Risk identification method, device, equipment and medium

Abstract

The present application relates to the technical field of artificial intelligence, and discloses a risk identification method, device, equipment and medium, which converts the original data of multiple modes into structured data blocks in a unified format through preprocessing according to the data mode types, realizes format unification of cross-mode data, eliminates format barriers between different mode data, provides a structured data basis for subsequent risk identification, does not need to rely on manual segmentation and auditing, improves data fusion processing efficiency, realizes multiple verifications through multi-layer risk scanning, guarantees high recall rate and ensures accurate understanding of complex semantics, effectively reduces false positive rate and false negative rate, improves risk identification accuracy, and through aggregation and statistics of risk events, the risk exposure level of users or staff can be quickly identified, which is beneficial to shorten the risk response time, improve response real-time performance, and facilitate subsequent timely risk intervention. It can be applied to intelligent medical and financial service scenarios to improve risk identification accuracy.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence technology and intelligent decision-making technology, and in particular to a risk identification method, device, equipment and medium. Background Technology

[0002] Existing risk monitoring systems rely on rule engines and keyword matching, lacking a deep understanding of the implicit semantics and contextual dependencies in business texts, communication voice messages, and multimedia promotional materials. This results in low accuracy in risk identification in complex scenarios such as implied profit promises in financial marketing and implicit risks in informed consent in medical communication. Furthermore, with the increasing prevalence of online business and multimodal data collection technologies, risk monitoring systems need to collect and monitor multimodal heterogeneous data. For example, unstructured data in the financial sector includes customer service recordings, dual-recording videos, and promotional materials; while in the medical field, unstructured data includes outpatient recordings, surgical videos, imaging reports, and health education materials. However, existing compliance monitoring systems still employ independent acquisition and manual segmented review processes for each modality of data, leading to response delays of several hours to days from data collection to risk analysis output, failing to support minute-level risk intervention needs. Summary of the Invention

[0003] This invention provides a risk identification method, apparatus, device, and medium to solve the technical problems of low risk identification accuracy and poor real-time response caused by the lack of understanding ability and low efficiency of multimodal heterogeneous data fusion processing in existing risk monitoring systems.

[0004] Firstly, a risk identification method is provided, including: Acquire multimodal raw data, preprocess the raw data according to the data modality type, extract the text information corresponding to the raw data of each modality, add metadata tags to the text information corresponding to the raw data of each modality, generate structured data blocks corresponding to the raw data of each modality, and store the structured data blocks in the message queue. Multi-level risk scanning is performed on the structured data blocks stored in the message queue to obtain the violation results at each level. The violation results at each level are associated and encapsulated with the metadata tags of the corresponding structured data blocks to generate risk events. The risk events are acquired, and they are aggregated according to a preset aggregation dimension to construct a dynamic source tracing map.

[0005] Secondly, a risk identification device is provided, comprising: The multimodal data preprocessing module is used to acquire multimodal raw data, preprocess the raw data according to the data modality type, extract the text information corresponding to the raw data of each modality, add metadata tags to the text information corresponding to the raw data of each modality, generate structured data blocks corresponding to the raw data of each modality, and store the structured data blocks into a message queue. The multi-layer risk scanning module is used to perform multi-layer risk scanning on the structured data blocks stored in the message queue, obtain the violation results of each layer, associate and encapsulate the violation results of each layer with the metadata tags of the corresponding structured data blocks, and generate risk events. The risk aggregation module is used to acquire the risk events, aggregate the risk events according to preset aggregation dimensions, and construct a dynamic source tracing map.

[0006] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the risk identification method described above.

[0007] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the risk identification method described above.

[0008] In the aforementioned risk identification method, apparatus, equipment, and medium, the solution can acquire multimodal raw data through a client, preprocess the raw data according to the data modality type, extract the text information corresponding to the raw data of each modality, add metadata tags to the text information corresponding to the raw data of each modality, generate structured data blocks corresponding to the raw data of each modality, and store the structured data blocks in a message queue. Multi-layer risk scanning is performed on the structured data blocks stored in the message queue to obtain the violation results at each layer. The violation results at each layer are associated and encapsulated with the metadata tags of the corresponding structured data blocks to generate risk events. The risk events are aggregated according to a preset aggregation dimension to construct a dynamic traceability graph and feed it back to the client. In this invention, for intelligent assistants in the field of smart healthcare, or for intelligent customer service in the field of finance, this can be utilized... The risk identification scheme preprocesses multimodal raw data according to data modality type, converting it into structured data blocks in a unified format. This achieves format unification across modalities, eliminating format barriers between different modalities and providing a structured data foundation for subsequent risk identification. It eliminates the need for manual segmented review, improving data fusion processing efficiency. Multi-layered risk scanning enables multiple verifications, ensuring both high recall and accurate understanding of complex semantics, effectively reducing false positives and false negatives, and improving risk identification accuracy. Furthermore, by aggregating and statistically analyzing risk events, it can quickly identify the risk exposure level of users or staff, shortening risk response time, improving real-time response, and facilitating timely risk intervention. Finally, by constructing a dynamic source tracing map, it can quickly locate the source of violations and the affected area, effectively reducing the probability of risk spread. Attached Figure Description

[0009] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a schematic diagram of an application environment for a risk identification method according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating a risk identification method according to an embodiment of the present invention; Figure 3 yes Figure 2 A schematic diagram of a specific implementation method for step S20; Figure 4 This is a schematic diagram of the risk identification device in one embodiment of the present invention; Figure 5This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention; Figure 6 This is another structural schematic diagram of a computer device according to one embodiment of the present invention. Detailed Implementation

[0011] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0012] The risk identification method provided in this invention can be applied to, for example... Figure 1In application environments such as smart healthcare and finance, intelligent customer service, intelligent assistants, or intelligent management systems are typically implemented through a server-side architecture, where the client communicates with the server via a network. The server can obtain multimodal raw data from the client, preprocess the raw data according to its modality, extract the text information corresponding to each modality's raw data, add metadata tags to the text information corresponding to each modality's raw data, generate structured data blocks corresponding to each modality's raw data, and store these structured data blocks in a message queue. Multi-layer risk scanning is then performed on the structured data blocks stored in the message queue to obtain the violation results at each layer. The violation results at each layer are associated and encapsulated with the corresponding metadata tags of the structured data blocks to generate risk events. These risk events are aggregated according to a preset aggregation dimension to construct a dynamic source tracing graph and feed it back to the client. In this invention, for intelligent assistants in the smart healthcare field, or intelligent customer service in the financial field, a risk identification scheme can be used to... Multimodal raw data is preprocessed according to data modality type and converted into structured data blocks in a unified format. This achieves format unification across modalities, eliminating format barriers between different modalities and providing a structured data foundation for subsequent risk identification. It eliminates the need for manual segmentation and review, improving data fusion processing efficiency. Multi-layered risk scanning enables multiple verifications, ensuring both high recall and accurate understanding of complex semantics, effectively reducing false positives and false negatives, and improving risk identification accuracy. Furthermore, by aggregating and statistically analyzing risk events, the risk exposure level of users or staff can be quickly identified, shortening risk response time, improving real-time response, and facilitating timely risk intervention. Moreover, by constructing a dynamic source tracing map, the source of violations and the affected scope can be quickly located, effectively reducing the probability of risk spread. The client can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The invention will be described in detail below through specific embodiments.

[0013] Please see Figure 2 As shown, Figure 2 A flowchart illustrating the risk identification method provided in this embodiment of the invention includes the following steps: S10: Obtain the raw data of the multimodal data, preprocess the raw data according to the data modality type, extract the text information corresponding to the raw data of each modality, add metadata tags to the text information corresponding to the raw data of each modality, generate the structured data block corresponding to the raw data of each modality, and store the structured data block into the message queue.

[0014] The metadata tags include data modality type identifiers, source identifiers, timestamps, and business-related entity sets. Data modality type identifiers are used to identify the physical form of the original data corresponding to the current structured data block. Data modality types include text modality, audio modality, video modality, and image modality. Source identifiers are traceable coding fields used to identify the original data acquisition terminal, business system record, or file from which the current structured data block originates. The source is the data source of the original data, which may include intelligent customer service text chat, intelligent customer service voice call, recording system, dual recording system, file management system, and electronic signature system. The file management system can be used to store electronic promotional materials, electronic promotional image files, electronic product manual image files, and electronic report image files. The dual recording system refers to the recording of business processes... The information management system for simultaneous audio and video recording includes the following raw data: text modality data can be intelligent customer service text chat logs, promotional copy text, or signature record text; audio modality data can be intelligent customer service voice call recordings and audio / video recordings from dual-recording systems; video modality data can be video recordings from dual-recording systems; and image modality data can be promotional images. A timestamp represents the point in time the raw data was obtained; raw data from different modalities belonging to the same business session have the same timestamp. A business-related entity set is a set of identifiers used to record the business-related entities involved in the current structured data block, including but not limited to user identifiers, staff identifiers, product identifiers, and session identifiers, for subsequent data traceability. By preprocessing the raw multimodal data according to the data modality type, extracting the text information corresponding to the raw data of each modality and adding corresponding metadata tags, and generating structured data blocks corresponding to the raw data of each modality, the data is stored in a message queue. This facilitates the subsequent fusion and analysis of multimodal heterogeneous data, improves the system's ability to understand data of different modalities, enables synchronous acquisition and processing of multimodal data without the need for manual segmented review, improves processing efficiency, enhances real-time response, and helps improve the accuracy and precision of risk identification.

