Business abnormal data analysis method based on financial management system

Abstract

The invention relates to the technical field of data analysis, in particular to a business abnormal data analysis method based on a financial management system, and the method comprises the following steps: S1, obtaining various business data in an enterprise financial management system in real time; s2, processing the data acquired in the step S1; s3, extracting features for reflecting business exception; s4, establishing an anomaly detection model; s5, comprehensively analyzing the source and influence of the abnormal data to form a multi-dimensional abnormal data analysis report; s6, deeply mining reasons behind the abnormal data, and identifying business processes and operations causing the abnormity; and S7, providing a corresponding decision support suggestion based on an analysis result in S6. According to the invention, through integration of data mining and machine learning technologies, the business abnormity identification, analysis and processing capabilities in an enterprise financial management system are effectively improved, the decision support of an enterprise for coping with a complex business environment is significantly enhanced, and the operation and financial risks are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and in particular to a method for analyzing business abnormality data based on a financial management system. Background Art

[0002] In modern enterprise management, especially in the field of financial management, the rapid identification and analysis of business anomalies is crucial. Business anomalies may be caused by various factors such as operational errors, fraudulent behavior or system failures. If these anomalies are not discovered and handled in a timely manner, they may lead to serious financial losses or legal risks. Traditional anomaly detection methods mainly rely on rule-based systems or simple statistical analysis. These methods often cannot effectively cope with the complexity and dynamic changes of data in a big data environment. In addition, traditional methods face challenges in processing information across departments or multiple data sources, and it is difficult to achieve effective data integration and in-depth analysis. Therefore, a more efficient and intelligent solution is urgently needed.

[0003] The problems with existing technologies mainly include insufficient data processing, untimely risk warnings, and insufficient in-depth analysis of the reasons behind abnormal data. The existence of these problems often makes it difficult for companies to make quick and accurate decisions when facing complex business environments, thereby increasing operational and financial risks.

[0004] Therefore, there is an urgent need to develop a new business anomaly data analysis method that can integrate multi-source data, detect anomalies in real time, and deeply analyze the causes of anomalies to provide effective decision support. Summary of the invention

[0005] Based on the above purpose, the present invention provides a business abnormal data analysis method based on a financial management system.

[0006] The business abnormal data analysis method based on the financial management system includes the following steps:

[0007] S1: Through the data collection interface, various business data in the enterprise financial management system are obtained in real time, including sales data, procurement data, inventory data and financial statement data;

[0008] S2: Clean, remove duplicates, fill missing values ​​and normalize the data collected in S1 to form a standardized data set;

[0009] S3: Analyze the standardized data set through the preset feature extraction algorithm to extract features that reflect business anomalies, including transaction frequency, amount fluctuation, and customer credit;

[0010] S4: Use a class of support vector machine algorithms to model the features extracted from S3 and establish an anomaly detection model to perform real-time detection of business data and identify abnormal data;

[0011] S5: The abnormal data identified in S4 is integrated with relevant business data. Through the preset data fusion algorithm, the source and impact of the abnormal data are comprehensively analyzed to form a multi-dimensional abnormal data analysis report;

[0012] S6: Based on the abnormal data analysis report, use data mining technology to deeply explore the reasons behind the abnormal data and identify the business processes and operations that cause the abnormalities;

[0013] S7: Based on the analysis results in S6, provide corresponding decision support suggestions, including risk warnings, optimization suggestions and response measures.

[0014] Optionally, the S1 specifically includes:

[0015] S11: Define the parameters of data collection, including data type, data frequency and data format, by configuring the API interface of the enterprise financial management system;

[0016] S12: Using the OAuth 2.0 protocol, the data collection interface is securely authenticated through a token mechanism;

[0017] S13: Through the data collection interface, various data interfaces of the enterprise financial management system are called in real time to obtain sales data, purchase data, inventory data and financial report data;

[0018] S14: Perform preliminary verification on various types of business data collected in real time, including data format verification, data integrity verification and data consistency verification;

[0019] S15: Storing the verified data in a temporary data storage area.

[0020] Optionally, the S2 specifically includes:

[0021] S21: Clean the data collected in S1, including filtering out noise and invalid information in the data using regular expressions and predefined rules;

[0022] S22: Identify and delete duplicate data records by comparing predetermined fields in the data, including transaction ID and customer ID, and verify the uniqueness of the data using a hash algorithm or MD5 checksum;

[0023] S23: Fill in missing values ​​in the data. Specifically, for numerical data, use mean filling or interpolation method to fill in missing values; for categorical data, use mode filling or similarity-based filling method to fill in missing values;

[0024] S24: Normalize the data. Specifically, normalize or standardize the numerical data. Use the Min-Max normalization method to scale the data to the [0,1] interval, or use the Z-score normalization method to convert the data into a standard normal distribution. For categorical data, use one-hot encoding or label encoding to ensure data consistency.

[0025] S25: The cleaned, deduplicated, missing value filled and normalized data are stored in a standardized dataset as input data for subsequent feature extraction.

