Anomaly detection method, system and electronic device based on multivariate data analysis

Abstract

The present application relates to an anomaly detection method, system and electronic device based on multivariate data analysis, and to the field of invoice detection technology, wherein the method includes: obtaining at least one target invoice data to be detected in a target enterprise; preprocessing each target invoice data to obtain corresponding invoice characteristic information of at least one dimension; inputting the invoice characteristic information of each target invoice data into a preset anomaly detection model to determine the target potential anomaly type of the corresponding target invoice data; determining whether to issue an abnormal warning based on the target potential anomaly type, at least one target invoice characteristic dimension in which anomalies are prone to occur in the invoice of the target enterprise, and the corresponding at least one target invoice abnormal type; if so, verifying the target potential anomaly type to obtain the verified abnormal type, and issuing an abnormal warning for the verified abnormal type. The present application has the effect of improving the accuracy of the invoice abnormality warning.

Description

Technical Field

[0001] The present application relates to the technical field of invoice detection, and specifically to an anomaly detection method, system and electronic equipment based on multivariate data analysis. Background Art

[0002] As financial management becomes more and more important to enterprises, invoice anomaly detection in financial management is particularly important for enterprises. Therefore, how to effectively detect anomalies in invoices is an urgent problem to be solved at this stage.

[0003] At present, the common method for detecting anomalies in invoices is to review a large amount of invoice data based on the traditional invoice automation review system to check for possible invoice anomalies. However, under this method, the invoice automation review system usually focuses on the basic compliance of the invoice for anomaly review, lacks the ability to deeply explore and intelligently identify the anomaly types of invoices, and has poor accuracy in detecting anomalies in invoices, resulting in low accuracy in the final anomaly warning for invoices. Summary of the invention

[0004] In order to improve the accuracy of invoice anomaly warning, the present application provides an anomaly detection method, system and electronic device based on multivariate data analysis.

[0005] In a first aspect of the present application, a method for detecting anomalies based on multivariate data analysis is provided, which specifically includes:

[0006] Obtain at least one target invoice data to be detected in the target enterprise;

[0007] Preprocessing each of the target invoice data to obtain corresponding invoice characteristic information of at least one dimension;

[0008] Inputting the invoice feature information of each target invoice data into a preset anomaly detection model to determine the target potential anomaly type of the corresponding target invoice data;

[0009] Determine whether to issue an abnormality warning based on the target potential abnormality type, at least one target invoice feature dimension in which abnormalities are likely to occur in the invoices of the target enterprise, and at least one corresponding target invoice abnormality type, wherein the target invoice abnormality type is an invoice abnormality type that is likely to occur when an abnormality occurs in the invoice feature information of the corresponding target invoice feature dimension;

[0010] If so, the target potential abnormal type is verified to obtain a verified abnormal type, and an abnormal warning is issued for the verified abnormal type.

[0011] By adopting the above technical solution, after obtaining the target invoice data that needs to be detected for anomalies, the target invoice data is preprocessed to accurately extract the invoice feature information with high quality and that can be recognized by the model, so that the subsequent anomaly detection model can output the result more accurately based on the invoice feature information. Furthermore, the invoice feature information of the target invoice data is input into the anomaly detection model to efficiently detect and identify the invoice anomalies that may exist in the target invoice data. Then, based on each target invoice feature dimension and the corresponding target invoice anomaly type, the possibility of real anomalies in the target invoice data identified by the anomaly detection model is analyzed, and then it is accurately determined whether to issue an anomaly warning, thereby avoiding the false triggering of the warning to a certain extent. Finally, the target potential anomaly type identified by the anomaly detection model is verified, thereby improving the accuracy of invoice anomaly detection, thereby issuing a more accurate warning for the target invoice data.

[0012] Optionally, the determining whether to issue an abnormality warning based on the target potential abnormality type, at least one target invoice feature dimension in which abnormalities are likely to occur in the invoices of the target enterprise, and at least one corresponding target invoice abnormality type specifically includes:

[0013] Acquire historical invoice feature dimensions that have appeared abnormally in the historical invoices of the target enterprise, count the first occurrence times of each of the historical invoice feature dimensions, and select the historical invoice feature dimension with the first number from each of the historical invoice feature dimensions in descending order of the first occurrence times to determine it as the target invoice feature dimension;

[0014] Determine the historical invoice exception type that exists when the invoice feature information of each target invoice feature dimension is abnormal, count the second occurrence times of each historical invoice exception type, and select the historical invoice exception type with the second number from each historical invoice exception type in descending order of the second occurrence times to determine it as the target invoice exception type of the corresponding target invoice feature dimension;

[0015] Calculate a first weight of each target invoice feature dimension and a second weight of each corresponding target invoice exception type, wherein the first weight is a ratio of a first occurrence number of each target invoice feature dimension to a sum of first occurrence numbers of all target invoice feature dimensions, and the second weight is a ratio of a second occurrence number of a single target invoice exception type corresponding to the target invoice feature dimension to a sum of second occurrence numbers of all corresponding target invoice exception types;

[0016] Based on the target potential abnormality type, the first weight and the corresponding second weights, it is determined whether to issue an abnormality warning.

[0017] By adopting the above technical solution, the greater the number of first occurrences, the more likely the invoice feature information of the corresponding historical invoice feature dimension in the target enterprise's invoice is to be abnormal, thereby determining the target invoice feature dimension; the greater the number of second occurrences, the more likely the corresponding historical invoice abnormal type is to exist when the target invoice feature dimension is abnormal, thereby determining the target invoice abnormal type. Finally, combining the first weight and the corresponding second weights, the anomaly detection model is analyzed to identify the possibility of real anomalies in the abnormal target invoice data, thereby accurately determining whether to issue an abnormal warning, thereby avoiding false triggering of the warning to a certain extent.

[0018] Optionally, the determining whether to issue an abnormality warning based on the target potential abnormality type, the first weight and the corresponding second weights specifically includes:

[0019] Determine the target invoice feature dimensions that have the target potential abnormality type in the corresponding target invoice abnormality types as key invoice feature dimensions, and calculate the first product of the first weight of each key invoice feature dimension and the second weight of the corresponding target potential abnormality type;

[0020] Summing the first products to obtain a sum of the first products, and comparing the sum of the first products with a preset product sum threshold, and if the sum of the first products is greater than the product sum threshold, determining to issue an abnormal warning;

[0021] If the sum of the first products is not greater than the product sum threshold, it is determined that no abnormal warning is issued.