[0015] The risk identification method provided by this invention can be applied to intelligent customer service, intelligent assistants, or intelligent management systems in various application scenarios such as healthcare and finance. Intelligent management systems are typically implemented through a server-side architecture, which can acquire multimodal raw data in real time. For example, in the healthcare field, when a user consults about treatment procedures at a hospital, the timestamp for this treatment session can be the treatment appointment time. The business-related entity set includes the identifier of the user receiving treatment, the identifier of the staff receiving consultation, the identifier of the treatment consultation, and the identifier of the business session. The corresponding multimodal raw data can include conversation recordings, audio and video files of the conversation, ultrasound image files, and medical record text. The data modality type corresponding to the conversation recordings is audio, and its source can be a ward interview recording system. The data modality types corresponding to the audio and video files of the conversation are both audio and video. The source of these data can be a dual-recording system; the data modality type of ultrasound image files is image modality, and their source can be a dual-recording system or a file management system. Ultrasound image files can be obtained through synchronous screenshots of screen recordings from a dual-recording system, or through electronic ultrasound image files stored in a file management system; the data modality type corresponding to medical record texts is text modality, and their source can be a file management system, which can receive and store electronic medical record texts; or, in the financial field, users can purchase financial service products at branch counters. Financial service products include internet wealth management products and consumer credit products. Internet wealth management products include money market fund subscriptions, fixed-income wealth management plans, and fund portfolio investment services. Consumer credit products include personal consumer loans and consumer installment payments. For the business session of this financial service product purchase, the timestamp can be the purchase application initiation time. The business-related entity set includes the identifier of the user initiating the purchase, the identifier of the corresponding counter staff, the identifier of the purchased financial service product, and the identifier of the business session; the corresponding multimodal raw data includes customer service recording files, transaction process audio and video files, product instruction image files, and signature record texts. The data modality type corresponding to customer service recording files is audio modality, and its source... The data modality of the audio and video files in the transaction process can be either an audio or video modality, and the source can be a dual-recording system. The data modality of the product instruction manual image files is image, and the source can be a dual-recording system or a file management system. The product instruction manual image files can be obtained through synchronous screenshots of screen recordings from a dual-recording system, or through electronic product instruction manual image files stored in a file management system. The data modality of the signature record text is text, and the source can be an electronic signature system. The electronic signature system generates and stores signature record text through user signature operations.

[0016] Specifically, in step S10, a streaming data access layer can be used to acquire multimodal raw data from different sources in real time. This streaming data access layer can be constructed using a data access adapter of a streaming computing framework.

[0017] Specifically, in step S10, the message queue is a distributed message middleware cluster that can provide data through subscription or distribution modes.

[0018] Preferably, in some embodiments, the acquisition of raw multimodal data in step S10 includes: Obtain raw data from multiple modalities; Based on the physical file attributes or transmission protocol metadata of the raw data of each mode, obtain the data mode type identifier, source identifier, and timestamp corresponding to the raw data of each mode; Parse the business context information carried by the raw data of each modality to obtain the corresponding set of business-related entities; The data modality type identifier, source identifier, timestamp, and business-related entity set corresponding to the original data of each modality are used as metadata tags for the original data of each modality, and the metadata tags corresponding to the original data of each modality are recorded.

[0019] Among them, physical file attributes refer to the file attributes corresponding to the suffix of a physical file, and transport protocol metadata refers to a set of key-value pairs carried in the protocol layer header of the data transmission protocol. Data transmission protocols include Hypertext Transfer Protocol (HTTP) and the high-performance remote procedure call framework (gRPC) protocol. Through transport protocol metadata, the source and data modality type can be identified without parsing the data content. Furthermore, business context can be extracted from transport protocol metadata to obtain source identifiers, business-related entity sets, and timestamps.

[0020] Preferably, in some embodiments, the multimodal raw data includes text modal data, audio modal data, video modal data, and image modal data. Step S10, which involves preprocessing the raw data according to its modality type to extract the text information corresponding to each modality, includes: Text modal data is subjected to text normalization processing to obtain normalized text and retain content location tags. The normalized text is then associated with the content location tags to obtain the text information of the text modal data. The content location tags are used to identify the sequence number of a text segment within the normalized text in the text modal data. When the text modal data is a text chat log, the sequence number in the text modal data is the message sequence number. When the text modal data is promotional copy, the sequence number in the text modal data includes paragraph number, sentence number, and character number. The audio modal data is converted into audio text using the Automatic Speech Recognition (ASR) method, and the content time stamp is retained. The audio text is then associated with the content time stamp to obtain the text information of the audio modal data. The content time stamp is used to identify the relative time position of the audio segment in the audio text within the audio modal data. Keyframes are extracted from video modal data. Optical Character Recognition (OCR) is performed on the extracted keyframe images to obtain frame text. The spatial coordinates of the frame text in the corresponding keyframe image and the frame time marker of the keyframe image are recorded. The frame text is associated with the spatial coordinates and the frame time marker to obtain the text information of the video modal data. The frame time marker of the keyframe image is used to identify the relative time position of the keyframe image in the video modal data. A layout analysis method is used to separate text regions and image regions from image modal data. The text information of the text regions is extracted as image text, and the position coordinates and layout structure tags of the image text are recorded. The image text is then associated with the position coordinates and layout structure tags to obtain the text information of the image modal data. The layout structure tags include titles, body text, annotations, charts, and risk warnings to record the semantic information of the image text within the layout.

[0021] Preferably, the text normalization process for the text modal data includes: The text modal data is converted into a unified character encoding to obtain the converted text data. The character encoding conversion is used to convert the text modal data into a unified character encoding to eliminate the encoding differences between different character encodings. The obtained encoded and converted text data is cleaned to obtain cleaned text data. Cleaning removes or replaces invisible characters, zero-width characters, whitespace characters, tab characters, and HTML (Hyper Text Markup Language) entity escape characters and other special characters in the text data to avoid noise interfering with semantic understanding. The cleaned text data is formatted and standardized to obtain the formatted text data. The formatting and standardization process includes unifying the number format, the date format, and the use of full-width characters or half-width characters. Standardizing the format of the text data can improve the recall rate of keyword matching. The formatted text data is segmented and sentence-by-sentence to obtain the final standardized text. Segmentation and sentence-by-sentence processing are used to obtain and record paragraph numbers and sentence sequence numbers for easy location later.

[0022] Preferably, the keyframe extraction of the video modal data includes: The video parameters of the video modal data are obtained. The video parameters include the total duration of the video, frame rate, total number of frames, resolution, encoding format and keyframe distribution information. Candidate frames are extracted from video modal data according to a preset sampling frequency; Calculate the color histogram difference between two adjacent candidate frames to quantify the degree of image change. When the color histogram difference between two adjacent candidate frames is greater than the preset shot switching threshold, the candidate frame in the later position is determined to correspond to the shot boundary. The continuous frame sequence between the candidate frames corresponding to the adjacent shot boundaries is taken as a scene shot. Record the first candidate frame in each scene's shot as the pending candidate frame; The image text region ratio of the candidate frames is detected, and the candidate frames with an image text region ratio not less than the preset text ratio threshold are selected as key frames.

[0023] S20: Perform multi-layer risk scanning on the structured data block stored in the message queue, obtain the violation results of each layer, associate and encapsulate the violation results of each layer with the metadata tags of the corresponding structured data block, and generate a risk event; wherein, the violation result includes a violation tag, a corresponding confidence level, and a corresponding text fragment.

[0024] Preferably, the step S20 of performing a multi-layer risk scan on the structured data block stored in the message queue specifically involves: The structured data blocks stored in the message queue are subjected to a three-layer progressive risk scan, which includes detection of illegal language, detection of implicit violations, and verification of compliance consistency.

