Financial data anomaly identification method and system based on big data analysis

Abstract

The present invention proposes a method and system for identifying financial data anomalies based on big data analysis, the method comprising: collecting high-frequency trading data from multiple markets and performing synchronous preprocessing; constructing a dynamic association network based on the preprocessed data, and associating the linkage relationship characteristics between multiple markets; identifying normal trading patterns and abnormal trading patterns based on multi-market associations; selecting abnormal trading points, and classifying the abnormal trading points; constructing an abnormal propagation network based on the results of abnormal trading point classification, quantifying the propagation path and global influence of abnormal trading points, and analyzing the time dynamic characteristics of propagation. The present invention realizes the accurate identification of complex abnormal behaviors across markets, especially the effective capture of hidden trading patterns, and significantly enhances the interpretability and analytical value of the results.

Description

Technical Field

[0001] The present invention belongs to the technical field of big data analysis, and in particular to a method and system for identifying anomalies in financial data based on big data analysis. Background Art

[0002] As financial markets become increasingly complex, the correlation between various assets (such as stocks, futures, and foreign exchange) becomes stronger, and the manifestations of abnormal behaviors become more diverse. As an important tool for market risk management, financial data anomaly detection aims to quickly identify potential risk events from a large amount of transaction data, such as market manipulation, flash crashes, and large hidden transactions. However, with the expansion of market size and the acceleration of transaction speed, traditional anomaly detection methods face many challenges.

[0003] Existing financial anomaly detection technologies are mainly concentrated in the following directions: First, methods based on statistical analysis, such as using the statistical characteristics of price volatility or trading volume changes to identify abnormal events in a single market; second, technologies based on machine learning, such as using supervised learning or unsupervised learning algorithms to model financial transaction data and extract potential abnormal patterns. However, these methods have exposed significant deficiencies when dealing with actual complex market environments:

[0004] 1. Lack of characterization of cross-market linkage behavior: Most current detection methods are based on data from a single market or a single asset, and lack the ability to model linkage effects between multiple markets. However, abnormal behavior in financial markets often has cross-market transmission characteristics. For example, price fluctuations in a certain market may be quickly transmitted through trading behaviors in related markets. If we only rely on single-market analysis, it is easy to miss these linkage effects and fail to accurately determine the source and propagation path of the anomaly.

[0005] 2. Insufficient ability to capture hidden transaction patterns: Abnormal transaction behaviors often appear as hidden, dispersed, high-dimensional sparse patterns. For example, large transactions may be split into multiple small transactions to avoid being discovered by the regulatory system. Traditional methods are difficult to accurately extract these sparse abnormal patterns from massive data, resulting in low detection accuracy.

[0006] 3. Lack of explainability and comprehensive analysis capabilities: Financial market participants usually need to further analyze abnormal behaviors to determine their potential risks or opportunities. However, although many machine learning methods can capture anomalies, they cannot provide clear explanatory information, such as the causes, specific characteristics, and propagation paths of abnormal behaviors. This "black box" nature limits the value of anomaly detection results in practical applications.

[0007] In view of the above problems, existing technologies need to be improved in terms of detection accuracy, complex behavior modeling and result interpretability. Therefore, there is an urgent need for an anomaly detection method that can comprehensively consider cross-market linkages, high-dimensional sparsity and interpretability to better meet the needs of financial market risk management. Summary of the invention

[0008] The purpose of the present invention is to design a financial data anomaly identification method and system based on big data analysis, which realizes the accurate identification of complex abnormal behaviors across markets, especially the effective capture of hidden transaction patterns, and significantly enhances the interpretability and analytical value of the results. These improvements not only overcome the shortcomings of the existing technology, but also provide an efficient and comprehensive solution for financial risk management.

[0009] In order to achieve the above object, a first aspect of the present invention provides a method for identifying financial data anomalies based on big data analysis, the method comprising the following steps:

[0010] S1. Collect high-frequency trading data from multiple markets and perform synchronous preprocessing, including:

[0011] Collect transaction data streams from k markets, construct a multi-market original transaction matrix, and standardize the multi-market original transaction matrix;

[0012] The standardized matrix is ​​enhanced according to the price difference characteristics, the sparse items of the inter-market yield covariance and the price difference, and the enhanced transaction matrix is ​​obtained;

[0013] S2. Build a dynamic association network based on the preprocessed data to associate the linkage characteristics between multiple markets, including:

[0014] Construct the preliminary correlation between market i and market j based on the enhanced transaction matrix and make corrections;

[0015] Construct a cross-market dynamic correlation network based on the corrected correlation degree, and embed the cross-market dynamic correlation network into a low-dimensional space to obtain an embedding matrix, retaining only the most critical constraint items;

[0016] S3. Based on the multi-market correlation, the identification of normal trading patterns and abnormal trading patterns includes:

[0017] The enhanced transaction matrix and the embedding matrix are fused to form a comprehensive transaction feature matrix;

[0018] The comprehensive transaction feature matrix is ​​decomposed into sparse low-rank behavior patterns, specifically:

[0019] Assuming that the fused feature matrix X′ is decomposed into normal transaction mode and abnormal transaction mode, we have:

[0020] X′=L+S

[0021] Where L∈R k×(n′+d)×m represents a low-rank matrix, corresponding to the normal trading pattern, with strong regularity between time and market; S∈R k×(n′+d)×m represents a sparse matrix, corresponding to abnormal trading patterns, capturing local abnormal behaviors; k is the number of markets; n' is the enhanced feature dimension of each market, including original features and cross-market enhanced features; d is the dynamic embedding dimension, representing the low-dimensional representation of market linkage characteristics; m is the time step, representing the time series length of transaction data;

[0022] According to the identified abnormal trading pattern, the optimization objective function is designed to solve L and S:

[0023]

[0024] Among them, ||L|| * represents the nuclear norm, controlling the low rank of L; ||S||1 represents the sparse regularization term of S, encouraging the concentration of outliers; ||W⊙S||1 represents the weight sparse term, using the weight matrix W to strengthen the outlier detection in key markets; Represents a temporal smoothness constraint, encouraging the continuity of anomalies in the temporal dimension; τ,γ represent hyperparameters, which control the weights of each regularization term respectively;

[0025] Through the iterative optimization method, the optimization objective function is solved to obtain the decomposition results L and S, and then the transaction anomalies are extracted from the sparse matrix S:

[0026] Define the transaction anomaly point set P:

[0027] P={(t,i,j)||S(t,i,j)|>τ}

[0028] Among them, τ is the threshold for extracting transaction anomaly points; each transaction anomaly point (t,i,j) includes the annotation information of time t, market i, and feature dimension j;

[0029] Output sparse matrix S∈R k×(n′+d)×m , marking abnormal trading patterns; low-rank matrix L∈R k×(n′+d)×m , marking the normal transaction mode; the set of transaction abnormal points P;

[0030] S4. Select abnormal transaction points and classify the abnormal transaction points, including:

[0031] Construct a preliminary feature vector of the outlier point based on the sparse matrix and the set of prone outlier points. Design an importance score of the outlier point based on the preliminary feature vector of the outlier point combined with constant strength, market influence and cross-market propagation characteristics. Design an anomaly threshold, retain high-risk outliers with importance scores higher than the anomaly threshold, and construct a high-risk outlier point set P';

[0032] Construct the final feature vector of each outlier point based on the high-risk outlier point set P', build a multi-classification model to classify the final feature vector of each outlier point, and mark the category label of each point;

[0033] S5. Based on the results of abnormal transaction point classification, an abnormal propagation network is constructed to quantify the propagation path and global influence of abnormal transaction points, and the temporal dynamic characteristics of propagation are analyzed.

