Financial sharing abnormity early warning method based on RPA robot

Abstract

The invention relates to the field of anomaly analysis and early warning, in particular to a financial sharing anomaly early warning method based on an RPA robot, and the method comprises the steps: obtaining financial commission data of a plurality of user sides, so as to extract the workflow operation characteristics of each user side; determining a user operation behavior abnormity characterization value of the user side according to the workflow operation characteristics corresponding to the current preset monitoring period of the user side in combination with the number of service labels related to the workflow submitted by the user side, so as to mark the user side; in response to the marking result, evaluating and analyzing the user side; and according to the evaluation analysis result, calling the correlation degree between the related service labels corresponding to the current preset monitoring period and the previous preset monitoring period, evaluating the abnormal level of the abnormal settlement operation, and sending out a corresponding early warning prompt signal. The method depends on RPA automation, the labor cost is reduced, meanwhile, the process efficiency is improved, the anomaly recognition accuracy is improved, and the misjudgment rate and the missed judgment rate are reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of anomaly analysis and early warning, and in particular to a financial sharing anomaly early warning method based on an RPA robot. BACKGROUND

[0002] The core value of the financial sharing center relying on RPA lies in reducing the cost of financial operation and improving the efficiency of business processing through large-scale processing and process optimization. On this basis, the diversification of enterprise business models leads to increasingly complex financial business scenarios and increasing implicit risk points. On the one hand, the demand for cross-business type financial processing increases; on the other hand, some user ends will use methods such as "splitting and submitting", "missing labels", and "cross-cycle adjustment" to simplify the process and avoid audits. Further, an anomaly early warning scheme integrating "operation characteristics, business labels, and cross-cycle data" is provided to accurately capture implicit risks and avoid problems such as loss of funds caused by risk omissions.

[0003] Chinese Patent Application Publication No. CN114219628A discloses a data processing method and system. The method includes obtaining user inputted to-be-inquired overdue information, the to-be-inquired overdue information carrying user portrait information of at least one user; if it is determined that the number of to-be-predicted users in the to-be-inquired overdue information is one, taking the to-be-inquired overdue information as an input of an overdue prediction model, predicting the to-be-inquired overdue information based on the overdue prediction model, and outputting a prediction result, the prediction result being used to indicate a probability that the to-be-predicted user in the to-be-inquired overdue information exists overdue, the overdue prediction model being obtained by training based on historical provident fund data; based on the size of the prediction result and a preset probability, determining whether the to-be-predicted user in the to-be-inquired overdue information exists overdue, and displaying. The scheme can not only improve the processing efficiency, but also accurately predict the provident fund loan overdue situation of the user.

[0004] However, the prior art still has the following problems, Traditional early warning methods mostly focus on "whether the amount of a single business exceeds the standard", "whether the payment object is in the blacklist", and other explicit rules, lack depth analysis of the correlation of the operation behavior of the user end and the consistency of the business logic, and thus a large number of implicit anomalies are difficult to be identified, which reduces the accuracy of anomaly identification and also reduces the misjudgment and omission rate of anomalies. SUMMARY

[0005] Therefore, the present application provides a financial sharing anomaly early warning method based on an RPA robot to overcome the problem in the prior art that most explicit anomaly identification rules lack depth analysis of the correlation of the operation behavior of the user end and the consistency of the business logic, which leads to a large number of implicit anomalies being difficult to be identified, and thus reduces the accuracy of anomaly identification and also reduces the misjudgment and omission rate of anomalies.

[0006] To achieve the above object, the application provides a financial sharing abnormal early warning method based on an RPA robot, which comprises the following steps: Obtaining financial proposal data of a plurality of user terminals to extract workflow operation characteristics of each user terminal, wherein the workflow operation characteristics comprise an average interval length of proposals and a total proposal amount exceeding amount; According to the workflow operation characteristics of the user terminal in the current preset monitoring period and the number of business labels involved in the workflow proposed by the user terminal, the user operation behavior abnormality representation value of the user terminal is determined to mark the user terminal; In response to the marking result, the user terminal is evaluated and analyzed, including, Based on the settlement characteristics of the remaining unsettled amount of the user terminal in the last preset monitoring period, whether it meets the settlement split redundancy standard is determined, the average difference between the split amount and the approval amount corresponding to the current preset monitoring period and the historical split frequency of the user terminal are called, the avoidance deviation representation parameter of the user terminal is analyzed to determine whether the user terminal has abnormal settlement operation; According to the determination result, the correlation degree between the business labels involved in the current preset monitoring period and the last preset monitoring period is called, the abnormal level of the abnormal settlement operation is evaluated, and the corresponding early warning prompt signal is sent out; The settlement characteristics include the number of remaining unsettled amounts and the total amount of the corresponding unsettled amounts.

