Purchase abnormity monitoring and fraud early warning method and system based on behavior analysis

Abstract

The invention relates to the technical field of information, and provides a purchase abnormity monitoring and fraud early warning method and system based on behavior analysis, and the method comprises the steps: obtaining the position and authority information of a purchaser, setting different purchase amount thresholds and approval limits according to authority levels, building respective behavior mode baselines for the purchaser at different positions, meanwhile, purchasing mode characteristics of each purchaser are identified based on historical purchasing records of the purchasers; purchasing behaviors of purchasing personnel are monitored in real time, the purchasing behaviors are compared with a personal historical purchasing mode and a general purchasing mode of a team where the purchasing behaviors are located in combination with personal purchasing mode characteristics and behavior mode baselines, and if abnormity obviously deviating from the baselines or the team modes is found, the purchasing behaviors are marked as suspected abnormal purchasing behaviors; key attributes of suspected fraud orders are extracted, the key attributes comprise order amount, supplier information and purchasing time, and whether associated orders appearing for multiple times by the same supplier in similar time exist or not is analyzed;

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method and system for monitoring procurement anomalies and early warning of fraud based on behavior analysis. Background Art

[0002] In the analysis and detection of corporate procurement fraud, a key technical problem is how to accurately identify those frequent small-amount purchases or suspicious purchases close to the approval limit. This requires quickly screening out purchase records with abnormal amounts from the massive procurement data, and judging whether these records have artificially split orders. However, simply relying on the size of the purchase amount to judge whether there is a problem may produce a lot of false positives. Because in actual business scenarios, small-amount purchases and purchases close to the approval limit are normal within a certain amount. Therefore, the technical difficulty lies in how to design a set of intelligent methods that can fully consider the complexity of the business scenario, exclude normal small-amount purchases and purchases close to the approval limit, and at the same time not miss those suspicious orders that are artificially split. At the same time, it is also necessary to monitor the massive data in the procurement system in real time, use big data processing technology to quickly discover new suspicious orders, and issue warnings in time to provide clues for subsequent investigations. This requires a balance between accuracy and real-time performance, so as to effectively solve the hidden dangers of procurement fraud. This is a technical problem that needs to be solved urgently. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides a procurement anomaly monitoring and fraud early warning method based on behavior analysis, which mainly includes:

[0004] Obtain the position and authority information of procurement personnel, set different procurement amount thresholds and approval limits according to the authority level, establish behavioral pattern baselines for personnel in different positions, and identify the procurement pattern characteristics of each person based on their historical procurement records;

[0005] Monitor the purchasing behavior of purchasers in real time, combine the characteristics of individual purchasing patterns and the baseline of behavior patterns, and compare them with the individual's historical purchasing patterns and the general purchasing patterns of the team. If anomalies are found that deviate from the baseline or team pattern, they will be marked as suspected abnormal purchasing behavior. If no deviation is found, the purchasing behavior will be recorded as normal and the subsequent purchasing behavior will continue to be monitored.

[0006] For the suspected abnormal purchasing behavior that is marked, analyze whether the purchasing amount is close to the approval limit, and combine the purchasing frequency and time period factors to determine whether there is suspicion of artificial order splitting. If so, mark it as a suspected fraudulent order. If there is no suspicion of artificial order splitting, mark it as an abnormal but non-fraudulent order, generate an abnormal behavior report, and return to continue monitoring the purchasing behavior of the purchasing personnel;

[0007] Extract key attributes of suspected fraudulent orders, including order amount, supplier information, and purchase time, and analyze whether there are multiple related orders from the same supplier in a similar period of time;

[0008] If the total amount of related orders exceeds the approval limit of the purchasing personnel's position, it is determined that there is fraud in splitting the orders artificially, and it is marked as a confirmed fraud order, and a fraud report is generated. If it does not exceed the approval limit, the abnormal characteristics that deviate from the usual behavior patterns of individuals or teams are identified based on the purchasing personnel's position, historical purchasing situation, and behavioral pattern baseline, and early warning information is generated.

[0009] The present invention provides a procurement anomaly monitoring and fraud early warning system based on behavior analysis, which mainly includes:

[0010] Establish a behavior pattern baseline module to obtain the position and authority information of procurement personnel, set different procurement amount thresholds and approval limits according to the authority level, establish respective behavior pattern baselines for personnel in different positions, and identify the procurement pattern characteristics of each person based on the historical procurement records of each procurement personnel;

[0011] The real-time monitoring and marking module is used to monitor the purchasing behavior of purchasers in real time. It combines the characteristics of individual purchasing patterns and the baseline of behavioral patterns to compare them with the individual's historical purchasing patterns and the general purchasing patterns of the team. If an abnormality is found that deviates from the baseline or the team pattern, it is marked as a suspected abnormal purchasing behavior. If no deviation is found, the purchasing behavior is recorded as normal and the subsequent purchasing behavior continues to be monitored.

[0012] The abnormal purchasing behavior analysis module is used to analyze whether the purchase amount of the marked suspected abnormal purchasing behavior is close to the approval limit, and to determine whether there is suspicion of artificial order splitting based on the purchasing frequency and time period. If so, it is marked as a suspected fraudulent order. If there is no suspicion of artificial order splitting, it is marked as an abnormal but non-fraudulent order, and an abnormal behavior report is generated, and the module returns to continue monitoring the purchasing behavior of the purchasing personnel;

[0013] Suspected fraud order analysis module, used to extract key attributes of suspected fraud orders, including order amount, supplier information, and purchase time, and analyze whether there are multiple related orders from the same supplier in a similar period of time;

[0014] The report generation and early warning information module is used to generate fraud reports or early warning information to identify deviations from behavioral pattern characteristics. Specifically, if the total amount of the related orders exceeds the approval limit of the purchaser's position, it is determined that there is fraud in splitting the order artificially, and it is marked as a confirmed fraud order, and a fraud report is generated. If it does not exceed the approval limit, the abnormal characteristics that deviate from the usual behavior pattern of individuals or teams are identified based on the purchaser's position, historical procurement situation, and behavioral pattern baseline, and early warning information is generated. .

[0015] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0016] The invention discloses a method for monitoring and early warning of purchase anomalies and fraud based on behavior analysis. By setting purchase amount thresholds and approval limits for different positions, respective behavior pattern baselines are established, and historical purchase records of each purchaser are extracted from the purchase system to identify the main purchase pattern characteristics. Purchase behavior is monitored in real time, and compared with personal historical purchase patterns and team general purchase patterns. If an abnormality that obviously deviates from the baseline or team pattern is found, it is marked as suspected abnormal purchase behavior. For suspected abnormal purchase behavior, whether the purchase amount is close to the approval limit is analyzed, and whether there is suspicion of artificial order splitting is judged in combination with purchase frequency and time period factors. If there is, it is marked as a suspected fraud order. Extract key attributes including order amount, supplier information, and purchase time, analyze whether there are multiple related orders from the same supplier in a similar time, and calculate the total amount of the related orders. Arrange these orders in chronological order, calculate the time interval between adjacent orders, identify time-intensive order groups, count the number of orders, total amount, first and last order dates, number of suppliers involved, and type of purchased items, analyze the distribution pattern of order amounts, and find out whether there is deliberate amount allocation. The present invention can effectively identify and prevent procurement fraud through multi-dimensional analysis and real-time monitoring, thereby improving the transparency and security of procurement management. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 The present invention is a flowchart of the method for monitoring procurement anomalies and early warning of fraud based on behavioral analysis. DETAILED DESCRIPTION

[0018] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] like Figure 1The procurement anomaly monitoring and fraud early warning method based on behavior analysis in this embodiment may specifically include:

[0020] S101. Obtain the position and authority information of the purchasing personnel, set different purchasing amount thresholds and approval limits according to the authority level, establish behavioral pattern baselines for personnel in different positions, and identify the purchasing pattern characteristics of each person based on the historical purchasing records of each purchasing personnel.

