Risk assessment method of trusted data space, related device and storage medium

Abstract

Embodiments of the present application relate to the field of big data, and propose a risk assessment method for a trusted data space, related devices and a storage medium. The method comprises: obtaining a digital contract in the trusted data space and real-time behavior data when the digital contract is executed; obtaining a contract feature vector based on the digital contract; obtaining a real-time behavior time sequence feature vector based on the real-time behavior data; performing similarity matching with a preset risk feature library based on the contract feature vector and the real-time behavior time sequence feature vector to obtain a historical risk feature vector; and determining a risk type, a risk probability and a risk level based on the contract feature vector, the real-time behavior time sequence feature vector and the historical risk feature vector. In the risk assessment, the contract feature vector, the real-time behavior time sequence feature vector and the historical risk feature vector are used for comprehensive risk assessment, which can not only assess whether the real-time behavior has risks at the moment, but also predict potential risk trends.

Description

Technical Field

[0001] This application relates to the field of big data, and more specifically to a risk assessment method, related apparatus, and storage medium for a trusted data space. Background Technology

[0002] Currently, risk identification in trusted data spaces mostly involves monitoring whether behaviors at the current moment pose a risk of default. It cannot identify behaviors that have not yet triggered contract rules but have dangerous tendencies in advance, which often results in a lag in risk identification. Summary of the Invention

[0003] This application provides a risk assessment method, related apparatus, and storage medium for trusted data spaces. When identifying risks, the method assesses risks in real time based on digital contracts and real-time behavioral data during the execution of digital contracts. Furthermore, the method combines historical risk characteristics with the current real-time behavioral data and compares the time-series evolution characteristics of similar risks in the past, thereby enabling the method to predict in advance whether the current real-time behavior has a dangerous trend.

[0004] In a first aspect, embodiments of this application provide a risk assessment method for a trusted data space, the method comprising: acquiring digital contracts in the trusted data space, and real-time behavioral data when executing the digital contracts; Obtain the contract feature vector based on the digital contract; Based on the real-time behavior data, obtain the real-time behavior time-series feature vector; Based on the contract feature vector and the real-time behavior time series feature vector, a similarity match is performed with a preset risk feature library to obtain a historical risk feature vector; Based on the historical risk feature vector, determine the time-series evolution characteristics of similar historical risks; based on the contract feature vector, the real-time behavior time-series feature vector, and the time-series evolution characteristics of similar historical risks, determine the risk type, risk probability, and risk level.

[0005] In this embodiment of the application, obtaining the contract feature vector based on the digital contract includes: Obtain a general semantic vector based on the digital contract; Based on the general semantic vector, the contract semantic features are obtained by dimensionality reduction. Based on the contract semantic features and the preset data interaction dimensions, the data interaction features are obtained; Based on the aforementioned digital contract and the pre-set compliance knowledge base, compliance characteristics are obtained; A contract feature vector is obtained by fusing the contract semantic features, the compliance features, and the data interaction features.

[0006] In this embodiment of the application, the preset risk feature library includes a compliance feature sub-library and a case feature sub-library. The compliance feature sub-library includes compliance rule feature vectors, and the case feature sub-library includes default feature vectors. The process of matching the contract feature vector and the real-time behavior time-series feature vector with a preset risk feature database to obtain historical risk feature vectors includes: The target compliance rule feature vector is obtained by querying the compliance feature sub-database based on the compliance features in the contract feature vector; The target default feature vector is obtained by querying the case feature sub-database based on the real-time behavior time-series feature vector; The historical risk feature vector is obtained by fusing the target compliance rule feature vector and the target default feature vector.

[0007] In this embodiment of the application, based on the compliance features in the contract feature vector, a similarity match is performed with each compliance rule feature vector in the compliance feature sub-library, and the compliance rule feature vector with the highest similarity is taken as the target compliance rule feature vector; Based on the similarity matching between the real-time behavior time-series feature vector and each default feature vector in the case feature sub-library, the default feature vector with the highest similarity is taken as the target default feature vector.

[0008] In this embodiment of the application, after obtaining the risk type, risk probability, and risk level, the method further includes: Based on the risk type, the risk probability, the risk level, and the environmental operation feature vector, a global state vector is determined. Control commands are determined based on the global state vector.

[0009] In this embodiment of the application, before executing the digital contract, the method further includes: Based on the general semantic vector of the digital contract, a similarity match is performed with the text vectors of each default case in the case feature sub-library. If the similarity between the general semantic vector and the text vector of any default case exceeds a similarity threshold, a preset instruction is triggered.

[0010] Secondly, embodiments of this application provide a risk assessment apparatus for a trusted data space, which has the function of implementing the risk assessment method for a trusted data space corresponding to the first aspect described above. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above function, and the modules can be software and / or hardware.

[0011] In one embodiment, the risk assessment device for the trusted data space includes: The input / output module is used to acquire digital contracts in the trusted data space, as well as real-time behavioral data when executing the digital contracts; The processing module obtains the contract feature vector based on the digital contract; Based on the real-time behavior data, obtain the real-time behavior time-series feature vector; Based on the contract feature vector and the real-time behavior time series feature vector, as well as the preset risk feature library, the historical risk feature vector is determined; Based on the historical risk feature vector, determine the temporal evolution characteristics of similar historical risks; based on the contract semantic feature vector, the real-time behavior temporal feature vector, and the temporal evolution characteristics of similar historical risks, determine the risk type, risk probability, and risk level.

[0012] Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the risk assessment method for a trusted data space as described in the first aspect.

[0013] Fourthly, embodiments of this application provide a computing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the risk assessment method for trusted data space described in the first aspect.

[0014] The processing results are then output through this communication interface. This communication interface can be an input / output interface.

[0015] Fifthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute the risk assessment method for trusted data space provided in the first aspect.

[0016] Compared to existing technologies, the embodiments of this application, in risk assessment, first extract contract feature vectors based on digital contracts, then extract real-time behavior time-series feature vectors based on real-time behavior data, and then perform similarity matching between the contract feature vectors and real-time behavior time-series feature vectors and a preset risk feature library to obtain historical risk feature vectors. Based on the historical risk feature vectors, historical similar risk time-series evolution features are extracted. The historical similar risk time-series evolution features can reflect the time-series change pattern of historical similar risks from normal execution to default threshold and then to default. Finally, a comprehensive risk assessment is conducted based on the contract feature vectors, real-time behavior time-series feature vectors, and historical similar risk time-series evolution features. On the one hand, it can assess whether real-time behavior is risky at present; on the other hand, it can also predict potential risk trends based on historical similar risk time-series evolution features. Attached Figure Description

[0017] The objectives, features, and advantages of the embodiments of this application will become readily understood by referring to the accompanying drawings and the detailed description of the embodiments. Wherein: Figure 1 This is a flowchart illustrating a risk assessment method for a trusted data space according to an embodiment of this application. Figure 2 This is a schematic diagram of the structure of a risk assessment device for a trusted data space according to an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a computing device according to an embodiment of this application; Figure 4 This is a schematic diagram of a server structure in one embodiment of this application.

[0018] In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts. Detailed Implementation

[0019] The terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or modules is not necessarily limited to those explicitly listed, but may include other steps or modules not explicitly listed or inherent to these processes, methods, products, or devices. The division of modules in the embodiments of this application is merely a logical division; in actual applications, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be omitted or not performed. Additionally, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interface, indirect coupling between modules, or electrical or other similar forms of communication connection, none of which are limited in the embodiments of this application. Furthermore, the modules or sub-modules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed among multiple circuit modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of this application.

