An automobile industry financial data processing method, platform and system based on big data

Abstract

The application discloses a big data-based automobile industry financial data processing method, and relates to the field of data processing. The method comprises the following steps: obtaining automobile industry financial data; analyzing the data flow characteristics of the automobile industry financial data; constructing an industry financial data graph network according to the data flow characteristics of the automobile industry financial data; sampling the industry financial data graph network based on feature similarity to obtain a flow characteristic sample set, and dividing the flow characteristic sample set into an abnormal training set and an abnormal test set; performing negative sample sampling on the abnormal training set to obtain a mixed training set; after marking the abnormal points of the mixed training set, inputting the mixed training set into a preset industry financial anomaly detection model for iterative training to obtain a target industry financial anomaly detection model; and inputting the abnormal test set into the target industry financial anomaly detection model to obtain the data anomaly degree of the automobile industry financial data. The application can effectively realize high-precision anomaly detection on data with large data volume and high dimension.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of industry and finance data processing, and particularly relate to a big data-based automobile industry and finance data processing method, platform and system. BACKGROUND

[0002] With the rapid development of social economy, the automobile industry and finance data stored in enterprises presents a trend of scale growth. Meanwhile, due to the continuous rise of information technology, the automobile industry and finance data realizes information interconnection through big data. The automobile industry and finance data covers data in multiple aspects such as finance, sales, market and customers. According to these data, reliable development guidelines and strategic decisions can be made for the subsequent development of enterprises. However, due to the wide coverage and large amount of data, some abnormal data will inevitably appear. For example, the sales data of the sales department is significantly lower than that of the previous months. Behind these abnormal data, there may be some abnormal behaviors. These abnormal behaviors and data will affect the subsequent development of enterprises to some extent. Therefore, it is of great significance to perform abnormal analysis and evaluation on the automobile industry and finance data.

[0003] In the prior art, the detection of industry and finance data anomalies mainly relies on a certain distribution (such as normal distribution, Poisson distribution and binomial distribution) or probability model. By judging whether a data point conforms to the distribution / model, that is, by judging a small probability event, the detection of industry and finance data anomalies is realized. However, this method has low sensitivity and large calculation amount. For high-dimensional industry and finance data, the abnormal detection effect has low precision and large error. SUMMARY

[0004] Embodiments of the present application provide a big data-based automobile industry and finance data processing method, which is used to solve the problem that the prior art cannot realize high-precision abnormal detection on data with large amount and high dimension.

[0005] To achieve the above-mentioned purpose, embodiments of the present application adopt the following technical solutions:

[0006] In a first aspect, a big data-based automobile industry and finance data processing method is provided. The method comprises:

[0007] obtaining automobile industry and finance data of a target enterprise;

[0008] performing data flow feature analysis according to the automobile industry and finance data to obtain data flow features;

[0009] regarding all departments of the target enterprise and a plurality of sub-departments corresponding to the departments as department nodes, and regarding the data flow features as feature edges between the department nodes to construct an industry and finance data graph network of the target enterprise, the industry and finance data graph network being a high-dimensional data graph network;

[0010] extracting a feature similarity between each department node and a plurality of neighbor nodes in the industry and finance data graph network, screening the department nodes and the feature edges of the department nodes in the industry and finance data graph network according to the feature similarity, obtaining a plurality of data circulation feature samples, and integrating all the data circulation feature samples to obtain a circulation feature sample set, the neighbor nodes being a plurality of adjacent nodes around the department node;

[0011] randomly dividing the circulation feature sample set into an abnormal training set and an abnormal test set;

[0012] performing negative sample sampling on the abnormal training set to expand the negative samples in the abnormal training set, and obtaining a mixed training set after expansion of the negative samples;

[0013] constructing a data grid space based on the mixed training set, calculating the grid density of the grid cells in the data grid space, marking all abnormal grids in the data grid space according to the grid density, and marking all target training nodes in the abnormal grids based on the angle features and distance features between the target training nodes in the abnormal grids;

[0014] inputting the mixed training set after completion of the abnormal point marking into a preset industry and finance anomaly detection model for iterative training until the number of iterations reaches a preset maximum training number, and obtaining a target industry and finance anomaly detection model after completion of training;

[0015] inputting the abnormal test set into the target industry and finance anomaly detection model to obtain the data anomaly degree of the automobile industry and finance data.

[0016] Optionally, the extracting a feature similarity between each department node and a plurality of neighbor nodes in the industry and finance data graph network, screening the department nodes and the feature edges of the department nodes in the industry and finance data graph network according to the feature similarity, obtaining a plurality of data circulation feature samples, and integrating all the data circulation feature samples to obtain a circulation feature sample set comprises the following steps:

[0017] for each department node in the industry and finance data graph network, extracting feature vectors of the department node and all neighbor nodes from the industry and finance data graph network to obtain a department feature vector and a plurality of neighbor feature vectors;

[0018] calculating the feature similarity between the department feature vector and each neighbor feature vector by using a similarity formula;

[0019] If there is a target feature similarity exceeding a preset similarity threshold, the department node, the target neighbor node corresponding to the target feature similarity, and the target feature edge between the department node and the target neighbor node are extracted as data flow feature samples;

[0020] After traversing all the department nodes, all the data flow feature samples are integrated to obtain a flow feature sample set.

[0021] Optionally, the negative sample sampling on the abnormal training set to expand the negative samples in the abnormal training set to obtain the mixed training set after expansion of the negative samples includes the following steps:

[0022] A plurality of data flow feature samples are extracted from the abnormal training set, and the data flow feature samples are evenly divided and integrated to obtain a first feature sample set and a second feature sample set;

[0023] The sample feature vectors of the first feature sample set and the sample feature values corresponding to the sample feature vectors are extracted by principal component analysis;

[0024] The sample feature vectors with sample feature values greater than or equal to a preset feature value threshold are screened out to obtain a plurality of principal components, and the principal components are key features of the first feature sample set;

[0025] The key features are used as feature subspaces, and feature perturbations are performed on all the feature subspaces to generate a plurality of feature negative samples;

[0026] A plurality of subgraphs of the second feature sample set are extracted, and all the subgraphs are used as structure subspaces;

[0027] Structure perturbations are performed on all the structure subspaces to generate a plurality of structure negative samples;

[0028] All the feature negative samples and the structure negative samples are merged into the abnormal training set to obtain a mixed training set.

[0029] Optionally, the data grid space is constructed based on the mixed training set, the grid density of the grid cells in the data grid space is calculated, all abnormal grids in the data grid space are marked according to the grid density, and all target training nodes in the abnormal grids are marked as abnormal points based on the angle features and distance features between the target training nodes in the abnormal grids include the following steps:

[0030] The mixed training set is processed by dimensionality reduction according to rough set theory;

[0031] According to the data distribution of the mixed training set in each dimension after dimension reduction, data density estimation is performed, and a plurality of data-intensive spaces of the mixed training set in different dimensions are constructed according to the data density estimation result;

[0032] A plurality of hyperrectangle sequences of the mixed training set are obtained through the data-intensive space, and the sequence volume of each hyperrectangle sequence is calculated respectively;

[0033] Based on the hyperrectangle sequence with the smallest sequence volume, the data-intensive space is grid divided in each dimension, and a data grid space is obtained;

[0034] After mapping all training nodes in the mixed training set to the data grid space, the grid density of each grid cell in the data grid space is calculated;

[0035] The grid cell with the largest grid density is taken as a center grid;

[0036] Based on the grid density, the relative density difference between the adjacent grid and the center grid of each center grid is calculated respectively;

[0037] If the relative density difference is less than or equal to a preset density difference threshold, the adjacent grid is marked as a normal grid;

[0038] If the relative density difference is greater than the density difference threshold, the adjacent grid is marked as an abnormal grid;

[0039] Based on the grid density, the grid classification and marking step is repeatedly executed until each grid cell participates in the calculation of the relative density difference at least once;

[0040] All nodes in the normal grid and the center grid are marked as normal nodes;

[0041] According to the angle feature and distance feature between all target training nodes in the abnormal grid, the target training nodes are marked as abnormal points;

[0042] The grid classification and marking step comprises:

[0043] Taking any normal grid that is not a reference grid as a reference grid, the reference relative density difference between the adjacent grid and the reference grid of each reference grid is calculated based on the grid density;

[0044] If the reference relative density difference is less than or equal to the density difference threshold, the adjacent grid corresponding to the reference grid is marked as the normal grid;

[0045] If the relative density difference of the reference grid is greater than the density difference threshold, then the adjacent grids corresponding to the reference grid are marked as the abnormal grids.

