A monitoring device and method for auditing system

Abstract

The present invention discloses a monitoring device and method for use in an audit system, and relates to the technical field of audit systems. The device includes: a stream processing engine that uses a stream processing algorithm to perform logical processing on multiple data streams to obtain multiple logically processed data streams; a complex event processing module that compares the multiple logically processed data streams with multiple complex event templates. When there is a data segment in the multiple logically processed data streams that is consistent with any complex event template, the data segment that matches the complex event template is determined to be a pending data segment; and an audit rule model module that is used to input the pending data segment into the audit rule model to obtain an abnormality determination result. The audit rule model is obtained by training a machine learning model using multiple historical data segments of the audit system that are marked with abnormality determination results. By setting an audit rule model and a complex event processing module, the present invention can monitor the audit system in real time and improve audit efficiency and accuracy.

Description

Technical Field

[0001] The present invention relates to the technical field of audit systems, and in particular to a monitoring device and method applied to an audit system. Background Art

[0002] Current audit systems are primarily batch-processing-based, with data collection and analysis performed within a specific timeframe. This results in delayed audit results and potential data omissions. Existing technologies also lack the ability to instantly audit and monitor real-time transactions, and can face performance bottlenecks when processing large amounts of data, leading to inefficient audits. Summary of the Invention

[0003] The purpose of the present invention is to provide a monitoring device and method for an audit system, which can monitor the audit system in real time and improve audit efficiency and accuracy.

[0004] To achieve the above object, the present invention provides the following solutions:

[0005] A monitoring device applied to an audit system, wherein the monitoring device is applied to an audit system and comprises:

[0006] The data acquisition module, stream processing engine, complex event processing module, and audit rule model module are connected in sequence;

[0007] The data acquisition module is used to obtain multiple data streams of the audit system;

[0008] The stream processing engine is used to perform logical processing on multiple data streams using a stream processing algorithm to obtain multiple logically processed data streams;

[0009] The complex event processing module is used to store multiple complex event templates and compare multiple logically processed data streams with the multiple complex event templates respectively. When a data segment in the multiple logically processed data streams is consistent with any complex event template, the data segment matching the complex event template is determined as a pending data segment.

[0010] The audit rule model module is used to carry the audit rule model and input the pending data segment into the audit rule model to obtain the abnormal judgment result; the audit rule model is obtained by training the machine learning model using multiple historical data segments of the audit system marked with abnormal judgment results.

[0011] Optionally, the monitoring device further includes:

[0012] User interface module;

[0013] The user interface module is connected to the data acquisition module, the stream processing engine, the complex event processing module and the audit rule model module respectively;

[0014] The user interface module is used to display multiple data streams of the audit system, multiple logically processed data streams, pending data segments, complex event types corresponding to the pending data segments, and abnormality determination results of the pending data segments.

[0015] Optionally, the machine learning model is a standardized scoring model, an isolation forest model, or a deep learning model.

[0016] A monitoring method applied to an audit system, the monitoring method applying the monitoring device applied to the audit system, the monitoring method comprising:

[0017] Obtain multiple data streams from the audit system;

[0018] Utilize stream processing algorithms to perform logical processing on multiple data streams to obtain multiple logically processed data streams;

[0019] Comparing the multiple logically processed data streams with the multiple complex event templates respectively, and when a data segment in the multiple logically processed data streams is consistent with any complex event template, determining the data segment matching the complex event template as a pending data segment;

[0020] The pending data segment is input into the audit rule model to obtain an abnormality determination result; the audit rule model is obtained by training a machine learning model using multiple historical data segments of the audit system marked with abnormality determination results.

[0021] Optionally, the machine learning model is a standardized scoring model, an isolation forest model, or a deep learning model.

[0022] Optionally, before obtaining multiple data streams from the audit system, the following is also included:

[0023] Acquiring multiple historical data segments of an audit system; matching the historical data segments with complex event templates;

[0024] Mark the abnormal judgment results of multiple historical data segments;

[0025] The machine learning model is trained with the historical data segment as input and the abnormality determination result of the historical data segment as output to obtain the audit rule model.