[0022] By adopting the above technical solution, the larger the first product is, the more likely it is that this target potential abnormality type exists when an abnormality occurs in the invoice feature information of the key invoice feature dimension. If the sum of the first products is greater than the product sum threshold, it means that the overall possibility of the target potential abnormality type is large and the possibility of abnormality in the invoice feature information of the key invoice feature dimension is large, and there is a high probability of abnormal risk, then it is determined to perform a normal abnormal warning; otherwise, it means that there is a high probability that there is no abnormal risk, then it is determined not to perform an abnormal warning.

[0023] Optionally, verifying the target potential abnormality type to obtain a verified abnormality type specifically includes:

[0024] Determine the target invoice feature dimensions that have the target potential abnormality type in the corresponding target invoice abnormality types as key invoice feature dimensions, and calculate the second product of the first weight of each key invoice feature dimension and the second weight of the corresponding target invoice abnormality type;

[0025] Selecting the maximum second product from the second products corresponding to the same key invoice feature dimension;

[0026] Determine the target invoice exception type corresponding to each of the maximum second products as the key invoice exception type, and determine whether each of the key invoice exception types is consistent;

[0027] If so, when the key invoice anomaly type is the same as the target potential anomaly type, the target potential anomaly type is determined as the post-verification anomaly type;

[0028] When the key invoice anomaly type is different from the target potential anomaly type, the key invoice anomaly type is determined as the post-verification anomaly type.

[0029] By adopting the above technical solution, the larger the second product is, the more likely it is that the corresponding target invoice abnormality type will exist when the invoice feature information of the key invoice feature dimension is abnormal. If the key invoice abnormality types corresponding to each key invoice feature dimension are consistent, and the target invoice abnormality types that are most likely to appear when information abnormalities appear in each key invoice feature dimension are consistent, it means that there is a strong correlation between each key invoice feature dimension for the appearance of this key invoice abnormality type. Therefore, it can not only verify that the key invoice feature dimension is the invoice feature dimension with a high probability of abnormality in the target invoice data that needs abnormal warning, providing a reliable investigation dimension for subsequent invoice abnormality investigation, but also accurately determine the invoice abnormality type that is likely to exist.

[0030] Optionally, the method further includes:

[0031] Determine the target invoice data corresponding to the verified abnormal type as the invoice data to be checked, and sum the second products corresponding to each of the key invoice feature dimensions to obtain the corresponding sum of the second products;

[0032] According to the sum of the second products, determining the screening order of the key invoice feature dimensions in the invoice data to be screened, the larger the sum of the second products, the higher the corresponding screening order;

[0033] Each of the above-mentioned screening sequences is sent to the terminal of the financial personnel, so that the financial personnel can screen the invoice feature information of the corresponding key invoice feature dimensions according to each of the above-mentioned screening sequences.

[0034] By adopting the above technical solution, the larger the sum of the second products is, the greater the overall possibility of invoice anomalies when information anomalies appear in the corresponding key invoice feature dimensions, the higher the corresponding troubleshooting order is, and the higher the priority is for troubleshooting the occurrence of information anomalies in the corresponding dimensions. Furthermore, each troubleshooting order is sent to the terminal of the financial personnel, so that the financial personnel can check the invoice feature information of the corresponding key invoice feature dimensions according to each troubleshooting order, thereby facilitating better troubleshooting of the abnormal types of the invoice data after verification, and efficiently and accurately determining the invoice anomalies.

[0035] Optionally, the method further includes:

[0036] When the abnormal type after verification is that the invoice amount does not match the business transaction, if the verification result of the abnormal type after verification sent by the terminal is not obtained within a preset time, the first occurrence frequency of the historical business transactions of the target enterprise in which the invoice abnormality occurred is counted, and the third historical business transaction is selected from each of the historical business transactions in descending order of the first occurrence frequency to determine as the target business transaction;

[0037] When the invoice corresponding to each target business transaction has the abnormal type after verification, the second occurrence frequency of the historical invoice amount interval in which the invoice amount is located is counted, and in descending order of the second occurrence frequency, the fourth number of the historical invoice amount interval is selected from each of the historical invoice amount intervals to determine as the target amount interval of the corresponding target business transaction;

[0038] Calculate a third weight of each target business transaction and a fourth weight of each corresponding target amount interval, wherein the third weight is a ratio of a first occurrence frequency of each target business transaction to a sum of first occurrence frequencies of all target business transactions, and the fourth weight is a ratio of a second occurrence frequency of a single target amount interval corresponding to the target business transaction to a sum of second occurrence frequencies of all corresponding target amount intervals;

[0039] According to the third weight and the corresponding fourth weights, it is verified whether the post-verification abnormality type exists.

[0040] By adopting the above technical solution, the greater the first occurrence frequency, the more likely the corresponding historical business transaction is to have invoice anomalies, thereby determining the target business transaction; the greater the second occurrence frequency, the more likely the invoice amount is to be in the corresponding historical invoice amount range when the invoice corresponding to the target business transaction has an abnormal type after verification, thereby determining the target amount range corresponding to the target business transaction. Finally, combined with the third weight and the corresponding fourth weights, the possibility of mismatch between the invoice amount and the business transaction in the corresponding target invoice data is analyzed, thereby more accurately verifying the existence of the abnormal type after verification.

[0041] Optionally, verifying whether the post-verification abnormality type exists according to the third weight and the corresponding fourth weights specifically includes:

[0042] Determine the target invoice data corresponding to the verified abnormal type as the invoice data to be checked, and determine the actual business transaction corresponding to the invoice data to be checked based on the invoice feature information of the business transaction dimension in the invoice data to be checked;

[0043] Based on the invoice feature information of the invoice amount dimension in the invoice data to be checked, the actual invoice amount corresponding to the invoice data to be checked is determined, and when the actual business transaction is a target business transaction, the third product of the third weight of the actual business transaction and the fourth weight of each corresponding target amount interval is calculated and summed to obtain the corresponding sum of the third products;

[0044] Calculate and sum the fourth product of the third weight of each remaining target business transaction and the fourth weight of each corresponding target amount interval to obtain the corresponding sum of the fourth products, and sum the sums of the fourth products to obtain the final sum of the products, wherein the remaining target business transactions are target business transactions other than the actual business transactions;

[0045] If the sum of the third products is greater than the sum of the final products, the target business transactions containing the actual invoice amount in the corresponding target amount intervals are determined as important business transactions, and the target amount interval containing the actual invoice amount is determined as an important amount interval;

[0046] The fifth product of the third weight of each of the important business transactions and the fourth weight of the corresponding important amount range is calculated. If the important business transaction corresponding to the maximum fifth product among the fifth products is consistent with the actual business transaction, it is determined that the post-verification exception type exists.

