A method and device for identifying irregular invoicing of an invoicing user

Abstract

The application discloses a kind of methods and equipment for identifying irregular billing for billing user, belong to data processing field, solve the problem of unbalanced irregular sample, method includes: extracting the billing characteristic value of each billing user;Billing features include billing behavior characteristics, transaction mode characteristics, amount distribution characteristics;According to billing characteristic value, different billing users are clustered, to obtain multiple user clusters;User cluster is divided into high-risk area or noise area;Anchor point sampling is carried out on the user cluster of billing user risk sample noise area, to obtain sampling user set, to obtain billing user risk sample set;Constrained sample generation is carried out on billing user risk sample billing user risk sample set, to obtain synthetic billing user;According to the billing characteristic value of synthetic billing user and the billing characteristic value of billing user risk sample, the initial irregular identification model is trained, to obtain irregular identification model;According to irregular identification model, determine whether the billing user to be identified is irregular billing.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and device for identifying irregular invoicing by invoicing users. Background Technology

[0002] In recent years, with the popularization of electronic invoices and the deepening of enterprise digital transformation, a variety of illegal invoicing behaviors, such as illegal invoicing and tax evasion, have been hidden in the massive amount of invoicing data.

[0003] In real-world scenarios, compliant invoicing users constitute the vast majority, while non-compliant users are only a minority. This extreme imbalance in sample data makes the trained violation detection model prone to bias towards the majority class (compliant users), leading to a higher false negative rate for the minority class (non-compliant users). Although techniques such as undersampling and oversampling have been used to mitigate this problem.

[0004] For example, undersampling techniques, in pursuit of balanced data distribution, crudely remove a large number of boundary-compliant samples, causing the violation detection model to lose its ability to capture the gradual evolution of violations. For instance, when transitional invoices carrying critical fluctuation signals are removed, the system's ability to detect covert behaviors such as invoice splitting and reselling deteriorates drastically. Oversampling techniques, on the other hand, fall into a state of discrepancy between geometric rules and business logic. Phantom samples generated by linear interpolation often exhibit contradictory feature combinations, violating both the fundamental principle that invoice splitting and reselling requires multi-entity collaboration and distorting the reasonable form of decision boundaries. This double deviation causes the true violation patterns to be annihilated by synthetic noise, forming a detection blind spot that appears compliant but is actually highly dangerous. That is, linear path interpolation generates a large number of abnormal samples that deviate from the true distribution. These synthetic points often exhibit contradictory feature combinations, and when such samples intrude into overlapping category regions, the true nonlinear patterns are completely drowned out by noise.

[0005] Furthermore, the existing technological framework is constrained by the break in feature correlation, resulting in discrete events and continuous variables being analyzed separately for a long time. For example, key behavioral clues such as concentrated invoicing periods cannot be deconstructed in tandem with changes in transaction amounts, making it difficult to quantify the discrepancy between nominal compliance and substantive violations. This typically manifests as follows: when invoice amounts fluctuate frequently near regulatory thresholds, the system cannot penetrate the surface figures to capture the coordinated illegal intentions of related companies. Or, when special expenditures such as funds suddenly increase, the lack of spatiotemporal correlation analysis with historical expenditure patterns leads to abnormal misappropriation being incorrectly attributed to reasonable fluctuations.

[0006] Therefore, traditional methods often disrupt the original distribution of sample data or introduce irrelevant noise, which may actually reduce the discrimination performance of violation detection models. Summary of the Invention

[0007] To address the aforementioned issues, this application proposes a method for identifying irregular invoicing by invoicing users, including:

[0008] Extract the invoicing feature values ​​of each invoicing user from the invoice data of each invoicing user; the invoicing features include invoicing behavior features, transaction pattern features, and amount distribution features;

[0009] Clustering different invoicing users based on invoicing feature values ​​yields multiple user clusters;

[0010] Based on the invoicing characteristics of each invoicing user within each user cluster, user clusters are divided into high-risk areas or noise areas; the risk of violations for user clusters in high-risk areas is higher than that in noise areas.

[0011] Anchor point sampling is performed on the user clusters in the noise region to obtain a sampled user set;

[0012] Based on the sampled user set and the user set in the high-risk area, a risk sample set of invoicing users is obtained;

[0013] Constraint sample generation is performed on the aforementioned risk sample set of invoice issuers to obtain synthetic invoice issuers;

[0014] Based on the invoicing feature values ​​of the synthetic invoicing user and the invoicing feature values ​​of the risk sample of the invoicing user, the initial violation identification model is trained to obtain the violation identification model;

[0015] The violation identification model is used to identify violations by analyzing the invoicing feature values ​​of the user to be identified, in order to determine whether the user to be identified has violated regulations by issuing invoices.

[0016] In one example, the step of clustering different invoicing users based on invoicing feature values ​​to obtain multiple user clusters specifically includes:

[0017] Map the number of invoice-issuing users to obtain the number of clusters;

[0018] Based on the invoice feature value and the number of clusters, K-means clustering is performed on different invoice users to obtain multiple user clusters.

