Audit method and system based on timing characteristic monitoring

Abstract

The application discloses an auditing method and system based on timing feature monitoring, acquires N interaction features and interaction time stamps of a target user in a to-be-audited object, carries out feature clustering based on the interaction time stamps, obtains stage clustering clusters, carries out feature splicing in the stage clustering clusters, constructs real stage vectors, determines timing numbers according to the interaction time stamps, sorts M real stage vectors according to the timing numbers, obtains a real stage sequence of the target user, compares the real stage sequence with a pre-constructed standard stage sequence, marks dislocation nodes corresponding to a plurality of anchor nodes in the standard stage sequence, calculates the offset degrees of the anchor nodes according to the dislocation nodes corresponding to the anchor nodes, and generates an auditing label of the target user in the to-be-audited object according to the offset degrees of the anchor nodes. The application effectively supports the differential generation of the auditing label by introducing a dynamic threshold and dislocation node identification.

Description

Technical Field

[0001] This invention relates to the field of business auditing, specifically to an auditing method based on time-series feature monitoring. Background Technology

[0002] In modern information systems, critical business processes such as procurement approval, permission changes, expense reimbursement, and contract management heavily rely on user interactions. These interactions typically take the form of clicks, submissions, approvals, and queries, and are recorded by the system in log form. However, traditional auditing methods mostly rely on static rules or fixed templates, making it difficult to effectively identify misalignments and anomalies in the behavioral chain. Especially when user operation paths are complex, operation intervals are uneven, and node behaviors are heterogeneous, auditing systems often face problems such as high false positive rates, unclear stage boundaries, and delayed anomaly detection. Some existing technologies attempt to perform cluster analysis based on behavioral content or operation frequency, but they ignore the dynamic distribution characteristics of interactive behaviors on the time axis and lack structural identification of stage transitions, limiting their usability in actual auditing operations. To address this, this invention provides an auditing method based on time-series feature monitoring. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides an auditing method based on time-series feature monitoring, which solves the technical problems mentioned in the background art by generating dynamic thresholds and calculating the offset of misaligned nodes.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] In a first aspect, the present invention provides an auditing method based on time-series feature monitoring, the auditing method comprising:

[0006] S1. Obtain N interaction features and interaction timestamps of the target user in the audit object;

[0007] S2. Perform feature clustering based on interaction timestamps on N interaction features to obtain M stage clusters;

[0008] S3. Concatenate the interaction features within the M stage clusters to construct the M real stage vectors of the target user in the audit object.

[0009] S4. Based on several interaction timestamps, determine the time sequence number of M real stage vectors;

[0010] S5. Sort the M real stage vectors according to the time sequence number to obtain the real stage sequence of the target user;

[0011] S6. Compare the real stage sequence with the pre-constructed standard stage sequence to mark the misaligned nodes corresponding to several anchor nodes in the standard stage sequence.

[0012] The standard stage sequence is generated by arranging the standard stage vectors corresponding to M standard interaction timestamps.

[0013] S7. Calculate the offset of several anchor nodes based on the misaligned nodes corresponding to several anchor nodes.

[0014] S8. Generate audit tags for the target user in the audit object based on the offset of several anchor nodes.

[0015] In some embodiments, N interaction features are clustered based on interaction timestamps to obtain M stage clusters, including:

[0016] S2-1. Sort the N interactive timestamps in ascending order to construct a timestamp sequence;

[0017] S2-2. For adjacent timestamps in a timestamp sequence, calculate the time interval between adjacent timestamps;

[0018] S2-3. Calculate the dynamic threshold between adjacent timestamps based on the time interval between adjacent timestamps;

[0019] S2-4. Traverse the timestamp sequence and compare the time interval between adjacent timestamps with the corresponding dynamic threshold;

[0020] S2-5. If the time interval is less than its dynamic threshold, the two interactive features corresponding to adjacent timestamps are assigned to the same stage cluster. Otherwise, the two interactive features are assigned to different stage clusters until M stage clusters are obtained.

[0021] In some embodiments, a dynamic threshold between adjacent timestamps is calculated based on the time interval between adjacent timestamps, including:

[0022] S2-3-1. Obtain N-1 time intervals between adjacent timestamps in the timestamp sequence;

[0023] S2-3-2. Arrange the N-1 time intervals in order of their original positions in the timestamp sequence to construct a time interval sequence;

[0024] S2-3-3: Use a sliding window to obtain time interval subsequences from the time interval sequence;

[0025] S2-3-4. Calculate the mean and standard deviation of all time intervals in the time interval subsequence;

[0026] S2-3-5. Calculate the dynamic threshold of the time interval subsequence based on the mean and standard deviation.

