correction result must not be lower than zero, if the correction diffusion duration is negative, it is judged as an abnormal output of the model, outputting a zero value and marking the abnormal log; the second constraint is an upper limit constraint, the correction result must not exceed the preset longest observation period Tmax of the related business scenario, if the correction diffusion duration exceeds Tmax, it is judged as exceeding the business interpretability range, triggering a rollback mechanism to directly output the original basic diffusion duration; only when the correction diffusion duration simultaneously satisfies the lower limit being greater than or equal to zero and the upper limit not exceeding Tmax, the correction diffusion duration output by the model is used as the final risk diffusion time, ensuring that the output risk diffusion time is always within the reasonable interpretable time range of the business.

[0108] Preferably, the specific steps for generating a risk intervention report include:

[0109] Collect a list of target impact nodes, the risk transmission probability and risk diffusion time of each target impact node after correction by the AI ​​dynamic node prediction model, and associate the node impact weight, the abnormal trigger threshold of the target impact node, and real-time operational data fragments during the abnormal transmission observation period with the dynamic data pool. Establish the correlation between related nodes, risk transmission probability, risk diffusion time and business links through data correlation factors in the contextualized metadata to ensure that all data can be traced back to specific business links.

[0110] Prioritize the nodes affected by the target based on their impact weight, risk transmission probability, and risk diffusion time, classify the intervention levels of the nodes affected by the target, and mark the intervention time window for each level of node, which is the reserved time from the current time until the abnormal diffusion reaches the node.

[0111] Based on the node type and business scenario characteristics, targeted intervention suggestions are given for the nodes that are affected by the target. For example, for equipment nodes, it is recommended to prioritize the investigation of core components; for supply chain nodes, it is recommended to activate backup resources; and for environmental nodes, it is recommended to adjust the control parameters to ensure that the suggestions match the risk characteristics of the nodes.

[0112] This embodiment introduces a risk intelligent intervention system based on artificial intelligence dynamic node prediction, including a data acquisition module, a working condition identification module, an abnormal link construction module, and a risk prediction module:

[0113] The data acquisition module collects operational data from each associated node in the target operational scenario and extracts historical operational data within the monitoring period to construct a dynamic data pool containing real-time operational data and a benchmark dataset. The operational condition identification module, based on the dynamic data pool, filters potential deviation data through deviation analysis and identifies the operational condition type of newly added operational data for each associated node by calculating feature vector similarity and using a data tracking mechanism. The abnormal link construction module combines the benchmark dataset from the dynamic data pool with node type characteristics to construct a rule base for judging the status of associated nodes, identifies abnormal associated nodes, and constructs an abnormal impact link based on the core information of the associated nodes. The risk prediction module filters target impact nodes based on the impact weights of each associated node within the abnormal impact link, calculates the probability of risk transmission from abnormal associated nodes to target impact nodes through association rule mining, and predicts the risk diffusion time from abnormal associated nodes to target impact nodes by observing the trend of operational data changes during the abnormal transmission observation period, generating a risk intervention report.

[0114] The data acquisition module adopts a lightweight acquisition technology system, collecting operational data in real time and binding it with scenario-based metadata to ensure that the data is accurately associated with specific business links. Differentiated cleaning is performed according to data type, and standardized processing with unified data structure and encoding eliminates differences between multi-source data. A dynamic data pool is built based on a layered architecture of real-time layer, historical layer, and correlation layer. The real-time layer stores standardized real-time data and establishes a time index. The historical layer stores a benchmark dataset containing normal and abnormal operating conditions and is partitioned according to business scenarios and operating condition types. The correlation layer establishes a mapping between the real-time layer and the historical layer through metadata. It supports dynamic updates of the benchmark dataset. When a new correlation node is added or the deviation of the data of an existing node from the normal reference standard exceeds a preset threshold, historical data within the monitoring period is automatically extracted to update the benchmark dataset, normal reference standard, and abnormal feature library, providing a structured and highly available data foundation for subsequent modules.

