Auditing decision support system and method based on dynamic knowledge graph

Abstract

The invention discloses an auditing decision support system and method based on a dynamic knowledge graph, relates to the technical field of computers, and aims to solve the problems that auditing data are heterogeneous and complex, risk identification is not timely and causal interpretation is lacked. According to the system, multi-modal audit data is collected in real time through a streaming event processing framework, and a dynamic audit knowledge graph with timeliness weight is constructed. Based on a graph calculation engine and cross-domain rule mining, identifying a high-frequency risk mode, and generating a risk conduction path graph; further fusing a multi-modal graph attention network, identifying and positioning abnormal entities, and outputting abnormal nodes and risk links thereof; and finally, the abnormal node embedding representation is dynamically updated through the time sequence diagram attention network, an interpretable audit causal map is generated in combination with a structural causal model, and closed-loop support from data acquisition and risk identification to interpretive audit decision is realized. The intellectualization and transparency of audit decision making are improved, and an efficient and traceable decision making basis is provided for a complex audit scene.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and specifically to an audit decision support system and method based on a dynamic knowledge graph. Background Art

[0002] With the increasing frequency of enterprise transaction activities and the rapid growth of data scale, the information complexity and real-time requirements faced by audit work are constantly increasing. Especially in scenarios such as Internet finance, supply chain collaboration, and digital government affairs, transaction data exhibits characteristics such as multi-source heterogeneity, strong timeliness, and strong semantic association. Traditional static audit analysis methods have become difficult to cope with the ever-changing risk patterns. At the same time, the audit supervision has shifted from result-oriented to process supervision, posing higher requirements for the real-time response ability, risk prediction ability, and intelligent decision-making ability of technical systems. Against this background, building an intelligent audit decision support system that integrates multi-modal data and has the ability of dynamic evolution has become the key direction to promote the digital transformation of audit and improve the regulatory governance ability.

[0003] In existing methods, some audit systems have tried to introduce knowledge graphs, data mining, and artificial intelligence technologies to achieve risk identification and auxiliary decision-making. However, the adaptability and intelligence of such methods in actual audit operations are still significantly insufficient: on the one hand, the construction of knowledge graphs is mostly based on historical static data, and data collection and processing are mainly offline batch processing, which cannot adapt to the real-time data streams such as dynamic transactions and high-frequency interactions in audit scenarios, and it is difficult to capture the risk evolution and conduction behaviors at key nodes in a timely manner, resulting in a lag in response to potential anomalies during the audit process. On the other hand, risk identification mostly relies on preset rules, fixed thresholds, or single-modal data analysis, and it is difficult to reveal the deep logical contradictions and cross-domain risk linkages between data from different sources. Especially in complex transaction chains, there is a lack of global modeling ability for hidden risk paths. In addition, the audit assistance system often only gives qualitative hints for the risk identification results, lacking causal chain analysis and structured interpretable output, and it is difficult to support auditors in systematically tracing the origin, conduction mechanism, and affected objects of risks and quantitative assessment, limiting its application value in major decision-making scenarios. Summary of the Invention

[0004] Aiming at the deficiencies of the existing technology, the present invention provides an audit decision support system and method based on a dynamic knowledge graph, which solves the problems in the above background art.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: An audit decision support system based on a dynamic knowledge graph, including the following modules: a graph construction module, a risk conduction analysis module, a cross-modal anomaly detection module, and an audit decision module; the graph construction module is used to collect multi-modal audit data in real time through a streaming event processing framework and convert it into a dynamic event stream, construct an entity relationship network through a spatio-temporal attenuation function, attach a time-sensitive weight to the association relationship of audit objects, and construct an audit knowledge graph; the risk conduction analysis module is used to identify risks in audit data according to the entity relationship network in the audit knowledge graph, perform risk assessment on the nodes in the graph through a Neo4j graph computing engine, obtain a risk propagation coefficient, and combine cross-domain association rules to mine high-frequency risk patterns, generate a risk conduction path graph, and mark abnormal risk nodes and vulnerable links; the cross-modal anomaly detection module is used to locate hidden audit risks according to the risk conduction path graph and the node risk assessment results, combine multi-modal data, identify data logic contradiction behaviors through a multi-modal graph attention network, output a list of abnormal entities and confidence scores, and mark the associated risk conduction links; the audit decision module is used to dynamically update the embedding representation of abnormal nodes according to the list of abnormal entities and the associated paths, and generate interpretable audit decisions through causal reasoning and temporal dynamic representation.

[0006] Further, the specific process of collecting multi-modal audit data in real time through a streaming event processing framework and converting it into a dynamic event stream is as follows: Structured transaction data, unstructured contract texts, and external public opinion data are collected through a distributed crawler and API interfaces, and an event-driven data preprocessing mechanism is adopted. According to the data source type, a cleaning strategy is dynamically matched, keyword fields are extracted and converted into audit semantic tags; audit domain event types are defined, including contract changes, transaction anomalies, and regulatory updates, and the multi-modal data is mapped into a dynamic event stream through a stream processing engine; an incremental graph construction algorithm is triggered based on the audit semantic tags, and only the local subgraph affected by the event is updated.

[0007] Further, the specific process of constructing an entity relationship network through a spatio-temporal attenuation function, attaching a time-sensitive weight to the association relationship of audit objects, and constructing an audit knowledge graph is as follows: The association types between audit objects are defined, an initial weight is attached to each relationship edge, and a spatio-temporal attenuation function is introduced to dynamically adjust the relationship weight according to the event occurrence time, and an initial audit relationship graph is constructed; The semantic association strength factor is fused, and the entity edge weights are dynamically adjusted through the similarity between event semantic tags, so that entity pairs with high semantic consistency construct a stronger coupling relationship; For newly added or changed events, only the entity subgraph within its influence range is updated to construct an audit knowledge graph with time sensitivity and semantic interpretability.

[0008] Furthermore, the specific process of obtaining the risk propagation coefficient by performing risk assessment on the nodes in the knowledge graph through the Neo4j graph computing engine is as follows: According to the audit knowledge graph, import each audit entity node and its associated attributes into the Neo4j graph database environment, and calculate the topological influence index of the node in the entity relationship network; Combine the relationship weights dynamically adjusted by the spatio-temporal attenuation function to correct the input parameters of the algorithm and quantify the risk propagation ability of the node under the time limit; Define the node risk influence factors, including entity type, historical risk records, participation transaction frequency, and external evaluation indicators, and calculate the temporal risk index of the node through time decay weighted. Generate the risk propagation coefficient of the node by combining the temporal risk index and the topological influence index; Set the risk conduction direction constraint to limit the path reachability of risk propagation within a reasonable time window and business context to ensure that the risk path has business rationality; Map the propagation coefficient to the node attributes of the knowledge graph to generate a risk heat map, and screen high-risk nodes through Cypher query and label them as key risk sources.

[0009] Furthermore, in combination with cross-domain association rules, mine high-frequency risk patterns and generate a risk conduction path map. The specific process of labeling abnormal risk nodes and vulnerable links is as follows: According to the risk propagation coefficient output by the Neo4j graph computing engine, construct a set of candidate risk conduction paths in the knowledge graph; Use the frequent subgraph mining algorithm to count the common risk propagation paths in multiple business domains and extract high-frequency risk patterns across audit fields; Integrate the audit compliance rules, business logic rules, and abnormal transaction behavior models extracted from the external rule library to construct a cross-domain association rule knowledge base; Perform rule matching on the candidate paths, screen the paths that meet the high-frequency propagation characteristics and abnormal semantic consistency, and generate a risk conduction path map with a causal chain; Layer-by-layer label the risk source nodes, propagation relay nodes, and terminal impact nodes in the path map, and identify abnormal risk nodes by combining the propagation intensity and frequency indicators; Identify the structurally vulnerable links through graph connectivity and path vulnerability analysis, and label the key propagation links with vulnerable link labels to prompt potential conduction breakpoints or key monitoring points.