[0047] By adopting the above technical solution, the larger the sum of the third products is, the greater the possibility of the abnormal type after verification due to the abnormal invoice amount. If the sum of the third products is greater than the sum of the final products, it means that the possibility of the abnormal type after verification due to the invoice amount problem in the actual business transaction is higher than that of the non-actual business transaction; further, the larger the fifth product is, the more likely the abnormal type after verification will appear when the invoice amount of the corresponding important business transaction is the actual invoice amount. If the important business transaction corresponding to the largest fifth product is consistent with the actual business transaction, it means that there is indeed an abnormality in the mismatch between the invoice amount and the business transaction in the invoice data to be checked, so as to quickly and accurately verify the existence of the abnormal type after verification.

[0048] In a second aspect of the present application, an anomaly detection system based on multivariate data analysis is provided, specifically comprising:

[0049] A data acquisition module, used to acquire at least one target invoice data to be detected in a target enterprise;

[0050] A feature extraction module, used for preprocessing each target invoice data to obtain corresponding invoice characteristic information of at least one dimension;

[0051] An anomaly detection module, used for inputting the invoice feature information of each target invoice data into a preset anomaly detection model to determine the target potential anomaly type of the corresponding target invoice data;

[0052] An abnormality checking module, used to determine whether to issue an abnormality warning based on the target potential abnormality type, at least one target invoice feature dimension in which abnormalities are likely to occur in the invoices of the target enterprise, and at least one corresponding target invoice abnormality type, wherein the target invoice abnormality type is an invoice abnormality type that is likely to occur when an abnormality occurs in the invoice feature information of the corresponding target invoice feature dimension;

[0053] The abnormality warning module is used to verify the potential abnormality type of the target, obtain the verified abnormality type, and issue an abnormality warning for the verified abnormality type.

[0054] By adopting the above technical solution, the data acquisition module obtains the target invoice data to be detected in the target enterprise, the feature extraction module determines the invoice feature information of at least one dimension in the target invoice data, and then the anomaly detection module inputs the invoice feature information into the anomaly detection model to identify and detect the target potential anomaly type. Then the anomaly verification module determines whether to issue an anomaly warning. Finally, when the anomaly warning module determines to issue an anomaly warning, it verifies the target potential anomaly type, obtains the verified anomaly type, and issues a targeted anomaly warning.

[0055] In a third aspect of the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is loaded and executed by a processor, the method steps described in any one of the first aspects are performed.

[0056] In a fourth aspect of the present application, an electronic device is provided, specifically comprising:

[0057] A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the processor is used to load and execute the computer program stored in the memory so that the electronic device performs the method as described in any one of the first aspects.

[0058] In summary, the present application includes at least one of the following beneficial technical effects: the invoice feature information of the target invoice data is input into the anomaly detection model to efficiently detect and identify the invoice anomalies that may exist in the target invoice data. Then, based on each target invoice feature dimension and the corresponding target invoice anomaly type, the possibility of the actual anomaly occurring in the target invoice data identified by the anomaly detection model is analyzed, and then it is accurately determined whether to issue an abnormal warning, thereby avoiding the false triggering of the warning to a certain extent. Finally, the target potential anomaly type identified by the anomaly detection model is verified, thereby improving the accuracy of invoice anomaly detection, thereby issuing a more accurate warning for the target invoice data. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a flowchart of an anomaly detection method based on multivariate data analysis provided in an embodiment of the present application;

[0060] Figure 2 It is a flowchart of another anomaly detection method based on multivariate data analysis provided in an embodiment of the present application;

[0061] Figure 3 It is a structural schematic diagram of an anomaly detection system based on multivariate data analysis provided in an embodiment of the present application;

[0062] Figure 4 It is a structural diagram of another anomaly detection system based on multivariate data analysis provided in an embodiment of the present application.

[0063] Explanation of the accompanying drawings: 11. Data acquisition module; 12. Feature extraction module; 13. Anomaly detection module; 14. Anomaly verification module; 15. Anomaly warning module; 16. Dimension investigation module; 17. Anomaly verification module. DETAILED DESCRIPTION

[0064] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0065] In the description of the embodiments of the present application, words such as "illustrative", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "illustrative", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "illustrative", "for example" or "for example" is intended to present related concepts in a concrete way.

[0066] In the description of the embodiments of the present application, the term "and / or" is only a kind of association relationship describing the associated objects, indicating that there may be three kinds of relationships, for example, A and / or B, which can represent: A exists alone, B exists alone, and A and B exist at the same time. In addition, unless otherwise specified, the meaning of the term "multiple" refers to two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" can explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0067] See also Figure 1 The present application embodiment discloses a flowchart of an anomaly detection method based on multivariate data analysis, which can be implemented by a computer program or run on an anomaly detection system based on multivariate data analysis based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application, specifically including:

[0068] S101: Obtain at least one target invoice data to be detected in a target enterprise.

[0069] Specifically, in an embodiment of the present application, the target enterprise is an enterprise that needs to review invoices, and the invoices correspond to various business transactions of the target enterprise. Each invoice can correspond to a single business transaction. In other embodiments, each invoice can also correspond to multiple business transactions, that is, combined invoices are issued. In addition, the business transaction can be a transaction related to the target enterprise's business operations, such as selling company products or providing company services. In other embodiments, it can also be a transaction related to a company's procurement project. Furthermore, the target invoice data is data in the image format of the invoice that needs to be detected for abnormalities, or it can be data in the PDF or OFD format of the invoice that needs to be detected for abnormalities.

[0070] Furthermore, the embodiment of the present application discloses an anomaly detection method based on multivariate data analysis, the execution subject of which is a server, the server is wirelessly connected to the terminal, a client or applet for invoice anomaly detection is installed in the terminal, and the server is the background server of the client or applet, which can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. The terminal can be a tablet computer or a personal computer. A feasible way to obtain at least one target invoice data to be detected is that the financial personnel in the target enterprise open the client or applet in the terminal, and send the target invoice data stored in the terminal to the server through the client or applet, and finally the server obtains the target invoice data.

[0071] S102: Preprocess each target invoice data to obtain corresponding invoice characteristic information of at least one dimension.

