WO2019232964A1

WO2019232964A1 - Risk management data processing method and apparatus, computer device, and storage medium

Info

Publication number: WO2019232964A1
Application number: PCT/CN2018/104759
Authority: WO
Inventors: 霍丽; 梁荣才; 刘芸; 杜号权
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-06-07
Filing date: 2018-09-10
Publication date: 2019-12-12
Also published as: CN108874968B; CN108874968A

Abstract

A risk management data processing method, comprising: acquiring a risk event set; respectively creating event reporting tasks for risk events; selecting target interface parties corresponding to the event reporting tasks from an interface party set corresponding to the risk events; respectively sending the event reporting tasks to terminals corresponding to the target interface parties thereof; receiving reporting data sent by the terminals corresponding to the target interface parties; obtaining risk types corresponding to the risk events by using a preset classification model; selecting review parties corresponding to the risk events according to the risk types, and sending the reporting data to terminals corresponding to the review parties; receiving review data sent by the terminals corresponding to the review parties, and when determining that the reporting data corresponding to any one of the risk events pass the review according to the review data, generating a report file according to the reported data passing the review.

Description

Risk management data processing method, device, computer equipment and storage medium

Cross-reference to related applications

This application claims the priority of a Chinese patent application filed on June 07, 2018, with the application number 2018105822439, and the application name is "risk management data processing method, device, computer equipment and storage medium". Citations are incorporated in this application.

Technical field

The present application relates to a risk management data processing method, device, computer equipment, and storage medium.

Background technique

IT risk is also known as information technology risk. IT risk refers to any adverse situation caused by the use of computer hardware, software, networks and other systems, including program errors, system downtime, software defects, operational errors, hardware failures, insufficient capacity, Network loopholes and failure recovery. In large groups, in order to reduce the losses caused by IT risk events, effective management of risk events is required.

In traditional technology, the risk events of various professional companies are usually managed by specialized event investigators through offline communication, such as emails. However, the inventors realized that this approach It takes time for investigators to spend a lot of time communicating, resulting in inefficient risk management.

Summary of the Invention

According to various embodiments disclosed in the present application, a risk management data processing method, apparatus, computer device, and storage medium are provided.

A risk management data processing method includes:

Obtaining a set of risk events, each risk event in the set of risk events carrying a user identification;

Creating corresponding event reporting tasks for each of the risk events to obtain a set of event reporting tasks;

Selecting the target interface party corresponding to each event reporting task from the set of interface parties corresponding to each risk event according to the user identification, and sending each event reporting task to the terminal corresponding to its target interface party;

Receiving report data sent by a terminal corresponding to the target interface party, the report data includes cause data and influence data of each risk event, and a preset classification model is used to obtain a risk corresponding to each risk event according to the cause data and influence data Types of;

Selecting a reviewer corresponding to each risk event according to the risk type, and sending the reported data to a terminal corresponding to each reviewer; and

Receive the review data sent by the terminal corresponding to each reviewer, and when it is determined that the report data corresponding to any risk event passes the review based on the review data, a report file is generated based on the report data passed the review.

A risk management data processing device includes:

A risk event set acquisition module, configured to acquire a risk event set, where each risk event in the risk event set carries a user identifier;

An event reporting task creation module, configured to create corresponding event reporting tasks for each of the risk events, and obtain an event reporting task set;

The target interface party selection module is configured to select a target interface party corresponding to each event reporting task from a set of interface parties corresponding to each risk event according to the user identifier, and send each event reporting task to a terminal corresponding to its target interface party. ;

A risk type acquisition module is configured to receive report data sent by a terminal corresponding to the target interface party, the report data includes cause data and influence data of each risk event, and a preset classification model is adopted according to the cause data and influence data. Get the risk type corresponding to each risk event;

A reporting data sending module, configured to select a reviewer corresponding to each risk event according to the risk type, and send the reported data to a terminal corresponding to each reviewer; and

A report file generating module is configured to receive the review data sent by the terminal corresponding to each reviewer. When it is determined that the review data corresponding to any risk event passes the review based on the review data, a report file is generated based on the report data passed by the review.

A computer device includes a memory and one or more processors. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the one or more processors are executed. The following steps:

One or more non-volatile storage media storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the following steps:

Details of one or more embodiments of the present application are set forth in the accompanying drawings and description below. Other features and advantages of the application will become apparent from the description, the drawings, and the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to explain the technical solutions in the embodiments of the present application more clearly, the drawings used in the embodiments are briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. Those of ordinary skill in the art can also obtain other drawings according to these drawings without paying creative labor.

FIG. 1 is an application scenario diagram of a risk management data processing method according to one or more embodiments; FIG.

2 is a schematic flowchart of a risk management data processing method according to one or more embodiments;

FIG. 3 is a schematic flowchart of step S206 according to one or more embodiments; FIG.

4 is a block diagram of a risk management data processing apparatus according to one or more embodiments;

FIG. 5 is a block diagram of a computer device according to one or more embodiments.

