A business operation risk early warning method, system, device and medium

Abstract

The application discloses an enterprise operation risk early warning method, system, device and medium, and belongs to the technical field of enterprise operation monitoring. The method is: obtaining first operation characteristic data of an enterprise in a current operation period, calculating distribution change data thereof; if a preset concept drift determination condition is met, determining a drift type and linking to update a time series prediction model, an anomaly detection submodel and a risk assessment submodel; inputting the first operation characteristic data into the updated time series prediction model to perform historical time series characteristic extraction and attention weighting fusion to obtain a prediction result, and inputting the prediction result into the anomaly detection submodel to perform reconstruction error calculation and isolation degree analysis to obtain an anomaly detection result; and inputting the prediction result, the first operation characteristic data and the anomaly detection result into the risk assessment submodel to obtain an enterprise operation risk early warning result. Therefore, by implementing the application, the problem of insufficient accuracy of enterprise operation risk early warning in the prior art can be solved.

Description

Technical Field

[0001] This application relates to the field of enterprise operation monitoring technology, and in particular to an enterprise operation risk early warning method, system, device and medium. Background Technology

[0002] As enterprises deepen their digital transformation, the scale of their operational data and the complexity of their business are growing rapidly, while market fluctuations are becoming increasingly frequent. Operational risks are characterized by their high degree of concealment and rapid transmission; failure to promptly detect potential anomalies and provide accurate early warnings often leads to significant economic losses. Therefore, establishing a precise early warning mechanism for enterprise operational risks is of great practical significance for ensuring the stable operation of enterprises.

[0003] Existing technologies primarily rely on single predictive models to simply extrapolate future operational trends, and use fixed thresholds or empirical rules for anomaly detection and risk assessment. Because enterprise operational data exhibits significant time-series dependence and non-linear characteristics, single models struggle to effectively extract key historical time-series features, leading to substantial prediction bias. Furthermore, existing anomaly detection methods typically employ single algorithms, which lack the ability to represent complex operational patterns, resulting in missed detections or false alarms. In addition, the prediction, detection, and assessment stages are independent of each other, with asynchronous model parameter updates at each stage. This prevents the effective integration of prediction biases and anomaly detection results, causing risk assessment results to deviate from actual operational conditions, ultimately leading to insufficient accuracy in enterprise operational risk warnings. Summary of the Invention

[0004] This application provides a method, system, device, and medium for early warning of enterprise operational risks, which can solve the problem of insufficient accuracy in early warning of enterprise operational risks in the prior art.

[0005] Some embodiments of this application provide a method for early warning of enterprise operational risks, including: Obtain the first operational characteristic data of the enterprise during the current operating period, and calculate the distribution change data of the first operational characteristic data; If the distribution change data meets the preset enterprise operating environment concept drift judgment conditions, then the drift type of the concept drift is determined according to the distribution change data, and the pre-constructed risk warning model is updated according to the drift type to obtain the target risk warning model; the target risk warning model includes: an operational time series prediction sub-model, an anomaly detection sub-model and a risk assessment sub-model; The first operational feature data is input into the operational time series prediction sub-model. The operational time series prediction sub-model extracts historical time series features and performs attention-weighted fusion on the first operational feature data to obtain the operational time series prediction result. The first operational feature data is input into the anomaly detection sub-model, and the anomaly detection sub-model is used to perform reconstruction error calculation and isolation degree analysis on the first operational feature data to obtain the anomaly detection result. Based on the operational time-series prediction results, the first operational characteristic data, and the anomaly detection results, the enterprise operational risk warning results are obtained through the risk assessment sub-model.

[0006] Compared with existing technologies, the above embodiments have the following beneficial effects: In existing technologies, operational time-series forecasting typically uses a single model to simply extrapolate historical data, which is difficult to effectively capture the feature correlations of key time nodes, resulting in large prediction biases; anomaly detection often relies on a single algorithm, which is insufficient in covering complex operational patterns, easily leading to missed detections or false alarms; in addition, the prediction, detection, and evaluation models are maintained independently, and when the operational environment changes, the updates of each model are not synchronized, resulting in contradictory warning results. This application integrates historical time-series features through attention weighting, enabling the model to dynamically focus on information from key historical moments according to the current prediction task; it identifies anomalies from two dimensions—pattern deviation and distribution isolation—by combining reconstruction error and isolation degree analysis; when concept drift is detected, the prediction, detection, and evaluation models are updated in a coordinated manner according to the drift type, enabling the models at each stage to adapt collaboratively to the new operational environment, thereby helping to improve the accuracy of enterprise operational risk warnings.

[0007] Further, the calculation of the distribution change data of the first operational characteristic data, if the distribution change data meets the preset enterprise operating environment concept drift determination condition, includes: Obtain the second operational feature data from the previous operational period, calculate the KL divergence of the first operational feature data relative to the second operational feature data, and the JS divergence between the first operational feature data and the second operational feature data; The KL divergence and the JS divergence are weighted and fused to obtain the distribution change data; The distribution change data is compared with a preset drift threshold. If the distribution change data is greater than the preset drift threshold, it is determined that the enterprise operating environment concept drift determination condition is met.

[0008] Compared with existing technologies, the above embodiments have the following beneficial effects: In concept drift detection, a single divergence measure often has limitations. KL divergence can reflect the directional difference between two distributions, but due to its asymmetry, it may produce biased judgments when used alone; JS divergence, as a symmetry improvement, can reflect bidirectional differences in a balanced way, but its sensitivity to subtle distribution changes is relatively low. This application weights and fuses KL divergence and JS divergence, which retains the sensitivity of KL divergence to capturing the direction of distribution differences, and uses the symmetry of JS divergence to balance the influence of unidirectional bias. The joint measurement of the two can more comprehensively characterize the degree of distribution change between the current operating period and the previous operating period, reduce the drift omissions or misjudgments caused by a single measurement method, and thus improve the reliability of concept drift determination.

[0009] Furthermore, the drift types include: gradual drift and abrupt drift; the step of updating the pre-built risk warning model according to the drift type to obtain the target risk warning model includes: If the drift type is a gradual drift, then based on the first operational feature data, an incremental update strategy is used to update each sub-model in the risk warning model respectively; If the drift type is a sudden drift, then based on the first operational feature data, the initial operational time series prediction sub-model and the initial anomaly detection sub-model in the risk warning model are updated respectively using a transfer learning strategy to obtain the operational time series prediction sub-model and the anomaly detection sub-model. Then, according to the output distribution of the operational time series prediction sub-model and the anomaly detection sub-model, the initial risk assessment sub-model in the risk warning model is updated to obtain the risk assessment sub-model.

