246 results about "Behavioral modeling" patented technology

The invention belongs to the technical field of computers, and particularly relates to an Internet of Things security data real-time monitoring and protection method and system, and the method comprises the steps: collecting equipment communication and state data through an edge agent, and analyzing and extracting standardized metadata; constructing an equipment behavior contour vector based on a sliding window, and dynamically maintaining a global equipment topological graph; triggering a primary alarm in combination with behavior deviation detection and topology abnormity; outputting a threat score and an attack intention through rule matching and Bayesian network double-engine collaborative reasoning; and executing automatic response according to grading, and feeding back and correcting a behavior baseline to realize closed-loop optimization. The system comprises a data acquisition module, a protocol analysis module, a behavior modeling module, a topology maintenance module, an anomaly detection module, a collaborative reasoning module, an automatic response module and a baseline correction module. Through full-link real-time modeling and cross-device collaborative analysis, the attack detection rate is significantly increased to 98% or above, the false alarm rate is lower than 2%, the response delay is controlled within 800 milliseconds, and the security and adaptive ability of the Internet of Things system are enhanced.

The invention discloses a power grid dynamic modeling method based on a physical information neural network and a related device, and the method comprises the steps: obtaining power grid observation data, inputting the power grid observation data into a neural network for power grid dynamic behavior prediction, and obtaining a power grid state prediction value; calculating data item loss through a power grid state prediction value and a power grid state actual measurement value, and calculating physical residual item loss through power grid observation data; the physical residual item loss comprises current conservation constraint loss, voltage closed-loop constraint loss and generator dynamic response loss; and network parameters of the neural network are updated through the data item loss and the physical residual item loss until the neural network converges, and a power grid state model is obtained. According to the method, the mapping relation between the state variable and the system input is established by using the neural network, and the physical rule of the power grid is introduced into the loss function as a hard constraint term, so that physical consistency control during dynamic behavior modeling of the power system is realized, and the accuracy of dynamic behavior modeling of the power grid is improved.

The invention provides a power grid evolution behavior modeling method and system based on dynamic digital twinning, and relates to the technical field of intelligent power grid digital twinning. According to the method, interaction characteristics of power station output, user load response and an energy storage scheduling strategy are captured in real time through a digital twin interface, behavior coupling factors containing complementarity and conflict weight are formed, and a power grid response relation and a multi-scale demand elastic curved surface are constructed by using an implicit tensor fusion technology and nonlinear projection. And through the steps of virtual behavior anchor point disturbance and the like, offset is separated to identify an unbalance region, an evolution trajectory is generated, an optimal collaborative path is extracted, and the weight of a behavior coupling factor is dynamically adjusted, so that rapid convergence of a global collaborative stability domain is realized. The method covers a behavior coupling factor generation module and the like, supports various operations, effectively solves many problems in power grid resource interaction, and improves dynamic adaptability and cooperation efficiency of power grid evolution modeling.

The present invention discloses a method and system for artificial intelligence-based cryptocurrency regulatory analysis capable of performing automated, adaptive, and verifiable compliance evaluation across multiple blockchain ecosystems. The invention integrates blockchain data acquisition, data normalization, graph-based behavioral modeling, artificial intelligence inference, and cryptographically anchored reporting within a unified architecture. The system comprises a blockchain data acquisition unit for retrieving multi-chain transaction data, a data normalization unit for harmonizing heterogeneous blockchain formats, a graph construction unit for generating dynamic transaction graphs, a regulatory knowledge base unit storing jurisdiction-specific regulatory rule graphs, an artificial intelligence processor configured for hybrid neural and symbolic reasoning, and a regulatory reporting unit for generating explainable compliance reports cryptographically anchored to a blockchain ledger.

The invention discloses a conversion method and system based on SysML and Modelica model semantic mapping. The method comprises the following steps that S1, a Modelica standard model library is imported into a SysML modeling tool; s2, completing the definition of behavior elements, and forming an SysML model instance; s3, exporting a Modelica model which can be executed by the Modelica simulator; s4, establishing a mapping relation table between SysML model elements and Modelica model elements; s5, when a change event occurs in the SysML model, updating the content of the corresponding Modelica model; s6, the Modelica model is imported into the SysML model, and a corresponding SysML model instance is generated; s7, simulation result mapping and behavior modeling generation are executed, a state transition diagram structure is formed, and structure updating of internal block diagrams in the system model is completed. According to the method, bidirectional conversion and joint simulation optimization between models are realized, and the method is suitable for cross-platform modeling, collaborative design and functional verification scenes of a complex system.