[0019] In one example, the process of dividing user clusters into high-risk or noisy areas based on the invoicing characteristic values ​​of each invoicing user within each user cluster specifically includes:

[0020] Identify the target invoicing users with abnormal invoicing characteristic values ​​within each user cluster;

[0021] Calculate the ratio of the total number of target invoicing users within each user cluster to the total number of invoicing users within that user cluster;

[0022] Users whose proportion is greater than or equal to a preset threshold are classified into high-risk areas, and users whose proportion is less than the preset threshold are classified into noise areas.

[0023] In one example, before performing anchor sampling on the user cluster in the noise region to obtain the sampled user set, the method further includes:

[0024] The number of sub-clusters for each user cluster in the high-risk area is determined based on the number of invoicing users in each user cluster.

[0025] Based on the invoice feature value and the number of clusters, K-means clustering is performed on each user cluster in the high-risk area to obtain user subclusters;

[0026] Determine whether there are any users in the user subcluster who have abnormal invoicing characteristic values;

[0027] If not, the user subcluster will be removed from the high-risk area.

[0028] In one example, determining the number of clusters for each user cluster within the high-risk area based on the number of invoiced users in each user cluster specifically includes:

[0029] Find the square root of the number of invoiced users in each user cluster within the high-risk area;

[0030] The integer part of the square root is compared with the preset number of sub-clusters, and the larger of the two values ​​is determined as the number of clustered sub-clusters for each user cluster in the high-risk area.

[0031] In one example, the step of anchor sampling of the user cluster in the noise region to obtain a sampled user set specifically includes:

[0032] Calculate the product between the number of users issuing invoices in the noise zone and the preset sampling ratio to obtain the number of users to be sampled;

[0033] The number of users to be sampled is compared with the preset number of samples. Based on the larger of the two values, random sampling is performed on the noise area to obtain the sampled user set.

[0034] In one example, the process of generating constrained samples from the risk sample set of invoicing users to obtain synthetic invoicing users specifically includes:

[0035] Based on the standardized Euclidean distance and the invoice feature value, a preset number of nearest neighbors are searched for each invoice user risk sample in the invoice user risk sample set.

[0036] Linear interpolation is performed between each invoicing user risk sample and its nearest neighbor to obtain the composite invoicing user and the invoicing feature value of the composite invoicing user.

[0037] In one example, the step of identifying violations based on the invoicing feature values ​​of the user to be identified using the violation identification model specifically includes:

[0038] Input the invoicing feature value corresponding to the invoicing user to be identified into multiple violation identification models;

[0039] The results of multiple violation identification models are weighted and summed to obtain the violation results of the invoicing user to be identified.

[0040] In one example, the invoicing behavior characteristics include at least one of the following: the month-on-month growth rate of invoice amount over 7 days, the standard deviation of invoice frequency over 15 days, the proportion of invoices close to the limit, and the sensitive amount splitting indicator;

[0041] Transaction pattern characteristics include at least one of the following: the proportion of invoices issued outside of working hours, and the number of invoices issued intensively within minutes;

[0042] The distribution characteristics of the amount include at least one of the following: the proportion of fixed amount invoices, and whether the amounts of consecutive invoices form an arithmetic or geometric sequence.

[0043] On the other hand, embodiments of this application provide a device for identifying irregular invoicing by an invoicing user, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform any of the aforementioned methods for identifying irregular invoicing by an invoicing user.

[0044] The above-described technical solutions adopted in the embodiments of this application can achieve the following beneficial effects:

[0045] By extracting features from three dimensions—invoicing behavior (when to issue invoices), transaction patterns (how to issue invoices), and amount distribution (how many invoices are issued)—a three-dimensional user profile can be constructed. Discrete events and continuous variables are no longer analyzed in isolation, allowing hidden violations to be discovered and potential risks to be identified.

[0046] The system can automatically filter out risk groups (clusters) with similar behavioral patterns through clustering, achieving efficient isolation of high-risk invoicing users and condensing potential violation samples.

[0047] Anchor point sampling is performed on low-risk invoice issuers in the noise region. By using a de-adaptive pure random mechanism, the implementation complexity is significantly reduced while ensuring the basic integrity of the topology, and the invoice issuer samples in the key transition state are preserved.

[0048] First, a coarse screening is performed through clustering and high- and low-risk partitioning, and then a large number of new, synthetic samples of violating users are generated, thus providing more and more diverse risk samples for the violation identification model.

[0049] In summary, by creating a multi-dimensional composite feature architecture and integrating invoicing behavior features, transaction pattern features, and amount distribution features, a spatiotemporally decoupled mathematical representation system is constructed. This completely solves the problem of the separation of discrete events and continuous variables in traditional methods, enabling the essential identification of complex violations such as split invoicing, significantly improving the accuracy of capturing complex patterns such as split invoicing, and making seemingly compliant behaviors map to quantitative values.

[0050] Based on the high-risk and noisy areas defined by clustering, dynamic anchor point control technology is used to sample the noisy areas. This not only preserves key transitional samples such as critical fluctuations in amount, but also ensures that rare violation patterns are not annihilated. This solves the problem of progressive violation loss and human data distortion under sample imbalance, ensuring full coverage of violation events. Attached Figure Description

[0051] To more clearly illustrate the technical solution of this application, some embodiments of this application will be described in detail below with reference to the accompanying drawings, in which:

[0052] Figure 1 A flowchart illustrating a method for identifying irregular invoicing by an invoicing user, provided in an embodiment of this application;

[0053] Figure 2 This is a schematic diagram of a device for identifying irregular invoicing by invoicing users, provided as an embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0055] Some embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0056] Figure 1 This is a flowchart illustrating a method for identifying irregular invoicing by an invoicing user, provided as an embodiment of this application. Certain input parameters or intermediate results in this process can be manually adjusted to help improve accuracy.