[0072] Specifically, after obtaining the target invoice data, each target invoice data is preprocessed. In the embodiment of the present application, a feasible way of preprocessing is: optical character recognition (OCR) is performed on the target invoice data to obtain the recognition result, and then cleaning and normalization are performed to improve the quality of the data, and then feature engineering is performed to extract invoice feature information of at least one dimension (invoice feature dimension) that can be recognized by the subsequent model from the target invoice data. Among them, the target invoice data includes but is not limited to invoice feature information of dimensions such as invoice amount, business transaction, information of both parties to the transaction, invoice date, invoice code, etc.

[0073] S103: Input the invoice feature information of each target invoice data into a preset anomaly detection model to determine the target potential anomaly type of the corresponding target invoice data.

[0074] Specifically, after obtaining the invoice feature information in the target invoice data, each invoice feature information in the single target invoice data is input into the preset anomaly detection model, so as to predict the target potential anomaly type of the corresponding target invoice data. The anomaly detection model is used to detect whether the target invoice data has potential anomaly risks, so as to better avoid potential violations or fraudulent issuances. For example, it can detect whether the target invoice data has potential abnormal risks of false invoices. In an embodiment of the present application, the anomaly detection model can be a trained isolation forest model, and in other embodiments, it can also be a trained support vector machine. Furthermore, the training process is briefly described as follows: the results of pre-processing the historical invoice data marked with abnormal types and the historical invoice data without abnormalities are used as training samples, and input into the preset isolation forest model for training. During the training process, the model parameters are adjusted by the reverse gradient algorithm until the model converges.

[0075] S104: Determine whether to issue an abnormality warning based on the target potential abnormality type, at least one target invoice feature dimension in which abnormalities are likely to occur in the invoices of the target enterprise, and the corresponding at least one target invoice abnormality type.

[0076] Specifically, if the target invoice data has the target potential abnormal type, it means that the target invoice data may have abnormal risks, and it is necessary to further verify whether the abnormal risk actually exists, so as to facilitate and accurately issue early warnings and avoid false warnings. Then, the historical abnormal records of the target enterprise under the manual review of the invoice are retrieved. The historical abnormal records include but are not limited to the historical invoice feature dimensions with abnormalities in the historical invoices and the corresponding historical invoice abnormal types. Based on the historical abnormal records, the first occurrence number of each historical invoice feature dimension is counted. The larger the first occurrence number, the more likely the invoice feature information of the corresponding historical invoice feature dimension in the target enterprise's invoice will be abnormal. Then, in order of the first occurrence number from large to small, the historical invoice feature dimension with the first number is selected from each historical invoice feature dimension to be determined as the target invoice feature dimension, that is, the invoice feature dimension that is prone to abnormalities.

[0077] Furthermore, based on the above historical exception records, determine the historical invoice exception types that exist in historical invoices when an exception occurs in the invoice feature information of a single target invoice feature dimension, and count the second occurrence times of each historical invoice exception type. The larger the second occurrence times, the more likely it is that the corresponding historical invoice exception type will exist when an exception occurs in the target invoice feature dimension. Then, in descending order of the second occurrence times, select the historical invoice exception type with the second number from each historical invoice exception type to determine the target invoice exception type of the corresponding target invoice feature dimension, that is, the invoice exception type that is likely to occur.

[0078] Furthermore, the first weight of each target invoice feature dimension and the second weight of each corresponding target invoice exception type are calculated, the first weight being the ratio of the first occurrence number of each target invoice feature dimension to the sum of the first occurrence numbers of all target invoice feature dimensions, and the second weight being the ratio of the second occurrence number of a single target invoice exception type corresponding to the target invoice feature dimension to the sum of the second occurrence numbers of all corresponding target invoice exception types. Then, the target invoice feature dimension in which this target potential abnormal type exists in the corresponding target invoice abnormal types is determined as the key invoice feature dimension, and the first product of the first weight of a single key invoice feature dimension and the second weight of the corresponding target potential abnormal type is calculated. The larger the first product is, the more likely this target potential abnormal type is to exist when an abnormality occurs in the invoice feature information of the key invoice feature dimension. Then, each first product is summed to obtain the sum of the first products, and the sum of the first products is compared with the preset product sum threshold. If the sum of the first products is greater than the product sum threshold, it means that the overall possibility of the target potential abnormal type is large and the invoice feature information of the key invoice feature dimension is large. The possibility of abnormality is high, and there is a high probability of abnormal risk, then it is determined to perform a normal abnormal warning; otherwise, it means that there is a high probability that there is no abnormal risk, then it is determined not to perform an abnormal warning.

[0079] S105: If yes, verify the target potential abnormal type to obtain a verified abnormal type, and issue an abnormal warning for the verified abnormal type.

[0080] Specifically, if it is determined to issue an abnormal warning, then it is necessary to verify the object to be warned, that is, the target potential abnormal type. In the embodiment of the present application, a feasible verification method is: calculate the second product of the first weight of each key invoice feature dimension and the second weight of each corresponding target invoice abnormal type. The larger the second product, the more likely it is that the corresponding target invoice abnormal type will exist when the invoice feature information of the key invoice feature dimension is abnormal. Further, the maximum second product is selected from the second products corresponding to the same key invoice feature dimension, and the target invoice abnormal type corresponding to the single maximum second product is determined as the key invoice abnormal type, that is, the target invoice abnormal type that is most likely to appear when information abnormality occurs in a single key invoice feature dimension. If the key invoice anomaly types corresponding to each key invoice feature dimension are consistent, and the target invoice anomaly types that are most likely to appear when information anomalies appear in each key invoice feature dimension are consistent, it means that there is a strong correlation between each key invoice feature dimension for the occurrence of this key invoice anomaly type, and thus it can not only verify that the key invoice feature dimension is the invoice feature dimension with a high probability of abnormality in the target invoice data that needs to be warned of abnormality, and provide a reliable investigation dimension for subsequent invoice anomaly investigation, but also accurately determine the invoice anomaly type that is likely to exist, that is, the key invoice anomaly type. If the key invoice anomaly type is the same as the target potential anomaly type, it means that the target potential anomaly type has been verified, and the target potential anomaly type is determined as the abnormal type after verification; if the key invoice anomaly type is different from the target potential anomaly type, then the key invoice anomaly type is determined as the abnormal type after verification. This improves the accuracy of determining the invoice anomaly type, making it easier to provide more targeted abnormal warnings in the future.

