Financial intelligent supervision method and system based on big data analysis

Abstract

The invention discloses an intelligent financial supervision method and system based on big data analysis. The method comprises the steps of obtaining multi-source financial data to construct an initial financial time sequence; performing Hampel filtering on the initial financial time sequence, calculating residual intensity and forming a residual energy envelope sequence; constructing a morphological feature vector sequence according to the initial financial time sequence and the residual energy envelope sequence, and inputting the morphological feature vector sequence into an ECOD anomaly detection algorithm model to generate a first anomaly score sequence; performing turn-back reconstruction processing on the residual energy envelope sequence according to the first abnormal score sequence to form a reconstructed envelope sequence; performing structure alignment processing on the reconstructed envelope sequence and the initial financial time sequence to generate a motif sequence; inputting the motif sequence into an ECOD distribution tail evaluation process to calculate a secondary risk intensity sequence; and acting the secondary risk intensity sequence on the motif sequence to generate disturbance intensity, and outputting a risk identification result according to a risk grading threshold. According to the invention, high-precision identification of the abnormal risk of the multi-source financial data is realized.

Description

Technical Field

[0001] This invention relates to the field of financial risk supervision technology, and in particular to a financial intelligent supervision method and system based on big data analysis. Background Technology

[0002] With the development of information technology, financial data processing and supervision technologies are characterized by rapid growth in data scale and continuous increasing complexity of business structures. Various financial business systems generate large amounts of structured and semi-structured data in accounting, budget execution, contract management, fund allocation, and expense reimbursement, forming heterogeneous data sets across systems, time periods, and multiple sources. To improve financial risk identification capabilities, time series modeling methods are commonly used to identify potential risk points by extracting trend changes, fluctuation amplitudes, and cyclical structures. Simultaneously, anomaly detection technologies are being applied in the financial field. Among these, filtering methods based on median and deviation calculations are used to identify local anomalies, while statistical detection methods based on distribution characteristics to infer the degree of offset are used to identify overall shifts.

[0003] In existing technologies, financial risk identification methods mainly rely on fixed rules, multi-threshold logic, or distribution analysis based on a single dimension. Rule-based methods rely on expert experience to establish judgment conditions, but they struggle to handle non-linear changes, and the rule system needs frequent updates when business scenarios change. Statistical distribution-based methods infer the degree of deviation based on univariate probability structures, which can reflect the tail risk of the distribution to some extent, but their ability to express multidimensional structural relationships is limited when facing scenarios with multiple fields and multiple business behaviors interacting. Some studies construct abnormal distribution models by integrating multiple variables into feature vectors, but due to the failure to effectively handle data noise and local outliers, they are prone to misidentification or insufficient risk level differentiation.

[0004] Because data generated from actual business operations is characterized by uneven time intervals and discontinuous local mutations, directly identifying anomalies in time series data can be affected by local energy spikes and noise peaks. Although some techniques attempt to remove local outliers using median-based filtering methods, the filtered series may still have structural gaps, causing subsequent distribution assessments to fail to accurately reflect the actual risk status.

[0005] Therefore, how to provide a financial intelligent supervision method and system based on big data analysis is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a financial intelligent supervision method and system based on big data analysis. The beneficial effects of this invention are that it improves the accuracy of outlier identification by coupling the filtering residual with ECOD distribution assessment, enhances the ability to express the continuity of time series through foldback reconstruction and structure alignment, and enhances the accuracy and reliability of financial risk identification through tail offset analysis and hierarchical calculation.

[0007] A financial intelligent supervision method based on big data analysis according to an embodiment of the present invention includes:

[0008] Acquire multi-source financial data and arrange them in chronological order to form an initial financial time series;

[0009] The initial financial time series is subjected to Hampel filtering, and the residual strength is calculated according to the relationship between the midpoint and the deviation in the window and then nonlinearly compressed to form a residual energy envelope sequence.

[0010] A morphological feature vector sequence consisting of an initial financial time series and a residual energy envelope sequence is constructed and input into the ECOD anomaly detection algorithm model. The degree of anomaly deviation is calculated based on the empirical distribution cumulative relationship to form the first anomaly score sequence.

[0011] Based on the abrupt change location and magnitude of the first anomaly score sequence in the time dimension, the residual energy envelope sequence is reconstructed by a backward reconstruction operation to form a reconstructed envelope sequence.

[0012] The reconstructed envelope sequence is structurally aligned with the initial financial time series to form a sequence of base sequences.

[0013] The motif sequence is input into the ECOD distribution tail assessment process, and the tail offset intensity is calculated and normalized for each time point to form a secondary risk intensity sequence.

[0014] The secondary risk intensity sequence is applied to the motif sequence to establish a perturbation intensity mapping for each time point and set a risk classification threshold, outputting the risk identification result.

[0015] Optionally, forming the initial financial time series includes:

[0016] Acquire multi-source financial data from different financial business systems, and mark the data with timestamps according to the time of data generation to form a set of original financial records;

[0017] The original set of financial records is sorted according to timestamp order to generate a time-series record sequence;

[0018] The time-series record sequence is subjected to field consistency verification. By comparing the field format, field length and field value range, records that do not meet the requirements are eliminated to form a valid time-series sequence.

[0019] Time interval correction processing is performed on the effective time series to form a time interval balanced series;

[0020] The time intervals of the sequence are standardized to form a sequence with uniform dimensions.

[0021] According to the chronological order of the sequence with unified dimensions in the time dimension, the field values ​​at each time point are combined into an ordered vector to form the initial financial time series.

[0022] Optionally, forming the residual energy envelope sequence includes:

[0023] Read the numerical fields and timestamp information of each record from the initial financial time series, set the window length and sliding step size to form a set of window parameters for Hampel filtering;

[0024] The initial financial time series is divided into sliding windows based on the window parameter set. Records are organized in chronological order within each window, and the median value of the target numerical field within the window is calculated to form a sequence of median values ​​within the window.

[0025] For each window in the window midpoint value sequence, subtract the window midpoint value from the target value field of each record in the corresponding window and take the absolute value to obtain the original residual sequence arranged in chronological order;

[0026] For the original residual sequence, the median absolute deviation of the original residual is calculated in each window, and the residual strength threshold is determined according to the numerical relationship between the median value in the window and the median absolute deviation, thus forming a residual strength threshold sequence.

[0027] For residuals in the original residual sequence whose values ​​are greater than the corresponding residual intensity threshold, a compression operation is performed to gradually slow down the growth rate of the amplitude, thereby generating a nonlinear compressed residual sequence.

[0028] The residual intensities at each time point in the nonlinear compressed residual sequence are continuously connected and locally smoothed in chronological order to form a residual energy envelope sequence.

[0029] Optionally, forming the first anomaly scoring sequence includes:

[0030] A differential perturbation sequence is constructed based on the numerical fields of each time point in the initial financial time series and the energy values ​​of the corresponding time points in the residual energy envelope sequence. The perturbation amplitude corresponding to the time is formed by calculating the differential amplitude and direction at each time point.