[0007] Further, the process of determining the user operation behavior abnormality representation value of the user terminal comprises: The ratio of the average interval length of the proposal to the average interval length threshold value and the ratio of the total proposal amount exceeding amount to the total proposal amount exceeding amount threshold value are taken as the first audit avoidance feature; The ratio of the number of business labels involved in the workflow proposed by the user terminal to the number of business labels involved threshold value is taken as the second audit avoidance feature; The first audit avoidance feature and the second audit avoidance feature are weighted and summed to determine the user operation behavior abnormality representation value.

[0008] Further, the marking of the user terminal comprises: If the user operation behavior abnormality representation value of the user terminal is greater than or equal to the audit avoidance representation threshold value, the user terminal is marked.

[0009] Further, in response to the marking result, the user terminal is evaluated and analyzed, including: If any user terminal is marked, the user terminal is evaluated and analyzed.

[0010] Further, determine whether the settlement redundancy benchmark is met, including: If the remaining outstanding amount is less than the threshold for the remaining outstanding amount, and the total outstanding amount is less than the threshold for the total outstanding amount, then it is determined that the settlement split redundancy benchmark is met.

[0011] Furthermore, the process of analyzing the avoidance bias characterization parameters of the user end includes: The ratio of the average difference between the split amount and the approved amount to the average difference threshold is used as the first avoidance bias feature; The ratio of the user's historical split frequency to the historical split frequency threshold is used as the second avoidance bias feature; The sum of the first avoidance bias feature and the second avoidance bias feature is used as the avoidance bias characterization parameter.

[0012] Further, determining whether the user terminal has any abnormal settlement operations includes: If the avoidance deviation representation parameter on the user's end is less than the avoidance deviation representation parameter threshold, it is determined that there is an abnormal settlement operation on the user's end.

[0013] Furthermore, if the determination result indicates that there is an abnormal settlement operation on the user end, the correlation between the relevant business tags corresponding to the current preset monitoring period and the previous preset monitoring period is invoked to assess the abnormality level of the abnormal settlement operation and issue a corresponding early warning signal.

[0014] Furthermore, the process of assessing the anomaly level of the abnormal settlement operation includes: Pre-set the correspondence between anomaly levels and predetermined correlation ranges; Determine the correlation range to which the correlation between the business tags belongs; The anomaly level corresponding to the correlation interval is taken as the anomaly level of the anomaly settlement operation.

[0015] Furthermore, the warning signals correspond one-to-one with the anomaly levels.

[0016] Compared with existing technologies, this invention acquires financial request data from several user terminals to extract workflow operation characteristics for each user terminal. Based on the workflow operation characteristics of the user terminal in the current preset monitoring period, combined with the number of business tags involved in the workflow requested by the user terminal, anomaly representation values ​​of user operation behavior are determined to mark the user terminal. In response to the marking results, the user terminal is evaluated and analyzed. Based on the evaluation and analysis results, the correlation between the relevant business tags in the current preset monitoring period and the previous preset monitoring period is called to assess the anomaly level of the abnormal settlement operation and issue a corresponding early warning signal. This invention relies on RPA automation, reducing labor costs while improving process efficiency, and also improving the accuracy of anomaly identification, reducing the false positive and false negative rates.