[0026] Optionally, the S3 specifically includes:

[0027] S31: Transaction frequency feature extraction: count the number of transactions of each customer within the preset time window, and use the sliding window technology to calculate the transaction frequency within a continuous time period to extract the transaction frequency feature. The specific calculation formula is: Among them, f i represents the transaction frequency of customer i, N i represents the number of transactions of customer i in the time window T;

[0028] S32: Amount fluctuation feature extraction, by calculating the mean and standard deviation of the transaction amount of each customer within the preset time window, and using the coefficient of variation to measure the volatility of the transaction amount, to extract the amount fluctuation feature; let the amount volatility be CV i , the calculation formula is:

[0029] Among them, CV i represents the volatility of customer i’s transaction amount, σ i represents the standard deviation of the transaction amount of customer i in time window T, μ i represents the average transaction amount of customer i in time window T;

[0030] S33: extracting customer credit features, specifically associating the customer's historical transaction data with the credit score data, and using association rule mining technology to identify the patterns and rules between the customer's transaction behavior and the credit score to extract the customer's credit features;

[0031] S34: Multiple features of transaction frequency, amount fluctuation and customer credit are integrated, feature scaling technology is used to unify the numerical ranges of different features, and principal component analysis technology is used to reduce the dimension of high-dimensional feature data to extract the principal component features that reflect business anomalies.

[0032] Optionally, the S4 specifically includes:

[0033] S41: Initialize a class of support vector machine algorithms and set initial parameters, including kernel function type, penalty parameter and tolerance error;

[0034] S42: input the multidimensional feature data extracted in S3 as a training set into a type of support vector machine model to train the anomaly detection model. During the training process, the objective function is optimized to find a hyperplane that can maximize the data interval, so as to distinguish normal data from abnormal data in the feature space.

[0035] S43: Validate and optimize the anomaly detection model through cross-validation technology. Cross-validation includes dividing the training data into multiple subsets, and cyclically using one subset as the validation set and the remaining subsets as the training set, repeatedly training and validating the model to evaluate the model performance;

[0036] S44: deploying the trained anomaly detection model to the enterprise financial management system, and acquiring new business data features in real time, inputting them into the anomaly detection model for real-time detection, and determining whether the data is abnormal data by calculating the distance and similarity between the new data and the training data;

[0037] S45: After the abnormal data is identified, it is marked and stored in the abnormal data log, and an abnormal data report is generated. The abnormal data report includes a feature description of the abnormal data, anomaly type, and potential business impact.

[0038] Optionally, establishing the anomaly detection model in S42 specifically includes:

[0039] S421: Training data preparation: The multi-dimensional feature data extracted from S3 is used as a training set. Specifically, the feature data of transaction frequency, amount fluctuation, and customer credit are merged to form a training data set containing all features: X = {x 1 , x 2 , …, x n}, where each sample x i Contains multiple eigenvalues;

[0040] S422: Kernel function selection: selecting a type of support vector machine kernel function for anomaly detection. The kernel function includes a radial basis function. The formula of the radial basis function is: K(x i , x j ) = exp(-γ||x i -x j || 2 ), where K(x i , x j ) represents the sample x i and sample x j The kernel function value between γ and x i -x j|| represents sample x i and sample x j The Euclidean distance between

[0041] S423: Training the model, inputting the training data into a type of support vector machine model for training, and finding a hyperplane by solving a quadratic programming problem: f(x)=w·φ(x)+b to maximize the classification interval, where f(x) is the discriminant function, w is the weight vector, φ(x) is the kernel function mapping, and b is the bias; the optimization goal is: Among them, ||w|| represents the norm of the weight vector w, v is the parameter that controls the anomaly detection rate, n is the number of training samples, and f(x i ) is the sample x i The discriminant function value of .

[0042] Optionally, the S44 includes:

[0043] S441: Feature mapping, preprocessing and feature extraction of real-time business data to obtain a multi-dimensional feature vector x new , and use the kernel function to map it to a high-dimensional feature space;

[0044] S442: Calculate the distance between the new data and the training data, specifically using the kernel function to calculate the new data x new With support vector x i The kernel function value K(x new , x i ), the formula is:

[0045] K(x new ,x i ) = exp(-γ||x new -x i || 2 ), where γ is the kernel parameter, ||x new -x i || represents new data x new and the support vector x i The Euclidean distance between

[0046] S443: Calculate the similarity score of the new data, and use the weight vector w and bias b in the anomaly detection model to calculate the discriminant function value f(x new ), the formula is: f(x new )=w·φ(x new )+b, where φ(x new ) is the kernel function mapping of the new data, w is the weight vector, and b is the bias;

[0047] S444: Determine whether the new data is abnormal data based on the discriminant function value. By setting a threshold value θ, if f(xnew )<θ, the new data is judged as abnormal data, otherwise it is normal data.

[0048] Optionally, the S5 specifically includes:

[0049] S51: Collect and summarize the abnormal data and related business data identified in S4, where the related business data includes timestamps, transaction details, and customer information;

[0050] S52: Match the abnormal data with other relevant business data, specifically matching based on the unique identifier of the business data;

[0051] S53: fusing the matched data, specifically fusing the multi-source data using a Bayesian network, and comprehensively analyzing the multi-dimensional features of the abnormal data;

[0052] S54: Use regression analysis to quantify the impact of abnormal data on business processes and financial indicators. By establishing a regression model, with business processes and financial indicators as dependent variables Y and abnormal data characteristics as independent variables X, the regression analysis formula is: Y = β 0 +β 1 X 1 +β 2 X 2 +…+β n X n +, where β 0 is the intercept term, β 1 ,β 2 ,…,β n is the regression coefficient, is the error term, and then the regression coefficient is estimated by the least squares method to quantify the impact of abnormal data on business processes and financial indicators;

[0053] S55: Generate a multi-dimensional abnormal data analysis report based on the analysis results, and present the comprehensive analysis results in charts and text. The analysis report includes the source of abnormal data, impact analysis and improvement suggestions.

