A multi-domain asset risk dynamic assessment method and system

Abstract

The application provides a kind of multi-domain asset risk dynamic evaluation method and system, by quantifying the characterization of multi-domain heterogeneous risk data, generate uniform format multi-dimensional asset feature vector, realize global asset risk integration comparable evaluation, solve the problem of inconsistent evaluation caliber in independent evaluation of sub-domain, filter core features by variance contribution rate through principal component dimension reduction, eliminate redundant noise, while retaining key risk information, compress feature dimension, reduce model training and inference algorithm power overhead, adapt to large-scale asset concurrent evaluation, build multi-heterogeneous base model and carry out scene-based hyperparameter optimization, play the complementary advantages of algorithm fitting, make the model parameters fit the actual risk distribution of assets, improve the evaluation accuracy and generalization ability, reduce the misjudgment rate of high-risk risk, based on weighted integrated model real-time output risk value, timely capture risk changes, support rapid early warning disposal, and ensure the stable operation of core business.

Description

Technical Field

[0001] This invention relates to the field of industrial information security technology, and in particular to a method and system for dynamic assessment of multi-domain asset risks. Background Technology

[0002] As the digital transformation of the tobacco industry deepens, core assets such as cigarette manufacturing production lines, intelligent cigarette making and packaging units, automated logistics sorting systems, tobacco leaf production management platforms, monopoly supervision information systems, and marketing big data platforms have formed a complex interconnected topology. Tobacco industry assets are characterized by high business coupling, strong requirements for production continuity, and high data security levels. Once a security risk occurs, it can easily cause significant losses such as production stoppages and data leaks.

[0003] Existing asset risk assessment techniques have the following shortcomings: The static manual scoring method is mostly used, which has a long evaluation cycle and poor timeliness, and cannot adapt to the dynamic changes in asset load during the peak season of tobacco production and the peak period of monopoly inspection. The assessment did not fully consider the business dependencies and risk transmission effects between assets, and only evaluated individual assets independently, which could not accurately identify chain risks and was out of touch with the actual scenario of tobacco production across the entire chain. Summary of the Invention

[0004] This invention provides a method and system for dynamic assessment of multi-domain asset risks to address the problems mentioned in the background art.

[0005] A multi-domain asset risk dynamic assessment method includes: S1: Obtain the raw data of risk factors of the enterprise in multiple domains, and quantify the raw data of risk factors to obtain a multidimensional asset feature vector; S2: Dimensionality reduction is performed on historical risk event samples, and principal components with variance contribution rates greater than a preset threshold are selected as model input features; S3: Construct multiple basic models, optimize the hyperparameters of the basic models based on the input features of the models, and establish a weighted asset risk assessment model; S4: Based on the weighted asset risk assessment model, it evaluates the multidimensional asset feature vector and outputs the asset risk value in real time; Among them, several basic models include three basic models: decision tree, random forest, and gradient boosting decision tree.

[0006] Preferably, in step S1, the original data of the risk factors are quantitatively characterized to obtain a multidimensional asset feature vector, including: The raw data of the risk factors are preprocessed to obtain the target data of the risk factors; Asset attribute data is extracted from the target data of the risk factors, and combined with the asset attribute distribution relationship diagram, the probability of asset risk diffusion is determined as an asset importance indicator; Network-related data are extracted from the target data of the risk factors, and the characteristics of the exposure surface are statistically analyzed and quantitatively represented as asset exposure risk indicators. Vulnerability scanning data is extracted from the target data of the risk factors, and the vulnerability scanning data is quantitatively analyzed to obtain asset vulnerability indicators. Security protection data is extracted from the risk factor target data to determine the security coverage rate and obtain the security strategy coverage rate index. By standardizing asset importance indicators, asset exposure risk indicators, asset vulnerability indicators, and security strategy coverage indicators, a multidimensional asset feature vector is established.

[0007] Preferably, in step S2, the historical risk event samples are subjected to dimensionality reduction processing, and principal components with a variance contribution rate greater than a preset threshold are selected as model input features, including: Based on the multidimensional risk characteristics of historical risk event samples, an original feature matrix is ​​constructed, and the original feature matrix is ​​standardized to obtain a standard feature matrix. Calculate the covariance matrix of each dimension based on the standard feature matrix, and obtain the eigenvalues ​​of the covariance matrix and its corresponding orthogonal eigenvectors. Calculate the variance contribution rate of each eigenvalue, select the target eigenvalue with a variance contribution rate greater than a preset threshold, and the target orthogonal eigenvector corresponding to the target eigenvalue. Integrate the target orthogonal eigenvectors to obtain the transformation matrix. Based on the result of the multiplication operation between the standard feature matrix and the transformation matrix, the principal component feature matrix is ​​obtained and used as the input features of the model.

[0008] Preferably, the original feature matrix is ​​standardized to obtain a standard feature matrix, including: The initial eigenvalues ​​in the original feature matrix are standardized based on the normalization formula; Based on standardized values, a standard feature matrix is ​​constructed.

[0009] Preferably, in step S3, multiple basic models are constructed, and hyperparameter optimization of the basic models is performed based on the model input features, including: We selected three basic models: decision tree, random forest, and gradient boosting decision tree. We initialized the hyperparameters of the three basic models, used the input features of the models as the inputs of the three basic models, and used the asset risk value as the output of the three basic models. Based on the vulnerability and exposure characteristics of enterprises in the production, logistics, marketing and specialty domains, a domain feature adaptation layer with targeted processing is configured for the basic learner of the three basic models to obtain three domain adaptation models. Based on model data features, total sample size, and asset risk assessment task, a hyperparameter search space is constructed for the three domain-adapted models. The model data features are evenly divided into 5 non-overlapping subsets. Each time, 4 subsets are selected as training subsets and the remaining 1 subset is selected as validation subset. All parameter combinations are traversed in the hyperparameter search space and iterated 5 times. The average value of the 5 validation results is used as the corresponding parameter combination to obtain the performance evaluation index. The optimal combination of hyperparameters for performance evaluation is selected as the final hyperparameter configuration for the model, thus obtaining the target single model.

[0010] Preferably, it also includes: dynamically adjusting the hyperparameter search space during model training, specifically: During model training, obtain the mutual information value between the input feature dimensions and the risk labels. The feature dimensions are sorted in descending order of mutual information value. The feature characteristics of the input feature dimensions whose mutual information value is greater than the preset mutual information value are obtained from the feature dimension sort. Based on the aforementioned characteristics, the hyperparameter search space is dynamically adjusted.