[0017] In particular, this invention considers the characteristics of user-side operational behavior and the complexity of the business involved. In practice, processes such as expense reimbursement in user-side workflows often involve "amount reaching a threshold triggering leadership approval." To circumvent the "large amount triggering approval" rule, users may split large transactions that could be submitted all at once into multiple smaller requests below the approval threshold—a practice known as splitting requests. Therefore, the average interval between user requests is used as a key indicator to capture this splitting behavior, quantifying the degree of abnormality in request frequency and directly linking it to the user's motivational avoidance tendencies. Furthermore, the excess amount of the corresponding request relative to the approval threshold reflects the user's deliberate attempt to control the amount per request to circumvent approval. If a user exhibits an avoidance tendency, they will deliberately keep the amount requested in a single transaction slightly below the approved threshold. Based on the total difference between the amounts involved in several requests within the current preset monitoring period and the approved threshold for a single transaction, this invention detects the user's deliberate attempt to keep the amount below the approved threshold for each transaction while accumulating large payments through multiple transactions. This invention comprehensively quantifies the temporal intensity and amount control intensity of user-side avoidance of review based on workflow operation characteristics. Furthermore, business tags are concrete annotations of the business types, stages, and rules involved in the workflow. Correspondingly, the number of tags is positively correlated with business complexity, and combined with the average interval of user requests, it can further reflect the deliberate nature of the avoidance of review. Therefore, this invention calculates user behavior anomaly representation values ​​to characterize the degree of anomaly in the user's operational behavior and the overall risk level of the user's use of workflow requests to avoid review, providing data support for subsequent user tagging, thereby achieving early tagging of operational anomalies and improving the accuracy of operational anomaly identification.

[0018] In particular, this invention establishes a two-layer progressive verification mechanism for settlement anomalies, consisting of a redundancy benchmark for settlement splitting and a parameter for avoiding deviations. First, it filters reasonable splitting scenarios. Traditional financial settlement anomaly detection often focuses on whether the amount of a single transaction after splitting is compliant, but it cannot identify hidden risks of unnecessary splitting to circumvent audits. Then, it uses the parameter for avoiding deviations to pinpoint deliberate circumvention behavior on the user's end. Furthermore, in financial settlement scenarios, splitting settlements is not inherently abnormal; phased payments of large outstanding amounts are normal business practices. The risk lies in unnecessary splitting by the user end. By using avoidance deviation representation parameters, the deliberate avoidance behavior of the user end is transformed from a qualitative description into a quantitative indicator. The accuracy of the user end's control over the split amount to avoid triggering approval is quantified based on the average difference between the split amount and the approved amount, reflecting the strength of the avoidance intention. Moreover, considering the user end's historical splitting frequency, by capturing unnecessary but high-frequency splitting to circumvent large-amount approvals, the abnormal intensity of the user end's splitting behavior and the degree of avoidance at the splitting frequency level are quantified. Therefore, this invention, by evaluating avoidance deviation representation parameters, characterizes the overall deviation degree of the user end's use of split settlements to avoid approval, providing core data support for subsequent anomaly level assessment and tiered early warning. This invention can accurately identify hidden settlement anomalies and reduce the missed detection rate of settlement anomalies.

[0019] In particular, by dynamically assessing the level of user-end operation anomalies based on the correlation between business operations, relevant managers can prioritize handling highly correlated anomalies according to their severity, avoiding resource waste caused by indiscriminate warnings and optimizing the allocation of risk response resources. Furthermore, the anomaly level is directly linked to the scope of business impact, providing relevant managers with more accurate decision-making basis and avoiding over- or under-processing caused by unreasonable level classifications in traditional solutions. This improves the operational efficiency of the financial shared service center and enhances the practicality of early warning decisions. Attached Figure Description

[0020] Figure 1 This is a schematic diagram illustrating the steps of the financial sharing anomaly early warning method based on RPA robot according to an embodiment of the invention. Figure 2 This is a logic decision diagram for marking the user terminal in an embodiment of the invention; Figure 3 A logic diagram for determining whether the settlement redundancy benchmark is met in an embodiment of the invention; Figure 4 This is a logic diagram for determining whether an abnormal settlement operation exists on the user's end, as shown in the embodiment of the invention. Detailed Implementation