[0054] Optionally, the S6 specifically includes:

[0055] S61: Collect abnormal data and related business data in the report to form a comprehensive data set D report ;

[0056] S62: For data set D report Perform standardization, missing value filling and noise filtering;

[0057] S63: Use association rule mining techniques to identify association patterns between abnormal data and business processes and operations;

[0058] S64: Root cause analysis: Use causal analysis technology to identify the business processes and operations that cause anomalies. By building a causal graph, map the identified association rules to the causal relationship graph, analyze the causal relationship between nodes, and identify the root cause of the abnormal data.

[0059] S65: Abnormal pattern recognition, using cluster analysis technology to cluster abnormal data and identify common abnormal patterns;

[0060] S66: Generate a report containing abnormal causes, abnormal business processes and operations based on association rules, cause-effect diagrams and cluster analysis results.

[0061] Optionally, the S7 specifically includes:

[0062] S71: Based on the analysis results in S6, quantify the impact of abnormal data on business processes and financial indicators, generate risk warnings, specifically perform risk scores on identified business processes and operations, and set warning thresholds. When the risk score exceeds the threshold, generate a risk warning;

[0063] S72: Provide optimization suggestions based on risk warning results. By analyzing the high-risk business processes and operations marked in the risk warning, combined with best practices and industry standards, propose optimization plans. The optimization suggestions include process improvement, resource reallocation, and technology upgrade;

[0064] S73: Formulate countermeasures, convert optimization suggestions into specific countermeasures, break down optimization plans into executable steps, assign relevant responsible persons and resources, and formulate implementation plans and timetables. Countermeasures include implementing new control processes, increasing audit and monitoring links, and conducting employee training;

[0065] S74: Integrate all analysis results and recommendations, generate a decision support report, and present it in chart and text form. The report includes risk assessment results, optimization recommendations, and response measures.

[0066] Beneficial effects of the present invention:

[0067] The present invention provides an efficient business abnormal data analysis solution by comprehensively utilizing data mining technology and machine learning methods. The method can collect various types of business data from the enterprise financial management system in real time and accurately. After data preprocessing and feature extraction steps, a type of support vector machine algorithm is used to establish an abnormal detection model to identify and mark abnormal data in real time. Through Bayesian network and regression analysis technology, multi-source data is integrated and the source and impact of abnormal data are deeply analyzed to provide enterprises with detailed abnormal cause reports. This systematic method significantly improves the enterprise's ability to identify and analyze abnormal data, and improves the scientificity and accuracy of financial management.

[0068] The present invention generates early warning information in a timely manner through risk scoring, and proposes specific optimization plans in combination with best practices to ensure that risks are effectively controlled and managed. The final generated comprehensive decision support report provides the enterprise management with detailed analysis results and feasible action plans, which significantly enhances the enterprise's ability to respond to business anomalies, reduces business and financial risks, and improves overall operational efficiency and decision-making quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0070] Figure 1 A schematic diagram of a method for analyzing abnormal business data according to an embodiment of the present invention;

[0071] Figure 2 A schematic diagram of establishing an anomaly detection model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0072] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0073] It should be noted that the references to "one embodiment", "an embodiment", "an exemplary embodiment", "some embodiments" and the like in the specification indicate that the embodiments described may include specific features, structures or characteristics, but not every embodiment may include the specific features, structures or characteristics. In addition, when a specific feature, structure or characteristic is described in conjunction with an embodiment, it should be within the knowledge of a person skilled in the art to implement such feature, structure or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0074] In general, a term can be understood, at least in part, from its use in context. For example, depending, at least in part, on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular sense, or can be used to describe a combination of features, structures, or characteristics in the plural sense. Additionally, the term "based on" can be understood as not necessarily intended to convey an exclusive set of factors, but can instead, depending, at least in part, on the context, allow for the presence of other factors that are not necessarily explicitly described.

[0075] like Figure 1-Figure 2 As shown, the business abnormal data analysis method based on the financial management system includes the following steps:

[0076] S1: Through the data collection interface, various business data in the enterprise financial management system are obtained in real time, including sales data, procurement data, inventory data and financial statement data;

[0077] S2: Clean, remove duplicates, fill missing values ​​and normalize the data collected in S1 to form a standardized data set;

[0078] S3: Analyze the standardized data set through the preset feature extraction algorithm to extract features that reflect business anomalies, including transaction frequency, amount fluctuation, and customer credit;

[0079] S4: Use a class of support vector machine algorithms to model the features extracted from S3 and establish an anomaly detection model to perform real-time detection of business data and identify abnormal data;

[0080] S5: The abnormal data identified in S4 is integrated with relevant business data. Through the preset data fusion algorithm, the source and impact of the abnormal data are comprehensively analyzed to form a multi-dimensional abnormal data analysis report;

[0081] S6: Based on the abnormal data analysis report, use data mining technology to deeply explore the reasons behind the abnormal data and identify the business processes and operations that cause the abnormalities;

[0082] S7: Based on the analysis results in S6, provide corresponding decision support suggestions, including risk warnings, optimization suggestions and response measures.