[0011] Preferably, in step S3, establishing a weighted asset risk assessment model includes: The model input features are divided into multiple scenario subsets according to business domain type and asset importance, and the performance evaluation index values ​​of each scenario subset in the three target single models are obtained. The performance evaluation index values ​​of the three target single models are normalized, and the normalized values ​​are used as the basic scene weights of the scene subsets in the target single models. Based on the relationship between the scene subsets and the basic scene weights, a weight benchmark table is established. Based on the business time period attributes of the model input features, establish weight correction coefficients for the three target single models; The online weights for each target single model are determined based on the weight benchmark table and weight correction coefficients. Based on online weights, the three single-objective models—decision tree, random forest, and gradient boosting decision tree—are weighted and fused to obtain a weighted asset risk assessment model.

[0012] Preferably, in step S4, based on the weighted asset risk assessment model, the multidimensional asset feature vector is evaluated, and the asset risk value is output in real time, including: By inputting the multidimensional asset feature vector into the three objective single models in the weighted asset risk assessment model, the corresponding risk prediction values ​​are obtained; Based on the online weights of the target single model, the risk prediction values ​​are weighted and fused to obtain the asset risk value.

[0013] A multi-domain asset risk dynamic assessment system includes: The vector acquisition module is used to acquire the original data of enterprise risk factors in multiple domains, and to quantify and characterize the original data of risk factors to obtain multidimensional asset feature vectors. The historical analysis module is used to reduce the dimensionality of historical risk event samples and select principal components with a variance contribution rate greater than a preset threshold as model input features. The model building module is used to build multiple basic models, optimize the hyperparameters of the basic models based on the model input features, and establish a weighted asset risk assessment model. The multiple basic models include three basic models: decision tree, random forest, and gradient boosting decision tree. The real-time assessment module is used to evaluate multi-dimensional asset feature vectors based on a weighted asset risk assessment model and output asset risk values ​​in real time.

[0014] Compared with the prior art, the present invention has achieved the following beneficial effects: By quantitatively representing the raw data of multi-domain risk factors, heterogeneous risk data from different business domains and data sources, such as production, logistics, marketing, and specialty stores, can be transformed into multi-dimensional asset feature vectors in a unified format. This breaks down data standard barriers between different domains, enabling integrated and comparable assessment of enterprise-wide asset risks. It solves the technical problems of risk transmission blind spots and inconsistent assessment criteria in independent domain assessments. Principal component dimensionality reduction is performed on the raw risk factor data, using variance contribution rate as the selection criterion to retain core effective features while eliminating redundant information and noise interference from high-dimensional raw features. This compresses the input feature dimensions while retaining the vast majority of risk information, avoiding model overfitting caused by the curse of dimensionality and reducing the computational overhead for subsequent model training and real-time inference, thus adapting to large-scale concurrent asset assessments for enterprises. To meet performance requirements, this approach constructs multiple heterogeneous basic models and performs scenario-based hyperparameter optimization. It leverages the fitting characteristics of different algorithms to create synergy, reducing the inherent bias and variance of a single model. Simultaneously, it optimizes hyperparameters based on the distribution characteristics of input features, ensuring a high degree of match between model parameters and the actual risk distribution of enterprise assets. Compared to general fixed-parameter models, this improves risk assessment accuracy and scenario generalization ability, effectively reducing the probability of missed or false high-risk assessments. By inferring and calculating real-time updated multi-dimensional asset feature vectors based on a weighted asset risk assessment model, it achieves second-level dynamic output of asset risk values, overcoming the limitations of traditional manual periodic and static assessments. This enables timely detection of asset risk anomalies, providing real-time data support for risk warning and rapid response, and ensuring the continuous and stable operation of the enterprise's core business systems.

[0015] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in this application.

[0016] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a multi-domain asset risk dynamic assessment method in an embodiment of the present invention; Figure 2 This is a structural diagram of a multi-domain asset risk dynamic assessment system according to an embodiment of the present invention. Detailed Implementation

[0018] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0019] Example 1: This embodiment of the invention provides a method for dynamic assessment of multi-domain asset risk, such as... Figure 1 As shown, it includes: S1: Obtain the raw data of risk factors of the enterprise in multiple domains, and quantify the raw data of risk factors to obtain a multidimensional asset feature vector; S2: Dimensionality reduction is performed on historical risk event samples, and principal components with variance contribution rates greater than a preset threshold are selected as model input features; S3: Construct multiple basic models, optimize the hyperparameters of the basic models based on the input features of the models, and establish a weighted asset risk assessment model; S4: Based on the weighted asset risk assessment model, it evaluates the multidimensional asset feature vector and outputs the asset risk value in real time; Among them, several basic models include three basic models: decision tree, random forest, and gradient boosting decision tree.

[0020] In this embodiment, before evaluating the multidimensional asset feature vector based on the weighted asset risk assessment model, it is necessary to perform dimensionality reduction processing on the multidimensional asset feature vector and select the principal components with a variance contribution rate greater than a preset threshold as the model input features. The method is consistent with the method of dimensionality reduction processing of historical risk event samples in S2.

[0021] In this embodiment, the raw data of risk factors includes, for example, equipment operation logs and vulnerability scanning results collected from the cigarette production industrial control system, open ports and external service configurations collected from the logistics sorting system, business system importance levels collected from the marketing big data platform, EDR terminal online status collected from the monopoly supervision system, access policies and attack logs collected from firewalls and WAFs, and basic attribute data such as asset roles and business ownership in the asset management system.

[0022] In this embodiment, the multidimensional asset feature vector is, for example, [4.9, 1.8, 8.2, 0.95], with the four dimensions being: asset importance index 4.9 points, asset exposure risk index 1.8 points, asset vulnerability index 8.2 points, and security strategy coverage 0.95.

[0023] In this embodiment, the historical risk event sample includes asset characteristic data and a historical dataset with corresponding real risk labels, wherein the risk labels are generated by combining actual risk events, the extent of loss, and expert annotations.