[0057] The analysis method involved in the embodiments of this application can be implemented by a terminal device or a server, and this application does not impose any special limitations on it. For ease of understanding and description, the following embodiments are all described in detail using a server as an example.

[0058] It should be noted that the server can be a single device or a system composed of multiple devices, i.e., a distributed server. This application does not make any specific limitations on this.

[0059] In identifying irregular expenditures on invoices, the main challenge is the extreme imbalance caused by the dominance of compliant samples and the scarcity of irregular samples. Existing technologies have the following shortcomings:

[0060] Imbalanced sample problem: Undersampling or oversampling methods, which generate samples by randomly deleting the majority class or through linear interpolation, can lead to the loss of key violation patterns or the introduction of noisy data. For example, deleting normal invoice samples may remove boundary cases, making the model unable to identify progressive violations; when generating synthetic samples, outliers that violate business logic are easily generated, distorting the decision boundary.

[0061] For example, undersampling techniques, by randomly deleting majority class samples (compliant users) to forcibly balance the distribution, essentially come at the cost of disrupting the feature association structure. When the algorithm removes key samples near the decision boundary, the interaction patterns between feature vectors are forcibly deconstructed. For instance, in financial risk prediction, after deleting transitional samples that carry critical fluctuation signals of control, the model loses its ability to identify the early evolution of violations. More seriously, low-density samples representing weak violation patterns in the majority class are mass-cleared, causing cases with seemingly compliant parameters but failed implicit mechanisms to be incorrectly classified as normal. This structural collapse prevents the prediction system from detecting weak invoice violation patterns, ultimately resulting in delayed warnings after significant losses occur.

[0062] Insufficient feature association: Existing methods have difficulty integrating multi-dimensional features, resulting in a weak ability to detect complex violations such as split invoicing and related-party transactions.

[0063] Therefore, it is first necessary to construct a spatiotemporal decoupling framework for discrete events and continuous variables, mapping surface compliance behaviors to entropy values ​​of violation risks through mathematical representation. Secondly, a physical retention mechanism for key samples must be established to prevent critical samples and low-frequency violation patterns from being lost during data preprocessing. Finally, a data generation system constrained by business rules must be developed to ensure that synthetic data strictly adheres to the core logic of invoice circulation. This requires full-chain collaboration between sample preservation mechanisms and spatial topology fidelity.

[0064] Figure 1 The process includes the following steps:

[0065] S101: Extract the invoicing feature value of each invoicing user from the invoice data of each invoicing user; the invoicing features include invoicing behavior features, transaction pattern features, and amount distribution features.

[0066] In this example, by quantitatively analyzing the invoicing data of an invoicing user, the characteristic values ​​of a series of discrete events and continuous variables are calculated, which can reveal whether the user has abnormal or suspicious invoicing patterns.

[0067] Among them, the characteristics of invoicing behavior may include the month-on-month growth rate of invoice amount in 7 days, the standard deviation of invoice frequency in 15 days, the proportion of invoices close to the limit, the sensitive amount splitting indicator (e.g., issuing ≥3 invoices with an amount >9,000 yuan to the same invoice recipient within 24 hours), the proportion of invoices issued outside working hours, the number of intensive invoices issued per minute, the proportion of fixed amount invoices, and whether the continuous invoice amounts form an arithmetic / geometric sequence, etc.

[0068] It should be noted that the 7-day invoice amount month-on-month growth rate refers to the increase in the total invoice amount of the current 7 days compared to the total invoice amount of the previous 7 days. The reasons for identifying this risk are as follows: Under normal circumstances, a company's operations and invoicing activities are relatively stable and do not fluctuate drastically. If a user's invoice amount suddenly surges within a short period (one week), it may indicate: inflated performance to meet some purpose, illegal activities such as irregular invoicing, or a strong seasonality in the business itself. However, outliers still require close monitoring.

[0069] The standard deviation of invoicing frequency over 15 days refers to the fluctuation in the number of invoices issued each day over the past 15 days. The reason for identifying risk is as follows: The invoicing frequency of normal enterprises is relatively stable. If the standard deviation is large, it indicates that invoicing is extremely frequent on some days and very infrequent on others, which is highly suspicious. For example, there might be a large number of irregular invoicings concentrated on a few days, while remaining silent at other times.

[0070] The percentage of invoices close to the limit refers to the proportion of invoices with amounts close to the limit (e.g., the difference between the amount and the limit is less than a preset threshold) out of the total number of invoices. The reason for identifying this risk is as follows: frequently issuing invoices with amounts just at the limit is a typical sign of invoice splitting. The purpose may be to bypass approval processes, circumvent higher-level monitoring, or comply with certain reimbursement rules, potentially indicating an intention to circumvent internal management or tax supervision.