[0031] For differential perturbation sequences, the gradient change of perturbation amplitude over a continuous time span is calculated, and a perturbation gradient sequence is constructed by obtaining the perturbation gradient at adjacent time points;

[0032] The gradient curvature is calculated based on the temporal continuity of the perturbation gradient sequence. Curvature values ​​are generated by analyzing the gradient changes at three consecutive time points, thus forming a curvature sequence that describes the temporal change pattern.

[0033] The curvature sequence and the initial financial time series are structurally integrated at each time point, and a dynamically weighted sequence is formed by applying the curvature values ​​as dynamic weights to the numerical fields of the initial financial time series.

[0034] The dynamic weighted sequence and the residual energy envelope sequence are vectorized and combined at each time point to form a morphological feature vector sequence.

[0035] The morphological feature vector sequence is input into the ECOD anomaly detection algorithm model. The degree of abnormal deviation of each vector in the feature space is calculated through the empirical distribution cumulative relationship. Based on the degree of abnormal deviation, anomaly scoring rules are constructed and the first anomaly scoring sequence is formed.

[0036] Optionally, the ECOD anomaly detection algorithm model includes an input vector generation layer, a scale alignment layer, a dimensional empirical distribution construction layer, a tail probability estimation layer, a multidimensional cumulative probability aggregation layer, a deviation mapping layer, a deviation normalization layer, and an anomaly score output layer.

[0037] The input vector generation layer is used to receive all the numerical fields of each morphological feature vector in the morphological feature vector sequence and combine all the numerical fields into an input vector in a fixed order.

[0038] The scale alignment layer is used to linearly stretch the values ​​of each dimension of the input vector within a range by mapping the values ​​of each dimension to a uniform range.

[0039] The dimensional empirical distribution construction layer is used to sort the values ​​of all input vectors in ascending order in each dimension of the input vector, and calculate the cumulative sorting position and cumulative probability value of each input vector in the corresponding dimension based on the sorting results, thus forming the dimensional empirical cumulative distribution.

[0040] The tail probability estimation layer is used to calculate the tail probability of each input vector in each dimension based on the empirical cumulative distribution of the dimensions.

[0041] The multidimensional cumulative probability aggregation layer is used to aggregate the tail probabilities of the same input vector across all dimensions to form multidimensional tail probabilities.

[0042] The deviation mapping layer is used to map each input vector to a deviation value based on the multidimensional tail probability, and generates a deviation sequence by monotonically increasing the mapping of the multidimensional tail probability.

[0043] The deviation normalization layer is used to perform a linear interval transformation on all deviation values ​​based on the maximum and minimum deviation values ​​in the deviation sequence.

[0044] The anomaly score output layer is used to output the normalized deviation value as the anomaly score for the corresponding time point in the first anomaly score sequence.

[0045] Optionally, the step-back reconstruction operation on the residual energy envelope sequence includes:

[0046] The energy value at each time point is obtained from the residual energy envelope sequence, and the energy change sequence is formed by calculating the difference between the energy values ​​at adjacent time points.

[0047] Based on the difference in the signs of changes at adjacent time points in the energy change sequence, the positions of the change signs are recorded as turning points, and all turning points are arranged in chronological order to form a sequence of turning point positions.

[0048] Local energy segments are constructed between adjacent turn points in the turn point location sequence. All energy values ​​within the local energy segments are extracted and arranged in reverse time to form a turn sequence fragment.

[0049] Local smoothing is performed on the foldback sequence segments by compressing the difference magnitude between adjacent values ​​within the segment to form smooth foldback segments;

[0050] All smoothed return segments are placed back into their original sequence positions according to their corresponding time intervals. The reconstructed segment sequence is formed by aligning the start and end time correspondence of the segments with the time dimension in the residual energy envelope sequence.

[0051] Boundary matching is performed on the non-returned intervals of the reconstructed fragment sequence and the residual energy envelope sequence, and boundary transition insertion is performed by calculating the difference in energy values ​​at the boundary.

[0052] All fragment sequences processed by boundary transition insertion are merged with the values ​​of the non-returned interval in chronological order to form a reconstructed envelope sequence.

[0053] Optionally, forming the motif sequence includes:

[0054] In the initial financial time series and the reconstructed envelope sequence, the numerical fields and energy values ​​at the corresponding time points are obtained in chronological order. A time-aligned index sequence is constructed by comparing the record integrity of the two sequences at the same time point.

[0055] The initial financial time series is supplemented based on the time-aligned index sequence. The supplemented financial series is formed by inserting compensation values ​​consisting of the differences between adjacent time points into the missing time points.

[0056] The reconstructed envelope sequence is energy-corrected based on the time-aligned index sequence to form a corrected envelope sequence.

[0057] The amplitude weight sequence is formed by calculating the amplitude difference between the compensated financial sequence and the corrected envelope sequence at the same time point and mapping the amplitude difference to amplitude weights.

[0058] The magnitude weight sequence is applied to the compensation financial sequence and the adjustment envelope sequence respectively to generate a weighted alignment sequence;

[0059] The weighted aligned sequence is continuously smoothed in the time dimension, and the radix sequence is formed by differential compression of the composite values ​​at adjacent time points.

[0060] Optionally, forming the secondary risk intensity sequence includes:

[0061] Obtain all numerical fields at each time point from the radix sequence, and construct a field sorting sequence by sorting the same numerical field at all time points from smallest to largest.

[0062] Calculate the cumulative position ratio of each time point in the corresponding field based on the field sorting sequence, and use the cumulative position ratio as the cumulative probability of the field.

[0063] Extract the probability value at the upper bound of the probability interval from the cumulative probability of the field and calculate the tail offset of the field at each time point. Arrange the tail offsets in the order of time points to form the field tail offset sequence.

[0064] The field tail offset sequence of all fields is aggregated point by point over time. The weighted combination operation of the field tail offsets at the same time point is used to form the offset aggregate value corresponding to the time.

[0065] All offset aggregate values ​​are linearly transformed based on the maximum and minimum offset aggregate values ​​to form a quadratic risk intensity sequence.

[0066] Optionally, the risk identification result includes:

[0067] The numerical field of each time point is obtained from the primal sequence, and the risk intensity value of the corresponding time point is obtained from the secondary risk intensity sequence. A time mapping index sequence is formed by establishing a one-to-one correspondence between the risk intensity value and the numerical field.

[0068] For each time point in the time-mapped index sequence, the magnitude of the numerical field vector is calculated. The disturbance intensity value is generated by multiplying the magnitude by the risk intensity value and then arranged in chronological order to form a disturbance intensity sequence.

[0069] A sliding time window is constructed on the disturbance intensity sequence, and a window statistical sequence is formed by calculating the approximate mean and standard deviation of the disturbance intensity values ​​within each time window;

[0070] Based on the numerical relationship between the approximate mean and the approximate standard deviation in the window statistical sequence, a set of risk classification thresholds is calculated for each time window;

[0071] The perturbation intensity value at each time point in the perturbation intensity sequence is compared with the corresponding risk classification threshold on the time axis to form a risk level label sequence;

[0072] The risk level marker sequence and the motif sequence are processed together to output the risk identification result.