[0024] The beneficial effects of the above design scheme are as follows: By quantitatively representing the original data of multi-domain risk factors, heterogeneous risk data from different business domains and data sources, such as production, logistics, marketing, and specialty stores, can be converted into multi-dimensional asset feature vectors in a unified format. This breaks down data standard barriers between different domains, enabling integrated and comparable assessment of enterprise-wide asset risks. It solves the technical problems of risk transmission blind spots and inconsistent assessment standards in independent domain assessments. By performing principal component dimensionality reduction on the original risk factor data, core effective features are retained based on variance contribution rate, while redundant information and noise interference in high-dimensional original features are eliminated. While retaining the vast majority of risk information, the input feature dimensions are compressed, avoiding the model overfitting problem caused by the curse of dimensionality and reducing the computational cost of subsequent model training and real-time inference. This makes it suitable for large-scale enterprise applications. To meet the performance requirements of concurrent asset assessment, this approach constructs multiple heterogeneous basic models and performs scenario-based hyperparameter optimization. It leverages the fitting characteristics of different algorithms to create synergy, reducing the inherent bias and variance of a single model. Simultaneously, it optimizes hyperparameters based on the distribution characteristics of input features, ensuring a high degree of match between model parameters and the actual risk distribution of enterprise assets. Compared to general fixed-parameter models, this improves risk assessment accuracy and scenario generalization ability, effectively reducing the probability of missed or false positives for high-risk assessments. By inferring and calculating real-time updated multi-dimensional asset feature vectors based on a weighted asset risk assessment model, it achieves second-level dynamic output of asset risk values, overcoming the limitations of traditional manual periodic and static assessments. This enables timely detection of asset risk anomalies, providing real-time data support for risk warning and rapid response, and ensuring the continuous and stable operation of the enterprise's core business systems.

[0025] Example 2: Based on Example 1, this embodiment of the invention provides a method for dynamic assessment of multi-domain asset risk. In step S1, the original data of the risk factors are quantitatively characterized to obtain a multi-dimensional asset feature vector, including: The raw data of the risk factors are preprocessed to obtain the target data of the risk factors; Asset attribute data is extracted from the target data of the risk factors, and combined with the asset attribute distribution relationship diagram, the probability of asset risk diffusion is determined as an asset importance indicator; Network-related data are extracted from the target data of the risk factors, and the characteristics of the exposure surface are statistically analyzed and quantitatively represented as asset exposure risk indicators. Vulnerability scanning data is extracted from the target data of the risk factors, and the vulnerability scanning data is quantitatively analyzed to obtain asset vulnerability indicators. Security protection data is extracted from the risk factor target data to determine the security coverage rate and obtain the security strategy coverage rate index. By standardizing asset importance indicators, asset exposure risk indicators, asset vulnerability indicators, and security strategy coverage indicators, a multidimensional asset feature vector is established.

[0026] In this embodiment, the original data of the risk factors is preprocessed to obtain the target data of the risk factors, for example, fields with more than 30% missing values ​​are removed, and the remaining missing values ​​are filled using the K-nearest neighbor interpolation method; outliers are identified using the box plot method, and values ​​exceeding 5 times the upper and lower quartiles are corrected to the nearest neighbor threshold to obtain the target data of the risk factors.

[0027] In this embodiment, the asset attribute data includes the importance level of the business system, the importance of the asset role, and the importance of the business affiliation, which are quantified using a 0-5 point system; at the same time, the probability of risk diffusion is incorporated, and the higher the probability of risk diffusion, the higher the weighted score of the asset importance.

[0028] In this embodiment, network-related data includes the network area where the asset is located (Internet zone, DMZ zone, enterprise intranet, production private network), the number of open ports, and the type of external services, which are quantified on a 0-5 scale to obtain the asset exposure risk index.

[0029] In this embodiment, the vulnerability scanning data includes vulnerability level (high / medium / low), vulnerability occurrence frequency, and vulnerability remediation status. A vulnerability quantification value of 0-10 is obtained by weighted calculation and used as an asset vulnerability indicator.

[0030] In this embodiment, security protection data includes, for example, EDR terminal coverage, WAF web protection coverage, and firewall access policy strictness, and a security coverage rate of 0-1 is calculated.

[0031] The beneficial effects of the above design scheme are as follows: By performing cleaning, missing value imputation, and outlier correction on the original risk factor data, target risk factor data is obtained. This effectively removes noise, missing fields, and outliers from multi-source heterogeneous original data, solving the problems of inconsistent data source formats and varying data quality across multiple business domains. This ensures the accuracy and consistency of subsequent quantitative indicators calculations across various dimensions, providing a reliable data foundation for feature vector construction. Extracting asset attribute data and combining it with asset attribute distribution diagrams to calculate risk diffusion probability, and using this as an asset importance indicator, breaks through the limitations of traditional static scoring based solely on the asset's own business level. It incorporates business dependencies and risk transmission chain effects between assets into the importance assessment dimension, accurately reflecting the chain impact of asset failures in the business chain, making asset importance assessment more aligned with actual risk transmission logic, and improving the identification accuracy of core related assets. Extracting network-related data and statistically analyzing exposure surface features for quantitative characterization allows for a refined depiction of asset network exposure at multiple network levels, adapting to scenarios with significant differences in network isolation levels across different business domains. This enables accurate differentiation between external network business systems, internal network office equipment, and production systems. By analyzing the differences in exposure risks of network devices, the granularity and accuracy of exposure dimension assessment are improved. Vulnerability scanning data is extracted and quantitatively statistically analyzed to obtain asset vulnerability indicators. This approach comprehensively quantifies asset vulnerability based on multiple dimensions, including basic vulnerability scores, risk levels, frequency of occurrence, and remediation status, rather than relying solely on single vulnerability scores. It comprehensively reflects the cumulative effect of overall asset vulnerability risks. By extracting security protection data and calculating security coverage, a security policy coverage indicator is obtained. This incorporates the protective capabilities of existing security measures into the risk characteristic system, avoiding assessment bias that only evaluates the threat side while ignoring the protection side. It objectively reflects the mitigating effect of security devices on asset risks, making the feature vector more completely reflect the actual risk status of the asset. By standardizing the four types of indicators to establish a multi-dimensional asset feature vector, interference from inconsistencies in dimensions and large differences in value ranges between different indicators can be eliminated, making each dimension of features comparable and computable. At the same time, a structured standard numerical vector is formed, which can be directly adapted to the input requirements of subsequent dimensionality reduction, model training, and real-time inference. This establishes a complete data processing link from raw data to the risk assessment model, ensuring the stability of subsequent model operations and the reliability of assessment results.