[0027] The formula for calculating the dynamic threshold is:

[0028]

[0029] Among them, Td i μ represents the i-th dynamic threshold. i Let σ represent the mean of the i-th time interval subsequence. i This represents the standard deviation of the i-th time interval subsequence. This represents the ratio of the standard deviation to the mean, and α is an adjustment coefficient used to control the degree of influence of the standard deviation on the dynamic threshold.

[0030] S2-3-6. The dynamic threshold calculated for each time interval subsequence is defined as the dynamic threshold of the adjacent timestamp to which the first time interval belongs in that time interval subsequence.

[0031] In some embodiments, the timing numbers of M real stage vectors are determined based on several interaction timestamps, including:

[0032] S4-1. Extract the timestamp sequence;

[0033] S4-2. Mark adjacent timestamps in the timestamp sequence that are not less than the dynamic threshold to obtain M pairs of adjacent timestamps;

[0034] S4-3. Delete the earlier timestamp of M pairs of adjacent timestamps, keep M later timestamps, and define them as changed timestamps;

[0035] S4-4. Assign an independent and consecutive index number to each changed timestamp, and assign the index number to the corresponding real stage vector according to the time order of the changed timestamps to obtain M time sequence numbers.

[0036] In some of these embodiments, the actual stage sequence is compared with a pre-constructed standard stage sequence to identify several misaligned nodes:

[0037] S6-1. Obtain the real stage vector and standard stage vector corresponding to the first time sequence number in the real stage sequence and the standard stage sequence, and pair them into vector pairs.

[0038] S6-2. Calculate the first similarity of the vector pairs;

[0039] S6-3. If the first similarity is greater than or equal to the similarity threshold, then jump to the vector pair corresponding to the next time sequence number to repeatedly calculate the first similarity of the vector pair;

[0040] S6-4. If the first similarity is less than the similarity threshold, then the standard stage vector in the vector pair is defined as the anchor node.

[0041] S6-5. Calculate the second similarity between the standard stage vector and the other true stage vectors in the anchor node;

[0042] S6-6. If there exists a true stage vector with a second similarity greater than or equal to the similarity threshold, then mark the true stage vector as the misaligned node corresponding to the anchor node.

[0043] S6-7. Traverse the M vector pairs in the real stage sequence and the standard stage sequence until all misaligned nodes are marked.

[0044] In some embodiments, the offset of several anchor nodes is calculated based on the misaligned nodes corresponding to several anchor nodes, including:

[0045] S7-1. Obtain the actual interaction timestamp of the misaligned node and the standard interaction timestamp of the anchor node;

[0046] S7-2, Calculate the offset duration between the actual interaction timestamp and the standard interaction timestamp;

[0047] S7-3. Calculate the offset of the anchor node based on the offset duration and the second similarity.

[0048] The formula for calculating the offset is:

[0049]

[0050] Where OD represents the offset, ΔT represents the offset duration, CS represents the second similarity, α is the adjustment coefficient used to control the decay rate of the second similarity, and e is the base of the natural logarithm.

[0051] In some embodiments, obtaining the actual interaction timestamps of misaligned nodes includes:

[0052] S7-1-1. Based on the true stage vector corresponding to the misaligned node, mark the stage cluster corresponding to the misaligned node;

[0053] S7-1-2. Obtain several interaction timestamps in the cluster order of this stage;

[0054] S7-1-3. Select the median timestamp from the plurality of interaction timestamps and define it as the true interaction timestamp of the misaligned node.

[0055] Compared with existing technologies, the auditing method based on time-series feature monitoring in this invention introduces dynamic thresholds to perform local statistical analysis (mean and standard deviation) on the interaction timestamp sequence. It adaptively calculates the dynamic threshold between each pair of adjacent timestamps, thus avoiding the reliance on fixed empirical parameters in traditional stage identification. This allows it to capture structural abrupt changes in interaction behavior along the timeline and delineate stage boundaries. Furthermore, it identifies misaligned nodes by comparing the similarity between standard stage sequences and real behavior sequences, and further constructs a deviation degree that combines behavioral similarity and temporal offset. This deviation degree not only reflects whether the behavior is misaligned but also measures the comprehensive impact of the degree of misalignment at the temporal and semantic levels, effectively supporting the differentiated generation of audit labels.