The invention relates to a data access prediction scheduling method and system based on a dynamic threshold value, and belongs to the technical field of data processing. The method comprises the following steps of: dynamically adjusting an abnormal detection threshold in an access behavior by utilizing reinforcement learning and an error feedback mechanism, realizing preposition identification of potential high-frequency access data by combining abnormal point classification processing and access trend prediction, and generating a scheduling request to drive cache preheating or interface priority scheduling of the data. According to the method, access behavior modeling, anomaly recognition, trend prediction and strategy feedback mechanisms are combined, interface access optimization requirements in a mass data storage system are met, and the key problems that access behaviors are unpredictable, scheduling response lags and the like are solved.

The invention discloses a police affair studying and judging method based on behavior feature recognition, and relates to the technical field of intelligent police affair and behavior modeling, and the method comprises the steps: collecting dynamic behavior data of a target object, and constructing a dynamic behavior portrait map comprising a behavior event, a time node, a spatial position and an interaction object; time sequence modeling is carried out on the map, and individual behavior chain feature vectors are extracted; comparing the current behavior chain with the historical behavior chain and the group mean value model, and calculating the deviation degree; performing cross-regional universality evaluation on the deviation degree through a transfer learning model; if the deviation degree exceeds a preset threshold value, generating early warning information in combination with a regional safety rule and pushing the early warning information to a police research and judgment system; according to the method, accurate identification and hierarchical response of abnormal behaviors can be realized, and the method has high robustness, strong generalization ability and good actual combat adaptability.

The invention relates to the technical field of medical management, and discloses a digital twin-driven hospital operation simulation and quality control optimization system, which comprises the following modules: a multi-source medical data fusion module for collecting heterogeneous medical data of a hospital and fusing to construct a dynamic medical diagram structure; the graph structure behavior modeling module is used for constructing a trajectory graph of the patient and generating potential trajectory representation of the patient in the medical process; the stable path evolution constraint module is used for introducing a path evolution model of a compression mapping function and generating a patient trajectory prediction result; the digital twin simulation module is used for generating multi-dimensional operation index data; and the strategy evaluation and closed-loop optimization module is used for constructing a multi-target evaluation model and carrying out optimization adjustment on the operation strategy according to the multi-target evaluation model. According to the application, the digital twinborn simulation module is introduced to construct the dynamic virtual environment capable of mapping the real hospital operation state, so that the patient path and the resource use condition can be completely reproduced on the basis of not interfering the existing process.

The invention belongs to the technical field of smart campus, and relates to a smart campus safety management early warning method and system based on big data. The method comprises the following steps: collecting registration information, real-time behavior data and state information of an environment of a foreign vehicle; constructing a dynamic space-time diagram, and generating an edge attribute reflecting a relationship between deployment nodes in the dynamic space-time diagram; calculating a reasonable path set of the foreign vehicle, and analyzing trajectory deviation data of the foreign vehicle; abnormal scoring is carried out on the external vehicle; generating a corresponding intervention control strategy; performing causal influence analysis and generating a decision basis; and training the local graph neural network model, and carrying out centralized aggregation and distribution updating on shared model parameters in a training result of the local graph neural network model. According to the method, a dynamic behavior modeling strategy based on a heterogeneous graph neural network is introduced, structural modeling and time sequence behavior evolution expression of campus moving target multi-source data are achieved, the system can capture tiny anomalies in individual trajectory evolution, and the abnormal behavior recognition sensitivity is improved.

Systems and methods for protecting electronic communications are described. A cyber security appliance may be configured to calculate a topic shift score for a communication by comparing a first lexical profile derived from the communication to a historical lexical profile established for an associated user. This analysis may be performed without using a large language model. The system may also parse communications to extract sensitive data and content from attachments, performing behavioral modeling on the extracted data. Based on the analysis, an autonomous response module may take a variety of mitigation actions. Furthermore, a security mailbox assistant module may perform a secondary, in-depth analysis on user-submitted communications and generate a deterministic report. For outbound communications, a data loss prevention architecture may divert messages for in-line analysis and may include a fail-safe timeout mechanism to ensure service continuity.

