Financial data security management method based on distributed account book

Abstract

The invention provides a financial data security management method based on a distributed account book, and the method comprises the steps: storing data to a distributed node database if a verification result shows that the data is not tampered, and generating a consistent data copy through a multi-node consensus mechanism; for the data copy, regularly extracting key field data and comparing the key field data with the initial data record set to obtain a consistency comparison result; if the consistency comparison result shows that inconsistency exists, marking and classifying inconsistent data, generating a risk assessment value, and determining a high-risk data point; performing deep analysis according to the high-risk data points, tracing a data modification history, and obtaining a timeline and responsibility attribution information of a tampering behavior; and according to the timeline and the responsibility affiliation information, generating a structured report and a risk early warning signal, and determining a subsequent processing direction.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a financial data security management method based on a distributed ledger. Background Art

[0002] Problem background: Financial reporting fraud detection, as a crucial research area, plays an irreplaceable role in ensuring transparency in corporate economic activities and maintaining market order. The authenticity of financial reports directly impacts investor trust, corporate reputation, and the stability of financial markets. Therefore, developing effective detection methods and systems is a critical and pressing task.

[0003] However, many current solutions face significant limitations in practical application. Traditional detection methods rely heavily on manual audits and spot checks, which are not only inefficient but also susceptible to human intervention, making it difficult to detect data tampering or omissions. Even with the introduction of digital tools, the centralized and modifiable nature of data storage often makes it difficult to fully guarantee the authenticity and integrity of information.

[0004] Against this backdrop, the field faces significant technical challenges. The primary issue is ensuring the immutability of financial data. Once the data is maliciously modified during storage or transmission, it directly undermines the authenticity of the report, thereby impacting the reliability of detection. This issue, in turn, leads to another core difficulty: how to automate and efficiently verify data. Without the ability to quickly compare financial reports with the original data through technical means, it becomes difficult to detect anomalies in complex data environments, missing the optimal opportunity for fraud detection. These two challenges, layered on top of each other—the former being the foundation, the latter a deeper application—collectively constitute the difficulty of current research.

[0005] Therefore, how to build a system that can not only ensure that financial data cannot be tampered with, but also automatically and efficiently verify data consistency has become a key issue that needs to be overcome in this research. Summary of the Invention

[0006] The present invention provides a financial data security management method based on a distributed ledger, which mainly includes: Financial data is encrypted and stored through distributed ledger technology, and a unique identifier bound to the data content is generated to form an initial data record set that cannot be tampered with; based on the initial data record set, an encryption algorithm is used to protect the data during data transmission, and the integrity of the transmitted data is verified to obtain a verification result; if the verification result shows that the data has not been tampered with, the data is stored in a distributed node database, and a consistent data copy is generated through a multi-node consensus mechanism; for the data copy, key field data is regularly extracted and compared with the initial data record set to obtain a consistency comparison result; if the consistency comparison result shows that there is an inconsistency, the inconsistent data is labeled and classified, a risk assessment value is generated, and high-risk data points are determined; based on the high-risk data points, an in-depth analysis is performed to trace the data modification history and obtain the timeline and responsibility information of the tampering behavior; based on the timeline and responsibility information, a structured report and risk warning signal are generated to determine the subsequent processing direction. Furthermore, the encrypted storage of financial data through distributed ledger technology includes: processing the original financial records using a preset encryption algorithm to generate a unique hash value bound to the data content as an identifier; binding it to the financial data based on the unique hash value to form an unalterable initial data set; obtaining irreversible digital fingerprint information for the initial data set; if an anomaly is detected in the digital fingerprint information during the storage process, recalculating the hash value through a verification mechanism to determine data consistency; obtaining the data storage status of each node by continuously monitoring the digital fingerprint information and combining it with the node synchronization mechanism of the distributed ledger; if it is detected that the data of a certain node does not match the digital fingerprint information, triggering an automatic repair process, using backup data to overwrite it, and updating the record information in the distributed ledger; verifying the updated content through a multi-node consensus mechanism, generating an unalterable log file and marking it with timestamp technology to obtain long-term traceable storage credentials. Furthermore, the data is protected by an encryption algorithm during data transmission, including: obtaining digital fingerprint information corresponding to each financial record based on an initial data record set to construct a unique identifier; using an asymmetric encryption algorithm to perform signature protection on each financial record to generate an encrypted record set with a signature mark; for the encrypted record set, performing segmented verification on each data packet during data transmission to obtain data packet status information; if the data packet status information shows abnormal fluctuations, the matching degree between the signature mark and the original fingerprint is analyzed by comparing a preset threshold to obtain an identification result of potential tampering; based on the identification result, a hash algorithm is used to perform a secondary verification on the abnormal data packet to determine the location where the tampering occurred; by analyzing the location where the tampering occurred, combined with the transmission log and timestamp information, the specific time point and impact range of the tampering are determined; if the impact range is confirmed, a repair instruction is generated, the signature protection is rebuilt, and an updated integrity verification result is obtained.Furthermore, the storing of data in a distributed node database includes: judging whether the data has been tampered with through the integrity verification result; if the data has not been tampered with, transmitting the data packet to a pre-built distributed node database, and using a storage allocation strategy to determine the data storage location distribution; based on the storage location distribution, calling a consensus mechanism to perform multi-node verification and synchronization on the data, generating a distributed backup, and obtaining multiple consistent copies of the data; for the data copies, using a consistency check tool to compare the differences in the contents of each copy to judge the degree of consistency assurance; if the consistency verification conclusion meets the preset threshold, determining the redundancy confirmation index by calculating the copy distribution coverage; based on the redundancy confirmation index, combined with the distributed node operation status monitoring, analyzing potential security risks, and obtaining a security assurance assessment result; based on the assessment result, adjusting the distributed backup storage strategy, optimizing the resource allocation between nodes, and obtaining the final storage optimization solution. Furthermore, the periodic extraction of key field data and comparison with the initial data record set includes: obtaining stored data copies through distributed nodes, using automated scripts for preliminary integration, and obtaining a unified data set to be processed; for the data set to be processed, using a timed extraction mechanism to extract core field data in the financial report to form a structured field data set; based on the field data set, obtaining corresponding original record data, calculating unique identification information, and obtaining a digital fingerprint set; by comparing the field data set with the digital fingerprint set item by item, using a hash algorithm to calculate consistency differences, and determining comparison result information; if the comparison result information shows that the difference exceeds a preset threshold, the inconsistent field data is marked and an abnormal data list is generated; based on the abnormal data list, a consistency result record is generated to determine whether the financial report is consistent with the original record; through the consistency result record, the data copy status in the distributed node is updated, and the abnormal data list is synchronized to each node. Furthermore, the labeling and classification of inconsistent data includes: extracting inconsistency features from field data through comparison result analysis, performing preliminary screening using a preset comparison tool, and obtaining a preliminary set of inconsistent data; based on the preliminary set, applying an anomaly marking algorithm to label the data, obtaining the specific location and deviation value of the abnormal data, and determining the labeling information; for the labeling information, calculating the distribution characteristics of the abnormal data through statistical analysis methods, and obtaining the distribution pattern and range; if the distribution pattern exceeds the preset threshold range, grouping the abnormal data using a clustering algorithm to obtain a classification result of potential fraud risk; based on the classification result, analyzing the correlation between the grouping and the fraud risk, if the degree of aggregation of the deviation value of a certain group is higher than the preset standard, it is determined that there is a risk point and the distribution details are obtained; through the distribution details, combined with the distribution feature pattern, the abnormal data is further verified to obtain a high-risk data set and determine the final fraud risk point.Furthermore, the in-depth analysis based on the high-risk data points includes: obtaining a high-risk data set through preset priority order rules, performing preliminary classification in batch processing, and obtaining classified data groups; according to the data grouping, using an automated verification process to check one by one to obtain a data subset with preliminary abnormality markings; for the data subset, using deep comparison technology to extract feature vectors and determine the abnormal distribution pattern; if the feature vector distribution pattern exceeds the preset threshold range, the data subset is scanned for tampering trace details to obtain significant features; through the significant features, combined with the potential pattern distribution law, a cluster analysis method is used to perform pattern matching to obtain a potential pattern set of fraudulent behavior; according to the potential pattern set, specific evidence trace details are associated to construct an evidence chain and determine the association path of the fraudulent behavior; if the association path meets the preset logical conditions, multi-dimensional verification is performed to obtain the final verification result and determine the accuracy of the fraudulent behavior. Furthermore, the tracing of data modification history includes: obtaining data modification record information through the distributed node database log function, extracting operation time and source address, and obtaining a preliminary modification history data set; constructing a complete timeline based on the historical data set, arranging the operation time using a time sorting method, and determining the time sequence and key nodes of the tampering behavior; analyzing the source address distribution through the timeline, and if the operation frequency of a certain address exceeds a preset threshold, it is marked as a potential source of tampering behavior, and a preliminary judgment result on the attribution of responsibility is obtained; for the potential source of tampering behavior, tracing the corresponding data modification record, using a cluster analysis method to identify the specific location of the tampering link, and obtaining a detailed pattern; based on the detailed pattern, analyzing the scope of influence on other data records, marking the affected objects, and determining the impact boundary; through the impact boundary, combined with the historical tracing function, obtaining the modification record of the affected object, judging whether the tampering behavior involves multi-node propagation, and obtaining the final tampering impact analysis result.