[0056] Secondly, the present invention provides an auditing system based on time-series feature monitoring, comprising:

[0057] The interaction acquisition unit is used to acquire N interaction features and interaction timestamps of the target user in the audit object;

[0058] A stage clustering unit is used to perform feature clustering based on interaction timestamps for N interaction features, resulting in M ​​stage clusters.

[0059] The vector construction unit is used to concatenate the interaction features within M stage clusters to construct M real stage vectors of the target user in the audit object.

[0060] The timing numbering unit is used to determine the timing number of M real stage vectors based on several interaction timestamps;

[0061] The sequence sorting unit is used to sort the M real stage vectors according to the time sequence number to obtain the real stage sequence of the target user.

[0062] The sequence alignment unit is used to align the real stage sequence with the pre-constructed standard stage sequence to mark the misaligned nodes corresponding to several anchor nodes in the standard stage sequence.

[0063] Offset calculation unit is used to calculate the offset of several anchor nodes based on the misaligned nodes corresponding to several anchor nodes.

[0064] The audit tag generation unit is used to generate audit tags for the target user in the audit object based on the offset of several anchor nodes.

[0065] Compared with the prior art, the beneficial effects of the auditing method based on time-series feature monitoring of the present invention are the same as those of the auditing method based on time-series feature monitoring described above, so they will not be repeated here. Attached Figure Description

[0066] Figure 1This is a schematic diagram of the audit process for the audit method based on time-series feature monitoring according to the present invention;

[0067] Figure 2 This is a schematic diagram illustrating the process of obtaining the staged clusters described in this invention;

[0068] Figure 3 This is a schematic diagram of the error node marking process described in this invention;

[0069] Figure 4 This is a structural block diagram of the auditing system based on time-series feature monitoring according to the present invention. Detailed Implementation

[0070] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0071] Please see Figures 1 to 3 This invention provides an auditing method based on time-series feature monitoring, comprising the following steps:

[0072] S1. Obtain N interaction features and interaction timestamps of the target user in the audit object;

[0073] It should be noted that the audit target is the business process or transactional node designated for audit, such as: procurement approval process, permission change application process, expense reimbursement system, contract management system, etc. Interaction features represent the structured vectors extracted from each interaction behavior (such as click, submit, query, approval, etc.) of the target user within the audit target.

[0074] Specifically, interactive behaviors can generally be divided into several categories, such as query behaviors (including field input, filter condition setting, etc.), approval behaviors (including approval result selection, opinion input, etc.), submission behaviors (such as clicking the submit button), modification behaviors (such as editing form data), and withdrawal behaviors.

[0075] Therefore, in actual implementation, interaction features are acquired by collecting raw parameters of each interaction behavior of the target user through methods such as system logging. These raw parameters include, but are not limited to, operation type, object field, and click location. After collecting the raw parameters, they undergo unified feature processing to eliminate the influence of inconsistent dimensions, different units, and excessive differences in values. For example, one-hot encoding is used for text or categorical fields, and standardization or normalization is performed on numerical fields.

[0076] Furthermore, each interaction feature is bound to an interaction timestamp, which is the specific timestamp at which the interaction occurred in the object to be audited.

[0077] S2. Perform feature clustering based on interaction timestamps on N interaction features to obtain M stage clusters;

[0078] It should be noted that stage clustering refers to the phenomenon where user interactions within the business process corresponding to the audited object typically exhibit distinct stage-based characteristics. Each business stage often shows a concentrated temporal distribution, meaning that users complete several interactive behaviors within a short timeframe before moving to the next stage, creating temporal gaps between these behaviors. Therefore, based on the temporal distribution characteristics of interactive behaviors, behaviors that are relatively concentrated in time and may correspond to the same interactive step in the actual business process can be grouped into a stage cluster.

[0079] Each stage cluster reflects the stage of the business process that the target user is in within a specific time period, such as the information entry stage, the approval processing stage, and the review and confirmation stage.

[0080] S3. Concatenate the interaction features within the M stage clusters to construct the M real stage vectors of the target user in the audit object.

[0081] It should be noted that feature concatenation refers to merging several interaction features within each stage's cluster into a comprehensive vector in a specific order, thereby representing the overall interaction features of that stage. The concatenated vector will contain key information about all interaction behaviors within that stage (such as operation type, operation object, operation parameters, etc.).

[0082] S4. Based on several interaction timestamps, determine the time sequence number of M real stage vectors;

[0083] S5. Sort the M real stage vectors according to the time sequence number to obtain the real stage sequence of the target user;

[0084] S6. Compare the real stage sequence with the pre-constructed standard stage sequence to mark the misaligned nodes corresponding to several anchor nodes in the standard stage sequence.