[0115] The operational condition identification module identifies the operational condition types of newly added operational data for each associated node through multi-dimensional data comparison and constructs a dynamically iterative status judgment rule base. For the preprocessing of the cleaned and standardized new operational data, deviation analysis is performed based on the normal reference standard of the dynamic data pool. Indicators such as mean deviation, status matching degree, and semantic similarity are calculated to filter potential deviation data that deviates from the normal range. Data that does not exceed the statistical deviation threshold is directly judged as normal operational condition. Potential deviation data, combined with the business scenario tags of the scenario-based metadata, is matched with the abnormal features of similar nodes in the abnormal feature library using feature vector similarity matching. Data exceeding the feature similarity judgment threshold is marked as an abnormal operational condition; otherwise, it is marked as an operational condition awaiting confirmation. The associated metadata of the operational condition awaiting confirmation is temporarily stored in the awaiting confirmation partition of the dynamic data pool, triggering data tracking. Data within the abnormal tracking period is collected to construct an abnormal assessment set. A comprehensive abnormal trend indicator is calculated through feature overlay analysis to achieve closed-loop processing. Simultaneously, a categorized status judgment rule base is constructed, with core parameters designed hierarchically according to business scenario tags and associated node types. These core parameters directly call the benchmark data from the dynamic data pool and automatically iterate the rule base judgment parameters and sub-logic as the data pool updates, providing a standard basis for abnormal node judgment.

[0116] The abnormal link construction module is responsible for verifying abnormal associated nodes, locating associated node hierarchies, and calculating the influence weight of nodes within the link. When the operational data of an associated node is marked as abnormal, the system automatically retrieves the node's baseline dataset from the historical layer of the dynamic data pool. Combined with the status judgment rule base of the operational condition identification module, core parameters are retrieved differentiated according to node type. The abnormal operational condition data is then verified from multiple dimensions. If all core parameters meet the abnormality judgment conditions, the node is confirmed as an abnormal associated node. Starting from the abnormal associated node, within the abnormal transmission observation period set based on the characteristics of the business process, the system uses data association factors from scenario-based metadata to locate directly related nodes that interact directly with the abnormal node. Then, it uses the data association factors of the directly related nodes to locate indirect related nodes, constructing an abnormal impact chain according to the abnormal source node, directly related nodes, and indirect related nodes. The system extracts the core information of all nodes within the chain during the abnormal transmission observation period and calculates the impact weight of each node sequentially: a basic weight coefficient is set based on whether the node is an abnormal node and its importance; an operational condition impact coefficient is set based on the degree of deviation between the data and the normal reference standard; and a time decay coefficient is set based on the time difference between the abnormal occurrence and that of the abnormal source node. Multiplying these three factors yields the final impact weight, providing a basis for prioritizing chain nodes in subsequent risk prediction.

[0117] The risk prediction module combines the influence weights of each node within the abnormal influence chain. Based on the statistical values ​​of the influence weights of abnormal chains in the historical layer of the dynamic data pool, a threshold is set, and nodes with influence weights greater than the threshold are selected as target influence nodes, reducing unnecessary monitoring targets. Historical transmission records of each target influence node are retrieved from the historical layer of the dynamic data pool to construct a historical transmission sample set. This set is then analyzed using an association rule mining algorithm to calculate the confidence score of the association rule between the core feature combination and the transmission result as a historical transmission probability benchmark. A basic transmission probability is obtained through similarity matching, feature difference correction, and hierarchical correction of the current target influence node's core features and historical rule features. This basic transmission probability and feature vector are fed into a pre-trained AI dynamic node prediction model for correction. If the probability exceeds the tolerance range, the basic transmission probability is used again to obtain the final risk prediction result. Risk propagation probability; starting from the time when the abnormal associated node is identified as abnormal, the operational data of the abnormal node and the target affected node during the abnormal propagation observation period are obtained, and risk diffusion characteristics are extracted. Based on the normal reference standard of the dynamic data pool, the abnormal trigger threshold of the target affected node is set, and the base time for the abnormal node parameters to reach the threshold is calculated. After correction by the sensitivity coefficient of the target affected node, the business connection time between nodes is superimposed to obtain the base diffusion time. This is fed into the same AI dynamic node prediction model for correction and boundary constraints are executed to obtain the risk diffusion time. Finally, the target affected node list, the risk propagation probability after AI correction, and the risk diffusion time are integrated to generate a structured risk intervention report, ensuring that all data can be traced back to specific business links, and clarifying the priority intervention nodes and precise intervention time for subsequent scenario-based risk intervention.

[0118] Working principle and its effects:

[0119] This invention aims to address issues such as poor data adaptability, inaccurate anomaly identification, and lack of risk prediction in traditional risk management. It collects real-time and historical operational data from related nodes, binds them with contextualized metadata including node identifiers and business tags, and after differentiated cleaning and standardization, constructs a dynamically updatable data pool. When a new node is added or the data deviation of existing nodes exceeds a threshold, the baseline dataset and reference standard are automatically updated. This eliminates the problem of chaotic formats from multiple data sources and ensures that the data reference aligns with the current operational patterns of the nodes, providing a high-quality data foundation for subsequent analysis and avoiding the analytical lag caused by traditional fixed references.