[0007] The technical solution provided by the embodiment of the present invention may have the following beneficial effects: The present invention discloses a method for detecting financial data fraud based on distributed ledger technology. By generating a unique hash value for the original financial records, an initial data record set that cannot be tampered with is formed, and an asymmetric encryption algorithm is used for signature protection during the data transmission process. The present invention stores data in a distributed node database, regularly extracts key fields from financial reports and compares them with the original records, anomaly marks when inconsistent data is found, and uses a support vector machine algorithm to assess the risk level of abnormal data. The present invention also traces the data modification history, extracts the operation time and source address, obtains a complete timeline and responsibility attribution information of the tampering behavior, and finally generates a structured report and a visual chart. This method can effectively detect fraud in financial data and improve the security and reliability of financial data. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 This is a flow chart of a financial data security management method based on a distributed ledger according to the present invention. DETAILED DESCRIPTION

[0009] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0010] like Figure 1 In this embodiment, a financial data security management method based on a distributed ledger may specifically include: In step S101, the financial data is encrypted and stored using distributed ledger technology. A unique hash value identifier is generated for the original financial record. The hash value is bound to the data content to form an unalterable initial data record set, and irreversible digital fingerprint information is obtained to determine the security basis of data storage.

[0011] Financial data is encrypted and stored using distributed ledger technology. A pre-set encryption algorithm is used to process the original records, generating a unique hash value tied to the data content and producing an initial digital identifier. This unique hash value is then bound to the financial data to form an unalterable initial dataset, ensuring the integrity of the data records. An irreversible digital fingerprint is generated for the initial dataset. If an anomaly is detected in the digital fingerprint during storage, a verification mechanism recalculates the hash value to verify data consistency. Continuously monitoring the digital fingerprint, combined with the distributed ledger's node synchronization mechanism, allows the data storage status across nodes to be determined, ensuring the stability of the storage environment. Regarding the data storage status, if a mismatch is detected between the data on a particular node and the digital fingerprint, an automatic repair process is triggered, overwriting the data with backup data to produce a consistent, repaired dataset. Based on the repaired dataset, the records in the distributed ledger are updated, and the updated content is verified through a multi-node consensus mechanism to determine the security foundation of the data storage. For this verified record information, unalterable log files are regularly generated and timestamped to provide long-term traceability of the data storage credentials.

[0012] For example, in the encrypted storage of financial data, distributed ledger technology is widely used to ensure data security and integrity. For encrypted storage of financial data, the original records are processed using a pre-set encryption algorithm to generate a unique hash value. For example, a company generates 1,000 financial transaction records per month. Each record contains the amount, time, and transaction parties. Based on this information, the system generates a 256-bit hash value, which serves as a digital identifier for the data. This hash value is bound to the original data, forming an immutable initial dataset. This ensures that any minor modification will result in a change in the hash value, thus laying the foundation for data integrity.

[0013] Specifically, when generating digital fingerprint information, the system extracts the features of the initial dataset, creating an irreversible fingerprint for subsequent verification. If the amount in a record is altered from 1,000 yuan to 1,001 yuan, the recalculated hash value will not match the original fingerprint, detecting the anomaly and triggering the verification mechanism. This mechanism has significant technical benefits, enabling timely detection of data tampering and safeguarding the authenticity of financial data.

[0014] For example, in a distributed ledger's node synchronization mechanism, suppose five nodes jointly store financial data, each maintaining an identical copy of the ledger. If a node experiences an anomaly in its data storage status, such as a mismatch in the hash value of a record on Node A, the system compares the backup data from other nodes, triggering an automatic repair process to overwrite the correct data on Node A. This multi-node synchronization improves the stability of the storage environment and prevents data loss due to single points of failure.