[0032] Example 3: Based on Example 1, this embodiment of the invention provides a multi-domain asset risk dynamic assessment method. In step S2, the historical risk event samples are dimensionality reduced, and principal components with a variance contribution rate greater than a preset threshold are selected as model input features, including: Based on the multidimensional risk characteristics of historical risk event samples, an original feature matrix is ​​constructed, and the original feature matrix is ​​standardized to obtain a standard feature matrix. Calculate the covariance matrix of each dimension based on the standard feature matrix, and obtain the eigenvalues ​​of the covariance matrix and its corresponding orthogonal eigenvectors. Calculate the variance contribution rate of each eigenvalue, select the target eigenvalue with a variance contribution rate greater than a preset threshold, and the target orthogonal eigenvector corresponding to the target eigenvalue. Integrate the target orthogonal eigenvectors to obtain the transformation matrix. Based on the result of the multiplication operation between the standard feature matrix and the transformation matrix, the principal component feature matrix is ​​obtained and used as the input features of the model.

[0033] In this embodiment, for example, the n-dimensional initial risk features corresponding to m historical risk event samples are spliced ​​together to construct an original feature matrix X with a size of m rows and n columns. The n-dimensional initial risk feature dimensions include all the subdivided quantitative indicators under the asset importance sub-dimension, asset exposure risk sub-dimension, asset vulnerability sub-dimension, and security protection coverage sub-dimension.

[0034] In this embodiment, the original feature matrix is ​​standardized to obtain a standard feature matrix, and the normalization formula is: ; in, This represents the normalized value of the j-th dimension feature of the i-th asset sample. This represents the value of the j-th dimension feature of the i-th asset sample in the original feature matrix. This represents the arithmetic mean of the j-th dimension feature in all historical risk event samples. This represents the sample standard deviation of the j-th dimension feature in all historical risk event samples.

[0035] In this embodiment, the calculation of the covariance matrix for each dimension based on the standard feature matrix is ​​specifically as follows: ; in, This represents the element in the j-th row and k-th column of the covariance matrix, used to characterize the covariance between the j-th and k-th features. This represents the sample mean of the j-th feature after standardization. This represents the sample mean of the standardized k-th dimension feature. The normalized value of the k-th dimension feature of the i-th asset sample is represented; the covariance matrix C is an n-order symmetric square matrix.

[0036] In this embodiment, the eigenvalues ​​of the covariance matrix and their corresponding orthogonal eigenvectors are specifically obtained by performing eigenvalue decomposition on the covariance matrix C to obtain n non-negative eigenvalues ​​and a unit orthogonal eigenvector corresponding to each eigenvalue.

[0037] In this embodiment, the variance contribution rate of each feature value is calculated as the ratio of that feature value to the sum of all n feature values. This ratio is used to characterize the proportion of the total variation information of the original features carried by the current principal component. The larger the value, the stronger the explanatory power of the principal component for the original risk feature information.

[0038] In this embodiment, the preset threshold is set to the value corresponding to 85%, that is, the variance contribution rate of the top 85% is selected according to the numerical value, the transformation matrix is ​​an n-row k-column matrix, n is the total number of dimensions of the original initial risk features, corresponding to the order of the covariance matrix C; k is the number of principal component dimensions retained after the variance contribution rate screening, and satisfies k < n.

[0039] In this embodiment, the principal component feature matrix is ​​an m-row, k-column matrix.

[0040] The beneficial effects of the above design scheme are as follows: It integrates dispersed multidimensional risk features into a unified matrix form, achieving a structured organization of multi-source heterogeneous risk features. This provides a standardized data carrier for subsequent linear algebra operations. The covariance matrix quantifies the linear correlation between the dimensions of each risk feature, accurately identifying strongly coupled redundant feature pairs. This provides a quantitative basis for subsequent redundancy removal and dimensionality reduction, ensuring that the generated principal components are completely linearly independent. This eliminates interference caused by feature redundancy at its source, providing a non-redundant feature set for subsequent risk assessment models, effectively reducing the risk of model overfitting. By using variance contribution rate as the core criterion and selecting principal components from high to low information carrying capacity, under preset threshold constraints, it retains the vast majority of risk feature information with the fewest dimensions, achieving dimensionality compression under the premise of controllable information loss, while also considering... This approach improves both the accuracy and computational efficiency of risk assessment. Simultaneously, it integrates the selected target feature vectors into a unified projection transformation matrix, forming a fixed and reusable dimensionality reduction mapping rule. This ensures consistent dimensionality reduction logic across all samples and reproducible results, providing a standardized feature preprocessing entry point for subsequent real-time asset risk assessment. Through linear projection operations of the standard feature matrix and the transformation matrix, a low-dimensional, orthogonal, and non-redundant principal component feature matrix is ​​output, directly serving as input to the risk assessment model. This reduces the dimensionality of input features, decreasing computational overhead and iteration time for model training, thus improving the efficiency of model training and incremental updates in large-scale asset scenarios. Furthermore, it eliminates the dimensionality curse caused by high-dimensional features, enhancing the generalization ability and inference stability of subsequent weighted ensemble assessment models, and ensuring the response speed and result stability of real-time risk value calculation.

[0041] Example 4: Based on Example 3, this embodiment of the invention provides a method for dynamic assessment of multi-domain asset risk, which standardizes the original feature matrix to obtain a standard feature matrix, including: The initial eigenvalues ​​in the original feature matrix are standardized based on the normalization formula; ; in, This represents the normalized value of the j-th dimension feature of the i-th asset sample. This represents the value of the j-th dimension feature of the i-th asset sample in the original feature matrix. This represents the arithmetic mean of the j-th dimension feature in all historical risk event samples. The sample standard deviation represents the j-th dimension of the feature across all historical risk events. Based on standardized values, a standard feature matrix is ​​constructed.

[0042] The beneficial effects of the above design scheme are: by standardizing each initial eigenvalue in the original feature matrix based on the normalization formula, the difference in feature dimensions is eliminated, ensuring the objectivity of covariance calculation and dimensionality reduction results, and providing a unified data benchmark for subsequent matrix operations.

[0043] Example 5: Based on Example 1, this embodiment of the invention provides a method for dynamic assessment of multi-domain asset risk. In step S3, multiple basic models are constructed, and hyperparameter optimization of the basic models is performed based on the model input features, including: We selected three basic models: decision tree, random forest, and gradient boosting decision tree. We initialized the hyperparameters of the three basic models, used the input features of the models as the inputs of the three basic models, and used the asset risk value as the output of the three basic models. Based on the vulnerability and exposure characteristics of enterprises in the production, logistics, marketing and specialty domains, a domain feature adaptation layer with targeted processing is configured for the basic learner of the three basic models to obtain three domain adaptation models. Based on model data features, total sample size, and asset risk assessment task, a hyperparameter search space is constructed for the three domain-adapted models. The model data features are evenly divided into 5 non-overlapping subsets. Each time, 4 subsets are selected as training subsets and the remaining 1 subset is selected as validation subset. All parameter combinations are traversed in the hyperparameter search space and iterated 5 times. The average value of the 5 validation results is used as the corresponding parameter combination to obtain the performance evaluation index. The optimal combination of hyperparameters for performance evaluation is selected as the final hyperparameter configuration for the model, thus obtaining the target single model.