[0010] Furthermore, based on the risk transmission path diagram and node risk assessment results, combined with multimodal data, a multimodal graph attention network is used to locate hidden audit risks and identify logically contradictory behaviors in the data. The specific process is as follows: based on the risk transmission path diagram and the node risk propagation coefficient, a weighted directed graph structure is constructed, and the node risk weight and propagation direction are used as input features of the attention mechanism; structured financial data, unstructured contract text, image vouchers, and external information sources are integrated to construct a unified multimodal feature representation tensor and map it to the corresponding nodes and edges in the graph; a multimodal graph attention network is constructed, and a cross-modal alignment mechanism is introduced to connect the implicit semantic relationship between text and numerical information, thereby improving the consistency of information transmission between nodes; multimodal contextual information is dynamically aggregated through an inter-node attention weight learning mechanism to strengthen the attention of weakly associated nodes hidden in high-risk propagation paths; a graph-level logical consistency judgment module is introduced to annotate node relationships in the path diagram that have timing conflicts, abnormal data jumps, or inconsistent contractual behaviors; finally, suspected hidden audit risk areas are output, focusing on audit entities with high risks but weakly expressed node features or isolated from explicit risk paths, realizing risk positioning based on deep information interaction.

[0011] Furthermore, the specific process of outputting a list of abnormal entities and confidence scores and labeling the associated risk transmission links is as follows: after completing the risk positioning of the multimodal graph attention network, the abnormal nodes are sorted according to the attention weight, propagation path weight and modal consistency score; a candidate pool of abnormal entities is constructed, and the abnormal confidence is calculated based on the difference in multimodal feature distribution density and node embedding representation; high-confidence entities are evaluated based on their propagation status in the risk path graph, and the core abnormal sources, risk relay nodes and potential victim nodes are identified and numbered and output in sequence; through the graph path reverse tracing mechanism, starting from each abnormal entity, the upstream risk source node is traced back, and the effective transmission link is determined in combination with the edge weight attenuation coefficient; the abnormal entity nodes are identified in the graph, and the associated risk path links are labeled as high-risk propagation paths, realizing graph-level risk link labeling.

[0012] Furthermore, the specific process of dynamically updating the embedding representation of abnormal nodes according to the temporal sequence graph attention network and generating interpretable audit decisions through causal reasoning and dynamic representation technology is as follows: Based on the abnormal entity list and its associated path information in the audit knowledge graph, extract the timestamp of the risk event occurrence and the context entity relationship, and construct a temporal subgraph reflecting the risk evolution process; Use the temporal sequence graph attention network to perform time-weighted encoding on each node and its edge relationship in the temporal subgraph, and dynamically adjust the embedding representation of the abnormal nodes according to the temporal dependence relationship between nodes, reflecting the risk evolution characteristics of the abnormal nodes in the time dimension; Combine the known audit causal event relationships in the graph to construct a causal graph structure, and mine the antecedent and consequent paths of the abnormal nodes through the structural causal model; Integrate the temporal embedding representation and causal path of the abnormal nodes to generate an explanatory rule for audit analysis. This rule describes the cause of the trigger anomaly, the risk conduction mechanism, and the potential affected entities, and outputs a structured audit causal graph containing the relationships between abnormal nodes, associated cause nodes, risk conduction paths, and affected objects.

[0013] An audit decision support method based on a dynamic knowledge graph includes the following steps: S1. Real-time collect multimodal audit data through a streaming event processing framework and convert it into a dynamic event stream. Construct an entity relationship network through a spatio-temporal attenuation function, attach a timeliness weight to the association relationship of the audit object, and construct an audit knowledge graph; S2. Identify risks in the audit data according to the entity relationship network in the audit knowledge graph, evaluate the risks of the nodes in the graph through the Neo4j graph computing engine, obtain the risk propagation coefficient, and combine cross-domain association rules to mine high-frequency risk patterns, generate a risk conduction path graph, and mark abnormal risk nodes and vulnerable links; S3. According to the risk conduction path graph and the node risk assessment results, combine multimodal data, and locate hidden audit risks through a multimodal graph attention network, identify data logical contradiction behaviors, output an abnormal entity list and a confidence score, and mark the associated risk conduction links; S4. According to the abnormal entity list and the associated path, dynamically update the embedding representation of the abnormal nodes according to the temporal sequence graph attention network, and generate interpretable audit decisions through causal reasoning and temporal dynamic representation.

[0014] The present invention has the following beneficial effects:

[0015] (1) The audit decision support system based on a dynamic knowledge graph uses a graph construction module to collect multi-modal audit data in real time based on a streaming event processing mechanism, and constructs an entity relationship network with time-weighted weights by combining a spatio-temporal attenuation function, enabling the dynamic construction of an audit knowledge graph that reflects the true evolution process of audit operations, enhancing the graph's ability to express temporal audit behaviors. The risk conduction analysis module introduces a graph computing engine to quantitatively evaluate the risks of graph nodes, combines cross-domain association rules to mine high-frequency risk patterns, generates a risk conduction path graph, and identifies abnormal risk nodes and vulnerable links, thus realizing the structured modeling and efficient discovery of risks.

[0016] (2) The audit decision support method based on a dynamic knowledge graph uses a cross-modal anomaly detection module to fuse structured and unstructured data, and uses a multi-modal graph attention network to deeply mine hidden audit risks, enabling the identification of logical conflict behaviors between data and outputting abnormal entities and confidence scores, enhancing the intelligent anomaly identification ability of the audit system. The audit decision module dynamically updates the embedded representation of abnormal nodes based on a temporal graph attention network, and combines causal reasoning and dynamic representation techniques to construct a causal link of audit risks, and can output interpretable structured audit conclusions, enhancing the traceability and decision-making transparency of audit results.

[0017] Of course, any product implementing the present invention does not necessarily need to achieve all of the above advantages simultaneously. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of the audit decision support system based on the dynamic knowledge graph of the present invention.

[0019] Figure 2 It is a flowchart of the audit decision support method based on the dynamic knowledge graph of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] The embodiments of the present application solve the problems of insufficient real-time risk identification, difficult accurate positioning of cross-modal anomalies, difficult modeling of risk conduction paths, and lack of interpretability of audit conclusions in existing audit systems through an audit decision support system and method based on a dynamic knowledge graph. Traditional audit systems rely on static knowledge graphs and offline batch processing mechanisms, and cannot respond to dynamic business scenarios in real time, resulting in risk warnings lagging behind the actual occurrence of risks. Through the real-time construction and evolution of dynamic knowledge graphs, anomaly detection driven by multi-modal graph attention networks, and interpretable decision generation driven by causal reasoning, a full-link audit support capability from real-time risk perception to closed-loop feedback optimization is formed, significantly improving the risk identification coverage rate, decision-making timeliness, and conclusion credibility in complex scenarios.

[0021] The general idea of the solution in the embodiments of the present application is as follows:

[0022] Collect multimodal audit data in real time through a streaming event processing framework and convert it into a dynamic event stream. Construct an entity relationship network through a spatio-temporal attenuation function, attach a timeliness weight to the association relationship of audit objects, and construct an audit knowledge graph.

[0023] Identify risks in the audit data based on the entity relationship network in the audit knowledge graph. Use the Neo4j graph computing engine to evaluate the risks of the nodes in the graph, obtain the risk propagation coefficient, and combine cross-domain association rules to mine high-frequency risk patterns, generate a risk conduction path map, and mark abnormal risk nodes and vulnerable links.

[0024] Based on the risk conduction path map and the node risk assessment results, combined with multimodal data, locate hidden audit risks through a multimodal graph attention network, identify data logical contradiction behaviors, output a list of abnormal entities and confidence scores, and mark the associated risk conduction links.

[0025] According to the list of abnormal entities and the associated paths, dynamically update the embedded representation of abnormal nodes according to the temporal graph attention network, and generate interpretable audit decisions through causal reasoning and temporal dynamic representation.

[0026] Please refer to Figure 1 , an embodiment of the present invention provides a technical solution: an audit decision support system based on a dynamic knowledge graph, including the following modules: a graph construction module, a risk conduction analysis module, a cross-modal anomaly detection module, and an audit decision module; the graph construction module is used to collect multimodal audit data in real time through a streaming event processing framework and convert it into a dynamic event stream, construct an entity relationship network through a spatio-temporal attenuation function, attach a timeliness weight to the association relationship of audit objects, and construct an audit knowledge graph; the risk conduction analysis module is used to identify risks in the audit data based on the entity relationship network in the audit knowledge graph, use the Neo4j graph computing engine to evaluate the risks of the nodes in the graph, obtain the risk propagation coefficient, and combine cross-domain association rules to mine high-frequency risk patterns, generate a risk conduction path map, and mark abnormal risk nodes and vulnerable links; the cross-modal anomaly detection module is used to locate hidden audit risks through a multimodal graph attention network, identify data logical contradiction behaviors, output a list of abnormal entities and confidence scores, and mark the associated risk conduction links based on the risk conduction path map and the node risk assessment results, combined with multimodal data; the audit decision module is used to dynamically update the embedded representation of abnormal nodes according to the temporal graph attention network according to the list of abnormal entities and the associated paths, and generate interpretable audit decisions through causal reasoning and temporal dynamic representation.