Detailed ways

In order to make the technical solution and advantages of the present application more clear and clear, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the application, and are not used to limit the application.

The risk management data processing method provided in this application can be applied to the application environment shown in FIG. 1. The terminal 104 corresponding to the target interface party, the terminal 106 corresponding to the reviewer, and the terminal 108 corresponding to the event investigator communicate with the risk management server 102 through the network, respectively. After the risk management server 102 obtains the risk event set, it creates an event reporting task for each risk event, and assigns the event reporting task to the target interface party, and the target interface party can report and enter the event reporting task through its corresponding terminal 104, and then The reported data is returned to the risk management server 102 through the terminal 104. The risk management server 102 classifies risk events based on the reported data, then selects the reviewer based on the classification results, sends the reported data to the corresponding terminal of the reviewer 106, and finally according to the reviewer The review data returned by the corresponding terminal determines whether the risk event passes the review, generates a report file for the risk event that passed the review, and sends it to the terminal 108 corresponding to the event investigator. Among them, the terminal 104 corresponding to the target interface party, the terminal 106 corresponding to the reviewer, and the terminal 108 corresponding to the event investigator may be, but are not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices, and the server 102 It can be implemented by an independent server or a server cluster composed of multiple servers.

In some embodiments, as shown in FIG. 2, a risk management data processing method is provided. The method is applied to the risk management server 102 in FIG. 1 as an example, and includes the following steps:

In step S202, a risk event set is acquired, and each risk event in the risk event set carries a user identifier.

A risk event set refers to a set of at least one risk event, and a risk event refers to any event that may cause an adverse situation due to the use of computer hardware, software, or network. The user ID is used to uniquely identify the user who caused the risk event, and is composed of a preset number of digits, letters, or other special symbols.

In some embodiments, the risk management server acquires risk events in real time from a third-party system server, such as an operation and maintenance system server, in a real-time and synchronous manner. Further, the user corresponding to the user identification may be an individual, or may be a company, a team, or the like. For example, in large group companies, the same industry often contains multiple professional subsidiaries, and each professional subsidiary corresponds to a user. For example, in an insurance company group, a professional company responsible for property insurance and a professional responsible for life insurance Each company corresponds to a user.

Step S204: Create corresponding event reporting tasks for each risk event, and obtain event reporting task sets.

Specifically, the risk management server may store a task template in advance, and the task template includes entries such as a risk event name, a risk event cause, a risk event history, and a possible impact of the risk event. After the risk management server obtains the risk event set, each risk event in the risk event set uses a task template to create a corresponding event reporting task. The task name of the event reporting task may be named after the risk event name, or The numbering rules set in advance are numbered. For example, the names can be named according to 001, 002, 003, etc. After creating an event reporting task for each risk event, the event reporting task set corresponding to the risk event set is obtained.

In step S206, the target interface party corresponding to each event reporting task is selected from the set of interface parties corresponding to each risk event according to the user identification, and each event reporting task is sent to the terminal corresponding to its target interface party.

Specifically, all user IDs have one or more interface parties associated with them stored in the risk management server. The interface party can be identified by name, mobile phone number, and mailbox in the risk management server. One user ID corresponds to All the interface parties in the group constitute the interface party set. Therefore, the corresponding interface party can be found according to the user ID carried in the risk event, and the event reporting task corresponding to the risk event is assigned to the interface party corresponding to the user ID carried in the risk event.

In some embodiments, the risk management server selects the target interface party from the set of interface parties corresponding to the user identification. The target interface party may be randomly selected as the target interface party. In another embodiment, the risk management server selects the target interface party from the set of interface parties corresponding to the user identification. The target interface party may be selected according to the long-term connection status and priority of each interface party in the interface party set. The long connection state corresponding to each interface party in the interface party set, and the interface party whose long connection state is maintained as the candidate interface party, to obtain the candidate interface party set, and obtain the correspondence of each candidate interface party in the candidate interface party set. Task priority; select the candidate interface party with the highest task priority from the set of candidate interface parties as the target interface party.

In step S208, the report data sent by the terminal corresponding to the target interface party is received. The report data includes cause data and influence data of each risk event, and a preset classification model is used to obtain a risk type corresponding to each risk event according to the cause data and influence data.

The reported data is data entered by the target interface party at its corresponding terminal according to the corresponding task, including the name of the risk event, the cause data corresponding to the risk event, the process data, and the impact data. The types of risks include system risk, network risk, data risk, and operational risk. In this embodiment, the preset classification model is obtained through machine learning training. When performing the model training, a supervised model training method, such as a logistic regression model, SVM (Support Vector Machine, Support Vector Machine), Bayesian models, convolutional neural networks, etc.

In this embodiment, after receiving the report data sent by the terminal corresponding to the target interface party, the risk management server inputs the cause data and influence data in the report data into the trained classification model to obtain the risk type corresponding to the risk event.

In step S210, the reviewer corresponding to each risk event is selected according to the risk type, and the reported data is sent to the terminal corresponding to each reviewer.