[0073] Optionally, a financial intelligent supervision system based on big data analytics includes:

[0074] The data acquisition module is used to obtain multi-source financial records from different financial business systems and generate a timestamp for each record;

[0075] The time series construction module is used to sort multi-source financial records according to timestamp order, perform field consistency verification, time interval correction and unit standardization processing, and output the initial financial time series.

[0076] The residual energy analysis module is used to perform Hampel filtering on the initial financial time series. It generates a residual energy envelope sequence by calculating the window median, absolute deviation median, and residual strength, and then performing nonlinear compression.

[0077] The morphological feature modeling module is used to construct a morphological feature vector sequence based on the initial financial time series and the residual energy envelope sequence, and to perform anomaly deviation calculation to generate the first anomaly score sequence.

[0078] The reversal and reconstruction module is used to perform reversal and reconstruction processing on the residual energy envelope sequence based on the first anomaly scoring sequence and generate a reconstructed envelope sequence.

[0079] The structure alignment module is used to perform time alignment, point filling, energy adjustment, amplitude weight synthesis, and continuity smoothing to generate a sequence sequence based on the initial financial time series and the reconstructed envelope sequence.

[0080] The ECOD distribution assessment module is used to construct a field sorting sequence, field cumulative probability, field tail offset and offset aggregation value based on the radix sequence, and to perform an interval linear transformation on the offset aggregation value to generate a quadratic risk intensity sequence.

[0081] The risk intensity calculation module is used to apply the secondary risk intensity sequence to the motif sequence and generate a risk level label sequence by calculating the magnitude of the numerical field vector, the perturbation intensity, the window statistic, and the risk classification threshold.

[0082] The risk identification module is used to construct a list of risk segments based on the risk level label sequence and output the risk identification results.

[0083] The beneficial effects of this invention are:

[0084] (1) By employing time interval correction, dimensional standardization and Hampel filtering based on median deviation in the processing of multi-source financial data, this invention significantly reduces the interference of heterogeneous data noise on subsequent analysis results and improves the stability of time series structure expression.

[0085] (2) This invention achieves joint identification of local anomalies and distribution tail shifts by constructing residual energy envelopes, generating morphological feature vectors and evaluating ECOD anomaly deviations, which effectively improves the accuracy and sensitivity of anomaly detection.

[0086] (3) This invention constructs a multi-level risk identification mechanism by aggregating the distribution tail offset and calculating the risk classification threshold, which improves the ability to distinguish financial risks on a time scale and shows stronger adaptability and identification effect in complex and multi-dimensional financial business scenarios. Attached Figure Description

[0087] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0088] Figure 1 This is a flowchart of a financial intelligent supervision method based on big data analysis proposed in this invention;

[0089] Figure 2 This is a flowchart illustrating the structure alignment of a financial intelligent supervision method based on big data analysis proposed in this invention.

[0090] Figure 3 This is a flowchart illustrating the risk identification process of a financial intelligent supervision method based on big data analysis proposed in this invention. Detailed Implementation

[0091] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0092] refer to Figure 1-3 The diagram illustrates a financial intelligent supervision method based on big data analytics, comprising:

[0093] Acquire multi-source financial data and arrange them in chronological order to form an initial financial time series;

[0094] The initial financial time series is subjected to Hampel filtering, and the residual strength is calculated according to the relationship between the midpoint and the deviation in the window and then nonlinearly compressed to form a residual energy envelope sequence.

[0095] A morphological feature vector sequence consisting of an initial financial time series and a residual energy envelope sequence is constructed and input into the ECOD anomaly detection algorithm model. The degree of anomaly deviation is calculated based on the empirical distribution cumulative relationship to form the first anomaly score sequence.

[0096] Based on the abrupt change location and magnitude of the first anomaly score sequence in the time dimension, the residual energy envelope sequence is reconstructed by a backward reconstruction operation to form a reconstructed envelope sequence.

[0097] The reconstructed envelope sequence is structurally aligned with the initial financial time series to form a sequence of base sequences.

[0098] The motif sequence is input into the ECOD distribution tail assessment process, and the tail offset intensity is calculated and normalized for each time point to form a secondary risk intensity sequence.

[0099] The secondary risk intensity sequence is applied to the motif sequence to establish a perturbation intensity mapping for each time point and set a risk classification threshold, outputting the risk identification result.

[0100] In this embodiment, forming the initial financial time series includes:

[0101] Acquire multi-source financial data from different financial business systems, and mark the data with timestamps according to the time of data generation to form a set of original financial records;

[0102] The original set of financial records is sorted according to timestamp order to generate a time-series record sequence;

[0103] The time-series record sequence is subjected to field consistency verification. By comparing the field format, field length and field value range, records that do not meet the requirements are eliminated to form a valid time-series sequence.

[0104] Time interval correction processing is performed on the effective time series to form a time interval balanced series;

[0105] The time interval correction process for the effective time series includes: calculating the actual time interval based on the timestamp difference between adjacent records in the effective time series; comparing the actual time interval with the continuous time interval generated by the actual financial business records; inserting a placeholder record with the same field structure as the previous record but with empty numerical fields according to the time order of the missing time points when there are missing time points; and removing the record with the corresponding abnormal interval when there is an abnormal amplification of the actual time interval, thus forming a time interval balanced sequence.

[0106] The time intervals of the sequence are standardized to form a sequence with uniform dimensions.

[0107] The dimension standardization process for the time interval balanced sequence includes: calculating the minimum and maximum values ​​of each numerical field in the time interval balanced sequence, and converting all numerical fields into a set of dimensionless values ​​within the same measurement range by subtracting the minimum value from the numerical field of each record and dividing by the difference between the maximum and minimum values, thus forming a dimensionally unified sequence.

[0108] According to the chronological order of the sequence with unified dimensions in the time dimension, the field values ​​at each time point are combined into an ordered vector to form the initial financial time series.

[0109] In this embodiment, forming the residual energy envelope sequence includes:

[0110] Read the numerical fields and timestamp information of each record from the initial financial time series, set the window length and sliding step size to form a set of window parameters for Hampel filtering;

[0111] The set window length value and sliding step value include:

[0112] The average time span of the entire series is calculated based on the timestamp intervals recorded in the initial financial time series. The time span distribution of the entire series is obtained by statistically analyzing the time differences between consecutive records. The smallest consecutive time period that can cover no less than 3 consecutive records is selected as the window length value in the time span distribution. When the window length value is less than 3 times the median time difference of the time span distribution, the window length value is kept equal to 3 times the median time difference. When the window length value is greater than 1 / 30 of the total time span of the entire series, the window length value is kept equal to 1 / 30 of the total time span of the entire series.

[0113] The sliding step size is set according to the window length value at a ratio not exceeding 1 / 3 of the window length value, and the sliding step size is kept at 1 / 2 of the window length value when the sliding step size causes the window coverage area to overlap.

[0114] The initial financial time series is divided into sliding windows based on the window parameter set. Records are organized in chronological order within each window, and the median value of the target numerical field within the window is calculated to form a sequence of median values ​​within the window.

[0115] For each window in the window midpoint value sequence, subtract the window midpoint value from the target value field of each record in the corresponding window and take the absolute value to obtain the original residual sequence arranged in chronological order;

[0116] For the original residual sequence, the median absolute deviation of the original residual is calculated in each window, and the residual strength threshold is determined according to the numerical relationship between the median value in the window and the median absolute deviation, thus forming a residual strength threshold sequence.