[0027] In this implementation plan, the functional positioning of the graph construction module is to achieve the structured modeling of audit data. The streaming event processing framework refers to Apache Flink, which can perform real-time processing on continuously arriving audit data (such as transaction records and log behaviors). Multimodal audit data includes, but is not limited to, structured data (such as financial statements), unstructured text (such as audit reports), images (such as document images), voice (such as meeting recordings), etc., and has heterogeneity. The spatio-temporal attenuation function is a function model that assigns a "timeliness weight" to entity relationships, indicating that the strength of entity relationships decays with changes in time or spatial distance. For example, the association weight of an old contract is lower than that of a recent transaction relationship. Dynamic event stream → entity relationship network → dynamic knowledge graph is a complete process from data perception to graph modeling, and finally forms a knowledge graph that can reflect the dynamic evolution of audit objects at different times. The functional positioning of the risk conduction analysis module is to model and identify the risk propagation paths in the graph. The Neo4j graph computing engine is a database technology that supports high-performance graph traversal and graph algorithm calculations, supports node weight calculation, shortest path identification, clustering, etc., and is used to evaluate the "risk propagation potential" of nodes. The risk propagation coefficient represents the intensity and probability of risk transmission between nodes, and is learned and assigned based on the diffusion trajectory of risk events in the historical graph. Cross-domain association rule mining uses Apriori to mine risk co-occurrence patterns from data intersections between different audit sub-domains (such as finance, taxation, and procurement). The risk conduction path graph is a visual graph structure that depicts how an abnormal risk node affects other entities through several edges to form a "risk chain". The vulnerable link refers to an important edge in the risk graph that, once attacked or abnormally activated, is likely to cause problems in the spread of the entire audit structure. Identifying these links can be used for key monitoring in audits. The functional positioning of the cross-modal anomaly detection module is to fuse multi-source data on the basis of the risk graph to identify deep-level risks. The multi-modal graph attention network is a deep learning model that introduces an attention mechanism on the basis of the graph neural network (GNN), which can assign weights to information of different modalities and accurately model the association strength between data. Hidden audit risks refer to risks that do not appear abnormal on the surface but have logical conflicts in multiple dimensions (such as inconsistent contract amounts and purchase invoices). Data logical contradiction behaviors refer to behaviors in which data violate business process logic or statistical norms, such as a company issuing different statements in multiple cities at the same time. The abnormal entity list and confidence score output a set of abnormal nodes and score each node, indicating the credibility of its being determined as abnormal. The marked associated risk conduction link not only outputs node anomalies, but also points out the possible risk path chains formed between it and other nodes. The functional positioning of the audit decision-making module is to generate auxiliary audit conclusions with causal explanation capabilities on the basis of anomaly identification.Temporal Graph Attention Network: It is a graph neural network model that combines temporal features with the attention mechanism and can capture the evolution patterns in the temporal dimension within the graph structure. For example, whether the risk of an abnormal node is caused by the rapid accumulation of recent events or long-term latency. Dynamically update the embedding representation of abnormal nodes: The embedding representation is a way to transform nodes into low-dimensional vectors. Dynamically updating means that the node representation changes with time, context, and causal paths, thus enabling a more realistic portrayal of the risk situation. Causal reasoning and temporal dynamic characterization: Causal reasoning: Such as the Structural Causal Model (SCM) is used to determine whether "one event causes another event"; Temporal dynamic characterization: It refers to modeling the node states that evolve over time. For example, continuous and frequent transfers of a certain account trigger an abnormal alarm. Explainable audit decision-making: The system output result is not only "this node is abnormal", but also provides the reason for its occurrence, the conduction mechanism, and the affected object, enhancing the traceability and transparency of the decision-making basis.

[0028] Specifically, the specific process of collecting multi-modal audit data in real time through the streaming event processing framework and converting it into a dynamic event stream is as follows: Structured transaction data, unstructured contract texts, and external public opinion data are collected through distributed crawlers and API interfaces, and an event-driven data preprocessing mechanism is adopted. According to the data source type, the cleaning strategy is dynamically matched, keyword fields are extracted and converted into audit semantic tags; Define audit domain event types, including contract changes, transaction anomalies, and regulatory updates, and map the multi-modal data into a dynamic event stream through a stream processing engine; Trigger an incremental graph construction algorithm based on the audit semantic tags, and only update the local subgraph affected by the event.

[0029] In this implementation plan, data collection: Multimodal audit data from different data sources is collected in real time through distributed crawlers and API interfaces, including: Structured transaction data: such as transaction records, accounting records, etc. The data is usually stored in tabular form, which is easy to process and analyze. Unstructured contract text: The contract content usually appears in text form, which contains a large amount of business terms, transaction conditions and other information, and needs to be extracted and analyzed through technologies such as natural language processing (NLP). External public opinion data: such as online public opinion, news reports, etc., which reflect the impact of the external environment on the audit object. This data is usually in the form of irregular text and multimedia. This multimodal data covers traditional structured data and unstructured data that needs to be parsed, reflecting various information sources involved in the audit process. Data preprocessing mechanism: An event-driven data preprocessing mechanism is adopted, which means that the system dynamically matches and applies different cleaning strategies according to different event types or data sources. This process includes the following steps: Data cleaning: Different types of data may contain noise, missing values or inconsistent formats. Therefore, according to the different types of data sources (such as contract text, transaction records, public opinion data), the system will adopt corresponding cleaning methods. Key field extraction: Extract valuable audit information from different original data, such as the terms of contract changes, the amount and time of abnormal transactions, etc. Conversion to audit semantic tags: Through text mining or structured data analysis, the extracted key information is converted into "tags" that conform to the audit context, such as: contract change, illegal transaction, etc., for subsequent processing. Event type definition: In the audit process, different types of events need to be identified and classified. The system defines multiple event types in the audit field. Common ones include: Contract change: such as the modification of contract terms, the addition of additional conditions, etc. Such events may affect the compliance of contract performance. Transaction anomaly: Refers to some transaction behaviors that exceed the normal range, such as abnormal amount transfers or frequent fund flows, etc., which may attract the attention of auditors. Regulation update: such as tax policy changes, audit standard adjustments, etc., which may have a direct impact on audit behaviors. These event types are the basis for the subsequent analysis and processing of the system, and they provide important context information for the subsequent construction of dynamic graphs. Stream processing engine and dynamic event stream: The multimodal data is mapped into a dynamic event stream through the stream processing engine. The core of this process is: Event-driven processing: When the system receives new events (such as contract changes, transaction anomalies, etc.), the stream processing engine will respond immediately and process the relevant data. Dynamic event stream: These events occur at any time and will increase and change over time, forming a "flowing" data stream, rather than traditional batch processing. This mechanism ensures that the audit system can respond to changes and potential risks in the audit field in real time.Incremental Graph Construction: Based on trigger-based audit semantic tags, the system adopts an incremental graph construction algorithm. The specific process is as follows: Local Subgraph Update: In the multimodal data stream, only the part related to a specific event will be triggered for update, rather than the entire graph. This means that only the audit data affected by the event (such as a certain abnormal transaction, a changed contract) will trigger the corresponding update of the graph, avoiding redundant calculations for the entire graph. Incremental Update: Different from traditional batch graph updates, this method only updates the part of the graph related to the current event, which helps improve processing efficiency and reduce computational resource consumption. Through this incremental construction mechanism, the system can efficiently update the entities and relationships in the audit knowledge graph without affecting the overall graph structure.

[0030] Specifically, an entity relationship network is constructed through a spatio-temporal decay function to attach a time-sensitive weight to the association relationship of audit objects. The specific process of constructing the audit knowledge graph is as follows: Define the association types between audit objects, attach an initial weight to each relationship edge, and introduce a spatio-temporal decay function to dynamically adjust the relationship weight according to the event occurrence time to construct an initial audit relationship graph; Integrate the semantic association strength factor, and dynamically adjust the entity edge weights through the similarity between event semantic tags, so that entity pairs with high semantic consistency build stronger coupling relationships; For newly added or changed events, only update the entity subgraph within its influence range to construct an audit knowledge graph with time sensitivity and semantic interpretability.