[0044] In this embodiment, the hyperparameter initialization of the three basic models specifically involves three core parameters for the decision tree model: maximum depth, minimum number of sample splits, and minimum number of leaf node samples; three core parameters for the random forest model: number of base decision trees, maximum feature sampling ratio, and node split evaluation criteria; and four core parameters for the gradient boosting decision tree model: number of iteration rounds, learning rate, subsampling ratio, and L2 regularization coefficient.

[0045] In this embodiment, the basic learners of the three basic models are configured with targeted domain feature adaptation layers. Specifically, for the characteristics of dense vulnerability features and sparse exposure risk features of industrial control assets in the production domain, the domain adaptation layer performs feature weighting enhancement and neighborhood smoothing completion on the exposure risk dimension; for the characteristics of dense exposure risk features and sparse vulnerability features of assets in the regulatory system of the franchise domain, the domain adaptation layer performs frequency weighting and distribution calibration on the vulnerability dimension; for the mixed feature distribution of the logistics domain and the marketing domain, the domain adaptation layer performs cross-domain standardization alignment processing to ensure that each basic learner has stable feature fitting capabilities in different business domains.

[0046] In this embodiment, based on model data features, total sample size, and asset risk assessment task, a hyperparameter search space is constructed for the three domain-adapted models. Specifically, for the decision tree model, the search space is set around the tree structure complexity and splitting rules: the maximum depth is set to a discrete range of 5-20 to match the sample size of tens of thousands and avoid underfitting and overfitting; the minimum number of splitting samples and the minimum number of leaf node samples are set to a step range of 10-200 to adapt to the splitting granularity of discrete and continuous mixed features; the splitting criteria cover both Gini coefficient and information entropy to adapt to the task requirements of risk level classification. For the random forest model, the search space is set around the ensemble size and feature sampling strategy: the number of base decision trees is set to a discrete range of 50-300 to balance ensemble accuracy and inference latency; the maximum depth is set to a discrete range of 50-300 to match the sample size of tens of thousands and avoid underfitting and overfitting; the minimum number of splitting samples and the minimum number of leaf node samples are set to a step range of 10-200 to adapt to the splitting granularity of discrete and continuous mixed features; the splitting criteria cover both Gini coefficient and information entropy to adapt to the task requirements of risk level classification. The feature sampling ratio is set in a continuous step range of 0.3 to 0.8 to adapt to the dynamic differences in the proportion of discrete / continuous features under different business domains; the maximum depth and minimum sample splitting parameters are simultaneously incorporated to align with the single decision tree search space and ensure the diversity of base learners; the gradient boosting decision tree model sets the search space around iterative convergence and regularization constraints: the learning rate is set in a logarithmic interval range of 0.01 to 0.2 to adapt to the high requirements of risk assessment for fitting accuracy; the number of iterations is set in a discrete range of 50 to 300 to form a linked convergence combination with the learning rate; the subsampling ratio is set in the range of 0.6 to 1.0 to alleviate the overfitting problem caused by imbalance of high-risk samples; the L2 regularization coefficient is set in a discrete range of 0 to 10 to enhance the model's cross-scenario generalization ability.

[0047] In this embodiment, the average value of the five verification results is used as the corresponding parameter combination to obtain the performance evaluation index. The comprehensive performance evaluation index is, for example, the risk level classification F1 value.

[0048] The beneficial effects of the above design scheme are as follows: By selecting three heterogeneous algorithms—decision tree, random forest, and gradient boosting decision tree—as the basic models, decision trees offer strong interpretability, facilitating subsequent back-analysis of key factors contributing to increased risk; random forests, through their multi-tree voting mechanism, exhibit outstanding anti-overfitting capabilities and are suitable for scenarios with uneven risk sample distribution; and the gradient boosting model achieves high-precision prediction through iterative fitting of residuals, adapting to the refined assessment needs of risk value regression. The combination of these three algorithms can fit the mapping relationship between risk characteristics and risk values ​​from different dimensions, reducing the inherent bias and variance of a single model. Furthermore, by considering the vulnerability characteristics of the four business domains (production, logistics, marketing, and specialty stores) and the industry characteristics of differences in the distribution of exposed features, a targeted domain feature adaptation layer is configured for each base model, addressing the challenges of using a general model across multiple domains. To address the issue of large fluctuations in generalization performance across different scenarios, this paper addresses the problem by specifically enhancing the effective representation of features in various domains. This improves the fitting accuracy and scenario adaptability of the base learner in specific business scenarios. By customizing the hyperparameter search space based on input feature characteristics, total sample size, and asset risk assessment task objectives, invalid parameter intervals that do not match the current scenario features and sample size are eliminated. This ensures comprehensive coverage of parameter search while avoiding computational waste caused by invalid traversal, thus improving the efficiency and scenario specificity of hyperparameter optimization. By selecting the hyperparameter combination with the optimal performance evaluation index as the final configuration, each base model can achieve the optimal risk assessment performance in the corresponding business domain scenario, resulting in a high-precision, highly adaptable target single model. This provides a high-quality basic learning unit for subsequent weighted ensemble evaluation.

[0049] Example 6: Based on Example 5, this embodiment of the invention provides a method for dynamic assessment of multi-domain asset risk, which further includes: dynamically adjusting the hyperparameter search space during model training, specifically: During model training, obtain the mutual information value between the input feature dimensions and the risk labels. The feature dimensions are sorted in descending order of mutual information value. The feature characteristics of the input feature dimensions whose mutual information value is greater than the preset mutual information value are obtained from the feature dimension sort. Based on the aforementioned characteristics, the hyperparameter search space is dynamically adjusted.