[0025] Combination Figure 3 Specifically, in this embodiment, step S20, which involves performing a multi-layer risk scan on the structured data block stored in the message queue, includes: S21: For the text information in the structured data block stored in the message queue, based on preset keywords, a keyword matching method is used, combined with a semantic recognition method, to detect illegal statements. The method acquires and outputs violation tags, violation statement confidence levels, and corresponding text fragments for violations with a confidence level not lower than a first preset confidence threshold. The structured data block with a violation statement confidence level not lower than the first preset confidence threshold is recorded. The preset keywords are predefined keywords used to characterize illegal behavior, such as zero risk, no risk, guaranteed minimum, guaranteed principal, guaranteed return, safe, complete, best, and invincible. Violation tags refer to violation type classification identifiers used to characterize the category of illegal behavior. Violation tags include guaranteed principal and return promises, exaggerated effects, and missing risk warnings. The first preset confidence threshold can be set to 0.9. By using a keyword matching method combined with a semantic recognition method to detect illegal statements, the keyword matching method ensures a rapid response to standardized violation statements, while the semantic recognition method compensates for the limited coverage of the keyword database, which cannot identify hidden violations. This ensures both high recall and accurate understanding of complex semantics.

[0026] Specifically, step S21, which involves detecting inappropriate language in the text information of the structured data block stored in the message queue based on preset keywords, using a keyword matching method, and combining it with a semantic recognition method, includes: Based on preset keywords, the text information in the structured data block stored in the message queue is subjected to precise and fuzzy matching using regular expressions to obtain keyword matching confidence and obtain matching text fragments as preliminary candidate text fragments. A semantic recognition method is used to perform semantic recognition verification on the initial candidate text fragments, and the verified violation tags, verified text fragments, and semantic recognition confidence scores are obtained. The confidence scores of keyword matching and semantic recognition are weighted and fused according to preset matching weights and preset recognition weights to obtain the final confidence score of the violation.

[0027] In this method, a keyword matching method is used for rapid matching, which reduces the pressure on subsequent semantic recognition. The semantic recognition method is then used to verify the matching and recognition results of the keyword matching method, thereby improving the accuracy of recognition and detection.

[0028] Specifically, step S21, which involves acquiring and outputting violation tags, violation statement confidence levels, and corresponding text fragments with violation statement confidence levels not lower than a first preset confidence threshold, and recording structured data blocks with violation statement confidence levels not lower than the first preset confidence threshold, includes: Compare and determine whether the final confidence level of the violation statement is not lower than the first preset confidence threshold; When the final confidence level of the violation statement is not lower than the first preset confidence threshold, it is judged as a violation. The corresponding verified violation label, the final confidence level of the violation statement, the verified text fragment, and the corresponding evidence location index are output. The structured data block in which the final confidence level of the violation statement is not lower than the first preset confidence threshold is recorded, and the processing time is obtained and output. Among them, the evidence location index includes content location markers, content time markers, spatial location coordinate markers, frame time markers, location coordinate markers, and layout structure tags.

[0029] Preferably, semantic recognition can be performed based on deep semantic understanding of a large model to scan structured data blocks stored in the message queue for risks. It should be noted that the large model can be a pre-trained multimodal large model, comprising multiple Transformer layers, an inference engine, a compliance feature embedding module, and a confidence calculation and output module. The inference engine loads and initializes the pre-trained large model, preprocesses preliminary candidate text fragments, performs inference, and obtains the inference results. The compliance feature embedding module obtains semantic recognition confidence and verified violation labels based on the inference results, and obtains... The corresponding preliminary candidate text fragments are taken as the verified text fragments. The confidence calculation and output module is used to perform weighted fusion of keyword matching confidence and semantic recognition confidence according to preset matching weight and preset recognition weight respectively to obtain the final violation statement confidence. The final violation statement confidence is compared with the first preset confidence threshold. The module outputs the verified violation tag, the final violation statement confidence and the corresponding verified text fragment, and records the structured data block with the final violation statement confidence not lower than the first preset confidence threshold.

[0030] The sum of the preset matching weight and the preset recognition weight is 1. Loading and initializing the pre-trained large model includes setting the large model inference parameters. These parameters include inference mode, batch size, maximum sequence length, and top sampling probability. The inference mode can be set to end-to-end inference to directly output the final judgment result. The batch size can be set to 8 to process 8 texts at a time. The maximum sequence length can be set to 2048 as a limit on the maximum number of characters in a single input. The top sampling probability can be set to 0.9 to sample from a vocabulary where the cumulative probability reaches 90%. The inference engine includes multiple Transformer layers. Preprocessing the initial candidate text fragments before inference to obtain the inference result includes: converting the initial candidate text fragments into a numerical representation that the large model can process, followed by word segmentation; mapping the word segmentation result to the corresponding token identifier. The process involves: 1) adding task-type lexical identifiers and special markers for boundary identification to the lexical identifier sequence to obtain an updated lexical identifier sequence; 2) padding or truncating the updated lexical identifier sequence according to a preset maximum sequence length to obtain the final lexical identifier sequence; 3) passing the final lexical identifier sequence sequentially through each Transformer layer of the large model. Each Transformer layer includes a multi-head self-attention sublayer and a feedforward neural network sublayer. Each Transformer layer uses a multi-head self-attention mechanism to obtain the contextual association weights between each lexical in the lexical identifier sequence and other lexicals, identifying semantic dependencies, and performing nonlinear transformation and feature extraction on the attention results through the feedforward neural network sublayer to obtain a sequence aggregation vector and transmit it to the next Transformer layer; 4) mapping the sequence aggregation vector output by the last Transformer layer to the violation category classification space through the final output layer mounted at the top of the last Transformer layer to obtain the probability distribution of each violation category in the lexical identifier sequence; and 5) obtaining the probability with the highest value and its corresponding violation category as the inference result. The step of obtaining verified violation tags based on the inference results and obtaining corresponding preliminary candidate text fragments as verified text fragments includes: using the probability in the inference results as semantic recognition confidence, and using the violation category corresponding to the probability in the inference results as the verified violation tag; obtaining the corresponding preliminary candidate text fragments as verified text fragments, and obtaining the evidence location index of the verified text fragments. The evidence location index includes content location markers, content time markers, spatial location coordinate markers, frame time markers, location coordinate markers, and layout structure tags.The compliance feature embedding module loads a dedicated adaptation layer for compliance checks onto the large model. This adaptation layer has a 128-dimensional compliance feature embedding space. The semantic vectors output by the large model are projected onto the 128-dimensional compliance feature embedding space through the linear transformation of the adaptation layer, so as to standardize the output results through the compliance feature embedding space.

[0031] The lexical identity sequence is the encoding mapping of the preliminary candidate text fragments. The numerical index corresponding to the character can be obtained from the preset vocabulary as the lexical identity of the character. Special markers include [CLS] and [SEP]. [CLS] is the start marker of the input sequence, and its corresponding lexical identity is 101. [SEP] is the sentence or paragraph separator marker, and its corresponding lexical identity is 102.

[0032] Of course, in other embodiments, keyword matching and semantic recognition can be performed simultaneously on the text information in the structured data block stored in the message queue, and then the confidence of keyword matching and semantic recognition can be processed by combining preset matching weights and preset recognition weights to obtain the final confidence of the illegal speech.

[0033] S22: Obtain structured data blocks with a violation statement confidence level lower than a first preset confidence threshold as structured data blocks to be identified by the knowledge graph. Extract text information and business-related entity sets from the structured data blocks to be identified by the knowledge graph. Associate the business-related entity sets in the structured data blocks to be identified with the graph nodes in the compliance knowledge graph. Associate and align the text information in the structured data blocks to be identified with the graph nodes in the compliance knowledge graph. Query the implicit relationship paths between the graph nodes in the compliance knowledge graph. Calculate the implicit violation confidence level based on the queried implicit relationship paths. Obtain violation tags, implicit violation confidence levels, and corresponding text fragments with implicit violation confidence levels not lower than a second preset confidence threshold. Record the structured data blocks to be identified by the knowledge graph with implicit violation confidence levels not lower than the second preset confidence threshold. The compliance knowledge graph is a graph-structured database. Graph nodes include starting nodes and target nodes. Starting nodes correspond to subjects, and target nodes correspond to objects. Subjects are the actors or entities bound by rules, while objects are the prohibited or required behaviors. The relationship between subjects and objects represents the type of entity relationship. Detection results meeting the confidence level are directly output without needing to be processed for subsequent risk scanning. This ensures rapid handling of high-confidence samples while avoiding wasting subsequent computational resources on clearly non-compliant samples, thus improving processing efficiency. Furthermore, the compliance knowledge graph facilitates implicit relationship detection, enhancing the reliability and accuracy of identification and judgment.