[0021] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0022] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0023] Please see Figure 1 The diagram illustrates the steps of the financial sharing anomaly early warning method based on RPA robots according to an embodiment of the present invention. The financial sharing anomaly early warning method based on RPA robots according to an embodiment of the present invention includes: Step S1: Obtain financial request data from several user terminals to extract workflow operation characteristics of each user terminal. The workflow operation characteristics include the average request interval and the amount of request exceeding the total amount. Step S2: Based on the workflow operation characteristics of the user terminal in the current preset monitoring period and the number of business tags involved in the workflow requested by the user terminal, determine the abnormal characterization value of the user operation behavior of the user terminal, so as to mark the user terminal. Step S3, in response to the marking result, performs an evaluation and analysis on the user terminal, including: Based on the settlement characteristics of the remaining outstanding payments in the previous preset monitoring period of the user terminal, it is determined whether the settlement split redundancy benchmark is met. The average difference between the split amount and the approved amount corresponding to the current preset monitoring period and the historical split frequency of the user terminal are called to analyze the avoidance deviation characterization parameters of the user terminal in order to determine whether there is an abnormal settlement operation on the user terminal. Step S4: Based on the judgment result, call the correlation degree between the relevant business tags corresponding to the current preset monitoring period and the previous preset monitoring period, assess the abnormality level of the abnormal settlement operation, and issue a corresponding early warning signal. The settlement features include the number of remaining outstanding payments and the corresponding total amount of outstanding payments.

[0024] Specifically, the historical financial data includes workflow operation characteristics of the user terminal, the number of business tags involved in the workflow requested by the user terminal, settlement characteristics, the average difference between the split amount and the approval amount, the historical split frequency of the user terminal, and the correlation between business tags, etc.

[0025] There are no specific limitations on the methods for collecting historical financial data. Log collection tools can be used to centrally collect operation logs from user terminals scattered across various system modules. Then, combined with system interface connections, data such as the number of business tags and the relationships between business tags can be supplemented. Of course, other methods can also be used for collection, which will not be elaborated here.

[0026] Specifically, the preset monitoring period is set to 1 month.

[0027] Specifically, the process of determining the abnormal user behavior representation value on the user terminal includes: The sum of the ratio of the average duration of the request interval to the average duration of the request interval and the ratio of the excess amount of the total amount of requests to the threshold for the excess amount of the total amount of requests is used as the first audit avoidance feature. The ratio of the number of business tags involved in the workflow requested by the user to the threshold number of business tags involved is used as the second audit avoidance feature; The weighted sum of the first audit avoidance feature and the second audit avoidance feature is determined as the abnormal user operation behavior representation value.

[0028] Specifically, the essence of the abnormal user behavior representation value is to measure the subjective intent and intensity of the user's behavior in circumventing review by submitting workflow requests, rather than simply assessing business complexity. Therefore, when assigning weight coefficients to the corresponding features, the focus should be on features that directly reflect circumvention behavior, rather than features that assist in calibrating the rationality of the operation, to ensure that the abnormal user behavior representation value can accurately capture the real risk of circumvention. The average request interval and the excess amount of the request are the direct action carriers of review circumvention behavior. The value of the first review circumvention feature determined based on workflow operation features is positively correlated with the intensity of the user's circumvention intent. The higher the value, the higher the matching degree between the user's operation strategy and the review circumvention, which is the core basis for anomaly judgment. Therefore, the first review circumvention feature calculated based on workflow operation features, namely the average request interval and the excess amount of the request, is given a higher weight coefficient, set to 0.6. Correspondingly, the weight coefficient of the second review circumvention feature calculated based on the number of business tags involved in the workflow submitted by the user is set to 0.4.