The invention discloses a curve driving collision early warning method and system based on multi-risk field fusion, and the method comprises the steps: 1, collecting vehicle dynamics data in real time, and carrying out the short-time prediction; step 2, geometric modeling and rasterization of a road; 3, constructing a geometric risk field; 4, constructing a kinetic energy risk field; 5, constructing a behavior risk field; step 6, constructing a comprehensive risk field; step 7, collision risk judgment; and step 8, generating an active intervention strategy. Collaborative perception and risk prediction of vehicles, roads and driving behaviors are realized through multi-risk field fusion, and potential collision hidden dangers of curve driving are identified in advance; a vehicle dynamics model and risk correction based on road adhesion are introduced to realize accurate risk assessment of the vehicle; multi-time window trajectory prediction and behavior modeling are adopted, so that the recognition capability of complex driving behaviors is improved; a closed-loop system from risk prediction and decision making to active control is realized, and the safety and stability of the vehicle driving in the curve scene are effectively improved.

The invention provides a traffic abnormity and congestion cause analysis method and system based on a knowledge graph, and relates to the technical field of intelligent traffic perception, and the method comprises the steps: carrying out the target detection through employing preprocessed laser radar point cloud data, recognizing traffic participants, carrying out the continuous frame tracking of the traffic participants, and extracting the motion track and behavior characteristics in an event dimension; identifying a behavior event of the traffic target based on the motion trail and the behavior characteristics, binding the identified behavior event of the traffic target to a corresponding target entity, and performing target behavior modeling to form standardized structured information; based on structured information of a traffic target, an intersection-oriented traffic state knowledge graph is constructed, a rule-based abnormal event judgment module is utilized to perform semantic analysis on behavior and event nodes in the traffic state knowledge graph, abnormal traffic events are identified, and potential causes causing traffic congestion are traced. According to the invention, refined understanding and active perception of the intersection traffic state can be realized.

The invention discloses an intelligent water meter operation monitoring method and system based on the Internet of Things, and relates to the technical field of intelligent water meters. According to the method, a disturbance consistency scoring index Ipd and a behavior map variation score Simv are constructed, and a multi-parameter coupling backtracking risk grade scoring function Rtrace is introduced; the disturbance sudden change intensity, the period stability, the flow direction consistency and the historical behavior deviation degree can be comprehensively considered, and the recognition precision of the unnatural disturbance water flow and the potential abnormal water consumption behavior is effectively improved. Particularly, under the condition that disturbance abnormity and behavior map abnormity are coupled, secondary comparison evaluation is carried out on a backtracking risk grade scoring function Rtrace and a risk interval threshold value, so that risk judgment and risk grade division with higher distinction can be realized, illegal water taking, backflow and backward flow and other abnormal water consumption behaviors can be accurately locked under the condition of a low misjudgment rate, and the accuracy and the reliability of the system are improved. And the intelligent sensing capability and the behavior modeling reliability of the urban water supply system are enhanced.

The invention discloses an enterprise carbon emission measuring and calculating method and system based on production activity carbon footprint analysis, relates to the technical field of enterprise carbon emission, and effectively solves the problem of difficulty in data space-time alignment and process association in a complex production process by introducing a time sequence mapping and process feature decoupling mechanism. Multi-source heterogeneous data are fused in the feature recognition stage, and the integrity and interpretability of energy consumption behavior modeling are improved by combining graph structure modeling and causal attribution analysis methods; structured expression and dynamic weight updating of a carbon emission path are realized based on a carbon emission calculation map, and the response capability and traceability of the model to working condition changes are enhanced; high efficiency and adaptability of carbon emission measurement and calculation are realized through distributed path analysis and a carbon factor dynamic adjustment mechanism; the finally output time-phased and process-divided carbon emission result provides a scientific basis and technical support for an enterprise to carry out refined carbon performance evaluation, carbon asset management and green transformation decision-making.

The invention provides a user behavior tracking and portrait generation system, which is characterized in that multi-source original behavior data is acquired through a data acquisition module, and a standard behavior event stream is generated through cleaning and standardization; the behavior modeling module is used for carrying out cross-event association and self-defined time window combination modeling on a standard event flow based on a configurable rule engine to generate a complex event flow; the real-time processing and calculation module performs real-time aggregation calculation on the complex event stream, generates a real-time behavior index, a trigger signal and an incremental portrait snapshot in combination with a preset rule, and pushes a behavior trigger signal to a downstream service system; the user portrait management module dynamically updates user tag weights and values according to the real-time indexes, and generates a target user portrait tag library and a lightweight tag change event stream; the data storage and query module stores data of each link; and the visual configuration and operation and maintenance module issues a configuration instruction through a visual interface, and monitors full-link operation and task scheduling. And real-time accurate portrait construction and instant service response are realized.