[0031] In this implementation plan, the association types between audit objects are defined: When constructing an audit knowledge graph, it is first necessary to define the association types between audit objects. Audit objects include companies, personnel, transactions, contracts, events, etc., and the association types describe the relationships between these objects. Common association types include: Association between a company and its employees: Some employees work in a specific company. Association between a contract and a transaction: Some transactions are specified by a specific contract. Association between a person and a transaction: Some transactions are executed by specific personnel. After defining these association relationship types, the system attaches an initial weight value to each relationship edge (i.e., the connection between entities), and this weight reflects the strength or importance of the association. For example, the weight between a transaction and the personnel associated with it may be relatively high because the transaction involves the audit of specific responsible personnel. Introduce a spatio-temporal decay function to dynamically adjust the relationship weight according to the event occurrence time: In order to reflect the impact of time on relationships, the system introduces a spatio-temporal decay function. The spatio-temporal decay function is a mathematical function whose role is to dynamically adjust the relationship weight according to changes in time and space. Specifically: Temporal decay: As time passes since the event occurred, the influence of some associations gradually weakens. For example, a transaction may become less important over time, so the weight of its association will gradually decay. Spatial decay: If the event occurs in different geographical regions or in the upstream and downstream audit chains, the influence may decay. The spatio-temporal decay function enables the system to dynamically adjust the association strength between audit objects, thereby better reflecting the timeliness and actual impact of audit data. Construct an initial audit relationship graph: Combining the defined association types and the weight adjustment of the spatio-temporal decay function, the system constructs a preliminary audit relationship graph. This graph includes all audit objects (such as companies, personnel, transactions, etc.) and the relationships between them (such as transaction contracts, employee positions, etc.). Each relationship edge is attached with an initial weight, and these weights not only represent the closeness between entities but also reflect the timeliness adjustment. Integrate the semantic association strength factor to dynamically adjust the entity edge weights: The next step is to further adjust the relationship weights between entities through the semantic association strength factor. This process involves analyzing the semantic similarity in audit data, that is, adjusting the weights of entity edges based on the similarity between event semantic labels. For example, there may be a high semantic similarity between contract changes and transaction anomalies, and the system will dynamically adjust their association strength according to these semantic similarities, so that entity pairs with higher semantic consistency have a stronger coupling relationship in graph construction. Specifically, the system will calculate the similarity between semantic labels (for example, through word vector or semantic network methods) to determine which relationships between audit objects are "highly semantically consistent", and adjust the weights according to these similarities to make the relationships between these objects closer. This helps the system to give priority to connections with stronger semantic relationships when constructing the graph.For newly added or changed events, only update the entity subgraph within their influence scope: When a new event occurs or an existing event changes, the system does not recalculate the entire knowledge graph but adopts an incremental update method to only update the affected part. This part includes: Newly added or changed events: including contract changes and transaction anomalies, which may affect the existing relationship graph. Entity subgraph within the influence scope: By analyzing the influence scope of the newly added or changed events, the system only updates the entity subgraph related to these events, avoiding unnecessary calculations and reconstruction of the graph. This can significantly improve efficiency, especially in the case of frequent event changes, reducing system resource consumption. Construct an audit knowledge graph with time sensitivity and semantic interpretability: Through the above steps, the finally constructed audit knowledge graph not only has time sensitivity (because it considers the spatio-temporal decay function) but also has semantic interpretability (because it adjusts the relationship strength according to semantic label similarity). Such a graph can provide more accurate and dynamic association analysis in complex audit data, providing strong support for audit decision-making.

[0032] Specifically, the specific process of obtaining the risk propagation coefficient by performing risk assessment on the nodes in the graph through the Neo4j graph computing engine is as follows: According to the audit knowledge graph, import each audit entity node and its associated attributes into the Neo4j graph database environment, and calculate the topological influence index of the node in the entity relationship network; Combine the relationship weights dynamically adjusted by the spatio-temporal decay function to correct the input parameters of the algorithm and quantify the risk propagation ability of the node under the time effect constraint; Define the node risk impact factors, including entity type, historical risk records, participation transaction frequency, and external evaluation indicators, and calculate the temporal risk index of the node through time decay weighted. Generate the risk propagation coefficient of the node by combining the temporal risk index and the topological influence index; Set the risk conduction directionality constraint to limit the path reachability of risk propagation within a reasonable time window and business context to ensure that the risk path has business rationality; Map the propagation coefficient to the graph node attributes to generate a risk heat map, and screen high-risk nodes through Cypher queries and label them as key risk sources.

[0033] In this implementation plan, each audit entity node and its associated attributes are imported into the Neo4j graph database environment: In this step, all audit entities (such as companies, personnel, transactions) and their related attributes (such as historical records, transaction types, etc.) are imported into the Neo4j graph database. Neo4j is a graph database that can efficiently store and query graph-structured data. In the graph database, audit entities will become graph nodes, and associated attributes and audit events are connected through relationship edges. Entity nodes: Audit objects, such as companies, employees, transactions, etc. Relationship edges: The mutual relationships between audit objects, such as transaction relationships, cooperation relationships, etc. In this way, the relationships between audit entities and events form an entity relationship network, which provides a basis for subsequent risk assessment. Calculate the topological influence index of nodes in the entity relationship network: The topological influence index is used to measure the influence of a node's position in the graph. Commonly used topological metrics include degree centrality, betweenness centrality, etc. Degree centrality represents the number of connections of a node. The more connections a node has, the greater its influence on other nodes. Through the Neo4j graph calculation engine, we can efficiently calculate the topological influence index of each node in the entity relationship network and quantify its propagation ability in the network. Formula representation: Where: D(v): The degree centrality of node v. C(v): The number of connections of node v (i.e., the degree, representing the number of direct connections between the node and other nodes). N: The total number of nodes in the graph. Dynamically adjust the relationship weight by combining the spatio-temporal decay function: The spatio-temporal decay function adjusts the relationship weight between nodes according to time and space factors. In the risk propagation model, more recent events and newer data usually have greater influence. The spatio-temporal decay function will correct the relationship weight according to the time difference and spatial distance between nodes to reflect timeliness and spatial correlation. Formula representation: w ij = w0(1 + αt ij ) × exp(-βd ij ); Where: w ij : The relationship weight between node i and node j. w0: The initial relationship weight. t ij : The time difference from node i to node j. d ij: The spatial distance from node i to node j. α, β: Decay coefficients that control the influence degree of time and space. This formula ensures that as time goes by and the distance increases, the weight of the propagation relationship between nodes will gradually weaken. Define the risk influence factor of a node: The risk influence factor of a node is a key factor in evaluating its risk propagation ability and usually includes the following aspects: Entity type: Different types of entities (such as companies, employees, transactions, etc.) have different risk characteristics. Historical risk records: Whether a risk event has occurred to the entity, and past risk records will affect the current risk probability. Transaction participation frequency: The more transactions a node participates in, the greater the likelihood of being exposed to risks. External evaluation indicators: External information such as credit scores and public opinion data will also affect the risk assessment of nodes. These risk factors will generate the time-series risk index of each node through weighted summation. Calculate the time-series risk index of a node through time decay weighting: The time-series risk index is a weighted calculation of the risk of a node in the time dimension. By considering the historical risk records of the node and its performance in the time series, the time-series risk index can quantify the historical risk impact of the node. The formula is expressed as: Where: R(t i ): The time-series risk index of node i at time t. I k (t i ): The risk influence factor of node i at the historical moment t k . w k : The weight of each historical factor (such as transaction frequency, historical risk, etc.). t: The current time. t k : The occurrence time of the historical event. Calculate the risk propagation coefficient of a node: The risk propagation coefficient of a node is the final result after comprehensively considering the time-series risk index and the topological influence index of the node. This coefficient measures the importance and potential influence of the node in the risk propagation process. The formula is expressed as: Ω i = λT i + μD i ; Where: Ω i : The risk propagation coefficient of node i. T i : The time-series risk index of node i. D i: The topological influence index of node i. λ, μ: Weighting coefficients that determine the contributions of the temporal risk index and the topological influence index to the final propagation coefficient. Set the risk conduction directionality constraint: To ensure the rationality of the risk propagation path, the conduction directionality constraint is set. The risk propagation path is only valid within a certain time window and conforms to the upstream and downstream relationships in the actual business scenario. This constraint guarantees the effectiveness and business rationality of the risk propagation link. Generate the risk heat map: Map the calculated risk propagation coefficient to the attributes of the nodes in the map and generate the risk heat map in a graphical way. The nodes in the map are marked according to the magnitude of their risk propagation coefficients, and high-risk nodes are highlighted to help auditors quickly identify the risk sources and high-risk areas. Screen for high-risk nodes through Cypher queries: Use Neo4j's Cypher query language to screen the map, find the nodes with relatively high risk propagation coefficients, and mark these nodes as "key risk sources". These nodes require special attention and management.