[0021] Obtain the position information and authority level of the purchasing personnel, set the purchasing amount threshold and approval limit according to the position information and authority level, and store the purchasing amount threshold and approval limit in the authority management database; extract the purchasing personnel's historical purchasing records from the purchasing system interface, perform data cleansing on the historical purchasing records, and obtain the cleansed purchasing data; group the cleansed purchasing data, identify the main purchasing pattern characteristics of the purchasing personnel, and generate a purchasing pattern feature vector; based on the purchasing amount threshold, determine whether the purchasing personnel's purchasing application amount exceeds the threshold, and if so, trigger a multi-level approval process; compare the purchasing personnel's actual purchasing behavior with the preset behavior pattern baseline to determine whether there is abnormal behavior, and if so, send an early warning signal to the risk control department.

[0022] Specifically, the position information and authority level of the purchasing staff are obtained from the human resources management system, and the corresponding purchase amount threshold and approval limit are set for different authority levels and stored in the authority management database. The decision tree algorithm is used to automatically generate threshold and limit rules for different positions. The rules include multiple dimensions such as position level, purchase category, and single purchase upper limit. At the same time, based on the position information, a behavioral pattern baseline is established for each type of purchasing staff, including characteristics such as purchase frequency, amount range, and commonly used suppliers. The behavioral pattern baseline is quantified by calculating the mean and standard deviation of historical data to form comparable numerical indicators. The procurement system interface is called to extract the historical procurement records of each purchasing staff in the past three years, including fields such as purchase order number, purchase amount, purchase date, and purchase item category. The procurement data is cleaned, including detecting and removing outliers and filling missing data with the average value. The K-means algorithm is used to group the cleaned procurement records to identify the main procurement pattern characteristics of each purchasing staff, such as preferred procurement categories, average single purchase amount, and procurement cycle. Based on the clustering results, a procurement pattern feature vector is generated for each purchasing staff. According to the purchase amount threshold in the authority management database, each purchase application of the purchaser is reviewed in real time. When the application amount exceeds the threshold, the multi-level approval process is automatically triggered. The purchase order can be generated only after approval. The approved purchase order data is converted into feature vectors that can be used for behavior analysis, including statistical indicators such as purchase frequency, average purchase amount, and purchase category distribution. These feature vectors are compared with the previously generated purchase pattern feature vectors to provide basic data for subsequent behavior analysis. The behavior analysis tool is built using the random forest algorithm to compare the actual purchase behavior of the purchaser with the preset behavior pattern baseline. When abnormal behavior is detected, such as a sudden increase in purchase frequency or a single purchase amount significantly exceeding the historical range, an early warning signal is sent to the risk control department. For abnormal behavior, a warning is first issued and additional review is required. If the problem is serious, the purchaser's purchase authority is temporarily restricted until the manual review is completed. The review results are used to update the purchaser's behavior pattern baseline and authority settings to ensure that the system can dynamically adjust to adapt to normal business changes. The human resources management system extracts the purchaser's position and authority level from the employee information table through SQL query statements. The decision tree algorithm uses job level, purchase category, and historical purchase data as input features to generate purchase amount thresholds and approval limit rules. For example, for junior purchasers, the upper limit of a single purchase in the office supplies category is set at 5,000 yuan, and the upper limit of the IT equipment category is 20,000 yuan. The authority management database uses a relational database to store these rules. The behavioral pattern baseline is established by calculating the statistical indicators of each purchaser's purchase data over the past three years, such as the average number of purchases per month, the mean and standard deviation of the single purchase amount. The procurement system interface uses the RESTful API interface call method to obtain procurement records.During the data cleaning process, the Z-score method is used to detect outliers, and data points with an absolute Z-score value greater than 3 are considered outliers and removed. The K-means algorithm uses features such as purchase frequency, amount, and category for clustering. The number of clusters is set to 5 and the number of iterations is set to 100 to obtain the main purchase mode of each purchaser. The real-time review module of the purchase application is implemented through a database trigger, which automatically triggers the review process when a new purchase application record is inserted. The feature vector generation process includes calculating the moving average and standard deviation of the purchase frequency and purchase amount within a 30-day sliding window, as well as the percentage distribution of the purchase category. The random forest algorithm uses 100 decision trees, and the features include purchase frequency deviation, amount deviation, category distribution change, etc. The anomaly detection threshold is set to a predicted probability greater than 0.95. When an anomaly is detected, the system automatically sends an email to notify the risk control department and marks the transaction as "requires additional review" in the procurement system. The manual review results dynamically adjust the system parameters by updating the user configuration in the permission management database.

[0023] S102. Monitor the purchasing behavior of purchasing personnel in real time, combine personal purchasing pattern characteristics and behavioral pattern baselines, and compare them with personal historical purchasing patterns and the general purchasing patterns of the team. If any deviation from the baseline or team pattern is found, it will be marked as suspected abnormal purchasing behavior. If no deviation is found, the purchasing behavior will be recorded as normal and the subsequent purchasing behavior will continue to be monitored.

[0024] Obtain each new purchase record of the purchasing staff, and extract the purchase amount, purchase date, and purchase category fields from the purchasing database; perform data cleaning based on the newly added purchase record fields, fill in missing values, use the quartile method to detect and remove outliers, and map numerical features to the range of zero to one through the minimum-maximum scaling method; perform principal component analysis on the cleaned purchasing behavior data set, calculate the purchase frequency, average purchase amount, and purchase category distribution indicators, and select the five principal components with the highest contribution rate as feature vectors; calculate the cosine similarity score of the feature vector with the personal historical pattern and the team pattern. If both similarity scores are lower than the preset threshold, the purchase behavior is determined to be suspected abnormal; if the purchase behavior is not determined to be suspected abnormal, the feature vector is stored in the purchasing staff's historical purchase record database, the personal purchasing pattern characteristics are updated, and the team's general purchasing pattern is updated at fixed intervals.

