A real-time audit monitoring system with adaptive learning

Abstract

This invention relates to the field of real-time audit monitoring technology and discloses an adaptive learning real-time audit monitoring system. The system includes a data acquisition module for determining the operational stability of audit objects based on operational behavior characteristics; a pattern recognition module for determining a learning adaptation strategy based on operational stability and determining the correlation between behavior and risk based on rule matching degree; a rule adaptation module for determining the determination method of rule optimization value based on risk exposure rate under the corresponding strategy and determining its compliance based on response lag; an anomaly determination module for determining the compliance of behavior and risk based on the risk conversion ratio of the monitoring node; and a system calibration module for determining whether to increase the optimization value, increase behavioral constraints, or decrease the risk threshold when the rule optimization value or behavior does not comply with the risk, based on the difference in response lag, the ratio of the risk conversion ratio to the preset conversion ratio, or the degree of difference. This system achieves real-time and accurate audit monitoring, improving risk identification and response capabilities.

Description

Technical Field

[0001] This invention relates to the field of real-time audit monitoring technology, specifically to an adaptive learning real-time audit monitoring system. Background Technology

[0002] In today's rapidly developing information age, the operational security and compliance of various systems are becoming increasingly important. Audit monitoring, as a key means of ensuring the secure operation of systems, is undeniably crucial. However, traditional audit monitoring systems face numerous challenges in practical applications. Most traditional systems employ fixed audit rules and models, making it difficult to adapt to the dynamic changes in the operational behavior of audited entities. Because different audited entities have different operating habits and business scenarios, and their operational behavior may change over time and due to business needs, fixed rules cannot accurately capture the stability changes in operational behavior, resulting in inaccurate assessments and difficulty in effectively identifying potential risks.

[0003] Traditional systems lack real-time capabilities. When faced with sudden abnormal operations or risky behaviors, they often exhibit delayed responses, failing to provide timely warnings and handle risks, potentially leading to the escalation and spread of those risks. This is because traditional systems lack efficient processing and dynamic adjustment mechanisms for real-time data during rule adaptation and anomaly detection, making it impossible to quickly optimize audit rules and judgment criteria based on real-time data collection.

[0004] Traditional audit monitoring systems lack flexibility and adaptability in rule optimization and anomaly detection. When operational behavior patterns change or new risk types emerge, the system struggles to automatically adjust rules to adapt to the new situation, requiring manual intervention for rule updates and optimization. This not only increases labor costs but may also lead to untimely rule updates, impacting the effectiveness of audit monitoring. Furthermore, traditional systems often employ a single judgment method when determining the correlation between behavior and risk, failing to differentiate based on different operational stability states and learning adaptation strategies, resulting in low accuracy and reliability in risk identification.

[0005] Traditional systems have shortcomings in collaborative processing across multiple monitoring nodes. Data sharing and collaborative analysis capabilities between different monitoring nodes are weak, making it impossible to comprehensively assess the overall risk situation and prone to vulnerabilities. Furthermore, the processing of key indicators such as risk conversion ratios is not refined enough, and risk thresholds and behavioral constraints cannot be dynamically adjusted according to actual conditions, resulting in poor system adaptability and robustness. Summary of the Invention

[0006] The purpose of this invention is to provide an adaptive learning real-time audit and monitoring system to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides an adaptive learning real-time audit monitoring system, the system comprising: The data acquisition module is used to determine the operational stability of the audit object based on operational behavior characteristics. The pattern recognition module, which is connected to the data acquisition module, is used to determine the learning and adaptation strategy based on the operational stability of the audit object, and to determine the correlation between behavior and risk based on the rule matching degree under the corresponding learning and adaptation strategy. The rule adaptation module, which is connected to the pattern recognition module, is used to determine the judgment method of the rule optimization value based on the risk exposure rate under the condition of the corresponding learning adaptation strategy, and to determine the conformity of the rule optimization value based on the response lag in the recognition process. An anomaly detection module, which is connected to the rule adaptation module, is used to determine the conformity between behavior and risk based on the risk conversion ratio of each monitoring node under the condition of the corresponding learning and adaptation strategy. The system calibration module, which is connected to the rule adaptation module and the anomaly determination module, is used to determine the improvement optimization value based on the difference between the preset response lag and the actual response lag when the rule optimization value does not meet the requirements, and to determine the improvement behavior constraint based on the ratio of the risk conversion ratio to the preset conversion ratio when the behavior and risk do not meet the requirements, or to determine the risk reduction threshold based on the difference between the risk conversion ratio and the preset conversion ratio.

[0008] Preferably, the pattern recognition module determines that the operation of the audit object is stable based on the comparison result that the number of operation behavior features is less than the preset number of features, and determines that the more standardized the behavior is under the continuous learning adaptation strategy, the lower the risk based on the comparison result that the rule matching degree is greater than or equal to the preset matching degree. The rule optimization value is determined according to the comparison result of the risk exposure rate and the preset exposure rate.

[0009] Preferably, the pattern recognition module determines that the audit object's operation is unstable based on the comparison result of the operation behavior feature quantity being greater than or equal to the preset feature quantity, and determines that the more frequent the behavior is under the segmented learning adaptation strategy, the higher the risk, based on the comparison result of the rule matching degree being greater than or equal to the preset matching degree, and determines the rule optimization value based on the comparison result of the risk exposure rate and the preset exposure rate.

[0010] Preferably, under the condition of determining the rule optimization value, the rule adaptation module determines that the rule optimization value does not meet the requirements based on the comparison result that the response lag is greater than or equal to the preset lag, and determines to increase the optimization value with the first preset optimization adjustment coefficient based on the comparison result that the difference between the preset response lag and the actual response lag is less than or equal to the preset deviation.

[0011] Preferably, under the condition of determining the rule optimization value, the rule adaptation module determines that the rule optimization value does not meet the requirements based on the comparison result that the response lag is greater than or equal to the preset lag, and determines to improve the optimization value with the second preset optimization adjustment coefficient based on the comparison result that the difference between the preset response lag and the actual response lag is greater than the preset deviation.