[0117] The calculation of the median absolute deviation of the original residuals includes: obtaining all residual values ​​in the original residual sequence within each window; constructing an absolute difference sequence by calculating the absolute difference between the median value in the window and each residual value in the window; sorting the absolute difference sequence in ascending order of value; and selecting the value located in the middle of the sequence as the median absolute deviation according to the position of the sorted sequence to obtain the median absolute deviation.

[0118] The determination of the residual strength threshold includes: obtaining the median value and the median absolute deviation value within each window; obtaining the deviation amplification value by multiplying the median absolute deviation value by 1.48; and adding the median value and the deviation amplification value to obtain a threshold value for judging whether the residual strength is abnormal. If the deviation amplification value is greater than the median value within the window, the threshold value is kept equal to the deviation amplification value. If the median value within the window is greater than the deviation amplification value, the threshold value is kept equal to the median value within the window, thus forming the residual strength threshold.

[0119] For residuals in the original residual sequence whose values ​​are greater than the corresponding residual intensity threshold, a compression operation is performed to gradually slow down the growth rate of the amplitude, thereby generating a nonlinear compressed residual sequence.

[0120] The compression operation includes: for residual strengths in the original residual sequence whose values ​​are greater than the residual strength threshold, obtaining the excess residual by calculating the difference between the residual strength and the residual strength threshold; generating the compressed residual strength according to the linear ratio of the excess residual when the excess residual is in a small range; and performing a square root operation on the excess residual in a nonlinear manner when the excess residual increases, and adding the operation result to the residual strength threshold to obtain the compressed residual strength.

[0121] The residual intensities at each time point in the nonlinear compressed residual sequence are continuously connected and locally smoothed in chronological order to form a residual energy envelope sequence.

[0122] In this embodiment, forming the first abnormality scoring sequence includes:

[0123] A differential perturbation sequence is constructed based on the numerical fields of each time point in the initial financial time series and the energy values ​​of the corresponding time points in the residual energy envelope sequence. The perturbation amplitude corresponding to the time is formed by calculating the differential amplitude and direction at each time point.

[0124] The construction of the differential perturbation sequence includes: obtaining the numerical field of each time point in the initial financial time series, obtaining the energy value of the corresponding time point in the residual energy envelope sequence, obtaining the differential value by subtracting the energy value from the numerical field, forming a differential perturbation sequence by arranging the differential values ​​of each time point in chronological order, and identifying the differential direction according to whether the differential value is greater than zero or less than zero, thus forming a differential perturbation sequence containing differential amplitude and differential direction.

[0125] The calculation of the difference amplitude and direction at each time point corresponds to the disturbance amplitude corresponding to the time of formation, including: obtaining the difference value at each time point in the difference disturbance sequence, obtaining the difference amplitude by taking the absolute value of the difference value, determining the difference direction by judging whether the difference value is greater than zero or less than zero, and combining the difference amplitude and difference direction in chronological order so that each time point is represented by a set of disturbance amplitude values ​​containing amplitude information and direction information.

[0126] For differential perturbation sequences, the gradient change of perturbation amplitude over a continuous time span is calculated, and a perturbation gradient sequence is constructed by obtaining the perturbation gradient at adjacent time points;

[0127] The calculation of the gradient change of the disturbance amplitude over a continuous time span includes: obtaining the disturbance amplitude of two adjacent time points in the disturbance amplitude sequence; obtaining the gradient value of the corresponding time period by subtracting the disturbance amplitude of the previous time point from the disturbance amplitude of the later time point; performing the same gradient calculation steps on each pair of adjacent time points in chronological order throughout the entire sequence; and arranging all gradient values ​​in chronological order to form a disturbance gradient sequence that represents the rate of change of the disturbance amplitude over time.

[0128] The gradient curvature is calculated based on the temporal continuity of the perturbation gradient sequence. Curvature values ​​are generated by analyzing the gradient changes at three consecutive time points, thus forming a curvature sequence that describes the temporal change pattern.

[0129] The calculation of gradient curvature includes: obtaining gradient values ​​at three consecutive time points in the perturbation gradient sequence in chronological order; constructing a curvature difference by subtracting the gradient value difference of the previous pair of time points from the gradient value difference of the subsequent pair of time points; and using the curvature difference as the curvature value corresponding to the three time points. The same curvature calculation steps are performed on each set of three consecutive time points in the entire sequence, so that the second-order change of gradient in the time dimension is recorded in the form of a curvature sequence.

[0130] The curvature sequence and the initial financial time series are structurally integrated at each time point, and a dynamically weighted sequence is formed by applying the curvature values ​​as dynamic weights to the numerical fields of the initial financial time series.

[0131] The dynamic weighted sequence and the residual energy envelope sequence are vectorized and combined at each time point to form a morphological feature vector sequence.

[0132] The morphological feature vector sequence is input into the ECOD anomaly detection algorithm model. The degree of anomaly deviation of each vector in the feature space is calculated through the empirical distribution accumulation relationship. Based on the degree of anomaly deviation, anomaly scoring rules are constructed and the first anomaly scoring sequence is formed.

[0133] The calculation of the abnormal deviation of each vector in the feature space includes: obtaining the values ​​of each dimension of each vector in the morphological feature vector sequence; obtaining a sorting sequence by sorting the values ​​of all vectors in each dimension from smallest to largest; calculating the sorting position of each vector in the corresponding dimension and dividing the sorting position by the number of vectors to obtain the cumulative probability value; performing the same cumulative probability calculation steps in all dimensions respectively; and aggregating the cumulative probability values ​​of each vector in all dimensions to form a deviation value for each vector to represent the rarity of the tail in the feature space. The larger the deviation value, the greater the distance of the corresponding vector from the concentrated region in the empirical distribution.

[0134] The construction of the anomaly scoring rules includes: obtaining the deviation value corresponding to each time point after the anomaly deviation degree calculation is completed; calculating the minimum deviation value and the maximum deviation value among all deviation values; subtracting the minimum deviation value from each deviation value to obtain the deviation difference; dividing the deviation difference by the difference between the maximum deviation value and the minimum deviation value to obtain the standardized deviation; and using the standardized deviation as the anomaly score corresponding to the corresponding time point.

[0135] In this embodiment, the ECOD anomaly detection algorithm model includes an input vector generation layer, a scale alignment layer, a dimensional empirical distribution construction layer, a tail probability estimation layer, a multidimensional cumulative probability aggregation layer, a deviation mapping layer, a deviation normalization layer, and an anomaly score output layer.

[0136] The input vector generation layer is used to receive all the numerical fields of each morphological feature vector in the morphological feature vector sequence and combine all the numerical fields into an input vector in a fixed order.

[0137] The scale alignment layer is used to linearly stretch the values ​​of each dimension of the input vector within a range by mapping the values ​​of each dimension to a uniform range.

[0138] The dimensional empirical distribution construction layer is used to sort the values ​​of all input vectors in ascending order in each dimension of the input vector, and calculate the cumulative sorting position and cumulative probability value of each input vector in the corresponding dimension based on the sorting results, thus forming the dimensional empirical cumulative distribution.