[0046] Optionally, the dimensionality reduction processing of the hybrid training set based on rough set theory includes the following steps:

[0047] The edge features and node features of each training node in the hybrid training set are extracted respectively, and the node features and the edge features are integrated into the comprehensive features corresponding to the training node;

[0048] Based on all the comprehensive features and according to the rough set theory, the feature weights of each comprehensive feature are calculated separately, as follows:

[0049]

[0050] Where U is the hybrid training set, P(R1) is the positive domain of the edge features in the comprehensive features, P(R2) is the positive domain of the node features in the comprehensive features, and I(k i ,k j )-I(k i ) represents the edge feature k in the comprehensive feature. i Subject to the edge feature k j The impact status, I(p) i ,p j )-I(p i The node feature p in the comprehensive features i Subject to the node feature p j The impact status, I(k) i ) and I(p i ) represents the initial feature weights of the hybrid training set, x represents the total number of edge features in the comprehensive features, and y represents the total number of node features in the comprehensive features;

[0051] If the feature weight of the comprehensive feature is less than the preset feature weight threshold, the corresponding training node will be removed from the hybrid training set.

[0052] Optionally, the step of marking the target training nodes as outliers based on the angle and distance features between all target training nodes in the outlier grid includes the following steps:

[0053] Randomly select a target training node from the abnormal grid as a reference node, and perform an anomaly identification and marking step on the reference node until each target training node has been subjected to the anomaly identification and marking step at least once.

[0054] The anomaly identification and marking step includes:

[0055] determining a plurality of reference neighboring nodes of the reference node in the abnormal grid;

[0056] adding a connection edge between the reference node and the reference neighboring nodes;

[0057] calculating an angle feature of an included angle with the reference node as a vertex by using a cosine formula;

[0058] respectively calculating a distance feature between the reference node and all the reference neighboring nodes, and assigning a weight to the angle feature according to the distance feature;

[0059] obtaining an abnormality degree of the reference node according to the angle feature after the weight assignment and by using an abnormality degree calculation formula as follows:

[0060]

[0061] wherein A is the reference node, B1 and B2 are the reference neighboring nodes, Wn is a set of n target training nodes, is a vector between the reference node A and the reference neighboring node B1, is a vector between the reference node A and the reference neighboring node B2, is a distance between the reference node A and the reference neighboring node B1, is a distance between the reference node A and the reference neighboring node B2, and <·,·> represents a dot product between two vectors, and VAR represents a variance calculation function;

[0062] if the abnormality degree of the reference node is greater than a preset abnormality degree threshold, marking the reference node as an abnormal node;

[0063] if the abnormality degree of the reference node is less than or equal to the abnormality degree threshold, marking the reference node as a normal node.

[0064] Optionally, the mixed training set after the abnormal points are marked is input into a preset industry and finance abnormality detection model for iterative training until the number of iterations reaches a preset maximum training number, and a target industry and finance abnormality detection model after training is obtained as follows:

[0065] inputting the mixed training set after the abnormal points are marked into a preset industry and finance abnormality detection model;

[0066] performing information aggregation on the comprehensive features of all the training nodes in the mixed training set by using an aggregation function to obtain a node aggregation feature;

[0067] The node aggregation feature is forward propagated, and the industry and finance anomaly detection model is adjusted in parameters until the number of parameter adjustment reaches a preset maximum training number, so as to obtain a target industry and finance anomaly detection model.

[0068] Optionally, the aggregation function is as follows:

[0069]

[0070] wherein W is the node aggregation feature, Tx is the number of nodes in the mixed training set, F is a full connection layer in the industry and finance anomaly detection model, W is the weight of the edge feature, W is the weight of the node feature, and is the node information of a training node i and all corresponding neighbor nodes in the mixed training set.

[0071] In a second aspect, the present application provides a big data-based automobile industry and finance data processing platform, which comprises:

[0072] An information acquisition module is configured to acquire automobile industry and finance data of a target enterprise.

[0073] A feature analysis module is configured to perform data flow feature analysis based on the automobile industry and finance data, so as to obtain data flow features.

[0074] A network construction module is configured to construct an industry and finance data graph network of the target enterprise by taking all departments of the target enterprise and a plurality of sub-departments corresponding to the departments as department nodes and taking the data flow features as feature edges between the department nodes.

[0075] A first sampling module is configured to extract feature similarity between each department node and a plurality of neighbor nodes in the industry and finance data graph network, filter the department nodes and the feature edges of the department nodes in the industry and finance data graph network based on the feature similarity, obtain a plurality of data flow feature samples, and integrate all the data flow feature samples to obtain a flow feature sample set, wherein the neighbor nodes are a plurality of adjacent nodes around the department nodes.

[0076] A sample division module is configured to randomly divide the flow feature sample set into an abnormal training set and an abnormal test set.

[0077] A second sampling module is configured to perform negative sample sampling on the abnormal training set to expand negative samples in the abnormal training set, so as to obtain a mixed training set after expansion of the negative samples.

[0078] an information marking module, configured to construct a data grid space based on the mixed training set, calculate a grid density of a grid cell in the data grid space, mark all abnormal grids in the data grid space according to the grid density, and mark all target training nodes in the abnormal grids as abnormal points based on angle features and distance features between the target training nodes in the abnormal grids;

[0079] a model training module, configured to input the mixed training set after the abnormal point marking into a preset industry and finance abnormality detection model for iterative training until a number of iterations reaches a preset maximum training number, so as to obtain a target industry and finance abnormality detection model after training;

[0080] a data detection module, configured to input the abnormal test set into the target industry and finance abnormality detection model, so as to obtain a data abnormality degree of the automobile industry and finance data.

[0081] In a third aspect, an automobile industry and finance data processing system based on big data comprises:

[0082] a memory configured to store instructions; and

[0083] a processor configured to call the instructions from the memory and enable a method of the automobile industry and finance data processing based on big data according to any one of the first aspect when the instructions are executed.

[0084] By the technical solution, the industry and finance data graph network of the target enterprise is constructed by using the industry and finance data of the target enterprise, so as to facilitate subsequent extraction of the industry and finance training set for model training of the pre-constructed industry and finance anomaly detection model, and then the feature similarity between the department nodes and the corresponding neighbor nodes in the industry and finance data graph network is extracted, the industry and finance data graph network is sampled by using the feature similarity, and the industry and finance training set is obtained. In order to ensure that the positive and negative samples in the training set for model training reach approximate balance and have certain similarity between the positive and negative samples, it is necessary to sample the negative samples by using the industry and finance training set, so as to obtain the mixed training set after expansion of the negative samples. Model training of the industry and finance anomaly detection model by using the mixed training set can effectively improve the robustness of the industry and finance anomaly detection model, so that the monitoring result obtained by subsequent anomaly data monitoring of the target enterprise is more reliable. After obtaining the mixed training set, the mixed training set is first marked with abnormal points, the generalization ability of the industry and finance anomaly detection model is improved, the model can be effectively optimized, and finally the mixed training set after completion of the abnormal point marking is input into the industry and finance anomaly detection model, and the target industry and finance anomaly detection model is obtained. Subsequent anomaly recognition of the automobile industry and finance data of the target enterprise is performed by using the target industry and finance anomaly detection model. In summary, a method capable of performing high-precision anomaly detection on large amount of data with high dimension is provided, which can accurately identify the abnormal data of the target enterprise and ensure the long-term development of the target enterprise.

[0085] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0086] Figure 1 A flowchart of an automobile industry and finance data processing method based on big data provided by the embodiments of the present application is shown.

[0087] Figure 2 A structure diagram of an industry and finance anomaly detection model provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0088] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific embodiments described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0089] It should be noted that if the embodiments of the present application involve directionality indication (such as up, down, left, right, front, back, …), the directionality indication is only used to explain the relative position relationship, motion condition, etc. between components in a certain posture (as shown in the drawings), if the certain posture changes, the directionality indication also changes accordingly.

[0090] In addition, if the embodiments of the present application involve "first", "second" and the like, the "first", "second" and the like are only for description purposes, and cannot be understood as indicating or implying the relative importance or implicitly indicating the number of technical features indicated. Therefore, the features limited by "first", "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of each embodiment can be combined with each other, but it must be based on the realization of ordinary skilled in the art, when the combination of technical solutions appears contradictory or unachievable, it should be considered that the combination of technical solutions does not exist, nor within the scope of protection claimed by the present application.

[0091] Figure 1 The flowchart of the method for processing automobile industry financial data based on big data according to the embodiments of the present application is schematically shown. As shown in Figure 1 The embodiments of the present application provide a method for processing automobile industry financial data based on big data, which can include the following steps:

[0092] S101, obtaining automobile industry financial data of a target enterprise.