[0081] In other embodiments, after the abnormal type after verification is determined, the target invoice data corresponding to the abnormal type after verification is determined as the invoice data to be checked, and the second products corresponding to each key invoice feature dimension are summed to obtain the corresponding sum of the second products, and then the checking order of each key invoice feature dimension in the invoice data to be checked is determined according to the sum of the second products. The larger the sum of the second products, the greater the overall possibility of invoice abnormality when information abnormality occurs in the corresponding key invoice feature dimension, the higher the corresponding checking order, and the higher the priority of checking the occurrence of information abnormality in the corresponding dimension. Furthermore, each checking order is sent to the terminal of the financial personnel, so that the financial personnel can check the invoice feature information of the corresponding key invoice feature dimension according to each checking order, so as to facilitate better checking of the abnormal type of the invoice data after verification to be checked, and efficiently and accurately determine the invoice abnormality.

[0082] See also Figure 2The present application embodiment discloses a flowchart of another anomaly detection method based on multivariate data analysis, which can be implemented by a computer program or run on an anomaly detection system based on multivariate data analysis based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application, specifically including:

[0083] S201: Obtain at least one target invoice data to be detected in a target enterprise.

[0084] S202: Preprocess each target invoice data to obtain corresponding invoice characteristic information of at least one dimension.

[0085] S203: Input the invoice feature information of each target invoice data into a preset anomaly detection model to determine the target potential anomaly type of the corresponding target invoice data.

[0086] S204: Determine whether to issue an abnormality warning based on the target potential abnormality type, at least one target invoice feature dimension in which abnormalities are likely to occur in the invoices of the target enterprise, and the corresponding at least one target invoice abnormality type.

[0087] S205: If yes, verify the target potential abnormal type to obtain a verified abnormal type, and issue an abnormal warning for the verified abnormal type.

[0088] For details, please refer to steps S101-S105, which will not be described in detail here.

[0089] S206: When the abnormal type after verification is that the invoice amount does not match the business transaction, if the verification result of the abnormal type after verification sent by the terminal is not obtained within the preset time, the first occurrence frequency of the historical business transactions of the target enterprise in which the invoice abnormality has occurred is counted, and the third historical business transaction is selected from each historical business transaction in descending order of the first occurrence frequency to determine it as the target business transaction.

[0090] S207: Count the second occurrence frequencies of the historical invoice amount intervals when the invoice has an abnormal type after verification under each target business transaction, and select the fourth historical invoice amount interval from each historical invoice amount interval in descending order of the second occurrence frequencies to determine as the target amount interval for the corresponding target business transaction.

[0091] Specifically, after issuing an abnormal warning for the abnormal type after verification, the invoice data to be checked with a high probability of abnormal type after verification is sent to the terminal of the financial personnel, so as to facilitate the financial personnel to conduct targeted investigation and verification. When the abnormal type after verification is that the invoice amount does not match the business transaction, that is, the transaction item in the invoice does not match the corresponding transaction amount. If the verification result for the abnormal type after verification sent by the terminal is not obtained after the preset time, it means that the verification efficiency is low. In order to complete the verification of the abnormal type after verification as soon as possible and avoid possible violations or fraudulent behaviors in time, the historical transaction archive of this target enterprise is retrieved. The historical transaction archive includes but is not limited to each historical business transaction of the target enterprise, the amount range of the invoice amount, and the existence of invoice abnormalities. Based on the historical transaction archive, the first occurrence frequency of the historical business transactions of the target enterprise with invoice abnormalities is counted. The greater the first occurrence frequency, the more likely the corresponding historical business transaction is to have invoice abnormalities. According to the order of the first occurrence frequency from large to small, the third historical business transaction is selected from each historical business transaction to determine the target business transaction, that is, the business transaction that is prone to invoice abnormalities. Furthermore, when an abnormal type of invoice after verification occurs in an invoice corresponding to a single target business transaction, the second occurrence frequency of the historical invoice amount interval in which the invoice amount is located is counted. The greater the second occurrence frequency, the more likely the invoice amount of the abnormal type of invoice after verification occurs in the target business transaction is to be in the corresponding historical invoice amount interval. Then, in descending order of the second occurrence frequency, the fourth number of historical invoice amount intervals is selected from each historical invoice amount interval to be determined as the target amount interval of the corresponding target business transaction, that is, the invoice amount interval in which the invoice amount is likely to be located.

[0092] S208: Calculate the third weight of each target business transaction and the fourth weight of each corresponding target amount range.

[0093] S209: Verify whether the abnormal type exists after verification according to the third weight and the corresponding fourth weights.

[0094] Specifically, in the embodiment of the present application, the third weight is the ratio of the first occurrence frequency of each target business transaction to the sum of the first occurrence frequencies of all target business transactions, and the fourth weight is the ratio of the second occurrence frequency of a single target amount interval corresponding to the target business transaction to the sum of the second occurrence frequencies of all corresponding target amount intervals. Further, based on the invoice feature information of each dimension extracted from the invoice data to be checked for abnormal types after verification, the invoice feature information of the business transaction dimension is screened out, that is, the actual business transaction in the invoice data to be checked; the invoice feature information of the invoice amount dimension is screened out, that is, the actual invoice amount in the invoice data to be checked.

[0095] When the actual business transaction is the target business transaction, the third product of the third weight of the actual business transaction and the fourth weight of each corresponding target amount interval is calculated and summed to obtain the corresponding sum of the third products. The larger the sum of the third products, the greater the possibility of the abnormal type after verification due to the abnormal invoice amount; then the third weight of each remaining target business transaction and the fourth product of the corresponding fourth weight of each target amount interval are calculated and summed to obtain the corresponding sum of the fourth products, and then the sum of the fourth products is summed to obtain the final sum of products. The larger the final sum of products, the greater the overall possibility of the abnormal type after verification due to the invoice amount problem in the target business transactions other than the actual business transaction. Among them, the remaining target business transactions are the target business transactions other than the actual business transactions.

[0096] Furthermore, if the sum of the third products is greater than the sum of the final products, it means that the possibility of the actual business transaction having a post-verification abnormal type due to the invoice amount problem is higher than that of the non-actual business transaction, then the target business transaction containing the actual invoice amount in the corresponding target amount interval is determined as an important business transaction, and the target amount interval containing the actual invoice amount is determined as an important amount interval. Next, the fifth product of the third weight of each important business transaction and the fourth weight of the corresponding important amount interval is calculated. The larger the fifth product, the more likely it is that the post-verification abnormal type will occur when the invoice amount of the corresponding important business transaction is the actual invoice amount. Then, the largest fifth product is selected from each fifth product. The invoice amount of the important business transaction corresponding to the largest fifth product is the actual invoice amount, and the possibility of the post-verification abnormal type of the invoice is the largest. Finally, if the important business transaction corresponding to the largest fifth product is consistent with the actual business transaction, it means that there is indeed an abnormality in the invoice amount and the business transaction do not match in the invoice data to be checked, so as to quickly and accurately verify the existence of the post-verification abnormal type.