[0015] Specifically, after data repairs are completed, the system verifies the updated content through a multi-node consensus mechanism. For example, if a transaction amount is updated, at least three nodes must reach consensus before it can be written to the ledger. This approach ensures the security of data storage and prevents malicious nodes from tampering with data. The consensus mechanism enhances the system's trustworthiness and resilience.

[0016] For example, when generating immutable log files, the system timestamps each log file, creating long-term traceability. For example, if a company's financial log file for October 1, 2023, is timestamped, future audits can verify that the file has not been tampered with using the timestamp. This approach provides a reliable basis for data traceability, meeting compliance requirements while enhancing the credibility of financial data. Through the aforementioned multifaceted technologies, the application of distributed ledgers in financial data storage demonstrates strong security and reliability. From encrypted storage to digital fingerprint verification, node synchronization, and log tracing, each link is closely linked, ensuring data integrity and credibility, providing solid technical support for corporate financial management.

[0017] In step S102, based on the digital fingerprint information of the initial data record set, an asymmetric encryption algorithm is used to sign and protect each financial record during the data transmission process, and a real-time verification is performed on the data packet in transmission to obtain the integrity verification result of the transmitted data and determine whether there is any tampering during the transmission process.

[0018] By processing the initial data, the digital fingerprint information corresponding to each financial record is obtained, and a unique identifier is constructed for subsequent protection and verification, resulting in a preliminary fingerprint dataset. Based on this preliminary fingerprint dataset, an asymmetric encryption algorithm is used to sign and protect each financial record, generating an encrypted record set with a signature mark. The protection status of each record is then determined. For this encrypted record set, segmented verification is performed on each data packet during data transmission, obtaining packet status information during transmission and determining whether there are any abnormal fluctuations. If the packet status information shows abnormal fluctuations, the match between the signature mark of the abnormal packet and the original fingerprint dataset is analyzed using a preset threshold, resulting in a preliminary identification result of potential tampering. Based on this preliminary identification result, a hash algorithm is used to perform a secondary verification on the content of the abnormal packet, generating a checksum that is then compared with the original digital fingerprint to determine the location of the tampering. By analyzing the location of the tampering, the transmission logs of the relevant data packets are obtained. Combined with the timestamp information of the real-time verification, the specific time and scope of the tampering are determined. If the time and scope of the tampering are confirmed, corresponding repair instructions are generated for the affected transmitted data, and the signature protection is reestablished to obtain an updated integrity verification result.

[0019] For example, when processing raw financial data, obtaining the digital fingerprint of each record is a key step. A digital fingerprint can be understood as a unique identifier for the data, usually generated through a specific algorithm to ensure that each record can be accurately distinguished.

[0020] In one possible implementation, imagine a company has 1,000 financial records, each containing amounts, dates, and transaction parties. The system processes these records one by one, generating corresponding fingerprint information, creating a preliminary dataset containing 1,000 unique identifiers. This approach facilitates rapid identification of problematic records during subsequent verification.

[0021] For example, asymmetric encryption signature protection for preliminary fingerprint datasets can be implemented through a public key and private key mechanism. The public key is used to verify the signature, and the private key is used to generate the signature, ensuring that the data is not illegally modified during transmission or storage.

[0022] Specifically, if a financial record contains an amount of 50,000 yuan, the system will use the private key to sign the record's fingerprint information, generating an encrypted mark. Any recipient can then use the public key to verify whether the record has been tampered with. This dual protection mechanism greatly enhances the credibility of the data.

[0023] For example, during data transmission, segmented verification can split a large file into multiple small data packets, each with its own integrity verification. For example, suppose a financial data file is divided into 10 data packets, each 1MB in size. The system compares the signature of each packet during transmission. If the signature of the third packet does not match the original fingerprint, it is marked as an anomaly. This segmentation method helps quickly locate problematic packets and reduces the scope of investigation.

[0024] For example, a hash algorithm can further confirm the location of tampering by performing secondary verification on abnormal data packets. For example, if the original fingerprint value of a data packet is a specific string of characters, and the system recalculates the hash value of the packet content and finds an inconsistency, it can be confirmed that the packet content has been modified. This secondary verification provides additional protection for data integrity.

[0025] For example, when analyzing the timing and scope of tampering, the system combines transmission logs and timestamp information for tracing. For example, if the log shows that a data packet experienced an anomaly during transmission at 10:00 AM, affecting five subsequent data packets, the system will record this time and analyze the scope of the impact, allowing for targeted remediation. This tracing capability helps quickly identify the root cause of the problem.

[0026] For example, when generating repair instructions for affected data, signature protection can be rebuilt from backup data. Assuming there are 10 affected records, the system extracts the original data from the backup and regenerates the signature tags, ensuring that these records are restored to their original state. This repair mechanism effectively prevents data loss or error propagation. Through the various implementation methods described above, it can be seen that each technical topic plays a vital role in financial data protection, collectively building a rigorous data security system. These methods not only enhance data credibility and integrity but also provide reliable support for rapid response to abnormal situations.

[0027] In step S103, if the integrity verification result of the transmitted data shows no tampering, the data packet is stored in a pre-established distributed node database, and the data is distributedly backed up through a multi-node consensus mechanism to obtain multiple consistent copies of the data, thereby ensuring the redundancy and security of the data storage.

[0028] By verifying data integrity and obtaining verification results, the data is determined to be tamper-proof, resulting in a preliminary integrity assessment. If the integrity assessment indicates that the data has not been tampered with, the data packet is transferred to a pre-built distributed node database, and a storage allocation strategy is implemented to determine the data storage location distribution. Based on the storage location distribution, a consensus mechanism is invoked to perform multi-node data verification and synchronization, generating distributed backups and obtaining multiple consistent data copies. A consistency check tool is used to compare the content differences between the generated data copies, determine the consistency assurance level between the copies, and obtain a consistency verification conclusion. If the consistency verification conclusion meets the preset threshold, a redundancy analysis is performed on the data copies. The redundancy verification index is determined by calculating the coverage of the replica distribution. Based on the redundancy verification index and the operational status monitoring of the distributed nodes, potential security risks are analyzed to obtain a security assurance assessment result. Based on the security assurance assessment results, the storage strategy of the distributed backup is adjusted, and resource allocation between nodes is optimized to obtain the final storage optimization solution.

[0029] For example, in the data integrity verification scenario, a multi-layered verification mechanism can be built for the transmission and storage of financial records to ensure data has not been tampered with. For example, if an enterprise transmits 1,000 financial records daily, a unique identification code is first generated for each record and compared against a pre-stored identification library. If the comparison results are consistent, the data integrity is initially determined to be intact. This approach can quickly screen out potentially problematic data, providing a foundational guarantee for subsequent processing.