[0010] Compared to existing technologies, the above embodiments have the following beneficial effects: The operating environment is subject to diverse changes. Gradual drift manifests as a slow migration of data distribution; drastic update strategies can easily lead to catastrophic forgetting of historical knowledge by the model. Abrupt drift, on the other hand, manifests as a rapid change in data distribution; fine-tuning strategies alone are insufficient to quickly adapt to the new environment. This application employs an incremental update strategy for gradual drift, progressively adjusting the parameters of the prediction, detection, and evaluation models based on current operating data, ensuring a smooth transition while maintaining the model's historical understanding. For abrupt drift, a transfer learning strategy is employed, rapidly retraining or fine-tuning the parameters of the prediction and detection models, and synchronously adjusting the risk assessment sub-model according to the updated output distribution. This differentiated update strategy can meet the adaptation needs of different drift characteristics, reduce performance fluctuations during model updates, and ensure the early warning system maintains good adaptability under various environmental change scenarios.

[0011] Further, determining the drift type of the concept drift based on the distribution change data includes: Monitor the changing trend of the distribution data over multiple consecutive operating periods; If the distribution change data shows a continuous upward trend over multiple consecutive operating periods, then the drift type is determined to be a gradual drift. If the increase in the distribution change data during the current operating period exceeds a preset mutation threshold, then the drift type is determined to be a mutation drift.

[0012] Compared to existing technologies, the above embodiments have the following beneficial effects: the determination of concept drift directly affects the selection of subsequent model update strategies. If gradual drift is misjudged as abrupt drift, it will lead to unnecessary drastic model updates, disrupting learned historical patterns; if abrupt drift is misjudged as gradual drift, the model will respond to rapid changes with small-step fine-tuning, resulting in adaptation lag. This application, by monitoring the changing trend of distribution change data over multiple consecutive operating periods, determines distribution changes showing a continuous upward trend over multiple consecutive periods as gradual drift, and determines distribution changes with an increase exceeding a preset abrupt threshold in the current operating period as abrupt drift. This trend-based classification method can distinguish between slow migration and rapid changes in the operating environment, avoiding misjudgments caused by data fluctuations at a single moment, and providing a reliable basis for the accurate selection of subsequent model update strategies.

[0013] Further, the step of extracting historical time-series features and performing attention-weighted fusion on the first operational feature data through the operational time-series prediction sub-model to obtain the operational time-series prediction result includes: Time period features are extracted from the first operational feature data to obtain time period features; Lag features are constructed from the first operational feature data to obtain lag features; Rolling statistical features are calculated on the first operational feature data to obtain rolling statistical features; The time period feature, the lag feature, and the rolling statistical feature are fused with the first operational feature data to obtain an enhanced operational feature sequence. The enhanced operational feature sequence is input into the operational time series prediction sub-model, and historical time series features are extracted through the operational time series prediction sub-model. The historical time series features are fused with attention weighting to obtain the operational time series prediction result.

[0014] Compared to existing technologies, the above embodiments have the following beneficial effects: Enterprise operational data often contains multi-dimensional and multi-frequency time-series information. When the original features are directly input into the prediction model, the prediction accuracy is easily limited due to insufficient feature representation or the submergence of key information. Before inputting the data into the prediction model, this application performs time-period feature extraction, lag feature construction, and rolling statistical feature calculation on the operational feature data, supplementing the representational ability of the original features from three dimensions: time periodicity, historical dependence, and statistical volatility. The enhanced feature sequence is then input into the prediction model, and historical time-series features are weighted and fused through an attention mechanism, enabling the model to dynamically allocate weights to different historical moments according to the current prediction task, focusing on information at key time steps. This combination of feature enhancement and attention weighting helps alleviate the problem of key information dilution in long-series prediction and improves the accuracy of operational time-series prediction.

[0015] Further, the anomaly detection sub-model includes: an encoder and a decoder; the step of inputting the first operational feature data into the anomaly detection sub-model, and performing reconstruction error calculation and isolation degree analysis on the first operational feature data through the anomaly detection sub-model to obtain the anomaly detection result includes: The first operational feature data is input into the encoder, and the encoder performs latent feature extraction on the first operational feature data to obtain a latent feature representation. The latent feature representation is input into the decoder, and the decoder reconstructs the latent feature representation to obtain the reconstructed output; Calculate the reconstruction error between the first operational feature data and the reconstruction output; The isolated forest anomaly score of the first operational feature data is calculated using the isolated forest algorithm. The anomaly detection result is determined by weighted fusion of the reconstruction error and the isolated forest anomaly score.

[0016] Compared to existing technologies, the above embodiments have the following advantages: Single anomaly detection methods often have their own applicable boundaries in practical applications. Detection methods based on reconstruction error learn normal operating patterns and are sensitive to samples deviating from the normal pattern, but have limited ability to distinguish anomalies near the normal pattern boundary. Detection methods based on isolation degree measure the degree of isolation of samples in the feature space and are effective in identifying sparsely distributed anomalies, but lack the ability to capture pattern-deviation anomalies. This application utilizes an encoder-decoder structure to calculate reconstruction error and identify overall deviations from the operating pattern; simultaneously, it uses the isolated forest algorithm to calculate anomaly scores and identify isolated points in the data distribution; the two detection results are combined to determine the anomaly judgment result. The two methods, based on different principles, complement each other, helping to reduce the false negative rate and false positive rate of single detection methods and improve the reliability of anomaly detection.

[0017] Further, the first operational characteristic data includes: resource allocation data; through the risk assessment sub-model, based on the operational time-series prediction results, the first operational characteristic data, and the anomaly detection results, an enterprise operational risk warning result is obtained, including: The operational time-series prediction results are compared with preset operational indicators to obtain operational performance deviation indicators; Based on the resource configuration data and the anomaly detection results, determine the resource configuration anomaly indicators; The operational performance deviation indicators and the resource allocation anomaly indicators are normalized to obtain their respective standardized risk scores. The standardized risk scores are then weighted and merged to obtain a comprehensive risk score. The comprehensive risk score is compared with a preset early warning threshold, and the enterprise operation risk early warning result is determined based on the comparison result.

[0018] Compared to existing technologies, the above embodiments have the following beneficial effects: Enterprise operational risks involve multiple dimensions, and assessments based on a single dimension often fail to fully reflect the actual risk situation. If assessments are based solely on prediction deviations, structural anomalies at the resource allocation level may be overlooked; if assessments are based solely on anomaly detection results, the degree of operational performance achievement may be insufficient. This application compares operational time-series prediction results with preset operational indicators to obtain operational performance deviation indicators, reflecting the achievement of operational goals; it combines resource allocation data with anomaly detection results to determine resource allocation anomaly indicators, reflecting the health status of resource utilization; and it normalizes and weights the multi-dimensional risk indicators to obtain a comprehensive risk score. This comprehensive assessment method, based on both performance deviation and resource allocation anomaly dimensions, avoids the one-sidedness of single-indicator assessments, enabling the comprehensive risk score to more comprehensively reflect the actual risk situation of enterprise operations.

[0019] Another embodiment of this application provides an enterprise operation risk early warning system, which is used to implement the steps of the enterprise operation risk early warning method of this application.

[0020] Another embodiment of this application also provides a terminal device, including: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the steps of the enterprise operation risk warning method of this application.