[0034] Specifically, before step S22, that is, before obtaining the structured data block with a violation statement confidence level lower than the first preset confidence threshold as the structured data block to be identified by the compliance knowledge graph, extracting the text information and business-related entity set from the structured data block to be identified by the compliance knowledge graph, associating the business-related entity set from the structured data block to be identified by the compliance knowledge graph with the graph nodes, associating and aligning the text information from the structured data block to be identified by the compliance knowledge graph with the graph nodes in the compliance knowledge graph, querying the implicit relationship path between the graph nodes in the compliance knowledge graph, calculating the implicit violation confidence level based on the queried implicit relationship path, obtaining the violation label, implicit violation confidence level and corresponding text fragment with an implicit violation confidence level not lower than the second preset confidence threshold, and recording the structured data block to be identified by the compliance knowledge graph with a violation confidence level not lower than the second preset confidence threshold, the risk identification method further includes: Define compliant entity types, inter-entity relationship types, and violation rule types, and construct a compliance knowledge graph based on these types. Specifically, the compliant entity types, inter-entity relationship types, and violation rule types can be defined according to a regulatory domain knowledge framework. The violation rule types are used to define query judgment logic to provide dynamic query templates. Violation rule types include direct association rules and indirect association rules. The compliant entity types are used to label the categories of graph nodes in the compliance knowledge graph. Compliance entity types include product type, benefit description, risk level, compliance clauses, related entities, and promotional scenarios. Product type refers to financial product type or service type, and benefit description is... This refers to the way of describing yield, return, and performance; risk level refers to the risk rating of a product or service; compliance clauses refer to the specific clause numbers and requirements in regulatory rules; related entities refer to institutions and practitioners bound by regulatory rules; and promotional scenarios include the specific channels or scenarios for promotion. The types of relationships between entities are used to determine the categories of directed connections between nodes in the compliance knowledge graph. These types include prohibited relationships, implied relationships, equivalent relationships, and subordinate relationships. Prohibited relationships refer to relationships between entities that are explicitly prohibited by regulatory rules; implied relationships refer to relationships that are not explicitly prohibited by regulatory rules but contain suggestive or misleading implications; and equivalent relationships refer to relationships between entities with different forms of association. The description of related relationships that have equivalent effects in a compliance sense refers to hierarchical or inclusive relationships between entities. The regulatory knowledge framework includes the dimensions of regulatory body, regulated object, regulated matter, and regulatory constraint. The regulatory body dimension refers to the makers and implementers of regulatory rules, recording the source attributes of regulatory rules. The regulated object dimension refers to the actors bound by the regulatory rules. The regulated matter dimension refers to the business areas and product types involved in the regulatory rules. The regulatory constraint dimension refers to the specific requirements of the regulatory rules on actors. For example, in the medical field, the regulatory body dimension is the regulatory agency, and the regulated object dimension includes medical institutions, healthcare professionals, pharmaceutical manufacturers and distributors, and medical supply manufacturers. For production and operation enterprises, the dimensions of regulatory matters include service behavior, product and technology, and management. The service behavior dimension includes diagnosis and treatment activities, surgical procedures, prescription issuance, medical record writing, informed consent, and nursing services. The product and technology dimension includes pharmaceuticals, medical supplies, and medical technologies. The management dimension includes medical waste disposal, medical equipment configuration, medical advertising, internet-based diagnosis, telemedicine, and mutual recognition of test results. The regulatory constraint dimension includes prohibitive requirements, mandatory requirements, restrictive requirements, standard requirements, and management procedure requirements. Alternatively, in the financial sector, the regulatory body dimension is regulatory agencies, and the regulatory objects dimension includes commercial banks, securities companies, fund companies, and insurance institutions.The regulatory dimensions include business behavior, product attributes, and promotional scenarios. Business behavior includes business types such as wealth management product sales, investment advisory services, and insurance sales services. Product attributes include product characteristics such as risk level, return type, product term, and investment direction. Promotional scenarios include promotional scenarios such as branch counters, telephone marketing, internet platforms, and live streaming promotions. Regulatory constraints include types of regulatory requirements such as prohibitive requirements, mandatory requirements, restrictive requirements, and information disclosure requirements. The process involves acquiring the text of regulatory rules, breaking it down to obtain standard structured rules, and storing them in a compliance knowledge graph. Here, "regulatory rule text" refers to the textual information of regulatory rules. For example, in the medical field, regulatory rules could be relevant management measures or implementing regulations; conversely, in the financial field, regulatory rules could be supervisory and management measures.

[0035] Preferably, the step of decomposing the regulatory rule text, obtaining standard structured rules, and storing them in the compliance knowledge graph includes: Obtain the prohibitive, obligatory, and restrictive clauses from the regulatory rules text as clauses to be broken down; Entity identification is performed on each clause to be disassembled to obtain the subject and object of each clause; Based on the identified subjects and objects of each clause to be disassembled, the relationships between the subjects and objects of the corresponding clauses to be disassembled are extracted to identify the relationships between them. Based on the subject, the relationship between the subject and object, and the relationship mapping triples of the object to be decomposed, the subject and object of the clause to be decomposed are mapped to the starting node and target node in the compliance knowledge graph according to the compliance entity type, and the corresponding compliance entity type is labeled for each starting node and target node; according to the relationship type between entities, the relationship between the subject and object of the clause to be decomposed is mapped to the directed edge between the starting node and target node in the compliance knowledge graph; Extract the scope of application, applicable conditions, and applicable objects defined by the clauses to be disassembled, and generate structured constraints. Integrate the starting node, the directed edge, and the target node, and use the structured constraints as attributes of the directed edge to generate standard structured rules. Store the standard structured rules in the compliance knowledge graph in the form of corresponding nodes combined with directed edges.

[0036] The standard structured rules consist of the starting node, directed edges, and target nodes of the compliance knowledge graph. The starting node corresponds to the subject, and the target node corresponds to the object. For example, in the medical field, regulatory rules could be the Measures for the Administration of Medical Advertising, and the corresponding clauses to be broken down could be: "The form of medical advertising shall not contain the following: (i) involving medical technology, treatment methods, disease names, or drugs; (ii) guaranteeing or implicitly guaranteeing a cure; (iii) promoting cure rates, effectiveness rates, or other treatment effects; (iv) obscenity, superstition, or absurdity; (v) denigrating others; (vi) using the name or image of patients, health technicians, medical education and research institutions and personnel, or other social groups or organizations as endorsements; (vii) using the name of the People's Liberation Army or the Armed Police Force; (viii) other circumstances prohibited by laws and administrative regulations." In this case, the identified subject is the medical institution or the entity publishing the medical advertisement, and the relationship between the subject and the object is a prohibited association. The object is the medical advertisement containing (i) involving medical technology, treatment methods, disease names, or drugs; (ii) guaranteeing or implicitly guaranteeing a cure; (iii) promoting... The content of any of the following forms of medical advertising is subject to the following constraints: (iv) obscenity, superstition, or absurdity; (v) denigration of others; (vi) use of the name or image of patients, health technicians, medical education and research institutions and personnel, or other social groups and organizations as proof; (vii) use of the name of the People's Liberation Army and the Armed Police Force; (viii) other circumstances prohibited by laws and administrative regulations. The structured constraint condition applies to all medical advertising activities. Alternatively, in the financial field, the regulatory rule can be the "Supervision and Management Measures for Commercial Bank Wealth Management Business". The corresponding clause text, i.e., the regulatory rule text, can be "No guarantee of principal and return". The subject of identification is the commercial bank. The relationship between the subject and the object is a prohibited association relationship. The object is the guarantee of principal and return. The corresponding relationship mapping triplets of the clauses to be disassembled can be "Commercial bank; Prohibited; Guaranteed principal and return". The structured constraint condition of the corresponding clauses to be disassembled applies to all wealth management businesses.

[0037] Specifically, after acquiring standard structured rules and storing them in the compliance knowledge graph, the risk identification method further includes: Obtain the regulatory rule update data text, decompose the regulatory rule update data text, obtain the standard structured update rules and store them in the compliance knowledge graph, and obtain the updated compliance knowledge graph.

[0038] Specifically, by acquiring and disassembling the text of updated regulatory rules, and storing it in a compliance knowledge graph, the knowledge graph is automatically updated, improving monitoring reliability. The process of disassembling the text of updated regulatory rules to obtain standard structured updated rules is similar to the process of disassembling the text of the regulatory rules to obtain standard structured rules, and will not be repeated here. The text of updated regulatory rules can be obtained by real-time crawling of updated cases and detailed updates of regulatory rules from the official website of regulatory authorities.