[0020] This application also provides a risk assessment method, related apparatus, and storage medium for trusted data spaces, which can be applied to risk assessment systems in trusted data space scenarios. The risk assessment system may include an input / output module and a processing module.

[0021] The solutions provided in this application involve technologies such as Artificial Intelligence (AI) and Machine Learning (ML), and are specifically illustrated through the following embodiments: AI, or Artificial Intelligence, refers to the theories, methods, technologies, and application systems that utilize digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, Artificial Intelligence is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine capable of reacting in a manner similar to human intelligence. Artificial Intelligence studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0022] AI technology is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0023] In existing technologies, risk assessment is mostly based on current behavioral data and the corresponding terms in digital contracts to determine whether the current behavior is risky. For behaviors that have not defaulted at the current moment but have a tendency to default, current risk assessment methods cannot identify them in advance. Therefore, existing risk assessment methods are often lagging.

[0024] Compared to existing technologies, the embodiments of this application, in risk assessment, first extract contract feature vectors based on digital contracts, then extract real-time behavior time-series feature vectors based on real-time behavior data, and then perform similarity matching between the contract feature vectors and real-time behavior time-series feature vectors and a preset risk feature library to obtain historical risk feature vectors. Based on the historical risk feature vectors, historical similar risk time-series evolution features are extracted. The historical similar risk time-series evolution features can reflect the time-series change pattern of historical similar risks from normal execution to default threshold and then to default. Finally, a comprehensive risk assessment is conducted based on the contract feature vectors, real-time behavior time-series feature vectors, and historical similar risk time-series evolution features. On the one hand, it can assess whether real-time behavior is risky at present; on the other hand, it can also predict potential risk trends based on historical similar risk time-series evolution features.

[0025] The computing device involved in the embodiments of this application may be a server.

[0026] The server involved in the embodiments of this application can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0027] Reference Figure 1 , Figure 1 This is a flowchart illustrating a risk assessment method for a trusted data space provided in an embodiment of this application. The method can be executed by a risk assessment device for a trusted data space. The method includes steps S100-S500: S100: Obtain the digital contract in the trusted data space, and the real-time behavioral data when executing the digital contract.

[0028] In this embodiment, the digital contract can be directly obtained through the data interface of the trusted data space, and the real-time behavioral data of executing the digital contract can be obtained through the data interface of the monitoring system associated with the trusted data space. The real-time behavioral data may include multi-source data such as access logs, operation logs, permission change records, data transmission logs, system operation status data, contract fulfillment progress data, IP access information, access time, terminal device information, operation type, and data access volume.

[0029] S200: Obtain the contract feature vector based on the digital contract.

[0030] In this embodiment of the application, the contract feature vector can be obtained through the following steps S210-S240: In this embodiment of the application, when obtaining the contract feature vector based on the digital contract, it can be obtained based on a preset contract feature extraction model.

[0031] In this embodiment of the application, the contract feature extraction model can be a language model with BERT model as its core architecture, which may specifically include an input layer, an encoding layer, a task adaptation layer and an output layer.

[0032] In this embodiment, the input layer can use a combination of token embedding, segment embedding, and position embedding to convert the input text into a vector form that can be processed by the BERT model.

[0033] The encoding layer is based on the BERT model and consists of multiple layers of identical bidirectional Transformer encoders stacked together. Each encoder contains a multi-head self-attention mechanism and a feed-forward network. The multi-head self-attention mechanism is used to capture the dependencies between words at different positions in the input text to achieve bidirectional semantic understanding of the context. The feed-forward network is used to perform non-linear transformation on the text features output by the multi-head attention mechanism, outputting a fixed 768-dimensional global semantic feature (the standard output dimension of the BERT model), where the 768-dimensional global semantic feature is a general semantic feature at the semantic level.

[0034] The task adaptation layer follows the encoding layer and is used to map high-dimensional global semantic features to low-dimensional specific features. Specific features refer to features of a fixed dimension associated with digital contracts.

[0035] In this embodiment, the task adaptation layer may include a linear dimensionality reduction layer and a multi-feature branch layer.

[0036] The linear dimensionality reduction sublayer is used to receive the high-dimensional global semantic features output by the encoding layer. Through a linear transformation matrix, the high-dimensional global semantic features are mapped to 50 specific semantic features. These 50 specific semantic features are 50 specific contract semantic features related to digital contracts, thereby achieving the adaptation of general semantics to digital contract-specific semantics.

[0037] In this embodiment, the multi-feature branch layer includes a first branch and a second branch. The input layer is further used to send a digital contract to the first branch, which in turn is used to obtain 30-dimensional compliance features based on the received digital contract. The second branch is used to obtain 48-dimensional data interaction features based on the 50-dimensional contract semantic features output by the linear dimensionality reduction layer.

[0038] In this embodiment, the output layer can use the softmax activation function to normalize the 50-dimensional contract semantic features, 30-dimensional compliance features, and 48-dimensional data interaction features, and then concatenate them to generate a 128-dimensional contract feature vector, which serves as the final output of the contract feature extraction model.

[0039] In this embodiment, the contract feature extraction model can employ a multi-task joint loss function during training to constrain the outputs of the three branches of the task adaptation layer. For example, mean squared error loss can be used for the 50-dimensional contract semantic feature branch to ensure that the dimensionality-reduced contract semantic features fit the labeled tags; binary cross-entropy loss can be used for the 30-dimensional compliance feature branch to constrain the 0 / 1 classification accuracy of the compliance features; and mean squared error loss can be used for the 48-dimensional data interaction feature branch to constrain the numerical fitting of the interaction attributes.

[0040] In this embodiment of the application, the AdamW optimizer can be used when training the contract feature extraction model to minimize the joint loss of multiple tasks.

[0041] The training methods for the three branches will be explained in detail below.

[0042] For the 50-dimensional contract semantic feature branch In this application embodiment, the 50-dimensional contract semantic features include 50 specific dimensions of semantic features. These include: contract subject features, rights and obligations features, time threshold features, scope of authority features, data usage purpose features, performance conditions features, breach of contract clause features, termination condition features, data ownership features, data scope features, usage period features, storage period features, data destruction features, confidentiality clause features, dispute resolution features, jurisdiction agreement features, compensation clause features, audit clause features, notification obligation features, contract modification features, contract termination features, force majeure features, data quality features, data source features, processing purpose features, minimum necessity features, anonymization requirement features, cross-border transmission features, third-party sharing features, security measures features, event reporting features, compliance audit features, record retention features, impact assessment features, exit mechanism features, data classification and grading features, access control features, identity authentication features, authorization management features, log retention features, data backup features, data migration features, service level features, availability requirement features, response timeliness features, change notification features, data verification features, integrity requirement features, traceability features, and disclaimer clauses—a total of 50 specific features across these dimensions.

[0043] In this embodiment of the application, the training of the 50-dimensional contract semantic feature branch includes a pre-training stage and a fine-tuning stage.

[0044] During the pre-training phase, training samples can utilize large-scale general text corpora. For example, basic legal corpora (such as original texts of laws and regulations related to data security and contracts, including the Data Security Law, the Contract Law section of the Civil Code, and relevant GDPR clauses) and industry compliance norms, enabling the trained BERT model to master basic semantics and professional terminology in the legal field (such as data ownership, liability for breach of contract, and anonymization).