[0021] Another embodiment of this application also provides a computer-readable storage medium item, including: a stored computer program, which, when the computer program is running, controls the device where the computer-readable storage medium is located to perform the steps of the enterprise operation risk warning method of this application. Attached Figure Description

[0022] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating a method for early warning of enterprise operational risks provided in some embodiments of this application; Figure 2 This is a comparison chart of operational status prediction and early warning provided in some embodiments of this application; Figure 3 This is a prediction error distribution histogram provided in some embodiments of this application; Figure 4 This is an anomaly detection result and early warning probability analysis diagram provided in some embodiments of this application; Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0026] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0027] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0028] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0029] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0030] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0031] Existing technologies primarily rely on single predictive models to simply extrapolate future operational trends, and use fixed thresholds or empirical rules for anomaly detection and risk assessment. Because enterprise operational data exhibits significant time-series dependence and non-linear characteristics, single models struggle to effectively extract key historical time-series features, leading to substantial prediction bias. Furthermore, existing anomaly detection methods typically employ single algorithms, which lack the ability to represent complex operational patterns, resulting in missed detections or false alarms. In addition, the prediction, detection, and assessment stages are independent of each other, with asynchronous model parameter updates at each stage. This prevents the effective integration of prediction biases and anomaly detection results, causing risk assessment results to deviate from actual operational conditions, ultimately leading to insufficient accuracy in enterprise operational risk warnings.

[0032] Please refer to Figure 1 To address the issue of insufficient accuracy in early warning of enterprise operational risks in existing technologies, this application provides an early warning method for enterprise operational risks, comprising the following steps S101 to S105: S101: Obtain the first operational characteristic data of the enterprise during the current operating period, calculate the distribution change data of the first operational characteristic data, and if the distribution change data meets the preset enterprise operating environment concept drift determination conditions, determine the drift type of the concept drift based on the distribution change data.

[0033] Furthermore, in some embodiments of this application, the first operational characteristic data includes: resource allocation data, process execution data, and external environment data. The resource allocation data covers human resource allocation information, equipment operating status information, and cash flow information; the process execution data includes order fulfillment rate, task delay rate, process node timeout rate, and production plan execution progress; the external environment data includes external market price volatility, supplier delivery delay rate, and customer order change rate. In addition, the first operational characteristic data may also include operational performance-related data, such as production efficiency, product quality pass rate, cost deviation rate, inventory turnover rate, and procurement cycle.

[0034] Preferably, in some embodiments of this application, the first operational feature data is extracted and obtained through the following process: real-time collection of multi-source heterogeneous data of the enterprise through a unified data access gateway, wherein, for financial data, procurement data and human resource data generated by the Enterprise Resource Planning (ERP) system, it is read from the Oracle database through direct connection via Java Database Connectivity (JDBC); for real-time monitoring data generated by production equipment and production progress data and quality inspection records generated by the Manufacturing Execution System (MES), it is obtained by subscribing to the message queue of the Apache Kafka distributed stream processing platform; for external market data, supplier delivery data and customer order change information, it is obtained by calling a third-party Representational State Transfer Application Programming Interface (RESTful API). The collected raw data undergoes a data preprocessing pipeline, which removes duplicate records and standardizes the time format. For example, different formats such as "2024 / 01 / 15", "2024-01-15", and "20240115" are unified into the standard format "2024-01-15 00:00:00". For numerical indicators such as production efficiency and equipment utilization, if missing data occurs, linear interpolation between the preceding and following time points is used to fill in the gaps. For categorical data such as equipment status and order type, the most frequently occurring category is used for filling. Outliers exceeding the normal range are identified and marked using the three-standard-deviation principle. Indicators of different dimensions are uniformly mapped to standard intervals for standardization. The processed data is stored in a data lake based on the Hadoop Distributed File System (HDFS), partitioned according to the directory structure of data source, year, month, and day, and uses the columnar storage format Parquet to improve query efficiency. The data lake is divided into a raw data area, a processed data area, and a service data area. The processed data area stores the data after the above preprocessing, and the service data area provides a structured query language (SQL) query interface to the outside world through Hive. After the above preprocessing, the first operational characteristic data containing resource configuration data, process execution data, and external environment data is obtained.

[0035] Furthermore, in some embodiments of this application, the calculation of the distribution change data of the first operational characteristic data, if the distribution change data satisfies a preset enterprise operating environment concept drift determination condition, includes: Obtain the second operational feature data from the previous operational period, calculate the KL divergence of the first operational feature data relative to the second operational feature data, and the JS divergence between the first operational feature data and the second operational feature data; The KL divergence and the JS divergence are weighted and fused to obtain the distribution change data; The distribution change data is compared with a preset drift threshold. If the distribution change data is greater than the preset drift threshold, it is determined that the enterprise operating environment concept drift determination condition is met.

[0036] Preferably, in some embodiments of this application, the step of calculating the distribution change data of the first operational feature data, if the distribution change data meets the preset enterprise operating environment concept drift judgment condition, includes: obtaining the second operational feature data of the previous operating period, wherein the second operational feature data is obtained by performing the same preprocessing on the enterprise operating data of the previous operating period as the first operational feature data, i.e., sequentially performing cleaning and denoising, missing value completion, outlier identification, and dimensional standardization; using the first operational feature data as detection window data and the second operational feature data as reference window data, wherein the reference window data is taken from a historical stable period and the detection window data is taken from the current operating period; calculating the Kullback-Leibler divergence (KL divergence) of the first operational feature data relative to the second operational feature data, wherein the KL divergence measures the distribution difference of the detection window data relative to the reference window data; and calculating the Jensen-Shannon divergence between the first operational feature data and the second operational feature data. (JS divergence), whereby the JS divergence is used to symmetrically measure the distribution distance between the detection window data and the reference window data by constructing the average distribution of the two data. The KL divergence and the JS divergence are weighted and fused. Specifically, the KL divergence and the JS divergence are summed to obtain a comprehensive drift index, which is used as the distribution change data. The distribution change data is compared with a preset drift threshold. If the distribution change data is greater than the preset drift threshold, it is determined that the enterprise operating environment concept drift judgment condition is met.

[0037] Preferably, in some embodiments of this application, the formula for calculating the KL divergence is: ; in, Let KL divergence be a metric. This indicates the feature distribution corresponding to the latest operational data within the detection window; This indicates the feature distribution corresponding to historical stable operation data within the reference window; This represents the operational characteristic values ​​or discretized intervals used to calculate distribution differences; This represents the probability that a feature in the detection window takes the value x. This represents the probability that the feature in the reference window takes the value x.

[0038] Preferably, in some embodiments of this application, the formula for calculating the JS divergence is: ; ; in, This represents the JS divergence between the detection window distribution and the historical reference distribution. Indicates by and The average distribution constitutes the composition.