[0034] Specifically, in combination with cross-domain association rules to mine high-frequency risk patterns and generate a risk conduction path map, the specific process of labeling abnormal risk nodes and vulnerable links is as follows: According to the risk propagation coefficients output by the Neo4j graph calculation engine, construct a set of candidate risk conduction paths in the map; Through the frequent subgraph mining algorithm, statistically analyze the risk propagation paths with commonalities in multiple business domains, and extract high-frequency risk patterns across audit domains; Integrate the audit compliance rules, business logic rules, and abnormal transaction behavior models extracted from the external rule base to construct a cross-domain association rule knowledge base; Perform rule matching on the candidate paths, screen the paths that meet the high-frequency propagation characteristics and abnormal semantic consistency, and generate a risk conduction path map with a causal chain; Layer-by-layer label the risk source nodes, propagation relay nodes, and terminal impact nodes in the path map, and identify abnormal risk nodes by combining the propagation intensity and frequency indicators; Identify the structurally vulnerable links through graph connectivity and path vulnerability analysis, and label the key propagation links with vulnerable link labels to indicate potential conduction breakpoints or key monitoring sites.

[0035] In this implementation plan, the process aims to extract high-frequency risk conduction paths with actual propagation logic and risk semantics from the dynamic audit knowledge graph, and label abnormal nodes and vulnerable links through graph calculation and rule matching, so as to provide accurate support for subsequent audit decisions. Specifically: Candidate path construction phase: First, based on the Neo4j graph calculation engine, analyze the risk propagation of each node in the graph, calculate the risk propagation coefficient between nodes, and form a set of candidate path sets that may have risk conduction relationships. Cross-domain high-frequency pattern recognition: Use the frequent subgraph mining algorithm to count the repeatedly occurring risk conduction patterns in multiple business domains (such as finance, procurement, contracts, etc.), extract the risk paths with commonalities in cross-audit domains, and form a "high-frequency risk pattern library". Rule knowledge base construction: Further introduce external audit rule bases, including audit compliance rules, business logic rules, and abnormal transaction behavior models, and uniformly construct them into a "cross-domain association rule knowledge base" to improve the audit rationality and risk interpretation ability of the paths. Path screening and matching: Semantically match the candidate paths with the above rule base, and screen out the paths that meet both the high-frequency propagation characteristics and the rule semantics, ensuring that the selected paths have a causal chain logic and can reasonably reflect the propagation process of risks from the source to the impact. Risk node annotation: In the finally generated risk conduction path graph, label the nodes according to their risk roles based on the propagation coefficient, path depth, and frequency, such as "risk source node" (risk starting point), "propagation relay node" (risk diffusion point), "terminal impact node" (final risk landing point), to improve the interpretability of the path. Vulnerable link identification: Through graph connectivity analysis and path vulnerability assessment (such as the impact on the graph structure after deleting key nodes on the path), identify the key links in the risk path that are prone to chain breakage or risk surge, and mark them as "vulnerable links" in the graph for auditors to focus on monitoring and early warning.

[0036] Specifically, based on the risk transmission path diagram and node risk assessment results, combined with multimodal data, a multimodal graph attention network is used to locate hidden audit risks and identify logically contradictory behaviors in the data. The specific process is as follows: based on the risk transmission path diagram and the node risk propagation coefficient, a weighted directed graph structure is constructed, and the node risk weight and propagation direction are used as input features of the attention mechanism; structured financial data, unstructured contract text, image vouchers, and external information sources are integrated to construct a unified multimodal feature representation tensor and map it to the corresponding nodes and edges in the graph; a multimodal graph attention network is constructed, and a cross-modal alignment mechanism is introduced to connect the implicit semantic relationship between text and numerical information, thereby improving the consistency of information transmission between nodes; multimodal contextual information is dynamically aggregated through an inter-node attention weight learning mechanism to strengthen the attention of weakly associated nodes hidden in high-risk propagation paths; a graph-level logical consistency judgment module is introduced to annotate node relationships in the path diagram that have timing conflicts, abnormal data jumps, or inconsistent contractual behaviors; finally, suspected hidden audit risk areas are output, focusing on audit entities with high risks but weakly expressed node features or isolated from explicit risk paths, realizing risk positioning based on deep information interaction.

[0037] In this implementation scheme, a set of candidate risk transmission paths in the graph is constructed: based on the aforementioned risk propagation coefficient, a set of all possible risk transmission paths in the graph is constructed. These paths reflect the propagation mode from a risk source node to other influencing nodes. Each path has a certain propagation strength and is related to the topological structure of the nodes and edges in the graph. The candidate path is a potential high-risk propagation path screened out based on the propagation coefficient. Risk transmission path: a propagation chain from one node (risk source) to other nodes. Propagation coefficient: the risk propagation ability between nodes, reflecting the importance of the path and the potential risk influence. The frequent subgraph mining algorithm statistics the common risk propagation paths in multiple business fields: a frequent subgraph mining algorithm is used to extract common risk propagation paths in multiple business domains to identify high-frequency risk patterns across domains. This step identifies potential common risks between businesses by mining subgraphs with similar structures from the graph. For example, if certain nodes or paths appear frequently in multiple business scenarios and have a high propagation coefficient, they may represent a high-frequency risk pattern across domains. Formula: S f ={G∈G|f(G)≥τ}; where: S f: Frequent subgraph set, representing subgraphs that frequently appear in a graph. G: A subgraph in the graph. f(G): The frequency of subgraph G, indicating the frequency of occurrence of the subgraph in all candidate paths. τ: The minimum frequency threshold, and subgraphs below this threshold will be discarded. Mining frequent subgraphs helps identify risk patterns across domains, such as risk patterns that often appear in the same type of transactions or business processes. Building a cross-domain association rule knowledge base: Build a cross-domain association rule knowledge base through external rule bases (such as audit compliance rules, business logic rules, abnormal transaction behavior models, etc.). These rules can help the system identify potential risk transmission paths, especially the risk correlations between different business domains or different audit objects. Audit compliance rules: Operational or behavioral models that conform to industry norms. Business logic rules: Behavioral rules based on specific business processes, such as transaction timing rules, etc. Abnormal transaction behavior model: An abnormal behavior detection model based on historical data and pattern recognition. These rules help identify which transmission paths may belong to abnormal transmission patterns and require special attention. Rule matching and path screening: By matching cross-domain association rules with candidate risk transmission paths, filter out those paths that meet the characteristics of high-frequency transmission and abnormal semantic consistency. This step matches the transmission paths according to the association rule knowledge base and the data of the actual paths, and eliminates paths that do not conform to the risk characteristics. High-frequency transmission characteristics: Risk paths that frequently appear in multiple transmissions. Abnormal semantic consistency: It means that the semantics of the nodes and edges in the path are consistent with the abnormal behavior model, indicating that the path may be involved in a certain known risk pattern. Generating a risk transmission path graph with a causal chain: After analyzing the filtered paths, a risk transmission path graph with a causal chain is formed. This graph clearly shows the propagation process from the risk source to the affected nodes, and explains the role played by each node and edge in the propagation process through the causal chain. This causal chain helps auditors understand the transmission mechanism of risk events. Causal chain: It refers to the transmission path from the source node to the final affected node, and there is a causal relationship between each node. Layer-by-layer labeling of risk source nodes, transmission relay nodes, and terminal impact nodes: In the risk transmission path graph, label each node as a risk source node, a transmission relay node, or a terminal impact node. Risk source node: The origin of the risk event, which may be a violation transaction, a contract change, or an external public opinion event. Transmission relay node: The node where the risk is transmitted in the middle of the path, playing the role of linking other nodes. Terminal impact node: The node that is finally affected, and these nodes may bear the final risk consequences. Layer-by-layer labeling helps clearly identify the role and responsibility of each node in the entire propagation chain. Identifying abnormal risk nodes by combining propagation intensity and frequency metrics: Through the propagation intensity and frequency metrics in the propagation path, identify the nodes with abnormal risk propagation in the graph. These nodes may be potential risk sources because they frequently appear in high-risk paths or have strong propagation capabilities. Formula representation: R risk (v) = ∑a∈N(v) P(a)·C(a); where: R risk (v): The abnormal risk index of node v. N(v): The neighbor nodes directly connected to node v. P(a): The propagation intensity of node a in the propagation path. C(a): The propagation frequency of node a in the path. This formula calculates the risk of node propagation in the path, and the propagation intensity and frequency jointly determine the abnormal degree of node risk. Graph connectivity and path vulnerability analysis identify structural vulnerable links: Through graph connectivity analysis, identify possible vulnerable links in the graph. These vulnerable links are parts that cause large-scale risk propagation interruption when there are fewer connections or key nodes are lost in the network. Vulnerable links are usually the weakest link in the risk conduction path, so they need to be monitored keyly. Graph connectivity: Measures the connection degree of nodes and edges in the graph. The lower the connectivity, the more likely it is that this area is more vulnerable to influence or breakage. Vulnerable link: Is the key path in the graph whose breakage may trigger large-scale risk conduction interruption. Label the key propagation links as vulnerable links: Mark the vulnerable links in the graph to remind auditors to pay attention to these links that may become potential breakpoints or key monitoring sites. The vulnerability of these links may cause the risk to suddenly intensify at a certain future moment, so special attention is needed.