[0085] The standard stage sequence is generated by arranging the standard stage vectors corresponding to M standard interaction timestamps.

[0086] In this embodiment, the standard stage sequence refers to a predefined order of user behavior execution based on the normal interaction flow of the business process. This sequence contains M standard stage vectors, each representing several standard interactive behaviors. Furthermore, each standard stage is pre-set with a matching standard interaction timestamp. The standard stage sequence is typically obtained from multiple historical interaction data or business rule presets, and can represent a standardized operation path.

[0087] S7. Calculate the offset of several anchor nodes based on the misaligned nodes corresponding to several anchor nodes.

[0088] S8. Generate audit tags for the target user in the audit object based on the offset of several anchor nodes.

[0089] Specifically, the misaligned nodes represent real stage vectors that differ significantly from the standard stage sequence in terms of interaction behavior or timing numbering. Node offset is used to measure the severity of the difference; by calculating the behavioral similarity and temporal offset of each node, its impact on the overall process is comprehensively evaluated.

[0090] In this embodiment, audit tags for the target user are generated based on the misaligned nodes and their offsets, combined with predefined audit mapping rules. The mapping rules may include, but are not limited to, the following categories:

[0091] Severe stage anomaly: If the offset of any misaligned node exceeds a preset threshold (e.g., 0.85), it is mapped as "severe node anomaly".

[0092] Path error: If multiple consecutive stages (such as login, approval, submission) have incorrect locations or inconsistent behaviors, it is mapped as "path error";

[0093] High-risk missing anomaly: If a standard behavior node is missing in the actual stage sequence, it is mapped as a "high-risk missing anomaly";

[0094] High-risk process: If the total offset exceeds a set threshold (e.g., the sum of the offsets of multiple nodes exceeds a certain set value), the operation process is identified as a "high-risk process".

[0095] For example, in this embodiment, step S2 specifically includes:

[0096] S2-1. Sort the N interactive timestamps in ascending order to construct a timestamp sequence;

[0097] S2-2. For adjacent timestamps in a timestamp sequence, calculate the time interval between adjacent timestamps;

[0098] S2-3. Calculate the dynamic threshold between adjacent timestamps based on the time interval between adjacent timestamps;

[0099] S2-4. Traverse the timestamp sequence and compare the time interval between adjacent timestamps with the corresponding dynamic threshold;

[0100] S2-5. If the time interval is less than its dynamic threshold, the two interactive features corresponding to adjacent timestamps are assigned to the same stage cluster. Otherwise, the two interactive features are assigned to different stage clusters until M stage clusters are obtained.

[0101] By introducing a time interval judgment based on a dynamic threshold, adaptive clustering of interaction features in time sequence is achieved, effectively improving the accuracy of stage division. Compared with traditional clustering methods based on fixed time windows or fixed thresholds, this method dynamically adjusts the judgment criteria according to the local statistics of interaction behavior on the time axis, which can accurately identify the concentrated areas and time discontinuities of interaction behavior, thus better reflecting the stage distribution characteristics of user interaction behavior in real business processes.

[0102] Furthermore, steps S2-3 specifically include:

[0103] S2-3-1. Obtain N-1 time intervals between adjacent timestamps in the timestamp sequence;

[0104] S2-3-2. Arrange the N-1 time intervals in order of their original positions in the timestamp sequence to construct a time interval sequence;

[0105] It should be noted that the original order refers to the natural chronological order of the interactive timestamps on the timeline after they are sorted in ascending order. That is, the i-th time interval is calculated from the i-th timestamp and the (i+1)-th timestamp thereafter, and so on, with the last time interval corresponding to the (N-1)-th timestamp.

[0106] S2-3-3: Use a sliding window to obtain time interval subsequences from the time interval sequence;

[0107] The sliding window has a length w and a step size of 1. It should be noted that the length of the sliding window is set based on the total number of standard behaviors in the audited object. That is, for the N interaction features of the target user, they should, in principle, be included within the interaction range defined by the standard stage sequence. Therefore, the length of the sliding window can be set according to the proportional relationship between the number of standard behaviors and the interaction features of the target user to ensure the comparability of local statistics.

[0108] S2-3-4. Calculate the mean and standard deviation of all time intervals in the time interval subsequence;

[0109] S2-3-5. Calculate the dynamic threshold of the time interval subsequence based on the mean and standard deviation.