[0034] Furthermore, the price difference feature is the price difference between market i and market j, expressed as D i,j (t) = P i (t)-P j (t), the sparse term of the fusion market yield covariance and price difference is the synergistic enhancement term It is expressed as:

[0035]

[0036] Among them, Cov(R i (t),R j (t)) is the return covariance of market i and j, indicating their volatility co-movement; ||D i,j (t)||1 is a sparse term for price differences between markets, which encourages abnormal signals to be more concentrated; α and β are hyperparameters that control the covariance and sparsity regularization weights;

[0037] The single market feature X (aligned) And the cross-market enhancement matrix S(t) is concatenated to obtain the enhanced transaction matrix, which is expressed as:

[0038] X (enhanced) =[X (aligned) ,S(t)]

[0039] Among them, X (enhanced) This is the enhanced transaction matrix.

[0040] Furthermore, the S1 also includes data cleaning and noise reduction for the enhanced transaction matrix, specifically:

[0041] Use weighted mean of sliding window to fill:

[0042]

[0043] Among them, ω s =e -a(t-s) is the weight, the closer the value is to the time, the higher the weight; a represents the speed of weight decay; t represents the current time point; s represents the historical time point in the sliding window; w represents the length of the sliding window, which determines how many historical time points are considered; ω s represents the weight of time s; j represents the feature dimension currently being processed;

[0044] Use principal component analysis to reduce dimension and extract the main features X (final) (t):

[0045] X (final) (t) = X (cleaned) (t)·W PCA

[0046] Among them, W PCA X is the principal component projection matrix, and only the first n′ principal components are selected; (cleane d)(t) is the data after cleaning. Further, the preliminary correlation degree C t (i,j), which is represented as follows:

[0047] C t (i,j)=Corr(X (enhanced)9 t,i,:),X (enhanced) (t,j,:))

[0048] Where Corr is the Pearson correlation coefficient, C t (i,j) represents the characteristic correlation between market i and market j at time t; X (enhanced) (t,i,:) is the enhanced transaction matrix of market i, X (enhanced)( t,j,:) is the enhanced transaction matrix of market j;

[0049] At the same time, the initial correlation C t The association correction model is designed in (i, j), which is expressed as follows:

[0050] W t (i,j)=C t (i,j) exp ( -λ·(σ i +σ j ))

[0051] Among them, W t (i,j) is the modified correlation strength, which combines correlation and market volatility; σ i and σ j are the standard deviations of the characteristics of market i and market j respectively; λ is a hyperparameter used to adjust the impact of volatility on correlation; exp(-λ·(σ i +σj )) is used to suppress excessive correlation in volatile markets;

[0052] According to the modified correlation matrix W t ∈R k×k Constructing a cross-market dynamic association network G t =(V,E,W t ), where V = {v1, v2, …, v k} represents a market node; E = {(v i ,v j )∣W t (i,j)>τ} is the edge set whose correlation between markets exceeds the threshold τ; W t is the edge weight matrix, which indicates the strength of association between markets;

[0053] The cross-market dynamic association network is constructed according to the corrected association degree, and the cross-market dynamic association network is embedded in the low-dimensional space to obtain an embedding matrix, and only the most critical constraint items are retained, which is expressed as follows:

[0054]

[0055] in, is the Euclidean distance between embedding vectors; is a regularization term used to prevent numerical instability caused by an overly large embedding vector; γ is a regularization weight.

[0056] Furthermore, the cross-market dynamic association network G t =(V,E,W t ), there is also a node influence factor ψ i :

[0057]

[0058] Among them, ψ i Measures the influence of market i in the network, normalized to the interval [0,1].

[0059] Furthermore, the preliminary feature vector f0(t,i,j) of the outlier point is expressed as:

[0060]

[0061] Among them, |S(t,i,j)| represents the strength of the outlier point (t,i,j); ψ i is the point impact factor of market i; ∑ q≠i W t (i,q) represents the sum of linkage weights between market i and other markets, measuring the cross-market propagation characteristics of anomalies. q is the identifier of other markets associated with market i; W tis the linkage weight matrix at time t;

[0062] The feature fusion of the preliminary feature vector f0(t,i,j) is performed through the time sliding window method, which is expressed as:

[0063]

[0064] Among them, Δ t (S(t,i,j))=|S(t,i,j)-S(t-1,i,j)|, which indicates the change amplitude of the abnormal point in the time dimension; is the average anomaly intensity in the time window [t-w+1,t];

[0065] The importance score ν(t,i,j) is expressed as:

[0066]

[0067] Among them, δ is the weight for adjusting the cross-market transmission term; ω is the weight for adjusting the time change term;

[0068] The final feature vector is:

[0069] f(t,i,j)=[f1(t,i,j),ξ(t,i,j)]

[0070] Among them, f1(t,i,j) is the enhanced preliminary feature vector; ξ(t,i,j) is the inter-market distance characteristic of the outlier point:

[0071]

[0072] Among them, ξ(t,i,j) measures the spatial linkage characteristics between markets;

[0073] The classification target of the multi-classification model is expressed as:

[0074]

[0075] Among them, g(f(t,i,j); θ) represents the predicted output of the classification model; y t,i,j is the true category label of the outlier; l is the classification error loss; ρ is the model regularization weight.

[0076] Furthermore, the classification results include: single-market hidden anomalies, cross-market linkage anomalies, sudden anomalies and continuous anomalies.

[0077] Furthermore, the anomaly propagation network is constructed as follows:

[0078] Define anomaly propagation network G = (V, E), where node V represents the market; edge E = {(v i,v j )∣W t (i,j)>τ}, the weight is given by W t (i,j) determines; node importance ρ i , which represents the influence of market i in abnormal propagation, is expressed as:

[0079]

[0080] Among them, |S(t,i,j)| represents the strength of the outlier point (t,i,j); Var(Z t (i,:)) is the dynamic variance of the embedding representation of market i, reflecting its activity in anomaly propagation; ε is a hyperparameter that adjusts the dynamic impact of embedding;

[0081] In the propagation network G, the propagation path and overall influence of the anomaly are quantified by the propagation path weight and the global propagation influence; the propagation path weight is expressed as:

[0082]

[0083] Among them, π(i→j) represents the degree to which the communication capacity of market i is distributed to market j through linkage weights, ensuring the accuracy of path analysis;

[0084] The global propagation influence is expressed as:

[0085]

[0086] Among them, Φ is the global communication influence.