[0083] S1 specifically includes:

[0084] S11: Define the parameters of data collection, including data type, data frequency and data format, by configuring the API interface of the enterprise financial management system. The API interface configuration specifies the name, type, length and constraints of each data field by writing an interface definition file (such as Swagger) to ensure the accuracy and consistency of data collection.

[0085] S12: Using the OAuth 2.0 protocol, the data collection interface is securely authenticated through a token mechanism. The specific steps include: first, the client application requests an access token from the authentication server, and the authentication server issues the access token after verifying the identity and authority of the client; then, the client attaches the access token to the request header each time it requests data, and the data server verifies the legitimacy and validity period of the access token to ensure the security and legitimacy of the data collection process;

[0086] S13: Through the data collection interface, various data interfaces of the enterprise financial management system are called in real time. The specific process includes: the client application sends an HTTP request, calls the defined API interface, and obtains sales data, purchase data, inventory data and financial report data;

[0087] S14: Perform preliminary verification on various types of business data collected in real time, including data format verification, data integrity verification and data consistency verification; data format verification is used to check whether the data conforms to the predefined format standard; data integrity verification is used to check whether there are missing values ​​or illegal values; data consistency verification is used to compare the logical relationship of the data (such as whether the inventory quantity is a negative number) to ensure data quality;

[0088] S15: Store the verified data in a temporary data storage area and prepare for preprocessing steps. The temporary data storage area can use a relational database (such as MySQL) or a NoSQL database (such as MongoDB) for storage to ensure fast reading and writing and flexible query of data. Through the combination of the above steps, the high quality and reliability of the data are guaranteed, the storage and processing efficiency of the data is improved, and a solid foundation is provided for subsequent data preprocessing and analysis.

[0089] S2 specifically includes:

[0090] S21: Clean the data collected in S1, including using regular expressions and predefined rules to filter out noise and invalid information in the data to ensure the standardization of the data format;

[0091] S22: Identify and delete duplicate data records by comparing predetermined fields in the data, including transaction ID and customer ID, and verify the uniqueness of the data using a hash algorithm or MD5 checksum to ensure the uniqueness of the data;

[0092] S23: Fill in missing values ​​in the data. For numerical data, use mean filling or interpolation; for categorical data, use mode filling or similarity-based filling to ensure data integrity;

[0093] S24: Normalize the data. Specifically, normalize or standardize the numerical data. Use the Min-Max normalization method to scale the data to the [0,1] interval, or use the Z-score normalization method to convert the data into a standard normal distribution. For categorical data, use One-Hot Encoding or Label Encoding to ensure data consistency.

[0094] S25: Store the cleaned, deduplicated, missing value filled and normalized data into a standardized data set as input data for subsequent feature extraction;

[0095] Through the above steps, the business abnormality data analysis method of the present invention can perform comprehensive and detailed preprocessing on the collected data to ensure the quality and consistency of the data, filter out noise and invalid information through the data cleaning step, and improve the standardization of the data; delete duplicate records through the data deduplication step to ensure the uniqueness of the data; complete the data through the missing value processing step to ensure the integrity of the data; and uniformly process the data through the data normalization step to ensure the comparability and consistency of the data. These preprocessing steps provide high-quality input data for subsequent feature extraction and anomaly detection.

[0096] The features extracted from S3 to reflect business anomalies include:

[0097] S31: Transaction frequency feature extraction, by counting the number of transactions of each customer within a preset time window (such as a week or a month), and using the sliding window technology to calculate the transaction frequency within a continuous time period, to extract the transaction frequency feature. The specific calculation formula is: Among them, f i represents the transaction frequency of customer i, N i represents the number of transactions of customer i in the time window T;

[0098] S32: Amount fluctuation feature extraction, by calculating the mean and standard deviation of the transaction amount of each customer within the preset time window, and using the coefficient of variation (CV) to measure the volatility of the transaction amount, so as to extract the amount fluctuation feature; let the amount volatility be CV i , the calculation formula is:

[0099] Among them, CV i represents the volatility of customer i’s transaction amount, σ i represents the standard deviation of the transaction amount of customer i in time window T, μ i represents the average transaction amount of customer i in time window T;

[0100] S33: extracting customer credit features, specifically associating the customer's historical transaction data with the credit score data, using association rule mining technology (such as the Apriori algorithm) to identify the patterns and rules between the customer's transaction behavior and the credit score, so as to extract the customer's credit features;

[0101] In association rule mining, the definition is as follows:

[0102] Support: indicates the rule The frequency of occurrence in the data set, the formula is: Support Among them, |A∩B| represents the number of samples that contain both A and B, and N represents the total number of all samples in the data set;

[0103] Confidence: Indicates the probability of including B when A is included. The formula is: Among them, |A| represents the number of samples containing A;

[0104] Lift: It indicates the ratio of the probability of B appearing when A appears to the probability of B appearing itself. The formula is: Among them, Support(B) represents the frequency of B in the data set.