[0071] The sensitive amount splitting indicator refers to the occurrence of multiple invoices issued to the same customer within a very short period, each exceeding a certain sensitive threshold. The reason for identifying this risk is as follows: it is the most direct and typical evidence of invoice splitting. For example, a single expense claim exceeding 10,000 yuan requires a more stringent approval process. Therefore, someone might deliberately split a transaction exceeding 10,000 yuan into multiple invoices of just over 9,000 yuan to circumvent regulations. This rule directly detects such behavior.

[0072] Among them, transaction pattern characteristics may include the proportion of invoices issued outside of working hours and the number of invoices issued intensively within minutes.

[0073] The percentage of invoices issued outside of working hours refers to the proportion of invoices issued during non-working periods (such as late night, early morning, weekends, and holidays) to the total number of invoices. The reasons for identifying this risk are as follows: Normal business transactions and invoicing activities typically occur during working hours. Frequent invoicing outside of working hours may indicate that the invoicing activity is automated or manipulated, rather than driven by genuine transactions. It may also suggest internal misconduct, with unsupervised personnel engaging in illegal activities during unsupervised periods.

[0074] Minute-level intensive invoicing refers to the number of times multiple invoices (e.g., five or more) are issued consecutively within a very short period (e.g., one minute). The reason for identifying this risk is as follows: manual invoicing requires time to fill in information and verify details, making it difficult to issue multiple invoices consecutively within one minute. This explosive invoicing behavior is highly likely to be accomplished through scripts, software APIs, or automated tools, and is commonly seen in large-scale illegal invoicing activities.

[0075] Among them, the characteristics of the amount distribution may include the proportion of fixed amount invoices and whether the amounts of consecutive invoices form an arithmetic / geometric sequence.

[0076] The fixed-amount invoice percentage calculation refers to the proportion of invoices with identical amounts to the total number of invoices. The reason for identifying this risk is as follows: In real-world business scenarios, the probability of invoices having exactly the same amount is low due to factors such as product unit price, quantity discounts, and shipping costs. If a user frequently issues invoices with the same amount, it may be using a fixed template for purposes such as distributing benefits or commissions, but may not be paying taxes as required by law.

[0077] Checking whether consecutive invoice amounts follow an arithmetic / geometric sequence refers to examining multiple consecutively issued invoices to see if their amounts exhibit a regular mathematical pattern, such as an arithmetic sequence (same amount difference, e.g., 1000, 2000, 3000) or a geometric sequence (same amount multiples, e.g., 1000, 2000, 4000). The reason for identifying this risk is as follows: This is a very strong characteristic of machine behavior. It is virtually impossible for a human to intentionally or unintentionally issue invoices with amounts forming a perfect mathematical sequence. This almost certainly indicates that the invoicing behavior was generated by a program.

[0078] S102: Cluster different invoicing users based on invoicing feature values ​​to obtain multiple user clusters.

[0079] In this example, invoicing users are grouped according to the similarity of their behavioral patterns through clustering, thereby identifying potential abnormal groups or behavioral patterns. In other words, risk points can be accurately located, and user clusters largely composed of high-risk users can be identified.

[0080] Since a series of numerical invoicing characteristics are calculated for each invoicing user, an invoicing feature vector can be formed for each invoicing user. Through the feature vector, the complex invoicing behavior of each user is transformed into data points that can be processed and calculated by the computer.

[0081] Clustering algorithms (such as K-Means, DBSCAN, hierarchical clustering, etc.) are used to calculate the distance or similarity between the invoice feature vectors of different invoice issuers. For example, if the invoice feature vector values ​​of user A and user C are very similar, then the distance between them is short, and they are likely to be assigned to the same group. If the feature vector of user B is very different from those of A and C, then the distance between B and A and C is large, and B is likely to be assigned to a separate group.

[0082] It's important to note that a user cluster is a set of users with highly similar invoicing behavior patterns. For example, cluster 1 includes the vast majority of users whose invoicing characteristics are within the normal range, representing a group with normal invoicing behavior. This group may be the largest and most concentrated. Cluster 2 includes some users whose characteristics exhibit abnormal patterns such as high frequency, large amounts, and invoicing outside of working hours, representing a highly suspicious abnormal group. Cluster 3 may include another abnormal pattern, such as a group that exclusively issues fixed-amount invoices.

[0083] In summary, by using machine learning clustering algorithms, users who issue invoices are automatically grouped into different behavioral groups based on their invoicing characteristics. These groups (clusters) group users with normal behavior together, while users with abnormal behavior are separated into other groups due to their different behaviors.

[0084] S103: Based on the invoicing characteristic values ​​of each invoicing user within each user cluster, the user cluster is divided into a high-risk area or a noise area; the violation risk of user clusters in the high-risk area is higher than that in the noise area.

[0085] In this example, the initial partitioning is completed through a noise isolation mechanism. The isolation of the noise area not only achieves the enrichment of high-risk users in the high-risk area, but also significantly reduces the complexity of subsequent calculations and allows for subsequent sampling processing.

[0086] It should be noted that invoicing users included in the high-risk zone can be considered high-risk invoicing users, while those in the noise zone can be considered low-risk clusters.

[0087] S104: Perform anchor point sampling on the user cluster in the noise area to obtain the sampled user set.