[0139] The tail probability estimation layer is used to calculate the tail probability of each input vector in each dimension based on the empirical cumulative distribution of the dimensions.

[0140] The multidimensional cumulative probability aggregation layer is used to aggregate the tail probabilities of the same input vector across all dimensions to form multidimensional tail probabilities.

[0141] The deviation mapping layer is used to map each input vector to a deviation value based on the multidimensional tail probability, and generates a deviation sequence by monotonically increasing the mapping of the multidimensional tail probability.

[0142] The deviation normalization layer is used to perform a linear interval transformation on all deviation values ​​based on the maximum and minimum deviation values ​​in the deviation sequence.

[0143] The anomaly score output layer is used to output the normalized deviation value as the anomaly score for the corresponding time point in the first anomaly score sequence.

[0144] In this embodiment, the step of performing a backward reconstruction operation on the residual energy envelope sequence includes:

[0145] The energy value at each time point is obtained from the residual energy envelope sequence, and the energy change sequence is formed by calculating the difference between the energy values ​​at adjacent time points.

[0146] The calculation of the difference between energy values ​​at adjacent time points to form an energy change sequence includes: obtaining the energy value of each time point in the residual energy envelope sequence in chronological order; obtaining the energy difference between adjacent time points by subtracting the energy value of the previous time point from the energy value of the next time point; performing the same difference calculation steps on each pair of adjacent time points throughout the entire time range; and arranging all the differences in chronological order to form an energy change sequence.

[0147] Based on the difference in the signs of changes at adjacent time points in the energy change sequence, the positions of the change signs are recorded as turning points, and all turning points are arranged in chronological order to form a sequence of turning point positions.

[0148] Local energy segments are constructed between adjacent turn points in the turn point location sequence. All energy values ​​within the local energy segments are extracted and arranged in reverse time to form a turn sequence fragment.

[0149] The construction of the local energy segment includes: obtaining the position indices of two adjacent turn-off points in the turn-off point position sequence in chronological order; extracting the corresponding energy values ​​by taking all time points between the corresponding position indices as a continuous interval in the residual energy envelope sequence; and arranging these energy values ​​in chronological order to form a local energy segment.

[0150] Local smoothing is performed on the foldback sequence segments by compressing the difference magnitude between adjacent values ​​within the segment to form smooth foldback segments;

[0151] All smoothed return segments are placed back into their original sequence positions according to their corresponding time intervals. The reconstructed segment sequence is formed by aligning the start and end time correspondence of the segments with the time dimension in the residual energy envelope sequence.

[0152] Boundary matching is performed on the non-returned intervals of the reconstructed fragment sequence and the residual energy envelope sequence, and boundary transition insertion is performed by calculating the difference in energy values ​​at the boundary.

[0153] The boundary transition insertion process includes: obtaining boundary energy values ​​in two directions at the connection position between the reconstructed fragment sequence and the non-returning interval; obtaining the boundary difference value by calculating the difference between the two energy values; constructing several transition energy values ​​based on the magnitude of the boundary difference value; and inserting the boundary energy values ​​and transition energy values ​​into the connection position in chronological order so that the reconstructed fragment sequence and the non-returning interval form a continuous transition in terms of energy change trend.

[0154] All fragment sequences processed by boundary transition insertion are merged with the values ​​of the non-returned interval in chronological order to form a reconstructed envelope sequence.

[0155] In this embodiment, forming the motif sequence includes:

[0156] In the initial financial time series and the reconstructed envelope sequence, the numerical fields and energy values ​​at the corresponding time points are obtained in chronological order. A time-aligned index sequence is constructed by comparing the record integrity of the two sequences at the same time point.

[0157] The initial financial time series is supplemented based on the time-aligned index sequence. The supplemented financial series is formed by inserting compensation values ​​consisting of the differences between adjacent time points into the missing time points.

[0158] The process of forming a compensation financial sequence includes: identifying the time point position of the missing record in the initial financial time series in the time alignment index sequence; obtaining the numerical field of the time point before the missing position and the numerical field of the time point after the missing position and calculating the difference between the two to obtain the difference value; adding the difference value to the numerical field of the time point before the missing position to generate a compensation value for filling the missing point; and inserting the compensation value into the position corresponding to the missing time point, so that the record of the missing position in the time dimension is filled by the compensation value and a compensation financial sequence is formed.

[0159] The reconstructed envelope sequence is energy-corrected based on the time-aligned index sequence to form a corrected envelope sequence.

[0160] The energy correction process includes: identifying discontinuous positions in the time dimension of the reconstructed envelope sequence in the time alignment index sequence; obtaining the energy value of the time point before and after the discontinuous position and calculating the difference between them to obtain the energy difference value; constructing a correction energy value that is proportional to the corresponding difference value based on the energy difference value; inserting the correction energy value into the time point corresponding to the discontinuous position; and forming a correction envelope sequence by making the energy value of the corresponding position consistent with the energy change trend of the time points before and after the discontinuous position.

[0161] The amplitude weight sequence is formed by calculating the amplitude difference between the compensated financial sequence and the corrected envelope sequence at the same time point and mapping the amplitude difference to amplitude weights.

[0162] The magnitude weight sequence is applied to the compensation financial sequence and the adjustment envelope sequence respectively to generate a weighted alignment sequence;

[0163] The weighted aligned sequence is continuously smoothed in the time dimension, and the radix sequence is formed by differential compression of the composite values ​​at adjacent time points.

[0164] In this embodiment, forming the secondary risk intensity sequence includes:

[0165] Obtain all numerical fields at each time point from the radix sequence, and construct a field sorting sequence by sorting the same numerical field at all time points from smallest to largest.

[0166] Calculate the cumulative position ratio of each time point in the corresponding field based on the field sorting sequence, and use the cumulative position ratio as the cumulative probability of the field.

[0167] The calculation of the cumulative position ratio of each time point in the corresponding field includes: assigning a position index to the value of each time point in the corresponding field in ascending order in the field sorting sequence; obtaining the cumulative position ratio of the corresponding time point by subtracting the position index of the smallest value from the position index and dividing the result by the total length of the field sorting sequence minus the position index of the smallest value; so that the cumulative position ratio can reflect the relative cumulative position of the corresponding time point in the field sorting sequence.

[0168] Extract the probability value at the upper bound of the probability interval from the cumulative probability of the field and calculate the tail offset of the field at each time point. Arrange the tail offsets in the order of time points to form the field tail offset sequence.

[0169] The field tail offset sequence of all fields is aggregated point by point over time. The weighted combination operation of the field tail offsets at the same time point is used to form the offset aggregate value corresponding to the time.

[0170] All offset aggregate values ​​are linearly transformed based on the maximum and minimum offset aggregate values ​​to form a quadratic risk intensity sequence.

[0171] In this embodiment, the risk identification result includes:

[0172] The numerical field of each time point is obtained from the primal sequence, and the risk intensity value of the corresponding time point is obtained from the secondary risk intensity sequence. A time mapping index sequence is formed by establishing a one-to-one correspondence between the risk intensity value and the numerical field.