[0029] In this embodiment, the purpose of setting thresholds for the average request interval, the total request amount exceeding the threshold, and the number of business tags involved are all to characterize situations where the user's operational behavior is highly abnormal and the overall risk of the user circumventing review through workflow request operations is high. By obtaining historical financial data corresponding to several historical preset monitoring periods, calling historical data on the average request interval, the total request amount exceeding the historical threshold, and the number of business tags involved in the user's requested workflow, the average average request interval, the average total request amount exceeding the historical threshold, and the average number of business tags involved are calculated and used as the benchmark under normal circumstances. Based on the purpose of setting the above three thresholds, the average duration threshold for request intervals is determined as the product of the average duration of request intervals and the duration deviation coefficient; the threshold for the excess amount of the total request amount is determined as the product of the average excess amount of the total request amount and the total amount deviation coefficient; and the threshold for the number of business tags involved is determined as the product of the average number of business tags involved and the number deviation coefficient. The duration deviation coefficient is selected within the range [0.9, 0.95], preferably 0.9 in practice; the total amount deviation coefficient is selected within the range [1.15, 1.2], preferably 1.15 in practice; and the number deviation coefficient is selected within the range [1.1, 1.2], preferably 1.1 in practice.

[0030] Specifically, this invention considers the characteristics of user-side operational behaviors and the complexity of the business involved. In practice, user-side workflows involving reimbursement amounts often involve situations where "amount reaching a threshold triggers leadership approval." To circumvent the "large amount triggering approval" rule, users may split large transactions that could be submitted all at once into multiple smaller requests below the approval amount—a practice known as splitting requests. Therefore, the average request interval of the user-side is used as a key indicator to capture this splitting behavior, quantifying the degree of abnormality in request frequency and directly linking it to the user's motivational avoidance tendencies. Shorter request intervals indicate a greater deviation from the normal business rhythm and a higher tendency to circumvent approval through frequent splitting. Furthermore, the excess amount of the corresponding request relative to the approval threshold reflects the user's deliberate attempt to control the amount per request to circumvent approval. If a user exhibits an evasion tendency, they will deliberately keep the amount requested in a single transaction slightly below the approved threshold. Based on the total difference between the amounts involved in several requests within the current preset monitoring period and the approved threshold for a single transaction, this invention detects the user's deliberate attempt to keep the amount per transaction below the approved threshold while accumulating large payments through multiple transactions. This invention comprehensively quantifies the temporal intensity and amount control intensity of user-side evasion of auditing based on workflow operation characteristics. Furthermore, business tags are concrete labels representing the business types, stages, and rules involved in the workflow. Correspondingly, the number of tags is positively correlated with business complexity. Combined with the average request interval of the user, this further reflects the deliberate nature of audit evasion. For example, a large number of business tags indicates a more complex business, and the normal interval should be longer, but if the average request interval is still short, it indicates a stronger deliberate attempt to evade auditing. Therefore, this invention calculates the abnormality representation value of user terminal behavior to characterize the degree of abnormality of the operation behavior performed by the user terminal, as well as the overall risk level of the user terminal requesting operation through workflow to avoid review, providing data support for subsequent marking of the user terminal, thereby realizing early marking of operation abnormalities and improving the accuracy of operation abnormality identification.

[0031] Specifically, please refer to Figure 2 As shown, this is a logic decision diagram for marking the user terminal according to an embodiment of the present invention. Marking the user terminal includes: If the abnormal user behavior value on the user terminal is greater than or equal to the audit avoidance threshold, the user terminal will be marked. If the abnormal user behavior value on the user terminal is less than the audit avoidance threshold, then there is no need to mark the user terminal.

[0032] The audit avoidance threshold is predetermined. It is determined by calculating the audit avoidance value when the average request interval threshold is equal to the average request interval, the total request amount exceeds the threshold, and the number of business tags involved in the workflow requested by the user is equal to the threshold for the number of business tags involved.

[0033] Specifically, in response to the labeling results, the user terminal is evaluated and analyzed, including: If any user terminal is marked, then the user terminal is evaluated and analyzed.

[0034] Specifically, please refer to Figure 3 As shown, this is a logic diagram for determining whether the settlement redundancy benchmark is met according to an embodiment of the present invention. Determining whether the settlement redundancy benchmark is met includes: If the remaining outstanding amount is less than the threshold for the remaining outstanding amount, and the total outstanding amount is less than the threshold for the total outstanding amount, then it is determined that the settlement split redundancy benchmark is met.