[0088] In this example, a subset of samples is intelligently selected from the low-risk invoicing user group (the noise zone) for review to ensure no one slips through the cracks. From another perspective, this avoids identifying violations by all invoices from users within the noise zone. Downsampling the noise zone eliminates the vast majority of legitimate users, reducing computational load.

[0089] S105: Based on the sampled user set and the user set in the high-risk area, obtain the invoice-issuing user risk sample set.

[0090] In this example, the union of the sampled user set and the user set in the high-risk area is obtained to get the risk sample set of invoiced users.

[0091] It should be noted that the user set in the high-risk area includes all invoicing users with a high suspicion of violation. Sampling the user set can effectively ensure the retention of key transitional samples, preventing sophisticated violations from being missed due to their good disguise. This approach focuses on covering high-risk individuals identified by the machine while also allowing for spot checks on users in low-risk areas.

[0092] It should be noted that topological weighted cleaning can also be performed on the risk sample set of invoicing users.

[0093] S106: Generate constrained samples from the risk sample set of the invoicing users to obtain synthetic invoicing users.

[0094] In this example, new high-risk samples are synthesized to expand the number of high-risk samples.

[0095] S107: Based on the invoicing feature values ​​of the synthetic invoicing user and the invoicing feature values ​​of the risk sample of the invoicing user, the initial violation identification model is trained to obtain the violation identification model.

[0096] Among them, the synthetic invoicing users are not real users, but their characteristics (such as invoicing frequency, time, amount distribution, etc.) are generated under the premise of following the real data distribution and business rules.

[0097] The model is trained by using risk samples of invoice-issuing users or the invoice feature values ​​of synthetic invoice-issuing users as input samples and violation conclusions as sample labels, until the training ends.

[0098] The training process allows the initial violation detection model to learn how to predict the output (whether it is a violation) based on the input (invoice feature values).

[0099] In summary, expanding the violation samples: By using constraint samples, high-quality, simulated violation samples can be created, effectively increasing the quantity and diversity of violation samples. This allows the violation identification model to learn more comprehensive and detailed violation patterns, and also solves the sample imbalance problem.

[0100] S108: Based on the violation identification model, the violation identification of the invoice feature value of the user to be identified is performed to determine whether the user to be identified has violated the rules in issuing invoices.

[0101] In this example, the checks can be conducted periodically on invoicing users within the company to check for violations, or the checks can be conducted on invoicing users within the company when a request for a violation check is received from the company.

[0102] Using a pre-trained model capable of identifying irregular invoicing, the system performs precise analysis and judgment on the user to be identified for invoicing, and finally outputs a clear conclusion: whether the user has engaged in irregular invoicing behavior.

[0103] In summary, through Figure 1 The method extracts features from three dimensions: invoicing behavior (when to issue invoices), transaction pattern (how to issue invoices), and amount distribution (how many invoices are issued). This can build a three-dimensional user profile, and discrete events and continuous variables are no longer in a state of separate analysis, so that hidden violations can be discovered and potential risks can be found.

[0104] The system can automatically filter out risk groups (clusters) with similar behavioral patterns through clustering, achieving efficient isolation of high-risk invoicing users and condensing potential violation samples.

[0105] Anchor point sampling is performed on low-risk invoice issuers in the noise region. By using a de-adaptive pure random mechanism, the implementation complexity is significantly reduced while ensuring the basic integrity of the topology, and the invoice issuer samples in the key transition state are preserved.

[0106] First, a coarse screening is performed through clustering and high- and low-risk partitioning, and then a large number of new, synthetic samples of violating users are generated, thus providing more and more diverse risk samples for the violation identification model.

[0107] In summary, by creating a multi-dimensional composite feature architecture and integrating invoicing behavior features, transaction pattern features, and amount distribution features, a spatiotemporally decoupled mathematical representation system is constructed. This completely solves the problem of the separation of discrete events and continuous variables in traditional methods, enabling the essential identification of complex violations such as split invoicing, significantly improving the accuracy of capturing complex patterns such as split invoicing, and making seemingly compliant behaviors map to quantitative values.

[0108] Based on the high-risk and noisy areas defined by clustering, dynamic anchor point control technology is used to sample the noisy areas. This not only preserves key transitional samples such as critical fluctuations in amount, but also ensures that rare violation patterns are not annihilated. This solves the problem of progressive violation loss and human data distortion under sample imbalance, ensuring full coverage of violation events.

[0109] based on Figure 1 In addition to the method described herein, this application also provides some specific implementation schemes and extended schemes of the method, which will be further described below.

[0110] In one example, the process of clustering invoices from different invoicing users based on invoicing feature values ​​to obtain multiple user clusters is as follows:

[0111] First, the number of invoice-issuing users is mapped to obtain the number of clusters.

[0112] In this process, the number of invoice-issuing users can be matched in the mapping table to obtain the corresponding number of clusters.

[0113] It should be noted that the more users there are, the more possible behavioral patterns (clusters) there are, so the K value should increase accordingly. If the number of users is small, the K value should decrease.

[0114] Then, based on the invoice feature value and the number of clusters, K-means clustering is performed on the invoices of different invoice users to obtain multiple user clusters.

[0115] This consists of a multidimensional invoicing feature vector composed of all the feature values ​​of each invoicing user. These are the data points to be clustered.