[0012] Preferably, the system calibration module, under the condition that the corresponding learning and adaptation strategy is executed on the audit object, determines that the behavior does not conform to the risk based on the comparison result that the risk conversion ratio of each monitoring node is less than the preset conversion ratio, and determines to increase the behavior constraint with the first preset constraint adjustment coefficient based on the comparison result that the ratio of the risk conversion ratio to the preset conversion ratio is greater than or equal to the preset ratio.

[0013] Preferably, the system calibration module, under the condition that the corresponding learning and adaptation strategy is executed on the audit object, determines that the behavior does not conform to the risk based on the comparison result that the risk conversion ratio of each monitoring node is less than the preset conversion ratio, and determines to increase the behavior constraint with the second preset constraint adjustment coefficient based on the comparison result that the ratio of the risk conversion ratio to the preset conversion ratio is less than the preset proportion.

[0014] Preferably, the anomaly determination module, under the condition that the corresponding learning and adaptation strategy is executed on the audit object, determines that the behavior does not conform to the risk based on the comparison result that the risk conversion ratio of each monitoring node is less than the preset conversion ratio, and determines to reduce the risk threshold with the first preset threshold adjustment coefficient based on the comparison result that the difference between the risk conversion ratio and the preset conversion ratio is less than or equal to the preset difference.

[0015] Preferably, the anomaly determination module, under the condition that the corresponding learning and adaptation strategy is executed on the audit object, further includes: determining that the behavior does not conform to the risk based on the comparison result that the risk conversion ratio of each monitoring node is less than the preset conversion ratio, and determining to reduce the risk threshold with a second preset threshold adjustment coefficient based on the comparison result that the difference between the risk conversion ratio and the preset conversion ratio is greater than the preset difference.

[0016] Preferably, the system further includes an adaptive learning real-time audit monitoring method, which is applied to the aforementioned adaptive learning real-time audit monitoring system. The method includes the following steps: Step 1: Determine the operational stability of the audit object based on operational behavior characteristics using the data acquisition module; Step 2: Using the pattern recognition module connected to the data acquisition module, determine the learning adaptation strategy based on the operational stability of the audit object, and determine the correlation between behavior and risk based on the rule matching degree under the corresponding learning adaptation strategy; Step 3: Using the rule adaptation module connected to the pattern recognition module, under the condition of the corresponding learning adaptation strategy, determine the judgment method of the rule optimization value according to the risk exposure rate, and determine the conformity of the rule optimization value according to the response lag in the recognition process. Step 4: Using the anomaly detection module connected to the rule adaptation module, under the corresponding learning and adaptation strategy, determine the conformity between behavior and risk based on the risk conversion ratio of each monitoring node; Step 5: Using the system calibration module connected to the rule adaptation module and the anomaly judgment module, if the rule optimization value does not meet the requirements, determine the improvement optimization value based on the difference between the preset response lag and the actual response lag. If the behavior and risk do not meet the requirements, determine the improvement behavior constraint based on the ratio of the risk conversion ratio to the preset conversion ratio, or determine the reduction risk threshold based on the difference between the risk conversion ratio and the preset conversion ratio.

[0017] Compared with the prior art, the beneficial effects of the present invention are: The system accurately determines the operational stability of audit targets based on operational behavior characteristics through its data acquisition module, laying a solid foundation for subsequent learning and adaptation strategy selection and risk assessment. This stability judgment based on actual operational data can accurately capture changes in the behavioral patterns of audit targets, significantly improving the accuracy of operational behavior assessment compared to traditional fixed-rule methods.

[0018] The pattern recognition module is connected to the data acquisition module. It determines an appropriate learning and adaptation strategy based on the operational stability of the audited object and establishes the correlation between behavior and risk based on rule matching. When the operational behavior feature quantity is less than a preset feature quantity, the operation is considered stable, and a continuous learning and adaptation strategy is adopted, indicating that more standardized behavior corresponds to lower risk. When the operational behavior feature quantity is greater than or equal to the preset feature quantity, the operation is considered unstable, and a segmented learning and adaptation strategy is adopted, indicating that more frequent behavior corresponds to higher risk. This differentiated learning and adaptation strategy can dynamically adjust the risk assessment model according to different operational states, making risk assessment more closely aligned with actual operational situations and effectively improving the accuracy and relevance of risk identification.

[0019] The rule adaptation module, based on a corresponding learning and adaptation strategy, determines the method for judging the rule optimization value according to the risk exposure rate and uses the response lag to determine the compliance of the rule optimization value. When the response lag is greater than or equal to a preset lag, it can promptly detect cases where the rule optimization value does not comply, and adjust the optimization value using different adjustment coefficients based on the difference between the preset and actual response lag. This dynamic rule optimization mechanism ensures that audit rules can be updated and optimized in a timely manner according to actual operational data and risk exposure, greatly improving the system's real-time performance and adaptability, enabling the system to quickly respond to new risk types and changes in operational modes.

[0020] Under the corresponding learning and adaptation strategy, the anomaly detection module determines the conformity between behavior and risk based on the risk conversion ratio of each monitoring node. It then lowers the risk threshold using different threshold adjustment coefficients based on the difference between the risk conversion ratio and the preset conversion ratio. This anomaly detection method based on the risk conversion ratio of multiple monitoring nodes can comprehensively and holistically assess the overall risk situation, avoiding the limitations of single-node detection and greatly improving the accuracy and reliability of anomaly identification. Simultaneously, dynamically adjusting the risk threshold based on the difference allows the system to more flexibly adapt to different risk environments and operational scenarios.