[0105] S34: Multiple features of transaction frequency, amount fluctuation and customer credit are integrated, feature scaling technology is used to unify the numerical ranges of different features, and principal component analysis (PCA) technology is used to reduce the dimension of high-dimensional feature data to extract the principal component features that best reflect business anomalies; finally, the extracted multi-dimensional features are stored in the feature data set as input data for subsequent anomaly detection steps;

[0106] Through the above steps, key features reflecting business anomalies can be efficiently extracted from standardized data sets. Transaction frequency features can be used to analyze customer transaction activity, amount fluctuation features can be used to evaluate the stability of transaction amounts, and customer credit features can be used to reveal the relationship between transaction behavior and credit scores. Multi-feature fusion can be used to uniformly process feature data and extract the most representative principal components, providing high-quality input data for anomaly detection and improving the accuracy and reliability of anomaly detection.

[0107] S4 specifically includes:

[0108] S41: Initialize a class of support vector machine algorithms and set initial parameters, including kernel function type, penalty parameter and tolerance error; the kernel function type includes Gaussian kernel, linear kernel or polynomial kernel, the penalty parameter is used to control the model's tolerance to outliers, and the tolerance error is used to balance the complexity and accuracy of the model;

[0109] S42: input the multidimensional feature data extracted in S3 as a training set into a type of support vector machine model to train the anomaly detection model. During the training process, the objective function is optimized to find a hyperplane that can maximize the data interval, so as to distinguish normal data from abnormal data in the feature space.

[0110] S43: Verify and optimize the anomaly detection model through cross-validation technology to ensure the generalization ability and robustness of the model. Cross-validation includes dividing the training data into multiple subsets, and cyclically using one subset as the validation set and the remaining subsets as the training set, repeatedly training and validating the model to evaluate the model performance;

[0111] S44: deploying the trained anomaly detection model to the enterprise financial management system, and acquiring new business data features in real time, inputting them into the anomaly detection model for real-time detection, and determining whether the data is abnormal data by calculating the distance and similarity between the new data and the training data;

[0112] S45: After the abnormal data is identified, it is marked and stored in the abnormal data log, and an abnormal data report is generated. The abnormal data report includes the characteristic description of the abnormal data, the abnormal type and the potential business impact, so that managers can conduct further analysis and decision support; through the above steps, a class of support vector machine algorithms is used to model the extracted multi-dimensional feature data, and an efficient anomaly detection model is established. By initializing model parameters, training and verifying the model, the accuracy and generalization ability of the anomaly detection model are ensured, and the trained model is deployed in the enterprise financial management system to realize real-time detection of new business data, quickly identify and mark abnormal data, and generate detailed abnormal data reports. This series of steps improves the real-time and reliability of anomaly detection and provides strong decision support for enterprise management.

[0113] The establishment of anomaly detection model in S42 specifically includes:

[0114] S421: Training data preparation: The multi-dimensional feature data extracted from S3 is used as a training set. Specifically, the feature data of transaction frequency, amount fluctuation, and customer credit are merged to form a training data set containing all features: X = {x 1 , x 2 , …, x n}, where each sample x i Contains multiple eigenvalues;

[0115] S422: Kernel function selection: selecting a type of support vector machine kernel function for anomaly detection. The kernel function includes a linear kernel and a radial basis function (RBF kernel). The formula of the radial basis function is: K(x i , x j ) = exp

[0116] (-γ||x i -x j || 2 ), where K(x i , x j ) represents the sample x i and sample x jThe kernel function value between γ and x i -x j || represents sample x i and sample x j The Euclidean distance between

[0117] S423: Training the model, inputting the training data into a type of support vector machine model for training, and finding a hyperplane by solving a quadratic programming problem: f(x)=w·φ(x)+b to maximize the classification interval, where f(x) is the discriminant function, w is the weight vector, φ(x) is the kernel function mapping, and b is the bias; the optimization goal is: Among them, ||w|| represents the norm of the weight vector w, v is the parameter that controls the anomaly detection rate, n is the number of training samples, and f(x i ) is the sample x i Through the above steps, it is possible to disclose in detail how to use a class of support vector machine algorithms to train anomaly detection models. By inputting the extracted multi-dimensional feature data into the model, selecting a suitable kernel function, and training by optimizing the objective function, it is ensured that the model can accurately identify abnormal data. This method effectively improves the accuracy and real-time performance of anomaly detection, provides reliable technical support for the financial management of enterprises, and reduces business risks.

[0118] The step of determining whether the data is abnormal data in S44 specifically includes:

[0119] S441: Feature mapping, preprocessing and feature extraction of real-time business data to obtain a multi-dimensional feature vector x new , and use the kernel function to map it to a high-dimensional feature space;

[0120] S442: Calculate the distance between the new data and the training data, specifically using the kernel function to calculate the new data x new With support vector x i The kernel function value K(x new , x i ), the formula is:

[0121] K(x new ,x i ) = exp(-γ||x new -x i || 2 ), where γ is the kernel parameter, ||x new -x i || represents new data x new and the support vector x i The Euclidean distance between

[0122] S443: Calculate the similarity score of the new data, and use the weight vector w and bias b in the anomaly detection model to calculate the discriminant function value f(x new ), the formula is: f(x new )=w·φ(x new )+b, where φ(x new ) is the kernel function mapping of the new data, w is the weight vector, and b is the bias;

[0123] S444: Determine whether the new data is abnormal data based on the discriminant function value. By setting a threshold value θ, if f(x new )<θ, the new data is judged to be abnormal data, otherwise it is normal data; through the above steps, it is possible to determine whether the data is abnormal data by calculating the distance and similarity between the new data and the training data.