Specifically, different reviewers are set in advance for different types of risks. Therefore, after obtaining the type of risk corresponding to a risk event, a reviewer that matches the type of risk can be selected according to the type of risk. In this embodiment, each reviewer corresponds to a user ID in the risk management server. The user ID is used to uniquely identify the identity of the reviewer. It can be a name, social account number, ID number, mobile phone number, etc. After the reviewers of each risk type are determined, the mapping relationship between the user ID and the risk type corresponding to the reviewer can be established. After the risk management server obtains the risk type of the risk event, it can find its corresponding The user identification, and then report the risk event data to the terminal corresponding to the user identification.

Further, the reviewer corresponding to the user ID may review the reported data corresponding to the risk event through the terminal. The review may directly give an overall conclusion to the reported data, and the conclusion may be that the review is passed or the review fails. When the review fails At that time, improvement suggestions can be given; each item of the reported data can be reviewed separately, such as the cause of the event, the course of the event, and the impact of the event, and the review conclusions can be given.

Step S212: Receive the review data sent by the terminal corresponding to each reviewer, determine whether each risk event passes the review based on the review data, and when any risk event is judged to pass the review based on the review data, a report file is generated based on the reported data passed the review.

Specifically, after receiving the review data sent by the terminal corresponding to the reviewer, the risk management server parses the review data, obtains the review conclusions in the review data, and determines whether the risk event has passed the review based on the review conclusions.

In some embodiments, when only one overall review conclusion is obtained from the review conclusions, the review of the risk event can be directly determined based on the review conclusion. In another embodiment, when the obtained review conclusions include Multiple review conclusions, that is, when the review conclusions are directed to a single item in the reported data, it is determined whether these review conclusions include unsuccessful review conclusions. If so, it is judged that the risk event review has failed.

Further, when the risk management server determines that the reported data corresponding to any risk event passes the review, a report file corresponding to the risk event is generated based on the reported data that passes the review. The report file contains at least the data such as the name of the risk event, reported data, and review conclusions.

Further, the risk management server sends the report file to a terminal corresponding to the event investigator. Specifically, when the report file acquisition request sent by the terminal corresponding to the event investigator is received, the report file corresponding to the report file acquisition request is separately sent to the terminal corresponding to the event investigator; or when the number of report files exceeds Set a threshold, such as five, to send all the report files that have been generated to the terminal corresponding to the event investigator; you can also query the report files that are not currently sent at regular intervals, such as 2 days, and then Send all unsent report files found to the terminal corresponding to the incident investigator.

In the above risk management data processing method, a risk event is obtained through a risk management server, a report task is generated for the risk event, and then it is assigned to the corresponding target interface party, and receives the report data sent by the target interface party through its corresponding terminal, and sends the report data To the corresponding reviewer, judge whether the risk event review has passed based on the review data returned by the corresponding terminal of the reviewer, and when it passes, generate a report file to realize the automated management of risk events and improve the efficiency of risk management.

In some embodiments, the step of obtaining a set of risk events includes: obtaining source data corresponding to the risk event; creating an ETL (Extract-Transform-Load, extraction / transformation / load) task according to the source data, and triggering the ETL tool to run the ETL task; The result of the ETL task corresponds to the set of risk events.

Specifically, the risk management server obtains source data corresponding to a risk event from a third-party system server such as an operation and maintenance system server, and the source data includes, but is not limited to, a user identifier corresponding to the risk event, a type of the risk event, and a brief description of the risk event, such as The causes and effects of risk events, and the estimated loss of risk events. The format of the source data may be, for example, one or more of a variety of data sources such as a data source MySQL, a data source Oracle, a data source PostgreSQL, a data source DB2, and a data source SQL Server.

In some embodiments, after the ETL task is created by the risk management server according to the source data, the corresponding ETL tool is selected to run the ETL task according to the data type of the source data, and a risk event set is obtained according to the operation result.

In other embodiments, the risk management server may first perform a uniform format conversion on the source data, such as uniformly converting the source data into a comma-separated value CSV format, and then create an ETL task based on the converted source data, and select the corresponding CSV format. The ETL tool runs the ETL task and obtains a set of risk events based on the results of the operation.

In this embodiment, the ETL tool can be used to better integrate the acquired source data and quickly obtain a set of risk events.

In some embodiments, as shown in FIG. 3, the step of selecting the target interface party corresponding to each event reporting task from the set of interface parties corresponding to each risk event according to the user identification includes:

In step S206A, the long-connected state corresponding to each interface party in the set of interface parties is obtained, and the interface party whose long-connected state is maintained is used as the candidate interface party to obtain the set of candidate interface parties.

Specifically, in order to ensure that the event reporting task can be allocated to the corresponding interface party in time, the terminal corresponding to the interface party and the risk management server adopt a long connection for communication. Therefore, when selecting the target interface party, it can first determine whether the long connection corresponding to each interface party in the interface party set is a long connection state, and the interface party whose long connection state is maintained as an alternative interface party, and finally obtain the target interface party. set.