[0026] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0027] The present invention provides a monitoring device and method for an audit system. The method utilizes a stream processing algorithm to logically process multiple data streams, generating multiple logically processed data streams. The method stores multiple complex event templates and compares the multiple logically processed data streams with the multiple complex event templates. When a data segment in the multiple logically processed data streams matches any complex event template, the data segment matching the complex event template is determined as a pending data segment. An audit rule model module is configured to implement the audit rule model and input the pending data segment into the audit rule model to obtain an anomaly determination result. By utilizing real-time data stream processing and complex event processing technologies, the audit process is made real-time, improving audit efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0029] Figure 1 This is a schematic diagram of the structure of a monitoring device applied to an audit system provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0030] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0031] The purpose of the present invention is to provide a monitoring device and method for an audit system, which can monitor the audit system in real time and improve audit efficiency and accuracy.

[0032] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] Example 1

[0034] like Figure 1 As shown, a monitoring device applied to an audit system in this embodiment is applied to an audit system, and the monitoring device includes: a data acquisition module, a stream processing engine, a complex event processing module, and an audit rule model module connected in sequence.

[0035] The data acquisition module is used to obtain multiple data streams of the audit system.

[0036] The stream processing engine is used to perform logical processing on multiple data streams using a stream processing algorithm to obtain multiple logically processed data streams.

[0037] The complex event processing module is used to store multiple complex event templates and compare multiple logically processed data streams with multiple complex event templates respectively. When there is a data segment in the multiple logically processed data streams that is consistent with any complex event template, the data segment that matches the complex event template is determined to be a pending data segment.

[0038] The audit rule model module is used to load the audit rule model and input the pending data segments into the audit rule model to obtain anomaly determination results. The audit rule model is obtained by training the machine learning model using multiple historical data segments of the audit system that are annotated with anomaly determination results.

[0039] The monitoring device further comprises a user interface module which is connected to the data acquisition module, the stream processing engine, the complex event processing module and the audit rule model module respectively.

[0040] The user interface module is used to display multiple data streams of the audit system, multiple logically processed data streams, pending data segments, complex event types corresponding to the pending data segments, and abnormality determination results of the pending data segments.

[0041] The machine learning model is a standardized score model, an isolation forest model, or a deep learning model.

[0042] Specifically, the monitoring device used in the audit system includes:

[0043] Data acquisition module: responsible for obtaining real-time data streams directly from the data source and collecting the data streams from the source into the system.

[0044] Stream processing engine: Uses stream processing technology to process and analyze real-time data streams.

[0045] Complex event processing module: Build a complex event processing module on the stream processing engine, use complex event processing technology to identify and process the complex relationships between multiple data streams, and formulate appropriate complex event processing rules so that the system can identify events or situations that need to be audited from the data stream based on these rules.

[0046] Audit Rules and Models: This module interacts with the Complex Event Processing module to establish audit rules and models. When the Complex Event Processing module identifies events or situations that require auditing, it passes these events to the Audit Rules and Models module for further analysis and evaluation. These rules and models can be defined based on business needs and regulatory requirements to ensure that the system can accurately detect potential issues or anomalies.

[0047] User interface module: used to display audit results in real time and provide user interaction functions. The user interface uses reports, charts, etc. to intuitively display audit results and data trends, and provides user interaction functions, allowing users to view detailed information, adjust audit rules, set alarm conditions, etc.

[0048] The data collection module can collect data from audit data sources in multiple fields, including but not limited to:

[0049] Financial data: including financial statement data such as balance sheet, income statement, cash flow statement, as well as original financial records such as accounting vouchers and bank statements.

[0050] Transaction records: Covers transaction activity data of enterprises or individuals, such as sales records, purchase orders, payment transactions, contracts, etc.

[0051] Log information: including system logs, network logs, operation logs, etc., which record the system's operating status, user operation behavior, network access records and other information.