[0097] The implementation principle of an anomaly detection method based on multivariate data analysis in an embodiment of the present application is as follows: the invoice feature information of the target invoice data is input into the anomaly detection model, and the invoice anomalies that may exist in the target invoice data are efficiently detected and identified. Then, based on each target invoice feature dimension and the corresponding target invoice anomaly type, the possibility of real anomalies in the target invoice data identified by the anomaly detection model is analyzed, and then it is accurately determined whether to issue an abnormal warning, thereby avoiding the false triggering of the warning to a certain extent. Finally, the target potential anomaly type identified by the anomaly detection model is verified, thereby improving the accuracy of invoice anomaly detection, thereby issuing a more accurate warning for the target invoice data.

[0098] The following is a system embodiment of the present application, which can be used to execute the method embodiment of the present application. For details not disclosed in the system embodiment of the present application, please refer to the method embodiment of the present application.

[0099] See also Figure 3 , which is a schematic diagram of the structure of an anomaly detection system based on multivariate data analysis provided in an embodiment of the present application. The anomaly detection system based on multivariate data analysis can be implemented as all or part of a device through software, hardware, or a combination of both. The system includes a data acquisition module 11, a feature extraction module 12, an anomaly detection module 13, an anomaly verification module 14, and an anomaly warning module 15.

[0100] The data acquisition module 11 is used to acquire at least one target invoice data to be detected in the target enterprise;

[0101] A feature extraction module 12 is used to pre-process each target invoice data to obtain corresponding invoice characteristic information of at least one dimension;

[0102] Anomaly detection module 13, used to input the invoice feature information of each target invoice data into a preset anomaly detection model to determine the target potential anomaly type of the corresponding target invoice data;

[0103] The abnormality checking module 14 is used to determine whether to issue an abnormality warning based on the target potential abnormality type, at least one target invoice feature dimension in which abnormalities are likely to occur in the invoices of the target enterprise, and at least one corresponding target invoice abnormality type, where the target invoice abnormality type is an invoice abnormality type that is likely to occur when the invoice feature information of the corresponding target invoice feature dimension is abnormal;

[0104] The abnormality warning module 15 is used to verify the target potential abnormality type, obtain the verified abnormality type, and issue an abnormality warning for the verified abnormality type.

[0105] Optionally, the abnormality checking module 14 is specifically used for:

[0106] Obtain the historical invoice feature dimensions that have had abnormalities in the historical invoices of the target enterprise, count the first occurrence times of each historical invoice feature dimension, and select the historical invoice feature dimension with the first number from each historical invoice feature dimension in descending order of the first occurrence times to determine it as the target invoice feature dimension;

[0107] Determine the historical invoice exception type that exists when the invoice feature information of each target invoice feature dimension is abnormal, count the second occurrence times of each historical invoice exception type, and select the historical invoice exception type with the second occurrence times from each historical invoice exception type in descending order as the target invoice exception type of the corresponding target invoice feature dimension;

[0108] Calculate the first weight of each target invoice feature dimension and the second weight of each corresponding target invoice exception type, where the first weight is the ratio of the first occurrence number of each target invoice feature dimension to the sum of the first occurrence numbers of all target invoice feature dimensions, and the second weight is the ratio of the second occurrence number of a single target invoice exception type corresponding to the target invoice feature dimension to the sum of the second occurrence numbers of all corresponding target invoice exception types;

[0109] Based on the target potential abnormality type, the first weight and the corresponding second weights, it is determined whether to issue an abnormality warning.

[0110] Optionally, the abnormality checking module 14 is specifically used for:

[0111] Determine the target invoice feature dimensions that have target potential anomaly types in the corresponding target invoice anomaly types as key invoice feature dimensions, and calculate the first product of the first weight of each key invoice feature dimension and the second weight of the corresponding target potential anomaly type;

[0112] The first products are summed to obtain a sum of the first products, and the sum of the first products is compared with a preset product sum threshold value. If the sum of the first products is greater than the product sum threshold value, it is determined that an abnormal warning is issued;

[0113] If the sum of the first products is not greater than the product sum threshold, it is determined that no abnormal warning is issued.

[0114] Optionally, the abnormal warning module 15 is specifically used for:

[0115] Determine the target invoice feature dimensions that have target potential abnormal types in the corresponding target invoice abnormal types as key invoice feature dimensions, and calculate the second product of the first weight of each key invoice feature dimension and the second weight of the corresponding target invoice abnormal type;

[0116] Select the largest second product from the second products corresponding to the same key invoice feature dimension;

[0117] Determine the target invoice exception type corresponding to each largest second product as the key invoice exception type, and determine whether the key invoice exception types are consistent;

[0118] If so, when the key invoice exception type is the same as the target potential exception type, the target potential exception type is determined as the verified exception type;

[0119] When the key invoice exception type is different from the target potential exception type, the key invoice exception type is determined as the post-verification exception type.

[0120] Optional, such as Figure 4 As shown, the system further includes a dimension checking module 16, which is specifically used for:

[0121] The target invoice data corresponding to the abnormal type after verification is determined as the invoice data to be checked, and the second products corresponding to each key invoice feature dimension are summed to obtain the corresponding sum of the second products;

[0122] According to the sum of the second products, determine the screening order of each key invoice feature dimension in the invoice data to be screened. The larger the sum of the second products, the higher the corresponding screening order.

[0123] Each checking sequence is sent to the terminal of the financial personnel, so that the financial personnel can check the invoice feature information of the corresponding key invoice feature dimensions according to each checking sequence.

[0124] Optionally, the system further includes an abnormality verification module 17, which is specifically used to:

[0125] When the abnormal type after verification is that the invoice amount does not match the business transaction, if the verification result of the abnormal type after verification sent by the terminal is not obtained within the preset time, the first occurrence frequency of the historical business transactions of the target enterprise with invoice abnormalities is counted, and the third historical business transaction is selected from each historical business transaction in descending order of the first occurrence frequency to determine as the target business transaction;

[0126] When the invoice corresponding to each target business transaction has an abnormal type after verification, the second occurrence frequency of the historical invoice amount range in which the invoice amount is located is counted, and the fourth historical invoice amount range is selected from each historical invoice amount range in descending order of the second occurrence frequency to determine as the target amount range of the corresponding target business transaction;

[0127] Calculate the third weight of each target business transaction and the fourth weight of each corresponding target amount interval, where the third weight is the ratio of the first occurrence frequency of each target business transaction to the sum of the first occurrence frequencies of all target business transactions, and the fourth weight is the ratio of the second occurrence frequency of a single target amount interval corresponding to the target business transaction to the sum of the second occurrence frequencies of all corresponding target amount intervals;

[0128] According to the third weight and the corresponding fourth weights, it is verified whether the abnormal type exists after verification.