[0021] The system calibration module is connected to the rule adaptation module and the anomaly detection module. When the rule optimization value does not meet the requirements, the system determines the improvement optimization value based on the difference between the preset response lag and the actual response lag. When the behavior does not match the risk, the system determines whether to increase the behavioral constraint or decrease the risk threshold based on the ratio or difference between the risk conversion ratio and the preset conversion ratio. This multi-dimensional system calibration mechanism enables dynamic optimization and adjustment of the overall system performance, ensuring that the system maintains its optimal operating state under various operating environments and risk scenarios, greatly improving the system's stability and robustness. Attached Figure Description

[0022] Figure 1 This is a schematic diagram illustrating the working principle of the adaptive learning real-time audit monitoring system described in this invention. Figure 2 A flowchart for pattern recognition during stable operation; Figure 3 A flowchart for the first adjustment when the rule optimization value does not meet the requirement; Figure 4 A flowchart for adjusting the second threshold when behavior does not conform to risk. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Please see Figures 1-4 This invention provides an adaptive learning real-time audit monitoring system, comprising a data acquisition module, a pattern recognition module, a rule adaptation module, an anomaly detection module, and a system calibration module. The specific implementation steps are as follows: The data acquisition module is used to determine the operational stability of an audited object based on operational behavior characteristics. Specifically, the data acquisition module collects various behavioral characteristics of the audited object in real time during the operation process. These characteristics include operation frequency, operation duration, accuracy of operation instructions, and degree of standardization in process execution. By comparing the collected operational behavior characteristics with preset characteristics, if the characteristics are less than the preset characteristics, the audited object is judged to be operationally stable; otherwise, it is judged to be operationally unstable, thus determining the operational stability of the audited object.

[0025] The pattern recognition module is connected to the data acquisition module to determine the learning and adaptation strategy based on the operational stability of the audit object. It then determines the correlation between behavior and risk based on the rule matching degree under the corresponding learning and adaptation strategy. The pattern recognition module receives the operational stability results output by the data acquisition module. When the operation is stable, a continuous learning and adaptation strategy is used; when the operation is unstable, a segmented learning and adaptation strategy is used. Simultaneously, it calculates the degree of matching between the operational behavior and preset rules under this strategy, i.e., the rule matching degree. The correlation between behavior and risk is determined based on the rule matching degree. For example, under the continuous learning and adaptation strategy, a higher rule matching degree indicates more standardized behavior and lower risk; under the segmented learning and adaptation strategy, although the rule matching degree meets the standard, more frequent behavior indicates higher risk.

[0026] The rule adaptation module is connected to the pattern recognition module. Based on the corresponding learning and adaptation strategy, it determines the method for judging the rule optimization value according to the risk exposure rate, and determines the compliance of the rule optimization value based on the response lag during the recognition process. After determining the learning and adaptation strategy, the rule adaptation module combines the risk exposure rate (i.e., the probability of risk occurring within a certain period) and determines the method for judging the rule optimization value based on the comparison between the risk exposure rate and the preset exposure rate. Simultaneously, the rule adaptation module monitors the response lag during the recognition process and determines whether the rule optimization value meets the requirements by comparing the response lag with the preset lag.

[0027] The anomaly detection module is connected to the rule adaptation module. Based on the corresponding learning and adaptation strategy, it determines the compliance of behavior with risk according to the risk conversion ratio (the ratio of the number of actual risk events to the number of potential risk points) of each monitoring node. Under the corresponding learning and adaptation strategy, the anomaly detection module collects the risk conversion ratio of each monitoring node, compares it with the preset conversion ratio, and thus determines whether the behavior of the audited object complies with the risk.

[0028] The system calibration module is connected to the rule adaptation module and the anomaly detection module, receiving results from each respectively. Based on the condition that the rule optimization value is not met, it determines the improvement value based on the difference between the preset response lag and the actual response lag. Based on the condition that the behavior and risk are not met, it determines the improvement of behavioral constraints based on the ratio of the risk conversion ratio to the preset conversion ratio, or determines the reduction of the risk threshold based on the difference between the risk conversion ratio and the preset conversion ratio. When the rule adaptation module determines that the rule optimization value is not met, the system calibration module calculates the difference between the preset response lag and the actual response lag, and determines the magnitude of the improvement in the optimization value based on this difference. When the anomaly detection module determines that the behavior and risk are not met, the system calibration module determines whether to improve the behavioral constraints or reduce the risk threshold, and the specific magnitude of improvement or reduction, based on the ratio or difference between the risk conversion ratio and the preset conversion ratio, thereby achieving dynamic system calibration.

[0029] Example 1: In this embodiment, the pattern recognition module determines that the audit object's operation is stable based on the comparison results of operational behavior feature quantities being less than preset feature quantities. The data acquisition module continuously collects various behavioral feature quantities of the audit object in real time during the operation process. These feature quantities cover multiple dimensions, such as operation accuracy indicators, like the number of incorrect input commands and the deviation range of operation parameter settings; operation interval time, i.e., the time span between two adjacent operations; and operation process standardization indicators, such as whether the operation is executed according to the established operation steps sequence. After collecting this data, the data acquisition module compares each operational behavior feature quantity with a preset corresponding feature quantity threshold one by one. When the values ​​of all collected operational behavior feature quantities are less than their respective preset feature quantity thresholds, it indicates that the audit object exhibits a relatively stable operation mode during the operation process, with small fluctuations in operation. At this time, the pattern recognition module determines that the audit object is in a stable operation state.

[0030] The pattern recognition module determines that under the continuous learning adaptation strategy, more standardized behavior indicates lower risk, based on comparison results where the rule matching degree is greater than or equal to a preset matching degree. Once the audit object's operation is determined to be stable, the system automatically adopts the continuous learning adaptation strategy. Under this strategy, the system continuously accumulates operational behavior data of the audit object, forming a dynamically updated behavior database. Simultaneously, the system matches the currently collected operational behavior data with rules in the existing rule base, which contains various standard rules set for different operational scenarios and behavioral patterns. The pattern recognition module calculates the degree of matching between the current operational behavior and the rules in the rule base, i.e., the rule matching degree. When the rule matching degree reaches or exceeds the preset matching degree standard, it indicates that the audit object's operational behavior has a high degree of conformity with the standard rules and the behavior is relatively standardized.