[0038] Specifically, the process of outputting the abnormal entity list and confidence score and marking the specific associated risk conduction links is as follows: After completing the risk positioning of the multi-modal graph attention network, sort the abnormal nodes according to the attention weight, propagation path weight, and modal consistency score; construct a candidate pool of abnormal entities, and calculate the abnormal confidence based on the multi-modal feature distribution density and the difference degree of node embedding representation; evaluate the high-confidence entities in combination with their propagation status in the risk path graph, identify the core abnormal source, risk relay nodes, and potential victim nodes, and output them in sequence after numbering; through the graph path reverse tracing mechanism, trace back the upstream risk source nodes from each abnormal entity, and determine the effective conduction links in combination with the edge weight attenuation coefficient; mark the abnormal entity nodes in the graph spectrum, and label the risk path links associated with them as high-risk propagation paths to achieve graph spectrum-level risk link marking.

[0039] In this implementation, anomalous nodes are ranked based on attention weight, propagation path weight, and modal consistency score. After completing risk identification in a multimodal graph attention network, the identified anomalous nodes must first be ranked. Ranking criteria include: attention weight: the contribution of each node to risk transmission in the multimodal network. Propagation path weight: the position of the node in the risk propagation path. Nodes with higher weights play a significant role in the propagation process. Modal consistency score: a consistency score for nodes across multiple modalities (such as text and images) is used to assess the consistency of node behavior under different information sources. By comprehensively considering these three factors, key nodes in risk propagation can be efficiently identified. Constructing an anomalous entity candidate pool: Based on the aforementioned ranking, an anomalous entity candidate pool is constructed containing all anomalous nodes. Nodes in this pool may be potential risk sources. To further screen out high-risk entities, the anomalous confidence score of each anomalous node is calculated. The anomalous confidence score is calculated based on the node's multimodal feature distribution density and the difference in the node's embedding representation. A higher distribution density indicates a higher degree of anomalousness; a greater difference in the embedding representation indicates a more significant difference between the node and other nodes in the network. The formula is: Where: C E (c): Confidence of abnormality of node v. |N(c)|: Number of neighbor nodes of node c. D E (c, d): The multimodal feature difference between node c and its neighbor node d. ρ(c, d): The embedding representation difference between node c and node d. This formula comprehensively measures the degree of anomaly by calculating the difference between a node and its neighbors. Evaluating the propagation status of high-confidence entities: For selected high-confidence entities, further evaluation is required in conjunction with their propagation status in the risk path graph. This evaluation focuses on the entity's core position in the risk transmission chain, determining whether it is a core anomaly source, a risk relay node, or a potential victim node. Core anomaly source: The node itself is the starting point and source of risk. Risk relay node: The node is a transit node in the risk propagation path, taking on the risk and then propagating it outward. Potential victim node: The node ultimately bears the consequences of the risk or suffers losses. This evaluation relies on the node's position in the graph and its propagation capabilities. These roles can be identified through the node's propagation coefficient and influence index in the graph. A backtracking mechanism identifies effective transmission links: Using the graph path backtracking mechanism, starting from each anomaly entity, tracing back to its upstream risk source node to determine effective transmission links. During the tracking process, the effectiveness of the path needs to be judged by combining the weight attenuation coefficient of each edge. The edge with a higher attenuation coefficient indicates that the influence of the path is smaller and may be excluded from the effective transmission link. The formula is: P chain (c)=∑ d∈P(c) W cd (t)·σ; where: Pchain (c): The effective conduction link weight of node c. P(c): All reverse conduction paths starting from node v. W cd (t): The relationship weight between node c and node d. ω: The edge weight decay coefficient in the conduction path. This formula calculates the effectiveness of each path, weights the path through the decay coefficient, and identifies the intensity of the conduction risk. Identify abnormal entity nodes in the graph spectrum, and label the associated risk path links as high-risk propagation paths: In the graph spectrum, for each identified abnormal entity node, make an identification and label its associated risk path links as high-risk propagation paths. In this way, the high-risk paths in the graph spectrum can be clearly displayed, facilitating subsequent risk monitoring and response. By labeling the risk degree of each conduction link, the visualization of potential high-risk paths can be achieved, helping auditors quickly identify possible risk transmission paths.

[0040] Specifically, the specific process of dynamically updating the embedding representation of abnormal nodes according to the time-series graph attention network and generating interpretable audit decisions through causal reasoning and dynamic representation techniques is as follows: Based on the abnormal entity list and its associated path information in the audit knowledge graph, extract the timestamps and context entity relationships of risk event occurrences, and construct a time-series subgraph reflecting the risk evolution process; Perform time-weighted encoding on each node and its edge relationships in the time-series subgraph through the time-series graph attention network, and dynamically adjust the embedding representation of abnormal nodes according to the time-series dependence relationship between nodes, reflecting the risk evolution characteristics of abnormal nodes in the time dimension; Combine the known audit causal event relationships in the graph spectrum to construct a causal graph structure, and mine the antecedent and consequent paths of abnormal nodes through the structural causal model; Integrate the time-series embedding representation and causal paths of abnormal nodes to generate an explanatory rule for audit analysis. This rule describes the reasons for triggering abnormalities, the risk conduction mechanism, and potential affected entities, and outputs a structured audit causal graph spectrum containing the relationships between abnormal nodes, associated cause nodes, risk conduction paths, and affected objects.