[0025] Specifically, each new purchase record of the purchaser is obtained from the purchase database in real time, and key fields such as purchase amount, purchase date, and purchase category are extracted. The original data is cleaned, including processing missing values, detecting outliers, and normalizing the data. Missing values ​​are filled by interpolation algorithms, outliers are detected and removed using the quartile method, and normalization uses the minimum-maximum scaling method to map numerical features to the 0-1 interval. After processing, a standardized purchase behavior data set is obtained. Principal component analysis (PCA) is used to extract features from the standardized purchase behavior data set. Key indicators such as purchase frequency (number of purchases per unit time), average purchase amount (total amount divided by number of purchases), and purchase category distribution (proportion of each category) are calculated. The top five principal components with the highest contribution rate are selected as feature vectors to form a digital representation of the current purchase behavior. These feature vectors contain key information about the purchase behavior, which is convenient for subsequent similarity calculation and anomaly detection. The historical purchase pattern characteristics of the purchaser and the general purchase pattern data of the team to which he belongs are retrieved from the user portrait database. The cosine similarity is used to calculate the similarity score between the current purchase behavior and the personal historical pattern and team pattern. The value range of cosine similarity is -1 to 1, and the closer to 1, the more similar. The similarity threshold is set to 0.8, which is determined by analyzing the normal and abnormal behaviors marked in the historical data. If both similarity scores are lower than 0.8, the purchase behavior is marked as suspected abnormal. If the purchase behavior is not marked as suspected abnormal, its feature vector is stored in the purchaser's historical purchase record database. The exponential moving average method is used to update the characteristics of personal purchase patterns, giving higher weights to recent purchases. At the same time, the team's general purchase pattern is updated once a week, and the average purchase behavior of all team members in the past month is calculated. The record is marked as normal purchase behavior, and subsequent purchase behaviors are monitored and analyzed in real time. This dynamic update mechanism ensures that the procurement system can adapt to the periodic changes in procurement patterns. The procurement database obtains new purchase records every 5 minutes through SQL queries, and extracts fields such as purchase amount, date, and category. First, fill the missing values ​​with the mean, such as filling the missing purchase amount with the average purchase amount of the purchaser in the past 30 days. Outlier detection uses the quartile method to mark data points that exceed Q3+1.5IQR or are below Q1-1.5IQR as outliers and removes them. During normalization, the purchase amount is mapped to the 0-1 interval through (x-min) / (max-min), and the purchase date is converted to the number of days from the current date and the same process is performed. min is the minimum value in the purchase amount list, and max is the maximum value in the purchase amount list. Principal component analysis (PCA) is applied to the standardized data to calculate the eigenvalues ​​and eigenvectors, and select the first few principal components with a cumulative contribution rate of 85%. For example, if the contribution rates of the first three principal components are 50%, 25%, and 15%, respectively, these three principal components are selected as eigenvectors.The purchase frequency is calculated as the number of purchases within 30 days, the average purchase amount is the total amount of 30 days divided by the number of times, and the purchase category distribution is expressed by the proportion of each category. The user portrait database stores the average of the feature vectors of the last 100 purchases of each purchaser as the personal history mode, and the team mode is the average of the feature vectors of all members in the last month. The formula for calculating cosine similarity is cos(θ)=A·B / (||A||·||B||), where A is the feature vector of the current purchase behavior, B is the feature vector of the comparison object (personal history or team mode), ||A||, ||B|| respectively represent the Euclidean norm of vectors A and B (i.e., the length of the vector), and cos(θ) is the cosine value of the angle between vectors A and B. If the similarity with both personal history and team mode is less than 0.8, it is marked as suspected abnormality. When normal purchase behavior updates personal mode, an exponential moving average of α=0.1 is used: new mode=0.1*new purchase data+0.9*old mode data. The team mode is automatically updated at 3 a.m. every Monday, calculating the arithmetic mean of all members' purchasing behaviors in the past 30 days. The anomaly detection results are pushed to the risk control system in real time through the message queue, and written into the log database for subsequent analysis.

[0026] S103. For the marked suspected abnormal purchasing behavior, analyze whether the purchasing amount is close to the approval limit, and combine the purchasing frequency and time period factors to determine whether there is suspicion of artificial order splitting. If so, mark it as a suspected fraudulent order. If there is no suspicion of artificial order splitting, mark it as an abnormal but non-fraudulent order, generate an abnormal behavior report, and return to continue monitoring the purchasing behavior of the purchasing personnel.

[0027] Obtain marked suspected abnormal purchase records, the suspected abnormal purchase records include purchase amount, purchase time and purchaser identification number; obtain the corresponding approval limit value according to the purchaser identification number, calculate the amount proximity, if the amount proximity is greater than a preset threshold, it is determined to be close to the approval limit; obtain recent purchase records based on the purchaser identification number, calculate the frequency anomaly index and time clustering index; use the amount proximity, frequency anomaly index and time clustering index as input features to train a classifier for identifying artificially split orders; the classifier judges the current suspected abnormal purchase behavior, if the confidence of the judgment result is greater than a first preset threshold, the purchase record is marked as a suspected fraudulent order, if the confidence of the judgment result is between the second preset threshold and the first preset threshold, it is marked as an abnormal but non-fraudulent order; for the marked abnormal but non-fraudulent order, generate an abnormal behavior report, the abnormal behavior report includes the performance of abnormal purchase behavior, relevant data indicators and preliminary judgment results; store the abnormal behavior report in a database, and update the risk level of the purchaser at the same time.

[0028] Specifically, the marked suspected abnormal purchase records are obtained from the abnormal purchase behavior database, and the key information such as the purchase amount, purchase time, and purchaser ID of the record are extracted. At the same time, the approval limit value corresponding to the purchaser is obtained from the authority management database. The amount proximity index is calculated using the formula of amount proximity = purchase amount / approval limit. When the value is greater than 0.9, it is judged to be close to the approval limit. Based on the purchaser ID, the purchase records of the purchaser in the past 90 days are extracted from the purchase history data, and the average purchase frequency and purchase time distribution are calculated. The ARIMA time series analysis method is used to detect abnormal fluctuations in the purchase frequency, and the frequency anomaly index is calculated as frequency anomaly index = (actual frequency-predicted frequency) / standard deviation of predicted frequency. The concentration of purchase time is analyzed by the K-means clustering algorithm, and the time clustering index is generated as time clustering index = time span of cluster center / total time span. The random forest algorithm is used to train a classifier for identifying artificially split orders with the amount proximity index, frequency anomaly index, and time clustering index as input features. The current suspected abnormal purchasing behavior is judged. If the confidence of the judgment result is greater than 0.8, the purchasing record is marked as a suspected fraudulent order. If the confidence of the judgment result is between 0.5 and 0.8, it is marked as abnormal but non-fraudulent behavior. For the abnormal purchasing records that are judged, an abnormal behavior report is automatically generated. The report content includes the specific manifestations of abnormal purchasing behavior, relevant data indicators and preliminary judgment results. The report is stored in the abnormal behavior report database, and the risk level of the purchaser in the procurement monitoring database is updated at the same time. Using the scorecard tool, the risk level is quantitatively adjusted according to the severity of the abnormal behavior, with 50 points added for suspected fraud and 30 points added for abnormal but non-fraud. If the total score exceeds 100, the purchaser will be included in the key monitoring list, and his subsequent purchasing behavior will be reviewed more frequently. The abnormal purchasing behavior database is updated once an hour through SQL queries to extract the latest suspected abnormal purchasing records. Assume that the purchase amount of purchaser A is 95,000 yuan, and the approval limit is 100,000 yuan. The calculated amount proximity is 0.95, which exceeds the threshold of 0.9 and is marked as close to the approval limit. At the same time, A's purchase records for the past 90 days are extracted from the purchase history data, and it is found that the average purchase is 3 times per week. The ARIMA (1,1,1) model is used to predict that the normal purchase frequency this week should be 3 times, while the actual frequency is 7 times, and the frequency anomaly index is calculated to be 2.67. The K-means clustering algorithm divides the 90-day purchase time into 3 clusters, the time span of the largest cluster is 5 days, and the total time span is 90 days, and the time clustering index is 0.056. The random forest algorithm uses these three indicators as input features and votes through 1,000 decision trees to obtain a probability of 0.85 that the purchase behavior is suspected of fraud. Because it exceeds the threshold of 0.8, the system marks this record as a suspected fraud order.The automatically generated abnormal behavior report contains the above data indicators and records the preliminary judgment result as "suspected fraud". The scorecard tool adds 50 points based on the suspicion of fraud, which increases A's risk score from 60 to 110. Because it exceeds the threshold of 100 points, A is added to the key monitoring list, and the frequency of review of its subsequent procurement behavior is increased from once a week to once a day.

[0029] Calculate the difference between the current purchase amount and the approval limit, pay attention to situations that are close to but not exceeding the limit, count the number of purchases and the total amount made by the purchaser, calculate the average purchase interval and the single purchase amount, and mark purchases made during non-working hours.