Specifically, to determine whether the long connection corresponding to each interface party in the interface party set is a long connection state, a heartbeat detection packet can be sent to the terminal corresponding to the interface party. When the heartbeat response packet is judged to be in a long connection state, otherwise, it can be determined that the corresponding long connection of the interface party has been disconnected, or the heartbeat detection packet can be sent again when no heartbeat response packet is received within a preset time, and It is judged again whether the heartbeat response packet is received within a preset time, so that an error judgment may occur when the terminal corresponding to the interface party has a short-term failure, so as to select as many alternative interface parties as to have the long connection online.

Step S206B: Obtain a task priority corresponding to each candidate interface party in the candidate interface party set.

In step S206C, the candidate interface party with the highest task priority is selected from the set of candidate interface parties as the target interface party.

Specifically, a task priority is set for each interface party in the interface party set. The task priority can be set according to the experience and position of the interface party. After obtaining the task priority corresponding to each candidate interface party, the The task priority sorts each candidate interface party, and the candidate interface party with the highest priority is selected as the target interface party according to the sorting result.

In this example, selecting the target interface party based on the long-term connection status and task priority of the interface party can ensure that the reporting task is allocated to the most appropriate interface party in a timely manner, thereby improving task processing efficiency and processing quality.

In some embodiments, the preset classification model can be trained by: obtaining the reporting data and corresponding risk categories corresponding to the historical reporting task; obtaining the training set according to the cause data, impact data, and risk categories corresponding to the reporting data; according to The training set is modeled to obtain a classification model.

Among them, the cause data includes one or more of data such as program errors, software defects, operational errors, hardware failures, insufficient capacity, network vulnerabilities, etc., and the affected data include network delays, communication interruptions, system paralysis, and data loss. One or more. In this embodiment, after the reporting data corresponding to the historical reporting task and the corresponding risk category are obtained, these data are mapped to the feature vector space to obtain the input feature vector and the expected output feature vector corresponding to each historical reporting task. Input feature vectors and expected output feature vectors are used to construct training samples for model training. During model training, supervised model training methods, such as logistic regression models, SVM (Support Vector Machine), and Bayesian Models, etc.

Taking SVM as an example, the stochastic gradient algorithm can be used for model training. During the gradient descent process, the cost function J (θ) needs to be minimized. In some embodiments, the cost function can be expressed by the following formula:

m represents the number of sample features in the training set, x ⁽ⁱ⁾ is the input feature vector, y ⁽ⁱ⁾ is the expected output feature vector, and h _θ (x ⁽ⁱ⁾ ) is the actual output feature vector for each training, where,

among them,

That is, θ ^T x is equal to the sum of the product of features and parameters, where x ⁽ⁱ⁾ is the input feature vector.

In some embodiments, the method further includes: when it is determined that there is report data that fails the review according to the review data, generating a revision task according to the report data that fails the review and its corresponding review data, and sending the revision task to the target interface Party corresponding terminal.

Specifically, the revision task includes the reporting data and review data corresponding to the risk event to be revised, and is used to instruct the target interface party to revise the reported data according to the review data. Further, after the target interface party completes the revision task, it sends the revised corresponding reporting data to the risk management server through its corresponding terminal again, and the risk management server sends the revised reporting data to the corresponding terminal of the reviewer again and accepts it. After the review data returned from the terminal corresponding to the reviewer, judge again whether the risk event passes the review, and if it passes, proceed to the above step S214, otherwise repeat the steps in this embodiment until the risk event passes the review.

In some embodiments, the above method further includes: generating a tracking task for each risk event in the risk event set to obtain a tracking task set; allocating each tracking task in the tracking task set to a terminal corresponding to the target interface party; and receiving a target interface party corresponding The feedback data sent by the terminal is sent to the terminal corresponding to the event investigator.

Among them, feedback data refers to data related to improvement measures for risk events, including the implementation status, progress description, and output description of each improvement measure. Among them, the implementation status includes unimplemented, ongoing, and completed implementation. The progress description refers to the current progress corresponding to the implementation status, and the output description refers to the result description corresponding to the current progress.

In this embodiment, the risk management server may mark the status of each event reporting task, mark the event reporting task as incomplete for the event that has not received the reported data, and mark the event reporting task that has received the reported data and has not passed the review as In the process of completion, the event reporting task that has passed the review is marked as completed. The risk management server can query the current completion status corresponding to each event reporting task from the database every preset time, such as every other day, filter out all the event reporting tasks whose current status is incomplete, and calculate each outstanding task separately. The time difference between the time when the event reporting task was created and the current time determines whether the time difference is greater than a preset threshold, where the preset threshold can be set and changed according to business needs. For example, if the creation time of a report task at a certain time is "April 3, 2018", the current time is "April 7, 2018", and the preset threshold is 2, it can be determined that the time difference 4 is greater than the preset Threshold 2.