[0039] Preferably, in some embodiments of this application, the formula for weighted fusion of the KL divergence and the JS divergence is as follows: ; in, This represents the overall drift metric, used to measure the degree of change in the distribution of the current operating environment relative to historically stable operating environments. When... The larger the value, the more significant the difference between the current operational data distribution and the historical stable distribution.

[0040] In concept drift detection, single divergence measures often have limitations. KL divergence can reflect the directional difference between two distributions, but due to its asymmetry, it may lead to biased judgments when used alone. JS divergence, as a symmetric improvement, can reflect bidirectional differences in a balanced way, but its sensitivity to subtle distribution changes is relatively low. This application weightedly fuses KL divergence and JS divergence, retaining KL divergence's ability to sensitively capture the direction of distribution differences while utilizing the symmetry of JS divergence to balance the impact of unidirectional bias. The combined measurement of both measures can more comprehensively characterize the degree of distribution change between the current operating period and the previous operating period, reducing drift omissions or misjudgments caused by single measurement methods, thereby improving the reliability of concept drift determination.

[0041] Furthermore, in some embodiments of this application, the drift type includes: gradual drift and abrupt drift.

[0042] Furthermore, in some embodiments of this application, determining the drift type of the concept drift based on the distribution change data includes: Monitor the changing trend of the distribution data over multiple consecutive operating periods; If the distribution change data shows a continuous upward trend over multiple consecutive operating periods, then the drift type is determined to be a gradual drift. If the increase in the distribution change data during the current operating period exceeds a preset mutation threshold, then the drift type is determined to be a mutation drift.

[0043] Preferably, in some embodiments of this application, the process of determining the drift type is as follows: setting a preset drift threshold. ,when Concept drift is determined to occur at that time. Drift type identification is based on... Judging the trend of change: Gradual drift is manifested as Slow growth, showing an upward trend over five consecutive testing windows (one operating period represents one testing window); abrupt drift is characterized by... A sudden and significant increase, with a single increase exceeding 0.1.

[0044] The determination of concept drift directly affects the selection of subsequent model update strategies. Misjudging gradual drift as abrupt drift leads to unnecessary drastic model updates, disrupting learned historical patterns. Conversely, misjudging abrupt drift as gradual drift causes the model to respond to rapid changes with small, incremental adjustments, resulting in adaptation lag. This application monitors the changing trends of distribution data over multiple consecutive operating periods, classifying distribution changes showing a continuous upward trend over these periods as gradual drift and distribution changes with an increase exceeding a preset abrupt threshold within the current operating period as abrupt drift. This trend-based classification method distinguishes between slow migrations and rapid changes in the operating environment, avoiding misjudgments caused by data fluctuations at a single moment, and providing a reliable basis for the accurate selection of subsequent model update strategies.

[0045] S102: Update the pre-built risk warning model according to the drift type to obtain the target risk warning model; the target risk warning model includes: an operational time series prediction sub-model, an anomaly detection sub-model and a risk assessment sub-model.

[0046] Furthermore, in some embodiments of this application, updating the pre-built risk warning model according to the drift type to obtain the target risk warning model includes: If the drift type is a gradual drift, then based on the first operational characteristic data, an incremental update strategy is used to update each sub-model in the risk warning model respectively.

[0047] Preferably, in some embodiments of this application, the update strategies for the operation time series prediction sub-model, the anomaly detection sub-model, and the risk assessment sub-model are selected based on the drift type. For incremental drift, gradient descent incremental updates are used: ; in, For learning rate, For a new dataset, each update uses the most recent 500 samples. and These are the model parameters obtained from the t-th and t+1-th updates. This is the gradient calculation function.

[0048] If the drift type is a sudden drift, then based on the first operational feature data, the initial operational time series prediction sub-model and the initial anomaly detection sub-model in the risk warning model are updated respectively using a transfer learning strategy to obtain the operational time series prediction sub-model and the anomaly detection sub-model. Then, according to the output distribution of the operational time series prediction sub-model and the anomaly detection sub-model, the initial risk assessment sub-model in the risk warning model is updated to obtain the risk assessment sub-model.

[0049] Preferably, in some embodiments of this application, for abrupt drift, a transfer learning strategy is adopted to freeze the first L-2 layers of the pre-trained model and fine-tune only the last 2 layers: ; in This is a regularization coefficient to prevent the model parameters from deviating too far. For the updated parameters, For pre-trained parameters, The task loss is due to the new data.

[0050] The changing operating environment is diverse. Gradual drift manifests as a slow migration of data distribution; drastic update strategies can easily lead to catastrophic forgetting of historical knowledge by the model. Abrupt drift, on the other hand, manifests as a sharp change in data distribution; fine-tuning strategies alone are insufficient to quickly adapt to the new environment. This application employs an incremental update strategy for gradual drift, progressively adjusting the parameters of the prediction, detection, and evaluation models based on current operational data, ensuring a smooth transition while maintaining the model's historical understanding. For abrupt drift, a transfer learning strategy is employed, rapidly retraining or fine-tuning the parameters of the prediction and detection models, and simultaneously adjusting the risk assessment sub-model based on the updated output distribution. This differentiated update strategy can match the adaptation needs of different drift characteristics, reduce performance fluctuations during model updates, and ensure the early warning system maintains good adaptability under various environmental change scenarios.

[0051] S103: Input the first operational feature data into the operational time series prediction sub-model, and use the operational time series prediction sub-model to extract historical time series features and perform attention-weighted fusion on the first operational feature data to obtain the operational time series prediction result.

[0052] Furthermore, in some embodiments of this application, the step of extracting historical time-series features and performing attention-weighted fusion on the first operational feature data through the operational time-series prediction sub-model to obtain the operational time-series prediction result includes: Time period features are extracted from the first operational feature data to obtain time period features; Lag features are constructed from the first operational feature data to obtain lag features; Rolling statistical features are calculated on the first operational feature data to obtain rolling statistical features; The time period feature, the lag feature, and the rolling statistical feature are fused with the first operational feature data to obtain an enhanced operational feature sequence. The enhanced operational feature sequence is input into the operational time series prediction sub-model, and historical time series features are extracted through the operational time series prediction sub-model. The historical time series features are fused with attention weighting to obtain the operational time series prediction result.

[0053] Preferably, in some embodiments of this application, before feature extraction from the first operational feature data, the data in the first operational feature data are first time-aligned to form a multidimensional operational feature sequence arranged in chronological order. ,in This represents the feature vector of the enterprise's operational status at time t.

[0054] To enable the model to utilize both short-term fluctuations and long-term trends, the system employs a sliding window approach to construct the model input samples. Specifically, the historical input window length is set to 128 time steps, and the prediction window length is 24 time steps; for any prediction time t, the operational characteristic sequence of the preceding 128 time steps is selected. As input to the model, the target operational metrics corresponding to the next 24 time steps are used. As the model output label, the target operational indicator can be the enterprise's overall operational index, or it can be one or more core operational indicators such as production efficiency, equipment utilization rate, and order fulfillment rate.