[0050] Based on the aforementioned characteristics, the hyperparameter search space is dynamically adjusted. For example, the specific execution logic pre-fixes mapping rules, and the adjustment object is the k-dimensional principal component features after principal component transformation. The distribution attributes of the original subdivided features formed by the principal components are associated through the inverse mapping of principal components, and a one-to-one correspondence is established between the triggering conditions, the adjustment object, and the new interval boundary. First, perform inverse linear projection on the single-dimensional principal component to decompose it into the weights of each original sub-feature that constitutes the principal component. Count the original feature types whose weight ratio exceeds the preset weight threshold (e.g., 0.1). If the original feature with the highest weight ratio is a discrete feature (vulnerability level, security strategy protection coverage status, etc.), it is determined that the current principal component dimension is dominated by discrete feature information. Then, the hyperparameter search interval of the random forest model is adjusted: shrink the upper and lower limits of the original search interval of the minimum number of split samples and the maximum feature sampling ratio, and shift the interval as a whole to the numerical interval that is suitable for the split of discrete features, and remove parameter values ​​in the interval that do not match the fitting logic of discrete features. If the original feature with the highest proportion is a continuous feature (such as the frequency of asset port exposure, external access traffic, and duration of vulnerability), and it is determined that the current principal component dimension is dominated by continuous feature information, then the gradient boosting decision tree hyperparameter search interval adjustment is triggered: shrink the upper and lower limits of the original search interval of learning rate and L2 regularization coefficient, and shift the interval as a whole towards the numerical interval that is suitable for smooth fitting of continuous features, and remove parameter values ​​in the interval that do not match the fitting logic of continuous features. If the discrete and continuous original features have a balanced weight in the principal components, then the original complete hyperparameter search interval is retained without shrinkage or shifting. By using the above mapping rules of binding principal components, tracing back to the original features, and adjusting boundaries within fixed intervals, invalid parameter combinations that do not match the principal component feature distribution of the current scenario are eliminated, thereby simultaneously improving the computational efficiency of hyperparameter optimization and the model's accuracy in adapting to business scenarios.

[0051] In this embodiment, the mutual information value is used to quantify the degree of non-linear dependence between a single-dimensional feature and a risk label. The higher the value, the stronger the feature's contribution to distinguishing risk levels and the higher its sensitivity. Based on the information entropy calculation logic, the information entropy of the feature dimension, the information entropy of the risk label, and the joint entropy of the feature and the label are calculated respectively. Then, the mutual information value between the feature dimension and the risk label is calculated through the entropy difference. The mutual information value = feature information entropy + risk label information entropy - joint information entropy of the feature and the label.

[0052] The beneficial effects of the above design scheme are as follows: By calculating the mutual information value between the input feature dimension and the risk label during training, the nonlinear correlation strength between each feature dimension and the risk result can be quantified based on the true distribution of the current training samples. This accurately identifies the actual distinguishing contribution of each feature to the risk level, providing a data-driven objective quantitative basis for adjusting the hyperparameter search space. It can adapt to scenarios with large differences in the feature distribution of samples from different business domains, ensuring that the subsequent adjustment logic is highly matched with the risk feature patterns of the current training set. By sorting the mutual information values ​​in descending order and selecting high-sensitivity feature dimensions above the threshold, the contribution level of features to risk assessment can be clarified, locking in the core feature set that determines the risk assessment result. Based on the discrete / continuous feature dominant type carried by the principal component, the parameter search space is pruned in a targeted manner, optimizing the fitting ability of random forests and gradient boosting trees, reducing invalid parameter traversal, reducing computing power consumption, accelerating the optimization speed, realizing dynamic adaptive parameter tuning for business scenarios, and avoiding excessive shrinkage and loss of effective parameter combinations, thus balancing optimization efficiency and model generalization accuracy.

[0053] Example 7: Based on Example 5, this embodiment of the invention provides a multi-domain asset risk dynamic assessment method. In step S3, a weighted asset risk assessment model is established, including: The model input features are divided into multiple scenario subsets according to business domain type and asset importance, and the performance evaluation index values ​​of each scenario subset in the three target single models are obtained. The performance evaluation index values ​​of the three target single models are normalized, and the normalized values ​​are used as the basic scene weights of the scene subsets in the target single models. Based on the relationship between the scene subsets and the basic scene weights, a weight benchmark table is established. Based on the business time period attributes of the model input features, establish weight correction coefficients for the three target single models; The online weights for each target single model are determined based on the weight benchmark table and weight correction coefficients. Based on online weights, the three single-objective models—decision tree, random forest, and gradient boosting decision tree—are weighted and fused to obtain a weighted asset risk assessment model.

[0054] In this embodiment, the normalization of the performance evaluation index values ​​of the three target single models is specifically achieved by using the sum of the performance values ​​of the three base models in the same scenario as the normalization denominator, and calculating the proportion of the performance value of each base model to the total performance value.

[0055] In this embodiment, based on the business time period attributes of the model input features, weight correction coefficients are established for the three target single models. For example, during the peak production season, the weights of the random forest base model for production domain assets are multiplied by a correction coefficient of 1.15 to strengthen the fitting weights of discrete vulnerability features; during the special inspection period for monopoly, the weights of the gradient boosting decision tree base model for monopoly domain assets are multiplied by a correction coefficient of 1.1 to strengthen the fitting weights of time-series exposure features; after correction, weight normalization is re-executed to obtain the dynamic integrated weights for the current inference.

[0056] In this embodiment, determining the online weight for each target single model based on the weight benchmark table and the weight correction coefficient specifically involves multiplying the basic scene weight determined by the weight benchmark table with the weight correction coefficient as the online weight.

[0057] In this embodiment, the model input features are divided into multiple scenario subsets according to business domain type and asset importance: four business domains are preset: production, logistics, marketing, and specialty stores. For example, the continuous scores of asset importance are divided into three levels: low importance [0,2], medium importance [2,4], and high importance [4,5]. Boundary values ​​2 and 4 are assigned to higher levels. Twelve standard scenario subsets are formed by combining business domains and importance levels in pairs. The performance evaluation index values ​​of each scenario subset in the three target single models are obtained. The performance evaluation index values ​​of the three target single models are normalized, and the normalized values ​​are used as the basic scenario weights of the scenario subsets in the target single models. Based on the one-to-one correspondence between the 12 standard scenario subsets and the basic scenario weights, a unique and reproducible weight benchmark table is established. Based on the business time period attributes of the model input features, weight correction coefficients are established for the three target single models. Based on the weight benchmark table and the weight correction coefficients, the online weights for each target single model are determined. According to the online weights, the three target single models of decision tree, random forest, and gradient boosting decision tree are weighted and fused to obtain a weighted asset risk assessment model.