[0110] The formula for calculating the dynamic threshold is:

[0111]

[0112] Among them, Td i μ represents the i-th dynamic threshold. i Let σ represent the mean of the i-th time interval subsequence. i This represents the standard deviation of the i-th time interval subsequence. This represents the ratio of the standard deviation to the mean. α is an adjustment coefficient used to control the degree of influence of the standard deviation on the dynamic threshold, and is usually set to 1 or 2.

[0113] Specifically, when adjacent timestamps belong to the same behavioral stage, and the interaction between adjacent timestamps is usually completed within the same time window, the time intervals are relatively short and the fluctuations are small. Consequently, the mean and standard deviation of the time interval subsequence are quite close, the influence of the standard deviation is small, and the ratio of the standard deviation to the mean is close to 1. Conversely, when adjacent timestamps belong to different behavioral stages, the ratio of the standard deviation to the mean is much greater than 1.

[0114] In other words, if the ratio is close to 1, it indicates that the time interval fluctuates little, and the interaction timestamps are likely within the same stage. In this case, the calculated dynamic threshold is small, and the threshold will not be too high, making it suitable for judging interactions within the same behavioral stage. If the ratio is much greater than 1, it indicates that the time interval fluctuates greatly, possibly due to a switch in behavioral stages. In this case, the dynamic threshold will be amplified, making it suitable for identifying time gaps between stages.

[0115] S2-3-6. The dynamic threshold calculated for each time interval subsequence is defined as the dynamic threshold of the adjacent timestamp to which the first time interval belongs in that time interval subsequence.

[0116] In other words, the dynamic threshold of each time interval subsequence reflects the combination of the mean and standard deviation of the time intervals within that window, becoming the standard for judging the clustering of behavioral stages. Specifically, the dynamic threshold of the i-th subsequence applies to the i-th time interval, that is, the time interval between the i-th timestamp and the (i+1)-th timestamp.

[0117] This embodiment achieves local statistics on interactive behavior by introducing a sliding window into the time interval sequence and dynamically calculating a threshold based on the mean and standard deviation of the subsequences. Instead of relying on fixed empirical thresholds, this embodiment identifies structural differences in time intervals through changes in the ratio between the mean and standard deviation: when interactive behaviors occur concentrated in short time intervals, the mean and standard deviation tend to be consistent, and the dynamic threshold is small, used to determine the same stage; while when the time interval fluctuates drastically due to the switching of behavioral stages, the ratio increases significantly, and the dynamic threshold rises accordingly, thus accurately defining stage boundaries. This method achieves adaptive determination based on local statistical features, improving the accuracy of cross-stage identification.

[0118] For example, in this embodiment, step S4 specifically includes:

[0119] S4-1. Extract the timestamp sequence;

[0120] S4-2. Mark adjacent timestamps in the timestamp sequence that are not less than the dynamic threshold to obtain M pairs of adjacent timestamps;

[0121] S4-3. Delete the earlier timestamp of M pairs of adjacent timestamps, keep M later timestamps, and define them as changed timestamps;

[0122] S4-4. Assign an independent and consecutive index number to each changed timestamp, and assign the index number to the corresponding real stage vector according to the time order of the changed timestamps to obtain M time sequence numbers.

[0123] This embodiment identifies adjacent timestamps in a timestamp sequence whose interval is not less than a dynamic threshold, extracts key change timestamps, and constructs a continuous time series number based on this. This numbering method based on abrupt changes in time intervals can accurately reflect the actual switching points between stages, avoiding missegmentation caused by dense or repetitive interaction behaviors.

[0124] For example, in this embodiment, step S6 specifically includes:

[0125] S6-1. Obtain the real stage vector and standard stage vector corresponding to the first time sequence number in the real stage sequence and the standard stage sequence, and pair them into vector pairs.

[0126] S6-2. Calculate the first similarity of the vector pairs;

[0127] For example, similarity can be achieved using cosine similarity. Cosine similarity focuses primarily on the directionality (i.e., the order and importance of operations) between interactions, rather than specific numerical values. Since the time intervals between different stages can be significant, cosine similarity effectively ignores numerical differences and focuses on the similar patterns between interactions.

[0128] S6-3. If the first similarity is greater than or equal to the similarity threshold, then jump to the vector pair corresponding to the next time sequence number to repeatedly calculate the first similarity of the vector pair;

[0129] S6-4. If the first similarity is less than the similarity threshold, then the standard stage vector in the vector pair is defined as the anchor node.

[0130] S6-5. Calculate the second similarity between the standard stage vector and the other true stage vectors in the anchor node;

[0131] S6-6. If there exists a true stage vector with a second similarity greater than or equal to the similarity threshold, then mark the true stage vector as the misaligned node corresponding to the anchor node.