[0087] Furthermore, the time dynamic characteristics of the analysis propagation are specifically:

[0088] In terms of time dimension, define the change trend of the propagation rate of market i as η i (t), is calculated as follows:

[0089]

[0090] Among them, ∈ is a small value used to avoid the denominator being zero; ρ i (t) is the transmission intensity of market i at time t; ρ i (t-1) is the transmission intensity of market i at time t-1;

[0091] Aggregate the changes in the propagation rate of the entire market to form a global trend, calculated as follows:

[0092]

[0093] Among them, η i (t) is the propagation rate, is the average value of the change in the propagation rate of all markets at time t, indicating the global trend of the change in the propagation rate;

[0094] Combined propagation rate η i (t) and node propagation importance ρ i , identify the set of hot spots H, defined as markets that meet the following conditions:

[0095]

[0096] Among them, δ is the threshold set by the user.

[0097] In a second aspect of the present invention, a financial data anomaly identification system based on big data analysis is provided, the system comprising:

[0098] The multi-market data collection module is used to collect high-frequency trading data from multiple markets and perform synchronous preprocessing, including:

[0099] Collect transaction data streams from k markets, construct a multi-market original transaction matrix, and standardize the multi-market original transaction matrix;

[0100] The standardized matrix is ​​enhanced according to the price difference characteristics, the sparse items of the inter-market yield covariance and the price difference, and the enhanced transaction matrix is ​​obtained;

[0101] The association network construction module is used to build a dynamic association network based on the preprocessed data and associate the linkage characteristics between multiple markets, including:

[0102] Construct the preliminary correlation between market i and market j based on the enhanced transaction matrix and make corrections;

[0103] Construct a cross-market dynamic correlation network based on the corrected correlation degree, and embed the cross-market dynamic correlation network into a low-dimensional space to obtain an embedding matrix, retaining only the most critical constraint items;

[0104] The data anomaly identification module is used to identify normal and abnormal trading patterns based on multi-market associations, including:

[0105] The enhanced transaction matrix and the embedding matrix are fused to form a comprehensive transaction feature matrix;

[0106] The comprehensive transaction feature matrix is ​​decomposed into sparse low-rank behavior patterns, specifically:

[0107] Assuming that the fused feature matrix X′ is decomposed into normal transaction mode and abnormal transaction mode, we have:

[0108] X′=L+S

[0109] Where L∈R k×(n′+d)×m represents a low-rank matrix, corresponding to the normal trading pattern, with strong regularity between time and market; S∈R k×(n′+d)×m represents a sparse matrix, corresponding to abnormal trading patterns, capturing local abnormal behaviors; k is the number of markets; n' is the enhanced feature dimension of each market, including original features and cross-market enhanced features; d is the dynamic embedding dimension, representing the low-dimensional representation of market linkage characteristics; m is the time step, representing the time series length of transaction data;

[0110] According to the identified abnormal trading pattern, the optimization objective function is designed to solve L and S:

[0111]

[0112] Among them, ||L|| * represents the nuclear norm, controlling the low rank of L; ||S||1 represents the sparse regularization term of S, encouraging the concentration of outliers; ||W⊙S||1 represents the weight sparse term, using the weight matrix W to strengthen the outlier detection in key markets; Represents a temporal smoothness constraint, encouraging the continuity of anomalies in the temporal dimension; τ,γ represent hyperparameters, which control the weights of each regularization term respectively;

[0113] Through the iterative optimization method, the optimization objective function is solved to obtain the decomposition results L and S, and then the transaction anomalies are extracted from the sparse matrix S:

[0114] Define the transaction anomaly point set P:

[0115] P={(t,i,j)||S(t,i,j)|>τ}

[0116] Among them, τ is the threshold for extracting transaction anomaly points; each transaction anomaly point (t,i,j) includes the annotation information of time t, market i, and feature dimension j;

[0117] Output sparse matrix S∈R k×(n′+d)×m , marking abnormal trading patterns; low-rank matrix L∈R k×(n′+d)×m , marking the normal transaction mode; the set of transaction abnormal points P;

[0118] The data anomaly classification module is used to select abnormal transaction points and classify the abnormal transaction points, including:

[0119] Construct a preliminary feature vector of the outlier point based on the sparse matrix and the set of prone outlier points. Design an importance score of the outlier point based on the preliminary feature vector of the outlier point combined with constant strength, market influence and cross-market propagation characteristics. Design an anomaly threshold, retain high-risk outliers with importance scores higher than the anomaly threshold, and construct a high-risk outlier point set P';

[0120] Construct the final feature vector of each outlier point based on the high-risk outlier point set P', build a multi-classification model to classify the final feature vector of each outlier point, and mark the category label of each point;

[0121] The data anomaly propagation module is used to build an anomaly propagation network based on the results of abnormal transaction point classification, quantify the propagation path and global influence of abnormal transaction points, and analyze the time dynamic characteristics of propagation.

[0122] The beneficial technical effects of the present invention are at least as follows:

[0123] (1) The present invention captures the transaction relationships and linkage characteristics between multiple markets by constructing a dynamic association network model. The dynamic weighted network method is used to extract the association strength between markets in real time, and a low-dimensional representation that can reflect the linkage characteristics is generated through graph embedding technology. This method significantly enhances the ability to identify cross-market abnormal events and overcomes the limitations of traditional single-market analysis methods.

[0124] (2) The present invention uses high-dimensional sparse matrix decomposition technology to decompose transaction data into normal transaction patterns (low-rank part) and abnormal transaction patterns (sparse part), and extracts potential abnormal points from the sparse matrix. This method can effectively capture the hidden characteristics of abnormal transactions, such as scattered transactions and frequent small transactions, and significantly improves the detection accuracy of sparse abnormal patterns.

[0125] (3) The present invention combines cross-market linkage features with sparse anomaly patterns to design a fusion anomaly analysis framework. While identifying anomalies, it provides multi-level result interpretation, including anomaly propagation paths, key features of abnormal transactions, and potential market impact. This design makes the detection results more practical and can directly provide support for risk assessment and decision-making.

[0126] (4) The present invention achieves accurate identification of complex abnormal behaviors across markets, especially the effective capture of hidden trading patterns, and significantly enhances the interpretability and analytical value of the results. These improvements not only overcome the shortcomings of the existing technology, but also provide an efficient and comprehensive solution for financial risk management. BRIEF DESCRIPTION OF THE DRAWINGS

[0127] The present invention is further described using the accompanying drawings, but the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative work.

[0128] Figure 1 This is a flow chart of the financial data anomaly identification method based on big data analysis of the present invention.

[0129] Figure 2 This is a framework diagram of the financial data anomaly identification system based on big data analysis of the present invention. DETAILED DESCRIPTION

[0130] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0131] In one or more embodiments, Figure 1 As shown, a method for identifying financial data anomalies based on big data analysis is disclosed, and the method includes the following steps S1-S5:

[0132] S1. Collect high-frequency trading data from multiple markets and perform synchronous preprocessing, including:

[0133] Input transaction data stream from k markets Each market contains characteristics such as opening price O i (t), closing price P i (t), transaction volume V i (t), etc., construct the original transaction matrix of multiple markets:

[0134] X (raw) ∈R k×n×m

[0135] Among them, k represents the number of markets, n represents the characteristic dimension of a single market, and m represents the time step.