[0045] The pre-training phase mainly includes two training tasks: MLM (Masked Language Model) and NSP (Next Sentence Prediction).

[0046] Among them, the MLM task can randomly mask some words in the training samples, allowing the BERT model in the encoding layer to extract the masked words and learn the semantic associations between text contexts; the NSP task can determine whether two sentences are consecutive sentences, allowing the BERT model to learn the logical relationship between sentences.

[0047] During the fine-tuning phase, training samples can utilize historical digital contracts from a trusted data space. These historical digital contracts should cover as many types of terms as possible, such as: scope of data use, permissions, duration, storage, transmission, destruction, liability for breach of contract, and compliance requirements.

[0048] In this embodiment of the application, the training samples in the fine-tuning stage can be labeled manually.

[0049] In this embodiment of the application, the labels of the training samples in the fine-tuning stage may include two types: semantic category labels and semantic fine-classification labels.

[0050] The semantic category labels can correspond to features in each dimension of the 50-dimensional contract semantic features. Examples include: contract subject, usage period, scope of permissions, and liability for breach of contract. Each label corresponds to a contract semantic feature dimension, used to indicate whether a clause in the training sample contains that type of contract semantic feature. For example, if a clause contains "Party A has the right to use the data for 30 days," then it would be labeled with two contract semantic feature labels: "Contract Subject" and "Usage Period."

[0051] Semantic fine-classification labels supplement and subdivide the core dimensions of the 50-dimensional contract semantic features. For example, the label "scope of permissions" is further subdivided into sub-labels such as "internal access", "external sharing", and "cross-organizational access" to improve the granularity of contract semantic features extracted by the contract feature extraction model.

[0052] In this embodiment, the digital contracts in the training samples can be in formats such as PDF, JSON, scanned documents, and Word documents. Therefore, different formats of digital contracts can be processed before training, for example: If the digital contract is in JSON format, the structured data (such as key-value pairs of contract terms) can be read directly, and the text content (such as terms description, responsible parties, etc.) can be extracted to obtain a plain text digital contract.

[0053] If the digital contract is in PDF format, such as a scanned image, then OCR technology (such as Tesseract) can be used to recognize the text in the image to obtain a plain text digital contract. If it is a native PDF containing text layers, the text content can be extracted directly to obtain a plain text digital contract.

[0054] After processing the training samples to obtain the plain text digital contracts, further preprocessing is possible. For example, the plain text digital contracts can be segmented into short sentences, each sentence can be segmented by word, and a [CLS] symbol can be added at the beginning of each sentence, as well as a [SEP] symbol can be added between sentences and at the end of sentences.

[0055] For example, suppose a short sentence is "The data usage period shall not exceed 30 days".

[0056] After splitting and adding symbols, it can be represented as: "[CLS] Data usage period shall not exceed 30 days [SEP]".

[0057] In this embodiment of the application, the segmented and symbolized training samples can also be mapped to word vectors for recognition by the contract feature extraction model.

[0058] For example, “[CLS]”, “data”, “use”, “term”, “must not”, “exceed”, “30”, “day”, and “[SEP]” can be mapped to word vectors respectively.

[0059] At this point, the word vector corresponding to each training sample can be input into the contract feature extraction model.

[0060] When optimizing the 50-dimensional contract semantic feature branch, the dimensionality reduction parameters of the fully connected layer can be optimized to ensure that the core semantic information is not lost after the 768-dimensional global semantic features are reduced to 50 dimensions, thus ensuring that the 50-dimensional contract semantic features can fully represent the overall semantics of the contract terms.

[0061] For the 30-dimensional compliance feature branch In this application embodiment, when the 30-dimensional compliance feature branch obtains the 30-dimensional compliance features based on the digital contract, it can be based on a preset compliance knowledge base, regular expressions, or named entity recognition tools.

[0062] In this embodiment of the application, the compliance knowledge base includes compliance rules in 30 dimensions, as detailed below: Rule 1: Data collection requires the explicit consent of the data subject, and consent can be withdrawn.

[0063] Rule 2: The scope of data collected must be consistent with the intended use as agreed in the contract, and there must be no collection beyond the scope.

[0064] Rule 3: When collecting personal data, the data subject must be clearly informed of the purpose of collection, the scope of use, and the retention period.

[0065] Rule 4: Collection of sensitive personal data unrelated to the contract (such as biometrics, religious beliefs, etc.) is prohibited. If collection is necessary, additional specific consent must be obtained.

[0066] Rule 5: Data collection methods must be legal; data must not be stolen or illegally obtained.

[0067] Rule 6: The data storage period shall not exceed the period stipulated in the contract and in accordance with laws and regulations.

[0068] Rule 7: Sensitive data storage must employ security technologies such as encryption and data anonymization.

[0069] Rule 8: Storage devices must meet the requirements for trusted data space and trusted management, and have security protection capabilities.

[0070] Rule 9: Stored data must be backed up regularly and have data recovery capabilities.

[0071] Rule 10: It is prohibited to store contractually restricted data on unauthorized overseas servers.

[0072] Rule 11: Data usage must strictly adhere to the scope of use stipulated in the contract and must not exceed the agreed purpose.

[0073] Rule 12: Data must not be illegally processed or tampered with; data authenticity must be ensured.

[0074] Rule 13: If the sensitivity of desensitized data is restored after secondary processing, compliance approval must be carried out again.

[0075] Rule 14: During the use of data, usage logs must be recorded to achieve full traceability.

[0076] Rule 15: Contractual data must not be shared or disclosed to unauthorized third parties.

[0077] Rule 16: Data usage must comply with industry standards and be compatible with the Trusted Data Space operation rules.

[0078] Rule 17: Data transmission must be encrypted to ensure the security of the transmission process.

[0079] Rule 18: Cross-entity and cross-space data transmission requires approval procedures and must comply with the Trusted Data Space Interconnection and Interoperability Specifications.

[0080] Rule 19: Cross-border data transfers must comply with export control requirements and undergo security review procedures.

[0081] Rule 20: The data transmitted must be consistent with the transmission destination; irrelevant data transmission is prohibited.

[0082] Rule 21: Data transmission must be recorded to ensure traceability.

[0083] Rule 22: Once the data reaches the end of its storage period or the contract is terminated, it must be completely destroyed as stipulated and cannot be recovered.

[0084] Rule 23: Data destruction process must be documented, including destruction time, method, and responsible person.

[0085] Rule 24: If a third party is entrusted to destroy data, an entrustment agreement must be signed to clarify the responsibilities of the third party.

[0086] Rule 25: All parties to the contract must designate a data security officer and management organization to ensure the implementation of security responsibilities.

[0087] Rule 26: Conduct data security risk assessments regularly and report potential risks in a timely manner.

[0088] Rule 27: Compliance audits must cover the entire data lifecycle and retain audit records.

[0089] Rule 28: Conduct regular self-inspections of the compliance of data processing activities and promptly rectify any violations.

[0090] Rule 29: Cooperate with the supervision and inspection of the trusted data space regulator and provide relevant data and records.

[0091] Rule 30: When violating compliance rules, clear corrective measures and accountability mechanisms must be in place.

[0092] The 30 compliance rules in the aforementioned compliance knowledge base were designed in conjunction with GDPR, the Data Security Law, and the Trusted Data Space Operation Specifications, covering the core compliance scenarios of digital contracts in the Trusted Data Space. Each rule corresponds to one of the 30 compliance characteristics: Rules 1-5 correspond to data collection compliance rules, Rules 6-10 correspond to data storage compliance rules, Rules 11-16 correspond to data usage compliance rules, Rules 17-21 correspond to data transmission compliance rules, Rules 22-24 correspond to data destruction compliance rules, and Rules 25-30 correspond to entity responsibility and compliance audit compliance rules.

