Anomaly financial behavior analysis method and system based on deep learning model

Abstract

The application discloses an abnormal financial behavior analysis method and system based on a deep learning model, and relates to the technical field of financial analysis.The method comprises the following steps: acquiring real-time financial data, performing information extraction on the real-time financial data, determining the data category of the real-time financial data according to the extraction result, performing data feature extraction on the real-time financial data according to the data category, matching the extraction result with data in a preset database to obtain a matching degree, comparing the matching degree with a preset matching threshold, and determining whether the real-time financial data is abnormal financial behavior according to the comparison result; if the comparison result exceeds the preset matching threshold, it is determined that the real-time financial data is abnormal financial behavior, and a report is generated and a warning is given according to the comparison result, the matching degree, the data category and the real-time financial data. The application can accurately determine whether real-time financial data represents abnormal financial behavior, and reduce the possibility of false positives and false negatives. The application provides an important basis for supervision and investigation.

Description

Technical Field

[0001] This invention relates to the field of financial analysis technology, and in particular to a method and system for analyzing abnormal financial behavior based on a deep learning model. Background Technology

[0002] As businesses expand, their operations become increasingly diverse and complex. Therefore, identifying and addressing abnormal financial activities is urgently needed. Only by preventing such activities can the financial market and all industries develop more smoothly. However, because abnormal financial activities are often highly concealed and take many forms, identifying their abnormal nature becomes difficult. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for analyzing abnormal financial behavior based on a deep learning model, so as to solve the problems of strong concealment, diverse forms, and difficulty in identifying the abnormal nature of abnormal financial activities, and to achieve efficient early warning of abnormal financial behavior.

[0004] In a first aspect, the present invention provides a method for analyzing abnormal financial behavior based on a deep learning model, comprising:

[0005] 1) Obtain historical financial data, perform integrity analysis and correction on the obtained historical financial data, identify abnormal financial data through classification, extract abnormal features and establish credibility levels;

[0006] 2) Acquire real-time financial data, extract information from the real-time financial data, and determine the data category of the real-time financial data based on the extraction results;

[0007] 3) Based on the data category, extract data features from the real-time financial data, and match the extraction results with data in a preset database to obtain the matching degree;

[0008] 4) Compare the matching degree with a preset matching threshold, and determine whether the real-time financial data represents an abnormal financial behavior based on the comparison result;

[0009] 5) If the matching degree exceeds the preset matching threshold, the real-time financial data is determined to represent an abnormal financial behavior, and a report is generated based on the comparison result, the matching degree, the data category, and the real-time financial data, and an early warning is issued based on the report.

[0010] In step 1), the acquisition of historical financial data, the integrity analysis and correction of the acquired historical financial data, the identification of abnormal financial data through classification, the extraction of abnormal features and the establishment of a credibility level specifically include:

[0011] (1.1) Obtain historical financial data, analyze the historical financial data based on domain knowledge, and determine whether the historical financial data is complete;

[0012] (1.2) If the historical financial data is incomplete, the input and correction of domain knowledge are obtained, and the historical financial data is adjusted according to the input and correction to obtain complete historical financial data. The complete historical financial data is then classified based on whether the historical financial transaction behavior is an abnormal financial transaction behavior.

[0013] (1.3) Based on the classification results, identify historical abnormal financial data and extract the historical abnormal financial data. Based on the extraction results, determine the characteristics of the abnormal data.

[0014] (1.4) Construct a matching confidence level based on the abnormal data characteristics.

[0015] This step involves performing a completeness check on historical financial data to ensure its accuracy and reliability, making the analysis results more consistent with reality and providing a foundation for subsequent analysis. Based on the characteristics of abnormal data, a matching credibility level is constructed, and combined with the matching degree of real-time financial data, the credibility of real-time financial data is evaluated. This improves the accuracy and reliability of the analysis, enabling timely detection and early warning of potential abnormal financial behavior, and providing decision support for regulatory agencies.

[0016] Furthermore, step (1.4) involves constructing a matching credibility level based on the abnormal data characteristics; specifically, this includes the following steps:

[0017] (1.4.1) Analyze the abnormal data features, and determine the data characteristics of each abnormal data feature based on the feature analysis results;

[0018] (1.4.2) Based on the characteristics of the data, the abnormal data features are classified to obtain several sets of abnormal features;

[0019] (1.4.3) Match each historical abnormal financial data with the corresponding abnormal feature set, and determine the proportion of each abnormal data feature in the corresponding abnormal feature set based on the matching results.

[0020] (1.4.4) Calculate the frequency of each abnormal data feature in the historical financial data;

[0021] (1.4.5) Based on the stated proportion and frequency, determine the feature weight of each abnormal data feature, referring to the following formula:

[0022] N=(α*y i +β*n i ) / Σ(α*y j+β*n j );

[0023] Where N represents the weight of the i-th abnormal data feature after normalization; y i The frequency of the i-th anomalous data feature appearing in the historical financial data; n i α represents the proportion of the i-th anomalous data feature in the set of anomalous features; β represents the weighting coefficient corresponding to the frequency; y represents the weighting coefficient corresponding to the proportion; j This represents the frequency with which all anomalous data characteristics appear in the historical financial data; n j This indicates the proportion of all abnormal data features in the abnormal feature set;

[0024] (1.4.6) Generate a feature weight matrix based on the aforementioned feature weights;

[0025] (1.4.7) Construct a matching confidence level based on the feature weight matrix.

[0026] This step involves analyzing the characteristics of anomalous data, identifying its features, and categorizing these features into multiple sets. By statistically analyzing the frequency of each anomalous feature in historical financial data and considering its proportion within each set, the feature weight is determined, providing a more comprehensive reflection of its importance. The matching credibility level constructed based on the feature weight matrix provides a quantitative basis for assessing the credibility of real-time financial data, helping to more accurately identify anomalous financial behavior.

[0027] Optionally, after constructing the matching credibility level based on the feature weight matrix, a dynamic monitoring and self-evolving financial regulatory mechanism can be established, including the following steps:

[0028] This process involves acquiring and analyzing financial market data. Based on the analysis results, it determines whether new types of abnormal financial behavior exist in the financial market. If such new abnormal financial behavior exists, it acquires new abnormal financial transaction data related to that behavior. Data features are extracted from this new abnormal financial transaction data to obtain abnormal new data features. Based on these abnormal new data features, the category of the new abnormal financial behavior is determined. Based on the category and the abnormal new data features, the feature weight matrix is ​​adjusted to obtain an adjusted feature weight matrix. Finally, the matching credibility level is adjusted based on the adjusted feature weight matrix. Through data feature extraction and abnormal feature analysis, the abnormal new data features of new abnormal financial behavior can be accurately identified, providing a strong basis for determining the category of abnormal financial behavior. Adjusting the feature weight matrix based on the category and abnormal data features optimizes the accuracy and efficiency of subsequent analysis. Adjusting the matching credibility level using the adjusted feature weight matrix helps to more accurately assess the legality of financial transaction behavior and improves the reliability of the analysis.

[0029] In step 2), the acquisition of real-time financial data, the extraction of information from the real-time financial data, and the determination of the data category of the real-time financial data based on the extraction results specifically include the following steps:

[0030] (2.1) Monitor the financial transaction behavior of several enterprises to determine whether there is any possibility that the financial transaction behavior of at least one enterprise is abnormal;

[0031] (2.2) If it is determined that at least one enterprise's financial transaction behavior is likely to be abnormal, then extract the financial transaction data of the abnormal financial transaction behavior;

[0032] (2.3) Retrieve the historical financial transaction data of the abnormal enterprise, compare the historical financial transaction data of the abnormal enterprise with the financial transaction data of the abnormal financial transaction behavior, and determine whether there is an error in the acquisition operation;

[0033] (2.4) If there is an error in the acquisition operation, the real financial transaction data shall be reacquired based on the abnormal financial transaction behavior; if there is no error in the acquisition operation, the financial transaction data shall be filtered based on the operating scale of the abnormal enterprise and the historical financial transaction data to determine the real-time financial data.