[0055] Before inputting the operational time-series forecasting sub-model into the hybrid forecasting model, the input sequence is... Feature enhancement processing is performed. This feature enhancement includes: extracting time-period features such as year, month, day, week, and hour; constructing lagged features from t-1, t-2 to tn; and calculating statistical features such as 7-day moving average, 30-day moving average, rolling standard deviation, month-on-month change rate, and year-on-year change rate. The feature-enhanced input sequence forms an operational feature sequence, which is mapped to the model input matrix. Where L is the input window length and d is the feature dimension at each time step. The dataset is divided into training, validation, and test sets in a 7:1.5:1.5 ratio, with a batch size of 32.

[0056] Preferably, in some embodiments of this application, the operational time-series prediction sub-model is a Transformer-LSTM hybrid prediction model, wherein the Transformer encoder uses sine and cosine position encoding: ; ; in, For location index, For dimensional indexing, Set to 256. The multi-head self-attention mechanism is set to have h=8 heads, and the dimension of each head is... The query, key, and value matrix is ​​obtained through linear transformation: ; in, This represents the query matrix, used to characterize the query requirements of the current time step for operational status information of other time steps; The key matrix represents the feature representations that can be matched at each time step. The value matrix represents the operational status information of each time step that actually participates in the weighted convergence. This represents the operational feature matrix input to the Transformer encoder after feature enhancement; , and These represent the trainable weight matrices corresponding to the query matrix, key matrix, and value matrix, respectively. This indicates the number of attention heads in a multi-head self-attention mechanism; This indicates the dimensions of the query matrix and key matrix in a single attention head.

[0057] Attention weights are calculated using scaled dot products: ; The Transformer encoder has six stacked layers, each containing a multi-head attention sublayer and a feedforward neural network sublayer, employing residual connections and layer normalization. for The transpose of the matrix. The feedforward neural network has a dimension of 1024 and uses the ReLU activation function.

[0058] The LSTM network is designed as a two-layer bidirectional structure, with 128 hidden units in each layer. The hidden state update of LSTM follows the formula: How much historical information is retained by the forget gate control? ; The input gate controls how much new information it receives: ; Candidate values ​​are used to calculate the candidate state at the current time: ; Cell state update fusion history and new information: ; Output gates control how much information is output: ; The hidden state output is used for subsequent calculations: ; in, Indicates the current time step; This represents the operational feature vector input to the LSTM network at time t; This represents the hidden state output from the previous time step; This represents the combined vector obtained by concatenating the hidden state of the previous time step with the current input feature vector; This represents the output of the forget gate, used to control the cell state at the previous time step. The proportion of information that needs to be retained in the document; This represents the input gate output, used to control the proportion of new information that needs to be written into the cell state in the current candidate state; This indicates the state of candidate cells at the current time step; It represents the cell state at the current time step and is used to store long-term temporal memory information; This indicates the output of the output gate, used to control the proportion of information from the current cell state that participates in the output of the hidden state. This represents the hidden state output at the current time step, which is used to pass it to the next time step and for subsequent attention weighting layer calculations. , , , These represent the trainable weight matrices corresponding to the forget gate, input gate, candidate cell state, and output gate, respectively. , , , These represent the bias terms corresponding to the forget gate, input gate, candidate cell state, and output gate, respectively. This represents the sigmoid activation function; Represents the hyperbolic tangent activation function; This represents element-wise multiplication. In a bidirectional LSTM, the forward hidden state... Used to characterize the forward operational state evolution information from the historical time step to the current time step, backward hidden state This is used to represent the reverse context dependency information within the current window; the two are concatenated to obtain the final hidden state. .

[0059] The attention-weighted mechanism calculates the importance of the hidden states at each time step. The attention weights are calculated as follows: ; ; in, represents the attention score corresponding to the t-th time step, used to measure the importance of the hidden state at that time step to the final prediction result; v represents the trainable projection vector in the attention mechanism; This indicates the action applied to the hidden state of the LSTM. The trainable weight matrix; This represents the hidden state vector output by the LSTM at time step t. represents the trainable weight matrix acting on the query vector s; s represents the query vector in the attention calculation, used to characterize the current prediction task's query requirement for historical time step information; This represents the time step index in the attention normalization computation. This represents the attention weight corresponding to the t-th time step, which is determined by the attention score. It is calculated by exponential normalization, and the sum of attention weights at each time step is 1; exp(·) represents the exponential function; c represents the context vector obtained by weighting and summing the hidden states at each time step according to the attention weights, which is used to gather key historical operational status information related to the prediction task; This represents the trainable weight matrix of the output layer; This represents the output layer bias term. Where s is the query vector. This represents the hidden state of the LSTM at each time step. The context vector is... The final predicted output is .

[0060] The operational time-series prediction sub-model is trained using the Huber loss function, which is robust to outliers. The optimizer is AdamW, with an initial learning rate of 0.001, using cosine annealing for 20 epochs. The weight decay coefficient is set to 0.0001. The program was trained for 100 epochs with early stopping and a patience level of 10. To prevent gradient explosion, the maximum norm of gradient clipping was set to 1.0. Dropout was set to 0.2 to prevent overfitting.

[0061] Enterprise operational data often contains multi-dimensional and multi-frequency time-series information. When raw features are directly input into the prediction model, the prediction accuracy is easily limited due to insufficient feature representation or the submergence of key information. This application extracts time-period features, constructs lagged features, and calculates rolling statistical features from the operational feature data before inputting them into the prediction model. This supplements the representational power of the raw features from three dimensions: time periodicity, historical dependence, and statistical volatility. The enhanced feature sequence is then input into the prediction model, and historical time-series features are weighted and fused through an attention mechanism. This allows the model to dynamically allocate weights to different historical moments according to the current prediction task, focusing on information at key time steps. This combination of feature enhancement and attention weighting helps alleviate the problem of key information dilution in long-series prediction and improves the accuracy of operational time-series prediction.

[0062] S104: Input the first operational feature data into the anomaly detection sub-model, and use the anomaly detection sub-model to perform reconstruction error calculation and isolation degree analysis on the first operational feature data to obtain the anomaly detection result.

[0063] Further, in some embodiments of this application, the anomaly detection sub-model includes: an encoder and a decoder; the step of inputting the first operational feature data into the anomaly detection sub-model, and performing reconstruction error calculation and isolation degree analysis on the first operational feature data through the anomaly detection sub-model to obtain anomaly detection results includes: The first operational feature data is input into the encoder, and the encoder performs latent feature extraction on the first operational feature data to obtain a latent feature representation. The latent feature representation is input into the decoder, and the decoder reconstructs the latent feature representation to obtain the reconstructed output; Calculate the reconstruction error between the first operational feature data and the reconstruction output; The isolated forest anomaly score of the first operational feature data is calculated using the isolated forest algorithm. The anomaly detection result is determined by weighted fusion of the reconstruction error and the isolated forest anomaly score.