[0124] S5 specifically includes:

[0125] S51: Collect and summarize the abnormal data and related business data identified in S4, where the related business data includes timestamps, transaction details, and customer information;

[0126] S52: Match the abnormal data with other relevant business data, specifically matching according to the unique identifier of the business data (such as transaction ID, customer ID), to ensure that each abnormal data is accurately associated with its related business data;

[0127] S53: The matched data is fused, specifically using the Bayesian network to fuse the multi-source data and comprehensively analyze the multi-dimensional characteristics of the abnormal data. The joint probability distribution formula of the Bayesian network is: P Among them, X i Represents each node in the Bayesian network, Parents(X i ) represents node X i The parent node set of P(X i |Parents(X i )) indicates that node X is i The conditional probability of

[0128] S54: Use regression analysis to quantify the impact of abnormal data on business processes and financial indicators. By establishing a regression model, with business processes and financial indicators as dependent variables Y and abnormal data characteristics as independent variables X, the regression analysis formula is: Y = β 0 +β 1 X 1 +β 2 X 2 +…+β n X n +, where β0 is the intercept term, β 1 ,β 2 ,…,β n is the regression coefficient, is the error term, and then the regression coefficient is estimated by the least squares method (OLS) to quantify the impact of abnormal data on business processes and financial indicators;

[0129] S55: Generate a multi-dimensional abnormal data analysis report based on the analysis results, and present the comprehensive analysis results in the form of charts and text. The analysis report includes the source of abnormal data, impact analysis and improvement suggestions;

[0130] Through the above steps, the business abnormal data analysis method of the present invention can effectively integrate the identified abnormal data with the relevant business data, and comprehensively analyze the source and impact of the abnormal data through the Bayesian network, and ensure the consistency and integrity of the data through the abnormal data collection, data matching and data fusion steps; through the regression analysis method, quantify the specific impact of abnormal data on business processes and financial indicators, and provide accurate quantitative results; through the report generation step, provide a clear and detailed abnormal data analysis report. This method significantly improves the comprehensiveness and accuracy of abnormal data analysis, provides reliable data support and decision-making basis for enterprise financial management, and reduces business risks.

[0131] S6 specifically includes:

[0132] S61: Collect abnormal data and related business data in the report to form a comprehensive data set D report ;

[0133] S62: For data set D report Perform standardization, missing value filling and noise filtering to ensure data quality and consistency;

[0134] S63: Use association rule mining technology (such as Apriori algorithm) to identify the association pattern between abnormal data and business processes and operations. The specific formula is:

[0135] Where A represents a specific business process or operation, B represents abnormal data, N represents the total number of records in the data set, |A∩B| represents the number of records containing both A and B, |A| represents the number of records containing A, Support, Confidence, and Lift represent support, confidence, and lift, respectively;

[0136] S64: Root cause analysis: Use causal analysis techniques (such as causal graphs) to identify the business processes and operations that cause anomalies. By building a causal graph, the identified association rules are mapped to the causal relationship graph, and the causal relationship between nodes is analyzed to identify the root cause of the abnormal data.

[0137] S65: Abnormal pattern recognition, clustering the abnormal data using clustering analysis technology (such as K-means algorithm) to identify common abnormal patterns. The specific formula is: Among them, J represents the objective function, k is the number of clusters, C i is the i-th cluster, x is the data point, μ i is the center point of the i-th cluster;

[0138] S66: Generate a report containing abnormal causes, abnormal business processes and operations based on association rules, cause-effect diagrams and cluster analysis results;

[0139] Through the above steps, based on the abnormal data analysis report, data mining technology can be used to deeply explore the reasons behind the abnormal data, ensure data quality through data preparation and preprocessing, identify the relationship between abnormal data and business processes through association rule mining, identify the key processes and operations that lead to abnormalities through causal analysis, identify common abnormal patterns through cluster analysis, and generate a comprehensive abnormal cause analysis report. This method significantly improves the ability to understand and analyze abnormal data, and provides strong support for the company's business optimization and risk management.

[0140] S7 specifically includes:

[0141] S71: Based on the analysis results in S6, quantify the impact of abnormal data on business processes and financial indicators, generate risk warnings, specifically perform risk scores on identified business processes and operations, and set warning thresholds. When the risk score exceeds the threshold, generate a risk warning;

[0142] S72: Provide optimization suggestions based on risk warning results. By analyzing the high-risk business processes and operations marked in the risk warning, combined with best practices and industry standards, propose optimization plans. The optimization suggestions include process improvement, resource reallocation, and technology upgrades to ensure that risks are effectively controlled.

[0143] S73: Formulate countermeasures, convert optimization suggestions into specific countermeasures, break down optimization plans into executable steps, assign relevant responsible persons and resources, and formulate implementation plans and timetables. Countermeasures include implementing new control processes, increasing audit and monitoring links, and conducting employee training;

[0144] S74: Integrate all analysis results and suggestions, generate a decision support report, and present it in the form of charts and text. The report includes risk assessment results, optimization suggestions and countermeasures, and is submitted to management for decision-making reference; through the above steps, provide specific decision support suggestions, including risk warnings, optimization suggestions and countermeasures. This method significantly improves the company's ability to respond to business anomalies, enhances the scientificity and accuracy of financial management, and reduces business risks.