[0129] Optionally, the abnormality verification module 17 is specifically used for:

[0130] The target invoice data corresponding to the abnormal type after verification is determined as the invoice data to be checked, and the actual business transaction corresponding to the invoice data to be checked is determined based on the invoice feature information of the business transaction dimension in the invoice data to be checked;

[0131] Based on the invoice feature information of the invoice amount dimension in the invoice data to be checked, the actual invoice amount corresponding to the invoice data to be checked is determined. When the actual business transaction is the target business transaction, the third product of the third weight of the actual business transaction and the fourth weight of each corresponding target amount interval is calculated and summed to obtain the corresponding sum of the third products;

[0132] Calculate and sum the fourth product of the third weight of each remaining target business transaction and the fourth weight of each corresponding target amount interval to obtain the corresponding sum of the fourth products, and sum the sums of the fourth products to obtain the final sum of the products. The remaining target business transactions are the target business transactions other than the actual business transactions.

[0133] If the sum of the third products is greater than the sum of the final products, the target business transactions that contain the actual invoice amounts in the corresponding target amount intervals are determined as important business transactions, and the target amount intervals that contain the actual invoice amounts are determined as important amount intervals;

[0134] The fifth product of the third weight of each important business transaction and the fourth weight of the corresponding important amount range is calculated. If the important business transaction corresponding to the largest fifth product among the fifth products is consistent with the actual business transaction, it is determined that the abnormal type exists after verification.

[0135] It should be noted that the anomaly detection system based on multivariate data analysis provided in the above embodiment only uses the division of the above functional modules as an example when executing the anomaly detection method based on multivariate data analysis. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the anomaly detection system based on multivariate data analysis provided in the above embodiment and the anomaly detection method based on multivariate data analysis embodiment belong to the same concept. The implementation process is detailed in the method embodiment and will not be repeated here.

[0136] An embodiment of the present application further discloses a computer-readable storage medium, and the computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, an anomaly detection method based on multivariate data analysis of the above embodiment is adopted.

[0137] Among them, the computer program can be stored in a computer-readable medium, the computer program includes computer program code, the computer program code can be in the form of source code, object code, executable file or certain middleware, etc. The computer-readable medium includes any entity or device that can carry the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the computer-readable medium includes but is not limited to the above-mentioned components.

[0138] Among them, through this computer-readable storage medium, an anomaly detection method based on multivariate data analysis of the above embodiment is stored in a computer-readable storage medium, and is loaded and executed on a processor to facilitate the storage and application of the above method.

[0139] An embodiment of the present application further discloses an electronic device, wherein a computer program is stored in a computer-readable storage medium, and when the computer program is loaded and executed by a processor, the above-mentioned anomaly detection method based on multivariate data analysis is adopted.

[0140] The electronic device may be a desktop computer, a laptop computer, a cloud server or other electronic device, and the electronic device includes but is not limited to a processor and a memory. For example, the electronic device may also include input and output devices, a network access device, and a bus.

[0141] Among them, the processor can adopt a central processing unit (CPU). Of course, according to actual usage, other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. can also be adopted. The general-purpose processor can adopt a microprocessor or any conventional processor, etc., and this application does not impose any restrictions on this.

[0142] Among them, the memory can be an internal storage unit of the electronic device, such as a hard disk or memory of the electronic device, or it can be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card (SMC), a secure digital card (SD) or a flash memory card (FC) equipped on the electronic device. Moreover, the memory can also be a combination of an internal storage unit and an external storage device of the electronic device. The memory is used to store computer programs and other programs and data required by the electronic device. The memory can also be used to temporarily store data that has been output or is to be output, and this application does not impose any restrictions on this.

[0143] Among them, through this electronic device, an abnormality detection method based on multivariate data analysis of the above embodiment is stored in the memory of the electronic device, and is loaded and executed on the processor of the electronic device for easy use.

[0144] The above is only an exemplary embodiment of the present disclosure and cannot be used to limit the scope of the present disclosure. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. This application is intended to cover any variation, use or adaptive change of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field that are not recorded in the present disclosure. The description and examples are only regarded as exemplary, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. An anomaly detection method based on multivariate data analysis, characterized in that: The method comprises: Acquire at least one target invoice data to be detected in the target enterprise; Preprocessing each of the target invoice data to obtain corresponding invoice characteristic information of at least one dimension; Inputting the invoice feature information of each target invoice data into a preset anomaly detection model to determine the target potential anomaly type of the corresponding target invoice data; Determine whether to issue an abnormality warning based on the target potential abnormality type, at least one target invoice feature dimension in which abnormalities are likely to occur in the invoices of the target enterprise, and at least one corresponding target invoice abnormality type, wherein the target invoice abnormality type is an invoice abnormality type that is likely to occur when an abnormality occurs in the invoice feature information of the corresponding target invoice feature dimension; If it is determined to issue an abnormality warning, the target potential abnormality type is verified to obtain a verified abnormality type, and an abnormality warning is issued for the verified abnormality type.

2. The anomaly detection method based on multivariate data analysis according to claim 1, characterized in that: The determining whether to issue an abnormality warning based on the target potential abnormality type, at least one target invoice feature dimension in which abnormalities are likely to occur in the invoices of the target enterprise, and at least one corresponding target invoice abnormality type specifically includes: Acquire historical invoice feature dimensions that have appeared abnormally in the historical invoices of the target enterprise, count the first occurrence times of each of the historical invoice feature dimensions, and select the historical invoice feature dimension with the first number from each of the historical invoice feature dimensions in descending order of the first occurrence times to determine it as the target invoice feature dimension; Determine the historical invoice exception type that exists when the invoice feature information of each target invoice feature dimension is abnormal, count the second occurrence times of each historical invoice exception type, and select the historical invoice exception type with the second number from each historical invoice exception type in descending order of the second occurrence times to determine it as the target invoice exception type of the corresponding target invoice feature dimension; Calculate a first weight of each target invoice feature dimension and a second weight of each corresponding target invoice exception type, wherein the first weight is a ratio of a first occurrence number of each target invoice feature dimension to a sum of first occurrence numbers of all target invoice feature dimensions, and the second weight is a ratio of a second occurrence number of a single target invoice exception type corresponding to the target invoice feature dimension to a sum of second occurrence numbers of all corresponding target invoice exception types; Based on the target potential abnormality type, the first weight and the corresponding second weights, it is determined whether to issue an abnormality warning.