[0136] Furthermore, dynamic standardization is performed to address the problem of inconsistent feature scales:

[0137]

[0138] in, is the sliding mean of feature j in market i, is the sliding standard deviation of feature j, and ∈ is a regularization term used to avoid numerical instability when the feature variance is too small. By combining dynamic standardization with sliding window technology, the processing is made time-sensitive and the model's adaptability to financial data fluctuations is enhanced.

[0139] Furthermore, multi-market trading data may have inconsistent sampling frequencies or asynchronous time steps, and a unified time grid is required. Therefore, a unified time grid {t1, t2, …, t m}, interpolation is used to align missing values:

[0140]

[0141] Where interp(·) represents the interpolation function, and the interpolation method (such as linear interpolation or nearest neighbor interpolation) is dynamically selected to adapt to the feature type. Time alignment unifies the time steps of multiple markets and fills in missing points to ensure data consistency.

[0142] Furthermore, a cross-market correlation feature matrix is ​​constructed to capture the hidden linkages and abnormal correlations between markets through innovative regularization terms:

[0143] Price difference feature: Calculate the price difference between market i and market j:

[0144] D i,j (t) = P i (t)-P j (t)

[0145] Synergy enhancement term: By integrating the sparse terms of inter-market yield covariance and price differences, a cross-market synergy enhancement matrix is ​​defined:

[0146] S i,j (t) = α·Cov(R i (t),R j (t))+β·||D i,j (t)||1

[0147] Among them, Cov(R i (t),R j (t)) is the return covariance of market i and j, indicating their volatility co-movement; ||D i,j (t) | ||1 is a sparse term for price differences between markets, which encourages abnormal signals to be more concentrated; α and β are hyperparameters that control the covariance and sparsity regularization weights.

[0148] The single market feature X (aligned) and cross-market enhancement matrix Splicing to get the enhanced transaction matrix:

[0149]

[0150] By combining covariance and sparsity regularization, we can capture hidden linkage patterns across markets while enhancing the concentration of outliers.

[0151] Furthermore, noise and missing values ​​are common in high-frequency trading data, which requires cleaning and noise reduction to ensure data quality. The solution is:

[0152] Missing value filling: Use the weighted mean of the sliding window to fill:

[0153]

[0154] where ω s =e -α(t-s) is the weight, the closer the value is to the time, the higher the weight; α controls the weight decay speed.

[0155] Outlier processing: Outliers exceeding the z standard deviation are replaced with the median of the sliding window. The weighted mean retains the dynamic characteristics of the data while smoothing the noise and enhancing the robustness of the data.

[0156] Furthermore, high-frequency trading data has a high dimensionality, and directly inputting it into subsequent steps may lead to high computational overhead and low efficiency. Principal component analysis (PCA) is used to reduce the dimensionality and extract the main features:

[0157] X (final) (t) = X (cleaned) (t)·W PCA

[0158] Where W PCA For the principal component projection matrix, only the first n' principal components are selected so that the cumulative variance explanation exceeds 95%. Dimensionality reduction not only retains the main feature information, but also reduces the computational complexity, providing efficient input for subsequent steps.

[0159] Furthermore, the final output is the enhanced, cleaned and compressed transaction matrix:

[0160] X∈R k×n′×m

[0161] The matrix combines single-market characteristics with cross-market enhancements, and is high-quality input data that supports subsequent cross-market dynamic modeling and anomaly detection.

[0162] S2. Build a dynamic association network based on the preprocessed data to associate the linkage characteristics between multiple markets, including:

[0163] Input is the enhanced transaction matrix X (enhanced) , where X (enhanced) (t,i,:) represents the feature vector of market i at time t. By constructing a sliding time window [t-w+1,t], the initial correlation between market i and market j is defined:

[0164] C t (i,j)=Corr(X (enhanced) (t,i,:),X(enhanced)(t,j,:))

[0165] Where Corr is the Pearson correlation coefficient, C t (i,j) represents the feature correlation between market i and market j at time t.

[0166] In order to address the impact of market fluctuations on correlation, an innovative correlation correction model is designed:

[0167] W t (i,j)=Ct(i,j)·exp(-λ·(σ i +σ j ))

[0168] Among them, W t (i,j) is the modified correlation strength, which combines correlation and market volatility; σ i and σ j are the standard deviations of the characteristics of market i and market j respectively; λ is a hyperparameter used to adjust the impact of volatility on correlation. t (i,j) is a static correlation between markets, but is easily affected by large fluctuations in the market. i +σ j )) is used to suppress excessive correlation in large volatile markets and enhance the stability and authenticity of correlation.

[0169] Furthermore, based on the modified correlation matrix Constructing a cross-market dynamic association network G t =(V,E,Wt), where:

[0170] V={v1,v2,…,v k} represents a market node; E = {(v i ,v j )∣W t (i,j)>τ} is the edge set whose correlation between markets exceeds the threshold τ; W t is the edge weight matrix, which indicates the strength of association between markets.

[0171] Furthermore, to highlight the importance of the market, we define the node impact factor ψ i :

[0172]

[0173] where ψ i Measures the influence of market i in the network, normalized to the interval [0,1]. i , can identify key markets in the network and provide a reference for subsequent anomaly detection

[0174] Furthermore, in order to extract the linkage characteristics between markets, the network G t Embed into low-dimensional space. Let the embedding vector matrix be Z t ∈R k×d , where z i (t) is a low-dimensional representation vector representing market i. The embedding is generated by optimizing the following objective:

[0175]

[0176] in, is the Euclidean distance between embedding vectors, which encourages strongly related markets to be closer in the embedding space; is a regularization term used to prevent numerical instability caused by an overly large embedding vector; γ is a regularization weight. Only the most critical constraints are retained in the embedding optimization objective to avoid the redundancy of complex formulas, and the regularization term is designed in combination with the sparsity of the embedding to ensure the sensitivity of low-dimensional features to abnormal signals.

[0177] The final output dynamic embedding matrix Z t ∈R k×d , where each row corresponds to the low-dimensional representation z of market i at time t i (t), contains the characteristics of the linkage relationship between markets. This matrix is ​​used as the input of the next step, combined with the decomposition of trading behavior patterns, to help identify abnormal trading behaviors across markets.

[0178] S3. Identify normal and abnormal trading patterns based on multi-market correlation, including:

[0179] The input includes:

[0180] Enhanced Trading Matrix Derived from step 1, including basic trading features and enhanced features of multiple markets;

[0181] Dynamic Embedding Matrix Derived from step 2, it represents the low-dimensional representation of the market's linkage characteristics.

[0182] The two matrices are merged in feature dimension to form a comprehensive transaction feature matrix X′:

[0183] X′=[X (enhanced) ,Z t ]

[0184] Among them, X (enhanced) The time dimensions m and Z t The time steps of X′∈R are aligned by broadcast expansion; k×(n′+d)×m , represents the multi-market comprehensive feature matrix that integrates both transaction characteristics and linkage characteristics. This feature fusion enables the decomposition model to not only capture the abnormal transaction characteristics of a single market, but also t Extract unusual cross-market linkage patterns.