[0132] S6-7. Traverse the M vector pairs in the real stage sequence and the standard stage sequence until all misaligned nodes are marked.

[0133] This embodiment uses a dual judgment of first and second similarity. First, it compares the stage vectors of interactive behaviors one by one in the standard and real stage sequences, using cosine similarity to identify sequential matching relationships. Then, in the case of anchoring failure, it searches backward for real stages with higher similarity and marks them as misaligned nodes. By considering not only the similarity of behavior vectors but also their expected positions in the sequence, it can accurately identify temporal anomalies of behavior misalignment, improving the auditing method's ability to capture process deviations.

[0134] For example, in this embodiment, step S7 specifically includes:

[0135] S7-1. Obtain the actual interaction timestamp of the misaligned node and the standard interaction timestamp of the anchor node;

[0136] S7-2, Calculate the offset duration between the actual interaction timestamp and the standard interaction timestamp;

[0137] S7-3. Calculate the offset of the anchor node based on the offset duration and the second similarity.

[0138] The formula for calculating the offset is:

[0139]

[0140] Where OD represents offset, ΔT represents offset duration, CS represents second similarity, which reflects the similarity between the real stage vector and the standard stage vector. The larger the value, the higher the similarity. α is an adjustment coefficient used to control the decay rate of the second similarity, which is usually set to a positive number (e.g., 1 or 2). e is the base of the natural logarithm.

[0141] Specifically, as the offset duration increases, the offset degree increases, while the higher the second similarity, the lower the offset degree. That is, when the two stages are very similar, the offset has a small impact on the audit results. However, as the offset duration increases, the impact of the second similarity on the offset degree should gradually weaken. This means that the longer the offset duration, the smaller the impact of the second similarity on the offset degree. As the offset duration increases, the decay effect of the second similarity increases, and the role of the second similarity becomes smaller and smaller.

[0142] Further, step S7-1 specifically includes:

[0143] S7-1-1. Based on the true stage vector corresponding to the misaligned node, mark the stage cluster corresponding to the misaligned node;

[0144] S7-1-2. Obtain several interaction timestamps in the cluster order of this stage;

[0145] S7-1-3. Select the median timestamp from the plurality of interaction timestamps and define it as the true interaction timestamp of the misaligned node.

[0146] This embodiment extracts all interaction timestamps within the stage cluster corresponding to the misaligned node and selects the median as the true interaction timestamp of the misaligned node, thereby avoiding the offset distortion caused by extreme early or late behaviors. Compared with the strategy of using the earliest or latest time point, the median timestamp is more robust and can more accurately represent the temporal concentration trend of stage behaviors.

[0147] In summary, this invention provides an auditing method based on time-series feature monitoring. It constructs a complete auditing path covering behavior collection, dynamic clustering, stage modeling, misalignment identification, and offset calculation, centered around the process of "interaction behavior—stage clustering—behavior vector—time-series deviation." This method uses dynamic thresholds as its core mechanism to accurately segment behavior stages; it identifies interaction misalignment nodes through a dual-factor determination of vector similarity and time offset; and it generates multi-level audit labels based on offset and audit mapping rules. This method does not rely on fixed rules or human experience, possesses high process adaptability and anomaly detection capabilities, and is particularly suitable for transactional system scenarios with multiple nodes, multiple behaviors, and multiple time periods, such as approval workflows, contract workflows, and expense workflows. It achieves structured identification and auditing of abnormal behaviors in the user operation chain, significantly improving the level of business process auditing.

[0148] This invention also provides an auditing system based on time-series feature monitoring, which is used to implement the above-described method embodiments; details already described will not be repeated. The terms "module," "unit," and "subunit," etc., used below refer to combinations of software and / or hardware that perform a predetermined function. Although the system described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0149] like Figure 4 As shown, Figure 4 This is a structural block diagram of the auditing system based on time-series feature monitoring according to the present invention. The system includes:

[0150] The interaction acquisition unit is used to acquire N interaction features and interaction timestamps of the target user in the audit object;

[0151] A stage clustering unit is used to perform feature clustering based on interaction timestamps for N interaction features, resulting in M ​​stage clusters.

[0152] The vector construction unit is used to concatenate the interaction features within M stage clusters to construct M real stage vectors of the target user in the audit object.

[0153] The timing numbering unit is used to determine the timing number of M real stage vectors based on several interaction timestamps;

[0154] The sequence sorting unit is used to sort the M real stage vectors according to the time sequence number to obtain the real stage sequence of the target user.