[0052] Compliance and regulatory data: covers data that meets legal and regulatory requirements, such as compliance reports and audit reports from regulators.

[0053] Business process data: records the business process activity data of an enterprise or organization, such as production processes, sales processes, human resources processes, etc.

[0054] Risk management data: including risk assessment data, security incident data, exception report data, etc., used to identify and manage potential risks and abnormal situations.

[0055] Customer data: covers customer information, customer transaction records, customer complaint feedback and other data, which are used for customer relationship management and service quality assessment.

[0056] 1. Acquisition of data source.

[0057] Internal data sources: Enterprise databases: such as relational databases (such as MySQL, Oracle, etc.) or non-relational databases (such as MongoDB, Redis, etc.), which store the company's structured data; log files: log files generated by servers, applications, network devices, etc., containing detailed information on system operation and user behavior; ERP, CRM and other systems: Enterprise resource planning (ERP) and customer relationship management (CRM) systems store the company's business data and customer information.

[0058] External data sources: public databases: such as public data released by the government, industry associations, etc.

[0059] API interface: obtain data, such as market data, by calling the API interface provided by a third party; web crawler: crawl data from the Internet, but be careful to comply with relevant laws and regulations and the website's usage agreement.

[0060] 2. Get data from the data source.

[0061] Database connection and query: For enterprise databases, you typically use database connection tools (such as JDBC and ODBC) to establish a connection and retrieve data through SQL queries. You can set up scheduled tasks or triggers to periodically pull data from the database.

[0062] Log file parsing: Use log parsing tools (such as Logstash and Flume) to read and analyze log files and extract useful information. Logs can be filtered and selected using regular expressions, pattern matching, and other methods.

[0063] API call: Based on the API documentation provided by a third party, code is written to call the API to retrieve data. This typically involves handling issues such as API authentication, request parameters, and response formats.

[0064] Web crawler: Use a crawler framework (such as Scrapy, Selenium, etc.) to write a crawler program to simulate a browser to access web pages and crawl data.

[0065] Other data collection methods:

[0066] (1) For non-database files (such as TXT, XML, Excel, etc.), you can:

[0067] Direct access: When these files are stored on the local file system or a network share, they can be accessed and retrieved directly through the file path or network location. For example, the audit team may regularly download these files from the audited organization's server or transfer them remotely via a secure file transfer protocol (such as SFTP or FTPS).

[0068] Automated scripts and tools: Automated scripts can be written to periodically scan and collect these files. These scripts can be written in various programming languages (such as Python, Perl, and Shell) and can select and collect files based on specific file naming conventions, locations, or modification times. Additionally, specialized tools (such as rsync, wget, and curl) can help automate file downloads from remote locations.

[0069] Manual upload: In some cases, the audited entity may manually upload these documents via email, file sharing platforms, or dedicated data upload systems. The audit team needs to regularly review these uploaded documents and ensure their security and integrity.

[0070] Data exchange and sharing agreement: If there is a data exchange and sharing agreement with the audited entity, these non-database files can be obtained according to the methods specified in the agreement. For example, secure file transfer protocols such as SFTP and FTPS can be used for file transfer and exchange.

[0071] Backup and recovery: Restore data from backup files. This is applicable when the original data source cannot be directly accessed.

[0072] Data interface method: access and collect data through existing data interfaces, such as using a general audit interface or a dedicated audit interface.

[0073] Stream processing engines use stream processing algorithms to process and analyze real-time data.

[0074] The process of using Apache Kafka to process and analyze real-time data:

[0075] Set up the Kafka environment.

[0076] Create a data topic to store real-time data streams and configure a data producer to send real-time data to the Kafka topic. The producer can be a data source system responsible for producing and sending real-time data to the Kafka cluster.

[0077] Develop stream processing applications, use Kafka's stream processing API to process real-time data streams, and use stream processing algorithms and operators to process, transform, and analyze data.