[0031] To determine the correlation between behavior and risk, the pattern recognition module analyzes historical data to extract the risk occurrence corresponding to different levels of behavioral compliance under conditions of high rule matching. By establishing a correlation model between behavioral compliance and risk level, the pattern recognition module found that under a continuous learning and adaptation strategy, the probability of risk occurrence shows a significant downward trend as the auditee's behavioral compliance increases. For example, when an auditee consistently operates according to standard rules in the rule base, and its rule matching degree remains at a high level, the number of risk events caused by this auditee during subsequent monitoring is significantly less than when the rule matching degree is low. Therefore, the pattern recognition module concludes that under a continuous learning and adaptation strategy, more standardized behavior corresponds to lower risk.

[0032] The pattern recognition module determines the optimized rule value based on a comparison between the risk exposure rate and the preset exposure rate. The risk exposure rate refers to the probability that the auditee's actions may lead to a risk occurring within a certain time period. The pattern recognition module collects the auditee's operational data in real time and calculates the current risk exposure rate by combining historical risk data and the current operating environment. Simultaneously, the system presets a reasonable risk exposure rate threshold, i.e., the preset exposure rate, which is set based on a comprehensive consideration of industry standards, historical experience, and the system's risk tolerance.

[0033] The pattern recognition module compares the real-time calculated risk exposure rate with a preset exposure rate. If the risk exposure rate is lower than the preset exposure rate, it indicates that the current rules are effectively controlling the risk to a certain extent, keeping the risk from the audited entity's actions within an acceptable range. However, to further improve the system's risk control capabilities, the pattern recognition module determines an optimized rule value based on the difference between the risk exposure rate and the preset exposure rate, as well as the preset calculation rules. This could be achieved by multiplying by a fixed coefficient or by determining the optimized value based on the range of the difference. Determining the optimized rule value provides a basis for subsequent adjustments and optimizations to the system rules, enabling the system to better adapt to the audited entity's actions and further reduce the risk exposure rate.

[0034] Throughout the process, the pattern recognition module continuously collects, compares, analyzes, and calculates data to ensure timely and accurate determination of the operational stability, the correlation between behavior and risk, and the rule optimization value of the audited object. This enables the system to achieve adaptive learning and real-time audit monitoring. For example, when the operational behavior of the audited object undergoes slight changes, the data collection module can promptly capture these changes and transmit them to the pattern recognition module. The pattern recognition module will then re-perform the operational stability assessment, rule matching degree calculation, and risk exposure rate analysis to determine whether the learning adaptation strategy and rule optimization value need to be adjusted. This ensures that the system can always effectively monitor and control the operational behavior of the audited object.

[0035] Example 2: In this embodiment, the pattern recognition module determines that the audit object's operation is unstable based on the comparison results of operation behavior feature quantities being greater than or equal to preset feature quantities. During operation, the data acquisition module continuously monitors the audit object's operation behavior in real time, collecting feature quantity data including operation frequency, operation error rate, and operation process deviation. For example, operation frequency records the number of times the audit object performs an operation per unit time; the operation error rate calculates the probability of errors occurring during the operation; and the operation process deviation measures whether the audit object performs the operation according to the prescribed steps. After collection, the data acquisition module compares these feature quantities with their respective preset feature quantity thresholds. When the value of any one or more operation behavior feature quantities reaches or exceeds the corresponding preset feature quantity threshold, such as a sudden and significant increase in operation frequency exceeding the frequency threshold under normal working conditions, or a substantial increase in operation error rate exceeding the allowable range, the pattern recognition module determines that the audit object's operation is currently in an unstable state, indicating that its operation behavior may be abnormal or have potential risks.

[0036] The pattern recognition module determines that, based on comparison results where the rule matching degree is greater than or equal to a preset matching degree, more frequent behavior carries higher risk under the segmented learning adaptation strategy. Once the system determines that the audited object's operation is unstable, it automatically switches to the segmented learning adaptation strategy. This strategy divides the audited object's operation process into different stages, such as the initial operation stage, high-frequency operation stage, and abnormal operation stage, each with different operational characteristics and risk features. For each stage, the pattern recognition module matches the collected operational behavior data with rules in the rule base, which stores different rules set for each stage. The rule matching degree is obtained by calculating the degree of matching between the operational behavior and the corresponding rule for each stage. When the rule matching degree reaches or exceeds the preset matching degree standard, it indicates that the audited object's operational behavior in that stage has a certain degree of fit with the corresponding rule; however, due to operational instability, further analysis of the relationship between behavior and risk is required.

[0037] Under the segmented learning adaptation strategy, the pattern recognition module conducts detailed analysis of operational behavior data at each stage, especially focusing on the key indicator of operation frequency. Through statistical analysis and mining of historical data, it was discovered that the higher the operation frequency of the auditee at a certain stage, the greater the probability of the corresponding risk event occurring. For example, in high-frequency operation stages, the auditee may neglect operational standardization in pursuit of efficiency, leading to an increased error rate and thus increasing the probability of risk occurrence. The pattern recognition module establishes a correlation model between operation frequency and risk level, training and validating it on a large amount of historical data, ultimately determining that under the segmented learning adaptation strategy, more frequent behavior corresponds to higher risk.

[0038] The pattern recognition module determines the rule optimization value based on the comparison between the risk exposure rate and the preset exposure rate. The risk exposure rate is the probability that an operational action may lead to a risk, calculated by comprehensively considering factors such as the auditee's operational behavior, historical risk data, and the current operating environment. The module processes the collected operational data and related risk data in real time to obtain the current risk exposure rate. The preset exposure rate is a risk exposure threshold pre-set by the system based on industry standards, historical experience, and its own risk tolerance, used to measure whether the current risk exposure level is within an acceptable range.