[0039] Specifically, step S22, which involves associating the set of business-related entities in the structured data block to be identified with the graph nodes in the compliance knowledge graph, and associating and aligning the text information in the structured data block to be identified with the graph nodes in the compliance knowledge graph, includes: Using the entity identifier in the business-related entity set of the structured data block to be identified as the query key, query the graph node corresponding to the entity identifier in the compliance knowledge graph, and determine the obtained graph node as the first graph anchor point. Fine-grained entity extraction is performed on the text information in the structured data block to be identified in the compliance knowledge graph to obtain candidate entities. An entity linking method is used to calculate the semantic similarity between the candidate entities and graph nodes in the compliance knowledge graph. The graph node with the highest semantic similarity is selected as the second graph anchor point, thus mapping the ambiguous expressions in the text information to the standard entities corresponding to the graph nodes in the compliance knowledge graph. This fine-grained entity extraction can be performed on the text information in the structured data block to be identified using a large model. The large model performs contextual semantic understanding on the text information through its Transformer layer, identifies entities with business semantics and entity types in the text information, and outputs candidate entities, including entity name, entity type, and their position in the text information.

[0040] Specifically, the step of calculating the semantic similarity between the candidate entity and the graph nodes in the compliance knowledge graph using the entity linking method, and obtaining the graph node with the highest semantic similarity as the second graph anchor point, includes: The name and type of the candidate entity are encoded into a first semantic vector; Encode the name and type of the subject or object corresponding to each graph node in the compliance knowledge graph into a second semantic vector; Calculate the cosine similarity between the first semantic vector and each of the second semantic vectors; The graph node corresponding to the second semantic vector with the highest cosine similarity is obtained as the second graph anchor point.

[0041] Preferably, the step S22 of querying the implicit relationship paths between graph nodes in the compliance knowledge graph includes: Using either the first or second graph anchor point as the query starting point, a graph traversal algorithm is employed to query the implicit relationship paths in the compliance knowledge graph that connect the starting node to the target node via directed edges. Specifically, the graph traversal algorithm determines the traversal direction based on the actual position of the query starting point within the standard structured rules stored in the compliance knowledge graph. When the query starting point is the starting node in a standard structured rule, a forward traversal is performed along the positive direction of the directed edges, searching from the query starting point to the target node. When the query starting point is the target node in a standard structured rule, a reverse traversal is performed along the negative direction of the directed edges, searching from the query starting point to the starting node.

[0042] Specifically, the step of using the first or second graph anchor point as the query starting point and employing a graph traversal algorithm to query the implicit relationship path in the compliance knowledge graph that connects the starting node to the target node via directed edges includes: When the first graph anchor point and the second graph anchor point are successfully obtained, the first graph anchor point is used as the query starting point, and a graph traversal algorithm is used to query the implicit relationship path in the compliance knowledge graph that is connected to the target node through the starting node via directed edges. The second graph anchor point is used as a verification point to cross-validate the implicit relationship path. When only the first graph anchor point is successfully obtained, the first graph anchor point is used as the query starting point, and a graph traversal algorithm is used to query the implicit relationship path in the compliance knowledge graph that connects the starting node to the target node through directed edges. When only the second graph anchor point is successfully obtained, the second graph anchor point is used as the query starting point, and a graph traversal algorithm is used to query the implicit relationship path in the compliance knowledge graph that connects the starting node to the target node through directed edges.

[0043] Specifically, a streaming graph computing engine can be used to execute graph traversal algorithms. This streaming graph computing engine is based on a distributed streaming data processing framework and includes a DataSource module for accessing data sources, a StreamGraph module for constructing the streaming graph topology, a JobManager module for task scheduling and fault tolerance, and a TaskManager module for parallel computing and task execution. The TaskManager module embeds graph computing operators for path lookup and matching. The DataSource module consumes data streams from a consumption queue to continuously consume risk events, transforming the received data into a data stream that the streaming processing framework can process. The streaming graph topology module then performs a Directed Acyclic Graph (DAG) on the transformed data stream. The DAG (Directed Acyclic Graph) topology construction organizes aggregation operations and graph state update operations into parallel executable DAG topologies. The job scheduling management module distributes the DAG topology to the task management module for parallel execution. The task management module performs window aggregation calculations for risk events and state updates and queries for the dynamic tracing graph. The graph computation operator module is embedded within the task management module to perform node creation, edge updates, and graph traversal queries for the dynamic tracing graph, enabling path queries based on the DAG topology.

[0044] Specifically, the step of calculating the implicit violation confidence level based on the queried implicit relationship path includes: The number of directed edges in the implicit relationship paths found in the query is counted, and this number is used as the path length of the implicit relationship path. A first confidence component is determined based on the path length. Specifically, when the path length is 1, it is determined to be a direct association rule; when the path length is greater than 1, it is determined to be an indirect association rule. The path length and the first confidence component are negatively correlated. When the path length is 1, the first confidence component is set to a first preset value, which can range from 0.9 to 1. When the path length is 2, the first confidence component is set to a second preset value, which can range from 0.6 to 0.8. When the path length is not less than 3, the first confidence component is set to a third preset value, which can range from 0 to 0.5. The subjects, objects, and relationships between subjects and objects in the text information of the structured data block to be identified are matched one by one with the subjects, objects, and relationships between subjects and objects corresponding to the implicit relationship paths. The second confidence component is determined based on the degree of matching. The degree of matching is the matching ratio. The lower the degree of matching, the smaller the corresponding second confidence component. Based on the data modality type identifier and source identifier of the metadata tag in the structured data block to be identified, the business scenario type of the structured data block to be identified is determined, and the scenario weight coefficient is obtained as the third confidence component based on the business scenario type. The product of the first confidence component, the second confidence component, and the third confidence component is calculated as the implicit violation confidence level.

[0045] Specifically, after step S22, that is, after obtaining the structured data block with a confidence level of less than the first preset confidence threshold as the structured data block to be identified by the compliance knowledge graph, extracting the text information and business-related entity set from the structured data block to be identified by the compliance knowledge graph, associating the business-related entity set from the structured data block to be identified by the compliance knowledge graph with the graph nodes, associating and aligning the text information from the structured data block to be identified by the compliance knowledge graph with the graph nodes in the compliance knowledge graph, querying the implicit relationship path between the graph nodes in the compliance knowledge graph, calculating the implicit violation confidence level based on the queried implicit relationship path, obtaining the violation label, implicit violation confidence level and corresponding text fragment with an implicit violation confidence level not lower than the second preset confidence threshold, and recording the structured data block to be identified by the compliance knowledge graph with an implicit violation confidence level not lower than the second preset confidence threshold, the risk identification method further includes: Text fragments with implicit violation confidence levels no lower than the second pre-set confidence threshold are associated with the identity identifiers of standard structured rules in the compliance knowledge graph, so that a traceable chain of evidence can be formed subsequently.

[0046] S23: Obtain the structured data blocks to be identified in the graph with implicit violation confidence lower than the second preset confidence threshold as the structured data blocks to be verified. Extract the business-related entity set from the structured data blocks to be verified. Merge and group them according to the session identifiers in the obtained business-related entity set. Extract compliance key features from the structured data blocks to be verified belonging to the same session group. Map the compliance key features to preset data dimensions to generate standardized feature vectors. Perform compliance consistency verification on the standardized feature vectors. When there are standardized feature vectors with inconsistent dimension information in the structured data blocks to be verified belonging to the same session group, it is determined to be a violation. Obtain and output the corresponding violation label, verification confidence, and text fragment.

[0047] Preferably, the extraction of compliance key features from the structured data blocks to be verified belonging to the same session group in step S23 includes: Based on the data modality type identifier of the metadata tag in the structured data block to be verified, obtain the data modality type of the structured data block to be verified belonging to the same session group, and extract compliance key features from the text information in the structured data block to be verified according to the corresponding data modality type.

[0048] Preferably, the step of extracting compliance key features from the text information in the structured data block to be verified according to the corresponding data modality type includes: For the text information in the structured data block to be verified that is identified as a text modality by the data modality type of the metadata tag, extract the product risk level, expected rate of return, risk warning statement and principal protection attribute features, extract the content location tag, and integrate to obtain the key compliance features of the text modality source; For text information in structured data blocks to be verified that are identified by the data modality type of the metadata tag as audio modality, the product risk level, expected rate of return, risk warning statements and principal protection attributes are extracted. Then, the text information is subjected to tone emphasis word detection to extract tone emphasis marker features, and integrated to obtain key compliance features of the audio modality source. The tone emphasis word detection is based on a predefined emphasis word library to match and detect the emphasis expressions in the text information. Text information in the structured data block to be verified, which is identified by the data modality type of the metadata tag as video modality, is extracted to extract the product risk level, expected rate of return, risk warning statement and principal protection attribute features. Based on the spatial positioning coordinate mark, the key frame image corresponding to the structured data block to be verified is analyzed to extract the font size, color and position features of the risk warning statement in the key frame image. The key features of video modality source compliance are then integrated to obtain the key features of video modality source compliance. The text information in the structured data block to be verified is identified as image modality data by the data modality type of the metadata tag. The product risk level, expected rate of return, risk warning statement and principal protection attribute features are extracted, and the layout structure tags are extracted. The key compliance features of the image modality source are integrated to obtain the key compliance features.