[0030] Obtain the amount information of the purchase record and the approval limit and rank information of the purchaser; wherein the amount information is extracted from the purchase database, and the approval limit and rank information are obtained from the authority management database; set a dynamic threshold according to the rank information, and if the difference between the purchase amount and the approval limit is less than the dynamic threshold, mark the purchase record as a quota purchase; calculate the total number of purchases and the total purchase amount by the time-weighted average method to obtain the average single purchase amount; at the same time, calculate the purchase frequency and amount proportion of each purchase category to form the distribution characteristics of the purchase category; use the exponential moving average method to calculate the average purchase interval, and use the standard deviation to measure the volatility of the purchase interval ; Construct a purchase frequency prediction tool in combination with the average purchase interval and volatility; determine whether the timestamp of the purchase record falls in the non-working time period; if the timestamp falls in the non-working time period, add a non-working time mark to the purchase record; calculate the proportion of non-working time purchases in total purchases; use the weighted average method to comprehensively consider the limit degree, purchase frequency abnormality, proportion of non-working time purchases and purchase category abnormality; wherein, the limit degree is determined by the ratio of the difference to the dynamic threshold, the purchase frequency abnormality is obtained by the purchase frequency prediction tool, and the purchase category abnormality is determined by the purchase category distribution characteristics, and the abnormality degree score of the purchase record is obtained.

[0031] Specifically, the amount information of the current purchase record is extracted from the purchase database, and the approval limit and rank of the purchaser are obtained from the authority management database. Dynamic thresholds are set according to the rank, and the judgment standard for approaching the limit for senior purchasers is set to 5%, 10% for intermediate purchasers, and 15% for junior purchasers. The difference between the purchase amount and the approval limit is obtained by numerical calculation. If the difference is less than the dynamic threshold of the corresponding rank, the purchase record is marked as a purchase close to the limit. Based on the purchaser ID, all purchase records of the purchaser in the past 180 days are retrieved from the purchase history database. The total number of purchases and the total amount of purchases are calculated using the time-weighted average method, and recent purchases are given a higher weight. The average single purchase amount is obtained by dividing the weighted total amount by the weighted total number of times. At the same time, the purchase frequency and amount ratio of each purchase category are calculated to form the distribution characteristics of the purchase category. The purchase history records are sorted by time, and the time interval between two adjacent purchases is calculated. The average purchase interval is calculated using the exponential moving average method, and the volatility of the purchase interval is measured using the standard deviation. Combining these indicators, a purchase frequency prediction tool is constructed to identify abnormally frequent or sparse purchase behaviors. The timestamp of each purchase record is compared with the preset working time range. The working time is defined as 9:00-18:00 on working days, taking into account statutory holidays. If the purchase time falls within the non-working time period, a non-working time mark is added to the record. The proportion of non-working time purchases in total purchases is calculated as one of the evaluation indicators of abnormal purchase behavior. Finally, the weighted average method is used to combine all calculated indicators, including the degree of approaching the limit, the abnormality of purchase frequency, the proportion of non-working time purchases, and the abnormality of purchase categories, to obtain an abnormality degree score from 0 to 100. The purchase database extracts purchase records in real time through SQL queries. For example, the purchase amount of purchaser A is 95,000 yuan, the approval limit is 100,000 yuan, and the job level is intermediate. The calculated difference is 5,000 yuan, accounting for 5%, which is less than the dynamic threshold of 10% for intermediate personnel, and is automatically marked as a purchase close to the limit. At the same time, A's purchase records for the past 180 days are retrieved, and the total purchase amount and number of purchases are calculated using the time-weighted average method. The weight factor is set to 0.98^n, where n is the number of days since today. Assuming the weighted total amount is 1,500,000 yuan and the weighted total number of times is 20, the average single purchase amount is 75,000 yuan. It is also calculated that the proportions of the three main purchase categories of office supplies, IT equipment, and raw materials are 30%, 45%, and 25% respectively. The average purchase interval is calculated using the exponential moving average method (α=0.2) to be 9 days, with a standard deviation of 2 days. Based on these data, the purchase frequency prediction tool uses the ARIMA (1,1,1) model to predict that the next purchase should occur within 8-10 days. Comparing the purchase timestamp with the preset time range, it is found that the purchase occurred at 15:30 on Saturday, and the non-working time mark is automatically added. It is calculated that the proportion of A's non-working time purchases is 15%.Finally, the weighted average method is used to combine the indicators into the degree of proximity to the limit, with a weight of 0.3, the abnormality of procurement frequency, with a weight of 0.25, the proportion of non-working hours procurement, with a weight of 0.2, and the abnormality of procurement category, with a weight of 0.25, resulting in an abnormality score of 78 points.

[0032] S104. Extract key attributes of suspected fraudulent orders, including order amount, supplier information, and purchase time, and analyze whether there are multiple related orders from the same supplier within a similar period of time.

[0033] Obtain order records marked as suspected fraud in a purchase order database, wherein the order records include order amount, supplier ID and purchase time; calculate the interquartile range of the order amount based on the order records, and if the order amount is less than a first preset range or greater than a second preset range, mark the order as an abnormal order; for the abnormal order, set a preset time sliding time window centered on the purchase time of the order, and group the orders with the same supplier ID within the time window; calculate the time interval and amount difference between adjacent orders in the group, and construct an order feature vector including the order quantity, total order amount, average order amount and standard deviation of the order amount; perform anomaly detection on the order feature vector, and if the detection result is determined to be abnormal, mark the order set as an abnormal order set and update the purchase risk record.

[0034] Specifically, extract order records marked as suspected fraud from the purchase order database, and obtain key attributes such as the amount, supplier ID, and purchase time of each order. Use the interquartile range (IQR) method to identify and process outliers, mark data less than Q1-1.5IQR or greater than Q3+1.5IQR as abnormal, perform data cleaning and format unification, and ensure data consistency and reliability. Q1 is the first quartile (lower quartile), which refers to the value at the 25% position after sorting the data from small to large. Q3 is the third quartile (upper quartile), which refers to the value at the 75% position after sorting the data from small to large. IQR is the interquartile range, which is equal to the difference between Q3 and Q1, that is, IQR=Q3 -Q1. For each suspected fraudulent order, set a 7-day sliding time window, and retrieve other orders with the same supplier ID as the order within this window. Use the K-means clustering algorithm to group these orders by time and identify a set of orders with similar time. Calculate the time interval and amount difference between adjacent orders in the order set to construct the order time series features. For each identified set of orders with similar time, calculate the number of orders, total order amount, average order amount and standard deviation of order amount. Analyze the continuity of the amounts of adjacent orders, calculate the mean and variance of the amount difference, and use them to identify possible order splitting behaviors. Construct an order feature vector, which includes the above statistical indicators and time series features. Use the isolation forest algorithm to detect anomalies on the order feature vector. Set specific anomaly judgment criteria, such as the number of orders exceeding 3 times the daily average and the total order amount approaching 95% of the approval limit. Mark the order set judged as abnormal and calculate the total amount of all orders in the set. At the same time, deeply analyze the relevant supplier information, including supplier registration time, historical transaction frequency, credit rating, etc., to identify possible affiliated companies or fake suppliers. The abnormal order collection information and supplier analysis results are associated with the original suspected fraudulent orders, and the relevant records in the procurement risk database are updated. The procurement order database extracts suspected fraudulent orders through SQL query, such as order number A001, amount 95,000 yuan, supplier ID S123, and procurement time 2023-06-15 14:30. The interquartile range method is used to process outliers, and Q1 = 50,000, Q3 = 150,000, IQR = 100,000, and data less than -100,000 or greater than 300,000 are marked as abnormal and removed. A 7-day sliding window is set to retrieve 5 orders from the same supplier S123. K-means clustering, where k = 2, divides these orders into two groups: {A001, A002, A003} and {A004, A005}. The mean of the calculated order interval time is 1.2 days and the standard deviation is 0.5 days. The mean difference in order amount is 5,000 yuan, and the variance is 1,000,000. Construct the feature vector: [3,285000,95000,2500,1.2,0.5,5000,1000000], which represents the number of orders, total amount, average amount, amount standard deviation, time interval mean, time interval standard deviation, amount difference mean, amount difference variance. Isolation forest algorithm, with 100 trees and 256 samples, calculates the anomaly score to be 0.85, which exceeds the threshold of 0.8 and is considered abnormal. Supplier analysis shows that S123 was registered on 2023-01-01, with a transaction frequency of 3 times per month in the past six months and a credit rating of B. Set the abnormal orders into

[0035] {A001, A002, A003}, total amount RMB 285,000, supplier information is associated with the original fraud order A001, and the risk database is updated.