[0093] In the present embodiment, the automobile industry financial data can be obtained through the database inside the target enterprise, which contains all data information inside the target enterprise, such as personnel appointment of the target enterprise, revenue situation of the target enterprise, R&D progress of the target enterprise, etc. The automobile industry financial data includes the running state of each department of the target enterprise and the business interaction data between departments, wherein the running state of the department includes the sales of the marketing department, the R&D progress of the R&D department, the production efficiency of the production department, the customer maintenance information of the after-sales service department, etc., and the business interaction data between departments includes the manufacturability evaluation report transmitted by the production department to the R&D department, the vehicle quality monitoring report sent by the quality management department to the production department, etc.

[0094] S102, performing data flow feature analysis according to the automobile industry financial data to obtain data flow features.

[0095] In this embodiment, the financial data of the automobile industry is analyzed to analyze whether there is data flow between each department and each sub-department corresponding to each department, if there is data flow, the frequency and mode of data flow are analyzed, and other characteristics, which are data flow characteristics, are analyzed. Data flow refers to information interaction between departments, for example, the legal department will interact with the research and development, production and other departments to assess the legal risks of these departments and ensure that the new products produced and developed by the target enterprise comply with relevant legal regulations. The research and development department, the production department and the sales department will also jointly provide the basis for project budget to the financial department for audit.

[0096] S103, all departments of the target enterprise and the sub-departments corresponding to the departments are taken as department nodes, and the data flow characteristics are taken as characteristic edges between the department nodes to construct an industry and financial data graph network of the target enterprise. The industry and financial data graph network is a high-dimensional data graph network.

[0097] In this embodiment, each department and the sub-departments corresponding to each department are taken as nodes of the data graph network, the departments with information interaction are connected, and the connection relationship between them, the frequency and mode of data flow and other data flow characteristics are taken as characteristic edges of the data graph network, and finally an industry and financial data graph network is constructed. The departments include the research and development department, the production department, the sales department and the like, and the sub-departments are the departments under these departments, for example, the research and development department has product development department, engineering department, test and verification department and the like, the production department includes manufacturing department, process department, equipment maintenance department and the like, and there is information interaction between these sub-departments.

[0098] S104, the characteristic similarity between each department node and the plurality of neighbor nodes in the industry and financial data graph network is extracted, the department nodes and the characteristic edges of the department nodes in the industry and financial data graph network are screened according to the characteristic similarity, a plurality of data flow characteristic samples are obtained, and the flow characteristic sample set is obtained by integrating all data flow characteristic samples. The neighbor nodes are a plurality of adjacent nodes around the department node.

[0099] In the embodiment, the node degree values of different department nodes in the industry and finance data graph network are different. The higher the node degree value, the more important the node, because it has more direct neighbor nodes and can have greater impact on the network structure of the entire industry and finance data graph network. Therefore, the local information represented by each department node is also different. If simple random sampling is performed on these department nodes, nodes with more information may be ignored, increasing the computational burden. Therefore, a non-uniform or weighted sampling method is needed for sampling. The node features of each department node and the neighbor nodes corresponding to the department node are extracted, the node features refer to the running state of the department, the work tasks of the department, etc. The extracted node features are reduced to a low-dimensional vector space to obtain the feature vectors of the department nodes and the neighbor nodes, i.e., the department feature vector and multiple neighbor feature vectors. Then, according to the department feature vector and the multiple neighbor feature vectors and using a similarity formula, the feature similarity between each department node and the corresponding multiple neighbor nodes is calculated.

[0100] The greater the cosine similarity, the greater the similarity between the department node and the neighbor node. The department node with high similarity, the corresponding target neighbor node, and the target feature edge between the department node and the target neighbor node are extracted as data flow feature samples. After calculating the similarity between all department nodes and neighbor nodes and screening according to the similarity, all data flow feature samples obtained are integrated to obtain a flow feature sample set. This method of preferentially sampling by calculating the similarity between department nodes and neighbor nodes can reduce the complexity of the industry and finance anomaly detection model as much as possible and improve the generality of the industry and finance anomaly detection model.

[0101] S105, randomly divide the flow feature sample set into an anomaly training set and an anomaly test set.

[0102] In the embodiment, the flow feature sample set is randomly divided into an anomaly training set and an anomaly test set, which facilitates subsequent model training and model testing.

[0103] S106, negative sample sampling is performed on the anomaly training set to expand the negative samples in the anomaly training set, to obtain a mixed training set after expansion of the negative samples.

[0104] In the embodiment, in the embodiment, since the negative samples in the abnormal training set are far less than the positive samples, and the imbalance between positive samples and negative samples often leads to difficulty in training of the industry and finance anomaly detection model, and affects the accuracy of the industry and finance anomaly detection model in subsequent industry and finance data anomaly detection, therefore, it is necessary to expand the abnormal training set by negative sample sampling, so that the positive and negative samples in the abnormal training set are approximately balanced. The subspace perturbation method can be used to generate negative samples. The subspace perturbation method is designed based on the assumption that "positive samples are surrounded by negative samples", and the generated negative sample data is close to the positive sample, which is beneficial to the model to effectively distinguish positive samples and negative samples through training, and improve the generalization of the model.

[0105] Specifically, part of the data circulation feature samples are extracted from the abnormal training set, and then the data circulation feature samples are disturbed by adding noise, deleting feature edges and the like, to obtain negative samples with certain similarity with the data circulation feature samples. All the obtained negative samples are added to the abnormal training set to expand the abnormal training set, and a mixed training set with balanced positive and negative samples is obtained.

[0106] S107, based on the mixed training set, a data grid space is constructed, the grid density of the grid cells in the data grid space is calculated, all abnormal grids in the data grid space are marked according to the grid density, and all target training nodes in the abnormal grids are marked as abnormal points based on the angle features and distance features between all target training nodes in the abnormal grids.

[0107] In the embodiment, since the automotive industry financial data is high-dimensional data, the industry financial graph data network is a high-dimensional data graph network, and the distance between department nodes is not obviously distinguished, therefore, the evaluation result obtained by only evaluating the abnormal points according to the distance between the department nodes is not accurate, and therefore the angle variance between the nodes is introduced to identify and mark the abnormal points of the training nodes in the mixed training set. In addition, since the amount of data in the training set is large, if the angle variance between all the training nodes in the training set is calculated, the calculation efficiency will be greatly reduced, and resources will be wasted, therefore, before the angle variance is calculated, the mixed training set is divided into grids, the abnormal grids and the normal grids are screened out, the training nodes in the normal grids are marked as normal nodes, then the target training nodes in the abnormal grids are calculated according to the angle features and the distance features, the angle variance between the target training nodes is calculated according to the calculated angle features and distance features, the abnormal degree of the target training nodes is obtained according to the angle variance, and the target training nodes are marked as abnormal nodes according to the abnormal degree, that is, the target training nodes with an abnormal degree greater than a preset abnormal degree threshold are marked as abnormal nodes, and the target training nodes with an abnormal degree less than or equal to the abnormal threshold are marked as normal nodes. By marking the normal nodes and the abnormal nodes, it is convenient for subsequent training of the industry and finance anomaly detection model, the industry and finance anomaly detection model pays more attention to the normal samples in the training process, which helps the industry and finance anomaly detection model to capture the real distribution of the data, improves the robustness of the industry and finance anomaly detection model, and improves the generalization ability of the industry and finance anomaly detection model.

[0108] S108, input the mixed training set after completion of the abnormal point marking into the preset industry and finance anomaly detection model for iterative training until the number of iterations reaches the preset maximum training number, and obtain the target industry and finance anomaly detection model after completion of the training.

[0109] After the mixed training set after completion of the abnormal point marking is input into the preset industry and finance anomaly detection model, the information of the mixed training set is transmitted first to obtain updated new training nodes, then a plurality of neighbor nodes of the new training nodes in the mixed training set after completion of the information transmission and information update are obtained, all new training nodes and corresponding neighbor nodes are aggregated to obtain node aggregation features. The node aggregation features are forward propagated, and the parameters of the industry and finance anomaly detection model are adjusted until the number of parameter adjustments reaches the preset maximum training number, the model training is completed, and the target industry and finance anomaly detection model is obtained.

[0110] S109, input the abnormal test set into the target industry and finance anomaly detection model to obtain the data abnormal degree of the automotive industry financial data.