[0034] This step compares the historical financial transaction data of abnormal companies with current financial transaction data, which helps identify operational errors or abnormal patterns. When an operational error is discovered, the accurate financial transaction data can be retrieved again, ensuring data accuracy. Filtering financial transaction data based on the operating scale and historical data of abnormal companies helps focus on key information and improves analytical efficiency.

[0035] In step 4), comparing the matching degree with a preset matching threshold and determining whether the real-time financial data represents an abnormal financial behavior based on the comparison result includes the following steps:

[0036] (4.1) Based on the data category, determine the key data that matches the data in the preset database;

[0037] (4.2) Match the key data with the abnormal data features in the feature weight matrix to determine the overlap rate;

[0038] (4.3) Match the matching degree with the matching credibility level to determine the credibility level of the real-time financial data;

[0039] (4.4) Based on the credibility level, determine whether the real-time financial data represents an abnormal financial behavior.

[0040] This step categorizes real-time financial data based on its content, identifying key data points that allow for more focused and precise subsequent analysis. Based on data characteristic types, key data is matched with outlier data features, improving the accuracy and relevance of the analysis. By calculating the overlap rate and matching it with the matching credibility level, a quantitative credibility assessment method is provided for the analysis of real-time financial data.

[0041] The real-time financial data also includes information on key personnel; in step (4.4), determining whether the real-time financial data represents an abnormal financial behavior based on the credibility level includes the following steps:

[0042] (4.4.1) Based on the overlap rate, determine the categories of abnormal financial behaviors corresponding to key data with abnormal data characteristics;

[0043] (4.4.2) Analyze the information of the principal responsible persons and determine the historical financial business of the principal responsible persons based on the information analysis results;

[0044] (4.4.3) Analyze the historical financial transactions and, based on the business analysis results, determine the business overlap rate between the historical financial transactions and the set of a plurality of abnormal features;

[0045] (4.4.4) Compare the business overlap rate with the preset overlap threshold, and determine whether there is any abnormal financial behavior in the historical financial business based on the overlap comparison result;

[0046] (4.4.5) If the business overlap rate is lower than the preset overlap threshold, it is determined that there is no abnormal financial behavior in the historical financial business.

[0047] (4.4.6) Adjust the credibility level based on the business overlap rate and the overlap rate, and determine whether the real-time financial data represents an abnormal financial behavior based on the adjusted credibility level.

[0048] This step, using the overlap rate as a quantitative indicator, allows for an objective and accurate assessment of the matching degree between key data and the set of abnormal features, providing a strong basis for determining the category of abnormal financial behavior. By analyzing the historical financial transactions of key personnel and comparing them with the set of abnormal features, the business overlap rate is determined. Adjusting the credibility level based on the business overlap rate helps to more accurately assess whether real-time financial data represents abnormal financial behavior, improving the reliability of the analysis.

[0049] In step 5), the step of issuing an early warning based on the reported information includes the following steps:

[0050] (5.1) Analyze the abnormal financial behavior and determine the operational process of the abnormal financial behavior;

[0051] (5.2) Determine the handling method for the abnormal financial behavior according to the above operation procedure;

[0052] (5.3) Incorporate the processing method into the report information to obtain the adjusted report information;

[0053] (5.4) Issue an early warning based on the adjusted report information.

[0054] This step involves a detailed analysis of the operational process of abnormal financial behavior, providing a clear understanding of the entire chain of such behavior and helping to identify potential risks and vulnerabilities. The handling methods determined based on the operational process are more precise, allowing for the development of effective countermeasures for each stage of abnormal financial behavior, thus improving the targeting and effectiveness of supervision. Incorporating the handling methods into the reporting information makes the report more comprehensive and detailed, providing regulatory agencies and relevant departments with richer decision-making support.

[0055] After issuing an early warning based on the reported information in step 5), the present invention may further include the following steps:

[0056] 6) Monitor financial market data. If new abnormal financial behaviors are discovered, obtain relevant transaction data, extract their characteristics, determine the behavior category, and optimize feature weights and matching credibility accordingly to enhance subsequent analysis capabilities.

[0057] Specifically, the following steps are included:

[0058] (6.1) Obtain the number of warnings for the abnormal financial behavior within a preset time range;

[0059] (6.2) Compare the number of warnings with a preset high-frequency threshold. If the number of warnings is higher than the preset high-frequency threshold, obtain warning feedback and determine whether the abnormal financial behavior is processed based on the warning feedback.

[0060] (6.3) If it is determined that the abnormal financial behavior has been processed, the early warning feedback is analyzed, and based on the early warning analysis results and the number of early warnings, it is determined whether the abnormal financial behavior is a normal financial behavior.

[0061] (6.4) If it is determined that the abnormal financial behavior is the regular financial behavior, the matching credibility level is adjusted based on the real-time financial data.

[0062] This step, by comparing the number of alerts with a preset high-frequency threshold, quantitatively assesses the frequency of abnormal financial behavior, providing clear data support for subsequent analysis and decision-making. When the number of alerts exceeds the high-frequency threshold, timely alert feedback can be obtained, ensuring that abnormal financial behavior is dealt with quickly and potential risks are reduced. After determining that the abnormal financial behavior is a regular financial behavior, adjusting the matching credibility level based on real-time financial data helps improve the accuracy and reliability of subsequent analysis.

[0063] Secondly, the present invention provides an abnormal financial behavior analysis system based on a deep learning model, comprising:

[0064] The data acquisition module is used to acquire real-time financial data, extract information from the real-time financial data, and determine the data category of the real-time financial data based on the extraction results.

[0065] The data matching module is used to extract data features from the real-time financial data according to the data category, and match the extraction results with data in a preset database to obtain the matching degree.

[0066] The behavior determination module is used to compare the matching degree with a preset matching threshold, and determine whether the real-time financial data is an abnormal financial behavior based on the comparison result.

[0067] The reporting and early warning module is used to determine that the real-time financial data is an abnormal financial behavior if the matching degree exceeds a preset matching threshold, and to generate report information based on the comparison result, the matching degree, the data category, and the real-time financial data, and to issue an early warning based on the report information.

[0068] Optionally, the abnormal financial behavior analysis system further includes a hierarchy building module, used for:

[0069] The process involves acquiring historical financial data, analyzing it based on domain knowledge to determine its completeness, and if incomplete, obtaining domain knowledge input and corrections to adjust the data and obtain complete historical financial data. The complete historical financial data is then categorized based on whether the historical financial transactions constitute abnormal financial transactions. Based on the categorization results, abnormal historical financial data is identified and extracted. Abnormal data characteristics are determined based on the extraction results. A matching credibility level is constructed based on the abnormal data characteristics. The process of comparing the matching degree with a preset matching threshold and determining whether the real-time financial data represents an abnormal financial behavior includes: matching the matching degree with the matching credibility level to determine the credibility level of the real-time financial data; and determining whether the real-time financial data represents an abnormal financial behavior based on the credibility level.

[0070] Optionally, the level construction module is used for:

[0071] Analyze the abnormal data features, and based on the feature analysis results, determine the data characteristics of each abnormal data feature; classify the abnormal data features according to the data characteristics to obtain several abnormal feature sets; match each historical abnormal financial data with its corresponding abnormal feature set, and determine the proportion of each abnormal data feature in its corresponding abnormal feature set based on the matching results; count the frequency of each abnormal data feature in the historical financial data; determine the feature weight of each abnormal data feature based on the proportion and the frequency, referring to the following formula:

[0072] N=(α*y i +β*n i ) / ∑(α*y j +β*n j );

[0073] Where N represents the weight of the i-th abnormal data feature after normalization; y i The frequency of the i-th anomalous data feature appearing in the historical financial data; n i α represents the proportion of the i-th anomalous data feature in the set of anomalous features; β represents the weighting coefficient corresponding to the frequency; y represents the weighting coefficient corresponding to the proportion; j This represents the frequency with which all anomalous data characteristics appear in the historical financial data; n j This indicates the proportion of all abnormal data features in the abnormal feature set;

[0074] Based on the feature weights, a feature weight matrix is ​​generated; based on the feature weight matrix, a matching confidence level is constructed.