[0116] The clustering process is as follows: K user data points are randomly selected as initial cluster centers. The distance from each user point to the K cluster centers is calculated (usually using Euclidean distance), and the user is assigned to the cluster containing the nearest cluster center. This forms K initial clusters. The center of each cluster (i.e., the average value of all data points within that cluster) is recalculated. Iteration: The assignment and recalculation steps are repeated until the cluster centers no longer change significantly, at which point the algorithm converges. Finally, multiple user clusters are obtained, each belonging to a group of users with highly similar invoicing behavior patterns.

[0117] In one example, the process of classifying user clusters into high-risk or noisy areas based on the invoicing characteristic values ​​of each invoicing user within each user cluster is as follows:

[0118] First, identify the target invoicing users with abnormal invoicing characteristic values ​​within each user cluster.

[0119] Each invoice feature value has its own threshold. Invoice features values ​​exceeding the threshold are considered abnormal. If an invoice user's invoice feature value exceeds its threshold, that user will be marked as a target invoice user.

[0120] Then, calculate the ratio of the total number of target invoicing users in each user cluster to the total number of invoicing users in their respective user clusters.

[0121] The percentage represents the abnormal purity of the cluster. A high percentage means that the cluster is full of users with abnormal behavior, while a low percentage means that most users in the cluster are normal, with only a very few users exhibiting some abnormal behavior.

[0122] Finally, user clusters with a proportion greater than or equal to a preset threshold are classified into the high-risk zone, while user clusters with a proportion less than the preset threshold are classified into the noise zone.

[0123] For example, the preset threshold can be 15%. This threshold is a parameter that needs to be optimized based on historical data and business experience.

[0124] In one example, since a small number of normal users may be mixed into the user clusters in the high-risk area, the clusters in the high-risk area are purified to further reduce the amount of computational data. The process is as follows:

[0125] First, based on the number of invoicing users in each user cluster within the high-risk area, determine the number of cluster subclusters for each user cluster within the high-risk area.

[0126] Specifically, the square root of the number of invoiced users in each user cluster within the high-risk area is calculated. The integer part of the square root is compared with a preset number of subclusters, and the larger of the two values ​​is determined as the number of subclusters for each user cluster within the high-risk area. For example, the preset number of subclusters is 5.

[0127] By taking the square root of the number of users who issued invoices, we can ensure that the number of subclusters increases slowly as the sample size increases, avoiding over-segmentation. Taking the maximum of the minimum value of 5 ensures that even if the number of users in a high-risk cluster is very small, it will be forcibly divided into 5 subclusters for fine-grained inspection, which prevents risks from being hidden in small groups.

[0128] Then, based on the invoice feature value and the number of clusters, K-means clustering is performed on each user cluster in the high-risk area to obtain user subclusters.

[0129] One large high-risk cluster was further broken down into more refined user subclusters with more consistent internal user behavior patterns.

[0130] Then, determine whether there are any users in the user sub-cluster with abnormal invoicing characteristic values.

[0131] If a user subcluster still contains users with abnormal invoicing characteristics, it indicates that the risk of this subcluster is very high and it should be retained.

[0132] If not, the user sub-cluster will be removed from the high-risk area.

[0133] In summary, further cleaning of the decision-making boundaries makes the distinction between high-risk and low-risk areas clearer and more accurate. Furthermore, secondary clustering may reveal more subtle variations in violation patterns and uncover more refined risk patterns.

[0134] In other words, a hierarchical strategy of global coarse screening followed by local fine segmentation is used to achieve efficient isolation of illegal samples and in-depth analysis of the safe zone structure. The core process consists of two stages: the first stage uses a dynamic threshold-driven noise isolation mechanism to complete initial partitioning; the second stage reveals the potential structure within the safe zone through refined subspace modeling.

[0135] In one example, the process of anchor sampling of the user cluster in the noise region to obtain the sampled user set is as follows:

[0136] First, calculate the product between the number of users issuing invoices in the noise zone and the preset sampling ratio to obtain the number of users to be sampled.

[0137] It should be noted that by retaining a portion of key samples with a fixed probability, the sample size will naturally scale as the amount of data increases by setting a preset sampling ratio.

[0138] Then, the number of users to be sampled is compared with the preset sampling number. Based on the larger of the two values, random sampling is performed on the noise area to obtain the sampled user set.

[0139] For example, the preset sampling quantity is 1, thus ensuring minimum sampling guarantee in extreme scenarios. For instance, when the number of users to be sampled is only 8, the sampling quantity is 1.

[0140] Specifically, the formula for the sampling amount can be as follows:

[0141]

[0142] in, The number of users issuing invoices within the noise zone is rounded down to ensure the sample size is an integer. This represents the number of users to be sampled.

[0143] In summary, by employing a strategy that combines a fixed sampling ratio with small sample protection, the dynamic anchor point control module utilizes a random sampling mechanism that combines a fixed sampling ratio with small sample protection, thus preserving key transitional samples. For example, when the preset sampling ratio is 5%, it ensures that at least one of every 20 key samples is retained.

[0144] In one example, the process of generating constraint samples from a risk sample set of invoicing users is as follows:

[0145] In this example, constrained generation refers to the process of synthesizing new data samples under strict, controlled rules (i.e., constraints). The goal of generation is to create new feature vectors for high-risk invoicing users, but this is restricted to a specific mathematical space and rules to ensure that the generated new samples are both diverse and reasonable.