[0173] For each time point in the time-mapped index sequence, the magnitude of the numerical field vector is calculated. The disturbance intensity value is generated by multiplying the magnitude by the risk intensity value and then arranged in chronological order to form a disturbance intensity sequence.

[0174] A sliding time window is constructed on the disturbance intensity sequence, and a window statistical sequence is formed by calculating the approximate mean and standard deviation of the disturbance intensity values ​​within each time window;

[0175] Based on the numerical relationship between the approximate mean and the approximate standard deviation in the window statistical sequence, a set of risk classification thresholds is calculated for each time window. The first risk threshold is obtained by adding the approximate mean and the first standard deviation, the second risk threshold is obtained by adding the approximate mean and the second standard deviation, and the third risk threshold is obtained by adding the approximate mean and the third standard deviation, thus forming the risk classification thresholds.

[0176] The disturbance intensity value at each time point in the disturbance intensity sequence is compared with the corresponding risk classification threshold on the time axis. When the disturbance intensity value is between the first risk threshold and the second risk threshold, it is marked as medium risk. When the disturbance intensity value exceeds the second risk threshold but does not exceed the third risk threshold, it is marked as high risk. When the disturbance intensity value exceeds the third risk threshold, it is marked as extremely high risk, thus forming a risk level marking sequence.

[0177] The risk level label sequence and the motif sequence are processed together. By merging intervals with the same risk level label at consecutive time points in the time dimension, a list of risk segments is constructed. The start time, end time, risk level and corresponding secondary risk intensity statistics are recorded in each risk segment, and the risk identification results are output.

[0178] In this embodiment, a financial intelligent supervision system based on big data analysis includes:

[0179] The data acquisition module is used to obtain multi-source financial records from different financial business systems and generate a timestamp for each record;

[0180] The time series construction module is used to sort multi-source financial records according to timestamp order, perform field consistency verification, time interval correction and unit standardization processing, and output the initial financial time series.

[0181] The residual energy analysis module is used to perform Hampel filtering on the initial financial time series. It generates a residual energy envelope sequence by calculating the window median, absolute deviation median, and residual strength, and then performing nonlinear compression.

[0182] The morphological feature modeling module is used to construct a morphological feature vector sequence based on the initial financial time series and the residual energy envelope sequence, and to perform anomaly deviation calculation to generate the first anomaly score sequence.

[0183] The reversal and reconstruction module is used to perform reversal and reconstruction processing on the residual energy envelope sequence based on the first anomaly scoring sequence and generate a reconstructed envelope sequence.

[0184] The structure alignment module is used to perform time alignment, point filling, energy adjustment, amplitude weight synthesis, and continuity smoothing to generate a sequence sequence based on the initial financial time series and the reconstructed envelope sequence.

[0185] The ECOD distribution assessment module is used to construct a field sorting sequence, field cumulative probability, field tail offset and offset aggregation value based on the radix sequence, and to perform an interval linear transformation on the offset aggregation value to generate a quadratic risk intensity sequence.

[0186] The risk intensity calculation module is used to apply the secondary risk intensity sequence to the motif sequence and generate a risk level label sequence by calculating the magnitude of the numerical field vector, the perturbation intensity, the window statistic, and the risk classification threshold.

[0187] The risk identification module is used to construct a list of risk segments based on the risk level label sequence and output the risk identification results.

[0188] Example 1:

[0189] To verify the feasibility of this invention in practice, a financial intelligent supervision method based on big data analysis was applied to a risk identification task involving large-scale financial flow data. Monitoring and modeling were performed on multi-source financial business data covering approximately 180,000 records over 90 consecutive days. The comprehensive performance of this method in complex time series structure reconstruction, anomaly deviation identification, and risk intensity classification was evaluated. In this scenario, conventional financial risk control systems typically rely on manual rules, static thresholds, and single-dimensional fluctuation analysis methods, which cannot handle high-frequency state noise, dynamic structural deformation, and cross-field coupling anomalies. Especially when sudden risk events occur, their ability to analyze residual fluctuations is limited, leading to delayed or misjudged risk labeling. This invention constructs residual energy envelope sequences, foldback reconstruction sequences, sequence sequences, and secondary risk intensity sequences, combined with an ECOD distribution assessment model, to achieve multi-level risk signal extraction and continuous mapping, effectively compensating for the shortcomings of traditional methods in terms of structural sensitivity and weak anomaly pattern characterization.

[0190] In the data processing stage, the collected multi-source financial fields are sorted according to timestamp order, and field consistency is checked and time intervals are corrected to construct an initial financial time series. A residual energy envelope sequence is then generated using Hampel filtering. In the residual energy analysis task, the system sets a window length of 31 for each time window, calculates the median and median absolute deviation, and estimates the residual intensity for each record, allowing the residual energy envelope sequence to characterize the local anomaly pressure within the sequence. In the sequence morphology modeling stage, a differential perturbation sequence, a perturbation gradient sequence, and a gradient curvature sequence are constructed. Curvature is used as a dynamic weight on the original time series to form a dynamically weighted sequence, enabling the morphological features to fully express the multidimensional information of the sequence in terms of amplitude, direction, and local structural changes. Subsequently, the system inputs the morphological feature vector into the ECOD anomaly detection model, constructs a dimensional empirical distribution, calculates the tail probability, and generates a first anomaly scoring sequence through distribution deviation mapping, forming the first level of anomaly characterization.

[0191] In the residual energy reconstruction stage, a reversal reconstruction process is performed on the residual energy envelope sequence. Reversal points are identified through the energy change sequence, and energy segments are extracted, reversed, and locally smoothed between two reversal points to form a reconstructed envelope sequence after sequential structure repair. Based on the reconstructed envelope sequence and the initial financial time series, point supplementation calculation, energy adjustment, and amplitude weight synthesis are performed using a time alignment index to ensure consistency between the two types of information on the time axis, thereby generating a sequence that reflects the evolution trend of the continuous structure. Subsequently, a field sorting sequence is constructed in the sequence, and the cumulative probability of each field is calculated. The tail offset of each field is extracted and multidimensional aggregation is performed to form a secondary risk intensity sequence covering all field coupling change information. Finally, the perturbation intensity is calculated based on the secondary risk intensity and the magnitude of the numerical field. A sliding time window is constructed, and window statistics are calculated. A risk grading threshold is constructed based on the mean approximation and standard deviation approximation. The risk level at all time points is marked, and a list of risk segments is finally output, including start and end times, risk level, and intensity statistics, to present the changing characteristics of the continuous risk structure in the sequence.

[0192] To evaluate the risk identification and abnormal structure modeling capabilities of the method of this invention in real-world scenarios, an experiment was conducted using 30 sets of key financial fields extracted over a continuous 90-day period. These fields included transaction fluctuation fields, account change fields, approval delay fields, cross-period record fields, and structural offset fields. After system execution, indicators such as sequence structure reconstruction effect, abnormal score deviation, secondary risk intensity stability, and risk segment identification accuracy were recorded. The table below shows the data structure deviation reconstruction effect and anomaly detection performance for five time segments.