[0049] Specifically, the preset data dimensions include a preset product risk level dimension, a preset expected rate of return range dimension, a preset principal protection attribute dimension, and a preset risk warning completeness dimension. The step of mapping key compliance features to the preset data dimensions to generate standardized feature vectors includes: For compliance key features of different data modalities, normalization processing is performed based on the data type and value range of each dimension in the preset data dimensions. The normalized dimension values ​​are then assembled in a preset order to generate standardized feature vectors corresponding to each compliance key feature. Here, compliance key features of different data modalities refer to the compliance key features of the structured data blocks to be verified that correspond to different data modal types identified by the metadata tags. This includes at least two of the following: compliance key features of text modalities, audio modalities, video modalities, and image modalities. The product risk level of the compliance key feature is mapped to the standardized risk level code of the corresponding standardized feature vector; the expected rate of return of the compliance key feature is mapped to the expected rate of return range of the corresponding standardized feature vector; the principal protection attribute feature of the compliance key feature is mapped to the standardized principal protection attribute identifier of the corresponding standardized feature vector; and the risk warning statement of the compliance key feature is mapped to the risk warning integrity status identifier of the corresponding standardized feature vector, depending on whether it contains a risk warning statement.

[0050] Preferably, the compliance consistency verification of the standardized feature vector includes: For the standardized feature vectors corresponding to the compliance key features of different data modal sources belonging to the same session group, a consistency check is performed on each dimension. When the standardized feature vectors corresponding to the compliance key features of different data modal sources belonging to the same session group are inconsistent in the same dimension, it is determined that there are standardized feature vectors with inconsistent dimension information in the structured data blocks belonging to the same session group. The name of the inconsistent dimension, the corresponding dimension information, and the structured data block to be checked corresponding to the standardized feature vector with inconsistent dimension information are recorded. Specifically, the product risk levels of structured data blocks to be verified belonging to the same session group must be the same, meaning the standardized risk level codes of the standardized feature vectors corresponding to the structured data blocks to be verified belonging to the same session group must be the same; the deviation of the expected rate of return intervals of structured data blocks to be verified belonging to the same session group must not exceed a preset deviation threshold, meaning the deviation of the expected rate of return intervals of the standardized feature vectors corresponding to the structured data blocks to be verified belonging to the same session group must not exceed a preset deviation threshold; contradictory statements are prohibited regarding the principal protection attribute features of structured data blocks to be verified belonging to the same session group, meaning contradictory statements are prohibited regarding the standardized principal protection attribute identifiers of the standardized feature vectors corresponding to the structured data blocks to be verified belonging to the same session group; and structured data blocks to be verified belonging to the same session group must jointly cover the risk warning statements required by regulators, meaning the risk warning integrity status identifiers of the standardized feature vectors corresponding to the structured data blocks to be verified belonging to the same session group must be consistent.

[0051] Specifically, step S23, which involves acquiring and outputting the corresponding violation label, verification confidence level, and text fragment, includes: When the standardized feature vectors corresponding to the compliance key features of different data modal sources have mutually exclusive information in the same dimension, the verification confidence level is set as the first verification confidence threshold; among them, mutually exclusive information in the same dimension includes different product risk level codes and different principal protection attribute identifiers; When the standardized feature vectors corresponding to the compliance key features of different data modal sources have numerical deviations in the same dimension within a preset deviation range or when there are deviations in the information but they are not contradictory, the verification confidence level is set to the second verification confidence level threshold. When the standardized feature vector is missing information in any dimension, the verification confidence level is set to the third verification confidence level threshold.

[0052] Among them, the verification confidence level is used to characterize the reliability of the judgment that inconsistency of dimensional information constitutes a compliance risk. The first verification confidence threshold ranges from 0.9 to 1, the second verification confidence threshold ranges from 0.7 to 0.8, and the third verification confidence threshold ranges from 0.6 to 0.7.

[0053] S30: Obtain the risk events, aggregate the risk events according to the preset aggregation dimensions, and construct a dynamic source tracing map.

[0054] By constructing a dynamic source tracing graph, the propagation path and impact range of violations can be displayed, facilitating source tracing and quickly locating the source of the violation and affected users. The risk events can be aggregated according to preset aggregation dimensions using the windowing mechanism of the streaming computing engine, a distributed streaming data processing framework.

[0055] Preferably, the aggregation of risk events according to a preset aggregation dimension in step S30 includes: Set sliding window parameters, including window length and sliding step size; wherein, the window length can be 5 minutes and the sliding step size can be 1 minute; When each sliding step is triggered, the risk events in the current sliding window are grouped according to a preset aggregation key, the preset aggregation key including the user identifier or staff identifier in the business-related entity set; Statistically analyze the number of risk events and average confidence level within each aggregation group; Output the aggregation results for each aggregation group. The aggregation results include user ID, staff ID, number of risk events, average confidence level, and highest confidence level.

[0056] Preferably, the construction of the dynamic source map in step S30 includes: Obtain the user identifier, staff identifier, and product identifier from the business-related entity set corresponding to each risk event, and generate a traceability node identifier for each risk event; wherein, the traceability node identifier includes a user traceability node identifier, a staff traceability node identifier, and a product traceability node identifier, with the user traceability node identifier using the user identifier as the key, the staff traceability node identifier using the staff identifier as the key, and the product traceability node identifier using the product identifier as the key; The graph state is constructed and maintained through the key-value state management mechanism of the streaming computing engine. The graph state uses the source node identifier as the key and the attributes of the associated source nodes and propagation edges of the source node as the values. The associated source node refers to another source node in the dynamic source graph that is connected to the current source node through a propagation edge. When there is a propagation edge between two source nodes in the dynamic source graph, the two source nodes are each other's associated source nodes. The direction of the propagation edge represents the direction of the propagation of the risk event. Extract the user identifier and staff identifier of the risk event, determine whether the corresponding traceability node identifier already exists in the graph status, and update the graph status according to the determination result.

[0057] Specifically, updating the map state based on the judgment result includes: If there is no traceability node identifier in the graph state that corresponds to the user identifier and staff identifier of the risk event, a new traceability node is created and the associated traceability nodes of the traceability node are initialized. If there are traceability node identifiers in the graph state that correspond to the user identifier and staff identifier of the risk event, then the associated traceability node and risk propagation metadata of the risk event are included. The risk propagation metadata includes a propagation timestamp, the corresponding confidence level, and a violation label. The propagation timestamp is the timestamp in the metadata tag, and the risk propagation metadata is an attribute of the propagation edge.

[0058] Specifically, a dynamic source tracing graph is constructed based on the key-value state management mechanism of the streaming computing engine, persistently storing the relationships between risk events in state form. The graph state serves as the physical carrier of the dynamic source tracing graph, representing its physical implementation within the distributed runtime environment of the distributed streaming processing framework. The dynamic source tracing graph records the propagation path of the risk event in the form of source nodes and propagation edges. Source nodes correspond to the business participant identifiers in the business-related entity set, and the direction of the propagation edges represents the direction of risk event propagation among business participants. When the confidence level corresponding to a risk event reaches or exceeds a preset risk source tracing confidence threshold, a source tracing query is triggered, traversing along the propagation edges starting from the source node to locate the source of the violation and the affected scope.

[0059] Specifically, when the confidence level corresponding to the risk event reaches or exceeds the preset risk tracing confidence level threshold, the tracing node corresponding to the risk event with the highest confidence level is taken as the starting point. In the dynamic tracing graph, the subsequent tracing node chain starting from the starting point is traversed along the positive direction of the propagation edge, and all downstream tracing nodes are recorded until a leaf tracing node with no subsequent tracing nodes is reached. The affected range is determined based on all the recorded downstream tracing nodes. In the dynamic tracing graph, the predecessor tracing node chain starting from the starting point is traversed along the negative direction of the propagation edge, and all upstream tracing nodes are recorded until a root tracing node with no predecessor tracing node is reached. The source of the violation is determined based on the earliest root tracing node among all the recorded upstream tracing nodes.

[0060] Specifically, after step S30, that is, after acquiring the risk event, aggregating the risk event according to a preset aggregation dimension, and constructing a dynamic source tracing map, the risk identification method further includes: Based on the confidence level corresponding to the risk event, a tiered handling operation is performed to obtain the handling results. The handling results are then fed back to the large model and compliance knowledge graph for model updates and rule weight adjustments.