[0078] Configure data consumers to read and process real-time data from Kafka topics. Consumers can be stream processing applications, which are responsible for consuming real-time data and performing corresponding business logic processing. In stream processing applications, specific stream processing algorithms and logic are implemented to process and analyze real-time data.

[0079] Based on business needs, the processing results are output to the data warehouse, sent to other Kafka topics, or written to the database.

[0080] Complex event processing module: Build a complex event processing module on the stream processing engine and use the complex event processing engine to identify and process complex relationships between multiple data streams.

[0081] Specific process:

[0082] Data input and event extraction: Receive data streams from the stream processing engine and extract events from the received data streams. Events can be any data with specific meaning in time, such as alarms, status changes, etc.

[0083] Event matching and analysis: The engine matches events using defined patterns. Patterns can be simple rules or complex event patterns that describe the relationships between multiple events. For example, a simple pattern might be "A occurs immediately after B occurs," while a more complex pattern might be "If A and B occur simultaneously, and C occurs later, trigger a certain action." Once a defined pattern is matched, the engine performs further analysis on these events, which may involve aggregation, filtering, calculations, and other operations to determine whether specific conditions are met.

[0084] State management: When dealing with complex relationships between multiple data streams, the engine needs to maintain some state information, which can be used to track the status of event sequences, record historical data, etc.

[0085] Real-time processing: The engine needs to be able to process data in real time or near real time. It must have high throughput, low latency, and high reliability to ensure it can handle large amounts of real-time data.

[0086] The Audit Rules and Models module contains the rules and models required for real-time auditing to detect and analyze real-time data.

[0087] The Audit Rules and Models module interacts with the Complex Event Processing module. It may define a set of audit rules and models based on historical data and machine learning models. When the Complex Event Processing module identifies events or situations that require auditing, it passes these events to the Audit Rules and Models module for further analysis and evaluation.

[0088] The audit rules and model module focuses on pre-defined rules and models to check and verify whether events occurring in the system comply with expected standards or rules. These rules and models are usually based on business specifications, compliance requirements or empirical knowledge, and may involve simple logical checks (such as threshold detection) or complex statistical analysis and machine learning models. They are mainly used to identify and process specific types of events or behaviors to ensure that the system's operations comply with business rules and regulatory requirements.

[0089] In the Audit Rules and Models module, models generally refer to machine learning models used for real-time data detection and analysis. These models can be used to identify abnormal behavior, detect fraud, and make predictions.

[0090] The process of building, training and using these models:

[0091] Model Building and Training: Collect historical data relevant to the audit, including samples of both normal and abnormal behavior. Select an appropriate machine learning model based on the specific audit requirements. Train the selected machine learning model using the prepared training data. During training, the model learns patterns and regularities in the data, enabling accurate predictions or detections in subsequent real-time data. After model training is complete, evaluate the model using a validation dataset. Based on the evaluation results, optimize and adjust the model, including adjusting model parameters and increasing the amount of training data, to further improve model performance.

[0092] Model usage process: Based on business needs and regulatory requirements, a series of audit rules are defined to identify events or situations that require auditing. Audit models are constructed based on historical data and machine learning technology to discover patterns, anomalies, or trends related to auditing. The constructed audit model is integrated into the complex event processing module. When the complex event processing module identifies events or situations that require auditing, these events are passed to the audit rules and model module for further analysis and evaluation. In the audit rules and model module, the passed events are further analyzed and evaluated, involving operations such as feature extraction of events, model prediction, or rule matching. Based on the evaluation results of the model and rules, an audit report is generated or a warning is triggered, relevant personnel are notified, etc.

[0093] Model Type:

[0094] Statistical models: These models use statistical principles to analyze audit data and identify data that significantly deviates from the normal data distribution pattern as anomalies. For example, the Z-score model assumes that audit data follows a normal distribution and calculates the Z-score (i.e., standardized score) for each data point, then sets a threshold to identify outliers.