[0120] Building upon this foundation, and relying on the reference standards and anomaly feature library of the dynamic data pool, potential deviation data is screened through deviation analysis. Feature vector similarity matching distinguishes between abnormal and pending conditions. A data tracking mechanism then verifies uncertain conditions in a closed loop. Simultaneously, a status judgment rule library updated with the data pool is constructed, significantly improving the accuracy of condition identification and reducing false positives and false negatives. Subsequently, starting with abnormal nodes, direct and indirect related nodes are located through data association factors, constructing an anomaly impact chain. Influence weights are calculated based on node attributes, condition status, and anomaly time, clearly outlining the risk diffusion path and addressing the pain point of traditional technologies' inability to define risk transmission relationships. Finally, target impact nodes are screened based on the weights of the chain nodes. Basic calculation results are obtained through association rule mining. After nonlinear correction by a pre-trained AI dynamic node prediction model, the risk transmission probability and diffusion time are obtained, generating a risk intelligent intervention report with marked intervention priorities and time windows. This clarifies priority intervention nodes and optimal timing, avoiding blind resource investment.

[0121] In summary, this invention enables coordinated action across all stages, transforming the traditional passive response model from post-event remediation to pre-event prediction, significantly improving the accuracy and timeliness of risk management in operational scenarios, and ensuring stable operation in scenarios such as production maintenance and supply chain collaboration.

[0122] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A risk intelligent intervention method based on artificial intelligence dynamic node prediction, characterized in that, include: Collect operational data from each associated node in the target operational scenario and extract historical operational data within the monitoring period to build a dynamic data pool containing real-time operational data and benchmark datasets. The dynamic data pool adopts a hierarchical storage architecture consisting of a real-time layer, a historical layer, and a correlation layer. Based on the dynamic data pool, potential deviation data is screened through deviation analysis, and the working condition type of newly added operational data of each associated node is identified by calculating feature vector similarity and data tracking mechanism. A rule base for judging the status of associated nodes is constructed by combining the benchmark dataset and node type characteristics to identify abnormal associated nodes, and an abnormal impact link is constructed by combining the core information of associated nodes. Based on the influence weights of each associated node in the anomaly impact chain, target impact nodes are screened, and the basic transmission probability is obtained through association rule mining. Based on the current operational data deviation value of the anomaly associated node, the rate of change of operational data, the sensitivity coefficient of the target impact node, and the business connection time between nodes, the basic diffusion time of the anomaly from the anomaly associated node to the target impact node is obtained. The basic transmission probability and the basic diffusion time are input into the pre-trained AI dynamic node prediction model to perform nonlinear correction, output the risk transmission probability and risk diffusion time, and generate a risk intervention report. The steps for identifying the operational status type of newly added operational data for each associated node include: Extract the core features of the newly added operational data and calculate the statistical deviation index between the newly added operational data and the normal reference standard. Configure the statistical deviation threshold for each statistical deviation index. If the statistical deviation index of the newly added operational data exceeds the corresponding statistical deviation threshold, the newly added operational data is determined to be potential deviation data. Otherwise, the operating condition type of the newly added operational data is determined to be normal operating condition. The core features of the potential deviation data are compared with the abnormal features of the same related nodes in the abnormal feature library to calculate the feature vector similarity. A feature similarity judgment threshold is configured. When the similarity between the potential deviation data and the abnormal feature is greater than the feature similarity judgment threshold, it is judged as a valid match and the working condition type of the newly added operation data is marked as an abnormal working condition; otherwise, it is judged as an invalid match and the working condition type of the newly added operation data is marked as a working condition to be confirmed. For newly added operational data marked as pending confirmation, its contextualized metadata is associated and stored in the pending confirmation partition of the dynamic data pool. At the same time, a data tracking mechanism is triggered to continuously collect operational data within the anomaly tracking period of the associated node and construct an anomaly assessment set. For the operational data in the anomaly assessment set, feature overlay analysis is performed according to data type. Based on the consistency and changing trend of the anomaly characteristics of the operational data, anomaly trend sub-indicators are calculated respectively. The comprehensive anomaly trend index value of the newly added operational data of the working condition to be confirmed is calculated by weighted summation. Configure a comprehensive anomaly threshold. If the comprehensive anomaly trend index value of the newly added operational data of the working condition to be confirmed is greater than the comprehensive anomaly threshold, then extract the core features of the newly added operational data of the working condition to be confirmed and the data in the anomaly assessment set, add the associated node identifier and business scenario label to the anomaly feature library, and update the working condition type of the newly added operational data to an abnormal working condition; otherwise, correct the working condition type to a normal working condition.