[0064] Preferably, in some embodiments of this application, the encoder is a variational autoencoder (VAE). The encoder network input is 128-dimensional first operational feature data x, which passes through two hidden layers (256 and 128 neurons, ReLU activated), and outputs a 32-dimensional mean. Sum of logarithmic variance Through reparameterization techniques Sampling yields latent representations The decoder network will Restore to reconstructed output The network structure is symmetrical with the encoder. This results in an anomaly detection result consisting of a first operational feature data x as input, latent representation z extracted by the encoder, reconstructed output x̂ generated by the decoder, reconstruction error between input x and reconstructed output x̂ calculated, and anomaly score from an isolated forest combined with the anomaly score, anomaly determination result, and anomaly type.

[0065] Preferably, in some embodiments of this application, the loss function of the VAE comprises two parts: the reconstruction loss measures the reconstruction quality and uses binary cross-entropy. ; KL divergence loss ensures that the latent distribution approximates the prior distribution: ; The total loss of VAE is , These are the KL divergence weighting coefficients. Anomaly scoring is calculated based on reconstruction error; a larger reconstruction error indicates a greater anomaly. ,in, Represents the reconstruction loss of VAE, used to measure the difference between the input first operational feature data x and the reconstructed output x̂; This indicates the feature dimension of the first operational feature data input; This represents the k-th feature value of the first operational feature data x. This represents the k-th eigenvalue of the reconstructed output x̂; This represents the KL divergence loss, used to constrain the distribution of latent variables to approximate a standard normal prior distribution; This represents the j-th component of the latent distribution mean vector μ; σ represents the j-th component of the latent distribution standard deviation vector σ; β represents the weighting coefficient of the KL divergence loss; This represents the total loss of the VAE model; This represents the VAE anomaly score obtained based on the reconstruction error. The larger the value, the greater the deviation of the current operating status from the normal operating mode.

[0066] Preferably, in some embodiments of this application, the Isolation Forest algorithm detects anomalies by constructing a set of isolated trees. The algorithm randomly selects features and split points, making it easier to isolate anomalies and thus shortening their path length. The number of trees is set to 100, and the subsampling size is 256. For sample x, its average path length across all trees is calculated. The normalized path length is: ; in, This represents the isolated forest anomaly score of sample x in a subset containing n samples; x represents the operational status sample to be detected; and n represents the number of isolated forest subsamples. This represents the path length of sample x in a single isolation tree; This represents the average path length of sample x across all isolated trees; This represents the normalization coefficient for the average path length of a binary search tree containing n samples. For harmonic number estimation, For the first The harmonic series of the term. (Score) A value close to 1 indicates an abnormality, while a value close to 0 indicates a normal condition.

[0067] Preferably, in some embodiments of this application, determining the anomaly detection result by weighted fusion of the reconstruction error and the isolated forest anomaly score includes: ; ; in, The dynamic weight parameter represents the fusion of VAE anomaly detection results and isolated forest anomaly detection results, and is used to determine the F1 scores of the two algorithms on the validation set. This represents the F1 score of the variational autoencoder on the validation set; This represents the F1 score of the Isolation Forest algorithm on the validation set. The value of is determined by the detection performance of the two anomaly detection algorithms on the validation set. When the F1 score of VAE is higher, the weight of the VAE anomaly score in the fusion result increases accordingly; when the F1 score of the Isolation Forest algorithm is higher, the weight of the Isolation Forest anomaly score in the fusion result increases accordingly. This represents the final anomaly score after fusion; This represents the normalized VAE anomaly score, used to characterize the degree of deviation of the input operational state from the normal operational mode. The anomaly score, representing the difficulty of isolating a sample within the isolation tree set, is the final anomaly score. The larger the value, the higher the likelihood that the current operational status is judged to be abnormal.

[0068] Preferably, in some embodiments of this application, the anomaly determination threshold is determined using the quantile method, taking the 95th percentile of historical scores. When the final score exceeds the threshold, it is determined to be an anomaly, and the anomaly is classified into point anomaly, contextual anomaly, or collective anomaly based on temporal characteristics.

[0069] Single anomaly detection methods often have their own limitations in practical applications. Detection methods based on reconstruction error learn normal operating patterns and are sensitive to samples deviating from these patterns, but their ability to distinguish anomalies near the boundaries of normal patterns is limited. Detection methods based on isolation degree measure the degree of isolation of samples in the feature space and are effective at identifying sparsely distributed anomalies, but their ability to capture pattern-deviation anomalies is insufficient. This application utilizes an encoder-decoder structure to calculate reconstruction error and identify overall deviations from operating patterns; simultaneously, it uses the isolated forest algorithm to calculate anomaly scores and identify isolated points in the data distribution; the anomaly determination is then determined by combining the two detection results. These two methods, based on different principles, complement each other, helping to reduce the false negative and false positive rates of single detection methods and improve the reliability of anomaly detection.

[0070] S105: Based on the operational time-series prediction results, the first operational characteristic data, and the anomaly detection results, the enterprise operational risk warning results are obtained through the risk assessment sub-model.

[0071] Furthermore, in some embodiments of this application, the enterprise operation risk warning result is obtained through the risk assessment sub-model based on the operation time series prediction result, the first operation characteristic data, and the anomaly detection result, including: The operational time-series prediction results are compared with preset operational indicators to obtain operational performance deviation indicators; Based on the resource configuration data and the anomaly detection results, determine the resource configuration anomaly indicators; The operational performance deviation indicators and the resource allocation anomaly indicators are normalized to obtain their respective standardized risk scores. The standardized risk scores are then weighted and merged to obtain a comprehensive risk score. The comprehensive risk score is compared with a preset early warning threshold, and the enterprise operation risk early warning result is determined based on the comparison result.

[0072] Preferably, in some embodiments of this application, the enterprise operation risk warning result is obtained through the risk assessment sub-model based on the operation time series prediction result, the first operation characteristic data, and the anomaly detection result, including: The operational timeline prediction results are compared with preset operational indicators to obtain operational performance deviation indicators. Specifically, the preset operational indicators include target values ​​for production efficiency, product quality pass rate, cost control budget, and inventory turnover. The operational performance deviation indicators are calculated from the relative deviations between the actual operational indicator values ​​and the corresponding preset operational indicators. For example, the production efficiency deviation is determined by the relative deviation between the actual production efficiency and the production efficiency target value; the product quality deviation is determined by the relative deviation between the actual quality pass rate and the target quality pass rate; and the cost control deviation is determined by the relative deviation between the actual cost and the cost control budget value.

[0073] Based on the resource allocation data and the anomaly detection results, anomaly indicators for resource allocation are determined. Specifically, the resource allocation data includes human resource allocation information, equipment operating status information, and capital flow information. The resource allocation data and the anomaly detection results are fused and analyzed. When the anomaly score in the anomaly detection results exceeds the anomaly judgment threshold and the resource utilization rate in the resource allocation data deviates from the normal range, an anomaly in resource allocation is determined. For example, anomalies in human resource allocation are determined by a combination of employee attendance rate and anomaly score; anomalies in equipment resource allocation are determined by a combination of equipment utilization rate and anomaly score; and anomalies in capital resource allocation are determined by a combination of capital turnover rate and anomaly score.