[0093] In this embodiment of the application, regular expressions are used to extract pre-defined keywords from digital contracts, such as: data subject, explicit consent, encrypted transmission, storage period, overseas server, data destruction, etc. No training is required; the corresponding keywords in the contract can be extracted by pre-setting rules and matching the digital contract.

[0094] In this embodiment of the application, the named entity recognition tool can be obtained by training and fine-tuning based on the NER (Named Entity Recognition) model. The training process is as follows: The training data for training NER tools can be historical digital contracts from a trusted data space, and entity annotations can be performed on the training samples, such as naming entities for the data subject, data processor, data anonymization, and encrypted transmission of digital contracts in the training samples.

[0095] The labeled digital contracts are then proportionally divided into a training set (80%) and a validation set (20%), and input into the NER tool. The entity recognition threshold and attention weight of the NER tool are adjusted without modifying the underlying model architecture. The recognition logic for contract-specific entities is optimized to enhance sensitivity to data-related entities. For example, a custom entity dictionary is built to cover business entities such as data subjects, data processors, sensitive personal data, biometric data, cross-border transmission, storage periods, encryption algorithms, authorized terminals, third-party institutions, penalties for breach of contract, and security audits, thereby strengthening the recognition logic for contract-specific entities. Higher loss weights are assigned to data-related entities (sensitive data, cross-border, and permission-related entities) to enhance sensitivity. The recognition accuracy of the NER tool is tested using training samples from the validation set. If there are problems such as misidentification or omission, a small number of labeled samples are added for further fine-tuning. The training and validation process is repeated until the recognition accuracy of the NER tool reaches the preset requirements.

[0096] Once training is complete, a NER tool that can adapt to digital contracts in a trusted data space can be obtained. It can be directly used to extract key entities such as data subjects and data processors from digital contracts, so that each key entity can be matched with 30 rules in the compliance knowledge base one by one to determine the characteristics corresponding to each rule in the compliance knowledge base.

[0097] For example, for rule 1, each key entity is matched with rule 1. If it conforms to rule 1, the feature of the corresponding dimension of rule 1 is recorded as 1, otherwise it is recorded as 0. This process is repeated to obtain each of the 30-dimensional compliance features.

[0098] For the 48-dimensional data interaction feature branch In this embodiment, the data interaction characteristics may include 48 specific dimensions, such as: transmission frequency characteristics, encryption method characteristics, storage location characteristics, access limit characteristics, data type characteristics, operating subject characteristics, terminal requirement characteristics, transmission protocol characteristics, bandwidth requirement characteristics, latency requirement characteristics, connection method characteristics, authentication method characteristics, authorization method characteristics, log recording characteristics, audit trail characteristics, data format characteristics, data volume characteristics, interaction frequency characteristics, session duration characteristics, retry policy characteristics, timeout setting characteristics, circuit breaker mechanism characteristics, rate limiting policy characteristics, data verification characteristics, signature method characteristics, key management characteristics, certificate requirement characteristics, IP whitelist characteristics, device fingerprint characteristics, geofencing characteristics, time window characteristics, concurrency limit characteristics, API version characteristics, callback address characteristics, data anonymization characteristics, watermark requirement characteristics, traceability identifier characteristics, data compression characteristics, batch processing characteristics, priority characteristics, idempotency characteristics, data partitioning characteristics, caching policy characteristics, synchronization mode characteristics, exception handling characteristics, data retention characteristics, access mode characteristics, and security level characteristics.

[0099] In this embodiment of the application, when the 48-dimensional data interaction feature branch is derived from the 50-dimensional contract semantic features, it can be based on the semantic role labeling model.

[0100] The semantic role labeling model can be trained on the basis of the SLR (Simple Linear Regression) model. The semantic role labeling model is used to identify the relevant roles of "actions" in digital contracts. Such as: action subject (who does it), action object (to whom / what it does), action method (how it is done), etc.

[0101] In this embodiment, the SLR model can use the aforementioned encoding layer as its underlying foundation, and the core neural network architecture follows the BERT architecture, without the need for a separate underlying structure design. The core function of the BERT model is to extract high-dimensional global semantic features of digital contracts and reduce the dimensionality to 50-dimensional contract semantic features through a 50-dimensional contract semantic feature branch. The core function of the SLR model is to extract the action subject, action object, and action method based on the 50-dimensional contract semantic features.

[0102] In this embodiment, the training data for training the SLR model can be the training samples of the BERT model, with supplementary annotations added to these training samples. Supplementary annotations are performed manually according to the 48-dimensional data interaction features, clearly defining the subject, object, and execution method of each type of operation; for dimensions not explicitly defined in the contract, default values ​​are uniformly annotated, and the annotation rules are consistent with the inference filling rules.

[0103] During training, the 48-dimensional predicted features output by the SLR model are compared with manually labeled tags. The mean squared error loss is used to calculate the loss of this branch, and it is also used in the multi-task joint loss calculation of the overall contract feature extraction model.

[0104] In this embodiment of the application, the contract feature extraction model adopts a multi-task joint loss function in the above manner to constrain the outputs of the three branches of the adaptation layer respectively. The training of the contract feature extraction model is completed after the joint loss converges.

[0105] In this embodiment, by setting 50-dimensional contract semantic features, 30-dimensional compliance features, and 48-dimensional data interaction features, the core semantics of contract terms in digital contracts can be fully captured, covering various compliance requirements of mainstream digital contracts and encompassing all risk points in the entire data flow process. Furthermore, the 128-dimensional contract semantic features can be adapted to the 768-dimensional global semantic features output by the encoding layer, as well as the input requirements of the subsequent real-time risk identification model. This ensures feature richness while avoiding model redundancy and low computational efficiency caused by excessive dimensionality, and also reduces the risk of overfitting. Additionally, fixing the 50, 30, and 48-dimensional division allows for standardized comparison of the contract semantic features of different digital contracts.

[0106] Furthermore, in the application embodiment, for the output 128-dimensional contract semantic features, if any digital contract lacks any or more relevant features in any of the 128 dimensions, default values ​​can be used to fill in the missing features. For example, "no relevant agreement," "unclear," or "does not meet default compliance requirements" can be filled in the corresponding dimensions.

[0107] Input the digital contract obtained in step S100 into the trained contract semantic feature extraction model to obtain the corresponding 128-dimensional contract feature vector, as detailed in steps S211-S215: S211: Obtain a general semantic vector based on the digital contract.

[0108] S212: Based on the general semantic vector, the contract semantic features are obtained by dimensionality reduction.

[0109] S213: Based on the contract semantic features and the preset compliance knowledge base, obtain the compliance features.

[0110] S214: Based on the contract semantic features and the preset data interaction dimensions, obtain the data interaction features.

[0111] S215: Obtain a contract feature vector by concatenating the contract semantic features, the compliance features, and the data interaction features.

[0112] The specific methods for steps S211-S215 can be found in the training process of the contract feature extraction model, and will not be elaborated here.

[0113] Additionally, it should be noted that the digital contract obtained in step S100 can be format-processed and preprocessed according to the training sample format processing and preprocessing process during the training of the contract feature extraction model, and then input into the trained contract feature extraction model.