The invention discloses an abnormal behavior detection method and device, a nonvolatile storage medium and electronic equipment. The method comprises the following steps: acquiring user behavior data; behavior feature vectors are determined in the user behavior data, and the behavior feature vectors comprise at least one of a mouse behavior feature vector, a keyboard behavior feature vector, a process behavior feature vector and a window interaction feature vector; and analyzing the behavior feature vector by using a machine learning model to obtain an anomaly score output by the machine learning model, the anomaly score being used for representing the degree of deviation of the behavior feature vector from a preset normal behavior feature vector. According to the method and the device, the technical problem that the accuracy of distinguishing the normal user activity from the remote control Trojan abnormal operation is insufficient due to the fact that a related abnormal behavior detection method lacks a refined behavior modeling technology and a dynamic behavior analysis mechanism is solved.

The invention relates to the technical field of occupational simulation training evaluation, and discloses a system for college student occupational scene simulation training evaluation. The system comprises a task analysis unit, a dynamic behavior modeling unit, a multi-mode interaction management unit, a state evolution tracking unit, a strategy adaptation unit and a comprehensive evaluation generation unit. The system receives the initial scene description and generates a structured task framework, and behavior parameters are configured for student roles; constructing a multi-modal interaction atlas by fusing aligned voice, action and sight line data in real time; identifying a key decision node, and dynamically tracking a team state evolution path; matching and adjusting strategies in a behavior rule base according to the evolution sequence, and outputting an adaptive intervention scheme; and finally generating a multi-dimensional structured evaluation report. According to the system, deep insight and dynamic and objective intelligent evaluation of complex interaction behaviors in the simulation training process are realized.

The invention discloses a real-time early warning method and system for precise mold production and processing, and relates to the technical field of mold processing, and the method comprises the steps: when a residual pressure disturbance energy aggregation function F1 exceeds a disturbance threshold Q1, the system automatically switches to a trend tracking mode, further calculates and outputs a flow velocity abrupt change rate variation factor F2 and a composite migration pressure difference index F3, and then outputs a flow velocity abrupt change rate variation factor F3; through second-order flow velocity derivative analysis and particle-heat flow-pressure difference coupling behavior modeling, a complex blocking trend caused by particle deposition, heat stagnation accumulation and countercurrent disturbance is effectively identified. And calculating a blockage risk index Irisk by combining the two indexes, and setting a first blockage threshold W1 and a second blockage threshold W2 to realize automatic evaluation and classified response of different blockage levels. Compared with an existing mode of only judging a single parameter of pressure, the method can analyze a blockage evolution path in multiple dimensions and output a grading result, and the risk controllability and the strategy adjustment elasticity are enhanced.

The invention relates to the technical field of liquid cooling flow distribution, and discloses a multi-GPU server cluster liquid cooling flow distribution method based on reinforcement learning, and the method comprises the steps: S1, collecting the operation state parameters of each GPU in a multi-GPU server, enabling the operation state parameters to comprise core temperature, voltage, current and load utilization rate, carrying out the thermal behavior modeling through a sliding time window, generating a thermal dynamic feature vector representing the GPU short-time thermal trend; and S2, collecting the flow velocity, the temperature difference of inlet and outlet water and the thermal resistance of the cold plate of each channel of the liquid cooling system in real time, and representing the liquid cooling assembly as a graph structure. According to the method, the technical scheme of joint modeling based on the graph neural network and reinforcement learning is adopted, fusion coding is performed on the GPU thermal dynamic characteristics and the topological state of the liquid cooling system, and an Actor-Critic architecture is introduced to realize self-adaptive regulation and control of the liquid cooling flow, so that the technical effect of improving the heat dissipation efficiency and the energy consumption balance control capability of the multi-GPU server cluster is achieved.