[0075] Optionally, the behavior determination module is used for:

[0076] Based on the data category, key data matching the data in the preset database is identified; the key data is matched with the abnormal data features in the feature weight matrix to determine the overlap rate; the overlap rate is matched with the matching credibility level to determine the credibility level of the overlap rate; based on the credibility level, it is determined whether the real-time financial data represents an abnormal financial behavior.

[0077] Optionally, the data acquisition module is used for:

[0078] The system monitors the financial transaction behavior of several enterprises to determine if at least one enterprise's financial transaction behavior is potentially abnormal. If it is determined that at least one enterprise's financial transaction behavior is potentially abnormal, the system extracts the financial transaction data of the abnormal financial transaction behavior. The system retrieves the historical financial transaction data of the abnormal enterprise and compares it with the current financial transaction data to determine if there was an acquisition error. If the acquisition error exists, the system re-acquires real financial transaction data based on the abnormal financial transaction behavior. If the acquisition error does not exist, the system filters the financial transaction data based on the operating scale of the abnormal enterprise and the historical financial transaction data to determine the real-time financial data.

[0079] Optionally, the real-time financial data includes information on key personnel, and the behavior determination module is used for:

[0080] Based on the overlap rate, the categories of abnormal financial behaviors corresponding to key data with abnormal data characteristics are determined; the information of the main person in charge is analyzed, and the historical financial business of the main person in charge is determined according to the information analysis results; the historical financial business is analyzed, and the business overlap rate between the historical financial business and the set of several abnormal features is determined according to the business analysis results; the business overlap rate is compared with a preset overlap threshold, and the presence of abnormal financial behavior in the historical financial business is determined according to the overlap comparison results; if the business overlap rate is lower than the preset overlap threshold, the historical financial business is determined not to have abnormal financial behavior; the credibility level is adjusted according to the business overlap rate and the overlap rate, and the real-time financial data is determined to represent an abnormal financial behavior according to the adjusted credibility level.

[0081] Optionally, the reporting and early warning module is used for:

[0082] Analyze the abnormal financial behavior to determine the operational process for the abnormal financial behavior; determine the handling method for the abnormal financial behavior based on the operational process; incorporate the handling method into the report information to obtain adjusted report information; and issue an early warning based on the adjusted report information.

[0083] Optionally, the abnormal financial behavior analysis system further includes an early warning analysis module, used for:

[0084] The system obtains the number of warnings for the abnormal financial behavior within a preset time range; compares the number of warnings with a preset high-frequency threshold; if the number of warnings is higher than the preset high-frequency threshold, it obtains warning feedback; based on the warning feedback, it determines whether the abnormal financial behavior has been processed; if it is determined that the abnormal financial behavior has been processed, it analyzes the warning feedback; based on the warning analysis results and the number of warnings, it determines whether the abnormal financial behavior is a regular financial behavior; if it is determined that the abnormal financial behavior is a regular financial behavior, it adjusts the matching credibility level based on the real-time financial data.

[0085] Optionally, the abnormal financial behavior analysis system further includes a level adjustment module, used for:

[0086] Acquire and analyze financial market data; based on the analysis results, determine whether new abnormal financial behaviors exist in the financial market; if such new abnormal financial behaviors exist, acquire new abnormal financial transaction data of such behaviors; extract data features from the new abnormal financial transaction data to obtain abnormal new data features; determine the category of the new abnormal financial behaviors based on the abnormal new data features; adjust the feature weight matrix based on the category and the abnormal new data features to obtain an adjusted feature weight matrix; adjust the matching confidence level based on the adjusted feature weight matrix.

[0087] Compared with the prior art, the present invention has the following outstanding technical effects:

[0088] This invention can acquire financial data in real time and analyze it instantly to quickly identify potential abnormal financial behaviors. Through a pre-set database and matching algorithm, it automatically extracts and matches features from real-time financial data, reducing manual intervention and improving processing efficiency. By using pre-set matching thresholds and the database, it accurately determines whether real-time financial data represents abnormal financial behavior, reducing the possibility of false positives and false negatives. When abnormal financial behavior is detected, it automatically generates a report and issues an early warning, providing crucial evidence for subsequent supervision and investigation. Attached Figure Description

[0089] Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of the present invention;

[0090] Figure 2 A flowchart illustrating an abnormal financial behavior analysis method based on a deep learning model, as provided in an embodiment of the present invention;

[0091] Figure 3 This is a schematic diagram of the structure of an abnormal financial behavior analysis system based on a deep learning model, provided in an embodiment of the present invention. Detailed Implementation

[0092] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0093] The embodiments of the present invention will now be described in further detail with reference to the accompanying drawings.

[0094] Because abnormal financial activities are often highly concealed and take many forms, identifying their abnormal nature is difficult. Therefore, this invention provides a method and system for analyzing abnormal financial behavior based on a deep learning model. It acquires and analyzes financial data in real time to quickly identify potential abnormal financial behaviors. Through a pre-set database and matching algorithm, it automatically extracts and matches features from real-time financial data, reducing manual intervention and improving processing efficiency. By using pre-set matching thresholds and the database, it accurately determines whether real-time financial data represents abnormal financial behavior, reducing the possibility of false positives and false negatives. When abnormal financial behavior is detected, it automatically generates a report and issues an early warning, providing important evidence for subsequent supervision and investigation.

[0095] Figure 1 This is a schematic diagram illustrating an application scenario provided in this embodiment. To reduce the occurrence of abnormal financial activities, the solution provided by this invention can be used for early warning. The solution of this invention can be installed on any server, acquiring real-time financial data from enterprise devices via a financial data API, analyzing and processing it to determine whether abnormal financial activities are occurring. If so, a report is directly generated and sent to relevant departments as an early warning. This reduces the possibility of false alarms and missed alarms, providing important evidence for subsequent supervision and investigation. Specific implementation methods can be found in the following embodiments.

[0096] Figure 2 This is a flowchart illustrating an abnormal financial behavior analysis method based on a deep learning model, provided as an embodiment of the present invention. The method of this embodiment can be applied to servers in the above scenarios. For example... Figure 2As shown, this method includes:

[0097] S201. Obtain real-time financial data, extract information from the real-time financial data, and determine the data category of the real-time financial data based on the extraction results.

[0098] Real-time financial data can be considered as the financial data published in the financial market at the current moment. This data is publicly available and can include stock trading data, futures trading data, foreign exchange trading data, etc.

[0099] Specifically, after a transaction, companies can directly access real-time financial data using a pre-configured financial data API. Once the real-time financial data is obtained, text classification technology can be used for initial organization. Then, natural language processing technology is used to extract information from the organized data, such as stock names, company names, and personal information. The extracted content is then identified and categorized according to data classification standards to determine the data category to which each part of the real-time financial data belongs.

[0100] S202. Based on the data category, extract data features from the real-time financial data, match the extracted results with data in the preset database, and obtain the matching degree.

[0101] The preset database can be considered as a database containing abnormal financial behavior and its data characteristics; the matching degree can be the degree to which real-time financial data matches the data characteristics of abnormal financial behavior.

[0102] Specifically, after obtaining real-time financial data, the data is cleaned to remove errors. Then, through data format conversion and unit unification, the processed data is analyzed and filtered using machine learning algorithms and other technologies to extract and filter features. After obtaining the data features of the real-time financial data, it is matched with the abnormal financial behavior data features in a preset database. If some data features of the real-time financial data match the abnormal financial behavior data features in the preset database, the proportion of this part of the data in the entire real-time financial data is determined, thus obtaining the matching degree.

[0103] S203. Compare the matching degree with the preset matching threshold, and determine whether the real-time financial data represents an abnormal financial behavior based on the comparison result.

[0104] The preset matching threshold can be the critical value for matching this portion of data that conforms to the characteristics of abnormal financial behavior in real-time financial data. Since financial data exists in different data categories, different preset matching thresholds can be set according to the data characteristics corresponding to the data in each data category.

[0105] Specifically, the matching degree obtained in step S202 is compared with a preset matching threshold to determine whether the matching degree exceeds the preset matching threshold. If it exceeds the threshold, it can be considered that there are many abnormal financial behavior data features in the real-time financial data, and it can be inferred that the real-time financial data can represent an abnormal financial behavior. If it does not exceed the threshold, it can be considered that some data in the real-time financial data may differ from the current situation of the enterprise, but this may be due to the development of the enterprise.