[0111] The abnormal test set is input into the target industry and finance abnormality detection model, and the data abnormality degrees of each department node in the automobile industry and finance data are obtained. According to the obtained data abnormality degrees, whether there is an abnormal behavior in each department of the target enterprise can be analyzed. When an abnormal behavior is detected, an alarm information is automatically output. The target enterprise can timely investigate and eliminate the abnormal behavior.

[0112] In one of the embodiments, the feature similarity between each department node and multiple neighbor nodes in the industry and finance data graph network is extracted, the department nodes and the feature edges of the department nodes in the industry and finance data graph network are screened according to the feature similarity, a plurality of data flow feature samples are obtained, and the flow feature sample set is obtained by integrating all the data flow feature samples, including the following steps:

[0113] For each department node in the industry and finance data graph network, the feature vectors of the department node and all neighbor nodes are extracted from the industry and finance data graph network to obtain the department feature vector and the plurality of neighbor feature vectors;

[0114] The feature similarity between the department feature vector and each neighbor feature vector is calculated by using the similarity formula;

[0115] If there is a target feature similarity that exceeds the preset similarity threshold, the department node, the target neighbor node corresponding to the target feature similarity, and the target feature edge between the department node and the target neighbor node are extracted as a data flow feature sample;

[0116] After all the department nodes are traversed, all the data flow feature samples are integrated to obtain the flow feature sample set.

[0117] In this embodiment, the node features of each department node and the corresponding neighbor nodes of the department node are extracted, the node features refer to the running state of the department, the work tasks of the department, etc., the extracted node features are reduced to a low-dimensional vector space, and then a covariance matrix is constructed according to the reduced node features. The feature vectors of the department node and the neighbor nodes, i.e., the department feature vector and the neighbor feature vector, are obtained by performing eigenvalue decomposition on the covariance matrix. The department feature vector and the neighbor feature vector are input into the similarity formula to calculate the feature similarity between the department feature vector and the neighbor feature vector, which is used to measure the similarity between the department node and the corresponding neighbor node. Common similarity formulas include the cosine similarity formula, the Jaccard similarity calculation formula, etc. Taking the cosine similarity formula as an example, the calculation formula is as follows:

[0118]

[0119] wherein a x is the department feature vector of the department node x, and b y is the neighbor feature vector of the neighbor node y.

[0120] After calculating the feature similarity of all department nodes, the department nodes with feature similarity greater than the preset feature similarity threshold, the corresponding target neighbor nodes and the target feature edges between the department nodes and the target neighbor nodes are extracted as data flow feature samples. Similarly, the similarity between all department nodes and neighbor nodes is calculated, and the similarity is screened to obtain all data flow feature samples. The flow feature sample set is obtained by integrating the data flow feature samples. This method of preferentially sampling by calculating the similarity between department nodes and neighbor nodes can reduce the complexity of the industry and finance anomaly detection model as much as possible and improve the generality of the industry and finance anomaly detection model.

[0121] In one embodiment, the method is characterized by the following steps:

[0122] Extracting a plurality of data flow feature samples from the anomaly training set, dividing and integrating the data flow feature samples to obtain a first feature sample set and a second feature sample set;

[0123] Extracting sample feature vectors and sample feature values corresponding to the sample feature vectors of the first feature sample set by principal component analysis;

[0124] Screening sample feature vectors with sample feature values greater than or equal to a preset feature value threshold to obtain a plurality of principal components, and the principal components are key features of the first feature sample set;

[0125] Taking the key features as a feature subspace, and performing feature perturbation on all feature subspaces to generate a plurality of feature negative samples;

[0126] Extracting a plurality of subgraphs of the second feature sample set, and taking all subgraphs as a structure subspace;

[0127] Performing structure perturbation on all structure subspaces to generate a plurality of structure negative samples;

[0128] Combining all feature negative samples and structure negative samples to the anomaly training set to obtain a mixed training set.

[0129] In the embodiment, a plurality of data flow feature samples are extracted from the abnormal training set, and the data flow feature samples are evenly divided and integrated to obtain two feature sample sets, i.e., a first feature sample set and a second feature sample set. This is to ensure that the generated negative samples have a certain similarity with the data flow feature samples in the abnormal training set, and to ensure that the trained industry and finance anomaly detection model has stronger generalization capability. The principal component analysis method is used to extract a plurality of most important key features of the first feature sample set. The specific steps are as follows: first, data cleaning is performed on the first feature sample set, then standardization processing is performed on the feature sample set after the data cleaning is completed, the covariance matrix of the feature sample set is calculated after the standardization processing is completed, then the covariance matrix is subjected to eigenvalue decomposition to obtain eigenvalues and corresponding eigenvectors, the eigenvalues are arranged in descending order, and the sample eigenvectors with eigenvalues greater than or equal to a preset eigenvalue threshold are screened out as principal components, and the obtained principal components are key features of the first feature sample set. The obtained key features are used as a feature subspace. In addition, the feature subspace is a key feature of the data flow feature sample, and the key feature includes data features, degrees, and clustering coefficients of the data flow feature sample in the first feature sample set. Among them, the data features represent the data features of each department node in the data flow feature sample, for example, the data of the sales department node has the characteristics of timeliness, shareability, and bidirectionality, and the data of the research and development department node has the characteristics of security, integrity, and clarity.

[0130] The feature subspace is subjected to feature disturbance to generate a plurality of feature negative samples. The feature disturbance refers to randomly adding Gaussian noise or uniform noise to the feature subspace to obtain new key features, and the data flow feature sample with the new key features is used as a feature negative sample. The structure subspace refers to a data graph network, i.e., a subgraph, extracted from the second data flow feature sample. The structure disturbance refers to randomly adding or deleting feature edges to the subgraph to change the connection relationship between the department nodes, so as to obtain data flow feature samples with different structures, and the data flow feature samples with different structures are used as structure negative samples. The obtained feature negative samples and structure negative samples are merged as negative samples to obtain a mixed training set.

[0131] In one embodiment, a data grid space is constructed based on the mixed training set, the grid density of the grid cells in the data grid space is calculated, all abnormal grids in the data grid space are marked according to the grid density, and the abnormal point marking of all target training nodes in the abnormal grid is based on the angle features and distance features between all target training nodes in the abnormal grid, including the following steps:

[0132] The mixed training set is subjected to dimensionality reduction processing according to the rough set theory;

[0133] According to the data distribution of the mixed training set after dimension reduction in each dimension, data density estimation is performed, and a plurality of data-intensive spaces of the mixed training set in different dimensions are constructed according to the data density estimation results;

[0134] A plurality of hyperrectangle sequences of the mixed training set are obtained through the data-intensive space, and the sequence volume of each hyperrectangle sequence is calculated respectively;

[0135] Based on the hyperrectangle sequence with the smallest sequence volume, the data-intensive space is divided into a grid in each dimension, and a data grid space is obtained;

[0136] After mapping all training nodes in the mixed training set to the data grid space, the grid density of each grid cell in the data grid space is calculated;

[0137] The grid cell with the maximum grid density is taken as a center grid;

[0138] Based on the grid density, the relative density difference between the adjacent grid and the center grid of each center grid is calculated respectively;

[0139] If the relative density difference is less than or equal to a preset density difference threshold, the adjacent grid is marked as a normal grid;

[0140] If the relative density difference is greater than the density difference threshold, the adjacent grid is marked as an abnormal grid;

[0141] The grid classification and marking step is repeatedly executed based on the grid density until each grid cell participates in the calculation of the relative density difference at least once;

[0142] All nodes in the normal grid and the center grid are marked as normal nodes;

[0143] According to the angle feature and distance feature between all target training nodes in the abnormal grid, the target training nodes are marked as abnormal points;

[0144] The grid classification and marking step comprises:

[0145] Taking any normal grid that is not a reference grid as a reference grid, the reference relative density difference between the adjacent grid and the reference grid of each reference grid is calculated based on the grid density;

[0146] If the reference relative density difference is less than or equal to the density difference threshold, the adjacent grid corresponding to the reference grid is marked as a normal grid;

[0147] If the reference relative density difference is greater than the density difference threshold, the adjacent grid corresponding to the reference grid is marked as an abnormal grid.

[0148] In this embodiment, the mixed training set is first processed by dimension reduction using rough set theory. Rough set theory is a mathematical tool for handling uncertainty, which can depict the incompleteness and uncertainty of information, and can effectively analyze various incomplete information such as inaccuracy, inconsistency, and incompleteness. It can also analyze and reason data to discover implicit knowledge and reveal potential laws. Through rough set theory, unnecessary features in the data set can be identified, redundant features can be removed, and core features can be retained, thereby reducing the dimension of the data. This method achieves the effect of dimension reduction without losing information.