2. The risk intelligent intervention method based on artificial intelligence dynamic node prediction as described in claim 1, characterized in that, The steps for constructing a dynamic data pool containing real-time operational data and a benchmark dataset include: Collect operational data from each associated node in the target operational scenario and bind it to scenario-based metadata, which includes node identifier, data collection timestamp, business scenario tag, and data association factor; Implement scenario-based data cleaning and invalid data filtering, and perform standardized processing of operational data, including unified data structure and unified data encoding format; Initialize the dynamic data pool, and extract historical operational data of each associated node within the monitoring period in batches based on node identifiers and business scenario tags in the scenario-based metadata of operational data to build a benchmark dataset. Historical operational data are categorized by operating condition type, which includes normal operating conditions and abnormal operating conditions. A normal reference standard and an abnormal feature library are constructed. When new operational data is added, the dynamic data pool is incrementally iterated, and the baseline dataset is updated based on the contextualized metadata. After the benchmark dataset is updated, the newly added operational data will be associated with the benchmark dataset, and the association link between operational data, normal reference standards, and abnormal feature library will be established through the node identifier in the contextualized metadata. A hierarchical storage architecture consisting of a real-time layer, a historical layer, and a correlation layer is adopted to store the dynamic data pool. The real-time layer is used to store real-time operational data and establishes a time index based on the data collection timestamp. The historical layer is used to store benchmark datasets and establishes a partition index based on business scenario tags and working condition types. The correlation layer is used to establish a mapping relationship between the real-time layer and the historical layer through scenario-based metadata.

3. The risk intelligent intervention method based on artificial intelligence dynamic node prediction as described in claim 2, characterized in that, The method of determining whether to trigger a baseline dataset update based on contextualized metadata includes: If the associated node of the newly added operational data is a newly added associated node, the benchmark dataset will be updated, the historical operational data of the monitoring period of the associated node will be extracted, the benchmark dataset will be added, and the normal reference standard and abnormal feature library will be updated. If the associated node of the newly added operational data is not a newly added associated node, the deviation between the newly added operational data and the normal reference standard of the associated node is calculated. If it is greater than the preset deviation threshold, the benchmark dataset is updated, the historical operational data of the monitoring period of the associated node is extracted, and the normal reference standard is updated.

4. The risk intelligent intervention method based on artificial intelligence dynamic node prediction as described in claim 1, characterized in that, The steps of identifying abnormal associated nodes and constructing the abnormal impact chain by combining the core information of the associated nodes include: When newly added operational data of an associated node is marked as abnormal, the baseline dataset corresponding to the associated node is retrieved from the historical layer of the dynamic data pool, and the core parameters of the associated node status judgment rule base are retrieved according to the business scenario tag of the associated node. This is used to perform multi-dimensional verification on the abnormal operating data of the associated node to determine whether it is an abnormal associated node. If so, starting from the abnormal associated node, during the abnormal transmission observation period, the directly associated node is located through the data association factor, and the indirect associated node is located according to the data association factor of the directly associated node. The abnormal impact link is constructed according to the hierarchy of the abnormal source node, the directly associated node and the indirect associated node. Extract the core information of all associated nodes during the observation period of abnormal transmission of the abnormal impact link. The core information includes whether it is an abnormal associated node, whether it contains abnormal operating conditions, and the time when the abnormal operating conditions occurred. The influence weight of each associated node is obtained by multiplying its basic weight coefficient, operating condition influence coefficient, and time decay coefficient based on whether a basic weight coefficient is set for the abnormal associated node, whether an abnormal operating condition is included, and the time decay coefficient is set based on the occurrence time of the abnormal operating condition.

5. The risk intelligent intervention method based on artificial intelligence dynamic node prediction as described in claim 1, characterized in that, The rule base for judging the status of associated nodes is divided into layers according to business scenario tags, associated node types, and core parameters. The core parameters refer to quantitative indicators set for various associated node types under different business scenario tags to determine whether an associated node is an abnormal associated node. Based on the benchmark dataset of the dynamic data pool, the core parameters are obtained through statistical analysis of operational data under normal working conditions and are used to determine whether the corresponding associated node meets the judgment conditions for an abnormal associated node.