[0061] Preferably, the step of performing tiered handling operations based on the confidence level corresponding to the risk event includes: When the confidence level corresponding to the risk event is not lower than the preset high-risk threshold, an intervention prompt message is sent to the staff. When the confidence level corresponding to the risk event is lower than the preset high-risk threshold but not lower than the low-risk threshold, a compliance handling work order is generated and transmitted. The compliance handling work order refers to a structured task document transferred to the compliance management department for manual review and subsequent processing. The compliance handling work order includes a work order number, a violation label, the corresponding confidence level, the corresponding text fragment, a risk event identifier, and a set of business-related entities.

[0062] Specifically, obtaining the handling results and feeding them back to the large model and compliance knowledge graph includes: The data collected includes corrected script data and violation determination results, which are used as the handling results. Corrected script data refers to the data on script corrections made by staff after receiving intervention prompts. Violation determination results refer to the results of violation determination and detection of compliance handling work orders by the compliance management department after receiving compliance handling work orders. The results of the treatment are input into the large model to update the model parameters; Based on the degree of matching between the violation determination results in the handling results and the corresponding violation tags, the weight coefficients of the corresponding violation rules in the compliance knowledge graph are adjusted.

[0063] As can be seen, in the above solutions, for intelligent management systems in the field of smart healthcare, or for intelligent management systems in the financial field, a risk identification scheme can be used. By preprocessing multimodal raw data according to data modality type, it is converted into structured data blocks of a unified format, achieving cross-modal data format unification, eliminating format barriers between different modalities, and providing a structured data foundation for subsequent risk identification. This eliminates the need for manual segmented review, improves data fusion processing efficiency, and achieves multiple verifications through multi-layer risk scanning, ensuring both high recall rate and accurate understanding of complex semantics, effectively reducing false positive and false negative rates, improving risk identification accuracy. Furthermore, by aggregating and statistically analyzing risk events, the risk exposure level of users or staff can be quickly identified, which helps to shorten risk response time, improve real-time response, and facilitate timely risk intervention. Moreover, by constructing a dynamic traceability map, the source of violations and the affected scope can be quickly located, effectively reducing the probability of risk spread.

[0064] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0065] In one embodiment, a risk identification device is provided, which corresponds one-to-one with the risk identification methods described in the above embodiments. For example... Figure 4 As shown, the risk identification device includes a multimodal data preprocessing module 11, a multi-layer risk scanning module 12, and a risk aggregation module 13. Detailed descriptions of each functional module are as follows: The multimodal data preprocessing module 11 is used to acquire multimodal raw data, preprocess the raw data according to the data modality type, extract the text information corresponding to the raw data of each modality, add metadata tags to the text information corresponding to the raw data of each modality, generate structured data blocks corresponding to the raw data of each modality, and store the structured data blocks into a message queue. The multi-layer risk scanning module 12 is used to perform multi-layer risk scanning on the structured data block stored in the message queue, obtain the violation results of each layer, associate and encapsulate the violation results of each layer with the metadata tags of the corresponding structured data block, and generate risk events. The risk aggregation module 13 is used to acquire the risk events, aggregate the risk events according to preset aggregation dimensions, and construct a dynamic source tracing map.

[0066] In one embodiment, the multimodal data preprocessing module 11 is specifically used for: Text modal data is subjected to text normalization processing to obtain normalized text and retain content location tags. The normalized text is then associated with the content location tags to obtain the text information of the text modal data. The audio modal data is converted into audio text using an automatic speech recognition method and the content time stamp is retained. The audio text is then associated with the content time stamp to obtain the text information of the audio modal data. Keyframes are extracted from video modal data, optical character recognition is performed on the extracted keyframe images, frame image text is obtained, and the spatial positioning coordinates of the frame image text and the frame time marker of the keyframe image corresponding to the frame image text are recorded. The frame image text is associated with the spatial positioning coordinates and the frame time marker respectively to obtain the text information of the video modal data. The image modal data is analyzed using a layout analysis method to separate the text region from the image region. The text information of the text region is extracted as the image text, and the position coordinates and layout structure labels of the image text are recorded. The image text is then associated with the position coordinates and layout structure labels to obtain the text information of the image modal data.

[0067] In one embodiment, the multi-layer risk scanning module 12 is specifically used for: For the text information in the structured data block stored in the message queue, based on preset keywords, a keyword matching method is used, combined with a semantic recognition method, to detect illegal speech, obtain and output the illegal label, illegal speech confidence and corresponding text fragment with an illegal speech confidence of not less than the first preset confidence threshold, and record the structured data block with an illegal speech confidence of not less than the first preset confidence threshold. Structured data blocks with a violation confidence level lower than a first preset confidence threshold are obtained as structured data blocks to be identified by the knowledge graph. Text information and business-related entity sets are extracted from the structured data blocks to be identified by the knowledge graph. The business-related entity sets in the structured data blocks to be identified by the knowledge graph are associated with the graph nodes in the compliance knowledge graph. The text information in the structured data blocks to be identified by the knowledge graph is associated and aligned with the graph nodes in the compliance knowledge graph. The implicit relationship paths between the graph nodes in the compliance knowledge graph are queried. The implicit violation confidence level is calculated based on the queried implicit relationship paths. Violation tags, implicit violation confidence levels, and corresponding text fragments with implicit violation confidence levels not lower than a second preset confidence threshold are obtained. The structured data blocks to be identified by the knowledge graph with implicit violation confidence levels not lower than the second preset confidence threshold are recorded. The system acquires structured data blocks for graph identification with implicit violation confidence levels below a second preset confidence threshold as structured data blocks to be verified. It extracts business-related entity sets from the structured data blocks to be verified, merges and groups them according to the session identifiers in the obtained business-related entity sets, extracts compliance key features from the structured data blocks to be verified belonging to the same session group, maps the compliance key features to preset data dimensions to generate standardized feature vectors, and performs compliance consistency verification on the standardized feature vectors. When there are standardized feature vectors with inconsistent dimensional information among the structured data blocks to be verified belonging to the same session group, it is determined to be a violation. The system then acquires and outputs the corresponding violation label, verification confidence level, and text fragment.

[0068] In one embodiment, the multi-layer risk scanning module 12 is specifically used for: Based on preset keywords, the text information in the structured data block stored in the message queue is subjected to precise and fuzzy matching using regular expressions to obtain keyword matching confidence and obtain matching text fragments as preliminary candidate text fragments. A semantic recognition method is used to perform semantic recognition verification on the initial candidate text fragments, and the verified violation tags, verified text fragments, and semantic recognition confidence scores are obtained. The confidence scores of keyword matching and semantic recognition are weighted and fused according to preset matching weights and preset recognition weights to obtain the final confidence score of the violation.

[0069] In one embodiment, the multi-layer risk scanning module 12 is further used for: Define compliant entity types, inter-entity relationship types, and violation rule types, and construct a compliance knowledge graph based on the compliant entity types, inter-entity relationship types, and violation rule types; Obtain the regulatory rule text, break down the regulatory rule text, obtain standard structured rules, and store them in the compliance knowledge graph.

[0070] In one embodiment, the risk aggregation module 13 is used for: The graph state is constructed and maintained through the key-value state management mechanism of the streaming computing engine. The graph state uses the source node identifier as the key and the attributes of the associated source nodes and propagation edges of the source node as the values. Extract the user identifier and staff identifier of the risk event, determine whether the corresponding traceability node identifier already exists in the graph status, and update the graph status according to the determination result.

[0071] In one embodiment, the risk aggregation module 13 is further configured to: Based on the confidence level corresponding to the risk event, a tiered handling operation is performed to obtain the handling result.

[0072] This invention provides a risk identification device that preprocesses multimodal raw data according to data modality type, converting it into structured data blocks in a unified format. This achieves format unification across modalities, eliminating format barriers between different modalities and providing a structured data foundation for subsequent risk identification. It eliminates the need for manual segmented review, improving data fusion processing efficiency. Through multi-layer risk scanning, multiple verifications are achieved, ensuring both high recall and accurate understanding of complex semantics, effectively reducing false positive and false negative rates and improving risk identification accuracy. Furthermore, by aggregating and statistically analyzing risk events, the device can quickly identify the risk exposure level of users or staff, shortening risk response time, improving real-time response, and facilitating timely risk intervention. Moreover, by constructing a dynamic source tracing map, the device can quickly locate the source of violations and the affected area, effectively reducing the probability of risk spread.

[0073] Specific limitations regarding the risk identification device can be found in the limitations of the risk identification method described above, and will not be repeated here. Each module in the aforementioned risk identification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0074] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When executed by the processor, the computer program implements the functions or steps of a risk identification method on the server side.

[0075] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 6As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a risk identification method on the client side.