[0095] Machine learning-based models: Machine learning models learn normal behavior patterns from training data and identify data that deviates significantly from these patterns as anomalies. For example, the Isolation Forest algorithm constructs multiple random binary trees, maps each data point to a leaf node, and assesses the degree of abnormality of a data point based on the length of the tree path. Outliers are typically isolated earlier, resulting in shorter paths.

[0096] Deep learning-based models: Deep learning models can handle more complex nonlinear relationships and learn deep features in data through multi-layer neural networks. For example, long short-term memory (LSTM) networks can be used to process time series data in audit log anomaly detection, learning the temporal dependency patterns of normal behavior and identifying anomalous logs that do not conform to these patterns.

[0097] Training methods:

[0098] Data preparation: Collect historical audit data as training data and perform data cleaning, preprocessing, and feature extraction. For supervised learning models (such as some machine learning-based models), the data also needs to be labeled to distinguish between normal and abnormal data.

[0099] Model selection: Choose the appropriate model type based on business needs, data characteristics, and available resources. Consider factors such as model complexity, accuracy, interpretability, and scalability.

[0100] Model training: The model is trained using training data, and model parameters are adjusted to optimize performance. For supervised learning models, the model is trained by minimizing a loss function (such as cross-entropy loss) to accurately distinguish between normal and abnormal data. For unsupervised learning models (such as isolation forests), the model is trained by random sampling and constructing binary trees to enable it to identify abnormal data.

[0101] Model evaluation: Use test data to evaluate the trained model and check metrics such as accuracy, recall, and F1 score. For audit anomaly detection systems, special attention should be paid to false positive and false negative rates to ensure that the system can accurately identify anomalies and reduce false positives and false negatives.

[0102] Model optimization: Optimize the model based on the evaluation results, such as adjusting model parameters, improving feature extraction methods, and trying different model structures. Repeat the training, evaluation, and optimization process until the model performance reaches a satisfactory level.

[0103] Taking the Isolation Forest model as an example, suppose there is a dataset containing a large number of audit logs, including both normal and abnormal logs. The goal is to train an Isolation Forest model to identify these abnormal logs. Data preparation: First, the audit logs need to be preprocessed to extract meaningful features (such as user ID, operation type, timestamp, etc.). These features are then used as input data, and each log entry is assigned a label (normal or abnormal). Model selection: The Isolation Forest model is chosen because it is suitable for unsupervised learning and anomaly detection tasks. Model training: The Isolation Forest model is trained using the training data. Specifically, a subsample of the data is randomly selected, and a random binary tree is constructed on the subsample. This process is then repeated multiple times to construct multiple such trees, forming an Isolation Forest. Model evaluation: The model's performance is evaluated using test data. The test data is fed into the model, and metrics such as precision and recall are calculated. If the model's performance does not meet the requirements, the model parameters can be adjusted or alternative model structures can be tried to optimize performance. Model optimization: Based on the evaluation results, the model can be optimized. For example, you can try increasing or decreasing the number of trees, adjusting parameters such as the tree height limit, and other parameters to improve the model's performance. You can also try using different feature extraction methods or introducing more features to improve the model. Deployment and Monitoring: Once you are satisfied with the model's performance, you can deploy it to a production environment and set up appropriate monitoring and alerting mechanisms to detect abnormal logs.

[0104] The user interface module provides real-time audit result display and user interaction functions.

[0105] The user interface module interacts with other modules to obtain audit results and display them to users, display audit results in real time and provide user interaction functions, and intuitively display audit results and data trends in the form of reports, charts, etc. When the audit rules and model modules detect anomalies or trigger alarms, the user interface module can display corresponding notifications or warnings to users and provide a corresponding operation interface.

[0106] User interaction typically requires obtaining user instructions or feedback so that users can view and manipulate audit results or further guide system behavior. This user interaction may affect the operation and changes of the data acquisition module, stream processing engine, complex event processing module, and audit rules and model modules.