Further, when the time difference corresponding to an event reporting task is greater than a preset threshold, a reminder message is generated for the event reporting task, and the reminder information is sent to the terminal corresponding to the target interface party corresponding to the event reporting task.

In this embodiment, by generating a reminder message for an event reporting task whose time difference exceeds a preset threshold and sending it to a terminal corresponding to the target interface party, an automatic reminder for the target interface party can be implemented, thereby improving the completion failure of the task.

It should be understood that although the steps in the flowchart of Fig. 2-3 are displayed in sequence as indicated by the arrows, these steps are not necessarily performed sequentially in the order indicated by the arrows. Unless explicitly stated in this document, the execution of these steps is not strictly limited, and these steps can be performed in other orders. Moreover, at least part of the steps in Figure 2-3 may include multiple sub-steps or stages. These sub-steps or stages are not necessarily performed at the same time, but may be performed at different times. These sub-steps or stages The execution order of is not necessarily performed sequentially, but may be performed in turn or alternately with at least a part of another step or a sub-step or stage of another step.

In some embodiments, as shown in FIG. 4, a risk management data processing device 400 is provided, and the device includes:

The risk event set acquisition module 402 is configured to acquire a risk event set, where each risk event in the risk event set carries a user identifier;

An event reporting task creation module 404 is configured to create corresponding event reporting tasks for each risk event and obtain a set of event reporting tasks;

The target interface party selection module 406 is configured to select the target interface party corresponding to each event reporting task from the set of interface parties corresponding to each risk event according to the user identifier, and send each event reporting task to the terminal corresponding to its target interface party;

The risk type acquisition module 408 is configured to receive the report data sent by the terminal corresponding to the target interface party. The report data includes the cause data and influence data of each risk event. Based on the cause data and influence data, a preset classification model is used to obtain the corresponding risk event correspondence. Risk type

A reporting data sending module 410, configured to select a reviewer corresponding to each risk event according to the type of risk, and send the report data to a terminal corresponding to each reviewer;

A report file generating module 412 is configured to receive the review data sent by the terminal corresponding to each reviewer. When it is determined that the review data corresponding to any risk event passes the review based on the review data, a report file is generated based on the report data passed by the review.

In some embodiments, the risk event set acquisition module 402 is configured to acquire source data corresponding to the risk event, create an ETL task based on the source data, trigger an ETL tool to run the ETL task, and obtain a risk event set according to a running result corresponding to the ETL task.

In some embodiments, the target interface party selection module 406 is configured to obtain the long-connected state corresponding to each interface party in the set of interface parties, and use the interface party whose long-connected state is maintained as the candidate interface party to obtain the set of candidate interface parties. To obtain the task priority corresponding to each candidate interface party in the candidate interface party set, and select the candidate interface party with the highest task priority from the candidate interface party set as the target interface party.

In some embodiments, the above-mentioned device further includes: a classification model training module for obtaining reporting data corresponding to the historical reporting task and corresponding risk categories; obtaining a training set according to the cause data, impact data, and risk categories corresponding to the reporting data; according to The training set is modeled to obtain a classification model.

In some embodiments, the above-mentioned device further includes: a revision task generating and sending module, configured to generate a revision based on the report data that fails the review and the corresponding review data when it is determined that there is report data that fails the review. Task, sending the revision task to the terminal corresponding to the target interface party.

In some embodiments, the above device further includes: a risk event tracking module, configured to generate a tracking task for each risk event in the risk event set, to obtain a tracking task set; and assign each tracking task in the tracking task set to a target interface party. Terminal: receiving feedback data sent by the terminal corresponding to the target interface party, and sending the feedback data to the terminal corresponding to the event investigation party.

In some embodiments, the above device further includes: a task reminder module, configured to obtain the current status corresponding to each event reporting task, filter out all event reporting tasks whose current status is incomplete, and calculate each current status as uncompleted respectively The time difference between the creation time of the event reporting task and the current time. When the time difference is greater than a preset threshold, a reminder message is generated and sent to the terminal corresponding to the target interface party.

For the specific limitation of the risk management data processing device, refer to the foregoing limitation on the risk management data processing method, which is not repeated here. Each module in the above-mentioned risk management data processing device may be implemented in whole or in part by software, hardware, and a combination thereof. The above-mentioned modules may be embedded in the hardware in or independent of the processor in the computer device, or may be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

In some embodiments, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. 5. The computer device includes a processor, a memory, a network interface, and a database connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, computer-readable instructions, and a database. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in a non-volatile storage medium. The database of the computer equipment is used to store various data in the process of risk management data processing, such as the current status data of the event reporting task, the information of each interface party in the interface party set, and the status of the persistent connection. The network interface of the computer device is used to communicate with an external terminal through a network connection. The computer-readable instructions are executed by a processor to implement a risk management data processing method.

Those skilled in the art can understand that the structure shown in FIG. 5 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer equipment to which the solution of the present application is applied. The specific computer equipment may be Include more or fewer parts than shown in the figure, or combine certain parts, or have a different arrangement of parts.