[0058] The beneficial effects of the above design scheme are as follows: By dividing the scenario subset according to both business domain type and asset importance, and by normalizing the performance values ​​of single models into basic scenario weights, an adaptive allocation mechanism with a positive correlation between model performance and weight ratio is achieved. The better the performance of the base model, the higher its decision-making weight in the corresponding scenario, which can maximize the scenario advantages of each base model and ensure the evaluation accuracy in subdivided scenarios. By introducing business time period attributes to set weight correction coefficients, the limitation of static weights being unable to adapt to business cycle fluctuations is overcome. It can match the risk characteristic drift characteristics of different periods such as the peak production season, tobacco leaf purchase period, and special inspection period of the tobacco monopoly industry. By combining offline weights... The baseline table and online time period correction coefficients calculate the final online weights, balancing the stability and dynamic adaptability of the assessment system: the baseline weight table provides a reliable weight foundation validated by historical data, ensuring the stability of the assessment results; the time period correction coefficients enable dynamic adaptation to the current business status, responding to real-time changes in risk characteristics. Based on the online dynamic weights, the three types of heterogeneous base models are weighted and fused, which can fully integrate the strong interpretability of decision trees, the anti-overfitting ability of random forests, and the high-precision fitting advantages of gradient boosting decision tree models, achieving complementary characteristics of different algorithms, effectively reducing the inherent bias and variance of single models, and improving the generalization ability and robustness of the overall risk assessment model.

[0059] Example 8: Based on Example 7, this embodiment of the invention provides a multi-domain asset risk dynamic assessment method. In step S4, based on a weighted asset risk assessment model, the multi-dimensional asset feature vector is assessed, and the asset risk value is output in real time, including: By inputting the multidimensional asset feature vector into the three objective single models in the weighted asset risk assessment model, the corresponding risk prediction values ​​are obtained; Based on the online weights of the target single model, the risk prediction values ​​are weighted and fused to obtain the asset risk value.

[0060] The beneficial effects of the above design scheme are as follows: by synchronously inputting multidimensional asset feature vectors into three heterogeneous target single models for parallel computation, the complementary advantages of different algorithms can be fully utilized to fit the risk feature mapping relationship from multiple dimensions, reducing the inherent bias and random error of the single model. By dynamically adapting online weights to perform weighted summation of the output results of each single model, the decision contribution ratio of each model can be dynamically adjusted according to the characteristics of the business scenario, importance level and current business period of the asset, so that the final output asset risk value is more in line with the risk distribution law of the actual scenario, and the scenario adaptation accuracy of the assessment results can be improved.

[0061] Example 9: This embodiment of the invention provides a multi-domain asset risk dynamic assessment system, specifically used to implement the multi-domain asset risk dynamic assessment method as described in Example 1, such as... Figure 2 As shown, it includes: The vector acquisition module is used to acquire the original data of enterprise risk factors in multiple domains, and to quantify and characterize the original data of risk factors to obtain multidimensional asset feature vectors. The historical analysis module is used to reduce the dimensionality of historical risk event samples and select principal components with a variance contribution rate greater than a preset threshold as model input features. The model building module is used to build multiple basic models, optimize the hyperparameters of the basic models based on the model input features, and establish a weighted asset risk assessment model. The multiple basic models include three basic models: decision tree, random forest, and gradient boosting decision tree. The real-time assessment module is used to evaluate multi-dimensional asset feature vectors based on a weighted asset risk assessment model and output asset risk values ​​in real time.

[0062] In this embodiment, the raw data of risk factors includes, for example, equipment operation logs and vulnerability scanning results collected from the cigarette production industrial control system, open ports and external service configurations collected from the logistics sorting system, business system importance levels collected from the marketing big data platform, EDR terminal online status collected from the monopoly supervision system, access policies and attack logs collected from firewalls and WAFs, and basic attribute data such as asset roles and business ownership in the asset management system.

[0063] In this embodiment, the multidimensional asset feature vector is, for example, [4.9, 1.8, 8.2, 0.95], with the four dimensions being: asset importance index 4.9 points, asset exposure risk index 1.8 points, asset vulnerability index 8.2 points, and security strategy coverage 0.95.

[0064] In this embodiment, the historical risk event sample includes asset characteristic data and a historical dataset with corresponding real risk labels, wherein the risk labels are generated by combining actual risk events, the extent of loss, and expert annotations.

[0065] The beneficial effects of the above design scheme are as follows: By quantitatively representing the original data of multi-domain risk factors, heterogeneous risk data from different business domains and data sources, such as production, logistics, marketing, and specialty stores, can be converted into multi-dimensional asset feature vectors in a unified format. This breaks down data standard barriers between different domains, enabling integrated and comparable assessment of enterprise-wide asset risks. It solves the technical problems of risk transmission blind spots and inconsistent assessment standards in independent domain assessments. By performing principal component dimensionality reduction on the original risk factor data, core effective features are retained based on variance contribution rate, while redundant information and noise interference in high-dimensional original features are eliminated. While retaining the vast majority of risk information, the input feature dimensions are compressed, avoiding the model overfitting problem caused by the curse of dimensionality and reducing the computational cost of subsequent model training and real-time inference. This makes it suitable for large-scale enterprise applications. To meet the performance requirements of concurrent asset assessment, this approach constructs multiple heterogeneous basic models and performs scenario-based hyperparameter optimization. It leverages the fitting characteristics of different algorithms to create synergy, reducing the inherent bias and variance of a single model. Simultaneously, it optimizes hyperparameters based on the distribution characteristics of input features, ensuring a high degree of match between model parameters and the actual risk distribution of enterprise assets. Compared to general fixed-parameter models, this improves risk assessment accuracy and scenario generalization ability, effectively reducing the probability of missed or false positives for high-risk assessments. By inferring and calculating real-time updated multi-dimensional asset feature vectors based on a weighted asset risk assessment model, it achieves second-level dynamic output of asset risk values, overcoming the limitations of traditional manual periodic and static assessments. This enables timely detection of asset risk anomalies, providing real-time data support for risk warning and rapid response, and ensuring the continuous and stable operation of the enterprise's core business systems.