[0193] Table 1 Comparison of Financial Time Series Structure Reconstruction and Anomaly Detection Performance

[0194] Time segment number Peak energy of the original residual Reconstructing peak energy First Abnormal Scoring Bias Secondary risk intensity amplitude Risk level identification results T-011 4.82 4.17 0.036 0.41 Medium risk T-024 5.33 4.98 0.029 0.52 High-level risk T-037 6.12 5.87 0.031 0.66 High-level risk T-052 7.41 6.92 0.044 0.83 Extremely high level of risk T-078 5.06 4.88 0.028 0.47 Medium risk

[0195] As can be seen from the data in the table, this invention can effectively compress high-frequency fluctuation noise and retain anomalous structural features in the residual energy reconstruction stage, keeping the difference between the reconstructed energy peak and the original peak stably within the range of 0.2 to 0.5, which contributes to the stability of subsequent motif construction. In the first anomaly scoring sequence, the anomaly deviations are all between 0.028 and 0.044, indicating that the anomaly extraction method based on empirical distribution mapping can effectively capture the tail behavior features across fields. In the further secondary risk intensity construction process, the aggregation mechanism of multidimensional tail offsets enhances the expressive ability of field coupling anomalies, enabling the risk intensity amplitude to show a clearer trend of increase. In particular, in segment T-052, the risk intensity amplitude reaches 0.83 and is ultimately identified as an extremely high level of risk, which is completely consistent with the large cross-period anomalies found in the subsequent manual audit.

[0196] Furthermore, the method of this invention effectively reduces the noise of frequently changing risk labels in the rule model by combining continuous merging and risk level labeling in the risk segment identification stage. This makes the finally identified risk segments more consistent with actual business logic in terms of temporal continuity and risk level stability. In the overall task execution, the method of this invention reduces the false alarm rate by about 42% and the false negative rate by about 31% in the anomaly detection stage compared with the model based on a single field threshold. The deviation of the start and end time of the risk segment is controlled within ±1 time point, and it exhibits high stability in structural reconstruction and anomaly classification tasks.

[0197] This embodiment verifies the effectiveness of the method of the present invention in structural analysis, anomaly mapping and risk classification of large-scale financial time series data. Through multi-level information fusion and distribution deviation modeling mechanism, it significantly improves the risk identification capability of complex financial sequences. It is particularly suitable for scenarios such as high-frequency trading monitoring, cross-cycle capital analysis and dynamic risk identification of multi-source financial data, and provides reliable technical support for building a more accurate and more stable intelligent financial supervision system.

[0198] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A financial intelligence monitoring method based on big data analysis, characterized in that, The method comprises the following steps: obtaining multi-source financial data and arranging them in time sequence to form an initial financial time series; performing Hampel filtering on the initial financial time series, calculating residual intensity according to the relationship between the window median value and the deviation, and performing nonlinear compression to form a residual energy envelope sequence; constructing a morphological feature vector sequence composed of the initial financial time series and the residual energy envelope sequence, and inputting the ECOD anomaly detection algorithm model to calculate the abnormal deviation degree according to the empirical distribution cumulative relationship to form a first abnormal score sequence; performing foldback reconstruction operation on the residual energy envelope sequence according to the mutation position and amplitude of the first abnormal score sequence in the time dimension to form a reconstructed envelope sequence; performing structure alignment processing on the reconstructed envelope sequence and the initial financial time series to form a base sequence; inputting the base sequence into the ECOD distribution tail evaluation process, calculating the tail deviation intensity at each time point and performing normalization processing to form a secondary risk intensity sequence; applying the secondary risk intensity sequence to the base sequence, establishing a disturbance intensity mapping for each time point and setting a risk classification threshold, and outputting a risk identification result. 2.The financial intelligent supervision method based on big data analysis of claim 1, wherein, The method for forming the initial financial time series comprises the following steps: obtaining multi-source financial data from different financial business systems, and labeling time stamps according to the data generation time to form an original financial record set; sorting the original financial record set according to the time stamp sequence to generate a time sequence record sequence; performing field consistency verification on the time sequence record sequence, eliminating records that do not meet the requirements by comparing the field format, field length and field value range, and forming a time sequence valid sequence; performing time interval correction processing on the time sequence valid sequence to form a time interval balanced sequence; performing dimension standardization processing on the time interval balanced sequence to form a dimension unified sequence; combining the field values of each time point into an ordered vector according to the sequence of the dimension unified sequence in the time dimension to form an initial financial time series. 3.The financial intelligence supervision method based on big data analysis of claim 1, wherein, The method for forming the residual energy envelope sequence comprises the following steps: reading the numerical field and time stamp information involved in each record from the initial financial time series, setting window length and sliding step values to form a window parameter set for Hampel filtering; based on the window parameter set, performing sliding window division processing on the initial financial time series, organizing records in each window in time sequence, and calculating the median value of the target numerical field in the window to form a window median value sequence; for each window in the window median value sequence, subtracting the target numerical field of each record in the corresponding window from the window median value and taking the absolute value to obtain an original residual sequence arranged in time sequence; for the original residual sequence, calculating the absolute deviation median value of the original residual in each window, and determining the residual intensity threshold value according to the numerical relationship between the window median value and the absolute deviation median value to form a residual intensity threshold value sequence; for the residual in the original residual sequence whose value is greater than the corresponding residual intensity threshold value sequence, performing compression operation with gradually slowed down amplitude growth rate to generate a nonlinear compressed residual sequence; The residual intensity of each time point in the nonlinear compression residual sequence is sequentially connected and locally smoothed in time sequence to form a residual energy envelope sequence.

4. The financial intelligence monitoring method based on big data analysis according to claim 1, characterized in that, The forming of the first anomaly score sequence comprises: According to the numerical field of each time point in the initial financial time sequence and the energy value of the corresponding time point in the residual energy envelope sequence, a difference disturbance sequence is constructed, and the disturbance amplitude corresponding to each time point is formed by calculating the difference amplitude and direction; The gradient change of the disturbance amplitude in the continuous time span is calculated for the difference disturbance sequence, and the disturbance gradient sequence is constructed by calculating the disturbance gradient of adjacent time points; According to the time continuity of the disturbance gradient sequence, the gradient curvature is calculated, the curvature value is generated by analyzing the gradient change of three continuous time points, and the curvature sequence describing the time change form is formed; The curvature sequence and the initial financial time sequence are structurally integrated at each time point, and the curvature value is used as a dynamic weight to act on the numerical field of the initial financial time sequence to form a dynamic weighted sequence; The dynamic weighted sequence and the residual energy envelope sequence are vectorized combined at each time point to form a shape feature vector sequence; The shape feature vector sequence is input into the ECOD anomaly detection algorithm model, the abnormal deviation degree of each vector in the feature space is calculated through the empirical distribution cumulative relationship, and the anomaly score rule is constructed according to the abnormal deviation degree to form the first anomaly score sequence.