[0114] S300: Obtain the real-time behavior time-series feature vector based on the real-time behavior data.

[0115] In this embodiment, the real-time behavioral data of executing digital contracts may include structured numerical data and unstructured text logs. Therefore, after obtaining the contract execution data, the real-time behavioral data can be preprocessed.

[0116] For example, for text-based logs (access logs, operation logs, alarm texts, etc.), the preprocessing rules of training samples during the training of the contract feature extraction model can be used to segment the data, and [CLS] and [SEP] identifiers can be added to the beginning and end of the sentences before mapping them to word vectors.

[0117] For numerical data (access frequency, transmission traffic, response time, access duration, etc.), missing value filling, outlier removal, and maximum / minimum value normalization can be performed to constrain the values ​​within a uniform range.

[0118] For categorized data (IP internal / external attributes, operating time, device authorization status, operation type, etc.), one-hot encoding or feature labeling can be used to convert them into standardized numerical features.

[0119] After preprocessing real-time behavioral data, basic risk features can be extracted based on the preprocessed real-time behavioral data. These basic risk features can include 32 dimensions such as IP address attribution, access time period, terminal device, access frequency, data operation type, data sensitivity level, permission change, system response, and performance deviation.

[0120] In this embodiment of the application, each type of risk basic feature at a single moment can be quantified into a corresponding value to form a basic feature set at a single moment. The basic feature sets corresponding to each moment can be arranged in chronological order to obtain the real-time behavior chronological feature vector.

[0121] In addition, in this embodiment of the application, to avoid lag in the real-time behavior data processing, the acquired real-time behavior data can be processed in batches according to a fixed sliding window. For example, every 10 pieces of real-time behavior data form a sliding window, and 10 pieces of real-time behavior data are processed at a time to obtain the real-time behavior time-series feature vector corresponding to the 10 pieces of real-time behavior data.

[0122] S400: Based on the contract feature vector and the real-time behavior time-series feature vector, perform similarity matching with the preset risk feature library to obtain the historical risk feature vector.

[0123] In this embodiment of the application, when obtaining historical risk feature vectors, similarity matching can be performed between contract feature vectors and real-time behavior time series feature vectors and a preset risk feature library.

[0124] In this embodiment of the application, the preset risk feature library may include a compliance feature sub-library and a case feature sub-library.

[0125] In this embodiment of the application, the compliance feature sub-library includes 30 library records, each library record corresponds to a compliance feature vector, and each compliance feature vector has a dimension of 30. Each compliance feature vector can be obtained as a 30-dimensional compliance feature vector according to the rule of 0 / 1 binary vectors.

[0126] In addition, in this embodiment of the application, each compliance feature vector can be associated with its corresponding compliance rule text and the keywords corresponding to the compliance rule text in the compliance feature sub-library.

[0127] In this embodiment, the TextRank algorithm can be used to extract compliance keywords from the original text corresponding to each compliance rule. The keywords can be pre-classified as follows: Data collection categories: data minimization, explicit consent, withdrawal of consent, sensitive data, personal data; Data storage categories: storage period, encrypted storage, data backup, overseas storage, and de-identified storage; Data usage categories: usage restrictions, tamper-proofing, anonymization, secondary processing, usage logs; Data transmission: encrypted transmission, cross-border transmission, approval procedures, transmission records, and interoperability; Data destruction categories: complete destruction, destruction record, entrusted destruction, accountability. Compliance-related responsibilities: safety officer, risk assessment, compliance audit, self-inspection and rectification, accountability; Specific rights include: the right to be forgotten (GDPR specific), the right to know, the right to access, and the right to correction. In this application embodiment, the original text of the compliance rule associated with each compliance feature vector can be determined based on keywords, such as: The keyword "data minimization" is related to Article 5 of the GDPR and Article 32 of China's Data Security Law; The keyword "right to be forgotten" is related to Article 17 of the GDPR; The keyword "cross-border transmission" is related to Article 48 of the GDPR and Article 31 of China's Data Security Law.

[0128] In this embodiment of the application, when constructing the case feature sub-library, the original case data can be obtained first. For example, collect cases of contract defaults and data violations from the trusted data space and industry over the past 5 years. The cases can cover typical default scenarios such as unauthorized data use, unauthorized access, unauthorized cross-border transmission, and abuse of permissions.

[0129] After obtaining the original case data, each case data is uniformly cleaned to remove invalid information, duplicate content, and garbled characters. Then, core information is extracted according to a preset template to complete the conversion of unstructured text into structured data. The preset template can include the following fields: time of breach, parties involved, data types involved, corresponding clauses of the violation, rectification requirements, and penalty results.

[0130] After obtaining the structured case data, the default features of each case data can be extracted according to the 32-dimensional features mentioned above when obtaining the time series feature vector. Each default feature vector is also 32-dimensional.

[0131] When extracting default features, for structured content such as time, amount, and IP location, regular expressions can be used to directly extract feature values; for unstructured text content such as case description and violation details, semantic features can be extracted based on natural language processing technology. The combination of feature values ​​and semantic features extracted from each case data is the default feature vector corresponding to that default case, and the default feature vectors corresponding to each default case constitute the case feature sub-library.

[0132] In this embodiment of the application, after obtaining the preset risk feature library, the historical risk feature vector can be obtained based on the following steps S410-S430: S410: Based on the compliance features in the contract feature vector, the target compliance rule feature vector is obtained by querying the compliance feature sub-library.

[0133] In step S200, a contract feature vector is obtained, which includes 30 compliance features. In step S410, the target compliance feature vector can be obtained by querying the compliance feature sub-library based on the 30 compliance features in the contract feature vector.

[0134] Specifically, based on the compliance features in the contract feature vector, similarity matching can be performed with each compliance rule feature vector in the compliance feature sub-library. The compliance rule feature vector with the highest similarity is taken as the target compliance rule feature vector. The compliance rule feature vector with the highest similarity to the compliance features represents the most suitable compliance rule for constraining the current real-time behavior given the current digital contract characteristics. S420: Based on the real-time behavior time-series feature vector, the target default feature vector is obtained from the case feature sub-library.

[0135] In step S300, a 32-dimensional real-time behavior time-series feature vector is obtained. In step S420, based on the real-time behavior time-series feature vector, and considering that the case feature sub-library includes multiple default cases, each default case corresponding to a 32-dimensional default feature vector, similarity matching can be performed between the real-time time-series feature vector and each default feature vector. The default feature vector with the highest similarity is selected as the target default feature vector. The default feature vector with the highest similarity to the real-time behavior sequence feature vector represents the historical default case most similar to the real-time behavior of executing the current digital contract.

[0136] S430: The historical risk feature vector is obtained by fusing the target compliance rule feature vector and the target default feature vector.

[0137] In this embodiment of the application, when fusing the target compliance rule vector and the target default feature vector, a weighted fusion method can be used. The resulting historical risk feature vector includes similar risk cases and corresponding compliance rules from the past. The weighting can be done by average weighting or by assigning appropriate weights based on historical experience.

[0138] S500: Determine the time-series evolution characteristics of similar historical risks based on the historical risk feature vector.

[0139] S600: Based on the contract feature vector, the real-time behavior time series feature vector, and the historical similar risk time series evolution characteristics, determine the risk type, risk probability, and risk level.