In some embodiments, a computer device is provided, including a memory and a processor. The memory stores computer-readable instructions. When the processor executes the computer-readable instructions, the processor implements the following steps: obtaining a risk event set, and obtaining the risk event set. Each risk event carries a user identification; a corresponding event reporting task is created for each risk event to obtain an event reporting task set; and a target interface party corresponding to each event reporting task is selected from the set of interface parties corresponding to each risk event according to the user identification, Send each event reporting task to the terminal corresponding to its target interface party; receive the reporting data sent by the terminal corresponding to the target interface party, the reporting data includes the cause data and impact data of each risk event, and presets are adopted based on the cause data and impact data Based on the classification model to obtain the risk type corresponding to each risk event; select the reviewer corresponding to each risk event according to the risk type, and send the reported data to the terminal corresponding to each reviewer; receive the review data sent by the terminal corresponding to each reviewer When it is determined that the reported data corresponding to any risk event passes the review based on the review data, a report file is generated based on the reported data passed the review.

In some embodiments, the step of obtaining a set of risk events includes: obtaining source data corresponding to the risk event; creating an ETL task based on the source data, triggering an ETL tool to run the ETL task; and obtaining a set of risk events according to a running result corresponding to the ETL task.

In some embodiments, the step of selecting the target interface party corresponding to each event reporting task from the interface party set corresponding to each risk event according to the user identification includes: obtaining the long connection status corresponding to each interface party in the interface party set, and The interface party whose connection status is maintained is used as the candidate interface party to obtain the candidate interface party set; obtain the task priority corresponding to each candidate interface party in the candidate interface party set; and select the task priority from the candidate interface party set. The highest candidate interface party is the target interface party.

In some embodiments, when the processor executes the computer-readable instructions, the following steps are further implemented: the preset classification model can be trained by: obtaining the reporting data corresponding to the historical reporting task and the corresponding risk category; according to the reporting data, Cause data, impact data, and risk categories are obtained from the training set; the model is obtained from the training set to obtain the classification model.

In some embodiments, when the processor executes the computer-readable instructions, the processor further implements the following steps: when it is determined that there is report data that fails the review according to the review data, generating a revision task according to the report data that fails the review and its corresponding review data To send the revision task to the terminal corresponding to the target interface party.

In some embodiments, when the processor executes the computer-readable instructions, the following steps are further implemented: generating a tracking task for each risk event in the risk event set to obtain a tracking task set; assigning each tracking task in the tracking task set to a target interface party correspondingly The terminal receives feedback data sent by the terminal corresponding to the target interface party, and sends the feedback data to the terminal corresponding to the event investigation party.

In some embodiments, when the processor executes the computer-readable instructions, the following steps are further implemented: acquiring the current status corresponding to each event reporting task, filtering out all event reporting tasks whose current status is incomplete, and calculating each current status as uncompleted separately The time difference between the creation time of the completed event reporting task and the current time. When the time difference is greater than a preset threshold, a reminder message is generated and sent to the terminal corresponding to the target interface party.

In some embodiments, a computer-readable storage medium is provided on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor, the following steps are implemented: acquiring a risk event set, and each risk event in the risk event set. Carry the user ID; create corresponding event reporting tasks for each risk event to obtain the event reporting task set; select the target interface party corresponding to each event reporting task from the set of interface parties corresponding to each risk event according to the user ID, and report each event The reporting task is sent to the terminal corresponding to its target interface party; receiving the reporting data sent by the terminal corresponding to the target interface party, the reporting data includes the cause data and impact data of each risk event, and a preset classification model is adopted according to the cause data and impact data Obtain the risk type corresponding to each risk event; select the reviewer corresponding to each risk event according to the risk type, and send the reported data to the terminal corresponding to each reviewer; receive the review data sent by the terminal corresponding to each reviewer, and based on the review data When it is determined that the reported data corresponding to any risk event passes the review, a report file is generated based on the reported data passed the review.

In some embodiments, when the computer-readable instructions are executed by the processor, the following steps are also implemented: the preset classification model can be trained by: obtaining the reporting data corresponding to the historical reporting task and the corresponding risk category; corresponding to the reporting data The cause data, impact data, and risk category of the training set are obtained; the model is obtained based on the training set to obtain the classification model.

In some embodiments, when the computer-readable instructions are executed by the processor, the following steps are further implemented: when it is determined from the review data that there is report data that fails the review, generating a revision based on the report data that fails the review and its corresponding review data Task, sending the revision task to the terminal corresponding to the target interface party.

In some embodiments, when the computer-readable instructions are executed by the processor, the following steps are further implemented: generating a tracking task for each risk event in the risk event set to obtain a tracking task set; and allocating each tracking task in the tracking task set to a target interface party Corresponding terminal; receiving feedback data sent by the terminal corresponding to the target interface party, and sending the feedback data to the terminal corresponding to the event investigation party.