The invention discloses a ship network abnormal behavior detection system based on multi-protocol deep analysis, and belongs to the technical field of ship network security. According to the ship network abnormal behavior detection system integrating multi-protocol semantic analysis, communication chain modeling, state awareness and behavior scoring, a unified semantic intermediate expression structure is constructed, fields of various heterogeneous protocols are abstracted into standard semantic units, behavior portraits are established in combination with a communication topological graph and an equipment state sequence, and the behavior portraits are subjected to state awareness and behavior scoring. And multi-dimensional anomaly recognition and hierarchical response are realized based on a weighted scoring mechanism, so that the blank in the aspects of cross-protocol fusion recognition and behavior modeling closed-loop detection in the prior art is filled, and the security risk recognition requirements of complex data and frequent switching in a ship scene are met.

The invention discloses a method and a system for monitoring a dynamic burning state of a printed circuit board (PCB), and relates to the technical field of PCB burning process monitoring and image processing. And the coverage of the whole process from image acquisition, path analysis, contact state evaluation to electrical fluctuation monitoring is realized. According to the system, an image algorithm is combined with a crimping behavior modeling technology, mechanical anomalies such as probe crimping path offset, contact inconsistency and time sequence mismatch can be accurately identified, electrical anomalies such as micro-contact resistance change can be detected, and monitoring precision and real-time performance are enhanced. By constructing the abnormal risk time anchor point and accessing the block chain for evidence storage, data credibility and subsequent traceability are guaranteed, meanwhile, a locking and alarm mechanism is matched, automatic isolation and closed-loop management of equipment abnormity are achieved, and burning quality consistency, equipment operation stability and maintenance efficiency are effectively improved.

The invention relates to an Internet of Things equipment identification method based on equipment behavior analysis. The method comprises the following steps: extracting periodic communication features and information entropy features of Internet of Things equipment on distributed nodes; the optimal feature subset is selected through chi-square verification, and the recognition accuracy is further improved; capturing time dependence and dynamics of behavior modeling by using an LSTM network, and aggregating local behavior patterns of each node through federated learning to form a global model; training and evaluating the model to obtain an optimal model and outputting a recognition result; according to the method, original data are not shared, only model updating is shared, user privacy is effectively protected, and compared with the prior art, the method has remarkable advantages in the aspects of privacy protection, recognition accuracy, expandability and robustness, is suitable for a complex and changeable Internet of Things environment, and has wide application prospects. The method can be widely applied to the fields of intelligent home, intelligent wearing, intelligent transportation and the like, and has important practical significance and wide application prospects.

The invention discloses a dynamic key value memory network knowledge tracking method and system fusing graph guidance and a behavior adaptive mechanism, and belongs to the technical field of artificial intelligence and education data mining. The system comprises an input coding module, a graph structure modeling module, a behavior modeling module, a fusion attention mechanism module, a dynamic memory updating module, a prediction output module and a visual interface module. Wherein the input coding module is used for performing vectorization representation on question numbers, answering results, time intervals and student portrait information in student and question interaction logs, and generating capability vectors including absorption capability, structure preference and predictive regulation and control; the graph structure modeling module is used for modeling knowledge graph relationships among the topics by using a graph attention network to generate structure perception representation; the behavior modeling module adopts a Transform structure to carry out modeling on a student answering sequence, and behavior feature representation is extracted.

The invention discloses a non-file attack detection method, system and device based on multi-view behavior modeling and frequency domain enhancement contrast learning and a medium, and belongs to the technical field of network security, and the method comprises the steps: collecting and coding multi-source behavior data of a target system during operation, and carrying out the unified coding; performing time sequence division on the multi-source behavior data, and constructing a corresponding behavior graph; inputting the divided time sequence into a self-attention mechanism neural network, extracting time domain representation of behaviors, inputting the constructed behavior graph into a graph structure neural network, and extracting structure representation; respectively performing fast Fourier transform on the time domain representation and the structure representation to generate frequency domain representation; constructing a joint contrast learning loss function, and training a consistency detection model; and judging whether the behavior is a file-free attack behavior based on the consistency deviation in combination with an anomaly detection judgment mechanism. According to the method, the non-file-attack characteristic behaviors are accurately identified, and the capability of detecting the non-file-attack in the advanced persistent threats is effectively improved.