[0030] For example, a dynamic allocation strategy can be used when transmitting data packets to a distributed node database. Assuming there are five distributed nodes, the system will distribute data packets to nodes with lower loads and closer proximity based on their load and location. For example, 40% of records could be stored on node A, 30% on node B, and the remainder distributed across other nodes. This allocation method effectively improves storage efficiency while reducing the risk of single node failure.

[0031] For example, a consensus mechanism for multi-node verification and synchronization can be implemented through a voting-based protocol. For example, a financial record is considered valid and synchronized to all nodes only after at least three of five nodes reach consensus. This mechanism ensures data consistency in a distributed environment and reduces data deviations caused by individual node anomalies.

[0032] For example, when checking the consistency of data replicas, an automated comparison tool can be used to regularly scan for differences in the content of replicas at each node. If a replica on a node is found to have a 0.1% discrepancy with the master record, the system will automatically flag that replica as abnormal and trigger a repair process. This type of checking method can promptly identify potential issues and ensure the reliability of replicas.

[0033] For example, redundancy analysis can assess storage robustness by calculating the distribution coverage of replicas. If replicas are distributed across five nodes and each node achieves at least 80% coverage, the redundancy index is considered high. This analysis helps determine data resilience in the event of node failures and improves the stability of the storage solution.

[0034] For example, security assessments can be combined with node operational status monitoring data for analysis. If a node experiences high load for three consecutive hours, the system will flag it as a potential risk point and reduce the data storage ratio for that node. This assessment method can effectively identify security risks and ensure the security of the data storage environment.

[0035] For example, when adjusting distributed backup storage policies, resource allocation can be optimized based on assessment results. If a node is marked as high-risk, the system will reduce the data percentage on that node from 30% to 10% and reallocate the remaining data to other stable nodes. This dynamic adjustment optimizes resource utilization, ensures long-term data storage stability, and improves overall system security and efficiency.

[0036] Step S104: Based on the data copies in the distributed node database, an automated script is used to regularly extract key field data in the financial report, and the extracted field data is compared with the digital fingerprint information of the original record set to obtain a consistency comparison result of the field data, and determine whether the financial report is consistent with the original record.

[0037] Distributed nodes retrieve data copies stored in each node and use automated scripts to perform preliminary integration of the data copies to obtain a unified dataset to be processed. A timed extraction mechanism is then used to extract the core field data from the financial report, forming a structured field data set. Based on this structured field data set, the corresponding original record data is retrieved. Using a pre-established digital fingerprint generation method, unique identification information is calculated for the original record data to obtain a digital fingerprint set. The field data set is then compared item by item with the digital fingerprint set, and a hash algorithm is used to calculate the consistency differences between the two to determine the data comparison results. If the data comparison results indicate differences exceeding a preset threshold, the inconsistent core field data is marked, generating a list of marked anomaly data. Based on this marked anomaly data list, a consistency result record is generated. Combined with the logical rules used to determine the results, the consistency between the financial report and the original record is determined. This consistency result record automatically updates the data copy status in the distributed nodes, and the anomaly data list is synchronized to each node, completing the data consistency verification process.

[0038] For example, in a distributed data processing scenario, automated tools can be used to perform preliminary data consolidation when acquiring data copies from each node. For example, consider a financial data system distributed across 10 nodes, each storing partial copies of financial reports. The system automatically invokes a script to consolidate these copies into a unified dataset for processing. This consolidation approach ensures a consistent data source for subsequent processing, avoiding discrepancies caused by data fragmentation between nodes.

[0039] For example, a scheduled extraction mechanism can be used to extract core field data. Key fields from financial reports, such as revenue, expenditure, and profit, can be extracted from the dataset every six hours to form a structured field data set. This mechanism ensures real-time data processing while avoiding system overhead caused by frequent operations.

[0040] It should be noted that the formation of structured data facilitates subsequent comparison and analysis. Especially in the financial field, the standardization of fields directly affects the accuracy of the results.

[0041] For example, when generating digital fingerprints, a hash-based method can be used to generate a unique identifier for each raw data record. For example, if a record contains a company's revenue data for the first quarter of 2023, totaling 1,000,000 yuan, the system will generate a fixed-length digital fingerprint using a specific algorithm. This fingerprint serves as a unique identifier for the data, making it easier to quickly locate discrepancies during subsequent comparisons.

[0042] For example, when comparing a field data set with a digital fingerprint set, a hash algorithm can be used to calculate the difference between the two. If the comparison reveals that the income value of a field data set does not match the original record corresponding to the fingerprint, and the difference reaches 5%, exceeding the preset threshold of 2%, the field data will be marked as an anomaly. This comparison method can accurately identify points of data inconsistency and provide a basis for subsequent processing.

[0043] For example, after generating a list of abnormal data, the system automatically marks inconsistent core fields and creates a list. For example, if the list contains three abnormal data items involving revenue and profit fields, the system will record the specific locations and discrepancies of these anomalies. This marking method helps quickly locate problematic data and improves troubleshooting efficiency.

[0044] For example, when generating consistency records, the consistency of financial reports with original records can be determined based on an exception list and logical rules. Suppose the rule is set to consider consistency if the total difference value does not exceed 3%. If the actual difference is 4%, it is considered inconsistent and a corresponding record is generated. This recording method provides clear guidance for subsequent data corrections.

[0045] For example, when updating the state of distributed node data replicas, the system synchronizes a list of exceptions to all 10 nodes, ensuring consistent data status across all nodes. If a node fails to update in time due to network latency, the system triggers a retry mechanism until synchronization is complete. This synchronization approach ensures data consistency in a distributed environment and mitigates business risks caused by data asynchrony between nodes.

[0046] It's important to note that the implementation methods for each of the aforementioned steps closely align with the business needs of distributed data processing, forming a complete chain from data acquisition to consistency verification. This approach not only improves the accuracy of financial data processing but also reduces the likelihood of human intervention through automation and synchronization, providing strong support for data security and business continuity.

[0047] In step S105, if the consistency comparison result of the field data shows inconsistency, the inconsistent data is marked using a preset anomaly marking algorithm to obtain the specific location and deviation value of the abnormal data, and determine the distribution characteristics of the abnormal data and potential fraud risk points.