[0149] The dimension-reduced mixed training set is mapped to multiple one-dimensional spaces, and the data distribution in each one-dimensional space, i.e., the number of training nodes in each one-dimensional space, is counted. The training nodes refer to the department nodes in the mixed training set. Then, each one-dimensional space is evenly divided into multiple one-dimensional grids, and the data density in each one-dimensional grid is calculated. The specific calculation method is to divide the number of samples by the area of the corresponding one-dimensional grid. The one-dimensional grids with a data density greater than a preset data density threshold are selected to obtain dense one-dimensional grids. The adjacent dense one-dimensional grids are aggregated to obtain multiple data dense intervals. According to the multiple data dense intervals of the mixed training set in different dimensions, multiple data dense spaces are obtained. Specifically, the total number of training nodes in the mixed training set is T, the data dense interval is [Si, Si] (i = 1, 2, …, d), and the data dense space is G = [S1, S1] x [S2, S2] x … x [Sd, Sd]. i refers to the dimension of the dimension-reduced mixed training set, and d refers to the dth one-dimensional space. Then, the center of gravity of the data dense space is calculated, and the data dense space containing the center of gravity and containing only √T training nodes is found as the hyperrectangle sequence. The volume of the hyperrectangle sequence is calculated. The formula for calculating the center of gravity is as follows:

[0150]

[0151] where O j is the center of gravity of the jth data dense space, H ij is the ith training node in the jth data dense space, and N is the number of training nodes in the data dense space.

[0152] The volume of the hyperrectangle sequence is calculated as follows:

[0153]

[0154] where and are the maximum and minimum values of the nth dimension of the hyperrectangle sequence, respectively.

[0155] The length of the smallest volume hyper-rectangular sequence in each dimension is taken as a standard for dividing the data grid space, and the space is divided according to this standard to obtain the data grid space, which is composed of multiple grid cells. Map all training nodes in the mixed training set to the data grid space, and after completing the mapping of the training nodes, count the number of training nodes falling into the grid cells. The total number of training nodes falling into each grid cell is taken as the grid density of the grid cell. The grid cell with the maximum grid density is taken as the center grid, and the grid density difference between the center grid and the adjacent grid with which the center grid exists edge coincidence is calculated according to the grid density to obtain the relative density difference between the center grid and the adjacent grid. The adjacent grid with a relative density difference less than or equal to the relative density difference threshold is marked as a normal grid. The adjacent grid with a relative density difference greater than the relative density difference threshold is marked as an abnormal grid. Repeat the steps of grid classification and marking until each grid cell participates in the calculation of the relative density difference at least once. After completing the steps of grid classification and marking, the training nodes in the normal grid and the center grid are marked as normal nodes. This step is to reduce the amount of calculation in the subsequent abnormal point marking, and only the training nodes in the abnormal grid need to be marked as abnormal points in the subsequent step. When marking abnormal points, an angle is introduced as an evaluation element for abnormal point marking, and the angle variance between the target training node and other target training nodes is calculated as the angle weight. The calculated angle variance is taken as the abnormality degree of the target training node, and the target training node with an abnormality degree greater than a preset abnormality degree threshold is marked as an abnormal node, and the target training node with an abnormality degree less than or equal to the abnormality degree threshold is marked as a normal node, and the marking of all target training nodes in the abnormal grid is completed.

[0156] Specifically, the steps of grid classification and marking include: taking a normal grid that is not a reference grid as a reference grid, calculating a reference relative density difference between the reference grid and the adjacent grid of the reference grid based on the grid density, marking the adjacent grid corresponding to the reference grid with a reference relative density difference less than or equal to the density difference threshold as a normal grid, and marking the adjacent grid corresponding to the reference grid with a reference relative density difference greater than the density difference threshold as an abnormal grid. The reference grid refers to taking the grid density of the grid as a reference to calculate the difference between the grid density of the grid and the grid density of the corresponding adjacent grid.

[0157] In one embodiment, the dimensionality reduction processing of the mixed training set according to the rough set theory includes the following steps:

[0158] The edge features and node features of each training node in the mixed training set are extracted respectively, and the node features and edge features are integrated into the comprehensive features of the corresponding training nodes;

[0159] Based on all the comprehensive features and according to the rough set theory, the feature weights of each comprehensive feature are calculated, and the specific formula is as follows:

[0160]

[0161] Where U is the mixed training set, P(R1) is the positive domain of the edge features in the comprehensive features, P(R2) is the positive domain of the node features in the comprehensive features, and I(k) i ,k j )-I(k i ) represents the edge feature k in the comprehensive feature set. i Edge feature k j The impact status, I(p) i ,p j )-I(p i ) Node features p in the comprehensive features i Subject to node features p j The impact status, I(k) i ) and I(p i ) represents the initial feature weights of the mixed training set, x represents the total number of edge features in the comprehensive features, and y represents the total number of node features in the comprehensive features;

[0162] If the feature weight of the combined feature is less than the preset feature weight threshold, the corresponding training node will be removed from the mixed training set.

[0163] In this embodiment, the feature edges of the mixed training set and the edge and node features of the department nodes are combined. Edge features refer to characteristics such as the frequency and method of information flow between department nodes, while node features refer to the operational status and work tasks of the department nodes. For example, the node features of the R&D department node refer to the current research progress and the types of products being researched. The extracted node features and edge features are integrated to obtain the comprehensive features. Rough set theory is used to calculate all feature weights of the mixed training set. Rough set theory can identify unnecessary features in the dataset, remove redundant features, and retain core features, thereby reducing the dimensionality of the data. This method achieves dimensionality reduction without losing information. The feature weight of each feature in the comprehensive features is calculated using the rough set theory calculation formula. Features with feature weights less than a preset feature weight threshold are removed to obtain the dimensionality-reduced mixed training set. In addition, the positive domain of the comprehensive features is a commonly used concept in rough set theory, which refers to the intersection of the upper similarity and lower similarity of the comprehensive features. The initial feature weights are feature weights calculated inaccurately, so further calculation is needed to obtain accurate feature weights.

[0164] In one embodiment, the method of marking outlier points on the target training nodes based on the angle and distance features between all target training nodes in the outlier grid includes the following steps:

[0165] randomly selecting one target training node as a reference node from the abnormal grid, and performing an anomaly point identification marking step on the reference node until each target training node is performed at least once anomaly point identification marking step;

[0166] The anomaly point identification marking step comprises:

[0167] determining a plurality of reference near-neighbor nodes of the reference node in the abnormal grid;

[0168] adding a connection edge between the reference node and the reference near-neighbor nodes;

[0169] calculating the angle feature of the included angle with the reference node as the vertex by using the cosine formula;

[0170] respectively calculating the distance feature between the reference node and all reference near-neighbor nodes, and assigning a weight to the angle feature according to the distance feature;

[0171] obtaining the abnormality degree of the reference node according to the angle feature after the weight assignment and using the abnormality degree calculation formula, and the abnormality degree calculation formula is as follows:

[0172]

[0173] wherein A is the reference node, B1 and B2 are the reference near-neighbor nodes, Wn is a set of n target training nodes, is a vector between the reference node A and the reference near-neighbor node B1, is a vector between the reference node A and the reference near-neighbor node B2, is a distance between the reference node A and the reference near-neighbor node B1, is a distance between the reference node A and the reference near-neighbor node B2, and <·,·> represents the dot product of two vectors, and VAR represents the variance calculation function;

[0174] if the abnormality degree of the reference node is greater than a preset abnormality degree threshold, the reference node is marked as an abnormal node;

[0175] if the abnormality degree of the reference node is less than or equal to the abnormality degree threshold, the reference node is marked as a normal node.

[0176] In the embodiment, a target training node is randomly selected from the abnormal grid as a reference node. The reference node is selected to facilitate subsequent calculation of the abnormality of the reference node. A plurality of (which can be two) target training nodes are randomly selected as reference near neighbor nodes of the reference node. The reference near neighbor nodes are selected to construct an angle with the reference node as the vertex. A connection edge is added between the reference node and the reference near neighbor nodes, i.e., the reference node and the reference near neighbor nodes are connected as an angle. The reference node is taken as the vertex, and the cosine value of the angle is calculated by using the cosine formula. The cosine value is the angle feature of the angle. Then, the distance between the reference node and the reference near neighbor nodes is calculated as a distance feature. The distance feature is weighted for the angle feature. In the abnormality calculation formula, the formula for distance weighting is as follows:

[0177]

[0178] The formula of the angle feature is as follows:

[0179]

[0180] The calculated angle variance is taken as the abnormality of the target training node. The target training node with an abnormality greater than a preset abnormality threshold is marked as an abnormal node. The target training node with an abnormality less than or equal to the abnormality threshold is marked as a normal node. The marking of all target training nodes in the abnormal grid is completed.