[0106] In a specific implementation, if each data category has a corresponding preset matching threshold, a preset quantity threshold can be set for the number of data exceeding the preset matching threshold of the corresponding data category. If the number of data exceeding the preset matching threshold of the corresponding data category also exceeds the preset quantity threshold, it can be inferred that the real-time financial data can represent an abnormal financial behavior.

[0107] S204. If the matching degree exceeds the preset matching threshold, the real-time financial data is determined to represent an abnormal financial behavior. Based on the comparison results, matching degree, data category, and real-time financial data, a report is generated, and an early warning is issued based on the report.

[0108] The report information can be considered as a report generated when real-time financial data is determined to characterize an abnormal financial behavior, which can be used by relevant personnel to understand the actual situation. In specific implementation methods, a detailed description can be given to the part of the data that matches the characteristics of the abnormal financial behavior, such as its corresponding data category and the data content of that part of the data.

[0109] Specifically, if the matching degree exceeds a preset matching threshold, it can be considered that most of the financial data in this real-time financial data conforms to the characteristics of abnormal financial behavior data. In this case, this real-time financial data can be used to characterize an abnormal financial behavior. In a specific implementation, a portion of the data that conforms to the characteristics of abnormal financial behavior data can be matched with abnormal financial behaviors in a preset database. Based on the matching results, it can be determined which abnormal financial behavior the real-time financial data can characterize.

[0110] To address the identified abnormal financial activities, reports can be generated based on the comparison results, matching degree, data categories, and real-time financial data. This allows relevant regulatory authorities to clearly define the areas requiring action and thus provide early warnings. For example, detailed information such as timestamps and specific values ​​can be determined from the real-time financial data; specific matching items can be identified based on the comparison results and matching degree; and the type, impact, and potential risks of the abnormal financial activity can be determined based on the detailed information, data categories, and matching degree.

[0111] The method provided by this invention enables real-time acquisition and analysis of financial data, quickly identifying potential abnormal financial behaviors. Through a pre-set database and matching algorithm, real-time financial data is automatically extracted and matched, reducing manual intervention and improving processing efficiency. Pre-set matching thresholds and the database accurately determine whether real-time financial data represents abnormal financial behavior, reducing the possibility of false positives and false negatives. When abnormal financial behavior is detected, a report is automatically generated and an early warning is issued, providing crucial evidence for subsequent supervision and investigation.

[0112] In some embodiments, historical financial data is acquired, analyzed based on domain knowledge, and its completeness is determined. If the historical financial data is incomplete, domain knowledge input and correction are acquired, and the historical financial data is adjusted to obtain complete historical financial data. The complete historical financial data is then classified based on whether the historical financial transaction behavior is abnormal. Based on the classification results, abnormal historical financial data is identified and extracted. Based on the extraction results, abnormal data characteristics are determined. Based on the abnormal data characteristics, a matching credibility level is constructed. The matching degree is matched with the matching credibility level to determine the credibility level of the real-time financial data. Based on the credibility level, it is determined whether the real-time financial data represents an abnormal financial behavior.

[0113] Historical financial data can be considered as financial data that has occurred up to the present moment and has produced analytical results to determine whether it constitutes abnormal financial behavior. This historical financial data can be obtained through professional financial platforms or other channels.

[0114] Domain knowledge can be considered to encompass everything that might be involved in the financial field, such as knowledge of stock trading.

[0115] The input and correction of domain knowledge can be considered as the supplementation and adjustment of historical financial data when some historical financial data is incomplete. This can be obtained based on domain knowledge. After determining the corresponding input and correction, the missing data can be retrieved and the erroneous data can be corrected based on the source of the historical financial data.

[0116] Historical financial transaction behavior can be considered as the financial transaction behavior represented by each historical financial data point.

[0117] Historical abnormal financial data can be considered as financial data that has been identified as an abnormal financial behavior.

[0118] Abnormal data features can be considered as data features that characterize abnormal financial behavior after extracting historical abnormal financial data.

[0119] The matching credibility level can be considered as the credibility level of the real-time financial data obtained above. It can be achieved by setting multiple preset matching thresholds, from smallest to largest. The higher the matching degree, the lower the credibility level of the real-time financial data, and the more likely it is to represent an abnormal financial behavior. This matching credibility level can be set by the proportion of data features belonging to abnormal financial behavior among all abnormal financial behaviors.

[0120] Specifically, historical financial data is acquired, and then, based on domain knowledge, it is determined whether the acquired historical financial data contains missing or erroneous parts. If so, the domain knowledge is used as input and correction, and the missing or erroneous parts are extracted based on the original content to adjust the data and obtain complete historical financial data. For example, if a piece of historical financial data lacks a company name and the corresponding transaction amount section only lists the transaction details, then it can be considered that the historical financial data has a missing company name and an incorrect transaction amount.

[0121] After obtaining complete historical financial data, based on the results of the analysis (i.e., the conclusion regarding whether it constitutes abnormal financial behavior), the complete historical financial data is categorized to obtain historical abnormal financial data. This data is then extracted. For ease of subsequent application, the historical abnormal financial data can be first categorized according to data types, and then extracted based on these categories. This ensures that the extracted abnormal data features belong to the corresponding data categories, facilitating subsequent matching and confidence level construction.

[0122] After obtaining the anomalous data features using the above methods, the matching credibility level can be constructed based on the number of anomalous data features contained in these combinations. For example, the combination of anomalous data features A, B, and C represents an existing and already identified anomalous financial behavior, but the combination of anomalous data features A and B alone is not considered an anomalous financial behavior. In this case, based on the corresponding data category, it can be determined which anomalous data feature combinations can be considered anomalous financial behavior and which combinations will not. The more anomalous data features there are, the lower the matching credibility level.

[0123] The solution provided in this embodiment performs integrity checks on historical financial data, ensuring its accuracy and reliability. This makes the analysis results more consistent with reality and provides a foundation for subsequent analysis. By constructing a matching credibility level based on the characteristics of abnormal data and combining it with the matching degree of real-time financial data, the credibility of real-time financial data is evaluated. This improves the accuracy and reliability of the analysis, enabling timely detection and early warning of potential abnormal financial behavior, and providing decision support for regulatory agencies.

[0124] In some embodiments, abnormal data features are analyzed, and the data characteristics of each abnormal data feature are determined based on the feature analysis results. Based on these characteristics, the abnormal data features are classified to obtain several abnormal feature sets. Each historical abnormal financial data point is matched with its corresponding abnormal feature set, and the proportion of each abnormal data feature in its corresponding abnormal feature set is determined based on the matching results. The frequency of each abnormal data feature in the historical financial data is statistically analyzed. Based on the proportion and frequency, the feature weight of each abnormal data feature is determined, and a feature weight matrix is ​​generated based on the feature weight matrix. Finally, a matching confidence level is constructed based on the feature weight matrix.

[0125] Data characteristics can be considered as the data structure of the abnormal data, such as tabular data, text data, etc.; and the data type, such as banking business data, securities business data, insurance business data, etc.

[0126] An anomaly feature set can be considered as a set of anomaly data features of the same type.

[0127] Specifically, the extracted abnormal data features are analyzed to determine the data characteristics corresponding to each abnormal data feature. Based on these characteristics, the abnormal data features are classified to obtain a corresponding abnormal feature set. Each historical abnormal financial data is matched with its corresponding abnormal feature set. Based on the matching results, the proportion of each abnormal data feature in its corresponding abnormal feature set is determined. Simultaneously, the frequency of each abnormal data feature appearing in historical abnormal data is calculated. Then, based on the proportion and frequency, the feature weight of each abnormal data feature is determined, referring to the following formula (1):

[0128] N=(α*y i +β*n i ) / ∑(α*y j +β*n j (1)

[0129] Where N represents the weight of the i-th outlier feature after normalization; y i The frequency of the i-th outlier feature in historical financial data is represented by n. i y represents the proportion of the i-th outlier feature in the outlier feature set; α represents the weight coefficient corresponding to the frequency; β represents the weight coefficient corresponding to the proportion; y j This represents the frequency of all outlier data features in historical financial data; n j This represents the proportion of all abnormal data features in the abnormal feature set.