[0048] Through comparison analysis, inconsistency features are extracted from the field data. Pre-defined comparison tools are then used to perform a preliminary screening of the data, resulting in a preliminary set of inconsistent data. Based on the inconsistent data in this preliminary set, an anomaly labeling algorithm is applied to the data, identifying the specific locations and deviation values ​​of the anomaly data and determining the anomaly labeling information. Based on the specific locations and deviation values ​​in the anomaly labeling information, statistical analysis methods are used to calculate the distribution characteristics of the anomaly data, identifying the pattern and range of the distribution characteristics. If the distribution pattern exceeds a preset threshold, a deep clustering analysis is performed on the anomaly data, using the K-means clustering algorithm to group the anomaly data and obtain a classification result of potential fraud risks. Based on the grouping information in the classification results, the association between each group and fraud risk is analyzed. If the degree of clustering of deviation values ​​in a group exceeds a preset standard, the group is identified as a risk point, and detailed distribution details of the risk point are obtained. Using the distribution details of the risk points and the pattern of the distribution characteristics, the anomaly data is further verified, resulting in a verified high-risk data set and the final fraud risk points. If the amount of data in the high-risk data set reaches a preset ratio, a batch backtracking analysis is performed on the field data to obtain the data comparison information after backtracking and determine whether there are new inconsistency features.

[0049] For example, in the area of ​​financial report data consistency verification, comparison tools can be used to perform preliminary data screening to identify inconsistencies in field data. For example, if a company's financial report shows the accounts receivable field as 5 million yuan, while the original record shows 4.8 million yuan, the tool will automatically identify this 200,000 yuan discrepancy and include it in the preliminary inconsistent data set. This preliminary screening can quickly identify potential problem fields and provide a foundation for subsequent analysis.

[0050] Specifically, when applying an anomaly marking algorithm to inconsistent data in the initial set, it can label it based on the deviation value and data location. For example, in the aforementioned accounts receivable field, the deviation is located in the summary of a subsidiary's report, and the deviation value is 200,000 yuan. The algorithm will label the specific location of the field and the deviation details. This annotation method helps accurately locate the source of the problem and improve the targeted nature of subsequent analysis.

[0051] For example, when statistically analyzing the distribution characteristics of abnormal data, we can identify abnormal patterns by analyzing the concentration and distribution range of deviation values. For example, if deviation values ​​across multiple financial fields are concentrated between 100,000 and 300,000 yuan and primarily distributed within reports within a specific time period, we can infer the presence of a systemic issue. This distribution analysis helps uncover hidden regular anomalies and provides a basis for risk assessment.

[0052] Specifically, using the K-means clustering algorithm to group abnormal data based on distribution patterns exceeding a threshold, the deviation data can be divided into three groups based on numerical value and time distribution. For example, if the first group of deviations is concentrated in a high-value range and coincides with a significant transaction, this may indicate potential fraud risk. This grouping method effectively separates abnormal data of different risk levels, improving the accuracy of risk identification.

[0053] For example, when analyzing the correlation between grouping and fraud risk, if a group shows a high degree of clustering of deviation values—for example, all deviation values ​​are around 250,000 yuan and involve the same department—this group can be identified as a risk point. Further analysis of the distribution details can confirm that the risk points are concentrated in a certain type of transaction record. This correlation analysis can help focus on high-risk areas and optimize resource allocation.

[0054] Specifically, verification of high-risk data sets can be combined with multi-dimensional comparisons based on distributional patterns. If, after verification, data deviations in a particular field are found to be consistent with historical anomaly patterns, and the data volume accounts for a preset 5%, batch retrospective analysis can be triggered. Retrospective analysis may reveal new inconsistencies, such as deviations caused by changes in data entry rules within a certain time period. This verification and retrospective mechanism ensures comprehensive coverage of risk points and improves the reliability of data verification.

[0055] For example, if new inconsistencies are discovered during batch retrospective analysis, such as deviations in a field due to manual adjustments, the comparison rules can be further refined. This retrospective analysis continuously optimizes the data consistency verification process, ensuring the accuracy of financial reports and providing reliable support for corporate decision-making.

[0056] In step S106, the labeled data is classified using a support vector machine algorithm based on the distribution characteristics of the abnormal data, and a risk level assessment value of the abnormal data is generated based on the classification result to obtain a priority ranking of high-risk data points and determine which data points need to be checked in detail.

[0057] By analyzing abnormal data and distribution characteristics, a feature description of the initial data set is obtained and the basic pattern of data distribution is determined. Based on the basic pattern of data distribution, the support vector machine algorithm is used to classify the labeled data to obtain a preliminary division of the classification results. Based on the preliminary division of the classification results, the risk assessment value of each data point is calculated to determine the risk level of the abnormal data. If the risk assessment value exceeds the preset threshold, the corresponding data point is marked as a high-risk point, and a set of high-risk points is obtained. Based on the set of high-risk points, a priority list is generated to determine the order of verification priority. By combining the order of verification priority with the characteristics of data distribution, the data points for key verification are screened to obtain the final verification target. The key verification data points are compared with the feature description of the initial data set to determine whether there is a new abnormal data distribution pattern.

[0058] For example, when analyzing abnormal data and distribution characteristics, one can start by examining the overall data distribution to understand the underlying patterns. For example, consider processing field data from a company's financial statements. The initial dataset might contain values ​​for multiple fields, such as revenue and costs. Statistical analysis reveals that the distribution of values ​​in the revenue field exhibits a certain centralization trend, with the majority of data concentrated between 1 million and 5 million, but with a small number of data points significantly above or below this range. These abnormal data points may indicate potential issues, necessitating further characterization, such as the data's concentration and dispersion, to determine the underlying distribution pattern.

[0059] For example, when using the support vector machine algorithm to classify the basic pattern of data distribution, data points can be divided into two categories: normal and abnormal. The principle of the support vector machine is to separate different categories of data by finding an optimal hyperplane.

[0060] In one possible implementation, assume that most data points in the revenue field are classified as normal, while a small number of data points with significant deviations, such as those with revenue values ​​of 10 million or only 100,000, are classified as abnormal. This preliminary classification helps quickly identify potential problem areas and lays the foundation for subsequent analysis.

[0061] For example, when calculating the risk assessment value for each data point, we can make a comprehensive judgment based on the data point's degree of deviation and distribution characteristics. For example, if a data point's income value deviates significantly from the average and its distribution is located in an extreme value area, its risk assessment value might be 85, far exceeding the preset threshold of 50. In this case, the data point would be marked as high-risk. All high-risk points are aggregated into a set to facilitate subsequent prioritization.

[0062] For example, when generating a prioritized list, data points can be sorted from highest to lowest based on their risk assessment value. For example, if there are 10 data points in a high-risk set, the three with the highest risk values ​​involve unusual fluctuations in the revenue field, and these three are prioritized. This sorting ensures that verification resources are focused on the areas most likely to present problems.

[0063] For example, when selecting key data points for review, you can further refine your targets based on distribution characteristics. For example, if two of the top three priority data points exhibit a concentrated anomaly in the distribution of the income field, they may be caused by the same type of issue. These points can then be designated as key review targets. This approach can effectively narrow the scope of review.