[0181] In one embodiment, the mixed training set after the completion of the abnormal point marking is input into a preset industry and finance abnormality detection model for iterative training until the number of iterations reaches a preset maximum training number. A target industry and finance abnormality detection model after the completion of the training is obtained as follows:

[0182] The mixed training set after the completion of the abnormal point marking is input into the preset industry and finance abnormality detection model.

[0183] The comprehensive features of all training nodes in the mixed training set are aggregated by using an aggregation function to obtain node aggregation features.

[0184] The node aggregation features are forward propagated, and the parameters of the industry and finance abnormality detection model are adjusted until the number of parameter adjustments reaches a preset maximum training number. A target industry and finance abnormality detection model is obtained.

[0185] In the embodiment, the mixed training set after the completion of the abnormal point marking is input into the preset industry and finance abnormality detection model for training. The preset industry and finance abnormality detection model is constructed based on a graph neural network model. The steps of constructing the industry and finance abnormality detection model are as follows: Figure 2

[0186] ​1.1, Collect appropriate graph data, i.e. industry and finance data graph grid, which includes department nodes, feature edges, node features and edge features, and standardize the collected graph data;

[0187] 1.2, Construct a node feature matrix containing the node features of each department node;

[0188] 1.3, Select an appropriate architecture of a graph neural network model, such as a graph convolutional network (GCN), a graph attention network (GAT), etc.;

[0189] 1.4, Define the hierarchical structure of the graph neural network model, including graph convolutional layers, activation functions, etc., and select appropriate aggregation methods (such as average, maximum, weighted, etc.) to aggregate the information of neighboring nodes;

[0190] 1.5, Select an appropriate loss function according to the specific task (such as node classification, graph classification, link prediction, etc.), such as cross-entropy loss, mean square error, etc., to finally obtain the industry and finance anomaly detection model to be trained.

[0191] First, use K-neighbor algorithm to obtain multiple neighbor nodes of the new training node, K-neighbor algorithm is a basic machine learning algorithm, its core idea is: if the K nearest neighbors of a sample in the feature space belong to a certain class, then the sample also belongs to this class. KNN algorithm calculates the distance between the sample to be classified and the known class samples, selects the K nearest samples, and determines the class of the sample to be classified according to the class of these neighbors. First, calculate the distance between any new training node and other new training nodes, and select other new training nodes with a distance less than a preset distance threshold as the neighbor nodes of the new training node. In this way, the neighbor nodes of all new training nodes are calculated.

[0192] According to the propagation mechanism of the graph neural network model, first, perform information transmission on the mixed training set, and perform information transmission between different training nodes along the feature edges connecting different training nodes, so that each training node can obtain the information of the neighbor nodes, complete information update, and obtain new training nodes.

[0193] Then, use the aggregation function to aggregate the information of the new training node and the corresponding multiple neighbor nodes to obtain node aggregation features. Information aggregation refers to aggregating the node features of the new training node and the corresponding multiple neighbor nodes to obtain node aggregation features, which refers to the features of the new training node after feature aggregation. The information of the new training node refers to the information of each department of the target enterprise, such as the information of the sales department, including sales performance, customer information, etc.

[0194] The node aggregation features are forward propagated to obtain a model output value, an error of the model output value is calculated according to a pre-set loss function, common loss functions include a cross-entropy loss function and a mean square error loss function, etc., then a gradient of the loss function is calculated through a back propagation algorithm, the model parameters are updated according to the gradient of the loss function and by using an optimization algorithm, when the number of times of parameter updating reaches a pre-set maximum training number, it is indicated that the model training is completed, and a target industry and finance abnormality detection model is obtained.

[0195] In the embodiment, the aggregation function is as follows:

[0196]

[0197] wherein, W is a node aggregation feature, Tx is the number of nodes in the mixed training set, F is a full connection layer in the industry and finance abnormality detection model, is a weight of an edge feature, a is a weight of a node feature, e (i) is node information of a training node i in the mixed training set and corresponding all neighbor nodes.

[0198] In one of the embodiments, an automobile industry and finance data processing platform based on big data, characterized in that the platform comprises:

[0199] An information acquisition module, configured to acquire automobile industry and finance data of a target enterprise;

[0200] A feature analysis module, configured to perform data flow feature analysis according to the automobile industry and finance data to obtain data flow features;

[0201] A network construction module, configured to take all departments of the target enterprise and a plurality of sub-departments corresponding to the departments as department nodes, and take the data flow features as feature edges between the department nodes to construct an industry and finance data graph network of the target enterprise, the industry and finance data graph network being a high-dimensional data graph network;

[0202] A first sampling module, configured to extract feature similarity between each department node and a plurality of neighbor nodes in the industry and finance data graph network, filter the department nodes and feature edges of the department nodes in the industry and finance data graph network according to the feature similarity, obtain a plurality of data flow feature samples, and integrate all the data flow feature samples to obtain a flow feature sample set, the neighbor nodes being a plurality of adjacent nodes around the department nodes;

[0203] A sample division module, configured to randomly divide the flow feature sample set into an abnormal training set and an abnormal test set;

[0204] A second sampling module, configured to perform negative sample sampling on the abnormal training set to expand negative samples in the abnormal training set, and obtain a mixed training set after expansion of negative samples;

[0205] The information marking module is configured to construct a data grid space based on the mixed training set, calculate a grid density of a grid cell in the data grid space, mark all abnormal grids in the data grid space according to the grid density, and mark all target training nodes in the abnormal grids according to angle features and distance features between the target training nodes in the abnormal grids.

[0206] The model training module is configured to input the mixed training set after the abnormal point marking into a preset industry and finance abnormality detection model for iterative training until a number of iterations reaches a preset maximum number of training, so as to obtain a target industry and finance abnormality detection model after training.

[0207] The data detection module is configured to input an abnormal test set into the target industry and finance abnormality detection model, so as to obtain a data abnormality degree of the automobile industry and finance data.

[0208] In this embodiment, the information acquisition module is configured to acquire automobile industry and finance data of a target enterprise. The automobile industry and finance data is acquired from a database in the target enterprise, which contains all data information in the target enterprise, such as personnel appointment of the target enterprise, revenue status of the target enterprise, and R&D progress of the target enterprise. The automobile industry and finance data includes running states of each department of the target enterprise and business interaction data between the departments, wherein the running states of the departments include sales of a marketing department, R&D progress of an R&D department, production efficiency of a production department, and customer maintenance information of an after-sales service department, and the business interaction data between the departments includes manufacturability evaluation reports transmitted from the production department to the R&D department, and vehicle quality monitoring reports sent from a quality management department to the production department.

[0209] The feature analysis module is configured to analyze whether there is data flow between each department and a plurality of sub-departments corresponding to the department, and if there is data flow, analyze frequency and mode of the data flow, which are data flow features. The data flow refers to information interaction between the departments, for example, the legal department interacts with the R&D department and the production department to perform legal risk assessment for the departments, so as to ensure that new automobile products produced and developed by the target enterprise comply with relevant legal regulations, and the R&D department, the production department, and the sales department also jointly provide a basis for project budget to the finance department for auditing.

[0210] The network construction module is configured to take each department and a plurality of sub-departments corresponding to the department as nodes of a data graph network, connect the departments with information interaction therebetween, and take connection relationship between the departments, frequency and mode of the data flow, and other data flow features as feature edges of the data graph network, so as to finally construct an industry and finance data graph network.

[0211] The first sampling module is responsible for sampling the industry and finance data graph network according to the feature similarity between the department nodes and the plurality of neighbor nodes. Specifically, the node features of each department node and the neighbor nodes corresponding to the department nodes are extracted, the node features refer to the running state of the department, the work task of the department and the like, the extracted node features are reduced to a low-dimensional vector space to obtain the feature vectors of the department nodes and the neighbor nodes, that is, the department feature vectors and the plurality of neighbor feature vectors, then the feature similarity between each department node and the corresponding plurality of neighbor nodes is calculated according to the department feature vectors and the plurality of neighbor feature vectors and by using a similarity formula. The department nodes with high similarity, the corresponding target neighbor nodes and the target feature edges between the department nodes and the target neighbor nodes are extracted as data flow feature samples. The similarity between all department nodes and neighbor nodes is calculated, and after screening according to the similarity, all data flow feature samples obtained are integrated to obtain a flow feature sample set.

[0212] The sample division module is used for randomly dividing the flow feature sample set into an abnormal training set and an abnormal test set, so as to facilitate subsequent model training and model testing.