[0107] The introduction of user interaction may require adjustments to the data acquisition module to support specific data or information that users may request. For example, a user may need to view data or event streams within a specific time period, so the data acquisition module may need to adjust its data acquisition and processing strategies accordingly.

[0108] User instructions or feedback can trigger the reconfiguration or adjustment of the stream processing engine. For example, a user may ask the stream processing engine to change the rules or mode of event processing to adapt to different audit requirements or user focus.

[0109] User interaction can affect how the complex event processing module works. Users may raise new queries or requirements based on the real-time audit results, and the complex event processing module may need to adjust event processing and pattern matching strategies based on user needs.

[0110] User interaction may lead to dynamic adjustments of audit rules and model modules. Users may request to modify or customize audit rules or models to better suit actual business needs or specific audit scenarios.

[0111] The collaborative working process of the various modules: Data acquisition collects real-time data sources into the system and sends them to the stream processing engine for processing. The stream processing engine receives, processes, and analyzes these data streams. The processed data may be sent to the complex event processing module. The complex event processing module is built on the stream processing engine, using the complex event processing engine to identify and process the complex relationships between multiple data streams. This process may trigger specific events or situations that may require further audit. Therefore, the audit rules and model module interacts with the complex event processing module to define a series of audit rules and models built based on historical data and machine learning. When the complex event processing module identifies events or situations that require audit, it passes these events to the audit rules and model module for further analysis and evaluation. The user interface module interacts with other modules to obtain audit results and display them to users in real time. It also provides user interaction functions, visually displaying audit results and data trends in reports and charts. When the audit rules and model module detects an anomaly or triggers an alert, the user interface module can display corresponding notifications or warnings to the user and provide a corresponding operation interface.

[0112] Real-time audit processing: Using stream processing technology and complex event processing technology, real-time processing and analysis of real-time data streams are achieved, making the audit process more timely and responsive.

[0113] Real-time audit processing uses stream processing technology and complex event processing technology to immediately process and analyze real-time data streams. The difference before and after analysis can be seen in the following aspects:

[0114] Timeliness and real-time performance:

[0115] Before analysis, real-time data streams may simply be collected or transmitted without undergoing real-time processing and analysis. After analysis and real-time audit processing, the data streams are processed and analyzed immediately, allowing the system to capture and respond to events or situations in real time. This can achieve higher timeliness and real-time performance, allowing important information or anomalies to be discovered and processed in a timely manner.

[0116] Complex Event Recognition:

[0117] Before analysis, the identification of complex events or specific rules may be difficult or time-consuming, requiring offline or batch processing. After analysis, real-time audit processing utilizes complex event processing technology to instantly identify and capture complex events or patterns, thereby enabling in-depth analysis and correlation identification of data streams.

[0118] Real-time monitoring and response capabilities:

[0119] Before analysis, traditional data analysis methods may not be able to provide real-time monitoring and response capabilities, and usually require waiting for data accumulation to be performed for batch analysis. After analysis, real-time audit processing can achieve real-time monitoring and response to data streams, enabling the system to perform instant analysis and decision support while data is generated.

[0120] Instant feedback and interaction:

[0121] Before analysis, pre-analysis data processing is usually static and cannot provide immediate interaction and feedback to users. After analysis, real-time audit processing can achieve instant display of real-time audit results and user interaction through the combination of stream processing technology and user interface, allowing users to understand the data status in a timely manner and provide real-time guidance or operations.

[0122] Real-time audit processing uses stream processing and complex event processing technologies to enable the system to promptly process real-time data streams, identify complex events, and monitor them in real time, thereby improving the system's real-time performance, feedback speed, and flexibility of application scenarios, making data processing more practical and efficient.

[0123] Complex Event Processing: By combining the Complex Event Processing module with the Audit Rules and Models module, the complex relationships between multiple data streams can be accurately identified and processed, thereby more accurately detecting changes, anomalies, and risks.

[0124] Instant Reporting: Generates real-time audit results and displays them in real time through the user interface, enabling auditors to take timely action and improving audit efficiency and accuracy.