[0036] Arrange related orders that appear multiple times in a similar period from the same supplier in chronological order, calculate the time intervals between adjacent orders, and identify time-intensive order groups; count the order information of each order group, including order quantity, total amount, first and last order dates, number of suppliers, and type of purchased items.

[0037] Obtain order records, sort them in ascending order according to the timestamps of the order records to obtain an ordered order sequence, and calculate the time intervals between adjacent orders in the ordered order sequence to obtain a time interval sequence. Scan the time interval sequence, determine the time threshold according to the statistical characteristics of the time interval sequence, and if it is detected that the time interval of multiple consecutive orders is less than the time threshold, mark these orders as an order group. For the order group, extract the order records in the order group, count the characteristic indicators of the order records, and generate a feature vector that characterizes the characteristics of the order group. Standardize the feature vector, reduce the dimension of the standardized feature vector, and obtain the feature vector after dimension reduction. Perform cluster analysis on the feature vector after dimension reduction, identify a set of order groups with similar procurement pattern characteristics, and determine whether the order group is an abnormal order group.

[0038] Specifically, all relevant order records are extracted from the purchase order database, sorted in ascending order according to the order timestamp to form an ordered order sequence, and the time intervals between adjacent orders are calculated to generate a time interval sequence. The adaptive sliding window algorithm is used to scan the time interval sequence, and the time threshold is dynamically adjusted according to the statistical characteristics of historical purchase data. The median and standard deviation of the order time intervals in the past 30 days are calculated, and the threshold is set to the median minus two times the standard deviation. If the time interval of multiple consecutive orders is less than the threshold, these orders are marked as a time-intensive order group, and the start and end indexes of each order group are recorded. For each identified order group, all order records in the group are extracted, the number of orders is counted, the total order amount is calculated, the first and last order dates are determined, and the number of different suppliers is counted. The purchased items are classified and summarized and marked with predefined item category codes. The mean, median, standard deviation, and maximum and minimum values ​​of the order amount are calculated. The time series decomposition technology is used to decompose the purchasing behavior in the order group into trend, seasonality, and random components, and the time series features are extracted. The feature vector of the order group is generated, which contains all the above statistical indicators and time series features. The generated order group feature vectors were preprocessed and standardized using the Z-score method to eliminate the dimensional differences between different features. Principal component analysis (PCA) was applied for dimensionality reduction, and the principal components that explained 85% of the variance were retained. The preprocessed feature vectors were clustered using the DBSCAN algorithm, where epsi lon is a distance threshold, and the parameter epsi lon is set to the average value of the nearest neighbor distance in the feature space, that is, the distances of all data points to their nearest neighbors are calculated, and then the average of these distances is taken as the epsi lon value. minPoints defines how many neighboring points a core point needs to have to be considered a core point. Core points are the basis of density clustering, and they define the boundaries of clusters. minPoints is set to twice the feature dimension. Order groups with similar procurement pattern characteristics are identified, and abnormal order groups that cannot be classified are marked. The clustering results are associated with the original order data, and the relevant records in the procurement risk database are updated. The purchase order database extracts 10,000 order records in the past 180 days through SQL queries, which are arranged in ascending order by timestamp. The time intervals between adjacent orders are calculated to obtain 9999 interval values. The adaptive sliding window algorithm calculates the median of the order time interval in the past 30 days as 12 hours, the standard deviation is 4 hours, and the dynamic threshold is set to 4 hours. Scan the time interval sequence and identify 50 time-intensive order groups. Count each order group. For example, order group A contains 15 orders with a total amount of 1.5 million yuan, involving 3 suppliers, and the purchased items are classified as "office supplies" and "IT equipment", accounting for 60% and 40% respectively.The mean order amount is 100,000 yuan, the median is 95,000 yuan, the standard deviation is 20,000 yuan, the maximum is 150,000 yuan, and the minimum is 70,000 yuan. Use STL decomposition to decompose the time series into trend, seasonal and random components, and extract features such as trend slope of 5,000 yuan / day and seasonal cycle of 7 days. Generate feature vectors for 50 order groups, each containing 20 features. After Z-score standardization, PCA dimension reduction is applied, and the first 5 principal components are retained, which explain 85.6% of the variance, which means that these 5 principal components contain 85.6% of the information of the original data. DBSCAN clustering, where the eps i lon parameter = 0.5 and the minPoints parameter = 10, divides the order groups into 3 categories and marks 2 abnormal groups at the same time. The clustering results show that category 1 contains 30 order groups, category 2 contains 12, category 3 contains 6, and 2 abnormal groups are marked separately. Update the results to the risk database and associate the original order data.

[0039] Analyze the distribution pattern of order amounts, and find and determine whether there are orders with deliberate amount distribution.

[0040] All order amount data within a specified time period are obtained from the purchase order database, and the amount data are preprocessed, including standardization and outlier marking; based on the preprocessed amount data, kernel density estimation is performed using the Gaussian kernel function, and distribution fitting is performed on the standardized amount series to obtain an amount distribution curve; the standardized amount series is decomposed into a time series to separate trend, seasonal and random components, and the long-term amount distribution pattern is analyzed; the amount data is clustered, the elbow rule is used to determine the optimal number of clusters, and the amount value of each cluster center and the number of orders contained in the cluster are calculated; the variance, coefficient of variation and Gini coefficient of the amount series are calculated. If the coefficient of variation is less than a preset threshold and the Gini coefficient is less than a preset threshold, and the autocorrelation analysis shows that there is significant periodicity, it is determined that there is deliberate amount allocation; combined with the outlier marking, amount distribution curve and time series decomposition results, the degree of abnormality of the amount allocation is evaluated, and an amount allocation abnormality report is generated.