[0213] The second sampling module is responsible for expanding the abnormal training set by negative sample sampling, so that the positive and negative samples in the abnormal training set are approximately balanced. The subspace perturbation method can be used to generate negative samples. Specifically, part of the data flow feature samples are extracted from the abnormal training set, and then the data flow feature samples are perturbed by adding noise, deleting feature edges and the like to obtain negative samples with a certain similarity to the data flow feature samples. All the obtained negative samples are added to the abnormal training set to expand the abnormal training set, and a mixed training set with balanced positive and negative samples is obtained. Balanced positive and negative samples are conducive to the model to effectively distinguish positive and negative samples through training, and improve the generalization of the model.

[0214] The information marking module is used for identifying and marking abnormal points of the training nodes of the mixed training set according to the angle variance between the nodes. Since the amount of data in the training set is large, if the angle variance between all the training nodes in the training set is calculated, the calculation efficiency will be greatly reduced, and resources will be wasted. Therefore, before the angle variance calculation, the mixed training set is divided into grids, and abnormal grids and normal grids are screened out. The training nodes in the normal grids are marked as normal nodes first, and then the target training nodes in the abnormal grids are calculated for angle features and distance features. The angle variance between the target training nodes is calculated according to the calculated angle features and distance features. The abnormality degree of the target training nodes is obtained according to the angle variance. The target training nodes are marked as abnormal nodes according to the abnormality degree, that is, the target training nodes with an abnormality degree greater than a preset abnormality threshold are marked as abnormal nodes, and the target training nodes with an abnormality degree less than or equal to the abnormal threshold are marked as normal nodes. By marking the normal nodes and the abnormal nodes, the industry and finance abnormality detection model pays more attention to the normal samples during training, which helps the industry and finance abnormality detection model to capture the true distribution of the data, improves the robustness of the industry and finance abnormality detection model, and improves the generalization ability of the industry and finance abnormality detection model.

[0215] The model training module is used for training a preset industry and finance abnormality detection model according to the mixed training set with completed abnormal point marking. Specifically, after the mixed training set with completed abnormal point marking is input into the preset industry and finance abnormality detection model, information transmission is performed on the mixed training set to obtain updated new training nodes. Then, a plurality of neighbor nodes of the new training nodes in the mixed training set with completed information transmission and information update are obtained. The new training nodes and the corresponding neighbor nodes are aggregated to obtain node aggregation features. The node aggregation features are forward propagated, and the parameters of the industry and finance abnormality detection model are adjusted until the number of parameter adjustments reaches a preset maximum training number. The model training is completed, and a target industry and finance abnormality detection model is obtained.

[0216] The data detection module is responsible for testing the target industry and finance abnormality detection model using an abnormal test set, so as to analyze whether the target enterprise has abnormal behavior. Specifically, the abnormal test set is input into the target industry and finance abnormality detection model to obtain the data abnormality degree of each department node in the automobile industry and finance data. According to the obtained data abnormality degree, whether each department of the target enterprise has abnormal behavior can be analyzed. When abnormal behavior is detected, an alarm information is automatically output. The target enterprise can timely investigate and eliminate abnormal behavior.

[0217] In one of the embodiments, an automobile industry and finance data processing system based on big data, characterized in that it comprises:

[0218] a memory configured to store instructions; and

[0219] a processor configured to call the instructions from the memory and implement the method for big data-based automotive financial data processing according to any one of the preceding embodiments when the instructions are executed.

[0220] The processor can be a central processing unit (CPU), but can also be other general purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), programmable logic devices (PLD), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gates or transistor logic, discrete hardware components, etc. The general purpose processor can be a microprocessor or any conventional processor, etc. The present application is not limited in this regard.

[0221] The memory can be an internal storage unit of the computer device, such as a hard disk or a memory of the computer device, or an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SMC), a secure digital card (SD), a flash memory card (FC), etc. The memory can also be a combination of the internal storage unit and the external storage device of the computer device. The memory is used to store computer programs and other programs and data required by the computer device. The memory can also be used to temporarily store data that has been output or will be output. The present application is not limited in this regard.

[0222] The present application also provides a machine readable storage medium having instructions stored thereon for causing a machine to perform the method for big data-based automotive financial data processing.

[0223] Those skilled in the art should understand that embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can be in the form of a completely hardware embodiment, a completely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0224] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), computer program product according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the computer or other programmable data processing device produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1one or more processes and / or blocks Figure 1 an apparatus with the functionality to achieve the specified processes or functions in the block or blocks.

[0225] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a Figure 1 one or more processes and / or blocks Figure 1 an apparatus with the functionality to achieve the specified processes or functions in the block or blocks.

[0226] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the processes specified in the flowchart Figure 1 one or more processes and / or blocks Figure 1 an apparatus with the functionality to achieve the specified processes or functions in the block or blocks.

[0227] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0228] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the processor can execute instructions. The memory can also include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), flash memory, or a combination of non-volatile memories in different types. The memory can also include a storage device, such as a hard disk drive, a solid state drive, or a combination of storage devices in different types. The memory can be configured to store data and / or instructions that can be executed by the processor. The memory is an example of computer readable media.

[0229] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0230] It should also be noted that the terms "comprising", "comprises" or other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0231] The above embodiments are only used to illustrate the present application, but not to limit it. Instead of the above, various modifications and changes can be made to the application by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall fall into the scope of the claims of the application.

Claims

1. A big data-based automotive industry financial data processing method, characterized by, The method comprises the following steps: Obtaining automobile industry financial data of a target enterprise, the automobile industry financial data comprising market sales data, research and development progress data, and production efficiency data; Performing data flow feature analysis according to the automobile industry financial data to obtain data flow features; Taking all departments of the target enterprise and a plurality of sub-departments corresponding to the departments as department nodes, and taking the data flow features as feature edges between the department nodes, an industry financial data graph network of the target enterprise is constructed, the industry financial data graph network being a high-dimensional data graph network, and the department nodes including legal department nodes, research and development department nodes, production department nodes, and sales department nodes; Extracting feature similarities between each of the department nodes and a plurality of neighbor nodes in the industry financial data graph network, screening the department nodes and the feature edges of the department nodes in the industry financial data graph network according to the feature similarities, obtaining a plurality of data flow feature samples, and integrating all the data flow feature samples to obtain a flow feature sample set, the neighbor nodes being a plurality of adjacent nodes around the department nodes; Randomly dividing the flow feature sample set into an abnormal training set and an abnormal test set; Extracting a plurality of data flow feature samples from the abnormal training set, equally dividing and integrating the data flow feature samples to obtain a first feature sample set and a second feature sample set; Extracting sample feature vectors of the first feature sample set and sample feature values corresponding to the sample feature vectors by principal component analysis; Screening out the sample feature vectors with sample feature values greater than or equal to a preset feature value threshold to obtain a plurality of principal components, the principal components being key features of the first feature sample set; Taking the key features as feature subspaces, and performing feature perturbation on all the feature subspaces to generate a plurality of feature negative samples; Extracting a plurality of sub-graphs of the second feature sample set, and taking all the sub-graphs as structure subspaces; Performing structure perturbation on all the structure subspaces to generate a plurality of structure negative samples; Merging all the feature negative samples and the structure negative samples to the abnormal training set to obtain a mixed training set; Constructing a data grid space based on the mixed training set, calculating grid densities of grid cells in the data grid space, marking all abnormal grids in the data grid space according to the grid densities, and performing abnormal point marking on all target training nodes in the abnormal grids based on angle features and distance features between the target training nodes in the abnormal grids; Inputting the mixed training set after the abnormal point marking into a preset industry financial anomaly detection model for iterative training until the number of iterations reaches a preset maximum training number, to obtain a target industry financial anomaly detection model after training; Inputting the abnormal test set into the target industry financial anomaly detection model to obtain a data anomaly degree of the automobile industry financial data.

2. The method of claim 1, wherein, The feature similarity between each department node and multiple neighbor nodes in the industry and finance data graph network is extracted, the department nodes and the feature edges of the department nodes in the industry and finance data graph network are screened according to the feature similarity, a plurality of data flow feature samples are obtained, and a circulation feature sample set is obtained by integrating all the data flow feature samples. For each department node in the industry and finance data graph network, the feature vectors of the department node and all neighbor nodes are extracted from the industry and finance data graph network to obtain a department feature vector and a plurality of neighbor feature vectors. The feature similarity between the department feature vector and each neighbor feature vector is calculated using a similarity formula. If there is a target feature similarity that exceeds a preset similarity threshold, the department node, a target neighbor node corresponding to the target feature similarity, and a target feature edge between the department node and the target neighbor node are extracted as a data flow feature sample. After traversing all the department nodes, all the data flow feature samples are integrated to obtain a circulation feature sample set.