The invention discloses a subway station air conditioning load adjusting system and method, and the system comprises a load simulation module which is used for simulating the time sequence change of cold loads and heat loads of different types of stations under different meteorological conditions and operation conditions, and generating a system training data set; the passenger travel behavior modeling module is used for establishing a time-period passenger distribution model by using subway historical passenger flow data and urban public transport survey data; outputting passenger flow densities of different areas by using a time period passenger flow distribution model; the machine learning prediction model is used for extracting multi-dimensional features as input features; a system training data set is utilized to learn the mapping relation between the input features and the target cold / heat load, and a load preset value is output; the intelligent load adjusting control module dynamically adjusts the output capacity of the air conditioning system through the building automation system according to the load preset value, and closed-loop control is achieved. According to the invention, TRNSYS simulation, behavior modeling and intelligent control are integrated, and accurate load prediction and energy-saving regulation and control are realized.

The invention relates to the technical field of industrial control system security testing, and provides a construction method and device for a dynamic attack and defense testing environment of an industrial control system. The method comprises the following steps: realizing virtualization operation and behavior modeling of industrial control firmware through a hardware system simulation technology based on logic self-learning; constructing a meta-aggregation data resource pool to realize intelligent scheduling and automatic deployment of industrial control component resources; when it is detected that the behavior of the industrial equipment is abnormal, deviation behavior data are complemented based on a causal relationship reasoning mechanism, and a simulation model is driven to be adjusted; constructing a digital-analog fusion model supporting space-time driving and data synchronization, and realizing data consistency and linkage between a virtual environment and a real environment; an AI agent mechanism is introduced, an attack path is automatically deduced, a defense strategy is optimized, and intelligent evaluation of a drilling process is completed; attack protection scene configuration and control are carried out through an interactive user interface, and simulation and verification operations in a complex dynamic attack and defense environment are realized.

The invention discloses an employee performance evaluation method and system based on multi-dimensional data, and belongs to the technical field of enterprise talent intelligent management, and the method comprises the steps of multi-dimensional employee data preparation, employee behavior modeling, employee performance fluctuation prediction, employee performance attribution analysis and employee performance evaluation. According to the method, employee behavior modeling is carried out by adopting a graph construction method combining multi-dimensional cooperation characteristics and behavior characteristics, and overall modeling and dynamic sensing of real positions, interaction strength and multi-dimensional behavior states of individual employees in an organization cooperation network are realized; employee performance fluctuation prediction is carried out by using a graph convolution bidirectional long-short term network model optimized by a joint loss function, and employee individual performance and dynamic evolution of mutual influence in an organization cooperation network are comprehensively modeled; the employee performance attribution analysis method based on anti-fact simulation is adopted to perform attribution analysis, and the influence of the key cooperation relation on employee performance change is quantitatively evaluated by simulating the hypothesis situation.

The invention relates to the technical field of API security protection, and discloses an API anomaly detection method, system and device based on behavior fingerprints during operation and a medium, and the method comprises the following steps: collecting operation log data in an API calling process in real time; preprocessing the log data, extracting multi-dimensional behavior characteristics from the preprocessed data, and constructing an API behavior fingerprint vector; based on the historical behavior fingerprint vector, a Gaussian mixture model is adopted to establish a normal behavior reference model; dynamically determining the optimal clustering number of the Gaussian mixture model through a Bayesian information criterion; and inputting a behavior fingerprint vector called by the API in real time into the Gaussian mixture model, calculating an abnormal score, judging an abnormal behavior, regularly and incrementally updating parameters of the Gaussian mixture model, and re-optimizing the clustering number. According to the method, through dynamic behavior modeling and a closed-loop self-adaptive mechanism, the accuracy of abnormal recognition in a complex environment and the long-term stability of the system are remarkably improved.

The invention discloses a fund backflow tracking method based on an AI large model, and relates to the field of fund backflow tracking, and the method comprises the steps: carrying out the dynamic transaction and fund flow guiding analysis through obtaining transaction data, obtaining a space-time risk node feature matrix, carrying out the anonymous entity clustering and behavior modeling of the space-time risk node feature matrix, obtaining a high-risk cluster set, and carrying out the dynamic transaction and fund flow guiding analysis. Carrying out mixed currency link penetration analysis based on the high-risk cluster set to obtain a recombined fund path, carrying out fund transfer dynamic deduction and attribution based on the recombined fund path to obtain fund transfer path probability distribution, carrying out entity inter-cluster transfer analysis based on the fund transfer path probability distribution to obtain an entity attribution map, and finally outputting a structured map. According to the method, multi-source heterogeneous data can be effectively fused, single-chain analysis can break through a block chain, key evidences such as the capability of clustering addresses into risk entities, the actionable entity association probability and the fusion amount can be dispersed, the response can be timely, and the interception efficiency can be improved.