[0130] After obtaining the feature weights corresponding to each abnormal data feature, a corresponding feature weight matrix is ​​generated. Based on this feature weight matrix, the weighted matching degree between the feature type of each abnormal data feature and the corresponding feature in the feature weight matrix is ​​calculated. The obtained weighted matching degree is then standardized, and the above-mentioned matching confidence level is constructed based on the processed weighted matching degree.

[0131] For example, if the standardized weighted match score is >= 0.9, the credibility level is "low"; if 0.5 <= standardized weighted match score < 0.9, the credibility level is "medium"; and if the standardized weighted match score < 0.5, the credibility level is "high".

[0132] The solution provided in this embodiment performs in-depth analysis of anomalous data features, identifies data characteristics, and categorizes these features into multiple anomalous feature sets. By statistically analyzing the frequency of each anomalous data feature in historical financial data and combining this with the feature's proportion within the set, the feature weight is determined, providing a more comprehensive reflection of the feature's importance. The matching credibility level constructed based on the feature weight matrix provides a quantitative basis for assessing the credibility of real-time financial data, helping to more accurately identify anomalous financial behavior.

[0133] In some embodiments, based on the data category, key data that matches data in a preset database is determined; the key data is matched with abnormal data features in the feature weight matrix to determine the overlap rate; the overlap rate is matched with the matching credibility level to determine the credibility level of the overlap rate; and based on the credibility level, it is determined whether the real-time financial data represents an abnormal financial behavior.

[0134] Key data can be considered as distinctive data in real-time financial data. In the signing of some contracts, there are usually some common contents, such as precautions. In the specific implementation, if certain transactions are related to the contents of the precautions, then the relevant precautions can also be regarded as key data.

[0135] The overlap rate can be considered as the degree of overlap between the abnormal parts of real-time financial data and the aforementioned set of abnormal features.

[0136] Specifically, based on the data categories identified above, key data points in the real-time financial data that match the characteristics of abnormal financial behavior data in the preset database are obtained. These key data points are then matched with the abnormal data features in the feature weight matrix to determine the overlap rate. The overlap rate is then matched with a matching confidence level to determine the confidence level of the overlap rate. Based on the confidence level, it is determined whether the real-time financial data represents an abnormal financial behavior.

[0137] In a specific implementation, if three matching confidence levels are constructed based on the aforementioned feature weight matrix, and the overlap rate is higher than the second level, then the real-time financial data can be considered to characterize an abnormal financial behavior.

[0138] The solution provided in this embodiment categorizes real-time financial data according to its content, identifying key data that allows for more focused and precise subsequent analysis. Based on data feature types, key data is matched with anomaly data features, improving the accuracy and relevance of the analysis. By calculating the overlap rate and matching it with the matching credibility level, a quantitative credibility assessment method is provided for the analysis of real-time financial data.

[0139] In some embodiments, the financial transaction behavior of several enterprises is monitored to determine whether there is any possibility of anomalies in the financial transaction behavior of at least one enterprise. If it is determined that there is a possibility of anomalies in the financial transaction behavior of at least one enterprise, the financial transaction data of the abnormal financial transaction behavior is extracted. The historical financial transaction data of the abnormal enterprise is retrieved, and the historical financial transaction data is compared with the real financial transaction data to determine whether there is an acquisition operation error. If there is an acquisition operation error, the real financial transaction data is re-acquired based on the abnormal financial transaction behavior. If there is no acquisition operation error, the financial transaction data is filtered based on the operating scale and historical financial transaction data of the abnormal enterprise to determine the real-time financial data.

[0140] Financial transaction data can be considered as financial data generated during financial transactions; historical financial transaction data can be considered as financial data generated after transactions have been completed.

[0141] Before acquiring real-time financial data, a data collection system can be built to collect corporate financial data in real time. During collection, monitoring can be based on the company's size and business scope. If financial transactions that are inconsistent with the company's size or business scope occur, the company's financial transactions can be considered abnormal. In this case, the company can be identified as an abnormal company, and its financial data can be acquired to analyze whether the company is engaging in abnormal financial activities.

[0142] When acquiring the financial transaction data of an abnormal company, its historical financial transaction data is retrieved and compared to determine if there was an operational error. If the discrepancy in transaction amounts is significant, it can be considered an operational error, and the data acquisition process can be repeated. If no operational error is found, the financial transaction data is filtered based on the abnormal company's operating scale and historical financial transaction data to determine the real-time financial data.

[0143] The solution provided in this embodiment compares the historical financial transaction data of abnormal enterprises with the current financial transaction data, which helps to identify operational errors or abnormal patterns. When an operational error is detected, the accurate financial transaction data can be retrieved again, ensuring data accuracy. Filtering financial transaction data based on the operating scale and historical data of abnormal enterprises helps to focus on key information and improve analysis efficiency.

[0144] In some embodiments, based on the overlap rate, the categories of abnormal financial behaviors corresponding to key data with abnormal data characteristics are determined; the information of the principal responsible person is analyzed, and the historical financial business of the principal responsible person is determined according to the information analysis results; the historical financial business is analyzed, and the business overlap rate between the historical financial business and several abnormal feature sets is determined according to the business analysis results; the business overlap rate is compared with a preset overlap threshold, and the existence of abnormal financial behavior in the historical financial business is determined according to the overlap comparison results; if the business overlap rate is lower than the preset overlap threshold, it is determined that there is no abnormal financial behavior in the historical financial business; the credibility level is adjusted according to the business overlap rate and the overlap rate, and the real-time financial data is determined to represent an abnormal financial behavior according to the adjusted credibility level.

[0145] Real-time financial data includes information on key personnel. This information can include basic details such as gender and age. By analyzing the historical financial data, it is possible to identify which historical financial transactions were handled by this key person.

[0146] Business overlap rate can be considered as the ratio of the portion of financial data in historical financial transactions that overlaps with the abnormal data features in the abnormal feature set to that historical financial transaction.

[0147] The preset overlap threshold can be considered as the maximum overlap ratio. If it exceeds this preset overlap threshold, the historical financial transaction can be considered an abnormal financial behavior.

[0148] Based on the overlap rate of business transactions, we can infer the probability that the key person in charge may engage in abnormal financial activities. By combining this with the overlap rate of real-time financial data, we can determine the probability of engaging in abnormal financial activities in this instance, and thus comprehensively analyze the credibility level of the real-time financial data.

[0149] In the specific implementation, the impact of the probability that the principal person in charge may engage in abnormal financial behavior on the credibility level can be analyzed and determined by corresponding weights, which can be set by professionals in the financial field.

[0150] The solution provided in this embodiment uses the overlap rate as a quantitative indicator to objectively and accurately assess the degree of matching between key data and the set of abnormal features, providing a strong basis for determining the category of abnormal financial behavior. By analyzing the historical financial transactions of key personnel and comparing them with the set of abnormal features, the business overlap rate is determined. Adjusting the credibility level based on the business overlap rate helps to more accurately assess whether real-time financial data represents abnormal financial behavior, improving the reliability of the analysis.

[0151] In some embodiments, abnormal financial behavior is analyzed to determine the operational procedures for abnormal financial behavior; based on the operational procedures, the handling methods for abnormal financial behavior are determined; the handling methods are incorporated into the reporting information to obtain adjusted reporting information; and warnings are issued based on the adjusted reporting information.

[0152] The operational process can be considered as the operational process that the abnormal financial behavior wants to achieve. It may include some routine operations, such as contract signing and money transfer, or some special operations, such as private transfers within a short period of time.

[0153] The handling methods can be considered as measures taken to prevent abnormal financial behavior and to deal with abnormal individuals, such as initiating internal investigations and freezing accounts.

[0154] Since the pre-set database already contains corresponding abnormal financial behaviors and their abnormal data characteristics, these abnormal financial behaviors can all be considered as already occurring and confirmed actions. The relevant regulatory authorities should have already identified the operation of the abnormal financial behavior and implemented corresponding handling measures. These corresponding operational procedures and handling measures can also be stored in the pre-set database. If an abnormal financial behavior is determined through the above embodiments, a search can be performed in the pre-set database according to the operational procedures of the abnormal financial behavior to determine the corresponding handling method and include it in the reporting information for early warning.