[0064] For example, comparing the feature descriptions of key audit data points with those of the initial dataset can reveal new abnormal distribution patterns. Suppose, through comparison, the abnormal values ​​in the revenue field of a key audit data point are correlated with abnormal values ​​in other fields, such as the cost field. This could be due to data entry errors or manual adjustments. This comparative analysis helps uncover hidden issues and improves the comprehensiveness of data quality management. Through this approach, a complete logical chain is formed from data analysis to classification, risk assessment, prioritization, and key audits, ensuring more accurate and efficient processing of abnormal data while providing strong support for the reliability of corporate financial data.

[0065] Step S107: Based on the priority ranking of high-risk data points, the data points are deeply compared and analyzed through a preset automated verification process to obtain detailed information on the source of deviations and tampering traces, thereby determining the potential pattern and specific chain of evidence of fraudulent behavior.

[0066] Using preset priority rules, a high-risk data set is retrieved from the system and preliminarily categorized using batch processing to generate categorized data groups. Based on these categorized data groups, each group is individually verified using an automated verification process to obtain a data subset with preliminary anomaly markings and identify records that may contain deviations. For this preliminarily marked data subset, deep comparison techniques are used, utilizing a support vector machine algorithm to extract features from the data points, obtain feature vectors indicating the source of the deviation, and determine the specific distribution pattern of the anomaly. If the distribution pattern of the feature vector exceeds a preset threshold, the data subset is scanned for detailed tampering traces to obtain detailed information and identify significant features of the tampering. Using these significant features and the distribution patterns of potential patterns, cluster analysis is used to perform pattern matching on the data subset to obtain a potential pattern set of fraudulent behavior and determine its behavioral patterns. Based on this potential pattern set of fraudulent behavior, the trace details of specific evidence are linked, and a rule-matching approach is used to construct a chain of evidence on the data subset, resulting in a complete chain of evidence and identifying the associated path of the fraudulent behavior. If the associated path of the evidence chain meets the preset logical conditions, the path will be verified in multiple dimensions to obtain the final verification result and determine the accuracy of the fraudulent behavior.

[0067] For example, when processing high-risk data sets, pre-set priority rules can be used to filter out potentially anomalous data from the system. These priority rules can be based on the data's source, historical anomaly records, or fluctuations in key fields. For example, if a transaction amount field in a dataset fluctuates by more than 50% of its average, it will be prioritized for inclusion in the high-risk set. Batch processing can then initially categorize this data by source or type, for example, into internal and external transactions, to facilitate subsequent targeted verification.

[0068] For example, within the categorized data groups, an automated verification process can individually check the integrity and consistency of each group. For example, if the transaction time of a record in an internal transaction group doesn't match the system log, it might be flagged as a preliminary anomalous data subset. This approach allows for rapid identification of potentially discrepant records, providing a foundation for subsequent in-depth analysis.

[0069] For example, when using a support vector machine algorithm for feature extraction, key feature vectors, such as transaction frequency and amount distribution, can be extracted from a subset of data that has been initially flagged as abnormal. For example, if the transaction frequency of a particular data point increases abnormally over a short period of time, and the distribution pattern deviates from a threshold within the normal range, for example, exceeding three times the average, this may indicate a potential problem. This feature extraction method allows for more accurate identification of abnormal distribution patterns.

[0070] For example, for feature vectors that exceed a threshold, a detailed scan for tampering can focus on details such as the data point's timestamp and modification history. For example, if a scan reveals that a record's timestamp has been manually adjusted multiple times, with significant adjustments, this could be considered a significant sign of tampering. This detailed analysis helps pinpoint the source of the anomaly.

[0071] For example, cluster analysis can combine the distinctive features of tampering evidence with the distribution patterns of underlying patterns to group data subsets into groups based on behavioral patterns. For example, if a set of data exhibits a pattern of recurring high-value transactions, this may indicate specific fraudulent activity. This pattern matching can help identify underlying behavioral patterns.

[0072] For example, when constructing a chain of evidence, rule matching can be used to link potential patterns of fraudulent behavior with specific evidence traces. For example, if a pattern of recurring high-value transactions matches multiple timestamp adjustment records, a complete chain of evidence can be formed, pointing to a possible fraud path. This connection path provides a logical basis for subsequent verification.

[0073] For example, if the path along a chain of evidence meets pre-set logical conditions, such as high consistency in time, amount, and operator, it can be further confirmed through multi-dimensional verification. For example, cross-checking operator logs and transaction records can ensure the accuracy of the results. This multi-dimensional verification can enhance the reliability of judgments and provide solid support for the final decision.

[0074] Step S108: Based on the potential pattern of fraudulent behavior, the data modification history is traced through the log recording function of the distributed node database. The operation time and source address are extracted for each modification operation to obtain the complete timeline and responsibility information of the tampering behavior, and the specific links and impact scope of the tampering are determined.

[0075] Using the database logging capabilities of distributed nodes, we retrieve records of all data modifications. For each record, we extract the operation time and source address, generating a preliminary modification history dataset. Based on this preliminary modification history dataset, we construct a complete timeline, using a chronological sorting method to rank the operation times and determine the chronological order and key nodes of the tampering behavior. Using this complete timeline, we analyze the distribution of source addresses. If the operation frequency of a particular address on the timeline exceeds a preset threshold, it is marked as a potential source of tampering, providing a preliminary assessment of responsibility. For potential sources of tampering, we trace the corresponding data modification records and employ cluster analysis to identify the specific location of the tampering link and obtain detailed patterns of the tampering behavior. Based on the detailed patterns of the tampering behavior, we analyze the impact of the tampering on other data records. If a data record is associated with a tampering link, it is marked as an affected object, determining the boundaries of the impact range. Using the boundaries of the impact range, combined with historical tracing capabilities, we retrieve all modification records of the affected objects, determine whether the tampering behavior spreads across multiple nodes, and obtain the final tampering impact analysis results. Based on the final tampering impact analysis results, the complete timeline, responsibility attribution and tampering link information are integrated, and visualization tools are used to generate a dynamic display of the tampering behavior to determine a comprehensive tampering behavior tracking path.

[0076] For example, when obtaining data modification records through the database logging function of a distributed node, one can first focus on the operation time and source address information recorded in the log. For example, in a financial transaction monitoring system, a distributed node records the modification logs of all transaction data for the past month. By extracting the operation time and source address of each record, a preliminary dataset containing thousands of records can be generated. This approach can lay the foundation for subsequent analysis.