[0125] The system generates real-time audit results through instant reports and displays these results in real time through the user interface, helping auditors take timely action and improving audit efficiency and accuracy. Based on this real-time auditing, the system also provides action recommendations through intelligent analysis and a rules engine to further assist auditors in their decision-making and operations. For example, the system can automatically detect and identify potential issues or anomalies using pre-defined audit rules and policies. When the system detects specific audit events or patterns, it can automatically generate corresponding action recommendations, such as warnings, recommended actions, or reminders, based on the pre-defined rules engine. When the system detects significant audit events or anomalies, it can immediately send real-time alerts or notifications to auditors. This real-time alerting capability enables auditors to obtain timely critical information and take swift action.

[0126] In summary, this solution achieves real-time auditing and monitoring by combining real-time data stream processing technology and complex event processing technology, providing a new solution for auditing work.

[0127] Example 2

[0128] This embodiment provides a monitoring method for an audit system. The monitoring method uses the monitoring device for an audit system described in Example 1. The monitoring method includes:

[0129] Step 1: Obtain multiple data streams from the audit system.

[0130] Step 2: Use a stream processing algorithm to perform logical processing on multiple data streams to obtain multiple logically processed data streams.

[0131] Step 3: Compare the multiple logically processed data streams with the multiple complex event templates respectively. When there is a data segment in the multiple logically processed data streams that is consistent with any complex event template, determine the data segment that matches the complex event template as the pending data segment.

[0132] Step 4: Input the undetermined data segment into the audit rule model to obtain the anomaly determination result. The audit rule model is obtained by training the machine learning model using multiple historical data segments of the audit system that are annotated with anomaly determination results.

[0133] The machine learning model is a standardized score model, an isolation forest model, or a deep learning model.

[0134] Before step 1, also include:

[0135] Step 5: Obtain multiple historical data segments from the audit system and match the historical data segments with the complex event templates.

[0136] Step 6: Mark the abnormality determination results of multiple historical data segments.

[0137] Step 7: Using the historical data segment as input and the anomaly determination result of the historical data segment as output, the machine learning model is trained to obtain the audit rule model.

[0138] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0139] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The above examples are only intended to help understand the method and core concept of the present invention. At the same time, those skilled in the art will find that the specific implementation methods and application scopes may vary based on the concept of the present invention. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims

1. A monitoring device applied to an audit system, characterized in that: The monitoring device is applied to an audit system, and the monitoring device includes: The data acquisition module, stream processing engine, complex event processing module, and audit rule model module are connected in sequence; The data acquisition module is used to obtain multiple data streams of the audit system; the types of data streams include: financial data, transaction records, log information, compliance and regulatory data, business process data, risk management data and customer data; financial data includes balance sheets, income statements and cash flow statements, as well as accounting vouchers and bank statements; transaction records are transaction activity data of enterprises or individuals; log information includes system logs, network logs and operation logs; the log information is used to record the operating status of the system, user operation behavior and network access records; compliance and regulatory data are data that comply with laws and regulations, and compliance and regulatory data include compliance reports and audit reports of regulatory agencies; business process data are data that records business process activities of enterprises or organizations, and business process data include production processes, sales processes and human resources processes; risk management data includes risk assessment data, security incident data, and abnormal report data; risk management data is used to identify and manage potential risks and abnormal situations; customer data includes customer information, customer transaction records and customer complaint feedback, and customer data is used for customer relationship management and service quality assessment; The stream processing engine is used to use stream processing algorithms to perform logical processing on multiple data streams respectively to obtain multiple logically processed data streams; the stream processing engine is used to set up the Kafka environment; create data topics to store real-time data streams, configure data producers, and send real-time data to Kafka topics. The producer is the data source system, which is responsible for producing and sending real-time data to the Kafka cluster; develop stream processing applications, use Kafka's stream processing API to process real-time data streams, and use stream processing algorithms and operators to process, transform and analyze data; configure data consumers, read real-time data from Kafka topics and process them. Consumers are stream processing applications, which are responsible for consuming real-time data and performing corresponding business logic processing. In the stream processing application, specific stream processing algorithms and logic are implemented to process and analyze real-time data; according to business needs, the processing results are output to the data warehouse, the processing results are sent to other Kafka topics, or written to the database; The complex event processing module is used to store multiple complex event templates and compare multiple logically processed data streams with the multiple complex event templates respectively. When a data segment in the multiple logically processed data streams is consistent with any complex event template, the data segment matching the complex event template is determined as a pending data segment. The audit rule model module is used to carry the audit rule model and input the pending data segment into the audit rule model to obtain the abnormal judgment result; the audit rule model is obtained by training the machine learning model using multiple historical data segments of the audit system marked with abnormal judgment results; the machine learning model is a standardized scoring model, an isolation forest model or a deep learning model.