[0074] The operational performance deviation indicators and the resource allocation anomaly indicators are normalized to obtain their respective standardized risk scores. Specifically, for positive risk indicators, the maximum value standardization method is used to map the indicator values ​​to the [0,1] interval; for negative risk indicators, the minimum value standardization method is used to map the indicator values ​​to the [0,1] interval. The larger the mapped indicator value, the higher the corresponding risk level.

[0075] The standardized risk scores are weighted and fused to obtain a comprehensive risk score. Specifically, based on the historical importance of each level of risk indicator and the expert evaluation results, the weight coefficients corresponding to each level of risk indicator are determined. The standardized risk scores are then weighted and summed based on these weight coefficients to obtain the comprehensive risk score.

[0076] The comprehensive risk score is compared with preset warning thresholds, and the enterprise's operational risk warning result is determined based on the comparison result. Specifically, a red warning is triggered when the comprehensive risk score is greater than a first preset threshold; an orange warning is triggered when the comprehensive risk score is greater than a second preset threshold and less than or equal to the first preset threshold; a yellow warning is triggered when the comprehensive risk score is greater than a third preset threshold and less than or equal to the second preset threshold; and a blue warning is triggered when the comprehensive risk score is greater than a fourth preset threshold and less than or equal to the third preset threshold.

[0077] Preferably, in some embodiments of this application, before the weighted fusion of the standardized risk scores, the method further includes: determining the weights of each level of risk indicator using the analytic hierarchy process (AHP). Specifically, a judgment matrix is ​​constructed by combining expert scores and historical data; the relative importance of each indicator is determined using the 1-9 scaling method; the eigenvector corresponding to the largest eigenvalue of the judgment matrix is ​​solved; after normalization, the weight vector is obtained; and a consistency index and consistency ratio are calculated to verify the rationality of the weight allocation. When the consistency ratio is less than 0.1, the weight allocation is considered to have satisfactory consistency.

[0078] Preferably, in some embodiments of this application, the weighted fusion of the standardized risk scores includes: using a fuzzy comprehensive evaluation method to handle the uncertainty in risk assessment. A fuzzy evaluation set is established, comprising five evaluation levels: extremely low, relatively low, medium, relatively high, and extremely high. A trapezoidal membership function is used to calculate the membership degree of each indicator to different evaluation levels, resulting in a fuzzy evaluation matrix. A fuzzy synthesis operator is then used for step-by-step comprehensive evaluation to obtain the comprehensive evaluation value of each level of risk indicator, which serves as the standardized risk score.

[0079] Preferably, in some embodiments of this application, the formula for calculating the comprehensive risk score is: ; in, This indicates the overall risk score; Indicates the sequence number of the primary risk indicator; This indicates the number of primary risk indicators; This represents the weight of the i-th primary risk indicator; This indicates the number of secondary risk indicators under the i-th primary risk indicator; j represents the sequence number of the secondary risk indicator. This represents the weight of the j-th secondary risk indicator under the i-th primary risk indicator; This represents the standardized risk score of the j-th secondary risk indicator under the i-th primary risk indicator.

[0080] Preferably, in some embodiments of this application, the preset early warning threshold adopts a dynamic adjustment mechanism. Based on historical early warning results, the preset early warning threshold is dynamically adjusted by multiplying the adjustment step size by the difference between the false alarm rate and the target false alarm rate. The early warning information includes early warning level, risk score, risk source analysis, future predicted trends, and recommended measures.

[0081] Enterprise operational risks involve multiple dimensions, and assessments based on a single dimension often fail to fully reflect the actual risk situation. Assessments based solely on prediction deviations may overlook structural anomalies at the resource allocation level; assessments based solely on anomaly detection results may fail to measure the degree of operational performance achievement. This application compares operational time-series prediction results with preset operational indicators to obtain operational performance deviation indicators, reflecting the achievement of operational goals; it combines resource allocation data with anomaly detection results to determine resource allocation anomaly indicators, reflecting the health of resource utilization; and it normalizes and weights these multi-dimensional risk indicators to obtain a comprehensive risk score. This comprehensive assessment approach, considering both performance deviations and resource allocation anomalies, avoids the one-sidedness of single-indicator assessments, enabling the comprehensive risk score to more fully reflect the actual risk situation of enterprise operations.

[0082] For further details, please refer to... Figures 2 to 4 To verify the effectiveness of the method proposed in this application, a large manufacturing enterprise was used as an example for actual deployment testing. This enterprise has an annual output value of over 5 billion yuan and involves multiple business areas such as auto parts, electronic equipment, and precision machinery. The system has been running for 18 months.

[0083] like Figure 2 As shown in the comparison chart of operational trend prediction and early warning, the solid line represents the actual trend of operational indicators, the dashed line represents the prediction result of the operational time-series prediction sub-model of this application, and the diamond mark represents the early warning point triggered by the system. It can be seen that the prediction curve has a high degree of consistency with the actual operational trend. Before significant fluctuations in operational indicators occur, the system can mark the early warning position in advance, with an average early warning time of 72 hours, which provides sufficient response time for enterprise management.

[0084] like Figure 3 As shown, the histogram of prediction error distribution exhibits an approximately normal distribution, with errors concentrated around zero. During the testing period, the Mean Absolute Percentage Error (MAPE) was 7.68%, the Symmetric Mean Absolute Percentage Error (sMAPE) was 7.59%, and the Root Mean Square Error (RMSE) was 0.0802, indicating that the prediction bias was controlled within a small range.

[0085] like Figure 4As shown in the figure, the anomaly detection results and early warning probability analysis chart demonstrates the correspondence between anomaly detection output and risk warning levels. During the test, the anomaly detection module successfully detected 156 operational anomalies, including equipment failure warnings, supply chain disruption risks, quality anomaly warnings, personnel turnover risk warnings, and financial anomaly alerts. The anomaly detection accuracy reached 98.36%, the recall rate reached 92.31%, the F1 score was 0.9524, and the AUC-ROC index was 0.9981. The chart shows that samples with higher anomaly scores correspond to higher early warning probabilities. The system can accurately trigger risk warnings of corresponding levels based on the fusion output of anomaly detection results and operational time-series prediction results.

[0086] comprehensive Figures 2 to 4 The test results show that the method in this application has achieved the expected results in terms of time series prediction accuracy, anomaly detection reliability and early warning timeliness, with an early warning accuracy rate of 99.39%, which can effectively support the needs of enterprise operation risk management.