[0041] Specifically, all order amount data within a specified time period are extracted from the purchase order data, and the amount data is preprocessed, including standardization and outlier marking. Descriptive statistical indicators of the amount data are calculated, including mean, median, standard deviation, quartiles and extreme values. A standardized amount series is generated, while retaining the original amount data and time information. The Gaussian kernel function is used for kernel density estimation, and the standardized amount series is fitted to obtain the amount distribution curve. The kurtosis and skewness of the distribution are calculated to determine the concentration and symmetry of the amount distribution. Multimodal distribution is identified, and the position and height of each peak are recorded. The amount series is decomposed into time series, trend, seasonality and random components are separated, and the long-term amount distribution pattern is analyzed. The K-means algorithm is used to cluster the amount data, and the elbow rule is used to determine the optimal number of clusters. The amount value of each cluster center and the number of orders contained in the cluster are calculated, and order groups with similar amounts are identified. Internal consistency analysis is performed on each cluster, and the ratio of the within-group variance to the between-group variance is calculated to evaluate the clustering effect. Calculate the variance, coefficient of variation, and Gini coefficient of the amount series to evaluate the degree of dispersion and uniformity of the amount distribution. Perform autocorrelation analysis on the amount series to detect whether there is a periodic amount distribution pattern. Set the coefficient of variation threshold to 0.1 and the Gini coefficient threshold to 0.2. If the coefficient of variation is less than 0.1 and the Gini coefficient is less than 0.2, and the autocorrelation analysis shows significant periodicity, it is determined that there is deliberate amount distribution. Combined with outlier analysis, multi-peak distribution characteristics, and time series decomposition results, comprehensively evaluate the degree of abnormality in amount distribution and generate an amount distribution abnormality report. Extract 10,000 order amount data for the past 180 days through SQL query. Perform Z-score standardization on the amount, and mark the data with an absolute Z-score value greater than 3 as abnormal. The descriptive statistical results show a mean of 100,000 yuan, a median of 95,000 yuan, a standard deviation of 30,000 yuan, a first quartile of 80,000 yuan, a third quartile of 115,000 yuan, a minimum of 10,000 yuan, and a maximum of 500,000 yuan. The kernel density estimation was performed using a Gaussian kernel function with a bandwidth of 0.5, and a bimodal distribution curve was obtained, with peaks at 90,000 yuan and 110,000 yuan. The distribution kurtosis was 2.8 and the skewness was 0.3, indicating that the distribution was relatively concentrated and slightly to the right. The time series decomposition showed obvious periodicity, with a period of about 30 days. K-means clustering, in which K=5 was determined by the elbow rule, divided the orders into 5 groups, with center values ​​of 50,000 yuan, 80,000 yuan, 100,000 yuan, 120,000 yuan and 200,000 yuan, and the number of orders in each group was 500, 3,000, 4,000, 2,000 and 500. The ratio of the variance within the group to the variance between the groups was 0.15, indicating that the clustering effect was good. The coefficient of variation of the amount series was 0.3, the Gini coefficient was 0.25, and the autocorrelation analysis showed that there were significant peaks at different time intervals of 30 days, with a correlation coefficient of 0.6.The coefficient of variation is the ratio of the standard deviation to the mean, which is used to measure the relative dispersion of the data distribution. Based on the comprehensive analysis results, although the coefficient of variation and the Gini coefficient did not meet the strict standards of deliberate distribution, the bimodal distribution and obvious periodicity suggested that there might be two different purchasing patterns, generating an abnormal report and recommending further investigation.

[0042] S105. If the total amount of related orders exceeds the approval limit of the purchasing personnel's position, it is determined that there is fraud in splitting the orders artificially, and it is marked as a confirmed fraud order and a fraud report is generated; if it does not exceed the approval limit, based on the purchasing personnel's position, historical purchasing situation and behavioral pattern baseline, abnormal features that deviate from the usual behavioral patterns of individuals or teams are identified, and early warning information is generated.

[0043] Based on the approval limit data corresponding to the purchasing personnel's position information, determine whether the total amount of the associated orders exceeds the approval limit of the purchasing personnel's position to determine whether there is fraudulent behavior of artificially splitting orders; sum the order amounts in the associated order list to obtain the total amount of the associated orders. If the total amount of the associated orders exceeds the approval limit of the purchasing personnel, it is determined that there is fraudulent behavior of artificially splitting orders. If it is determined to be a fraudulent behavior, the purchasing personnel and the associated orders are marked, and a fraud report is generated, including the fraudulent personnel information and the fraudulent order content. If the total amount of the associated orders does not exceed the approval limit, the current purchasing behavior of the purchasing personnel is compared and analyzed with the baseline of the usual behavior pattern of individuals or teams to identify abnormal features that deviate from the usual behavior pattern. The identified abnormal feature information of the purchasing behavior is used to generate warning information, including abnormal purchasing personnel information and abnormal feature description content.

[0044] Specifically, according to the position information of the purchasing personnel, the corresponding approval limit data is obtained from the human resources system. For example, the approval limit of the supervisor is 50,000 yuan, the approval limit of the manager is 100,000 yuan, and the approval limit of the director is 200,000 yuan. Using the association rule mining algorithm Apriori, by setting the minimum support threshold of 1 and the minimum confidence threshold of 8, multiple orders with associated relationships are identified and a list of associated orders is generated. The order amounts in the associated order list are summed up. For example, the amounts of three associated orders are 30,000 yuan, 40,000 yuan, and 50,000 yuan respectively, and the total amount of the associated orders is 120,000 yuan. The total amount of the associated orders is compared with the approval limit data of the purchasing personnel. If the total amount exceeds the approval limit, for example, the total amount of three associated orders of a supervisor is 120,000 yuan, which exceeds the approval limit of 50,000 yuan, it is determined that the supervisor has committed fraud by artificially splitting orders. If it is determined to be fraud, the purchasing personnel and the associated orders are marked, and a fraud report is generated, which records in detail the name, position, department, etc. of the fraud personnel, as well as the order number, product name, amount, supplier, etc. of the fraudulent order. If the total amount of the associated orders does not exceed the approval limit, based on the individual purchasing behavior pattern baseline, including the purchase frequency, purchase amount, and distribution characteristics of the purchased commodity categories, the current purchasing behavior of the purchasing personnel is compared and analyzed with the historical behavior pattern baseline to identify abnormal characteristics that deviate from the usual behavior pattern, such as a sudden increase of more than 2 times in the purchase frequency, a sudden increase of more than 50% in the purchase amount, etc. At the same time, the team purchasing behavior pattern baseline is compared with the individual purchasing behavior pattern baseline to assist in determining whether the individual behavior is abnormal. The identified abnormal purchasing behavior feature information is used to generate warning information, record the name, position, and other information of the abnormal purchasing personnel, and the description of the abnormal features, such as "abnormal increase of 5 times in the purchase frequency", etc., and automatically send it to the relevant person in charge through the workflow for risk warning and subsequent tracking analysis.

[0045] The present invention provides a procurement anomaly monitoring and fraud early warning system based on behavior analysis, which mainly includes:

[0046] Establish a behavior pattern baseline module to obtain the position and authority information of procurement personnel, set different procurement amount thresholds and approval limits according to the authority level, establish respective behavior pattern baselines for personnel in different positions, and identify the procurement pattern characteristics of each person based on the historical procurement records of each procurement personnel;

[0047] The real-time monitoring and marking module is used to monitor the purchasing behavior of purchasers in real time. It combines the characteristics of individual purchasing patterns and the baseline of behavioral patterns to compare them with the individual's historical purchasing patterns and the general purchasing patterns of the team. If an abnormality is found that deviates from the baseline or the team pattern, it is marked as a suspected abnormal purchasing behavior. If no deviation is found, the purchasing behavior is recorded as normal and the subsequent purchasing behavior continues to be monitored.

[0048] The abnormal purchasing behavior analysis module is used to analyze whether the purchase amount of the marked suspected abnormal purchasing behavior is close to the approval limit, and to determine whether there is suspicion of artificial order splitting based on the purchasing frequency and time period. If so, it is marked as a suspected fraudulent order. If there is no suspicion of artificial order splitting, it is marked as an abnormal but non-fraudulent order, and an abnormal behavior report is generated, and the module returns to continue monitoring the purchasing behavior of the purchasing personnel;

[0049] Suspected fraud order analysis module, used to extract key attributes of suspected fraud orders, including order amount, supplier information, and purchase time, and analyze whether there are multiple related orders from the same supplier in a similar period of time;

[0050] The report and early warning information generation module is used to generate fraud reports or early warning information to identify characteristics that deviate from behavioral patterns. Specifically, if the total amount of related orders exceeds the approval limit of the purchasing personnel's position, it is determined that there is fraud in splitting the orders artificially, and it is marked as a confirmed fraud order, and a fraud report is generated. If it does not exceed the approval limit, the abnormal characteristics that deviate from the usual behavioral patterns of individuals or teams are identified based on the purchasing personnel's position, historical purchasing situation, and behavioral pattern baseline, and early warning information is generated.