[0155] The sequence alignment unit is used to align the real stage sequence with the pre-constructed standard stage sequence to mark the misaligned nodes corresponding to several anchor nodes in the standard stage sequence.

[0156] Offset calculation unit is used to calculate the offset of several anchor nodes based on the misaligned nodes corresponding to several anchor nodes.

[0157] The audit tag generation unit is used to generate audit tags for the target user in the audit object based on the offset of several anchor nodes.

[0158] In the above system, the interaction features and timestamps were acquired through the interaction acquisition unit; M stage clusters were obtained through the stage clustering unit; M real stage vectors were constructed through the vector construction unit; the time sequence number was determined through the time sequence numbering unit; the real stage sequence of the target user was obtained through the sequence sorting unit; erroneous nodes were marked through the sequence comparison unit; the offset calculation degree of the anchor node was calculated through the offset calculation unit; and the audit tag generation unit generated audit tags for the auditable object. This solves the problem of inaccurate generation of audit tags in actual audit business.

[0159] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means.

[0160] The computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives (SSDs).

[0161] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Furthermore, the mutual couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0162] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. An auditing method based on time-series feature monitoring, characterized in that, include: Obtain N interaction characteristics and interaction timestamps of the target user in the audit object; Perform feature clustering based on interaction timestamps on N interaction features to obtain M stage clusters; The interaction features within the M stage clusters are concatenated to construct the M real stage vectors of the target user in the audit object. Based on several interaction timestamps, determine the time sequence number of M real stage vectors; The M real stage vectors are sorted according to their time sequence numbers to obtain the real stage sequence of the target user. The actual stage sequence is compared with the pre-constructed standard stage sequence to mark the misaligned nodes corresponding to several anchor nodes in the standard stage sequence. The standard stage sequence is generated by arranging the standard stage vectors corresponding to M standard interaction timestamps. Calculate the offset of several anchor nodes based on the misaligned nodes corresponding to several anchor nodes; Based on the offset of several anchor nodes, generate audit tags for the target user in the audit object; The feature clustering based on interaction timestamps of N interaction features yields M stage clusters, including: Arrange the N interaction timestamps in ascending order to construct a timestamp sequence; For adjacent timestamps in a timestamp sequence, calculate the time interval between adjacent timestamps; Calculate the dynamic threshold between adjacent timestamps based on the time interval between them; Traverse the timestamp sequence and compare the time interval between adjacent timestamps with the corresponding dynamic threshold; If the time interval is less than its dynamic threshold, the two interaction features corresponding to adjacent timestamps are assigned to the same stage cluster; otherwise, the two interaction features are assigned to different stage clusters until M stage clusters are obtained. The step of calculating the dynamic threshold between adjacent timestamps based on the time interval between adjacent timestamps includes: Obtain N-1 time intervals between adjacent timestamps in a timestamp sequence; Arrange the N-1 time intervals in order of their original positions in the timestamp sequence to construct a time interval sequence; Use a sliding window to obtain time interval subsequences from the time interval sequence; Calculate the mean and standard deviation of all time intervals in the time interval subsequence; Calculate the dynamic threshold of the time interval subsequence based on the mean and standard deviation; The formula for calculating the dynamic threshold is: ； in, This represents the i-th dynamic threshold. Let represent the mean of the subsequence at the i-th time interval. This represents the standard deviation of the i-th time interval subsequence. This represents the ratio of the standard deviation to the mean. This is an adjustment coefficient used to control the degree of influence of the standard deviation on the dynamic threshold. The dynamic threshold calculated for each time interval subsequence is defined as the dynamic threshold of the adjacent timestamp to which the first time interval in that time interval subsequence belongs.

2. The auditing method based on time-series feature monitoring according to claim 1, characterized in that, Based on several interaction timestamps, determine the time sequence numbers of M real stage vectors, including: S4-1. Extract the timestamp sequence; S4-2. Mark adjacent timestamps in the timestamp sequence that are not less than the dynamic threshold to obtain M pairs of adjacent timestamps; S4-3. Delete the earlier timestamp of M pairs of adjacent timestamps, keep M later timestamps, and define them as changed timestamps; S4-4. Assign an independent and consecutive index number to each changed timestamp, and assign the index number to the corresponding real stage vector according to the time order of the changed timestamps to obtain M time sequence numbers.