[0087] In summary, the enterprise operation risk early warning method provided in this application has the following advantages compared with the prior art: In the prior art, operation time series prediction usually uses a single model to simply extrapolate historical data, which is difficult to effectively capture the feature correlation of key time nodes, resulting in large prediction deviations; anomaly detection mostly relies on a single algorithm, which is insufficient in covering complex operation modes and is prone to missed detections or false alarms; in addition, the prediction, detection and evaluation models are maintained independently, and when the operation environment changes, the updates of each model are not synchronized, resulting in contradictory early warning results. This application integrates historical time series features through attention weighting, enabling the model to dynamically focus on information of key historical moments according to the current prediction task; it identifies anomalies from two dimensions, pattern deviation and distribution isolation, by combining reconstruction error and isolation degree analysis; when concept drift is detected, the prediction, detection and evaluation models are updated in a coordinated manner according to the drift type, so that the models of each link can adapt to the new operation environment in a coordinated manner, thereby helping to improve the accuracy of enterprise operation risk early warning.

[0088] Based on the above-described method embodiments, one embodiment of this application provides an enterprise operation risk early warning system, which can implement the enterprise operation risk early warning method provided in any of the above-described method embodiments of this application.

[0089] Based on the above-described embodiments of the enterprise operation risk warning method, another embodiment of this application provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the enterprise operation risk warning method of any embodiment of this application.

[0090] For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete this application. The one or more module units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.

[0091] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0092] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0093] Based on the above-described method embodiments, another embodiment of this application provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the enterprise operation risk warning method described in any of the above-described method embodiments of this application.

[0094] The modules / units integrated in the device / terminal equipment, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above-described embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, an electrical signal, and a software distribution medium, etc.

Claims

1. A method for early warning of enterprise operational risks, characterized in that, include: Obtain the first operational characteristic data of the enterprise during the current operating period, calculate the distribution change data of the first operational characteristic data, and if the distribution change data meets the preset enterprise operating environment concept drift judgment condition, then determine the drift type of the concept drift based on the distribution change data. The pre-built risk warning model is updated based on the drift type to obtain the target risk warning model; The target risk early warning model includes: an operational time series prediction sub-model, an anomaly detection sub-model, and a risk assessment sub-model; The first operational feature data is input into the operational time series prediction sub-model. The operational time series prediction sub-model extracts historical time series features and performs attention-weighted fusion on the first operational feature data to obtain the operational time series prediction result. The first operational feature data is input into the anomaly detection sub-model, and the anomaly detection sub-model is used to perform reconstruction error calculation and isolation degree analysis on the first operational feature data to obtain the anomaly detection result. By integrating the operational time-series prediction results, the first operational characteristic data, and the anomaly detection results through the risk assessment sub-model, an early warning result for enterprise operational risks is obtained.

2. The enterprise operation risk early warning method as described in claim 1, characterized in that, The calculation of the distribution change data of the first operational characteristic data, if the distribution change data meets the preset enterprise operating environment concept drift determination condition, includes: Obtain the second operational feature data from the previous operational period, calculate the KL divergence of the first operational feature data relative to the second operational feature data, and the JS divergence between the first operational feature data and the second operational feature data; The KL divergence and the JS divergence are weighted and fused to obtain the distribution change data; The distribution change data is compared with a preset drift threshold. If the distribution change data is greater than the preset drift threshold, it is determined that the enterprise operating environment concept drift determination condition is met.

3. The enterprise operation risk early warning method as described in claim 1, characterized in that, The drift types include: gradual drift and abrupt drift; the updating of the pre-built risk warning model according to the drift type to obtain the target risk warning model includes: If the drift type is a gradual drift, then based on the first operational feature data, an incremental update strategy is used to update each sub-model in the risk warning model respectively; If the drift type is a sudden drift, then based on the first operational feature data, the initial operational time series prediction sub-model and the initial anomaly detection sub-model in the risk warning model are updated respectively using a transfer learning strategy to obtain the operational time series prediction sub-model and the anomaly detection sub-model. Then, according to the output distribution of the operational time series prediction sub-model and the anomaly detection sub-model, the initial risk assessment sub-model in the risk warning model is updated to obtain the risk assessment sub-model.

4. The enterprise operation risk early warning method as described in claim 3, characterized in that, Determining the drift type of the concept drift based on the distribution change data includes: Monitor the changing trend of the distribution data over multiple consecutive operating periods; If the distribution change data shows a continuous upward trend over multiple consecutive operating periods, then the drift type is determined to be a gradual drift. If the increase in the distribution change data during the current operating period exceeds a preset mutation threshold, then the drift type is determined to be a mutation drift.

5. The enterprise operation risk early warning method as described in claim 1, characterized in that, The step of extracting historical time-series features and performing attention-weighted fusion on the first operational feature data through the operational time-series prediction sub-model to obtain the operational time-series prediction result includes: Time period features are extracted from the first operational feature data to obtain time period features; Lag features are constructed from the first operational feature data to obtain lag features; Rolling statistical features are calculated on the first operational feature data to obtain rolling statistical features; The time period feature, the lag feature, and the rolling statistical feature are fused with the first operational feature data to obtain an enhanced operational feature sequence. The enhanced operational feature sequence is input into the operational time series prediction sub-model, and historical time series features are extracted through the operational time series prediction sub-model. The historical time series features are fused with attention weighting to obtain the operational time series prediction result.

6. The enterprise operation risk early warning method as described in claim 1, characterized in that, The anomaly detection sub-model includes an encoder and a decoder; the step of inputting the first operational feature data into the anomaly detection sub-model, and performing reconstruction error calculation and isolation degree analysis on the first operational feature data through the anomaly detection sub-model to obtain anomaly detection results includes: The first operational feature data is input into the encoder, and the encoder performs latent feature extraction on the first operational feature data to obtain a latent feature representation. The latent feature representation is input into the decoder, and the decoder reconstructs the latent feature representation to obtain the reconstructed output; Calculate the reconstruction error between the first operational feature data and the reconstruction output; The isolated forest anomaly score of the first operational feature data is calculated using the isolated forest algorithm. The anomaly detection result is determined by weighted fusion of the reconstruction error and the isolated forest anomaly score.

7. The enterprise operation risk early warning method as described in claim 1, characterized in that, The first operational characteristic data includes: resource allocation data; by fusing the operational time-series prediction results, the first operational characteristic data, and the anomaly detection results through the risk assessment sub-model, an enterprise operational risk warning result is obtained, including: The operational time-series prediction results are compared with preset operational indicators to obtain operational performance deviation indicators; Based on the resource configuration data and the anomaly detection results, determine the resource configuration anomaly indicators; The operational performance deviation indicators and the resource allocation anomaly indicators are normalized to obtain their respective standardized risk scores. The standardized risk scores are then weighted and merged to obtain a comprehensive risk score. The comprehensive risk score is compared with a preset early warning threshold, and the enterprise operation risk early warning result is determined based on the comparison result.

8. A business operation risk early warning system, characterized in that, The enterprise operation risk early warning system is used to implement an enterprise operation risk early warning method as described in any one of claims 1 to 7.

9. A terminal device, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements a method for early warning of enterprise operational risks as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform an enterprise operation risk early warning method as described in any one of claims 1 to 7.

Images