[0140] In this embodiment, steps S500 and S600 can be performed simultaneously. For example, steps S500 and S600 can be performed simultaneously based on the implementation of the risk identification model. In this embodiment, after obtaining the contract feature vector, real-time behavior time-series feature vector, and historical risk feature vector, these vectors can be input into a preset real-time risk identification model. The real-time risk identification model can first extract the time-series evolution features of similar historical risks based on the historical risk feature vector, and then combine the contract feature vector and the real-time behavior time-series feature vector to determine the risk type, risk probability, and risk level.

[0141] In this embodiment, the real-time risk identification model includes an input layer, a temporal evolution analysis layer, a feature fusion layer, a temporal feature extraction layer, and a multi-task output layer.

[0142] The input layer receives contract feature vectors, real-time behavior time-series feature vectors, and historical risk feature vectors, and performs format normalization and numerical normalization on each data. The processed contract feature vectors and real-time behavior time-series feature vectors are then sent to the feature fusion layer, and the processed historical risk feature vectors are sent to the time-series evolution parsing layer.

[0143] The temporal evolution analysis layer can perform temporal decomposition and analysis on the input historical risk feature vector. The historical risk feature vector is obtained by weighted fusion of the target compliance rule vector and the target default feature vector. The core temporal dimension carries the complete trajectory of historical similar default behaviors. The temporal evolution analysis layer extracts the temporal evolution features of historical similar risks from the historical risk feature vector through linear mapping and temporal segmentation operations. These features reflect the complete temporal change pattern of similar risks from normal operation, critical anomalies to complete default, and therefore can serve as a reference for subsequent risk trend projection. Furthermore, the historical similar risk temporal evolution features extracted by the temporal evolution analysis layer are also output to the feature fusion layer.

[0144] The feature fusion layer can use a fully connected network, based on a learned weight matrix, to explore the correlation between the static rules, real-time dynamic behavior, and historical risk cases of digital contracts, eliminate differences in different feature spaces, achieve deep fusion of contract feature vectors, real-time behavior time series feature vectors, and historical similar risk time series evolution features, and output a unified dimension of comprehensive fused features to the time series feature extraction layer.

[0145] The temporal feature extraction layer can use a bidirectional LSTM with an attention layer. The comprehensive fusion features output by the feature fusion layer are used as the input of the temporal sequence. The bidirectional LSTM captures both forward and reverse temporal dependencies at the same time, and a multi-head attention mechanism is superimposed to automatically allocate weights to focus on abnormal temporal segments, such as dangerous behavior sequences like increased access frequency or cross-time period logins from different locations. This strengthens the representation of risk-related temporal features and captures the temporal correlation and abnormal patterns of continuous real-time behavior sequences.

[0146] The task output layer can be configured with classification branches and regression branches. The classification branch outputs the risk type, while the regression branch outputs the probability of risk occurrence, and, based on a preset probability threshold, classifies the risk into three levels: low, medium, and high.

[0147] In this embodiment of the application, when training the real-time risk identification model, the training data can be historical behavior samples from a trusted data space. Each historical behavior sample is associated with a digital contract, a full-cycle real-time behavior log, and labeled historical risk records.

[0148] After obtaining each historical sample, the contract feature vector of the digital contract associated with each historical behavior, the real-time behavior time series feature vector corresponding to each historical behavior sample, and the historical risk feature vector corresponding to each historical behavior sample can be extracted based on the contract feature extraction model. Each historical behavior sample can be manually labeled, and risk type label, risk probability label, and risk level label can be added.

[0149] In addition, the training samples can be divided into training set, validation set, and test set according to a certain ratio.

[0150] During training, the real-time risk identification model can employ a multi-task joint loss function, such as using cross-entropy loss to constrain risk type classification tasks and mean squared error loss to constrain risk probability regression tasks.

[0151] In this embodiment, the AdamW optimizer can be used to optimize and iterate the real-time risk identification model until the multi-task joint loss converges.

[0152] In this embodiment, when applying the trained real-time risk identification model, the contract feature vector, real-time behavior time-series feature vector, and historical risk feature vector are input into the model. This allows the model to output the risk type, probability, and level of potential risks under the current digital contract and real-time behavior data. Since risk assessment involves similarity matching within a historical risk feature database, and the resulting historical risk feature vectors contain similar historical risk cases and corresponding compliance rules, the risk assessment can not only determine whether a risk exists currently, but also assess whether a risk trend exists.

[0153] In this embodiment of the application, after determining the risk type, risk probability, and risk level, the method further includes the following steps S600-S610: S600: Determine the global state vector based on the risk type, the risk probability, the risk level, and the environmental operation feature vector.

[0154] In this embodiment, the global state vector can be obtained by concatenating risk type, risk probability, risk level, and environmental operating characteristics. For example, it can be obtained by concatenating using the following formula: S=Concat(C,P,L,E) Where S represents the global state vector, Concat() represents the concatenation operation, C represents the risk type, P represents the risk probability (P∈[0,1]), L represents the risk level, and E represents the environmental operation characteristics.

[0155] C, P, and L can be obtained based on step S500.

[0156] Environmental operational characteristics represent the multi-dimensional operational status of the Trusted Data Space, which may include dimensions such as data sensitivity level, contract fulfillment stage, operator permissions, real-time access traffic, and terminal device attributes. These characteristics can be collected in real-time using standardized data interfaces from the Trusted Data Space's monitoring system, contract management module, and device management module.

[0157] S610: Determine control instructions based on the global state vector.

[0158] In this embodiment of the application, when generating control instructions based on the global state vector, they can be generated based on the PPO model.

[0159] In this embodiment, the PPO model can adopt a dual-network structure of a policy network and a value network. The policy network is used to output the probability distribution of different control actions based on the global state vector; the value network is used to output the value benefit of the control actions.

[0160] In this embodiment of the application, the training samples for training the PPO model can be historical running data in the trusted data space. Each piece of historical running data includes its global state vector during runtime, control action, the benefit after the control action is executed, and the global state vector at the next moment.

[0161] During training, the dominance function of the value network can be used to evaluate the dominance value of the control action. If the dominance value is greater than 0, it means that the PPO model can enhance the probability of the policy network selecting the control action. If the dominance value is less than 0, it means that the PPO model can reduce the probability of the policy network selecting the control action.

[0162] In addition, in the embodiments of this application, the loss function of the PPO model can be a truncated loss function constructed by combining probability ratios.

[0163] The probability ratio formula is as follows:

[0164] This is the old policy before the policy network update. This is the new policy after the policy network is updated. Represents control actions, Represents the old policy in the global state vector Output control actions The probability, This represents the new policy in the same global state vector. Output the same control action The probability, probability ratio The greater the deviation from 1, the greater the change in the new strategy; the smaller the deviation from 1, the smaller the change in the new strategy.

[0165] The loss function of the PPO model is as follows:

[0166] in, Represents the truncation loss function. The advantage value represents the output of the value network. Represents the unconstrained original evaluation item, clip ( ,1- 1+ ) This represents the evaluation item under the truncation constraint. To truncate the hyperparameters, a value of 0.1 or 0.2 is typically used to define the allowable deviation range between the old and new strategies. This represents the average value over all time intervals.

[0167] when In [1- 1+ When the network parameters are within the specified range, the normal optimization strategy applies. when Exceeding [1- 1+ When the range is ], use (1- ) or (1+ Truncation limits the update range of the policy network to avoid excessive deviation.

[0168] In this embodiment, by constructing a truncated loss function by combining probability ratios, the performance of the new policy can be evaluated on the one hand, and the probability ratios can be constrained within a fixed range on the other hand, which can limit the magnitude of policy network updates and ensure training stability.