[0155] The solution provided in this embodiment, through detailed analysis of the operational process of abnormal financial behavior, allows for a clear understanding of the entire chain of such behavior, facilitating the identification of potential risks and vulnerabilities. The processing methods determined based on the operational process are more precise, enabling the development of effective countermeasures for each stage of abnormal financial behavior, thus improving the targeting and effectiveness of supervision. Incorporating the processing methods into the reporting information makes the report more comprehensive and detailed, providing regulatory agencies and relevant departments with richer decision-making support.

[0156] In some embodiments, the number of warnings for abnormal financial behavior within a preset time range is obtained; the number of warnings is compared with a preset high-frequency threshold; if the number of warnings is higher than the preset high-frequency threshold, warning feedback is obtained; based on the warning feedback, it is determined whether the abnormal financial behavior has been handled; if it is determined that the abnormal financial behavior has been handled, the warning feedback is analyzed; based on the warning analysis results and the number of warnings, it is determined whether the abnormal financial behavior is a regular financial behavior; if it is determined that the abnormal financial behavior is a regular financial behavior, the matching credibility level is adjusted based on real-time financial data.

[0157] The preset time range can be considered as a period of time after the occurrence or discovery of abnormal financial behavior. Since there is a certain time interval between a company's financial transactions, this preset time range can be set relatively long, such as one month or one quarter. In this embodiment, there is no restriction, and it can be set according to the average frequency of financial transactions of the corresponding type of company.

[0158] Early warning feedback can be considered as the measures taken by relevant departments in response to an early warning. To ensure the effectiveness of the early warning, relevant departments can be required to provide feedback after taking measures. The early warning feedback can include the specific measures taken and the final results. It can also include the performance of the personnel involved in the abnormal financial activities.

[0159] The preset high-frequency threshold can be considered the maximum number of warnings. If the number of warnings exceeds this preset high-frequency threshold, it indicates that the frequency of currently confirmed abnormal financial behavior is too high. This may be due to misjudgment, or it may be that some individuals ignore the warnings and continue to engage in abnormal behavior.

[0160] Routine financial activities can be considered normal financial activities that do not violate relevant regulations and laws.

[0161] Specifically, after issuing an alert, the system obtains the number of alerts for the abnormal financial behavior within a preset time range and compares it with a preset high-frequency threshold to determine if the number of alerts exceeds the threshold. If it does, it obtains the alert feedback from relevant departments after processing to determine if the departments have addressed the abnormal financial behavior. If they have, it analyzes the alert feedback to determine whether the abnormal financial behavior is a routine financial behavior based on the alert analysis results and the number of alerts. For example, if the person involved communicates smoothly with relevant department personnel and performs well, but the alert still occurs, the communication record can be sent to the relevant departments to determine the communication results and thus judge whether the determination of the abnormal financial behavior is accurate. If accurate, the relevant departments continue to issue alerts and the handling method is strengthened. If inaccurate, the abnormal financial behavior can be considered a routine financial behavior. In this case, the constructed matching credibility level needs to be adjusted, such as adjusting the results formed by the abnormal data features corresponding to the abnormal financial behavior, thereby achieving a new combination and reconstructing the matching credibility.

[0162] The solution in this embodiment, by comparing the number of warnings with a preset high-frequency threshold, can quantitatively assess the frequency of abnormal financial behavior, providing clear data support for subsequent analysis and decision-making. When the number of warnings exceeds the high-frequency threshold, timely warning feedback can be obtained, ensuring that abnormal financial behavior is dealt with quickly and reducing potential risks. After determining that the abnormal financial behavior is a regular financial behavior, adjusting the matching credibility level based on real-time financial data helps improve the accuracy and reliability of subsequent analysis.

[0163] In some embodiments, financial market data is acquired and analyzed, and based on the analysis results, it is determined whether new abnormal financial behaviors exist in the financial market; if new abnormal financial behaviors exist, new abnormal financial transaction data of the new abnormal financial behaviors are acquired; data features are extracted from the new abnormal financial transaction data to obtain abnormal new data features; based on the abnormal new data features, the category of the new abnormal financial behaviors is determined; based on the category and the abnormal new data features, the feature weight matrix is ​​adjusted to obtain the adjusted feature weight matrix; based on the adjusted feature weight matrix, the matching confidence level is adjusted.

[0164] New types of abnormal financial behavior can be considered as abnormal financial behavior that is different from historical abnormal financial behavior that has occurred in the current financial market.

[0165] Abnormal new data features can be considered as abnormal data features used to characterize new abnormal financial behaviors.

[0166] The solution provided in this embodiment, through data feature extraction and anomaly feature analysis, can accurately identify novel abnormal data features of new types of abnormal financial behavior, providing a strong basis for determining the category of abnormal financial behavior. Based on the category of the novel abnormal financial behavior and the abnormal data features, the feature weight matrix is ​​adjusted, thereby optimizing the accuracy and efficiency of subsequent analysis. The adjusted feature weight matrix, by adjusting the matching confidence level, helps to more accurately assess the legality of financial transactions and improve the reliability of the analysis.

[0167] In other embodiments, deep learning models can also be used to determine whether real-time financial data represents an abnormal financial behavior. First, historical financial data can be divided into training and testing samples. The training samples are then labeled using a PU-Learning method, as detailed below:

[0168] 1. Set up an abnormal financial market behavior set P (all detected abnormal financial market behaviors) and an unlabeled set U (all samples not yet identified as abnormal behaviors, including both legitimate and abnormal behaviors); 2. Train a random forest model using set P as positive samples and set U as negative samples; 3. Apply the trained classification model to sets P and U to estimate the probability that each sample in each set is identified as an abnormal financial behavior; 4. Use isotonic regression... The regression technique is used to calibrate the probabilities obtained in step 4; 5. Samples in set U with a probability greater than 1 / 2 of being identified as abnormal financial market behavior are classified as reliable positive samples RP; 6. The probability of samples in set P being identified as abnormal financial market behavior is also estimated, and the mean probability corresponding to the minimum probability of 3% is determined as the lower limit of the probability threshold m. m equals 0.01%, which means that all U set samples with an estimated identification probability of less than 0.01% are considered reliable negative samples; 7. A new positive sample set P+RP and a negative sample set RN are obtained by summarizing, and the remaining samples that may have label confusion are deleted.

[0169] After obtaining the newly labeled training samples, the resulting negative sample set RN and reliable positive sample set RP are trained using Support Vector Machine (SVM), Random Forest (RF), and XGBoost algorithms respectively, resulting in three trained models.

[0170] When real-time financial data is available, it is input into the three trained models mentioned above. The results of the three models are then used to make a comprehensive judgment on whether the real-time financial data can represent an abnormal financial behavior.

[0171] It should be noted that the numbers involved in the above embodiments are all examples and are not intended to be limiting in any of the above embodiments. The specific settings can be made according to the actual situation.

[0172] Figure 3 This is a schematic diagram of the structure of an abnormal financial behavior analysis system based on a deep learning model, as provided in an embodiment of the present invention. Figure 3 As shown, the abnormal financial behavior analysis system 300 based on a deep learning model in this embodiment includes: a data acquisition module 301, a data matching module 302, a behavior determination module 303, and a reporting and early warning module 304.

[0173] The data acquisition module 301 is used to acquire real-time financial data, extract information from the real-time financial data, and determine the data category of the real-time financial data based on the extraction results.

[0174] The data matching module 302 is used to extract data features from the real-time financial data according to the data category, and match the extraction results with data in a preset database to obtain the matching degree.

[0175] The behavior determination module 303 is used to compare the matching degree with a preset matching threshold, and determine whether the real-time financial data is an abnormal financial behavior based on the comparison result.

[0176] The report warning module 304 is used to determine that the real-time financial data is an abnormal financial behavior if the matching degree exceeds a preset matching threshold, and to generate report information based on the comparison result, the matching degree, the data category, and the real-time financial data, and to issue a warning based on the report information.