[0146] Constraint sample generation can solve the sample imbalance problem caused by the number of high-risk invoicing users being far less than that of normal users.

[0147] First, based on the standardized Euclidean distance and the invoice feature value, a preset number of nearest neighbors are searched for each invoice risk sample in the invoice risk sample set.

[0148] Then, linear interpolation is performed between each invoicing user risk sample and its nearest neighbor to obtain the composite invoicing user and the invoicing feature value of the composite invoicing user.

[0149] That is, a synthetic invoice user is obtained by linear interpolation between a single invoice user risk sample and a single nearest neighbor sample.

[0150] It's important to note that different features may have different dimensions. Standardized Euclidean distance eliminates the influence of dimensions by dividing by the standard deviation of the features, ensuring that each feature contributes equally to the distance. This guarantees that the nearest neighbors found are samples with truly similar behavioral patterns, rather than being dominated by a feature with a particularly large value.

[0151] The expression for the standardized Euclidean distance can be given as follows:

[0152]

[0153] in, As a risk sample for invoicing users, The nearest neighbor sample of the risk sample of the invoicing user. Let be the standard deviation of the k-th invoicing feature. The number of invoice features.

[0154] The linear interpolation generation process strictly follows the principle of space conservation, and the process is as follows:

[0155]

[0156] in, For users who need to issue invoices in a composite format, These are the interpolation coefficients.

[0157] It should be noted that, It follows a uniform distribution in the interval (0, 1), when When approaching 0, Preserve risk samples of invoicing users The invoicing feature combinations are more numerous. When λ=0.5, midpoint interpolation samples are generated to achieve a smooth transition of feature values. When λ approaches 1... near This mechanism creates linear path constraints in the feature space, ensuring that new samples are strictly located within the valid interval of the lines connecting the original samples. By varying between 0 and 1, countless possibilities can be generated. and The generated composite invoicing user is not among the original invoicing users, but the combination of invoicing feature values ​​of the composite invoicing user may exist in the business logic.

[0158] In one example, the process of identifying violations based on the invoicing feature values ​​of the user to be identified using the violation identification model is as follows:

[0159] The invoice feature values ​​corresponding to the invoice issuer to be identified are input into multiple violation identification models.

[0160] It should be noted that the invoice feature values ​​can be standardized using Z-scores. This ensures that features with large values ​​(such as amount) do not dominate the model's judgment simply because of their large value, allowing all features to contribute information fairly.

[0161] In addition, the invoicing feature values ​​(such as the growth rate of invoicing amount, the proportion of invoicing outside working hours, etc.) corresponding to the same invoicing user to be identified are input into multiple different violation identification models.

[0162] Instead of relying on a single model, this approach constructs a heterogeneous model group comprised of multiple machine learning algorithms. These include, for example, decision trees, random forests, deep neural networks, and XGBoost. Decision trees, random forests, and XGBoost excel at finding clear, "if...then..." logical rules and boundaries in data, while deep neural networks are adept at handling large amounts of non-linear features and capturing highly complex, deep patterns in data that are difficult to describe with simple rules (e.g., suspicious patterns formed by combinations of multiple weak features).

[0163] This heterogeneous (different types) combination ensures diversity, enabling the entire system to grasp both clear rules and ambiguous situations, greatly reducing the risk of misjudgment.

[0164] It's important to note that each algorithm class doesn't use just one model, but rather 50 base learners with identical structures but slightly different training details to enhance diversity. For the prediction of the same invoice-issuing user, the outputs of these 50 models (e.g., the probability of violation) are simply averaged. That is, a simple averaging aggregation is performed on the outputs of homogeneous base learners, effectively extracting the common recognition patterns of single-class models.

[0165] Finally, the results of multiple violation identification models are weighted and summed to obtain the violation results for the invoicing user.

[0166] In this example, a dynamic weighting mechanism based on KNN similarity is introduced. During training, by analyzing the neighborhood distribution relationship between the test samples and the validation set samples in the feature space, appropriate weight coefficients are assigned to each model.

[0167] In summary, this classification prediction process innovatively employs a two-layer fusion mechanism. The first layer performs simple averaging aggregation on the outputs of homogeneous base learners within the model group, effectively extracting common identification patterns of single-class models. The second layer introduces a dynamic weighting mechanism based on KNN similarity, assigning appropriate weight coefficients to each model group, thereby performing weighted summation among different model groups. This significantly improves the discrimination accuracy for complex scenarios such as gradient mutation amount sequences and multi-entity collaborative violations, providing high-confidence decision support for real-time risk identification of large-scale invoice transactions.

[0168] In other words, by adopting a heterogeneous model collaboration mechanism, four types of models—decision tree, random forest, DNN, and XGBoost—are integrated to construct a two-layer structure of intra-group average aggregation and inter-group dynamic weighting. Through intelligent weight allocation based on KNN similarity, the prediction robustness of nonlinear feature scenarios is significantly improved while simultaneously increasing prediction accuracy.

[0169] Based on the same idea, some embodiments of this application also provide devices and non-volatile computer storage media corresponding to the above methods.