[0076] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: Acquire multimodal raw data, preprocess the raw data according to the data modality type, extract the text information corresponding to the raw data of each modality, add metadata tags to the text information corresponding to the raw data of each modality, generate structured data blocks corresponding to the raw data of each modality, and store the structured data blocks in the message queue. Multi-level risk scanning is performed on the structured data blocks stored in the message queue to obtain the violation results at each level. The violation results at each level are associated and encapsulated with the metadata tags of the corresponding structured data blocks to generate risk events. The risk events are acquired, and they are aggregated according to a preset aggregation dimension to construct a dynamic source tracing map.

[0077] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Acquire multimodal raw data, preprocess the raw data according to the data modality type, extract the text information corresponding to the raw data of each modality, add metadata tags to the text information corresponding to the raw data of each modality, generate structured data blocks corresponding to the raw data of each modality, and store the structured data blocks in the message queue. Multi-level risk scanning is performed on the structured data blocks stored in the message queue to obtain the violation results at each level. The violation results at each level are associated and encapsulated with the metadata tags of the corresponding structured data blocks to generate risk events. The risk events are acquired, and they are aggregated according to a preset aggregation dimension to construct a dynamic source tracing map.

[0078] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0079] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0080] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0081] It should be noted that any large models, software tools, or components not belonging to our company appearing in the embodiments of this application are merely illustrative examples and do not represent actual use. All user personal information involved in the embodiments of this application has been authorized (with the knowledge and consent) by the relevant parties or has been fully authorized by all parties, and the executing entity may obtain it through various legal and compliant means. The collection, storage, use, processing, transmission, provision, and disclosure of the information, data, and signals involved all comply with relevant laws and regulations and do not violate public order and good morals.

[0082] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A risk identification method, characterized in that, include: Acquire multimodal raw data, preprocess the raw data according to the data modality type, extract the text information corresponding to the raw data of each modality, add metadata tags to the text information corresponding to the raw data of each modality, generate structured data blocks corresponding to the raw data of each modality, and store the structured data blocks in the message queue. Multi-level risk scanning is performed on the structured data blocks stored in the message queue to obtain the violation results at each level. The violation results at each level are associated and encapsulated with the metadata tags of the corresponding structured data blocks to generate risk events. The risk events are acquired, and they are aggregated according to a preset aggregation dimension to construct a dynamic source tracing map.

2. The risk identification method as described in claim 1, characterized in that, The multimodal raw data includes text modal data, audio modal data, video modal data, and image modal data. The preprocessing of the raw data according to its modality type to extract the corresponding text information for each modality includes: Text modal data is subjected to text normalization processing to obtain normalized text and retain content location tags. The normalized text is then associated with the content location tags to obtain the text information of the text modal data. The audio modal data is converted into audio text using an automatic speech recognition method and the content time stamp is retained. The audio text is then associated with the content time stamp to obtain the text information of the audio modal data. Keyframes are extracted from video modal data, optical character recognition is performed on the extracted keyframe images, frame image text is obtained, and the spatial positioning coordinates of the frame image text and the frame time marker of the keyframe image corresponding to the frame image text are recorded. The frame image text is associated with the spatial positioning coordinates and the frame time marker respectively to obtain the text information of the video modal data. The image modal data is analyzed using a layout analysis method to separate the text region from the image region. The text information of the text region is extracted as the image text, and the position coordinates and layout structure labels of the image text are recorded. The image text is then associated with the position coordinates and layout structure labels to obtain the text information of the image modal data.

3. The risk identification method as described in claim 1, characterized in that, The multi-layer risk scanning of the structured data blocks stored in the message queue includes: For the text information in the structured data block stored in the message queue, based on preset keywords, a keyword matching method is used, combined with a semantic recognition method, to detect illegal speech, obtain and output the illegal label, illegal speech confidence and corresponding text fragment with an illegal speech confidence of not less than the first preset confidence threshold, and record the structured data block with an illegal speech confidence of not less than the first preset confidence threshold. Structured data blocks with a violation confidence level lower than a first preset confidence threshold are obtained as structured data blocks to be identified by the knowledge graph. Text information and business-related entity sets are extracted from the structured data blocks to be identified by the knowledge graph. The business-related entity sets in the structured data blocks to be identified by the knowledge graph are associated with the graph nodes in the compliance knowledge graph. The text information in the structured data blocks to be identified by the knowledge graph is associated and aligned with the graph nodes in the compliance knowledge graph. The implicit relationship paths between the graph nodes in the compliance knowledge graph are queried. The implicit violation confidence level is calculated based on the queried implicit relationship paths. Violation tags, implicit violation confidence levels, and corresponding text fragments with implicit violation confidence levels not lower than a second preset confidence threshold are obtained. The structured data blocks to be identified by the knowledge graph with implicit violation confidence levels not lower than the second preset confidence threshold are recorded. The system acquires structured data blocks for graph identification with implicit violation confidence levels below a second preset confidence threshold as structured data blocks to be verified. It extracts business-related entity sets from the structured data blocks to be verified, merges and groups them according to the session identifiers in the obtained business-related entity sets, extracts compliance key features from the structured data blocks to be verified belonging to the same session group, maps the compliance key features to preset data dimensions to generate standardized feature vectors, and performs compliance consistency verification on the standardized feature vectors. When there are standardized feature vectors with inconsistent dimensional information among the structured data blocks to be verified belonging to the same session group, it is determined to be a violation. The system then acquires and outputs the corresponding violation label, verification confidence level, and text fragment.

4. The risk identification method as described in claim 3, characterized in that, The text information in the structured data block stored in the message queue is used to detect illegal speech based on preset keywords, using a keyword matching method combined with a semantic recognition method. Based on preset keywords, the text information in the structured data block stored in the message queue is subjected to precise and fuzzy matching using regular expressions to obtain keyword matching confidence and obtain matching text fragments as preliminary candidate text fragments. A semantic recognition method is used to perform semantic recognition verification on the initial candidate text fragments, and the verified violation tags, verified text fragments, and semantic recognition confidence scores are obtained. The confidence scores of keyword matching and semantic recognition are weighted and fused according to preset matching weights and preset recognition weights to obtain the final confidence score of the violation.

5. The risk identification method as described in claim 3, characterized in that, The method further includes obtaining structured data blocks with a confidence level lower than a first preset confidence threshold as the structured data blocks to be identified in the compliance knowledge graph. This involves extracting text information and business-related entity sets from these data blocks, associating the business-related entity sets with graph nodes in the compliance knowledge graph, aligning the text information with graph nodes in the compliance knowledge graph, querying implicit relationship paths between graph nodes in the compliance knowledge graph, calculating implicit violation confidence levels based on the queried implicit relationship paths, and obtaining violation tags, implicit violation confidence levels, and corresponding text fragments with implicit violation confidence levels not lower than a second preset confidence threshold. Before recording the structured data blocks to be identified with implicit violation confidence levels not lower than the second preset confidence threshold, the risk identification method also includes: Define compliant entity types, inter-entity relationship types, and violation rule types, and construct a compliance knowledge graph based on the compliant entity types, inter-entity relationship types, and violation rule types; Obtain the regulatory rule text, break down the regulatory rule text, obtain standard structured rules, and store them in the compliance knowledge graph.

6. The risk identification method as described in claim 1, characterized in that, The construction of the dynamic source tracing map includes: Obtain user identifiers, staff identifiers, and product identifiers from the business-related entity set corresponding to each risk event, and generate traceability node identifiers for each risk event; The graph state is constructed and maintained through the key-value state management mechanism of the streaming computing engine. The graph state uses the source node identifier as the key and the attributes of the associated source nodes and propagation edges of the source node as the values. Extract the user identifier and staff identifier of the risk event, determine whether the corresponding traceability node identifier already exists in the graph status, and update the graph status according to the determination result.

7. The risk identification method as described in claim 1, characterized in that, After acquiring the risk events, aggregating the risk events according to preset aggregation dimensions, and constructing a dynamic source tracing map, the risk identification method further includes: Based on the confidence level corresponding to the risk event, a tiered handling operation is performed to obtain the handling result.

8. A risk identification device, characterized in that, include: The multimodal data preprocessing module is used to acquire multimodal raw data, preprocess the raw data according to the data modality type, extract the text information corresponding to the raw data of each modality, add metadata tags to the text information corresponding to the raw data of each modality, generate structured data blocks corresponding to the raw data of each modality, and store the structured data blocks into a message queue. The multi-layer risk scanning module is used to perform multi-layer risk scanning on the structured data blocks stored in the message queue, obtain the violation results of each layer, associate and encapsulate the violation results of each layer with the metadata tags of the corresponding structured data blocks, and generate risk events. The risk aggregation module is used to acquire the risk events, aggregate the risk events according to preset aggregation dimensions, and construct a dynamic source tracing map.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the risk identification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the risk identification method as described in any one of claims 1 to 7.

Images