[0035] In this embodiment, the purpose of setting the threshold for the number of outstanding payments and the threshold for the total amount of outstanding payments is to characterize the situation where there are many outstanding payments and large amounts in the previous preset monitoring period, which may lead to a high risk of requesting avoidance and a serious interference with the current preset monitoring period. By obtaining historical financial data corresponding to several historical preset monitoring periods, calling several historical data on the number of outstanding payments and the corresponding historical data on the total amount of outstanding payments in the previous preset monitoring period relative to any preset monitoring period, the average number of outstanding payments and the average total amount of outstanding payments are calculated and used as the benchmark values ​​under normal circumstances. Based on the purpose of setting the above two thresholds, the threshold for the number of outstanding payments is determined as the product of the average number of outstanding payments and the first deviation coefficient, and the threshold for the total amount of outstanding payments is determined as the product of the average total amount of outstanding payments and the second deviation coefficient. The first deviation coefficient is selected in the interval [1.2, 1.4], preferably 1.2 in practice, and the second deviation coefficient is selected in the interval [1.1, 1.2], preferably 1.1 in practice.

[0036] Specifically, the process of analyzing the avoidance bias characterization parameters of the user end includes: The ratio of the average difference between the split amount and the approved amount to the average difference threshold is used as the first avoidance bias feature; The ratio of the user's historical split frequency to the historical split frequency threshold is used as the second avoidance bias feature; The sum of the first avoidance bias feature and the second avoidance bias feature is used as the avoidance bias characterization parameter.

[0037] Specifically, the historical split frequency refers to the number of times a user client requests a split for the same type of service within a preset monitoring period.

[0038] It is understandable that in the daily expense reimbursement management of enterprises, a key process is established based on the four core needs of financial risk prevention and control, internal control and compliance management, budget control and accountability. The mechanism is designed such that "when the reimbursement amount reaches the approval amount, it needs to be approved by the corresponding level of leader". Based on this, the approval amount refers to the amount that triggers the leader's review, which will not be elaborated further.

[0039] In this embodiment, the purpose of setting the average difference threshold and the historical splitting frequency threshold is to characterize the abnormal intensity of user-side settlement splitting and the overall deviation of user-side settlement circumvention of review through splitting. By obtaining historical financial data corresponding to several historical preset monitoring periods, calling historical data of the average difference between the splitting amount and the approved amount and historical data of the user-side historical splitting frequency, the average difference mean and the historical splitting frequency mean are calculated and used as the benchmark value under normal circumstances. Based on the purpose of setting the above two thresholds, the average difference threshold is determined as the product of the average difference mean and the difference deviation coefficient, and the historical splitting frequency threshold is determined as the product of the historical splitting frequency mean and the splitting deviation coefficient. The difference deviation coefficient is selected in the interval [1.1, 1.15], preferably 1.1 in the implementation, and the splitting deviation coefficient is selected in the interval [1.2, 1.4], preferably 1.2 in the implementation.

[0040] Specifically, this invention establishes a two-tiered progressive verification mechanism for settlement anomalies, consisting of a redundancy benchmark for settlement splitting and a parameter for avoiding deviations. First, it filters reasonable splitting scenarios. Traditional financial settlement anomaly detection often focuses on whether the amount of a single split transaction is compliant, but it fails to identify hidden risks of unnecessary splitting to circumvent audits, such as frequent splitting despite minimal outstanding payments. Then, it uses the parameter for avoiding deviations to identify deliberate circumvention behaviors by users, such as users bypassing leadership approval through frequent, small-amount splitting. Furthermore, in financial settlement scenarios, splitting settlements is not inherently abnormal; phased payments of large outstanding amounts are normal business practices. The risk lies in unnecessary splitting by the user end. By using avoidance deviation representation parameters, the deliberate avoidance behavior of the user end is transformed from a qualitative description into a quantitative indicator. The accuracy of the user end's control over the split amount to avoid triggering approval is quantified based on the average difference between the split amount and the approved amount, reflecting the strength of the avoidance intention. Moreover, considering the user end's historical splitting frequency, by capturing unnecessary but high-frequency splitting to circumvent large-amount approvals, the abnormal intensity of the user end's splitting behavior and the degree of avoidance at the splitting frequency level are quantified. Therefore, this invention, by evaluating avoidance deviation representation parameters, characterizes the overall deviation degree of the user end's use of split settlements to avoid approval, providing core data support for subsequent anomaly level assessment and tiered early warning. This invention can accurately identify hidden settlement anomalies and reduce the missed detection rate of settlement anomalies.