3. The anomaly detection method based on multivariate data analysis according to claim 2, characterized in that: The determining whether to issue an abnormality warning based on the target potential abnormality type, the first weight and the corresponding second weights specifically includes: Determine the target invoice feature dimensions that have the target potential abnormality type in the corresponding target invoice abnormality types as key invoice feature dimensions, and calculate the first product of the first weight of each key invoice feature dimension and the second weight of the corresponding target potential abnormality type; Summing the first products to obtain a sum of the first products, and comparing the sum of the first products with a preset product sum threshold, and if the sum of the first products is greater than the product sum threshold, determining to issue an abnormal warning; If the sum of the first products is not greater than the product sum threshold, it is determined that no abnormal warning is issued.

4. The anomaly detection method based on multivariate data analysis according to claim 2, characterized in that: Verifying the target potential abnormality type to obtain a verified abnormality type specifically includes: Determine the target invoice feature dimensions that have the target potential abnormality type in the corresponding target invoice abnormality types as key invoice feature dimensions, and calculate the second product of the first weight of each key invoice feature dimension and the second weight of the corresponding target invoice abnormality type; Selecting the maximum second product from the second products corresponding to the same key invoice feature dimension; Determine the target invoice exception type corresponding to each of the maximum second products as the key invoice exception type, and determine whether each of the key invoice exception types is consistent; If so, when the key invoice anomaly type is the same as the target potential anomaly type, the target potential anomaly type is determined as the post-verification anomaly type; When the key invoice anomaly type is different from the target potential anomaly type, the key invoice anomaly type is determined as the post-verification anomaly type.

5. The anomaly detection method based on multivariate data analysis according to claim 4, characterized in that: The method further comprises: Determine the target invoice data corresponding to the verified abnormal type as the invoice data to be checked, and sum the second products corresponding to each of the key invoice feature dimensions to obtain the corresponding sum of the second products; According to the sum of the second products, determining the screening order of the key invoice feature dimensions in the invoice data to be screened, the larger the sum of the second products, the higher the corresponding screening order; Each of the above-mentioned screening sequences is sent to the terminal of the financial personnel, so that the financial personnel can screen the invoice feature information of the corresponding key invoice feature dimensions according to each of the above-mentioned screening sequences.

6. The anomaly detection method based on multivariate data analysis according to claim 1, characterized in that: The method further comprises: When the abnormal type after verification is that the invoice amount does not match the business transaction, if the verification result of the abnormal type after verification sent by the terminal is not obtained within a preset time, the first occurrence frequency of the historical business transactions of the target enterprise in which the invoice abnormality occurred is counted, and the third historical business transaction is selected from each of the historical business transactions in descending order of the first occurrence frequency to determine as the target business transaction; When the invoice corresponding to each target business transaction has the abnormal type after verification, the second occurrence frequency of the historical invoice amount interval in which the invoice amount is located is counted, and in descending order of the second occurrence frequency, the fourth number of the historical invoice amount interval is selected from each of the historical invoice amount intervals to determine as the target amount interval of the corresponding target business transaction; Calculate a third weight of each target business transaction and a fourth weight of each corresponding target amount interval, wherein the third weight is a ratio of a first occurrence frequency of each target business transaction to a sum of first occurrence frequencies of all target business transactions, and the fourth weight is a ratio of a second occurrence frequency of a single target amount interval corresponding to the target business transaction to a sum of second occurrence frequencies of all corresponding target amount intervals; According to the third weight and the corresponding fourth weights, it is verified whether the post-verification abnormality type exists.

7. The anomaly detection method based on multivariate data analysis according to claim 6, characterized in that: The verifying, according to the third weight and the corresponding fourth weights, whether the abnormal type after verification exists specifically includes: Determine the target invoice data corresponding to the verified abnormal type as the invoice data to be checked, and determine the actual business transaction corresponding to the invoice data to be checked based on the invoice feature information of the business transaction dimension in the invoice data to be checked; Based on the invoice feature information of the invoice amount dimension in the invoice data to be checked, the actual invoice amount corresponding to the invoice data to be checked is determined, and when the actual business transaction is a target business transaction, the third product of the third weight of the actual business transaction and the fourth weight of each corresponding target amount interval is calculated and summed to obtain the corresponding sum of the third products; Calculate and sum the fourth product of the third weight of each remaining target business transaction and the fourth weight of each corresponding target amount interval to obtain the corresponding sum of the fourth products, and sum the sums of the fourth products to obtain the final sum of the products, wherein the remaining target business transactions are target business transactions other than the actual business transactions; If the sum of the third products is greater than the sum of the final products, the target business transactions containing the actual invoice amount in the corresponding target amount intervals are determined as important business transactions, and the target amount interval containing the actual invoice amount is determined as an important amount interval; The fifth product of the third weight of each of the important business transactions and the fourth weight of the corresponding important amount range is calculated. If the important business transaction corresponding to the maximum fifth product among the fifth products is consistent with the actual business transaction, it is determined that the post-verification exception type exists.

8. An anomaly detection system based on multivariate data analysis, characterized in that: include: A data acquisition module (11), used for acquiring at least one target invoice data to be detected in a target enterprise; A feature extraction module (12) is used to pre-process each target invoice data to obtain corresponding invoice characteristic information of at least one dimension; An anomaly detection module (13), used for inputting the invoice feature information of each target invoice data into a preset anomaly detection model, and determining the target potential anomaly type of the corresponding target invoice data; An abnormality checking module (14) is used to determine whether to issue an abnormality warning based on the target potential abnormality type, at least one target invoice feature dimension in which abnormalities are likely to occur in the invoices of the target enterprise, and at least one corresponding target invoice abnormality type, wherein the target invoice abnormality type is an invoice abnormality type that is likely to occur when the invoice feature information of the corresponding target invoice feature dimension is abnormal; The abnormality warning module (15) is used to verify the target potential abnormality type if it is determined to issue an abnormality warning, obtain the verified abnormality type, and issue an abnormality warning for the verified abnormality type.

9. A computer-readable storage medium having a computer program stored therein, characterized in that: When the computer program is loaded and executed by a processor, the method according to any one of claims 1 to 7 is adopted.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that: When the processor loads and executes the computer program, the method according to any one of claims 1 to 7 is adopted.

Images