[0169] In the embodiments of this application, the loss function can be minimized. With the goal of updating the parameters of the policy network through backpropagation, the process is repeated in multiple rounds until the model performance converges, thus completing the training of the PPO model.

[0170] In this embodiment of the application, after the PPO model has completed training, the global state vector obtained by S600 is input into the PPO model, and the policy network of the PPO model can obtain the probability distribution of each control action. The control action with the highest probability is taken as the target control action. After obtaining the target control action, control is performed according to the target control action.

[0171] In this embodiment of the application, control actions may include suspending the contract, restricting access, triggering a penalty for breach of contract, or executing normally.

[0172] In this embodiment of the application, before any new digital contract is executed, the method further includes: performing similarity matching between the general semantic vector of the digital contract and the text vectors of each default case in the case feature sub-library; if the similarity between the general semantic vector and the text vector of any default case exceeds a similarity threshold, a preset instruction is triggered.

[0173] In this embodiment, in step S200, the general semantic vector of the digital contract can be obtained based on the BERT model, with a dimension of 768. The text vector of each default case in the case feature sub-library can also be obtained based on the BERT model, also with 768 dimensions. Before executing the digital contract, at the general semantic level, the general semantic vector of the digital contract can be matched with the text vector of each default case one by one using cosine similarity. If any one of the similarities exceeds a preset similarity threshold, the new digital contract is determined to be a high-risk contract. At this time, a preset instruction can be triggered, such as triggering a manual review instruction. After the manual review is approved, the contract can be launched and executed.

[0174] In this embodiment of the application, during risk assessment, contract feature vectors are first extracted based on digital contracts, and real-time behavior time-series feature vectors are extracted based on real-time behavior data. Then, based on the contract feature vectors and real-time behavior time-series feature vectors, similarity matching is performed with a preset risk feature library to obtain historical risk feature vectors. These historical risk feature vectors contain similar risk cases in history and corresponding compliance rules. Then, a comprehensive risk assessment is conducted based on the contract feature vectors, real-time behavior time-series feature vectors, and historical risk feature vectors. On the one hand, it can assess whether real-time behavior is risky at present. On the other hand, based on similar default cases in history, it can also predict potential risk trends.

[0175] The above describes a risk assessment method for a trusted data space in the embodiments of this application. The following describes the risk assessment device (e.g., a server) for a trusted data space that performs the above-described risk assessment method for a trusted data space.

[0176] See Figure 2 ,like Figure 2The diagram shows a structural schematic of a risk assessment device for a trusted data space. The risk assessment device for a trusted data space in this embodiment of the application can achieve the corresponding [measures / functions] described above. Figure 1 The steps of the trusted data space risk assessment method executed in the corresponding embodiments are described above. The functions of the trusted data space risk assessment device can be implemented in hardware or by executing corresponding software within hardware. The hardware or software includes one or more modules corresponding to the above functions, and these modules can be software and / or hardware. The trusted data space risk assessment device may include an input / output module 601 and a processing module 602. The functional implementation of the processing module 602 and the input / output module 601 can be found in [reference missing]. Figure 1 The operations performed in the corresponding embodiments will not be described in detail here. For example, the processing module 602 can be used to control the sending, receiving, and acquiring operations of the input / output module 601.

[0177] The input / output module 601 is configured to acquire digital contracts in the trusted data space, as well as real-time behavioral data when executing the digital contracts. The processing module 602 is configured to obtain a contract feature vector based on the digital contract; Based on the real-time behavior data, obtain the real-time behavior time-series feature vector; Based on the contract feature vector and the real-time behavior time series feature vector, a similarity match is made with a preset risk feature library to obtain a historical risk feature vector. Based on the historical risk feature vector, determine the temporal evolution characteristics of similar historical risks; Based on the contract feature vector, the real-time behavior time series feature vector, and the historical similar risk time series evolution characteristics, the risk type, risk probability, and risk level are determined.

[0178] In some implementations, the processing module is further configured to: Obtain a general semantic vector based on the digital contract; Based on the general semantic vector, the contract semantic features are obtained by dimensionality reduction. Based on the contract semantic features and the preset data interaction dimensions, the data interaction features are obtained; Based on the aforementioned digital contract and the pre-set compliance knowledge base, compliance characteristics are obtained; The contract feature vector is obtained by fusing the semantic features, compliance features, and data interaction features.

[0179] In some implementations, the preset risk feature library includes a compliance feature sub-library and a case feature sub-library, wherein the compliance feature sub-library includes compliance rule feature vectors and the case feature sub-library includes default feature vectors; The process of matching the contract feature vector and the real-time behavior time-series feature vector with a preset risk feature database to obtain historical risk feature vectors includes: The target compliance rule feature vector is obtained by querying the compliance feature sub-database based on the compliance features in the contract feature vector; The target default feature vector is obtained by querying the case feature sub-database based on the real-time behavior time-series feature vector; The historical risk feature vector is obtained by fusing the target compliance rule feature vector and the target default feature vector.

[0180] In some implementations, the processing module is further configured to: Based on the compliance features in the contract feature vector, a similarity match is performed with each compliance rule feature vector in the compliance feature sub-library, and the compliance rule feature vector with the highest similarity is taken as the target compliance rule feature vector; Based on the similarity matching between the real-time behavior time-series feature vector and each default feature vector in the case feature sub-library, the default feature vector with the highest similarity is taken as the target default feature vector.

[0181] In some implementations, the processing module is further configured to: Based on the risk type, the risk probability, the risk level, and the environmental operation feature vector, a global state vector is determined. Control commands are determined based on the global state vector.

[0182] In some implementations, before executing the digital contract, the processing module is further configured to: Based on the general semantic vector of the digital contract, a similarity match is performed with the text vectors of each default case in the case feature sub-library. If the similarity between the general semantic vector and the text vector of any default case exceeds a similarity threshold, a preset instruction is triggered.

[0183] In this embodiment of the application, during risk assessment, the processing module 602 first extracts contract feature vectors based on digital contracts, extracts real-time behavior time-series feature vectors based on real-time behavior data, and then performs similarity matching with a preset risk feature library based on the contract feature vectors and real-time behavior time-series feature vectors to obtain historical risk feature vectors. Based on the historical risk feature vectors, it extracts historical similar risk time-series evolution features. The historical similar risk time-series evolution features can reflect the time-series change pattern of historical similar risks from normal execution to default threshold and then to default. Then, based on the contract feature vectors, real-time behavior time-series feature vectors, and historical similar risk time-series evolution features, a comprehensive risk assessment is conducted. On the one hand, it can assess whether the real-time behavior is risky at present. On the other hand, based on the historical similar risk time-series evolution features, it can also predict potential risk trends.

[0184] The risk assessment device 60 for the trusted data space in this application embodiment has been described above from the perspective of modular functional entities. The risk assessment device for the trusted data space in this application embodiment will be described below from the perspective of hardware processing.

[0185] It should be noted that, Figure 2 The physical device corresponding to the input / output module 601 shown can be a transceiver, radio frequency circuit, communication module, and input / output (I / O) interface, etc., and the physical device corresponding to the processing module 602 can be a processor.

[0186] Figure 2 The devices shown can all have the following characteristics: Figure 3 The structure shown, when Figure 2 The risk assessment device 60 for the trusted data space shown has the following characteristics: Figure 3 When the structure shown is used, Figure 3 The processor and transceiver in the device can perform the same or similar functions as the processing module 602 and input / output module 601 provided in the aforementioned device embodiments. Figure 3 The computer program that the memory storage processor in the memory needs to call when executing the aforementioned risk assessment method for trusted data space.