3. The auditing method based on time-series feature monitoring according to claim 2, characterized in that, The actual stage sequence is compared with the pre-constructed standard stage sequence to identify several misaligned nodes: S6-1. Obtain the real stage vector and standard stage vector corresponding to the first time sequence number in the real stage sequence and the standard stage sequence, and pair them into vector pairs. S6-2. Calculate the first similarity of the vector pairs; S6-3. If the first similarity is greater than or equal to the similarity threshold, then jump to the vector pair corresponding to the next time sequence number to repeatedly calculate the first similarity of the vector pair; S6-4. If the first similarity is less than the similarity threshold, then the standard stage vector in the vector pair is defined as the anchor node. S6-5. Calculate the second similarity between the standard stage vector and the other true stage vectors in the anchor node; S6-6. If there exists a true stage vector with a second similarity greater than or equal to the similarity threshold, then mark the true stage vector as the misaligned node corresponding to the anchor node. S6-7. Traverse the M vector pairs in the real stage sequence and the standard stage sequence until all misaligned nodes are marked.

4. The auditing method based on time-series feature monitoring according to claim 3, characterized in that, Based on the misaligned nodes corresponding to several anchor nodes, calculate the offset of several anchor nodes, including: S7-1. Obtain the actual interaction timestamp of the misaligned node and the standard interaction timestamp of the anchor node; S7-2, Calculate the offset duration between the actual interaction timestamp and the standard interaction timestamp; S7-3. Calculate the offset of the anchor node based on the offset duration and the second similarity. The formula for calculating the offset is: ； in, Indicates the offset. Indicates the offset duration. Indicates the second similarity. This is an adjustment coefficient used to control the decay rate of the second similarity. It is the base of the natural logarithm.

5. The auditing method based on time-series feature monitoring according to claim 4, characterized in that, Obtain the actual interaction timestamps of the misaligned nodes, including: S7-1-1. Based on the true stage vector corresponding to the misaligned node, mark the stage cluster corresponding to the misaligned node; S7-1-2. Obtain several interaction timestamps in the clusters of this stage; S7-1-3. Select the median timestamp from the plurality of interaction timestamps and define it as the true interaction timestamp of the misaligned node.

6. An auditing system based on time-series feature monitoring, characterized in that, include: The interaction acquisition unit is used to acquire N interaction features and interaction timestamps of the target user in the audit object; A stage clustering unit is used to perform feature clustering based on interaction timestamps for N interaction features, resulting in M ​​stage clusters. The vector construction unit is used to concatenate the interaction features within M stage clusters to construct M real stage vectors of the target user in the audit object. The timing numbering unit is used to determine the timing number of M real stage vectors based on several interaction timestamps; The sequence sorting unit is used to sort the M real stage vectors according to the time sequence number to obtain the real stage sequence of the target user. The sequence alignment unit is used to align the real stage sequence with the pre-constructed standard stage sequence to mark the misaligned nodes corresponding to several anchor nodes in the standard stage sequence. Offset calculation unit is used to calculate the offset of several anchor nodes based on the misaligned nodes corresponding to several anchor nodes. The audit tag generation unit is used to generate audit tags for the target user in the audit object based on the offset of several anchor nodes. Based on interaction timestamps, feature clustering is performed on N interaction features to obtain M stage clusters, including: Arrange the N interaction timestamps in ascending order to construct a timestamp sequence; For adjacent timestamps in a timestamp sequence, calculate the time interval between adjacent timestamps; Calculate the dynamic threshold between adjacent timestamps based on the time interval between them; Traverse the timestamp sequence and compare the time interval between adjacent timestamps with the corresponding dynamic threshold; If the time interval is less than its dynamic threshold, the two interaction features corresponding to adjacent timestamps are assigned to the same stage cluster; otherwise, the two interaction features are assigned to different stage clusters until M stage clusters are obtained. The step of calculating the dynamic threshold between adjacent timestamps based on the time interval between adjacent timestamps includes: Obtain N-1 time intervals between adjacent timestamps in a timestamp sequence; Arrange the N-1 time intervals in order of their original positions in the timestamp sequence to construct a time interval sequence; Use a sliding window to obtain time interval subsequences from the time interval sequence; Calculate the mean and standard deviation of all time intervals in the time interval subsequence; Calculate the dynamic threshold of the time interval subsequence based on the mean and standard deviation; The formula for calculating the dynamic threshold is: ； in, This represents the i-th dynamic threshold. Let represent the mean of the subsequence at the i-th time interval. This represents the standard deviation of the i-th time interval subsequence. This represents the ratio of the standard deviation to the mean. This is an adjustment coefficient used to control the degree of influence of the standard deviation on the dynamic threshold. The dynamic threshold calculated for each time interval subsequence is defined as the dynamic threshold of the adjacent timestamp to which the first time interval in that time interval subsequence belongs.

Images