[0039] The pattern recognition module compares the real-time calculated risk exposure rate with the preset exposure rate. If the risk exposure rate is higher than the preset rate, it indicates that the current rules may not be effective in addressing the risks arising from the unstable operations of the audited entity, causing the risk exposure level to exceed the system's expectations and tolerance. In this case, the pattern recognition module needs to determine the rule optimization value based on the difference between the risk exposure rate and the preset exposure rate, as well as the preset calculation rules. This can be done using a function based on the magnitude of the difference, or by setting different optimization value calculation methods based on different intervals of the difference. By determining the rule optimization value, direction is provided for subsequent adjustments and optimizations to the system rules, enabling the adjusted rules to better adapt to the unstable operational states of the audited entity, effectively reducing the risk exposure rate and keeping the risk within an acceptable range.

[0040] Throughout the process, the pattern recognition module continuously monitors, analyzes, and evaluates the operational behavior of the audited entity. When the operational behavior of the audited entity changes between different stages, the data acquisition module promptly captures these changes and transmits the new data to the pattern recognition module. The pattern recognition module then re-divides the operational stages, calculates the rule matching degree of each stage, analyzes the relationship between operational frequency and risk, and calculates the risk exposure rate to determine whether the segmented learning adaptation strategy and rule optimization values ​​need to be adjusted. For example, when the audited entity moves from a high-frequency operation stage to an abnormal operation stage, the pattern recognition module re-assesses operational stability based on the new operational characteristics, adjusts the stage division, recalculates the rule matching degree and risk exposure rate, and determines new rule optimization values ​​accordingly. This ensures that the system can monitor and control the operational behavior of the audited entity in real time and accurately, achieving adaptive learning functionality.

[0041] Example 3: In this embodiment, the rule adaptation module, after determining the rule optimization value, determines that the rule optimization value is not conforming based on the comparison result of the response lag being greater than or equal to a preset lag. Once the pattern recognition module determines the rule optimization value based on the comparison result of the risk exposure rate and the preset exposure rate, the rule adaptation module will initiate monitoring of the system response process. The response lag refers to the time interval between the system issuing a rule optimization command and the command actually taking effect and generating a detectable response. This time interval encompasses the time consumed by multiple stages such as command transmission, system processing, and rule updates. The rule adaptation module pre-stores a preset lag value, comprehensively set based on system hardware performance, software processing efficiency, and industry-standard response criteria, as a benchmark for judging whether the response is timely.

[0042] During the system's rule optimization process, the rule adaptation module records the actual time from issuing the optimization command to the system's response in real time, obtaining the actual response lag. Then, the actual response lag is compared with a preset lag. If the actual response lag reaches or exceeds the preset lag, it indicates a significant delay in the system's rule optimization execution. This delay may prevent the system from responding promptly to the audited entity's actions, thus affecting the effectiveness of the entire audit monitoring system. In this case, the rule adaptation module determines that the rule optimization value does not meet the system's requirements and needs to be adjusted.

[0043] Then, the rule adaptation module determines the optimization value to be increased by a first preset optimization adjustment coefficient based on the comparison results where the difference between the preset response lag and the actual response lag is less than or equal to the preset deviation. The preset deviation is a threshold pre-set in the rule adaptation module to measure the degree of deviation in the response lag. It comprehensively considers the slight delays that may occur during normal system operation and the basic requirements for response speed. The rule adaptation module first calculates the difference between the preset response lag and the actual response lag, and uses this difference to measure the degree of system response lag.

[0044] When the calculated difference is less than or equal to the preset deviation, it indicates that the system response lag is relatively small and falls within an acceptable range of slight delay. In this case, the overall system performance is only slightly affected, but some optimization is still needed to prevent further delay. At this point, the rule adaptation module selects a first preset optimization adjustment coefficient from a set of pre-defined adjustment coefficients. This coefficient is a relatively small adjustment parameter used to increase the rule optimization value. For example, it can add the rule optimization value to the product of the rule optimization value and the first preset optimization adjustment coefficient, or it can incrementally adjust the rule optimization value according to the proportion of the first preset optimization adjustment coefficient.

[0045] By increasing the rule optimization value with a first preset optimization adjustment coefficient, the system's response speed can be gradually improved while ensuring stable system operation. For example, when the rule optimization value is increased, the system may prioritize allocating more computing resources or adjusting the priority of instruction processing when processing the next rule optimization instruction, thereby shortening the response lag. During this process, the rule adaptation module continuously monitors changes in the response lag. Once it detects that the response lag has decreased below the preset lag value, or the difference exceeds the preset deviation, it will stop the current optimization adjustment method or switch to other optimization strategies.

[0046] Throughout the implementation process, the rule adaptation module needs to interact and collaborate with other modules such as the pattern recognition module and the system calibration module. For example, the rule adaptation module needs to obtain relevant information about the rule optimization values ​​from the pattern recognition module, and simultaneously feed back the monitoring results of the response lag and the adjustment status of the rule optimization values ​​to the system calibration module, so that the system calibration module can make further calibration decisions based on the overall system operating status. In addition, the rule adaptation module also needs to continuously update and optimize its own preset lag, preset deviation, and first preset optimization adjustment coefficient, etc., to adapt to different audit monitoring scenarios and changes in the system operating environment.

[0047] For example, when the system faces complex audit object operations or large amounts of data processing tasks, the rule adaptation module may adjust the preset lag amount reasonably based on the actual operating conditions to avoid frequent judgments that the rule optimization value does not meet the requirements due to an overly strict preset lag amount setting. Simultaneously, the rule adaptation module analyzes historical data to summarize the changing patterns of response lag amount under different scenarios, thereby more accurately setting the preset deviation and selecting the first preset optimization adjustment coefficient, improving the effectiveness of rule optimization value adjustment and the system's adaptability.

[0048] Example 4: In this embodiment, the rule adaptation module determines that the rule optimization value is not valid based on a comparison result where the response lag is greater than or equal to a preset lag value, provided that the rule optimization value is determined. After the pattern recognition module generates the rule optimization value based on the comparison result between the risk exposure rate and the preset exposure rate, the rule adaptation module begins monitoring the system's response process for executing the optimization value. The response lag value refers to the time interval from when the system issues a rule optimization instruction to when the rule update is actually completed and a valid response is generated. This time includes the time consumed by multiple stages such as instruction transmission, database query, and rule compilation. The rule adaptation module presets a lag value based on system hardware configuration, software processing efficiency, and industry standards. For example, when the system is running normally, the preset lag value may be set to 500 milliseconds to determine whether the response is timely.