[0187] This application also relates to a chip system including at least one processor and an interface circuit. The processor includes a plurality of vector storage units. The processor is used to perform instruction and / or data interaction through the interface circuit, causing the chip system to perform the methods of any of the above embodiments.

[0188] In one possible implementation, the chip system may also directly include a memory in which computer programs or computer instructions are stored.

[0189] For example, the memory can be volatile memory or non-volatile memory, or may include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DRRAM).

[0190] This application also relates to a processor, which includes a plurality of storage units for calling computer programs or computer instructions stored in the memory to cause the processor to execute the methods described in any of the above embodiments.

[0191] For example, in the embodiments of this application, the processor is an integrated circuit chip with signal processing capabilities. For instance, the processor may be an FPGA, a general-purpose processor, a DSP, an ASIC, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, a SoC, a CPU, a network processor (NP), a microcontroller unit (MCU), a PLD, or other integrated chips, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. In one possible implementation, the embodiments of this application also provide a computer-readable storage medium storing program code, which, when executed on the computer, causes the computer to perform the above-described method embodiments.

[0192] This application also provides a server; please refer to [link / reference]. Figure 4 , Figure 4 This is a schematic diagram of a server structure provided in an embodiment of this application. The server 1100 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 1122 (e.g., one or more processors) and memory 1132, and one or more storage media 1130 (e.g., one or more mass storage devices) for storing application programs 1142 or data 1144. The memory 1132 and storage media 1130 may be temporary or persistent storage. The program stored in the storage media 1130 may include one or more modules (not shown in the figure), each module may include a series of instruction operations on the server. Furthermore, the CPU 1122 may be configured to communicate with the storage media 1130 and execute the series of instruction operations in the storage media 1130 on the server 1100.

[0193] Server 1100 may also include one or more power supplies 1126, one or more wired or wireless network interfaces 1150, one or more input / output interfaces 1158, and / or one or more operating systems 1141, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.

[0194] The steps performed by the server in the above embodiments can be based on this Figure 4 The structure of server 1100 is shown. For example, as in the above embodiment, it is... Figure 4 The steps performed by the data processing device 60 or the image processing device 70 shown can be based on this Figure 4 The server architecture is shown. For example, the central processing unit 1122 performs the following operations by calling instructions from memory 1132: The digital contracts in the trusted data space and the real-time behavioral data when executing the digital contracts are obtained through the input / output interface 1158. Obtain the contract feature vector based on the digital contract; Based on the real-time behavior data, obtain the real-time behavior time-series feature vector; Based on the contract feature vector and the real-time behavior time series feature vector, a similarity match is made with a preset risk feature library to obtain a historical risk feature vector. Based on the historical risk feature vector, determine the temporal evolution characteristics of similar historical risks; Based on the contract feature vector, the real-time behavior time series feature vector, and the historical similar risk time series evolution characteristics, the risk type, risk probability, and risk level are determined.

[0195] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0196] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0197] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, apparatuses, or modules, and may be electrical, mechanical, or other forms.

[0198] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0199] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0200] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0201] The computer program product includes one or more computer instructions. When the computer program is loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0202] The technical solutions provided in the embodiments of this application have been described in detail above. Specific examples have been used in the embodiments of this application to illustrate the principles and implementation methods of the embodiments of this application. The description of the above embodiments is only for the purpose of helping to understand the methods and core ideas of the embodiments of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the embodiments of this application. Therefore, the content of this specification should not be construed as a limitation on the embodiments of this application.

Claims

1. A risk assessment method for a trusted data space, characterized in that, The method includes: Obtain digital contracts in the trusted data space, as well as real-time behavioral data when executing the digital contracts; Obtain the contract feature vector based on the digital contract; Based on the real-time behavior data, obtain the real-time behavior time-series feature vector; Based on the contract feature vector and the real-time behavior time series feature vector, a similarity match is performed with a preset risk feature library to obtain a historical risk feature vector; Based on the historical risk feature vector, determine the temporal evolution characteristics of similar historical risks; Based on the contract feature vector, the real-time behavior time series feature vector, and the historical similar risk time series evolution characteristics, the risk type, risk probability, and risk level are determined.

2. The risk assessment method for a trusted data space as described in claim 1, characterized in that, The process of obtaining the contract feature vector based on the digital contract includes: Obtain a general semantic vector based on the digital contract; Based on the general semantic vector, the contract semantic features are obtained by dimensionality reduction. Based on the contract semantic features and the preset data interaction dimensions, the data interaction features are obtained; Based on the aforementioned digital contract and a pre-defined compliance knowledge base, compliance characteristics are obtained; A contract feature vector is obtained by fusing the contract semantic features, the compliance features, and the data interaction features.

3. The risk assessment method for trusted data space as described in claim 2, characterized in that, The preset risk feature library includes a compliance feature sub-library and a case feature sub-library. The compliance feature sub-library includes compliance rule feature vectors, and the case feature sub-library includes default feature vectors. The process of matching the contract feature vector and the real-time behavior time-series feature vector with a preset risk feature database to obtain historical risk feature vectors includes: The target compliance rule feature vector is obtained by querying the compliance feature sub-database based on the compliance features in the contract feature vector; The target default feature vector is obtained by querying the case feature sub-database based on the real-time behavior time-series feature vector; The historical risk feature vector is obtained by fusing the target compliance rule feature vector and the target default feature vector.

4. The risk assessment method for trusted data space as described in claim 3, characterized in that, Based on the compliance features in the contract feature vector, a similarity match is performed with each compliance rule feature vector in the compliance feature sub-library, and the compliance rule feature vector with the highest similarity is taken as the target compliance rule feature vector; Based on the similarity matching between the real-time behavior time-series feature vector and each default feature vector in the case feature sub-library, the default feature vector with the highest similarity is taken as the target default feature vector.

5. The risk assessment method for trusted data space as described in claim 1, characterized in that, After obtaining the risk type, risk probability, and risk level, the method further includes: Based on the risk type, the risk probability, the risk level, and the environmental operation feature vector, a global state vector is determined. Control commands are determined based on the global state vector.

6. The risk assessment method for trusted data space as described in claim 2, characterized in that, Before executing the digital contract, the method further includes: Based on the general semantic vector of the digital contract, a similarity match is performed with the text vectors of each default case in the case feature sub-library. If the similarity between the general semantic vector and the text vector of any default case exceeds a similarity threshold, a preset instruction is triggered.

7. A risk assessment device for a trusted data space, characterized in that, The device includes: The input / output module is used to acquire digital contracts in the trusted data space, as well as real-time behavioral data when executing the digital contracts; The processing module obtains the contract feature vector based on the digital contract; Based on the real-time behavior data, obtain the real-time behavior time-series feature vector; Based on the contract feature vector and the real-time behavior time series feature vector, as well as the preset risk feature library, the historical risk feature vector is determined; Based on the historical risk feature vector, determine the time-series evolution characteristics of similar historical risks; based on the contract feature vector, the real-time behavior time-series feature vector, and the time-series evolution characteristics of similar historical risks, determine the risk type, risk probability, and risk level.

8. A computing device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, It includes instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1-6.

10. A computer program product comprising computer instructions, characterized in that, When executed by a processor, the computer instructions implement the method described in any one of claims 1-6.

Images