[0041] Specifically, please refer to Figure 4 As shown, this is a logic diagram for determining whether an abnormal settlement operation exists on the user terminal according to an embodiment of the present invention. Determining whether an abnormal settlement operation exists on the user terminal includes: If the avoidance deviation representation parameter on the user side is less than the avoidance deviation representation parameter threshold, it is determined that there is an abnormal settlement operation on the user side. If the user's deviation avoidance parameter is greater than or equal to the deviation avoidance parameter threshold, it is determined that there is no abnormal settlement operation on the user's end.

[0042] The avoidance deviation characterization parameter threshold is predetermined. The avoidance deviation characterization parameter threshold is determined by calculating the average difference between the split amount and the approval amount and the average difference threshold, and the historical split frequency on the user side and the historical split frequency threshold.

[0043] Specifically, if the judgment result indicates that there is an abnormal settlement operation on the user end, the correlation between the relevant business tags corresponding to the current preset monitoring period and the previous preset monitoring period is called to assess the abnormality level of the abnormal settlement operation and issue a corresponding early warning signal.

[0044] Specifically, the process of assessing the anomaly level of the abnormal settlement operation includes: Pre-set the correspondence between anomaly levels and predetermined correlation ranges; Determine the correlation range to which the correlation between the business tags belongs; The anomaly level corresponding to the correlation interval is taken as the anomaly level of the anomaly settlement operation.

[0045] In this embodiment, the abnormality level of abnormal settlement operations is determined as follows: The correlation between business tags is divided into three preset ranges, and three levels of abnormality are set. If the correlation between the business tags is within the first preset range [0, R0), then it corresponds to the first abnormal level; If the correlation between the business tags is within the second preset range [R0, 1.2R0), then it corresponds to the second abnormal level; If the correlation between business tags is within the third preset range [1.2R0, +∞), then it corresponds to the third abnormal level.

[0046] In this embodiment, the co-occurrence frequency of the relevant business tags in a single complete workflow is used as the correlation degree. To characterize the correlation between the relevant business tags, a correlation degree threshold greater than or equal to the correlation degree threshold is defined as the correlation between the relevant business tags. Based on the existence of a correlation relationship, the correlation strength between the relevant business tags is determined according to the correlation degree. Specifically, by acquiring historical data on the relevance of business tags involved in several workflows for the same type of business from the same user terminal, the mean relevance is calculated, and based on the purpose of setting the relevance threshold, the mean relevance is used as the relevance threshold R0.

[0047] Specifically, the warning signals correspond one-to-one with the anomaly level; The first level of abnormality corresponds to warning signal 1, which includes a top yellow warning item and push notifications to relevant personnel, such as financial specialists. The second abnormal level corresponds to warning signal 2, which includes a top orange warning item and push notifications to relevant personnel, such as the finance manager and the head of the department involved. The third abnormality level corresponds to warning signal 3, which includes a top-pinned red warning item and notifications sent to relevant personnel, such as the CFO and the head of the department involved.

[0048] Specifically, the system dynamically assesses the level of user-end operation anomalies based on the correlation between business operations. Relevant managers can prioritize handling highly correlated anomalies according to their severity, avoiding resource waste caused by indiscriminate warnings and optimizing risk response resource allocation. Furthermore, the anomaly level is directly linked to the scope of business impact, providing managers with more accurate decision-making basis. For example, highly correlated anomalies require cross-period data verification, while low-correlation anomalies only require single-period review. This avoids over- or under-processing caused by unreasonable level classifications in traditional solutions, improving the operational efficiency of the financial shared service center and enhancing the practicality of early warning decisions.