[0185] Furthermore, it is assumed that the fused feature matrix X′ can be decomposed into normal transaction mode and abnormal transaction mode:

[0186] X′=L+S

[0187] Where L∈R k×(n′+d)×mrepresents a low-rank matrix, corresponding to the normal trading pattern, with strong regularity between time and market; S∈R k×(n′+d)×m Represents a sparse matrix, corresponding to abnormal trading patterns, capturing local abnormal behaviors.

[0188] To solve L and S, the following optimization objective function is designed:

[0189]

[0190] Among them, ||L|| * : Nuclear norm, controlling the low rank of L; ||S||1: Sparse regularization term of S, encouraging the concentration of outliers; ||W⊙S||1: Weight sparse term, using the weight matrix W to strengthen outlier detection in key markets; Temporal smoothness constraints encourage the continuity of anomalies in the time dimension; τ,γ: Hyperparameters, which control the weight of each regularization term respectively.

[0191] Furthermore, the weight sparse term: W = ψ·Z t , where ψ is the market impact factor in step 2, and Z t It is the dynamic linkage embedding of the market, and W emphasizes the influence of abnormal linkage across markets.

[0192] Where T(S) is the time difference operator of the anomaly matrix S, defined as T(S)(t) = S(t) - S(t-1), and its second norm is It is used to reduce the drastic changes of abnormal signals in the time dimension, which is in line with the gradual propagation characteristics of financial anomalies.

[0193] Furthermore, the above objective function is solved by an iterative optimization method (such as alternating direction multiplier method ADMM) to obtain decomposition results L and S.

[0194] Extract outliers from the sparse matrix S: Define the outlier set P:

[0195] P={(t,i,j)||S(t,i,j)|>τ}

[0196] Where τ is the anomaly extraction threshold, which is usually set based on the distribution quantile of S. Each anomaly point (t,i,j) includes the annotation information of time t, market i, and feature dimension j. The sparse values ​​in the matrix S mark the distribution location of abnormal behavior. By combining the information of weight W, the characteristics of cross-market linkage anomalies can be further identified.

[0197] The final output includes: sparse matrix Marking unusual trading patterns; low-rank matrices Mark normal trading patterns; the set of anomalies P contains specific information about the anomalies (time, market, features, etc.). These outputs provide basic data for subsequent anomaly classification and risk assessment, especially the sparsity and cross-market correlation characteristics of the matrix S, which directly serve the hierarchical analysis and interpretation of abnormal behaviors.

[0198] S4. Select abnormal transaction points and classify the abnormal transaction points, including:

[0199] The input includes:

[0200] Sparse anomaly matrix Indicates abnormal trading patterns, derived from step 3; abnormal point set Contains initially identified outliers; dynamic embedding matrix Derived from step 2, it represents the market linkage characteristics.

[0201] Furthermore, for the input data, a preliminary feature vector of the outlier is constructed:

[0202]

[0203] Among them, |S(t,i,j)| represents the strength of the outlier point (t,i,j); ψ i is the influencing factor of market i, derived from step 2; ∑ q≠i W t (i,q) represents the sum of linkage weights between market i and other markets, measuring the cross-market propagation characteristics of anomalies.

[0204] Furthermore, the temporal dynamic characteristics of outliers are enhanced through the time sliding window method:

[0205]

[0206] Among them, Δ t (S(t,i,j))=|S(t,i,j)-S(t-1,i,j)|, which indicates the change amplitude of the abnormal point in the time dimension; is the average anomaly intensity in the time window [t-w+1,t]:

[0207]

[0208] Among them, f1(t,i,j) represents the enhanced outlier feature vector.

[0209] Furthermore, in order to screen high-risk outliers, the importance score ν(t,i,j) of the outlier is defined, combining the outlier strength, market influence, and cross-market propagation characteristics:

[0210]

[0211] Among them, δ is the weight for adjusting the cross-market transmission term; ω is the weight for adjusting the time change term.

[0212] Furthermore, the screening rule is: set the screening threshold ζ according to the distribution quantile of ν(t,i,j), and retain the outliers with scores higher than ζ:

[0213] P′={(t,i,j)∈P∣ν(t,i,j)>ζ}

[0214] This screening strategy comprehensively considers the strength of a single market, cross-market transmission and time dynamic characteristics to ensure that the screening results focus on covering hidden transactions and linkage transmission anomalies.

[0215] Furthermore, for the filtered outlier set P′, the types of outliers are further classified. The final feature vector is constructed for each outlier:

[0216] f(t,i,j)= [ f1(t,i,j),ξ(t,i,j)]

[0217] Among them, f1(t,i,j) is the enhanced preliminary feature vector; ξ(t,i,j) is the inter-market distance characteristic of the outlier point:

[0218]

[0219] Among them, ξ(t,i,j) measures the spatial linkage characteristics between markets. The larger the value, the greater the distance of anomaly propagation in the embedded space.

[0220] Furthermore, a multi-classification model is defined to classify outliers, and the classification target is:

[0221]

[0222] Among them, g(f(t,i,j); θ) represents the predicted output of the classification model; y t,i,j is the true category label of the outlier; l is the classification error loss; ρ is the model regularization weight.

[0223] Furthermore, according to the classification results, the outliers are divided into the following categories:

[0224] Hidden anomalies in a single market: anomalies are concentrated in a single market, and the cross-market transmission effect is weak;

[0225] Cross-market linkage anomalies: anomalies spread across multiple markets, showing strong linkage;

[0226] Sudden anomaly: The anomaly has significant temporal mutation characteristics;

[0227] Persistent anomaly: The anomaly persists for a long time.

[0228] Furthermore, the final output includes:

[0229] The high-risk outlier point set P′ after screening, with the category label of each point;

[0230] Classification statistical features (such as the proportion of abnormal points in each category, cross-market transmission intensity, etc.) are used for subsequent abnormal transmission analysis and visual interpretation.

[0231] S5. Based on the results of abnormal transaction point classification, an abnormal propagation network is constructed to quantify the propagation path and global influence of abnormal transaction points, and analyze the temporal dynamic characteristics of propagation, including:

[0232] Define the propagation network G = (V, E), where:

[0233] Node V represents the market; edge E = {(v i ,v j )∣W t (i,j)>τ}, the weight is given by W t (i,j) determines; node importance ρ i , which represents the influence of market i in the abnormal propagation, is defined by the following innovation:

[0234]

[0235] Among them, |S(t,i,j)| represents the strength of the outlier point (t,i,j); Var(Z t (i,:)) is the dynamic variance of the embedding representation of market i, reflecting its activity in abnormal propagation; ε is a hyperparameter for adjusting the dynamic impact of embedding. By introducing the embedding dynamic variance term Var(Z t (i,:)), further quantifies the market’s activity in anomaly propagation, making the propagation network closer to the characteristics of multi-market anomaly linkage.

[0236] Furthermore, in the propagation network G, the propagation path and overall influence of the anomaly are quantified:

[0237] Propagation path weight:

[0238] Define the intensity of anomaly propagation from market i to market j:

[0239]

[0240] π(i→j) represents the extent to which the communication capacity of market i is distributed to market j through linkage weights, ensuring the accuracy of path analysis.