3. The method of claim 1, wherein, The data grid space is constructed based on the mixed training set, the grid density of each grid cell in the data grid space is calculated, all abnormal grids in the data grid space are marked according to the grid density, and all target training nodes in the abnormal grids are marked as abnormal points based on the angle features and distance features between the target training nodes in the abnormal grids. The mixed training set is dimensionally reduced according to rough set theory; Data density estimation is performed according to the data distribution of the mixed training set in each dimension after dimension reduction, and a plurality of data dense spaces of the mixed training set in different dimensions are constructed according to the data density estimation results; A plurality of hyperrectangle sequences of the mixed training set are obtained through the data dense spaces, and the sequence volume of each hyperrectangle sequence is calculated respectively; The data grid space is divided in each dimension based on the hyperrectangle sequence with the smallest sequence volume, and a data grid space is obtained. After mapping all training nodes in the mixed training set to the data grid space, the grid density of each grid cell in the data grid space is calculated. The grid cell with the maximum grid density is taken as a center grid. The relative density difference between each adjacent grid and the center grid is calculated based on the grid density. If the relative density difference is less than or equal to a preset density difference threshold, the adjacent grid is marked as a normal grid. If the relative density difference is greater than the density difference threshold, the adjacent grid is marked as an abnormal grid. The grid classification and marking step is repeatedly executed based on the grid density until each grid cell participates in the calculation of the relative density difference at least once. All nodes in the normal grid and the center grid are marked as normal nodes. The angle features and distance features between all target training nodes in the abnormal grid are used to mark the target training nodes as abnormal points. The grid classification marking step comprises: Taking any one of the normal grids that is not a reference grid as a reference grid, calculating the reference relative density difference between the adjacent grid of each reference grid and the reference grid based on the grid density; If the reference relative density difference is less than or equal to the density difference threshold, marking the adjacent grid corresponding to the reference grid as the normal grid; If the reference relative density difference is greater than the density difference threshold, marking the adjacent grid corresponding to the reference grid as the abnormal grid.

4. The method of claim 3, wherein, The dimension reduction processing of the mixed training set according to the rough set theory comprises the following steps: Extracting the edge feature and the node feature of each training node in the mixed training set respectively, and integrating the node feature and the edge feature into the comprehensive feature corresponding to the training node; Calculating the feature weight of each comprehensive feature based on all the comprehensive features and according to the rough set theory, and the specific formula is as follows: Where U is the hybrid training set, P(R1) is the positive domain of the edge features in the comprehensive features, P(R2) is the positive domain of the node features in the comprehensive features, and I(k i ,k j )-I(k i ) represents the edge feature k in the comprehensive feature. i Subject to the edge feature k j The impact status, I(p) i ,p j )-I(p i The node feature p in the comprehensive features i Subject to the node feature p j The impact status, I(k) i ) and I(p i ) represents the initial feature weights of the hybrid training set, x represents the total number of edge features in the comprehensive features, and y represents the total number of node features in the comprehensive features; If the feature weight of the comprehensive feature is less than the preset feature weight threshold, the corresponding training node is removed from the mixed training set.

5. The method of claim 3, wherein, The abnormal point marking of the target training node according to the angle feature and the distance feature between all target training nodes in the abnormal grid comprises the following steps: Randomly selecting a target training node in the abnormal grid as a reference node, and performing an abnormal point identification marking step on the reference node until each target training node has been executed at least once abnormal point identification marking step; The abnormal point identification marking step comprises: Determining a plurality of reference near-neighbor nodes of the reference node in the abnormal grid; Adding a connection edge between the reference node and the reference near-neighbor node; Calculating the angle feature of the included angle with the reference node as the vertex by using the cosine formula; Calculating the distance feature between the reference node and all reference near-neighbor nodes respectively, and assigning a weight to the angle feature according to the distance feature; According to the angle feature after weight assignment and using the abnormality degree calculation formula, the abnormality degree of the reference node is obtained, and the abnormality degree calculation formula is as follows: wherein A is the reference node, B1 and B2 are the reference near-neighbor nodes, Wn is a set of n target training nodes, is a vector between the reference node A and the reference near-neighbor node B1, is a vector between the reference node A and the reference near-neighbor node B2, is a distance between the reference node A and the reference near-neighbor node B1, is a distance between the reference node A and the reference near-neighbor node B2, and <·, ·> denotes the dot product of two vectors, and VAR denotes a variance calculation function. If the abnormality degree of the reference node is greater than the preset abnormality degree threshold, the reference node is marked as an abnormal node; If the abnormality degree of the reference node is less than or equal to the abnormality degree threshold, the reference node is marked as a normal node.

6. The method of claim 4, wherein, The following steps are taken to input the mixed training set after completing the abnormal point marking into the preset industry and finance abnormality detection model for iterative training until the number of iterations reaches the preset maximum training number, and obtain the target industry and finance abnormality detection model after training: Input the mixed training set after completing the abnormal point marking into the preset industry and finance abnormality detection model; Using an aggregation function to aggregate the comprehensive features of all training nodes in the mixed training set to obtain node aggregation features; Performing forward propagation on the node aggregation features and adjusting the parameters of the industry and finance abnormality detection model until the number of parameter adjustments reaches the preset maximum training number, and obtaining the target industry and finance abnormality detection model.

7. The method of claim 6, wherein, The aggregation function is as follows: wherein W is the node aggregation feature, Tx is the number of nodes in the mixed training set, F is the full connection layer in the industry and finance anomaly detection model, is the weight of the edge feature, and a is the weight of the node feature, (i) is the node information of the training node i and the corresponding all near neighbor nodes in the mixed training set.

8. A big data-based automotive industry financial data processing platform, characterized in that, The platform comprises: An information acquisition module configured to acquire automobile industry financial data of a target enterprise, the automobile industry financial data comprising market sales data, research and development progress data, and production efficiency data; A feature analysis module configured to perform data flow feature analysis based on the automobile industry financial data to obtain data flow features; A network construction module configured to construct an industry financial data graph network of the target enterprise by taking all departments of the target enterprise and a plurality of sub-departments corresponding to the departments as department nodes and taking the data flow features as feature edges between the department nodes, the industry financial data graph network being a high-dimensional data graph network, the department nodes including a legal department node, a research and development department node, a production department node, and a sales department node; A first sampling module configured to extract feature similarities between each of the department nodes and a plurality of neighbor nodes in the industry financial data graph network, filter the department nodes and the feature edges of the department nodes in the industry financial data graph network based on the feature similarities, obtain a plurality of data flow feature samples, and integrate all the data flow feature samples to obtain a flow feature sample set, the neighbor nodes being a plurality of adjacent nodes around the department nodes; A sample division module configured to randomly divide the flow feature sample set into an abnormal training set and an abnormal test set; A second sampling module configured to extract a plurality of the data flow feature samples from the abnormal training set, divide and integrate the data flow feature samples to obtain a first feature sample set and a second feature sample set, extract sample feature vectors of the first feature sample set and sample feature values corresponding to the sample feature vectors by principal component analysis, filter out the sample feature vectors with sample feature values greater than or equal to a preset feature value threshold to obtain a plurality of principal components, the principal components being key features of the first feature sample set, take the key features as feature subspaces, perform feature perturbation on all the feature subspaces to generate a plurality of feature negative samples, extract a plurality of subgraphs of the second feature sample set, take all the subgraphs as structure subspaces, perform structure perturbation on all the structure subspaces to generate a plurality of structure negative samples, and combine all the feature negative samples and the structure negative samples to the abnormal training set to obtain a mixed training set; An information labeling module configured to construct a data grid space based on the mixed training set, calculate a grid density of grid cells in the data grid space, label all abnormal grids in the data grid space according to the grid density, and perform abnormal point labeling on all target training nodes in the abnormal grids based on angle features and distance features between the target training nodes in the abnormal grids; A model training module configured to input the mixed training set after the abnormal point labeling to a preset industry financial anomaly detection model for iterative training until the number of iterations reaches a preset maximum number of training, and obtain a target industry financial anomaly detection model after the training is completed. The data detection module is configured to input the abnormal test set into the target industry and finance abnormality detection model to obtain a data abnormality degree of the automobile industry and finance data.

9. A big data based automotive industry financial data processing system characterized by, The method comprises the following steps: a memory configured to store instructions; and a processor configured to call the instructions from the memory and implement the method for processing automobile industry and finance data based on big data according to any one of claims 1 to 7 when the instructions are executed.

Images