[0049] If the financial sharing anomaly early warning method based on RPA robots of the present invention is implemented in the form of software functional units and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present invention. The aforementioned storage medium includes various media that can store program code, such as USB flash drives, mobile hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0050] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A method for early warning of financial sharing anomalies based on RPA robots, characterized in that, include: Acquire financial request data from several user terminals to extract workflow operation characteristics for each user terminal, including the average request interval and the amount of total request exceeding the limit. Based on the workflow operation characteristics of the user terminal in the current preset monitoring period and the number of business tags involved in the workflow requested by the user terminal, the abnormal characterization value of the user operation behavior of the user terminal is determined so as to mark the user terminal. In response to the labeling results, the user terminal is evaluated and analyzed, including, Based on the settlement characteristics of the remaining outstanding payments in the previous preset monitoring period of the user terminal, it is determined whether the settlement split redundancy benchmark is met. The average difference between the split amount and the approved amount corresponding to the current preset monitoring period and the historical split frequency of the user terminal are called to analyze the avoidance deviation characterization parameters of the user terminal in order to determine whether there is an abnormal settlement operation on the user terminal. Based on the judgment result, the correlation between the relevant business tags corresponding to the current preset monitoring period and the previous preset monitoring period is called to assess the abnormality level of the abnormal settlement operation and issue a corresponding early warning signal. The settlement features include the number of remaining outstanding payments and the corresponding total amount of outstanding payments.

2. The financial sharing anomaly early warning method based on RPA robot according to claim 1, characterized in that, The process of determining the abnormal user behavior representation value of the user terminal includes: The sum of the ratio of the average duration of the request interval to the average duration of the request interval and the ratio of the excess amount of the total amount of requests to the threshold for the excess amount of the total amount of requests is used as the first audit avoidance feature. The ratio of the number of business tags involved in the workflow requested by the user to the threshold number of business tags involved is used as the second audit avoidance feature; The weighted sum of the first audit avoidance feature and the second audit avoidance feature is determined as the abnormal user operation behavior representation value.

3. The financial sharing anomaly early warning method based on RPA robot according to claim 2, characterized in that, Marking the user terminal includes: If the abnormal user behavior value on the user terminal is greater than or equal to the audit avoidance threshold, the user terminal will be marked.

4. The financial sharing anomaly early warning method based on RPA robot according to claim 3, characterized in that, In response to the labeling results, the user terminal is evaluated and analyzed, including: If any user terminal is marked, then the user terminal is evaluated and analyzed.

5. The financial sharing anomaly early warning method based on RPA robot according to claim 1, characterized in that, Determine whether the settlement redundancy benchmark is met, including: If the remaining outstanding amount is less than the threshold for the remaining outstanding amount, and the total outstanding amount is less than the threshold for the total outstanding amount, then it is determined that the settlement split redundancy benchmark is met.

6. The financial sharing anomaly early warning method based on RPA robot according to claim 1, characterized in that, The process of analyzing the avoidance bias characterization parameters of the user end includes: The ratio of the average difference between the split amount and the approved amount to the average difference threshold is used as the first avoidance bias feature; The ratio of the user's historical split frequency to the historical split frequency threshold is used as the second avoidance bias feature; The sum of the first avoidance bias feature and the second avoidance bias feature is used as the avoidance bias characterization parameter.

7. The financial sharing anomaly early warning method based on RPA robot according to claim 6, characterized in that, Determining whether the user terminal has an abnormal settlement operation includes: If the avoidance deviation representation parameter on the user's end is less than the avoidance deviation representation parameter threshold, it is determined that there is an abnormal settlement operation on the user's end.

8. The financial sharing anomaly early warning method based on RPA robot according to claim 7, characterized in that, If the judgment result indicates that there is an abnormal settlement operation on the user end, the correlation between the relevant business tags corresponding to the current preset monitoring period and the previous preset monitoring period is called to assess the abnormality level of the abnormal settlement operation and issue a corresponding early warning signal.

9. The financial sharing anomaly early warning method based on RPA robot according to claim 1, characterized in that, The process of assessing the anomaly level of the abnormal settlement operation includes: Pre-set the correspondence between anomaly levels and predetermined correlation ranges; Determine the correlation range to which the correlation between the business tags belongs; The anomaly level corresponding to the correlation interval is taken as the anomaly level of the anomaly settlement operation.

10. The financial sharing anomaly early warning method based on RPA robot according to claim 1, characterized in that, The warning signals correspond one-to-one with the anomaly level.

Images