[0241] Global communication influence:

[0242] The global influence Φ is defined as the sum of all inter-market propagation path weights, normalized to the network size:

[0243]

[0244] The propagation path weight π(i→j) and the global influence Φ provide quantitative indicators to help identify the key paths for anomaly propagation and the overall diffusion of anomalies in the network.

[0245] Further, time dynamic modeling:

[0246] In terms of time dimension, define the change trend of the propagation rate of market i:

[0247]

[0248] where ∈ is a small value used to avoid the denominator being zero.

[0249] Aggregate the changes in the propagation rate of the entire market to form a global trend:

[0250]

[0251] Further, spatiotemporal hot spot analysis:

[0252] Combined propagation rate η i (t) and node propagation importance ρ i , identify the set of hot spots H, defined as markets that meet the following conditions:

[0253]

[0254] Here δ is a threshold set by the user, ensuring that only markets with significant propagation anomalies are screened out.

[0255] Temporal dynamic modeling and hot market identification combine the trend of propagation changes in the time dimension and the dynamics of inter-market linkages, providing a quantitative basis for the analysis of abnormal spatiotemporal propagation.

[0256] Furthermore, based on the propagation network G and the dynamic propagation analysis results, the following visualization scheme is designed:

[0257] Propagation network graph: Node size represents ρ i , that is, the importance of market transmission; the edge color and thickness represent π(i→j), showing the strength of the transmission path between markets; the network status is dynamically updated to show the time evolution process of abnormal transmission.

[0258] Propagation heat map:

[0259] The horizontal axis is time, the vertical axis is market, and the color represents ρ i (t) the propagation intensity;

[0260] The heat map intuitively presents the distribution of anomalies in time and space dimensions.

[0261] Global propagation trend curve:

[0262] The horizontal axis is time, and the vertical axis is Mark the key nodes of the propagation rate (such as the outbreak and decay periods of abnormal propagation).

[0263] By combining the visualization of static network structure and dynamic evolution process, it helps users quickly understand the overall picture of abnormal propagation and its key characteristics.

[0264] Furthermore, the output includes:

[0265] Anomaly propagation network G, annotating the propagation importance of each node ρ i and the edge propagation path weight π(i→j);

[0266] Global propagation index Φ and temporal dynamics Reveal the intensity and trend of transmission;

[0267] Visualized charts (propagation network diagrams, heat maps, trend curves) intuitively present the spatiotemporal characteristics of abnormal propagation.

[0268] Through quantitative analysis and visualization, this step provides an efficient tool for the interpretation and decision-making of abnormal risks, while closing the patent process from detection to propagation analysis, providing comprehensive technical support for the supervision of cross-market hidden transactions.

[0269] In one or more embodiments, Figure 2 As shown, a financial data anomaly identification system based on big data analysis is disclosed, and the system includes:

[0270] The multi-market data collection module 101 is used to collect high-frequency trading data from multiple markets and perform synchronous preprocessing, including:

[0271] Collect transaction data streams from k markets, construct a multi-market original transaction matrix, and standardize the multi-market original transaction matrix;

[0272] The standardized matrix is ​​enhanced according to the price difference characteristics, the sparse items of the inter-market yield covariance and the price difference, and the enhanced transaction matrix is ​​obtained;

[0273] The association network construction module 102 is used to construct a dynamic association network based on the pre-processed data, and associate the linkage relationship characteristics between multiple markets, including:

[0274] Construct the preliminary correlation between market i and market j based on the enhanced transaction matrix and make corrections;

[0275] Construct a cross-market dynamic correlation network based on the corrected correlation degree, and embed the cross-market dynamic correlation network into a low-dimensional space to obtain an embedding matrix, retaining only the most critical constraint items;

[0276] The data anomaly identification module 103 is used to identify normal transaction patterns and abnormal transaction patterns based on multi-market associations, including:

[0277] The enhanced transaction matrix and the embedding matrix are fused to form a comprehensive transaction feature matrix;

[0278] The comprehensive transaction feature matrix is ​​decomposed into sparse low-rank behavior patterns, specifically:

[0279] Assuming that the fused feature matrix X′ is decomposed into normal transaction mode and abnormal transaction mode, we have:

[0280] X′=L+S

[0281] Where L∈R k×(n′+d)×m represents a low-rank matrix, corresponding to the normal trading pattern, with strong regularity between time and market; S∈R k×(n′+d)×m represents a sparse matrix, corresponding to abnormal trading patterns, capturing local abnormal behaviors; k is the number of markets; n' is the enhanced feature dimension of each market, including original features and cross-market enhanced features; d is the dynamic embedding dimension, representing the low-dimensional representation of market linkage characteristics; m is the time step, representing the time series length of transaction data;

[0282] According to the identified abnormal trading pattern, the optimization objective function is designed to solve L and S:

[0283]

[0284] Among them, ||L|| * represents the nuclear norm, controlling the low rank of L; ||S||1 represents the sparse regularization term of S, encouraging the concentration of outliers; ||W⊙S||1 represents the weight sparse term, using the weight matrix W to strengthen the outlier detection in key markets; Represents a temporal smoothness constraint, encouraging the continuity of anomalies in the temporal dimension; τ,γ represent hyperparameters, which control the weights of each regularization term respectively;

[0285] Through the iterative optimization method, the optimization objective function is solved to obtain the decomposition results L and S, and then the transaction anomalies are extracted from the sparse matrix S:

[0286] Define the transaction anomaly point set P:

[0287] P={(t,i,j)||S(t,i,j)>τ}

[0288] Among them, τ is the threshold for extracting transaction anomaly points; each transaction anomaly point (t,i,j) includes the annotation information of time t, market i, and feature dimension j;

[0289] Output sparse matrix S∈R k×(n′+d)×m , marking abnormal trading patterns; low-rank matrix L∈R k×(n′+d)×m , marking the normal transaction mode; the set of transaction abnormal points P;

[0290] The data anomaly classification module 104 is used to select abnormal transaction points and classify the abnormal transaction points, including:

[0291] Construct a preliminary feature vector of the outlier point based on the sparse matrix and the set of prone outlier points. Design an importance score of the outlier point based on the preliminary feature vector of the outlier point combined with constant strength, market influence and cross-market propagation characteristics. Design an anomaly threshold, retain high-risk outliers with importance scores higher than the anomaly threshold, and construct a high-risk outlier point set P';

[0292] Construct the final feature vector of each outlier point based on the high-risk outlier point set P', build a multi-classification model to classify the final feature vector of each outlier point, and mark the category label of each point;

[0293] The data anomaly propagation module 105 is used to construct an anomaly propagation network based on the results of abnormal transaction point classification, quantify the propagation path and global influence of the abnormal transaction points, and analyze the time dynamic characteristics of the propagation.