[0051] The above is only a preferred embodiment of the present invention. It should be pointed out that ordinary technicians in this technical field can make several improvements and supplements without departing from the principle of the present invention. These improvements and supplements should also be regarded as the scope of protection of the present invention.

Claims

1. The method for monitoring abnormal purchases and early warning of fraud based on behavioral analysis is characterized by: The method comprises: Obtain the position and authority information of procurement personnel, set different procurement amount thresholds and approval limits according to the authority level, establish behavioral pattern baselines for personnel in different positions, and identify the procurement pattern characteristics of each person based on their historical procurement records; Monitor the purchasing behavior of purchasers in real time, combine the characteristics of individual purchasing patterns and the baseline of behavior patterns, and compare them with the individual's historical purchasing patterns and the general purchasing patterns of the team. If anomalies are found that deviate from the baseline or team pattern, they will be marked as suspected abnormal purchasing behavior. If no deviation is found, the purchasing behavior will be recorded as normal and the subsequent purchasing behavior will continue to be monitored. For the suspected abnormal purchasing behavior that is marked, analyze whether the purchasing amount is close to the approval limit, and combine the purchasing frequency and time period factors to determine whether there is suspicion of artificial order splitting. If so, mark it as a suspected fraudulent order. If there is no suspicion of artificial order splitting, mark it as an abnormal but non-fraudulent order, generate an abnormal behavior report, and return to continue monitoring the purchasing behavior of the purchasing personnel; Extract key attributes of suspected fraudulent orders, including order amount, supplier information, and purchase time, and analyze whether there are multiple related orders from the same supplier in a similar period of time; If the total amount of related orders exceeds the approval limit of the purchasing personnel's position, it is determined that there is fraud in splitting the orders artificially, and it is marked as a confirmed fraud order, and a fraud report is generated. If it does not exceed the approval limit, the abnormal characteristics that deviate from the usual behavior patterns of individuals or teams are identified based on the purchasing personnel's position, historical purchasing situation, and behavioral pattern baseline, and early warning information is generated.

2. The method according to claim 1, wherein: The acquisition of the position and authority information of the purchaser, setting different purchase amount thresholds and approval limits according to the authority level, establishing respective behavior pattern baselines for personnel in different positions, and identifying the purchase pattern characteristics of each person based on the historical purchase records of each purchaser, including: Obtaining the position information and authority level of the purchasing personnel, setting the purchase amount threshold and approval limit according to the position information and authority level, and storing the purchase amount threshold and approval limit in the authority management database; Extracting the historical purchase records of the purchaser from the purchase system interface, performing data cleansing on the historical purchase records, and obtaining cleansed purchase data; Grouping the cleaned purchasing data, identifying the main purchasing pattern characteristics of purchasing personnel, and generating a purchasing pattern feature vector; According to the purchase amount threshold, determine whether the purchaser's purchase application amount exceeds the threshold. If it exceeds the threshold, the multi-level approval process is triggered; Compare the actual purchasing behavior of the purchasing personnel with the preset behavioral pattern baseline to determine whether there is abnormal behavior. If there is abnormal behavior, send an early warning signal to the risk control department.

3. The method according to claim 1, wherein: The real-time monitoring of the purchasing behavior of the purchasing personnel is combined with the personal purchasing pattern characteristics and the behavioral pattern baseline, and compared with the personal historical purchasing pattern and the general purchasing pattern of the team. If an abnormality is found that deviates from the baseline or the team pattern, it is marked as a suspected abnormal purchasing behavior. If no deviation is found, the purchasing behavior is recorded as normal and the subsequent purchasing behavior is continuously monitored, including: Obtain each new purchase record of the purchaser and extract the purchase amount, purchase date and purchase category fields from the purchase database; Data cleaning was performed based on the newly added purchase record fields, missing values ​​were filled, outliers were detected and removed using the quartile method, and numerical features were mapped to the range of zero to one using the minimum-maximum scaling method; Perform principal component analysis on the cleaned purchasing behavior dataset, calculate the purchasing frequency, average purchasing amount, and purchasing category distribution indicators, and select the five principal components with the highest contribution rate as feature vectors; Calculate the cosine similarity score between the feature vector and the personal history pattern and the team pattern. If both similarity scores are lower than a preset threshold, the purchase behavior is determined to be suspected abnormal. If the purchase behavior is not determined to be suspected abnormal, the feature vector is stored in the purchaser's historical purchase record database, the individual purchase pattern feature is updated, and the team's general purchase pattern is updated at fixed intervals.

4. The method according to claim 1, wherein: For the marked suspected abnormal purchasing behavior, analyze whether the purchasing amount is close to the approval limit, and combine the purchasing frequency and time period factors to determine whether there is suspicion of artificial order splitting. If so, mark it as a suspected fraudulent order. If there is no suspicion of artificial order splitting, mark it as an abnormal but non-fraudulent order, generate an abnormal behavior report, and return to continue monitoring the purchasing behavior of the purchasing personnel, including: Obtaining a marked suspected abnormal purchase record, wherein the suspected abnormal purchase record includes a purchase amount, a purchase time, and a purchaser identification number; According to the purchaser identification number, the corresponding approval limit value is obtained, and the amount proximity is calculated. If the amount proximity is greater than a preset threshold, it is determined to be close to the approval limit; Based on the purchaser identification number, recent purchase records are obtained, and a frequency anomaly index and a time aggregation index are calculated; Using the amount proximity, frequency anomaly index, and time clustering index as input features, training a classifier for identifying artificially split orders; The classifier judges the current suspected abnormal purchase behavior. If the confidence of the judgment result is greater than a first preset threshold, the purchase record is marked as a suspected fraudulent order. If the confidence of the judgment result is between a second preset threshold and the first preset threshold, it is marked as an abnormal but non-fraudulent order. For orders marked as abnormal but not fraudulent, an abnormal behavior report is generated, which includes the performance of abnormal purchasing behavior, relevant data indicators and preliminary judgment results; Storing the abnormal behavior report in a database and updating the risk level of the purchaser; It also includes: calculating the difference between the current purchase amount and the approval limit, paying attention to situations that are close to but not exceeding the limit, counting the number of purchases and the total amount made by the purchaser, calculating the average purchase interval and the single purchase amount, and marking purchases made during non-working hours.

5. The method according to claim 4, wherein: The calculation of the difference between the current purchase amount and the approval limit, focusing on the situation close to but not exceeding the limit, counting the number of purchases and the total amount of the purchaser, calculating the average purchase interval and the single purchase amount, and marking the purchases during non-working hours, including: Obtain the amount information of the purchase record and the approval limit and rank information of the purchaser; The amount information is extracted from the procurement database, and the approval limit and rank information are obtained from the authority management database; A dynamic threshold is set according to the job level information, and if the difference between the purchase amount and the approval limit is less than the dynamic threshold, the purchase record is marked as a quota purchase; The total number of purchases and the total purchase amount are calculated using the time-weighted average method to obtain the average single purchase amount; At the same time, the purchase frequency and amount of each purchase category are calculated to form the distribution characteristics of the purchase category; The average purchase interval is calculated using the exponential moving average method, and the volatility of the purchase interval is measured using the standard deviation; Combining the average purchase interval and volatility, a purchase frequency prediction tool is constructed; Determine whether the timestamp of the purchase record falls during non-working hours; If the timestamp falls within the non-working time period, a non-working time mark is added to the purchase record; Calculate the proportion of non-working time purchases in total purchases; Use the weighted average method to comprehensively consider the degree of quota limit, abnormality of purchase frequency, proportion of purchases during non-working hours and abnormality of purchase categories; Among them, the limit degree is determined by the ratio of the difference to the dynamic threshold, the purchase frequency abnormality is obtained by the purchase frequency prediction tool, the purchase category abnormality is determined by the purchase category distribution characteristics, and the abnormality degree score of the purchase record is obtained.