[0049] During the execution of rule optimization instructions, the rule adaptation module records the actual response time in real time to obtain the actual response lag. If the actual response lag reaches or exceeds the preset lag, for example, if the actual time is 600 milliseconds but exceeds the preset 500 milliseconds, the rule adaptation module determines that the current rule optimization value does not meet the requirements. This is because an excessively long response lag may prevent the system from responding promptly to abnormal operations of the audited object. For example, when the audited object suddenly exhibits high-frequency operations, the system may fail to update the risk control rules in time due to response delays, potentially missing the optimal opportunity for risk warning.

[0050] Next, the rule adaptation module determines the optimization value to be increased by a second preset optimization adjustment coefficient based on the comparison result where the difference between the preset response lag and the actual response lag is greater than the preset deviation. The preset deviation is a threshold set in the rule adaptation module to measure the degree of response latency; for example, the preset deviation might be 100 milliseconds. The rule adaptation module first calculates the difference between the preset response lag and the actual response lag. If the difference is greater than the preset deviation (e.g., the preset lag is 500 milliseconds, the actual lag is 700 milliseconds, and the difference of 200 milliseconds is greater than the preset deviation of 100 milliseconds), it indicates that the system response latency problem is relatively serious. This may be due to the high complexity of the rule optimization instructions or the current system load being too high, resulting in a significant decrease in processing efficiency.

[0051] At this point, the rule adaptation module will activate a second preset optimization adjustment coefficient to increase the rule optimization value. The second preset optimization adjustment coefficient is a larger adjustment parameter than the first preset optimization adjustment coefficient; for example, if the first preset coefficient is 1.2, the second preset coefficient might be 1.8. The specific way to increase the rule optimization value can be by multiplying the original rule optimization value by the second preset optimization adjustment coefficient, or by increasing it incrementally according to a fixed step size corresponding to that coefficient. For example, if the original rule optimization value is 100, multiplying it by 1.8 yields 180. The new rule optimization value will be used to adjust the system's rule processing logic, such as increasing the priority of rule matching or optimizing the database index structure, to speed up the response time for the next rule update.

[0052] For a concrete example, suppose the audit target is a bank's fund transfer system. When the system detects that an account has initiated multiple large transfers within a short period, the pattern recognition module determines a rule optimization value based on operational behavior characteristics (such as transfer frequency and amount) to enhance monitoring of abnormal transfers. When the rule adaptation module executes this optimization value, if it finds that the response latency is 800 milliseconds, while the preset latency is 500 milliseconds and the preset deviation is 150 milliseconds, and the difference of 300 milliseconds is greater than the preset deviation, the rule adaptation module increases the rule optimization value by a second preset optimization adjustment coefficient of 2.0. After adjustment, the system will prioritize processing rule matching requests for large transfers, optimize database query statements, and shorten the response latency of subsequent similar operations to 450 milliseconds, meeting the preset latency requirement.

[0053] Throughout the process, the rule adaptation module needs to continuously interact with data from other modules. For example, it obtains the basis and specific parameters for generating rule optimization values ​​from the pattern recognition module, and reports any abnormalities in response lag to the system calibration module so that the system calibration module can make comprehensive adjustments based on the risk conversion ratio of other monitoring nodes. Simultaneously, the rule adaptation module records historical data for each adjustment and analyzes the changing patterns of response lag under different scenarios. For instance, response lag typically increases during peak business periods (such as the end of the month or holidays), at which point the rule adaptation module may adjust the preset lag or optimize the adjustment coefficient in advance to adapt to changes in system load.

[0054] In addition, the rule adaptation module dynamically optimizes the preset lag and preset deviation based on actual operating conditions. For example, when the system hardware is upgraded and the processing speed is improved, the rule adaptation module will reduce the preset lag accordingly to improve the system's response sensitivity. If it is found that the execution complexity of certain rule optimization instructions is high, resulting in frequent response delays, the rule adaptation module will adjust the processing priority of such instructions or optimize the algorithm logic of the instructions to fundamentally reduce the response lag.

[0055] Through this mechanism, the system can make precise adjustments using different optimization adjustment coefficients based on the specific degree of deviation of the response lag when the rule optimization value does not meet the requirements. This avoids over-adjustment when there is only slight delay and can quickly improve the rule optimization value when there is severe delay, ensuring that the system always maintains high response efficiency and achieves real-time monitoring and risk control of the audited object's operation behavior.

[0056] Example 5: In this embodiment, the system calibration module, after determining that an appropriate learning and adaptation strategy will be implemented for the audited object, determines that the behavior does not conform to the risk based on the comparison results where the risk conversion ratio of each monitoring node is less than the preset conversion ratio. Taking a company's financial reimbursement system as an example, the audited object is the employee who submits reimbursement applications within the system, and the monitoring nodes include reimbursement amount entry, invoice verification, approval process, etc. The system calibration module collects the risk conversion ratio of each monitoring node in real time, which is the ratio of the number of actual risk events to the number of potential risk points. The preset conversion ratio is set according to the company's historical reimbursement data and risk control standards. For example, a preset conversion ratio of 5% means that no more than 5 out of every 100 potential risk points are allowed to be converted into actual risk events.

[0057] When the risk conversion ratio of a monitoring node is lower than the preset conversion ratio, such as a 3% risk conversion ratio for the reimbursement amount entry node, the system calibration module determines that the node's behavior does not meet the risk criteria. This may mean that the current risk control rules are too strict, increasing the probability that normal operations are misjudged as risky behavior, or that the risk threshold is set unreasonably, failing to accurately identify actual risks.