[0294] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying financial data anomalies based on big data analysis, characterized in that: The method comprises the following steps: S1. Collect high-frequency trading data from multiple markets and perform synchronous preprocessing, including: Collect transaction data streams from k markets, construct a multi-market original transaction matrix, and standardize the multi-market original transaction matrix; The standardized matrix is ​​enhanced according to the price difference characteristics, the sparse items of the inter-market yield covariance and the price difference, and the enhanced transaction matrix is ​​obtained; S2. Build a dynamic association network based on the preprocessed data to associate the linkage characteristics between multiple markets, including: Construct the preliminary correlation between market i and market j based on the enhanced transaction matrix and make corrections; Construct a cross-market dynamic correlation network based on the corrected correlation degree, and embed the cross-market dynamic correlation network into a low-dimensional space to obtain an embedding matrix, retaining only the most critical constraint items; S3. Identify normal and abnormal trading patterns based on multi-market correlation, including: The enhanced transaction matrix and the embedding matrix are fused to form a comprehensive transaction feature matrix; The comprehensive transaction feature matrix is ​​decomposed into sparse low-rank behavior patterns, specifically: Assuming that the fused feature matrix X′ is decomposed into normal transaction mode and abnormal transaction mode, we have: X′=L+S Where L∈R k×(n′+d)×m represents a low-rank matrix, corresponding to the normal trading pattern, with strong regularity between time and market; S∈R k×(n′+d)×m represents a sparse matrix, corresponding to abnormal trading patterns, capturing local abnormal behaviors; k is the number of markets; n′ is the enhanced feature dimension of each market, including original features and cross-market enhanced features; d is the dynamic embedding dimension, representing the low-dimensional representation of market linkage characteristics; m is the time step, representing the time series length of transaction data; According to the identified abnormal trading pattern, the optimization objective function is designed to solve L and S: Among them, ||L|| * represents the nuclear norm, controlling the low rank of L; ||S||1 represents the sparse regularization term of S, encouraging the concentration of outliers; ||W⊙S||1 represents the weight sparse term, using the weight matrix W to strengthen the outlier detection in key markets; represents the time smoothness constraint, which encourages the continuity of anomalies in the time dimension; θ, τ, and γ represent hyperparameters, which control the weights of each regularization term respectively; Through the iterative optimization method, the optimization objective function is solved to obtain the decomposition results L and S, and then the transaction anomalies are extracted from the sparse matrix S: Define the transaction anomaly point set P: P={(t,i,j)||S(t,i,j)|>τ} Among them, τ is the threshold for extracting transaction anomaly points; each transaction anomaly point (t, i, j) includes the annotation information of time t, market i, and feature dimension j; Output sparse matrix S∈R k×(n′+d)×m , marking abnormal trading patterns; low-rank matrix L∈R k×(n′+d)×m , marking the normal transaction mode; the set of transaction abnormal points P; S4. Select abnormal transaction points and classify the abnormal transaction points, including: Construct a preliminary feature vector of the outlier point based on the sparse matrix and the set of prone outliers. Design the importance score of the outlier point based on the preliminary feature vector of the outlier point combined with the constant strength, market influence and cross-market propagation characteristics. Design an anomaly threshold, retain high-risk outliers with importance scores higher than the anomaly threshold, and construct a high-risk outlier point set P′; Construct the final feature vector of each outlier point based on the high-risk outlier point set P′, build a multi-classification model to classify the final feature vector of each outlier point, and mark the category label of each point; S5. Based on the results of abnormal transaction point classification, an abnormal propagation network is constructed to quantify the propagation path and global influence of abnormal transaction points, and the temporal dynamic characteristics of propagation are analyzed.

2. The method for identifying financial data anomalies based on big data analysis according to claim 1, characterized in that: The price difference feature is the price difference between market i and market j, denoted as D i，j (t) = P i (t)-P j (t), the sparse term of the fusion market yield covariance and price difference is the synergistic enhancement term It is expressed as: Among them, Cov(R i (t), R j (t)) is the return covariance of market i and j, indicating their volatility co-movement; ||D i，j (t)||1 is a sparse term for price differences between markets, which encourages abnormal signals to be more concentrated; α and β are hyperparameters that control the covariance and sparsity regularization weights; The single market feature X (aligned) And the cross-market enhancement matrix S(t) is concatenated to obtain the enhanced transaction matrix, which is expressed as: X (enhanced) =[X (aligned) ,S(t)] Among them, X (enhanced) This is the enhanced transaction matrix.

3. The method for identifying financial data anomalies based on big data analysis according to claim 2 is characterized in that: The S1 also includes data cleaning and noise reduction of the enhanced transaction matrix, specifically: Use weighted mean of sliding window to fill: Among them, ω s =e -a(t-s) is the weight, the closer the value is to the time, the higher the weight; a represents the speed of weight decay; t represents the current time point; s represents the historical time point in the sliding window; w represents the length of the sliding window, which determines how many historical time points are considered; ω s represents the weight of time s; j represents the feature dimension currently being processed; Use principal component analysis to reduce dimension and extract the main features X (final) (t): X (final) (t)=X (cleaned) (t)·W PCA Among them, W PCA X is the principal component projection matrix, and only the first n′ principal components are selected; (cleaned) (t) is the data after cleaning.

4. The method for identifying financial data anomalies based on big data analysis according to claim 1, characterized in that: The initial correlation C t (i, j), is represented as follows: C t (i,j)=Corr(X (enhanced) (t,i,:),x (enhanced) (t,j,:)) Where Corr is the Pearson correlation coefficient, C t (i, j) represents the characteristic correlation between market i and market j at time t; X (enhanced) (t, i, :) is the enhanced transaction matrix of market i, X (enhanced) (t, j,:) is the enhanced trading matrix of market j; At the same time, the initial correlation C t The correlation correction model is designed in (i, j) and is expressed as follows: W t (i,j)=C t (i,j)·exp(-λ·(σ i +σ j )) Among them, W t (i, j) is the modified correlation strength, which combines correlation and market volatility; σ i and σ j are the standard deviations of the characteristics of market i and market j respectively; λ is a hyperparameter used to adjust the impact of volatility on correlation; exp(-λ·(σ i +σ j )) is used to suppress excessive correlation in volatile markets; According to the modified correlation matrix W t ∈R k×k Constructing a cross-market dynamic association network G t =(V, E, W t ), where V = {v1, v2, ..., v k } represents a market node; E = {(v i , v j )|W t (i, j)>τ} is the edge set whose inter-market correlation exceeds the threshold τ; W t is the edge weight matrix, which indicates the strength of association between markets; The cross-market dynamic association network is constructed according to the corrected association degree, and the cross-market dynamic association network is embedded in the low-dimensional space to obtain an embedding matrix, and only the most critical constraint items are retained, which is expressed as follows: in, is the Euclidean distance between embedding vectors; is a regularization term used to prevent numerical instability caused by an overly large embedding vector; γ is a regularization weight.

5. The method for identifying financial data anomalies based on big data analysis according to claim 4 is characterized in that: The cross-market dynamic association network G t =(V, E, W t ), there is also a node influence factor ψ i : Among them, ψ i Measures the influence of market i in the network, normalized to the interval [0, 1].