In some embodiments, when the computer-readable instructions are executed by the processor, the following steps are also implemented: obtaining the current status corresponding to each event reporting task, filtering out all event reporting tasks whose current status is incomplete, and calculating each current status as The time difference between the creation time of the unfinished event and the current time is reported. When the time difference is greater than a preset threshold, a reminder message is generated and sent to the terminal corresponding to the target interface party.

A person of ordinary skill in the art can understand that all or part of the processes in the methods of the foregoing embodiments can be implemented by using computer-readable instructions to instruct related hardware. The computer-readable instructions can be stored in a non-volatile computer. In the readable storage medium, the computer-readable instructions, when executed, may include the processes of the embodiments of the methods described above. Wherein, any reference to the storage, storage, database, or other media used in the embodiments provided in this application may include non-volatile and / or volatile storage. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Synchlink DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

The technical features of the above embodiments can be arbitrarily combined. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, all It is considered to be the range described in this specification.

The above-mentioned embodiments only express several implementation manners of the present application, and the description thereof is more specific and detailed, but cannot be understood as a limitation on the scope of the invention patent. It should be noted that, for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of this application patent shall be subject to the appended claims.

Claims

A risk management data processing method includes:

Obtaining a set of risk events, each risk event in the set of risk events carrying a user identification;

Create corresponding event reporting tasks for each of the risk events, and obtain event reporting task sets;

Determining a target interface party corresponding to each of the event reporting tasks from the set of interface parties corresponding to each of the risk events according to the user identifier, and sending each of the event reporting tasks to a terminal corresponding to its target interface party;

Receiving report data sent by a terminal corresponding to the target interface party, the report data includes cause data and influence data of each of the risk events, and a preset classification model is used to obtain each report according to the cause data and the influence data. The type of risk corresponding to the risk event;

Selecting a reviewer corresponding to each of the risk events according to the risk type, and sending the reported data to a terminal corresponding to each of the reviewers; and

After receiving the review data sent by the terminal corresponding to each reviewer, when it is determined that the report data corresponding to any of the risk events has passed the review based on the review data, a report file is generated based on the report data passed the review.
The method according to claim 1, wherein the acquiring a set of risk events comprises:

Obtain source data corresponding to risk events;

Create an ETL task according to the source data, and trigger an ETL tool to run the ETL task; and

A risk event set is obtained according to a running result corresponding to the ETL task.
The method according to claim 1, wherein the selecting the target interface party corresponding to each event reporting task from the set of interface parties corresponding to each risk event according to the user identification, comprises:

Obtaining the long-connected state corresponding to each interface party in the set of interface parties, and using the interface party whose long-connected state is maintained as the candidate interface party to obtain the set of candidate interface parties;

Obtaining the task priority corresponding to each candidate interface party in the candidate interface party set; and

A candidate interface party with the highest task priority is selected from the set of candidate interface parties as a target interface party.
The method according to claim 1, wherein the generating step of the preset classification model comprises:

Obtain reporting data corresponding to historical reporting tasks and corresponding risk categories;

Obtaining a training set according to the cause data, impact data and risk category corresponding to the reported data; and

Perform a model according to the training set to obtain a classification model.
The method according to claim 1, further comprising:

When it is determined according to the review data that there is report data that fails the review, a revision task is generated based on the report data that fails the review and its corresponding review data, and the revision task is sent to a terminal corresponding to the target interface party .
The method according to claim 1, further comprising:

Generate tracking tasks for each risk event in the risk event collection to obtain the tracking task collection;

Assigning each tracking task in the tracking task set to a terminal corresponding to the target interface party; and

Receiving feedback data sent by a terminal corresponding to the target interface party, and sending the feedback data to a terminal corresponding to the event investigation party.
The method according to any one of claims 1 to 6, further comprising:

Acquiring the current status corresponding to each of the event reporting tasks, and filtering out all event reporting tasks whose current status is incomplete; and

Calculate the time difference between the creation time of each event reporting task whose current status is incomplete and the current time, and when the time difference is greater than a preset threshold, generate a reminder message and send the reminder information to the target The terminal corresponding to the interface.
A risk management data processing device includes:

A risk event set acquisition module, configured to acquire a risk event set, where each risk event in the risk event set carries a user identifier;

An event reporting task creation module, configured to create corresponding event reporting tasks for each of the risk events, and obtain an event reporting task set;

The target interface party selection module is configured to select a target interface party corresponding to each event reporting task from a set of interface parties corresponding to each risk event according to the user identifier, and send each event reporting task to a terminal corresponding to its target interface party. ;

A risk type acquisition module is configured to receive report data sent by a terminal corresponding to the target interface party, the report data includes cause data and influence data of each risk event, and a preset classification model is adopted according to the cause data and influence data. Get the risk type corresponding to each risk event;

A reporting data sending module, configured to select a reviewer corresponding to each risk event according to the risk type, and send the reported data to a terminal corresponding to each reviewer; and