[0058] Next, the system calibration module determines to increase the behavioral constraint using a first preset constraint adjustment coefficient based on the comparison results where the ratio of the risk conversion ratio to the preset conversion ratio is greater than or equal to a preset proportion. The preset proportion is a benchmark value set within the system to judge the degree of deviation of the risk conversion ratio, for example, a preset proportion of 80%. The ratio of the risk conversion ratio to the preset conversion ratio is calculated. If the ratio is greater than or equal to the preset proportion, such as the ratio of a risk conversion ratio of 3% to a preset conversion ratio of 5% being 60% and less than 80%, the condition is not triggered; if the risk conversion ratio is 4.5% and the ratio is 90%, which is greater than or equal to 80%, the system calibration module will use the first preset constraint adjustment coefficient (e.g., 1.2) to increase the behavioral constraint.

[0059] Specific ways to enhance behavioral constraints include adding verification steps to the auditee's operations. For example, in the expense reimbursement entry process, employees could be required to upload more supporting documentation or a dual-review mechanism could be introduced. In this way, while ensuring risk control, the auditee's operational behavior can be standardized, reducing the risk of non-compliance leading to adverse outcomes.

[0060] Meanwhile, the anomaly detection module, after determining that the corresponding learning and adaptation strategy has been implemented for the audited object, determines that the behavior does not conform to the risk based on the comparison results of the risk conversion ratio of each monitoring node being less than the preset conversion ratio. Taking the financial reimbursement system as an example, if the risk conversion ratio of the invoice verification node is 2%, which is less than the preset conversion ratio of 5%, the anomaly detection module determines that the behavior of this node does not conform to the risk. This indicates that the current risk identification rules may not have accurately captured the actual risk point, or the risk threshold may have been set too high, resulting in untimely risk warnings.

[0061] The anomaly detection module determines the risk threshold by adjusting a first preset threshold coefficient based on the comparison results where the difference between the risk conversion ratio and the preset conversion ratio is less than or equal to a preset difference. The difference is an indicator that measures the degree of deviation between the risk conversion ratio and the preset conversion ratio, for example, by calculating the percentage of the difference to the preset conversion ratio. The preset difference is 20%. If the difference between a risk conversion ratio of 2% and a preset conversion ratio of 5% is 60%, which is greater than 20%, this condition is not triggered. If the risk conversion ratio is 4% and the difference is 20%, which is equal to the preset difference, the anomaly detection module will use the first preset threshold adjustment coefficient (e.g., 0.8) to lower the risk threshold.

[0062] Lowering the risk threshold involves adjusting the system's criteria for judging risk events. For example, in the invoice verification process, instead of only identifying invoices with an amount exceeding 10,000 yuan as high-risk, the system can now identify invoices with an amount exceeding 8,000 yuan as high-risk, thereby increasing the system's sensitivity to risk and enabling timely detection of potential risk events.

[0063] Furthermore, when the system calibration module determines to implement the appropriate learning and adaptation strategy for the audited object, if the ratio of the risk conversion ratio to the preset conversion ratio is less than the preset proportion (e.g., if the risk conversion ratio is 2%, the ratio is 40%, which is less than 80%), the system calibration module will increase the behavioral constraints with a second preset constraint adjustment coefficient (e.g., 1.5). This means that the operational behavior of the audited object needs to be more strictly regulated. For example, in the expense reimbursement approval process, approval levels may be increased or approval time may be extended to ensure that each expense reimbursement application undergoes more rigorous review and reduce the possibility of risk conversion.

[0064] Under the condition that the corresponding learning and adaptation strategy is executed on the audit object, if the difference between the risk conversion ratio and the preset conversion ratio is greater than the preset difference (e.g., the risk conversion ratio is 1%, the difference is 80%, which is greater than 20%), the anomaly detection module will lower the risk threshold by a second preset threshold adjustment coefficient (e.g., 0.6). For example, the high-risk amount threshold in the invoice verification process can be lowered from 10,000 yuan to 5,000 yuan, enabling the system to issue risk warnings earlier and prevent potential risky behaviors in a timely manner.

[0065] For example, when an employee submits a travel expense reimbursement request of 8,000 yuan in the financial reimbursement system, the system finds during the invoice verification process that the invoice issuance date and the reimbursement date are more than 6 months apart. According to the original risk threshold setting, the amount does not exceed 10,000 yuan and is not considered a high-risk event. However, because the anomaly detection module has lowered the risk threshold to 5,000 yuan, the reimbursement request is marked as high-risk. The system automatically triggers a dual-review mechanism, which, upon review, reveals that the invoice is a duplicate reimbursement, thus preventing the risk event from occurring.

[0066] Throughout the process, the system calibration module and the anomaly detection module need to exchange data in real time, sharing information such as the risk conversion ratio, preset conversion ratio, and degree of difference for each monitoring node to ensure the consistency and effectiveness of the adjustment strategy. Simultaneously, the system records historical data for each adjustment, analyzing the impact of different adjustment strategies on risk control effectiveness. For example, it analyzes whether the risk conversion ratio of monitoring nodes tends to be reasonable after increasing behavioral constraints, and whether the false alarm rate of the system is within an acceptable range after lowering the risk threshold.

[0067] Through this dynamic adjustment mechanism, the system can accurately increase behavioral constraints or decrease risk thresholds based on the risk transformation of each monitoring node. This avoids both the inefficiency caused by overly strict risk control and the occurrence of risk events caused by overly lax risk control, thus achieving adaptive monitoring and risk control of the audited entity's operational behavior.