[0041] In this implementation plan, the extraction of abnormal entities and associated path information: First, extract the entity nodes with abnormal behaviors and their associated path information from the audit knowledge graph. The risk events of each abnormal entity node will leave a timestamp and the association relationship with other entities in the graph (for example, the association between a certain transaction and a certain customer). By analyzing these associated paths, we can obtain the time point when the risk event occurs and the context entities related to the event. These information provide a basis for subsequent risk evolution analysis. Construction of a temporal subgraph: Using the list of extracted abnormal entities and their associated path information in the audit graph, we construct a temporal subgraph. This subgraph includes the time nodes of abnormal events, the entities related to the event, and the chronological order relationship between these entities. The temporal subgraph reflects the evolution process of risks and also provides input data for subsequent processing of the temporal graph attention network. Encoding of the temporal graph attention network: In the temporal graph attention network, each node and its edge relationship will be weighted encoded, and the time-weighting mechanism can dynamically adjust the weights of nodes and edges according to time information. Specifically, when calculating the embedded representation of nodes, the temporal graph attention network will consider the temporal dependence relationship between nodes and dynamically adjust the embedded representation of abnormal nodes in the time dimension. In this way, the embedded representation of abnormal nodes not only reflects the current state but also can capture its changing characteristics during the time process, revealing the trend of its risk evolution. Construction of a causal graph structure: Based on the known audit causal event relationships in the graph (such as the occurrence of a certain transaction may lead to risk diffusion), we construct a causal graph structure. The causal graph describes the causal relationship between different events through structured nodes and edges. In this process, we associate abnormal nodes with their potential antecedent and consequent nodes to form a complete causal graph model. This causal graph reflects the causes of abnormal behaviors and the subsequent impact paths. Causal reasoning and analysis of abnormal nodes: Through the reasoning mechanism of the structural causal model, we can analyze the antecedents (i.e., the factors that lead to the abnormal event) and consequences (i.e., other risk events that may be triggered by the abnormal event) of abnormal nodes. This process helps us understand the motivation behind the behavior of abnormal nodes and predict the propagation path of risk events. Through causal reasoning, we can analyze the generation and diffusion mechanism of risks from multiple perspectives. Generation of audit decision rules: Combining the temporal embedded representation of abnormal nodes and causal path information, we can comprehensively obtain a set of explanatory rules, which provide support for audit decisions. The core of the rules is to describe the causes of abnormal behaviors, the risk conduction mechanism, and the potential affected entities. These rules can help auditors quickly understand the causes, propagation paths, and possible affected objects of abnormal events. Finally, the audit system will output a structured audit causal graph, which includes the relationships between abnormal nodes, related antecedent nodes, risk conduction paths, and their affected objects.Output Audit Causal Map: Finally, the audit system generates a structured audit causal map that includes abnormal nodes, associated cause nodes, risk transmission paths, and the relationship between affected objects. This information provides actionable decision-making support for auditors, helping them efficiently identify, analyze, and respond to potential risks in a complex audit environment.

[0042] Please refer to Figure 2 , an audit decision-making support method based on a dynamic knowledge graph, includes the following steps: S1. Real-time collect multimodal audit data through a streaming event processing framework and convert it into a dynamic event stream. Construct an entity relationship network through a spatio-temporal attenuation function, attach a timeliness weight to the association relationship of audit objects, and construct an audit knowledge graph; S2. Identify risks in the audit data according to the entity relationship network in the audit knowledge graph, evaluate the risks of the nodes in the graph through the Neo4j graph computing engine, obtain the risk propagation coefficient, and combine cross-domain association rules to mine high-frequency risk patterns to generate a risk transmission path map, and label abnormal risk nodes and vulnerable links; S3. According to the risk transmission path map and the node risk assessment results, combined with multimodal data, locate hidden audit risks through a multimodal graph attention network, identify data logical contradiction behaviors, output a list of abnormal entities and confidence scores, and label the associated risk transmission links; S4. According to the list of abnormal entities and the association path, dynamically update the embedding representation of abnormal nodes according to the temporal graph attention network, and generate an interpretable audit decision through causal reasoning and temporal dynamic representation.

[0043] In this implementation, Step S1: The innovation of this step lies in the introduction of a streaming event processing framework, enabling real-time collection of audit data and its transformation into a dynamic event stream. This method ensures the immediacy and timeliness of data, providing up-to-date real-time information for subsequent audit decisions. Additionally, using a spatio-temporal decay function to attach timeliness weights to the entity relationship network is the key point of innovation. By performing timeliness weighting on the association relationships of audit objects, it can effectively reflect the temporal evolution process of data, avoiding the lag of traditional static relationship graphs when dealing with dynamic data. In this way, the audit knowledge graph can automatically adjust its structure according to different time nodes, ensuring timely response to new audit events. Step S2: The innovation of this step is the combination of the Neo4j graph computing engine with the risk assessment of audit data. Through the graph computing engine, nodes (such as entities or events) and edges (such as association relationships) in audit data can be efficiently calculated and analyzed. This method breaks through the traditional single data analysis method, enabling real-time and accurate assessment of the risks of nodes and calculation of the risk propagation coefficient. Through cross-domain association rule mining and combined with domain knowledge, potential high-frequency risk patterns can be mined from multiple dimensions, identifying which entities or behaviors may lead to the concentrated outbreak of risks. Additionally, the generated risk conduction path graph presents the risks of audit objects in the form of a graph, making abnormal risk nodes and vulnerable links clearly visible, enhancing the intuitiveness and effectiveness of audit decisions. Step S3: In this step, the use of a multi-modal graph attention network is the core innovation of this method. By fusing multi-modal data (such as text, images, behavior records, etc.), the model can simultaneously consider multiple information sources and dynamically weight based on the relationships between nodes, thereby enhancing the ability to identify potential risks in complex audit environments. Traditional audit systems often rely on a single data source and may overlook hidden risks, while this method can capture audit risks more comprehensively through multi-modal fusion. Through this network, hidden risks in audits can be accurately located, and data logic contradiction behaviors can be discovered, which are usually subtle problems difficult to identify manually. Finally, the generated list of abnormal entities and confidence scores provides operability for subsequent risk decisions, helping auditors quickly identify and handle potential risks. Step S4: Combine the temporal graph attention network with causal reasoning methods to dynamically update the embedding representation of abnormal nodes. The temporal graph attention network can adjust the embedding representation of abnormal nodes based on time series information. Considering the changes in the time dimension, it can reflect the evolution characteristics of abnormal events at different time points. Causal reasoning, by mining the causal relationships between nodes, identifies the root causes and subsequent impact paths of abnormal events. This can not only explain the generation mechanism of risk events but also predict their future impacts. Additionally, the temporal dynamic representation can make audit decisions more interpretable. Auditors can more clearly understand the logic and data support behind each decision, reducing uncertainty and subjective human judgment in the decision-making process.

[0044] In summary, the present application has at least the following effects:

[0045] An audit decision support system and method based on a dynamic knowledge graph, by introducing a streaming event processing framework and a spatio-temporal decay function, realizes the real-time collection and dynamic update of multi-modal audit data, ensures the timeliness and relevance of the knowledge graph, and significantly improves the timeliness of audit response. Combining risk propagation analysis based on a graph computing engine and cross-domain high-frequency risk pattern mining, effectively identifies abnormal nodes and vulnerable paths in the audit graph, and realizes the structured presentation and precise positioning of complex audit risks. Introducing a multi-modal graph attention network to fuse multi-source heterogeneous data can identify logical conflicts and audit abnormal behaviors hidden behind the data, expanding the analysis depth that is difficult to reach by traditional audit means. Based on the temporal graph attention mechanism and the structural causal model, dynamically updates the embedding representation of abnormal nodes, mines the causal chain and influence path of abnormal events, and generates a structured audit causal graph, providing transparent and traceable explanatory support for audit decisions.

[0046] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0047] The present invention is described with reference to the flowcharts and / or block diagrams of systems, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, and the combination of processes and / or blocks in the flowchart and / or block diagram, can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for realizing the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0048] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device realizes the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0049] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operation steps are executed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions for implementing the functions specified in one process or a plurality of processes and / or boxes Figure 1 in one box or a plurality of boxes. Figure 1 steps.

[0050] Although the preferred embodiments of the present invention have been described, additional changes and modifications can be made by those skilled in the art once they learn of the basic creative concept. Therefore, the appended claims are intended to be construed to cover the preferred embodiments as well as all changes and modifications falling within the scope of the present invention.

[0051] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims

1. An audit decision support system based on a dynamic knowledge graph, characterized in that, It includes the following modules: a graph construction module, a risk conduction analysis module, a cross-modal anomaly detection module, and an audit decision-making module; The graph construction module is used to collect multi-modal audit data in real time through a streaming event processing framework and convert it into a dynamic event stream, construct an entity relationship network through a spatio-temporal attenuation function, attach a timeliness weight to the association relationship of audit objects, and construct an audit knowledge graph; The risk conduction analysis module is used to identify risks in audit data based on the entity relationship network in the audit knowledge graph, evaluate the risks of nodes in the graph through the Neo4j graph computing engine, obtain the risk propagation coefficient, and combine cross-domain association rules to mine high-frequency risk patterns, generate a risk conduction path graph, and mark abnormal risk nodes and vulnerable links; The cross-modal anomaly detection module is used to locate hidden audit risks, identify data logical contradiction behaviors, output a list of abnormal entities and confidence scores, and mark the associated risk conduction links by combining multi-modal data according to the risk conduction path graph and the node risk assessment results through a multi-modal graph attention network; The audit decision-making module is used to dynamically update the embedding representation of abnormal nodes according to the list of abnormal entities and the association path, and generate an interpretable audit decision through causal reasoning and temporal dynamic representation.