A report file generating module is configured to receive the review data sent by the terminal corresponding to each reviewer. When it is determined that the review data corresponding to any risk event passes the review based on the review data, a report file is generated based on the report data passed by the review.
The device according to claim 8, wherein the risk event set acquisition module is configured to acquire source data corresponding to the risk event, create an ETL task based on the source data, trigger an ETL tool to run the ETL task, and perform an ETL task according to the The result of the operation is a set of risk events.
The device according to claim 8, wherein the target interface party selection module is configured to obtain a long connection status corresponding to each interface party in the interface party set, and the interface party whose long connection state is maintained is used as the candidate interface party, The candidate interface party set is obtained, the task priority corresponding to each candidate interface party in the candidate interface party set is obtained, and the candidate interface party with the highest task priority is selected from the candidate interface party set as the target interface party.
A computer device includes a memory and one or more processors. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the one or more processors, the one or more processors are caused. Each processor performs the following steps:

Obtaining a set of risk events, each risk event in the set of risk events carrying a user identification;

Create corresponding event reporting tasks for each of the risk events, and obtain event reporting task sets;

Determining a target interface party corresponding to each of the event reporting tasks from the set of interface parties corresponding to each of the risk events according to the user identifier, and sending each of the event reporting tasks to a terminal corresponding to its target interface party;

Receiving report data sent by a terminal corresponding to the target interface party, the report data includes cause data and influence data of each of the risk events, and a preset classification model is used to obtain each report according to the cause data and the influence data. The type of risk corresponding to the risk event;

Selecting a reviewer corresponding to each of the risk events according to the risk type, and sending the reported data to a terminal corresponding to each of the reviewers; and

After receiving the review data sent by the terminal corresponding to each reviewer, when it is determined that the report data corresponding to any of the risk events has passed the review based on the review data, a report file is generated based on the report data passed the review.
The computer device of claim 11, wherein the processor further executes the following steps when executing the computer-readable instructions:

Obtain source data corresponding to risk events;

Create an ETL task according to the source data, and trigger an ETL tool to run the ETL task; and

A risk event set is obtained according to a running result corresponding to the ETL task.
The computer device of claim 11, wherein the processor further executes the following steps when executing the computer-readable instructions:

Obtaining the long-connected state corresponding to each interface party in the set of interface parties, and using the interface party whose long-connected state is maintained as the candidate interface party to obtain the set of candidate interface parties;

Obtaining the task priority corresponding to each candidate interface party in the candidate interface party set; and

A candidate interface party with the highest task priority is selected from the set of candidate interface parties as a target interface party.
The computer device of claim 11, wherein the processor further executes the following steps when executing the computer-readable instructions:

Obtain reporting data corresponding to historical reporting tasks and corresponding risk categories;

Obtaining a training set according to the cause data, impact data and risk category corresponding to the reported data; and

Perform a model according to the training set to obtain a classification model.
The computer device of claim 11, wherein the processor further executes the following steps when executing the computer-readable instructions:

When it is determined according to the review data that there is report data that fails the review, a revision task is generated based on the report data that fails the review and its corresponding review data, and the revision task is sent to a terminal corresponding to the target interface party .
One or more non-transitory computer-readable storage media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the following steps:

Obtaining a set of risk events, each risk event in the set of risk events carrying a user identification;

Create corresponding event reporting tasks for each of the risk events, and obtain event reporting task sets;

Determining a target interface party corresponding to each of the event reporting tasks from the set of interface parties corresponding to each of the risk events according to the user identifier, and sending each of the event reporting tasks to a terminal corresponding to its target interface party;

Receiving report data sent by a terminal corresponding to the target interface party, the report data includes cause data and influence data of each of the risk events, and a preset classification model is used to obtain each report according to the cause data and the influence data. The type of risk corresponding to the risk event;

Selecting a reviewer corresponding to each of the risk events according to the risk type, and sending the reported data to a terminal corresponding to each of the reviewers; and

After receiving the review data sent by the terminal corresponding to each reviewer, when it is determined that the report data corresponding to any of the risk events has passed the review based on the review data, a report file is generated based on the report data passed the review.
The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further performed:

Obtain source data corresponding to risk events;

Create an ETL task according to the source data, and trigger an ETL tool to run the ETL task; and

A risk event set is obtained according to a running result corresponding to the ETL task.
The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further performed:

Obtaining the long-connected state corresponding to each interface party in the set of interface parties, and using the interface party whose long-connected state is maintained as the candidate interface party to obtain the set of candidate interface parties;

Obtaining the task priority corresponding to each candidate interface party in the candidate interface party set; and

A candidate interface party with the highest task priority is selected from the set of candidate interface parties as a target interface party.
The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further performed:

Obtain reporting data corresponding to historical reporting tasks and corresponding risk categories;

Obtaining a training set according to the cause data, impact data and risk category corresponding to the reported data; and

Perform a model according to the training set to obtain a classification model.
The storage medium according to claim 16, wherein when the computer-readable instructions are executed by the processor, the following steps are further performed:

When it is determined according to the review data that there is report data that fails the review, a revision task is generated based on the report data that fails the review and its corresponding review data, and the revision task is sent to a terminal corresponding to the target interface party .