[0068] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0069] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A real-time audit monitoring system with adaptive learning, characterized in that, include: The data acquisition module is used to determine the operational stability of the audit object based on operational behavior characteristics. The pattern recognition module, which is connected to the data acquisition module, is used to determine the learning and adaptation strategy based on the operational stability of the audit object, and to determine the correlation between behavior and risk based on the rule matching degree under the corresponding learning and adaptation strategy. The rule adaptation module, which is connected to the pattern recognition module, is used to determine the judgment method of the rule optimization value based on the risk exposure rate under the condition of the corresponding learning adaptation strategy, and to determine the conformity of the rule optimization value based on the response lag in the recognition process. An anomaly detection module, which is connected to the rule adaptation module, is used to determine the conformity between behavior and risk based on the risk conversion ratio of each monitoring node under the corresponding learning and adaptation strategy. The system calibration module, which is connected to the rule adaptation module and the anomaly determination module, is used to determine the improvement optimization value based on the difference between the preset response lag and the actual response lag when the rule optimization value does not meet the requirements, and to determine the improvement behavior constraint based on the ratio of the risk conversion ratio to the preset conversion ratio when the behavior and risk do not meet the requirements, or to determine the risk reduction threshold based on the difference between the risk conversion ratio and the preset conversion ratio.

2. The adaptive learning real-time audit monitoring system according to claim 1, characterized in that, The pattern recognition module determines that the operation of the audit object is stable based on the comparison result that the number of operation behavior features is less than the preset number of features, and determines that the more standardized the behavior is under the continuous learning adaptation strategy, the lower the risk based on the comparison result that the rule matching degree is greater than or equal to the preset matching degree. The rule optimization value is determined based on the comparison result of the risk exposure rate and the preset exposure rate.

3. The adaptive learning real-time audit monitoring system according to claim 1, characterized in that, The pattern recognition module determines that the audit object's operation is unstable based on the comparison result of the operation behavior feature quantity being greater than or equal to the preset feature quantity, and determines that the more frequent the behavior is under the segmented learning adaptation strategy, the higher the risk, based on the comparison result of the rule matching degree being greater than or equal to the preset matching degree. The rule optimization value is determined based on the comparison result of the risk exposure rate and the preset exposure rate.

4. The adaptive learning real-time audit monitoring system according to claim 3, characterized in that, Under the condition of determining the rule optimization value, the rule adaptation module determines that the rule optimization value does not meet the requirements based on the comparison result that the response lag is greater than or equal to the preset lag. It then determines to increase the optimization value with the first preset optimization adjustment coefficient based on the comparison result that the difference between the preset response lag and the actual response lag is less than or equal to the preset deviation.

5. The adaptive learning real-time audit monitoring system according to claim 3, characterized in that, Under the condition of determining the rule optimization value, the rule adaptation module determines that the rule optimization value does not meet the requirements based on the comparison result that the response lag is greater than or equal to the preset lag. It then determines to increase the optimization value with the second preset optimization adjustment coefficient based on the comparison result that the difference between the preset response lag and the actual response lag is greater than the preset deviation.

6. The adaptive learning real-time audit monitoring system according to claim 5, characterized in that, Under the condition that the system calibration module determines that the corresponding learning and adaptation strategy is to be implemented on the audit object, it determines that the behavior does not conform to the risk based on the comparison result that the risk conversion ratio of each monitoring node is less than the preset conversion ratio, and determines to increase the behavior constraint with the first preset constraint adjustment coefficient based on the comparison result that the ratio of the risk conversion ratio to the preset conversion ratio is greater than or equal to the preset ratio.

7. The adaptive learning real-time audit monitoring system according to claim 6, characterized in that, Under the condition that the system calibration module determines that the corresponding learning and adaptation strategy is to be implemented on the audit object, it determines that the behavior does not conform to the risk based on the comparison result that the risk conversion ratio of each monitoring node is less than the preset conversion ratio, and determines to increase the behavior constraint with the second preset constraint adjustment coefficient based on the comparison result that the ratio of the risk conversion ratio to the preset conversion ratio is less than the preset proportion.

8. The adaptive learning real-time audit monitoring system according to claim 7, characterized in that, Under the condition that the corresponding learning and adaptation strategy is executed on the audit object, the anomaly determination module determines that the behavior does not conform to the risk based on the comparison result that the risk conversion ratio of each monitoring node is less than the preset conversion ratio, and determines to reduce the risk threshold with the first preset threshold adjustment coefficient based on the comparison result that the difference between the risk conversion ratio and the preset conversion ratio is less than or equal to the preset difference.

9. The adaptive learning real-time audit monitoring system according to claim 8, characterized in that, The anomaly determination module, under the condition that the corresponding learning and adaptation strategy is executed on the audit object, further includes: determining that the behavior does not conform to the risk based on the comparison result that the risk conversion ratio of each monitoring node is less than the preset conversion ratio, and determining to reduce the risk threshold with the second preset threshold adjustment coefficient based on the comparison result that the difference between the risk conversion ratio and the preset conversion ratio is greater than the preset difference.

10. An adaptive learning-based real-time audit monitoring method, applied to an adaptive learning-based real-time audit monitoring system as described in any one of claims 1 to 9, characterized in that, Includes the following steps: Step 1: Determine the operational stability of the audit object based on operational behavior characteristics using the data acquisition module; Step 2: Using the pattern recognition module connected to the data acquisition module, determine the learning adaptation strategy based on the operational stability of the audit object, and determine the correlation between behavior and risk based on the rule matching degree under the corresponding learning adaptation strategy; Step 3: Using the rule adaptation module connected to the pattern recognition module, under the condition of the corresponding learning adaptation strategy, determine the judgment method of the rule optimization value according to the risk exposure rate, and determine the conformity of the rule optimization value according to the response lag in the recognition process. Step 4: Using the anomaly detection module connected to the rule adaptation module, under the corresponding learning and adaptation strategy, determine the conformity between behavior and risk based on the risk conversion ratio of each monitoring node; Step 5: Using the system calibration module connected to the rule adaptation module and the anomaly judgment module, if the rule optimization value does not meet the requirements, determine the improvement optimization value based on the difference between the preset response lag and the actual response lag. If the behavior and risk do not meet the requirements, determine the improvement behavior constraint based on the ratio of the risk conversion ratio to the preset conversion ratio, or determine the reduction risk threshold based on the difference between the risk conversion ratio and the preset conversion ratio.

Images