[0077] For example, to construct a complete timeline and use a chronological sorting method, all operation times can be arranged from earliest to latest. Suppose, in the above system, an unusual concentration of modification operations is found between 2:00 AM and 3:00 AM on a certain day. This chronological arrangement can help quickly identify potentially suspicious time nodes and provide clues for subsequent analysis.

[0078] For example, when analyzing the distribution of source addresses, we can count the frequency of each address's operations. For example, if a source address modifies transaction data 50 times in a single day, far exceeding the preset threshold of 10, we would flag it as a potential source of tampering. This marking method helps to initially identify the direction of responsibility.

[0079] For example, tracing and clustering the source of potential tampering can delve deeper into the modification records corresponding to that address. Suppose, through clustering, we discover that the address primarily modified the transaction amount field, and that the modifications are concentrated in high-value transaction records. This pattern indicates that the tampering may have targeted specific types of data, helping to accurately locate the tampering link.

[0080] For example, when analyzing the impact of tampering on other data records, you can examine the data associated with the tampered record. For example, if a tampered transaction record is associated with multiple subsequent transfer records, these transfer records can be marked as affected. This demarcation helps clarify the scope of impact and avoid missing relevant data.

[0081] For example, by combining historical tracing capabilities with access to modification records of affected objects, it's possible to determine whether the tampering has spread across multiple nodes. If the affected transaction records are updated synchronously across multiple nodes, with highly consistent update times, this may indicate widespread tampering. This analysis helps comprehensively assess the impact of the tampering.

[0082] For example, when integrating information and using visualization tools to generate a dynamic representation of tampering behavior, a timeline chart can be used to display the order in which tampering operations occurred and the distribution of source addresses. For example, if the chart shows that operations on a certain address are concentrated in a specific time period and are associated with abnormal operations on other nodes, this intuitive display can help clearly track the tampering path and improve analysis efficiency and accuracy.

[0083] In step S109, based on the complete timeline and responsibility information of the tampering behavior, an automated report generation tool is used to integrate the information into structured report content, generate visual charts and risk warning signals for the report content, obtain the final fraud detection and analysis results, and determine the direction and basis for subsequent processing.

[0084] By obtaining timelines and responsibility information related to tampering from the data source, the raw data is de-noised using pre-set data cleaning rules to generate a preliminary dataset. Based on this preliminary dataset, automated tools are used to classify and map the timelines and responsibility information, generating a structured content framework. Within this structured content framework, visualization tools are used to create a correlation chart between timelines and responsibility. Pre-set thresholds are used to determine risk levels and generate risk warning signals. If the risk warning signal exceeds the pre-set threshold, a logical comparison method is used to deeply match the tampering behavior with the responsibility information to determine a preliminary conclusion on fraud detection. Based on this preliminary conclusion and the correlation chart between timelines and responsibility, a random forest algorithm is used to analyze the tampering patterns and generate the final detection results. The final detection results, combined with the structured content framework and risk warning signals, generate logical guidance for the processing direction and determine the priority ranking of subsequent actions. After obtaining the logical guidance for the processing direction, the execution path for the subsequent actions is automatically generated based on the priority ranking results, and the final processing plan is determined.

[0085] For example, when processing data related to tampering, timelines and responsibility information can be extracted from the data source. Taking a distributed database environment as an example, suppose an enterprise's internal system records all data operation logs, including operation time and operator address. Imagine a scenario where a key financial data has been modified multiple times in the past 30 days, and the system log shows that five different addresses participated in the operation. Using pre-set data cleaning rules, invalid or duplicate log entries are eliminated. For example, duplicate records with an operation time interval of less than 1 minute are treated as noise, resulting in a preliminary data set containing approximately 100 valid operation records.

[0086] For example, when using automated tools to classify and map associations within a pre-organized data set, timelines can be broken down by day, and responsibility attribution information can be grouped by address. For example, if a certain address saw 20 operations within three days, significantly higher than the average of 5 for other addresses, the system would automatically flag it as a high-risk target and generate a structured content framework that clearly displays the relationship between time and address. This approach helps quickly identify anomalous behavior.

[0087] For example, when creating a correlation chart using a visualization tool, you can use a timeline to display the order of operations, use color depth to represent the frequency of operations, and set a risk threshold of 15 operations per week. If an address experiences 18 operations per week, the system will trigger a risk warning signal. This intuitive presentation makes it easy to quickly identify potential issues.

[0088] For example, if risk warning signals exceed thresholds, a deep logical comparison method can be used to match tampering behavior with responsibility attribution. This can analyze whether the operations at that address are concentrated in a specific data field, such as the profit item in a financial statement. If the modifications are concentrated in that field, and the data before and after the modifications differ significantly, a preliminary judgment is made that fraud is involved. This method can effectively narrow the scope of the investigation.

[0089] For example, when using the random forest algorithm to analyze tampering patterns, the operation time, frequency, and data fields can be input as features, allowing the system to automatically identify abnormal patterns. For example, if operations on a certain address are mostly performed during non-business hours and the modified fields are highly consistent, it can be determined to be systematic tampering. This analysis can improve detection accuracy.

[0090] For example, when generating logical guidance for handling, the system, combined with a structured framework and risk warning signals, can prioritize operation records from high-risk addresses, recommending freezing their permissions before conducting a thorough audit of the relevant data. This prioritization helps effectively address risks.

[0091] For example, when automatically generating an execution path based on the priority sorting results, a process can be designed: first, notify the operator at the relevant address to submit an explanation. If no response is received within 48 hours, permissions are automatically restricted and the affected data is backed up. This path design ensures the feasibility of the solution and reduces potential losses.

[0092] Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application also intends to include such modifications and variations.

Claims

1. A financial data security management method based on a distributed ledger, characterized in that: include: Financial data is encrypted and stored through distributed ledger technology, generating a unique identifier bound to the data content, forming an initial data record set that cannot be tampered with; Based on the initial data record set, an encryption algorithm is used to protect the data during data transmission, and integrity verification is performed on the transmitted data to obtain a verification result; If the verification result shows that the data has not been tampered with, the data is stored in a distributed node database, and a consistent data copy is generated through a multi-node consensus mechanism; For the data copy, regularly extract key field data and compare it with the initial data record set to obtain consistency comparison results; If the consistency comparison results show inconsistencies, the inconsistent data are marked and classified, a risk assessment value is generated, and high-risk data points are identified; Conduct in-depth analysis based on the high-risk data points, trace the data modification history, and obtain the timeline and responsibility of the tampering behavior; Based on the timeline and responsibility information, a structured report and risk warning signals are generated to determine the subsequent processing direction.