[0177] Optionally, the abnormal financial behavior analysis system 300 further includes a level construction module 305, used for:

[0178] The process involves acquiring historical financial data, analyzing it based on domain knowledge to determine its completeness, and if incomplete, obtaining domain knowledge input and corrections to adjust the data and obtain complete historical financial data. The complete historical financial data is then categorized based on whether the historical financial transactions constitute abnormal financial transactions. Based on the categorization results, abnormal historical financial data is identified and extracted. Abnormal data characteristics are determined based on the extraction results. A matching credibility level is constructed based on the abnormal data characteristics. The process of comparing the matching degree with a preset matching threshold and determining whether the real-time financial data represents an abnormal financial behavior includes: matching the matching degree with the matching credibility level to determine the credibility level of the real-time financial data; and determining whether the real-time financial data represents an abnormal financial behavior based on the credibility level.

[0179] Optionally, the level construction module 305 is used for:

[0180] Analyze the abnormal data features, and based on the feature analysis results, determine the data characteristics of each abnormal data feature; classify the abnormal data features according to the data characteristics to obtain several abnormal feature sets; match each historical abnormal financial data with its corresponding abnormal feature set, and determine the proportion of each abnormal data feature in its corresponding abnormal feature set based on the matching results; count the frequency of each abnormal data feature in the historical financial data; determine the feature weight of each abnormal data feature based on the proportion and the frequency, referring to the following formula:

[0181] N=(α*y i +β*n i ) / Σ(α*y j +β*n j );

[0182] Where N represents the weight of the i-th abnormal data feature after normalization; y i The frequency of the i-th anomalous data feature appearing in the historical financial data; n i α represents the proportion of the i-th anomalous data feature in the set of anomalous features; β represents the weighting coefficient corresponding to the frequency; y represents the weighting coefficient corresponding to the proportion; j This represents the frequency with which all anomalous data characteristics appear in the historical financial data; n j This indicates the proportion of all abnormal data features in the abnormal feature set;

[0183] Based on the feature weights, a feature weight matrix is ​​generated; based on the feature weight matrix, a matching confidence level is constructed.

[0184] Optionally, the behavior determination module 303 is used for:

[0185] Based on the data category, key data matching the data in the preset database is identified; the key data is matched with the abnormal data features in the feature weight matrix to determine the overlap rate; the overlap rate is matched with the matching credibility level to determine the credibility level of the overlap rate; based on the credibility level, it is determined whether the real-time financial data represents an abnormal financial behavior.

[0186] Optionally, the data acquisition module 301 is used for:

[0187] The system monitors the financial transaction behavior of several enterprises to determine if at least one enterprise's financial transaction behavior is potentially abnormal. If it is determined that at least one enterprise's financial transaction behavior is potentially abnormal, the system extracts the financial transaction data of the abnormal financial transaction behavior. The system retrieves the historical financial transaction data of the abnormal enterprise and compares it with the current financial transaction data to determine if there was an acquisition error. If the acquisition error exists, the system re-acquires real financial transaction data based on the abnormal financial transaction behavior. If the acquisition error does not exist, the system filters the financial transaction data based on the operating scale of the abnormal enterprise and the historical financial transaction data to determine the real-time financial data.

[0188] Optionally, the real-time financial data includes information on key personnel, and the behavior determination module 303 is used for:

[0189] Based on the overlap rate, the categories of abnormal financial behaviors corresponding to key data with abnormal data characteristics are determined; the information of the main person in charge is analyzed, and the historical financial business of the main person in charge is determined according to the information analysis results; the historical financial business is analyzed, and the business overlap rate between the historical financial business and the set of several abnormal features is determined according to the business analysis results; the business overlap rate is compared with a preset overlap threshold, and the presence of abnormal financial behavior in the historical financial business is determined according to the overlap comparison results; if the business overlap rate is lower than the preset overlap threshold, the historical financial business is determined not to have abnormal financial behavior; the credibility level is adjusted according to the business overlap rate and the overlap rate, and the real-time financial data is determined to represent an abnormal financial behavior according to the adjusted credibility level.

[0190] Optionally, the reporting and early warning module 304 is used for:

[0191] Analyze the abnormal financial behavior to determine the operational process for the abnormal financial behavior; determine the handling method for the abnormal financial behavior based on the operational process; incorporate the handling method into the report information to obtain adjusted report information; and issue an early warning based on the adjusted report information.

[0192] Optionally, the abnormal financial behavior analysis system 300 further includes an early warning analysis module 306, used for:

[0193] The system obtains the number of warnings for the abnormal financial behavior within a preset time range; compares the number of warnings with a preset high-frequency threshold; if the number of warnings is higher than the preset high-frequency threshold, it obtains warning feedback; based on the warning feedback, it determines whether the abnormal financial behavior has been processed; if it is determined that the abnormal financial behavior has been processed, it analyzes the warning feedback; based on the warning analysis results and the number of warnings, it determines whether the abnormal financial behavior is a regular financial behavior; if it is determined that the abnormal financial behavior is a regular financial behavior, it adjusts the matching credibility level based on the real-time financial data.

[0194] Optionally, the abnormal financial behavior analysis system 300 further includes a level adjustment module 307, used for:

[0195] Acquire and analyze financial market data; based on the analysis results, determine whether new abnormal financial behaviors exist in the financial market; if such new abnormal financial behaviors exist, acquire new abnormal financial transaction data of such behaviors; extract data features from the new abnormal financial transaction data to obtain abnormal new data features; determine the category of the new abnormal financial behaviors based on the abnormal new data features; adjust the feature weight matrix based on the category and the abnormal new data features to obtain an adjusted feature weight matrix; adjust the matching confidence level based on the adjusted feature weight matrix.

[0196] The system in this embodiment can be used to execute the methods of any of the above embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0197] The above embodiments are merely preferred embodiments of the present invention and should not be considered as limiting the scope of the present invention. All equivalent variations and improvements made within the scope of the present invention should still fall within the patent coverage of the present invention.

Claims

1. A method for analyzing abnormal financial behavior based on a deep learning model, characterized in that... Includes the following steps: 1) Acquire historical financial data, perform integrity analysis and correction on the acquired historical financial data, identify abnormal financial data through classification, extract abnormal features and establish credibility levels, specifically including: (1.1) Obtain historical financial data, analyze the historical financial data based on domain knowledge, and determine whether the historical financial data is complete; (1.2) If the historical financial data is incomplete, the input and correction of domain knowledge are obtained, and the historical financial data is adjusted according to the input and correction to obtain complete historical financial data. The complete historical financial data is then classified based on whether the historical financial transaction behavior is an abnormal financial transaction behavior. (1.3) Based on the classification results, identify historical abnormal financial data and extract the historical abnormal financial data. Based on the extraction results, determine the characteristics of the abnormal data. (1.4) Based on the characteristics of abnormal data, construct a matching confidence level, which specifically includes the following steps: (1.4.1) Analyze the characteristics of abnormal data, and determine the data features of each abnormal data feature based on the results of the feature analysis; (1.4.2) Based on the characteristics of the data, the abnormal data features are classified to obtain several sets of abnormal features; (1.4.3) Match each historical abnormal financial data with the corresponding abnormal feature set, and determine the proportion of each abnormal data feature in the corresponding abnormal feature set based on the matching results. (1.4.4) Calculate the frequency of each abnormal data feature in historical financial data; (1.4.5) Determine the feature weight of each abnormal data feature based on its proportion and frequency, referring to the following formula: N=(α*y i +β*n i ) / ∑(α*y j +β*n j ); Where N represents the weight of the i-th outlier feature after normalization; y i The frequency of the i-th outlier feature in historical financial data is represented by n. i y represents the proportion of the i-th outlier feature in the outlier feature set; α represents the weight coefficient corresponding to the frequency; β represents the weight coefficient corresponding to the proportion; y j This represents the frequency of all outlier data features in historical financial data; n j This represents the proportion of all abnormal data features in the abnormal feature set; (1.4.6) Generate the feature weight matrix based on the feature weights; (1.4.7) Construct the matching confidence level based on the feature weight matrix; 2) Acquire real-time financial data, extract information from the real-time financial data, and determine the data category of the real-time financial data based on the extraction results; 3) Based on the data category, extract data features from the real-time financial data, and match the extraction results with data in a preset database to obtain the matching degree; the preset database is a database containing abnormal financial behavior and abnormal financial behavior data features; 4) Compare the matching degree with a preset matching threshold, and determine whether the real-time financial data represents an abnormal financial behavior based on the comparison result; 5) If the matching degree exceeds the preset matching threshold, the real-time financial data is determined to represent an abnormal financial behavior, and a report is generated based on the comparison result, the matching degree, the data category, and the real-time financial data, and an early warning is issued based on the report.