2. The audit decision support system based on the dynamic knowledge graph according to claim 1, characterized in that: The specific process of collecting multi-modal audit data in real time through a streaming event processing framework and converting it into a dynamic event stream is as follows: Collect structured transaction data, unstructured contract texts, and external public opinion data through a distributed crawler and API interfaces, adopt an event-driven data preprocessing mechanism, dynamically match cleaning strategies according to the data source type, extract key fields, and convert them into audit semantic tags; Define audit domain event types, including contract changes, transaction anomalies, and regulatory updates, and map multi-modal data into a dynamic event stream through a stream processing engine; Trigger an incremental graph construction algorithm based on audit semantic tags, and only update the local subgraph affected by the event.

3. The audit decision support system based on a dynamic knowledge graph according to claim 2, wherein: The specific process of constructing an entity relationship network through a spatio-temporal attenuation function, attaching a timeliness weight to the association relationship of audit objects, and constructing an audit knowledge graph is as follows: Define the association types between audit objects, attach an initial weight to each relationship edge, and introduce a spatio-temporal attenuation function to dynamically adjust the relationship weight according to the event occurrence time to construct an initial audit relationship graph; Fuse the semantic association strength factor, dynamically adjust the entity edge weights through the similarity between event semantic tags, and make entity pairs with high semantic consistency construct a stronger coupling relationship; For newly added or changed events, only update the entity subgraph within its influence range to construct an audit knowledge graph with time sensitivity and semantic interpretability.

4. The audit decision support system based on a dynamic knowledge graph according to claim 3, characterized in that: The specific process of evaluating the risks of nodes in the graph through the Neo4j graph computing engine and obtaining the risk propagation coefficient is as follows: According to the audit knowledge graph, import each audit entity node and its associated attributes into the Neo4j graph database environment, and calculate the topological influence index of the node in the entity relationship network; Combine the relationship weights dynamically adjusted by the spatio-temporal attenuation function, correct the input parameters of the algorithm, and quantify the risk propagation ability of the node under the timeliness constraint; Define node risk influencing factors, including entity type, historical risk record, transaction frequency, and external evaluation indicators. Calculate the node's temporal risk index through time decay weighting. Combine the temporal risk index with the topological impact index to generate the node's risk propagation coefficient. Set directional constraints on risk transmission to limit the path accessibility of risk transmission within a reasonable time window and business context, ensuring that the risk path is business reasonable; Map the propagation coefficient to the graph node attributes to generate a risk heat map, and filter high-risk nodes through Cypher queries and mark them as key risk sources.

5. The audit decision support system based on a dynamic knowledge graph according to claim 4, characterized in that: The specific process of mining high-frequency risk patterns by combining cross-domain association rules, generating a risk transmission path diagram, and marking abnormal risk nodes and vulnerable links is as follows: Based on the risk propagation coefficient output by the Neo4j graph calculation engine, a set of candidate risk transmission paths in the graph is constructed; Through the frequent subgraph mining algorithm, we can count the common risk propagation paths in multiple business domains and extract high-frequency risk patterns across audit areas. Integrate audit compliance rules, business logic rules, and abnormal transaction behavior models extracted from external rule bases to build a cross-domain association rule knowledge base; Perform rule matching on candidate paths, screen paths that meet high-frequency transmission characteristics and abnormal semantic consistency, and generate a risk transmission path diagram with a causal chain; In the path diagram, risk source nodes, transmission relay nodes, and terminal impact nodes are marked layer by layer, and abnormal risk nodes are identified by combining transmission intensity and frequency indicators; Through graph connectivity and path vulnerability analysis, structural vulnerable links are identified, and key transmission links are labeled as vulnerable links to indicate potential transmission breakpoints or key monitoring locations.

6. The audit decision support system based on a dynamic knowledge graph according to claim 5, wherein: Based on the risk transmission path diagram and node risk assessment results, combined with multimodal data, the multimodal graph attention network is used to locate hidden audit risks and identify data logical contradictions. The specific process is as follows: Based on the risk transmission path graph and the node risk propagation coefficient, a weighted directed graph structure is constructed, and the node risk weight and propagation direction are used as input features of the attention mechanism; Integrate structured financial data, unstructured contract text, image vouchers, and external information sources to build a unified multimodal feature representation tensor and map it to corresponding nodes and edges in the graph. Construct a multimodal graph attention network and introduce a cross-modal alignment mechanism to connect the implicit semantic relationship between text and numerical information, improving the consistency of information transmission between nodes; Dynamically aggregate multimodal contextual information through an inter-node attention weight learning mechanism to strengthen the attention of weakly connected nodes hidden in high-risk transmission paths; A graph-level logic consistency assessment module is introduced to mark node relationships in the path graph that have timing conflicts, abnormal data jumps, or inconsistent contract behaviors; The final output is suspected hidden audit risk areas, focusing on audit entities with high risks but weak node characteristics or isolated from explicit risk paths, to achieve risk positioning based on deep information interaction.

7. The audit decision support system based on a dynamic knowledge graph according to claim 6, characterized in that: The specific process of outputting a list of abnormal entities and confidence scores and marking the associated risk transmission links is as follows: After completing the risk localization of the multi-modal graph attention network, the abnormal nodes are sorted according to the attention weights, propagation path weights, and modal consistency scores; Construct an abnormal entity candidate pool, and calculate the abnormal confidence based on the multi-modal feature distribution density and the difference degree of node embedding representation; Evaluate the entities with high confidence in combination with their propagation status in the risk path graph, identify the core abnormal sources, risk relay nodes, and potential victim nodes, and number and output them in sequence; Through the graph path reverse tracing mechanism, trace back the upstream risk source nodes from each abnormal entity, and determine the effective conduction link in combination with the edge weight attenuation coefficient; Mark the abnormal entity nodes in the graph spectrum, and label the risk path links associated with them as high-risk propagation paths to achieve graph spectrum-level risk link annotation.

8. The audit decision support system based on a dynamic knowledge graph according to claim 7, characterized in that: The specific process of dynamically updating the abnormal node embedding representation according to the temporal graph attention network and generating an interpretable audit decision through causal reasoning and dynamic representation is as follows: Based on the abnormal entity list and its associated path information in the audit knowledge graph, extract the timestamps of risk events and the context entity relationships, and construct a temporal subgraph reflecting the risk evolution process; Perform time-weighted encoding on the nodes and their edge relationships in the temporal subgraph through the temporal graph attention network, and dynamically adjust the embedding representation of the abnormal nodes according to the temporal dependence relationship between the nodes, reflecting the risk evolution characteristics of the abnormal nodes in the time dimension; Combine the known audit causal event relationships in the graph spectrum to construct a causal graph structure, and mine the antecedent and consequent paths of the abnormal nodes through the structural causal model; Integrate the temporal embedding representation and causal path of the abnormal nodes to generate an explanatory rule for audit analysis. This rule describes the reasons for triggering the abnormality, the risk conduction mechanism, and the potential impact entities, and outputs a structured audit causal graph spectrum containing the relationships between the abnormal nodes, associated cause nodes, risk conduction paths, and affected objects.

9. The audit decision-making support method based on a dynamic knowledge graph, applying the audit decision-making support system based on a dynamic knowledge graph according to any one of claims 1-8, is characterized in that, Including the following steps: S1. Real-time collect multi-modal audit data through a streaming event processing framework and convert it into a dynamic event stream. Construct an entity relationship network through a spatio-temporal attenuation function, attach timeliness weights to the association relationships of audit objects, and construct an audit knowledge graph; S2. Identify risks in the audit data according to the entity relationship network in the audit knowledge graph, evaluate the risks of the nodes in the graph through the Neo4j graph computing engine, obtain the risk propagation coefficient, and combine cross-domain association rules to mine high-frequency risk patterns, generate a risk conduction path graph, and label abnormal risk nodes and vulnerable links; S3. According to the risk conduction path graph and the node risk assessment results, combined with multi-modal data, locate hidden audit risks through a multi-modal graph attention network, identify data logical contradiction behaviors, output an abnormal entity list and a confidence score, and label the associated risk conduction links; S4. According to the abnormal entity list and the associated path, dynamically update the abnormal node embedding representation according to the temporal graph attention network, and generate an interpretable audit decision through causal reasoning and temporal dynamic representation.

Images