[0170] Figure 2 A schematic diagram of a device for identifying irregular invoicing by an invoicing user, provided in an embodiment of this application, includes:

[0171] At least one processor; and,

[0172] A memory communicatively connected to the at least one processor; wherein,

[0173] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform any of the preceding descriptions of a method for identifying irregular invoicing by an invoicing user.

[0174] Some embodiments of this application provide a non-volatile computer storage medium for identifying irregular invoicing by invoicing users, which stores computer-executable instructions capable of executing any of the above-described methods for identifying irregular invoicing by invoicing users.

[0175] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device and medium embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the description of the method embodiments.

[0176] The devices and media provided in this application are one-to-one with the methods. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0177] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the technical principles of this application should fall within the protection scope of this application.

Claims

1. A method for identifying irregular invoicing by invoicing users, characterized in that, The method includes: Extract the invoicing feature values ​​of each invoicing user from the invoice data of each invoicing user; the invoicing features include invoicing behavior features, transaction pattern features, and amount distribution features; Clustering different invoicing users based on invoicing feature values ​​yields multiple user clusters; Based on the invoicing characteristics of each invoicing user within each user cluster, user clusters are divided into high-risk areas or noise areas; the risk of violations for user clusters in high-risk areas is higher than that in noise areas. Anchor point sampling is performed on the user clusters in the noise region to obtain a sampled user set; Based on the sampled user set and the user set in the high-risk area, a risk sample set of invoicing users is obtained; Constraint sample generation is performed on the aforementioned risk sample set of invoice issuers to obtain synthetic invoice issuers; Based on the invoicing feature values ​​of the synthetic invoicing user and the invoicing feature values ​​of the risk sample of the invoicing user, the initial violation identification model is trained to obtain the violation identification model; The violation identification model is used to identify violations by analyzing the invoice feature values ​​of the user to be identified, in order to determine whether the user to be identified has violated the rules in issuing invoices. The step of clustering different invoicing users based on invoicing feature values ​​to obtain multiple user clusters specifically includes: Map the number of invoice-issuing users to obtain the number of clusters; Based on the invoice feature value and the number of clusters, K-means clustering is performed on different invoice users to obtain multiple user clusters; The process of dividing user clusters into high-risk or noisy areas based on the invoicing characteristic values ​​of each invoicing user within each user cluster specifically includes: Identify the target invoicing users with abnormal invoicing characteristic values ​​within each user cluster; Calculate the ratio of the total number of target invoicing users within each user cluster to the total number of invoicing users within that user cluster; User clusters with a proportion greater than or equal to a preset threshold are classified into high-risk areas, and user clusters with a proportion less than the preset threshold are classified into noise areas. Before performing anchor point sampling on the user cluster in the noise region to obtain the sampled user set, the method further includes: The number of sub-clusters for each user cluster in the high-risk area is determined based on the number of invoicing users in each user cluster. Based on the invoice feature value and the number of clusters, K-means clustering is performed on each user cluster in the high-risk area to obtain user subclusters; Determine whether there are any users in the user subcluster who have abnormal invoicing characteristic values; If not, the user subcluster will be removed from the high-risk area; The step of determining the number of sub-clusters for each user cluster within the high-risk area based on the number of invoiced users in each user cluster specifically includes: Find the square root of the number of invoiced users in each user cluster within the high-risk area; The integer part of the square root is compared with the preset number of sub-clusters, and the larger of the two values ​​is determined as the number of clustered sub-clusters for each user cluster in the high-risk area. The step of anchor point sampling of the user cluster in the noise region to obtain the sampled user set specifically includes: Calculate the product between the number of users issuing invoices in the noise zone and the preset sampling ratio to obtain the number of users to be sampled; The number of users to be sampled is compared with the preset number of samples. Based on the larger of the two values, random sampling is performed on the noise area to obtain the sampled user set. The step of generating a constrained sample from the risk sample set of invoicing users to obtain a synthetic invoicing user specifically includes: Based on the standardized Euclidean distance and the invoice feature value, a preset number of nearest neighbors are searched for each invoice user risk sample in the invoice user risk sample set. Linear interpolation is performed between each invoicing user risk sample and its nearest neighbor to obtain the composite invoicing user and the invoicing feature value of the composite invoicing user.

2. The method according to claim 1, characterized in that, The step of identifying violations based on the violation identification model of the invoice feature values ​​of the user to be identified specifically includes: Input the invoicing feature value corresponding to the invoicing user to be identified into multiple violation identification models; The results of multiple violation identification models are weighted and summed to obtain the violation results of the invoicing user to be identified.

3. The method according to claim 1, characterized in that, The invoicing behavior characteristics include at least one of the following: the month-on-month growth rate of invoicing amount over 7 days, the standard deviation of invoicing frequency over 15 days, the proportion of invoices close to the limit, and the sensitive amount splitting indicator. Transaction pattern characteristics include at least one of the following: the proportion of invoices issued outside of working hours, and the number of invoices issued intensively within minutes; The distribution characteristics of the amount include at least one of the following: the proportion of fixed amount invoices, and whether the amounts of consecutive invoices form an arithmetic or geometric sequence.

4. A device for identifying irregular invoicing by invoicing users, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the method for identifying irregular invoicing by an invoicing user as described in any one of claims 1-3.

Images