6. The risk intelligent intervention method based on artificial intelligence dynamic node prediction as described in claim 1, characterized in that, The steps for calculating the risk transmission probability include: Extract the influence weights of all associated nodes from the abnormal influence chain, set an influence weight threshold, and use the associated nodes in the abnormal influence chain of the abnormal associated node whose influence weight is greater than the influence weight threshold as the target influence node; For each target impact node in the abnormal impact chain, retrieve the historical transmission records of the corresponding target impact node from the historical layer of the dynamic data pool, extract the number of successful transmissions, the number of failed transmissions, the operational data and core features of the target impact node during transmission, and construct a historical transmission sample set; Extract the hierarchical relationship between each target impact node and the anomaly-related node, the current operational data and core characteristics of the target impact node from the anomaly impact chain, and construct the current node feature set; Construct association rules between the core features of the target influence node and the transmission results, wherein the transmission results include transmission success and transmission failure, and calculate the confidence of each association rule as a historical transmission probability benchmark; Calculate the feature matching degree between the core features of the current target's affected nodes and the core features in the historical association rules. Select the association rule as the target's historical association rule based on the feature matching degree, and use the confidence level corresponding to the target's historical association rule as the initial reference probability. Calculate the feature difference degree between the current target's influencing node and the core features corresponding to the target's historical association rules. By setting a preset feature difference threshold, match the corresponding difference correction coefficient to dynamically correct the initial reference probability and obtain the corrected probability. Then, set a hierarchical correction coefficient and multiply the corrected probability by the hierarchical correction coefficient to obtain the basic transmission probability. The risk transmission probability is obtained by correcting the basic transmission probability through a pre-trained AI dynamic node prediction model.

7. The risk intelligent intervention method based on artificial intelligence dynamic node prediction as described in claim 1, characterized in that, The steps for calculating the risk diffusion time include: Starting from the time when the abnormal associated node is identified as abnormal, the operational data of the abnormal associated node and the target affected node during the abnormal propagation observation period are obtained, and risk diffusion characteristics are extracted, including: the deviation value of the current operational data of the abnormal associated node, the rate of change of operational data, the sensitivity coefficient of the target affected node, and the duration of business connection between nodes; Set an anomaly trigger threshold for the target affected node. Combine the current operational data deviation value and operational data change rate of the anomaly-related node to calculate the basic time required for the anomaly-related node to reach the anomaly trigger threshold of the target affected node. Correct the basic time according to the sensitivity coefficient of the target affected node to obtain the propagation time. Then, add the business connection time between the anomaly-related node and the target affected node to obtain the basic diffusion time of the anomaly from the anomaly-related node to the target affected node. Finally, correct the time by using a pre-trained AI dynamic node prediction model to obtain the risk diffusion time.

8. A risk intelligent intervention system based on artificial intelligence dynamic node prediction, implemented based on the risk intelligent intervention method based on artificial intelligence dynamic node prediction as described in any one of claims 1-7, characterized in that, It includes a data acquisition module, a working condition identification module, an anomaly link construction module, and a risk prediction module: The data acquisition module is used to collect operational data from each associated node in the target operational scenario and extract historical operational data within the monitoring period to construct a dynamic data pool containing real-time operational data and a benchmark dataset. The operational condition identification module, based on the dynamic data pool, filters potential deviation data through deviation analysis and identifies the operational condition type of newly added operational data for each associated node by calculating feature vector similarity and using a data tracking mechanism. The abnormal link construction module is used to construct a rule base for judging the status of associated nodes by combining the benchmark dataset and node type characteristics, identify abnormal associated nodes, and construct an abnormal impact link by combining the core information of the associated nodes. The risk prediction module is used to filter target impact nodes based on the impact weights of each associated node within the abnormal impact link, obtain the basic transmission probability through association rule mining, and obtain the basic diffusion time from the abnormal associated node to the target impact node based on the current operational data deviation value of the abnormal associated node, the rate of change of operational data, the sensitivity coefficient of the target impact node, and the business connection time between nodes. The basic transmission probability and basic diffusion time are input into a pre-trained AI dynamic node prediction model to perform nonlinear correction, outputting the risk transmission probability and risk diffusion time, and generating a risk intervention report.

Images