[0145] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0146] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A business abnormal data analysis method based on a financial management system, characterized in that: The following steps are involved: S1: Through the data collection interface, various business data in the enterprise financial management system are obtained in real time, including sales data, procurement data, inventory data and financial statement data; S2: Clean, remove duplicates, fill missing values ​​and normalize the data collected in S1 to form a standardized data set; S3: Analyze the standardized data set through the preset feature extraction algorithm to extract features that reflect business anomalies, including transaction frequency, amount fluctuation, and customer credit; S4: Use a class of support vector machine algorithms to model the features extracted from S3 and establish an anomaly detection model to perform real-time detection of business data and identify abnormal data; S5: The abnormal data identified in S4 is integrated with relevant business data. Through the preset data fusion algorithm, the source and impact of the abnormal data are comprehensively analyzed to form a multi-dimensional abnormal data analysis report; S6: Based on the abnormal data analysis report, use data mining technology to deeply explore the reasons behind the abnormal data and identify the business processes and operations that cause the abnormalities; S7: Based on the analysis results in S6, provide corresponding decision support suggestions, including risk warnings, optimization suggestions and response measures.

2. The business abnormality data analysis method based on the financial management system according to claim 1 is characterized in that: The S1 specifically includes: S11: Define the parameters of data collection, including data type, data frequency and data format, by configuring the API interface of the enterprise financial management system; S12: Using the OAuth 2.0 protocol, the data collection interface is securely authenticated through a token mechanism; S13: Through the data collection interface, various data interfaces of the enterprise financial management system are called in real time to obtain sales data, purchase data, inventory data and financial report data; S14: Perform preliminary verification on various types of business data collected in real time, including data format verification, data integrity verification and data consistency verification; S15: Storing the verified data in a temporary data storage area.

3. The business abnormality data analysis method based on the financial management system according to claim 1 is characterized in that: The S2 specifically includes: S21: Clean the data collected in S1, including filtering out noise and invalid information in the data using regular expressions and predefined rules; S22: Identify and delete duplicate data records by comparing predetermined fields in the data, including transaction ID and customer ID, and verify the uniqueness of the data using a hash algorithm or MD5 checksum; S23: Fill in missing values ​​in the data. Specifically, for numerical data, use mean filling or interpolation method to fill in missing values; for categorical data, use mode filling or similarity-based filling method to fill in missing values; S24: Normalize the data. Specifically, normalize or standardize the numerical data. Use the Min-Max normalization method to scale the data to the [0,1] interval, or use the Z-score normalization method to convert the data into a standard normal distribution. For categorical data, use one-hot encoding or label encoding to ensure data consistency. S25: The cleaned, deduplicated, missing value filled and normalized data are stored in a standardized data set as input data for subsequent feature extraction.

4. The business abnormality data analysis method based on the financial management system according to claim 1 is characterized in that: The S3 specifically includes: S31: Transaction frequency feature extraction: by counting the number of transactions of each customer within a preset time window, and using the sliding window technology to calculate the transaction frequency within a continuous time period, the transaction frequency feature is extracted. The calculation formula is: Among them, f i represents the transaction frequency of customer i, N i represents the number of transactions of customer i in the time window T; S32: Amount fluctuation feature extraction, by calculating the mean and standard deviation of the transaction amount of each customer within the preset time window, and using the coefficient of variation to measure the volatility of the transaction amount, to extract the amount fluctuation feature; let the amount volatility be CV i , the calculation formula is: Among them, CV i represents the volatility of customer i’s transaction amount, σ i represents the standard deviation of the transaction amount of customer i in time window T, μ i represents the average transaction amount of customer i in time window T; S33: Customer credit feature extraction, including associating the customer's historical transaction data with the credit score data, using association rule mining technology to identify the patterns and rules between customer transaction behavior and credit score to extract customer credit features; S34: Multiple features of transaction frequency, amount fluctuation and customer credit are integrated, feature scaling technology is used to unify the numerical ranges of different features, and principal component analysis technology is used to reduce the dimension of high-dimensional feature data to extract the principal component features that reflect business anomalies.

5. The business abnormality data analysis method based on the financial management system according to claim 1 is characterized in that: The S4 specifically includes: S41: Initialize a class of support vector machine algorithms and set initial parameters, including kernel function type, penalty parameter and tolerance error; S42: input the multidimensional feature data extracted in S3 as a training set into a type of support vector machine model to train the anomaly detection model. During the training process, the objective function is optimized to find a hyperplane that can maximize the data interval, so as to distinguish normal data from abnormal data in the feature space. S43: Validate and optimize the anomaly detection model through cross-validation technology. Cross-validation includes dividing the training data into multiple subsets, and cyclically using one subset as the validation set and the remaining subsets as the training set, repeatedly training and validating the model to evaluate the model performance; S44: deploying the trained anomaly detection model to the enterprise financial management system, and acquiring new business data features in real time, inputting them into the anomaly detection model for real-time detection, and determining whether the data is abnormal data by calculating the distance and similarity between the new data and the training data; S45: After the abnormal data is identified, it is marked and stored in the abnormal data log, and an abnormal data report is generated. The abnormal data report includes a feature description of the abnormal data, anomaly type, and potential business impact.