2. The method for analyzing abnormal financial behavior based on a deep learning model as described in claim 1, characterized in that... In step 1), section (1.4.7), after constructing the matching credibility level based on the feature weight matrix, a dynamic monitoring and self-evolving financial regulatory mechanism is established, including the following steps: This process involves acquiring and analyzing financial market data to determine if abnormal financial behavior exists. If abnormal financial behavior is found, abnormal financial transaction data is acquired. Data features are extracted from this abnormal financial transaction data to obtain abnormal data characteristics. Based on these characteristics, the category of abnormal financial behavior is determined. The feature weight matrix is ​​adjusted according to the category and abnormal data characteristics to obtain an adjusted feature weight matrix. The matching credibility level is then adjusted based on the adjusted feature weight matrix. Through data feature extraction and abnormal feature analysis, the abnormal data characteristics of abnormal financial behavior can be accurately identified, providing a strong basis for determining the category of abnormal financial behavior. Adjusting the feature weight matrix based on the category and abnormal data characteristics optimizes the accuracy and efficiency of subsequent analysis. Adjusting the matching credibility level using the adjusted feature weight matrix helps to more accurately assess the legality of financial transaction behavior and improves the reliability of the analysis.

3. The method for analyzing abnormal financial behavior based on a deep learning model as described in claim 1, characterized in that... In step 2), the acquisition of real-time financial data, the extraction of information from the real-time financial data, and the determination of the data category of the real-time financial data based on the extraction results specifically include the following steps: (2.1) Monitor the financial transaction behavior of several enterprises to determine whether there is any possibility that the financial transaction behavior of at least one enterprise is abnormal; (2.2) If it is determined that at least one enterprise's financial transaction behavior is likely to be abnormal, then extract the financial transaction data of the abnormal financial transaction behavior; (2.3) Retrieve the historical financial transaction data of the abnormal enterprise, compare the historical financial transaction data of the abnormal enterprise with the financial transaction data of the abnormal financial transaction behavior, and determine whether there is an error in the acquisition operation. (2.4) If there is an operational error, real financial transaction data will be re-acquired based on the abnormal financial transaction behavior; if there is no operational error, financial transaction data will be screened based on the operating scale and historical financial transaction data of the abnormal enterprise to determine the real-time financial data.

4. The method for analyzing abnormal financial behavior based on a deep learning model as described in claim 1, characterized in that... In step 4), comparing the matching degree with a preset matching threshold and determining whether the real-time financial data represents an abnormal financial behavior based on the comparison result includes the following steps: (4.1) Based on the data category, identify the key data that matches the data in the preset database; (4.2) Match the key data with the abnormal data features in the feature weight matrix to determine the overlap rate; (4.3) Match the matching degree with the matching credibility level to determine the credibility level of real-time financial data; (4.4) Determine whether real-time financial data represents an abnormal financial behavior based on the credibility level.

5. The method for analyzing abnormal financial behavior based on a deep learning model as described in claim 4, characterized in that... The real-time financial data includes information on key personnel. In step (4.4), based on the confidence level, it is determined whether the real-time financial data represents an abnormal financial behavior, including the following steps: (4.4.1) Based on the overlap rate, determine the categories of abnormal financial behaviors corresponding to key data with abnormal data characteristics; (4.4.2) Analyze the information of the principal responsible persons and determine their historical financial business based on the analysis results; (4.4.3) Analyze historical financial transactions and, based on the results of the transaction analysis, determine the overlap rate between historical financial transactions and several sets of abnormal characteristics. (4.4.4) Compare the business overlap rate with the preset overlap threshold, and determine whether there are any abnormal financial behaviors in the historical financial business based on the overlap comparison results. (4.4.5) If the business overlap rate is lower than the preset overlap threshold, it is determined that there is no abnormal financial behavior in the historical financial business. (4.4.6) Adjust the credibility level based on the business overlap rate and the overlap rate, and determine whether the real-time financial data represents an abnormal financial behavior based on the adjusted credibility level.

6. The method for analyzing abnormal financial behavior based on a deep learning model as described in claim 1, characterized in that... In step 5), the step of issuing an early warning based on the reported information includes the following steps: (5.1) Analyze abnormal financial behavior and determine the operational procedures for abnormal financial behavior; (5.2) Determine the handling method for abnormal financial behavior based on the operating procedures; (5.3) Incorporate the processing method into the report information to obtain the adjusted report information; (5.4) Issue early warnings based on the adjusted report information.

7. The method for analyzing abnormal financial behavior based on a deep learning model as described in claim 1, characterized in that... It also includes the following steps: 6) Monitor financial market data. If abnormal financial behavior is detected, obtain relevant transaction data, extract its features, determine the behavior category, and optimize feature weights and matching reliability accordingly to enhance subsequent analysis capabilities. Specific steps are as follows: (6.1) Obtain the number of warnings for abnormal financial behavior within a preset time range; (6.2) Compare the number of warnings with the preset high-frequency threshold. If the number of warnings is higher than the preset high-frequency threshold, obtain warning feedback and determine whether the abnormal financial behavior has been dealt with based on the warning feedback. (6.3) If it is determined that the abnormal financial behavior has been dealt with, the early warning feedback is analyzed, and the abnormal financial behavior is determined to be a routine financial behavior based on the early warning analysis results and the number of early warnings. (6.4) If it is determined that the abnormal financial behavior is a regular financial behavior, the matching credibility level is adjusted based on real-time financial data.

8. A system for analyzing abnormal financial behavior based on a deep learning model, characterized in that... include: The data acquisition module is used to acquire real-time financial data, extract information from the real-time financial data, and determine the data category of the real-time financial data based on the extraction results, specifically: Historical financial data is acquired and analyzed based on domain knowledge to determine its completeness. If the historical financial data is incomplete, domain knowledge input and corrections are obtained, and the historical financial data is adjusted to obtain complete historical financial data. The complete historical financial data is then classified based on whether the historical financial transaction behavior is abnormal. Based on the classification results, abnormal historical financial data is identified and extracted. Based on the extraction results, abnormal data characteristics are determined. Based on the abnormal data characteristics, a matching confidence level is constructed. The data matching module is used to extract data features from the real-time financial data according to the data category, and match the extraction results with data in a preset database to obtain the matching degree. The level building module is used for: Analyze the abnormal data features, and based on the feature analysis results, determine the data characteristics of each abnormal data feature; classify the abnormal data features according to the data characteristics to obtain several abnormal feature sets; Each historical abnormal financial data point is matched with its corresponding set of abnormal features. Based on the matching results, the proportion of each abnormal data feature in its corresponding set of abnormal features is determined. The frequency of each abnormal data feature appearing in the historical financial data is calculated. Based on the proportion and the frequency, the feature weight of each abnormal data feature is determined, referring to the following formula: N=(α*y i +β*n i ) / ∑(α*y j +β*n j ); Where N represents the weight of the i-th abnormal data feature after normalization; y i The frequency of the i-th anomalous data feature appearing in the historical financial data; n i α represents the proportion of the i-th anomalous data feature in the set of anomalous features; β represents the weighting coefficient corresponding to the frequency; y represents the weighting coefficient corresponding to the proportion; j This represents the frequency with which all anomalous data characteristics appear in the historical financial data; n j This indicates the proportion of all abnormal data features in the abnormal feature set; Generate a feature weight matrix based on the feature weights; construct a matching confidence level based on the feature weight matrix. The behavior determination module is used to compare the matching degree with a preset matching threshold, and determine whether the real-time financial data is an abnormal financial behavior based on the comparison result. The reporting and early warning module is used to determine that the real-time financial data is an abnormal financial behavior if the matching degree exceeds a preset matching threshold, and to generate report information based on the comparison result, the matching degree, the data category, and the real-time financial data, and to issue an early warning based on the report information.

Images