[0066] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of this application and its equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for dynamic assessment of multi-domain asset risk, characterized in that, include: S1: Obtain the raw data of risk factors of the enterprise in multiple domains, and quantify the raw data of risk factors to obtain a multidimensional asset feature vector; S2: Dimensionality reduction is performed on historical risk event samples, and principal components with variance contribution rates greater than a preset threshold are selected as model input features; S3: Construct multiple basic models, optimize the hyperparameters of the basic models based on the input features of the models, and establish a weighted asset risk assessment model; S4: Based on the weighted asset risk assessment model, it evaluates the multidimensional asset feature vector and outputs the asset risk value in real time; Among them, several basic models include three basic models: decision tree, random forest, and gradient boosting decision tree.

2. The method for dynamic assessment of multi-domain asset risk according to claim 1, characterized in that, In step S1, the original data of the risk factors are quantitatively characterized to obtain a multidimensional asset feature vector, including: The raw data of the risk factors are preprocessed to obtain the target data of the risk factors; Asset attribute data is extracted from the target data of the risk factors, and combined with the asset attribute distribution relationship diagram, the probability of asset risk diffusion is determined as an asset importance indicator; Network-related data are extracted from the target data of the risk factors, and the characteristics of the exposure surface are statistically analyzed and quantitatively represented as asset exposure risk indicators. Vulnerability scanning data is extracted from the target data of the risk factors, and the vulnerability scanning data is quantitatively analyzed to obtain asset vulnerability indicators. Security protection data is extracted from the risk factor target data to determine the security coverage rate and obtain the security strategy coverage rate index. By standardizing asset importance indicators, asset exposure risk indicators, asset vulnerability indicators, and security strategy coverage indicators, a multidimensional asset feature vector is established.

3. The method for dynamic assessment of multi-domain asset risk according to claim 1, characterized in that, In step S2, the historical risk event samples are dimensionality-reduced, and principal components with a variance contribution rate greater than a preset threshold are selected as model input features, including: Based on the multidimensional risk characteristics of historical risk event samples, an original feature matrix is ​​constructed, and the original feature matrix is ​​standardized to obtain a standard feature matrix. Calculate the covariance matrix of each dimension based on the standard feature matrix, and obtain the eigenvalues ​​of the covariance matrix and its corresponding orthogonal eigenvectors. Calculate the variance contribution rate of each eigenvalue, select the target eigenvalue with a variance contribution rate greater than a preset threshold, and the target orthogonal eigenvector corresponding to the target eigenvalue. Integrate the target orthogonal eigenvectors to obtain the transformation matrix. Based on the result of the multiplication operation between the standard feature matrix and the transformation matrix, the principal component feature matrix is ​​obtained and used as the input features of the model.

4. The method for dynamic assessment of multi-domain asset risk according to claim 3, characterized in that, The original feature matrix is ​​standardized to obtain a standard feature matrix, including: The initial eigenvalues ​​in the original feature matrix are standardized based on the normalization formula; Based on standardized values, a standard feature matrix is ​​constructed.

5. The method for dynamic assessment of multi-domain asset risk according to claim 1, characterized in that, In step S3, multiple basic models are constructed, and hyperparameter optimization is performed on the basic models based on the model input features, including: We selected three basic models: decision tree, random forest, and gradient boosting decision tree. We initialized the hyperparameters of the three basic models, used the input features of the models as the inputs of the three basic models, and used the asset risk value as the output of the three basic models. Based on the vulnerability and exposure characteristics of enterprises in the production, logistics, marketing and specialty domains, a domain feature adaptation layer with targeted processing is configured for the basic learner of the three basic models to obtain three domain adaptation models. Based on model data features, total sample size, and asset risk assessment task, a hyperparameter search space is constructed for the three domain-adapted models. The model data features are evenly divided into 5 non-overlapping subsets. Each time, 4 subsets are selected as training subsets and the remaining 1 subset is selected as validation subset. All parameter combinations are traversed in the hyperparameter search space and iterated 5 times. The average value of the 5 validation results is used as the corresponding parameter combination to obtain the performance evaluation index. The optimal combination of hyperparameters for performance evaluation is selected as the final hyperparameter configuration for the model, thus obtaining the target single model.

6. The method for dynamic assessment of multi-domain asset risk according to claim 5, characterized in that, Also includes: During model training, the hyperparameter search space is dynamically adjusted, specifically as follows: During model training, obtain the mutual information value between the input feature dimensions and the risk labels. The feature dimensions are sorted in descending order of mutual information value. The feature characteristics of the input feature dimensions whose mutual information value is greater than the preset mutual information value are obtained from the feature dimension sort. Based on the aforementioned characteristics, the hyperparameter search space is dynamically adjusted.

7. The method for dynamic assessment of multi-domain asset risk according to claim 5, characterized in that, In S3, a weighted asset risk assessment model is established, including: The model input features are divided into multiple scenario subsets according to business domain type and asset importance, and the performance evaluation index values ​​of each scenario subset in the three target single models are obtained. The performance evaluation index values ​​of the three target single models are normalized, and the normalized values ​​are used as the basic scene weights of the scene subsets in the target single models. Based on the relationship between the scene subsets and the basic scene weights, a weight benchmark table is established. Based on the business time period attributes of the model input features, establish weight correction coefficients for the three target single models; The online weights for each target single model are determined based on the weight benchmark table and weight correction coefficients. Based on online weights, the three single-objective models—decision tree, random forest, and gradient boosting decision tree—are weighted and fused to obtain a weighted asset risk assessment model.

8. The method for dynamic assessment of multi-domain asset risk according to claim 7, characterized in that, In step S4, based on the weighted asset risk assessment model, the multidimensional asset feature vector is evaluated, and the asset risk value is output in real time, including: By inputting the multidimensional asset feature vector into the three objective single models in the weighted asset risk assessment model, the corresponding risk prediction values ​​are obtained; Based on the online weights of the target single model, the risk prediction values ​​are weighted and fused to obtain the asset risk value.

9. A multi-domain asset risk dynamic assessment system, specifically used to implement the multi-domain asset risk dynamic assessment method as described in claim 1, characterized in that, include: The vector acquisition module is used to acquire the original data of enterprise risk factors in multiple domains, and to quantify and characterize the original data of risk factors to obtain multidimensional asset feature vectors. The historical analysis module is used to reduce the dimensionality of historical risk event samples and select principal components with a variance contribution rate greater than a preset threshold as model input features. The model building module is used to build multiple basic models, optimize the hyperparameters of the basic models based on the model input features, and establish a weighted asset risk assessment model. Among them, the multiple basic models include three basic models: decision tree, random forest and gradient boosting decision tree. The real-time assessment module is used to evaluate multi-dimensional asset feature vectors based on a weighted asset risk assessment model and output asset risk values ​​in real time.

Images