2. A monitoring device for an audit system according to claim 1, characterized in that: The monitoring device further comprises: User interface module; The user interface module is connected to the data acquisition module, the stream processing engine, the complex event processing module and the audit rule model module respectively; The user interface module is used to display multiple data streams of the audit system, multiple logically processed data streams, pending data segments, complex event types corresponding to the pending data segments, and abnormality determination results of the pending data segments.

3. A monitoring method applied to an audit system, characterized in that: The monitoring method applies a monitoring device applied to an audit system according to any one of claims 1 to 2, and the monitoring method includes: Obtain multiple data streams from the audit system; types of data streams include: financial data, transaction records, log information, compliance and regulatory data, business process data, risk management data and customer data; financial data includes balance sheets, income statements and cash flow statements, as well as accounting vouchers and bank statements; transaction records are transaction activity data of enterprises or individuals; log information includes system logs, network logs and operation logs; the log information is used to record the operating status of the system, user operation behavior and network access records; compliance and regulatory data is data that complies with laws and regulations, and compliance and regulatory data includes compliance reports and audit reports from regulatory agencies; business process data is data that records the business process activities of enterprises or organizations, and business process data includes production processes, sales processes and human resources processes; risk management data includes risk assessment data, security incident data and exception report data; risk management data is used to identify and manage potential risks and abnormal situations; customer data includes customer information, customer transaction records and customer complaint feedback, and customer data is used for customer relationship management and service quality assessment; Utilize stream processing algorithms to perform logical processing on multiple data streams respectively to obtain multiple logically processed data streams; the stream processing algorithm includes: setting up a Kafka environment; creating data topics to store real-time data streams, configuring data producers, and sending real-time data to Kafka topics. Producers are data source systems responsible for producing and sending real-time data to Kafka clusters; developing stream processing applications, utilizing Kafka's stream processing API to process real-time data streams, and using stream processing algorithms and operators to process, transform, and analyze data; configuring data consumers to read and process real-time data from Kafka topics. Consumers are stream processing applications responsible for consuming real-time data and performing corresponding business logic processing. In stream processing applications, specific stream processing algorithms and logic are implemented to process and analyze real-time data; according to business needs, processing results are output to a data warehouse, sent to other Kafka topics, or written to a database; Comparing the multiple logically processed data streams with the multiple complex event templates respectively, and when a data segment in the multiple logically processed data streams is consistent with any complex event template, determining the data segment matching the complex event template as a pending data segment; The pending data segment is input into the audit rule model to obtain an abnormality judgment result; the audit rule model is obtained by training a machine learning model using multiple historical data segments of the audit system marked with abnormality judgment results; the machine learning model is a standardized scoring model, an isolation forest model or a deep learning model.

4. A monitoring method applied to an audit system according to claim 3, characterized in that: Before acquiring multiple data streams from the audit system, it also includes: Acquiring multiple historical data segments of an audit system; matching the historical data segments with complex event templates; Mark the abnormal judgment results of multiple historical data segments; The machine learning model is trained with the historical data segment as input and the abnormality determination result of the historical data segment as output to obtain the audit rule model.

Images