6. The method for identifying financial data anomalies based on big data analysis according to claim 1, characterized in that: The preliminary feature vector f0(t, i, j) of the outlier point is expressed as: Among them, |S(t, i, j)| represents the strength of the outlier point (t, i, j); ψ i is the point impact factor of market i; ∑ q≠i W t (i, q) represents the sum of linkage weights between market i and other markets, measuring the cross-market propagation characteristics of anomalies. q is the identifier of other markets associated with market i; W t is the linkage weight matrix at time t; The feature fusion of the preliminary feature vector f0(t, i, j) is performed through the time sliding window method, which is expressed as: Among them, Δ t (S(t, i, j)) = |S(t, i, j) - S(t-1, i, j)|, which indicates the change amplitude of the abnormal point in the time dimension; is the average anomaly intensity in the time window [t-w+1, t]; The importance score ν(t, i, j) is expressed as: Among them, δ is the weight for adjusting the cross-market transmission term; ω is the weight for adjusting the time change term; The final feature vector is: f(t,i,j)=[f1(t,i,j),ξ(t,i,j)] Among them, f1(t, i, j) is the enhanced preliminary feature vector; ξ(t, i, j) is the inter-market distance characteristic of the outlier point: Among them, ξ(t, i, j) measures the spatial linkage characteristics between markets; The classification target of the multi-classification model is expressed as: Where g(f(t, i, j); θ) represents the predicted output of the classification model; y t，i，j is the true category label of the outlier; l is the classification error loss; ρ is the model regularization weight.

7. The method for identifying financial data anomalies based on big data analysis according to claim 6, characterized in that: The classification results include: single market hidden anomalies, cross-market linkage anomalies, sudden anomalies and continuous anomalies.

8. The method for identifying financial data anomalies based on big data analysis according to claim 1, characterized in that: The anomaly propagation network is constructed as follows: Define anomaly propagation network G = (V, E), where node V represents the market; edge E = {(v i , v j )|W t (i, j)>τ}, the weight is given by W t (i, j) determines; node importance ρ i , which represents the influence of market i in abnormal propagation, is expressed as: Among them, |S(t, i, j)| represents the intensity of the outlier point (t, i, j); Var(Z t (i,:)) is the dynamic variance of the embedding representation of market i, reflecting its activity in anomaly propagation; ε is a hyperparameter that adjusts the dynamic impact of embedding; In the propagation network G, the propagation path and overall influence of the anomaly are quantified by the propagation path weight and the global propagation influence; the propagation path weight is expressed as: Among them, π(i→j) represents the degree to which the communication capacity of market i is distributed to market j through linkage weights, ensuring the accuracy of path analysis; The global propagation influence is expressed as: Among them, Φ is the global communication influence.

9. The method for identifying financial data anomalies based on big data analysis according to claim 8, characterized in that: The time dynamic characteristics of the analysis propagation are specifically: In terms of time dimension, define the change trend of the propagation rate of market i as η i (t), is calculated as follows: Among them, ∈ is a small value used to avoid the denominator being zero; ρ i (t) is the transmission intensity of market i at time t; ρ i (t-1) is the transmission intensity of market i at time t-1; Aggregate the changes in the propagation rate of the entire market to form a global trend, calculated as follows: Among them, η i (t) is the propagation rate, is the average value of the change in the propagation rate of all markets at time t, indicating the global trend of the change in the propagation rate; Combined propagation rate η i (t) and node propagation importance ρ i , identify the set of hot spots H, defined as markets that meet the following conditions: Among them, δ is the threshold set by the user.

10. A financial data anomaly identification system based on big data analysis, characterized in that: The system comprises: The multi-market data collection module is used to collect high-frequency trading data from multiple markets and perform synchronous preprocessing, including: Collect transaction data streams from k markets, construct a multi-market original transaction matrix, and standardize the multi-market original transaction matrix; The standardized matrix is ​​enhanced according to the price difference characteristics, the sparse items of the inter-market yield covariance and the price difference, and the enhanced transaction matrix is ​​obtained; The association network construction module is used to build a dynamic association network based on the preprocessed data and associate the linkage characteristics between multiple markets, including: Construct the preliminary correlation between market i and market i based on the enhanced transaction matrix and make corrections; Construct a cross-market dynamic correlation network based on the corrected correlation degree, and embed the cross-market dynamic correlation network into a low-dimensional space to obtain an embedding matrix, retaining only the most critical constraint items; The data anomaly identification module is used to identify normal and abnormal trading patterns based on multi-market associations, including: The enhanced transaction matrix and the embedding matrix are fused to form a comprehensive transaction feature matrix; The comprehensive transaction feature matrix is ​​decomposed into sparse low-rank behavior patterns, specifically: Assuming that the fused feature matrix X′ is decomposed into normal transaction mode and abnormal transaction mode, we have: X′=L+S Where L∈R k×(n′+d)×m represents a low-rank matrix, corresponding to the normal trading pattern, with strong regularity between time and market; S∈R k×(n′+d)×m represents a sparse matrix, corresponding to abnormal trading patterns, capturing local abnormal behaviors; k is the number of markets; n′ is the enhanced feature dimension of each market, including original features and cross-market enhanced features; d is the dynamic embedding dimension, representing the low-dimensional representation of market linkage characteristics; m is the time step, representing the time series length of transaction data; According to the identified abnormal trading pattern, the optimization objective function is designed to solve L and S: Among them, ||L|| * represents the nuclear norm, controlling the low rank of L; ||S||1 represents the sparse regularization term of S, encouraging the concentration of outliers; ||W⊙S||1 represents the weight sparse term, using the weight matrix W to strengthen the outlier detection in key markets; represents the time smoothness constraint, which encourages the continuity of anomalies in the time dimension; θ, τ, and γ represent hyperparameters, which control the weights of each regularization term respectively; Through the iterative optimization method, the optimization objective function is solved to obtain the decomposition results L and S, and then the transaction anomalies are extracted from the sparse matrix S: Define the transaction anomaly point set P: P={(t,i,j)||S(t,i,j)|>τ} Among them, τ is the threshold for extracting transaction anomaly points; each transaction anomaly point (t, i, j) includes the annotation information of time t, market i, and feature dimension j; Output sparse matrix S∈R k×(n′+d)×m , marking abnormal trading patterns; low-rank matrix L∈R k×(n′+d)×m , marking the normal transaction mode; the set of transaction abnormal points P; The data anomaly classification module is used to select abnormal transaction points and classify the abnormal transaction points, including: Construct a preliminary feature vector of the outlier point based on the sparse matrix and the set of prone outliers. Design the importance score of the outlier point based on the preliminary feature vector of the outlier point combined with the constant strength, market influence and cross-market propagation characteristics. Design an anomaly threshold, retain high-risk outliers with importance scores higher than the anomaly threshold, and construct a high-risk outlier point set P′; Construct the final feature vector of each outlier point based on the high-risk outlier point set P′, build a multi-classification model to classify the final feature vector of each outlier point, and mark the category label of each point; The data anomaly propagation module is used to build an anomaly propagation network based on the results of abnormal transaction point classification, quantify the propagation path and global influence of abnormal transaction points, and analyze the time dynamic characteristics of propagation.

Images