6. The method according to claim 1, wherein: The key attributes of suspected fraudulent orders are extracted, including order amount, supplier information, and purchase time, and analysis is performed to determine whether there are multiple related orders from the same supplier within a similar period of time, including: Obtaining order records marked as suspected fraud in a purchase order database, wherein the order records include order amount, supplier identification, and purchase time; Calculating the interquartile range of the order amount according to the order record, and if the order amount is less than a first preset range or greater than a second preset range, marking the order as an abnormal order; For the abnormal order, a preset time sliding time window centered on the purchase time of the order is set, and orders with the same supplier ID within the time window are grouped; Calculate the time interval and amount difference between adjacent orders in a group, and construct an order feature vector containing the order quantity, total order amount, average order amount, and standard deviation of order amount; Performing anomaly detection on the order feature vector, if the detection result is determined to be abnormal, marking the order set as an abnormal order set and updating the procurement risk record; It also includes: arranging related orders that appear multiple times in a similar period of time from the same supplier in chronological order, calculating the time intervals between adjacent orders, identifying time-intensive order groups, and counting the order information of each order group, including the number of orders, total amount, first and last order dates, number of suppliers, and types of purchased items; analyzing the distribution pattern of order amounts, and finding and determining whether there are orders with deliberate amount distribution.

7. The method according to claim 6, wherein: The method of arranging the related orders of the same supplier that appear multiple times in a similar period of time in chronological order, calculating the time intervals between adjacent orders, identifying the time-intensive order groups, and counting the order information of each order group, including the order quantity, total amount, first and last order dates, number of suppliers, and type of purchased items, includes: Obtain order records, sort them in ascending order according to timestamps of the order records to obtain an ordered order sequence, and calculate time intervals between adjacent orders in the ordered order sequence to obtain a time interval sequence; Scanning the time interval sequence, determining a time threshold according to the statistical characteristics of the time interval sequence, and if it is detected that the time interval of a plurality of consecutive orders is less than the time threshold, marking these orders as an order group; For the order group, extract order records in the order group, count characteristic indicators of the order records, and generate a characteristic vector representing the characteristics of the order group; Standardizing the feature vector, and reducing the dimension of the standardized feature vector to obtain a feature vector after dimension reduction; Perform cluster analysis on the feature vector after dimension reduction to identify a set of order groups with similar purchasing pattern characteristics, and determine whether the order group is an abnormal order group.

8. The method according to claim 6, wherein: The analysis of the distribution pattern of order amounts, finding and determining whether there are orders with deliberate amount distribution, includes: Obtaining all order amount data within a specified time period from a purchase order database, and preprocessing the amount data, including standardization and outlier marking; According to the pre-processed amount data, a Gaussian kernel function is used to perform kernel density estimation, and a distribution fitting is performed on the standardized amount sequence to obtain an amount distribution curve; Perform time series decomposition on the standardized amount series to separate trend, seasonality and random components, and analyze the long-term amount distribution pattern; Cluster the amount data, use the elbow rule to determine the optimal number of clusters, and calculate the amount value of each cluster center and the number of orders contained in the cluster; Calculate the variance, coefficient of variation and Gini coefficient of the amount series. If the coefficient of variation is less than a preset threshold and the Gini coefficient is less than a preset threshold, and the autocorrelation analysis shows significant periodicity, it is determined that there is deliberate amount allocation. Combine outlier marks, amount distribution curves, and time series decomposition results to evaluate the degree of abnormality in amount allocation and generate an amount allocation abnormality report.

9. The method according to claim 1, wherein: If the total amount of the related orders exceeds the approval limit of the purchasing staff position, it is determined that there is fraudulent behavior of artificially splitting the order, and it is marked as a confirmed fraudulent order, and a fraud report is generated. If it does not exceed the approval limit, the abnormal characteristics that deviate from the usual behavior pattern of individuals or teams are identified based on the purchasing staff's position, historical purchasing situation, and behavioral pattern baseline, and warning information is generated, including: Based on the approval limit data corresponding to the purchasing staff position information, determine whether the total amount of the associated orders exceeds the approval limit of the purchasing staff position to determine whether there is fraudulent behavior of artificially splitting orders; Sum the order amounts in the associated order list to obtain the total amount of the associated orders; If the total amount of the related orders exceeds the approval limit of the purchasing staff, it will be judged as fraudulent behavior of artificially splitting the orders; If it is determined to be fraudulent behavior, the purchaser and related orders will be marked and a fraud report will be generated, including the fraudulent personnel information and fraudulent order content; If the total amount of the associated orders does not exceed the approval limit, the current purchasing behavior of the purchaser is compared and analyzed with the baseline of the individual or team's usual behavior pattern to identify abnormal characteristics that deviate from the usual behavior pattern; The abnormal characteristic information of the identified purchasing behavior will be used to generate early warning information, including abnormal purchasing personnel information and abnormal characteristic description content.

10. The procurement anomaly monitoring and fraud early warning system based on behavioral analysis is characterized by: The system comprises: Establish a behavior pattern baseline module to obtain the position and authority information of procurement personnel, set different procurement amount thresholds and approval limits according to the authority level, establish respective behavior pattern baselines for personnel in different positions, and identify the procurement pattern characteristics of each person based on the historical procurement records of each procurement personnel; The real-time monitoring and marking module is used to monitor the purchasing behavior of purchasers in real time. It combines the characteristics of individual purchasing patterns and the baseline of behavioral patterns to compare them with the individual's historical purchasing patterns and the general purchasing patterns of the team. If an abnormality is found that deviates from the baseline or the team pattern, it is marked as a suspected abnormal purchasing behavior. If no deviation is found, the purchasing behavior is recorded as normal and the subsequent purchasing behavior continues to be monitored. The abnormal purchasing behavior analysis module is used to analyze whether the purchase amount of the marked suspected abnormal purchasing behavior is close to the approval limit, and to determine whether there is suspicion of artificial order splitting based on the purchasing frequency and time period. If so, it is marked as a suspected fraudulent order. If there is no suspicion of artificial order splitting, it is marked as an abnormal but non-fraudulent order, and an abnormal behavior report is generated, and the module returns to continue monitoring the purchasing behavior of the purchasing personnel; Suspected fraud order analysis module, used to extract key attributes of suspected fraud orders, including order amount, supplier information, and purchase time, and analyze whether there are multiple related orders from the same supplier in a similar period of time; The report and early warning information generation module is used to generate fraud reports or early warning information to identify characteristics that deviate from behavioral patterns. Specifically, if the total amount of related orders exceeds the approval limit of the purchasing personnel's position, it is determined that there is fraud in splitting the orders artificially, and it is marked as a confirmed fraud order, and a fraud report is generated. If it does not exceed the approval limit, the abnormal characteristics that deviate from the usual behavioral patterns of individuals or teams are identified based on the purchasing personnel's position, historical purchasing situation, and behavioral pattern baseline, and early warning information is generated.

Images