5. The financial intelligence monitoring method based on big data analysis according to claim 1, characterized in that, The ECOD anomaly detection algorithm model comprises an input vector generation layer, a scale alignment layer, a dimension empirical distribution construction layer, a tail probability estimation layer, a multi-dimensional cumulative probability aggregation layer, a deviation mapping layer, a deviation normalization layer and an anomaly score output layer: The input vector generation layer is used to receive all numerical fields of each shape feature vector in the shape feature vector sequence, and combine all numerical fields into an input vector in a fixed order; The scale alignment layer is used to linearly stretch the interval of each dimension value of the input vector, and map each dimension value to a unified numerical interval; The dimension empirical distribution construction layer is used to sort the numerical values of all input vectors from small to large in each dimension of the input vector, and calculate the cumulative sorting position and cumulative probability value of each input vector in the corresponding dimension according to the sorting result to form a dimension empirical cumulative distribution; The tail probability estimation layer is used to calculate the tail probability of each input vector in each dimension according to the dimension empirical cumulative distribution; The multi-dimensional cumulative probability aggregation layer is used to aggregate the tail probabilities of the same input vector in all dimensions to form a multi-dimensional tail probability; The deviation mapping layer is used to map each input vector to a deviation value according to the multi-dimensional tail probability, and generate a deviation sequence by monotonically increasing mapping of the multi-dimensional tail probability; The deviation normalization layer is used to linearly transform all deviation values according to the maximum and minimum deviation values in the deviation sequence; The anomaly score output layer is used to output the normalized deviation value as the anomaly score of the corresponding time point in the first anomaly score sequence.

6. The financial intelligence monitoring method based on big data analysis according to claim 1, characterized in that, The foldback reconstruction operation on the residual energy envelope sequence comprises: Acquiring energy values at each time point in the residual energy envelope sequence, and forming an energy change sequence by calculating the difference between energy values at adjacent time points; According to the difference in change signs between adjacent time points in the energy change sequence, recording the positions of the change signs as turning points, and arranging all the turning points in time sequence to form a turning point position sequence; Constructing a local energy segment between adjacent turning points in the turning point position sequence, and forming a turning sequence segment by extracting all the energy values in the local energy segment and arranging them in reverse time order; Performing local smoothing processing on the turning sequence segment, and forming a smoothed turning segment by compressing the difference amplitude between adjacent values in the segment; Placing all the smoothed turning segments back to the original sequence position according to the corresponding time interval, and forming a reconstructed segment sequence by aligning the start and end time corresponding relationship of the segment with the time dimension in the residual energy envelope sequence; Performing boundary matching on the reconstructed segment sequence and the non-turning interval in the residual energy envelope sequence, and performing boundary transition insertion processing by calculating the difference between the energy values at the boundary; Combining all the segment sequences after the boundary transition insertion processing with the non-turning interval values in time sequence to form a reconstructed envelope sequence.

7. The financial intelligence monitoring method based on big data analysis according to claim 1, characterized in that, The forming of the motif sequence comprises: Acquiring the value field and energy value at the corresponding time point in the initial financial time sequence and the reconstructed envelope sequence in time sequence, and constructing a time alignment index sequence by comparing the record integrity of the two sequences at the same time point; Performing point compensation processing on the initial financial time sequence according to the time alignment index sequence, and forming a compensated financial sequence by inserting a compensation value composed of the difference between adjacent time points into the missing time point; Performing energy calibration processing on the reconstructed envelope sequence according to the time alignment index sequence to form a calibrated envelope sequence; Forming an amplitude weight sequence by calculating the amplitude difference between the compensated financial sequence and the calibrated envelope sequence at the same time point and mapping the amplitude difference to an amplitude weight; Generating a weighted alignment sequence by applying the amplitude weight sequence to the compensated financial sequence and the calibrated envelope sequence respectively; Performing continuity smoothing processing on the weighted alignment sequence in the time dimension, and forming a motif sequence by performing difference compression operation on the synthesized values of adjacent time points. 8.The financial intelligent supervision method based on big data analysis of claim 1, wherein, The forming of the secondary risk intensity sequence comprises: Acquiring all the value fields at each time point in the motif sequence, and constructing a field ordering sequence by ordering the same value field of all time points from small to large; Calculating the cumulative position proportion of each time point on the corresponding field according to the field ordering sequence, and taking the cumulative position proportion as the field cumulative probability; Extracting the probability value at the upper limit of the probability interval from the field cumulative probability, and calculating the tail offset of each time point on the field, and arranging the tail offset of all fields in time sequence to form a field tail offset sequence; Performing time point by time point aggregation processing on the field tail offset sequence of all fields, and forming an offset aggregated value corresponding to the time by performing weighted combination operation on the tail offset of all fields at the same time point; Performing linear interval transformation on all offset aggregated values according to the maximum offset aggregated value and the minimum offset aggregated value to form a secondary risk intensity sequence. 9.The financial intelligence monitoring method based on big data analysis of claim 1, wherein, The risk identification result comprises: The numerical field of each time point is obtained in the motif sequence, the risk intensity numerical value of the corresponding time point is obtained in the quadratic risk intensity sequence, and the time mapping index sequence is formed by establishing a one-to-one correspondence between the risk intensity numerical value and the numerical field. For each time point in the time mapping index sequence, the length of the numerical field vector is calculated, the disturbance intensity numerical value is generated by multiplying the length and the risk intensity numerical value, and the disturbance intensity sequence is formed in time sequence. A sliding time window is constructed on the disturbance intensity sequence, and the window statistics sequence is formed by calculating the average value approximation and the standard deviation approximation of the disturbance intensity numerical value in each time window. According to the numerical relationship between the average value approximation and the standard deviation approximation in the window statistics sequence, a set of risk classification thresholds is calculated for each time window. The disturbance intensity numerical value of each time point in the disturbance intensity sequence is compared with the corresponding risk classification threshold on the time axis to form the risk level marking sequence. The risk level marking sequence is combined with the motif sequence to output the risk identification result. 10.A financial intelligent supervision system based on big data analysis, performing the financial intelligent supervision method based on big data analysis of any one of claims 1 to 9. It includes: A data acquisition module for obtaining multi-source financial records from different financial business systems and generating a timestamp for each record; A time series construction module for sorting, field consistency verification, time interval correction and dimension standardization processing of multi-source financial records according to the timestamp order and outputting an initial financial time series; A residual energy analysis module for Hampel filtering of the initial financial time series, calculating the window median value, absolute deviation median value and residual intensity, and generating a residual energy envelope sequence through nonlinear compression; A morphological feature modeling module for constructing a morphological feature vector sequence according to the initial financial time series and the residual energy envelope sequence and generating a first abnormal score sequence through abnormal deviation operation; A fold reconstruction module for fold reconstruction processing of the residual energy envelope sequence according to the first abnormal score sequence and generating a reconstructed envelope sequence; A structure alignment module for time alignment, point filling, energy correction, amplitude weight synthesis and continuity smoothing processing of the initial financial time series and the reconstructed envelope sequence to generate a motif sequence; An ECOD distribution evaluation module for constructing a field ordering sequence, a field cumulative probability, a field tail offset and an offset aggregation value according to the motif sequence, and performing interval linear transformation on the offset aggregation value to generate a quadratic risk intensity sequence; A risk intensity calculation module for applying the quadratic risk intensity sequence to the motif sequence, calculating the length of the numerical field vector, the disturbance intensity, the window statistics and the risk classification threshold to generate the risk level marking sequence; A risk identification module for constructing a risk fragment list according to the risk level marking sequence and outputting a risk identification result.

Images