6. The business abnormality data analysis method based on the financial management system according to claim 5 is characterized in that: The establishment of the anomaly detection model in S42 specifically includes: S421: Training data preparation, using the multi-dimensional feature data extracted from S3 as a training set, including merging the feature data of transaction frequency, amount fluctuation and customer credit to form a training data set containing all features: X = {x1, x2, ..., x n }, where each sample x i Contains multiple eigenvalues; S422: Kernel function selection: selecting a type of support vector machine kernel function for anomaly detection. The kernel function includes a radial basis function. The formula of the radial basis function is: K(x i , x j )=exp(-γ∥x i -x j ∥ 2 ), where K(x i , x j ) represents the sample x i and sample x j The kernel function value between γ and ∥x i -x j ∥ represents sample x i and sample x j The Euclidean distance between S423: Training the model, inputting the training data into a type of support vector machine model for training, and finding a hyperplane by solving a quadratic programming problem: f(x)=w·φ(x)+b to maximize the classification interval, where f(x) is the discriminant function, w is the weight vector, φ(x) is the kernel function mapping, and b is the bias; the optimization goal is: Among them, ∥w∥ represents the norm of the weight vector w, v is the parameter that controls the anomaly detection rate, n is the number of training samples, and f(x i ) is the sample x i The discriminant function value of .

7. The business abnormality data analysis method based on the financial management system according to claim 6 is characterized in that: The S44 includes: S441: Feature mapping, preprocessing and feature extraction of real-time business data to obtain a multi-dimensional feature vector x new , and use the kernel function to map it to a high-dimensional feature space; S442: Calculate the distance between the new data and the training data, specifically using the kernel function to calculate the new data x new With support vector x i The kernel function value K(x new , x i ), the formula is: K(x new ,x i )=exp(-γ∥x new -x i ∥ 2 ), where γ is the kernel parameter, ∥x new -x i ∥ represents new data x new and the support vector x i The Euclidean distance between S443: Calculate the similarity score of the new data, and use the weight vector w and bias b in the anomaly detection model to calculate the discriminant function value f(x new ), the formula is: f(x new )=w·φ(x new )+b, where φ(x new ) is the kernel function mapping of the new data, w is the weight vector, and b is the bias; S444: Determine whether the new data is abnormal data based on the discriminant function value. By setting a threshold value θ, if f(x new )<θ, the new data is judged as abnormal data, otherwise it is normal data.

8. The business abnormality data analysis method based on the financial management system according to claim 1 is characterized in that: The S5 specifically includes: S51: Collect and summarize the abnormal data and related business data identified in S4, where the related business data includes timestamps, transaction details, and customer information; S52: Match the abnormal data with other relevant business data, specifically matching based on the unique identifier of the business data; S53: fusing the matched data, specifically fusing the multi-source data using a Bayesian network, and comprehensively analyzing the multi-dimensional features of the abnormal data; S54: Use regression analysis to quantify the impact of abnormal data on business processes and financial indicators. By building a regression model, with business processes and financial indicators as dependent variables Y and abnormal data characteristics as independent variables X, the regression analysis formula is: Y = β0 + β1X1 + β2X2 + … + β n X n +, where β0 is the intercept term, β1,β2,…,β n is the regression coefficient, is the error term, and then the regression coefficient is estimated by the least squares method to quantify the impact of abnormal data on business processes and financial indicators; S55: Generate a multi-dimensional abnormal data analysis report based on the analysis results, and present the comprehensive analysis results in charts and text. The analysis report includes the source of abnormal data, impact analysis and improvement suggestions.

9. The business abnormality data analysis method based on the financial management system according to claim 1 is characterized in that: The S6 specifically includes: S61: Collect abnormal data and related business data in the report to form a comprehensive data set D report ; S62: For data set D report Perform standardization, missing value filling and noise filtering; S63: Use association rule mining techniques to identify association patterns between abnormal data and business processes and operations; S64: Root cause analysis: Use causal analysis technology to identify the business processes and operations that cause anomalies. By building a causal graph, map the identified association rules to the causal relationship graph, analyze the causal relationship between nodes, and identify the root cause of the abnormal data. S65: Abnormal pattern recognition, using cluster analysis technology to cluster abnormal data and identify common abnormal patterns; S66: Generate a report containing abnormal causes, abnormal business processes and operations based on association rules, cause-effect diagrams and cluster analysis results.

10. The business abnormality data analysis method based on the financial management system according to claim 1 is characterized in that: The S7 specifically includes: S71: Based on the analysis results in S6, quantify the impact of abnormal data on business processes and financial indicators, generate risk warnings, specifically perform risk scores on identified business processes and operations, and set warning thresholds. When the risk score exceeds the threshold, generate a risk warning; S72: Provide optimization suggestions based on risk warning results. By analyzing the high-risk business processes and operations marked in the risk warning, combined with best practices and industry standards, propose optimization plans. The optimization suggestions include process improvement, resource reallocation, and technology upgrade; S73: Develop countermeasures, break down the optimization plan into executable steps, assign relevant responsible persons and resources, and develop implementation plans and timetables. Countermeasures include implementing new control processes, increasing audit and monitoring links, and conducting employee training. S74: Integrate all analysis results and recommendations, generate a decision support report, and present it in chart and text form. The report includes risk assessment results, optimization recommendations, and response measures.

Images