2. The financial data security management method based on distributed ledger according to claim 1, characterized in that: The encrypted storage of financial data through distributed ledger technology includes: The original financial records are processed using a preset encryption algorithm to generate a unique hash value bound to the data content as an identifier; Based on the unique hash value, it is bound to the financial data to form an initial data set that cannot be tampered with; For the initial data set, obtaining irreversible digital fingerprint information; If an anomaly is detected during the storage of the digital fingerprint information, the hash value is recalculated through a verification mechanism to determine data consistency; By continuously monitoring the digital fingerprint information and combining it with the node synchronization mechanism of the distributed ledger, the data storage status of each node is obtained; If it is detected that the data of a certain node does not match the digital fingerprint information, an automatic repair process is triggered, and the backup data is used to overwrite and update the record information in the distributed ledger; The updated content is verified through a multi-node consensus mechanism, and tamper-proof log files are generated and marked with timestamp technology to obtain long-term traceable storage credentials.

3. The financial data security management method based on distributed ledger according to claim 1, characterized in that: The encryption algorithm is used to protect data during data transmission, including: Obtain the digital fingerprint information corresponding to each financial record based on the initial data record set and construct a unique identifier; Use asymmetric encryption algorithm to sign and protect each financial record, generating an encrypted record set with signature mark; For the encrypted record set, performing segment verification on each data packet during data transmission to obtain data packet status information; If the data packet status information shows abnormal fluctuations, the matching degree between the signature mark and the original fingerprint is analyzed by comparing the preset threshold to obtain the identification result of potential tampering; Based on the identification results, a hash algorithm is used to perform a secondary check on the abnormal data packet to determine the location where the tampering occurred; By analyzing the location where the tampering occurred and combining the transmission log and timestamp information, the specific time point and impact range of the tampering behavior can be determined; If the impact scope is confirmed, a repair instruction is generated, the signature protection is rebuilt, and the updated integrity verification result is obtained.

4. The financial data security management method based on distributed ledger according to claim 1, characterized in that: Storing the data in a distributed node database includes: Determine whether the data has been tampered with based on the integrity verification results; If the data has not been tampered with, the data packet is transmitted to a pre-built distributed node database, and a storage allocation strategy is used to determine the data storage location distribution; Based on the storage location distribution, a consensus mechanism is called to perform multi-node verification and synchronization of data, generate distributed backups, and obtain multiple consistent copies of data; For the data copies, use consistency check tools to compare the content differences of each copy and determine the consistency guarantee level; If the consistency verification conclusion meets the preset threshold, the redundancy confirmation index is determined by calculating the replica distribution coverage; Based on the redundancy confirmation indicators and in combination with the distributed node operation status monitoring, potential security risks are analyzed to obtain security assurance assessment results; Based on the evaluation results, the distributed backup storage strategy is adjusted, resource allocation between nodes is optimized, and the final storage optimization solution is obtained.

5. The financial data security management method based on distributed ledger according to claim 1, characterized in that: The periodic extraction of key field data and comparison with the initial data record set includes: Obtain stored data copies through distributed nodes and use automated scripts for preliminary integration to obtain a unified data set to be processed; For the data set to be processed, a timed extraction mechanism is used to extract the core field data in the financial report to form a structured field data set; According to the field data set, the corresponding original record data is obtained, the unique identification information is calculated, and the digital fingerprint set is obtained; By comparing the field data set with the digital fingerprint set item by item, using a hash algorithm to calculate the consistency difference, and determining the comparison result information; If the comparison result information shows that the difference exceeds a preset threshold, the inconsistent field data is marked and an abnormal data list is generated; Generate consistency result records based on the abnormal data list to determine whether the financial report is consistent with the original records; By recording the consistency results, the data copy status in the distributed nodes is updated, and the abnormal data list is synchronized to each node.

6. The financial data security management method based on distributed ledger according to claim 1, characterized in that: The labeling and classification of inconsistent data includes: By analyzing the comparison results, inconsistency features are extracted from the field data, and a pre-set comparison tool is used for preliminary screening to obtain a preliminary set of inconsistent data; Based on the preliminary set, an anomaly labeling algorithm is applied to label the data, obtain the specific location and deviation value of the abnormal data, and determine the labeling information; Calculate the abnormal data distribution characteristics based on the labeled information through statistical analysis methods to obtain the distribution pattern and range; If the distribution pattern exceeds a preset threshold range, a clustering algorithm is used to group the abnormal data to obtain a classification result of potential fraud risk; Based on the classification results, the correlation between the grouping and fraud risk is analyzed. If the degree of clustering of deviation values ​​in a certain grouping is higher than the preset standard, a risk point is determined to exist and distribution details are obtained; Through the distribution details, combined with the distribution feature pattern, the abnormal data is further verified to obtain a high-risk data set and determine the final fraud risk point.

7. The financial data security management method based on distributed ledger according to claim 1, characterized in that: The in-depth analysis based on the high-risk data points includes: By presetting priority order rules, a high-risk data set is obtained, and a batch processing method is used to perform preliminary classification to obtain the classified data groups; According to the data grouping, an automated verification process is used to verify each data one by one to obtain a data subset with preliminary abnormality marks; For the data subset, deep comparison technology is used to extract feature vectors and determine abnormal distribution patterns; If the feature vector distribution pattern exceeds a preset threshold range, the data subset is scanned for tampering details to obtain significant features; By combining the significant features with the distribution law of potential patterns, cluster analysis methods are used to perform pattern matching to obtain a set of potential patterns of fraudulent behavior; Based on the potential pattern set, specific evidence trace details are associated to build an evidence chain and determine the associated path of fraudulent behavior; If the association path meets the preset logical conditions, multi-dimensional verification is performed to obtain the final verification result and determine the accuracy of the fraudulent behavior.

8. The financial data security management method based on distributed ledger according to claim 1, characterized in that: The traceable data modification history includes: Through the distributed node database log function, obtain data modification record information, extract operation time and source address, and obtain preliminary modification history data set; Based on the historical data set, a complete timeline is constructed, and the operation time is arranged using a time sorting method to determine the time sequence and key nodes of the tampering behavior; Analyze the distribution of source addresses through the timeline. If the operation frequency of a certain address exceeds the preset threshold, it will be marked as a potential source of tampering and a preliminary determination of responsibility will be made. Based on the potential source of tampering, trace the corresponding data modification records, use cluster analysis methods to identify the specific location of the tampering link, and obtain detailed patterns; Analyze the impact scope on other data records based on the detailed pattern, mark the affected objects, and determine the impact boundary; Through the impact boundary, combined with the historical tracing function, the modification records of the affected objects are obtained, and it is determined whether the tampering behavior involves multi-node propagation, and the final tampering impact analysis results are obtained.

Images