Financial anomaly accurate positioning method and system based on anomaly propagation and multi-dimensional numerical fingerprints

Abstract

The invention discloses a financial anomaly accurate positioning method and system based on anomaly propagation and multi-dimensional numerical fingerprints, and the method employs a two-stage strategy of first recognizing the types of abnormal digits and then propagating the abnormal digits to specific records, analyzes whether the types of the digits significantly deviate from theoretical distribution (Benford's law or uniform distribution) through two-item tests, and finally obtains the accurate financial anomaly positioning result. And calculating a comprehensive abnormal score in combination with the rare degree weighting and the integral sensitivity weighting, and then spreading the score to each financial record. Compared with a traditional Leave-One-Out method, the method has the advantages that the calculation complexity is reduced to support real-time analysis of large-scale financial data; meanwhile, a complete attribution link from records to digital categories is provided, and the auditing and tracing requirements are met.

Description

Technical Field

[0001] This invention relates to the fields of financial technology and big data auditing technology, specifically to a computer processing method and system that uses anomaly propagation algorithms combined with multidimensional statistical constraints to accurately locate and attribute anomalies in financial data from macro-distribution to micro-document level. Background Technology

[0002] In the field of financial auditing and risk control, traditional anomaly detection methods mainly rely on rule engines (such as setting monetary thresholds for alerts) or single-dimensional statistical regularity analysis (such as applying Benford's law to detect one-dimensional numerical distributions). These methods generally suffer from the following drawbacks: Coarse-grained detection: Existing distribution tests (such as the chi-square test) can only determine whether the overall dataset is abnormal, but cannot pinpoint the specific record that caused the distribution anomaly; High computational complexity and low efficiency: While the traditional leave-one-out method can locate single points of failure, its computational complexity is high. It is difficult to handle the real-time analysis of large-scale financial data; Lack of statistical rigor: Most methods rely on empirical thresholds and do not perform significance analysis based on statistical tests, which can easily lead to false alarms; Ignoring numerical characteristics: failing to consider the inherent characteristics of different number categories, such as rare numbers being more suspicious and the last two digits (0 and 5) being more easily rounded up by human manipulation; Lack of interpretability: It only outputs risk scores and cannot trace the source of the deviation from the numerical pattern.

[0003] Therefore, there is an urgent need for a financial anomaly detection method and system that can accurately locate the specific data record from the category of abnormal numbers while ensuring statistical rigor and computational efficiency. Summary of the Invention

[0004] The purpose of this invention is to overcome the above-mentioned defects of the prior art and provide a method and system for accurate location of financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting. This method aims to solve the problems of coarse detection granularity, high computational complexity, lack of statistical rigor and interpretability in the prior art.

[0005] This invention provides a method for accurately locating financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting, comprising the following steps: S1. Data Multidimensional Slicing and Standardization: The original financial data is sliced ​​and reorganized according to multiple dimensions such as accounting subject, accounting period, and business type to construct a multidimensional data tensor, and then standardized and cleaned. S2. Establish a combined statistical detection model that includes constraints on the natural law of high-order digits (Benford's Law), constraints on the uniformity of low-order digits (tail entropy detection), and constraints on the numerical multiplicity density. S3. Construct a time series consistency constraint model: For numerical sequences of the same subject, establish a time series abrupt change detection model based on time series decomposition (such as STL decomposition) and residual analysis; S4. Anomaly Propagation Location and Attribution: Based on the significance analysis of the binomial test and the anomaly propagation algorithm, it achieves accurate location and risk scoring from "abnormal number category" to "specific financial record"; S5. Risk Profile Generation: Based on the final risk score, sort the data, output a list of high-risk vouchers, and generate an interpretable attribution label for each abnormal record.

[0006] Furthermore, step S1 specifically includes: Clean the original financial transaction records and define the set to be tested. Perform multi-scale mapping: Take the absolute value of negative numbers (for distribution analysis); Remove predefined fixed values ​​(such as tax rates of 0.06 and 0.13 to avoid interfering with the distribution); Extract the first and second digits and last digit .

[0007] Furthermore, the multidimensional numerical distribution constraints mentioned in step S2 include: A combined constraint system is adopted: (1) Benford's Law (a natural law constraint on high-order digits) Detect the distribution of the first and first two digits.

[0008] Benford's Law Expected Distribution:

[0009] Criterion for judgment: Calculate the actual distribution With expected distribution Kullback-Leibler divergence between:

[0010] like Exceeding the dynamic threshold The set is marked as "high-order anomaly".

[0011] (2) Tail Uniformity Constraint For the last or corner digits of a numerical value, detect traces of human manipulation (such as rounding or avoiding specific thresholds).

[0012] Algorithm: Calculate the Shannon Entropy of the last digit (0-9):

[0013] In theory, the last digit of a natural transaction should approach a uniform distribution, with an entropy value close to... .like A significant decrease indicates the presence of a large number of duplicate tails.

[0014] (3) Numerical multiplication density constraint Detects abnormal repetition frequencies of specific values. Employing the TF-IDF approach, it reduces the weight of globally common values ​​and highlights locally bursty high-frequency values.

[0015] Furthermore, the timing consistency constraint mentioned in step S3 specifically refers to: For the numerical sequence of the same accounting item, detect abrupt changes and anomalies in the time dimension.

[0016] Temporal mutation constraints: For time series data of the same subject, Seasonal-Trend Decomposition (STL) is used to remove seasonality and trend, and residual series are extracted. .

[0017] Anomaly detection: Perform a 3-Sigma statistical test on the residuals or use the Isolation Forest algorithm. If the residuals at a certain time point significantly deviate from the expected values, generate a time-series anomaly index. .

[0018] Furthermore, step S4 is the core innovation, and the anomaly propagation localization and attribution described in step S4 specifically includes the following sub-steps: The Anomaly Propagation Method is used to replace the traditional Leave-One-Out method, enabling precise localization from macroscopic distribution anomalies to microscopic record levels.

[0019] Step 4.1: Binomial significance analysis For the first digit set (in ), for each number category Perform a binomial test.

[0020] Null hypothesis :number The probability of its occurrence matches Benford's expectations.

[0021] Test statistic: Let the numbers be... The number of observations is The total sample size is ,but:

[0022] One-tailed tests are used, focusing only on cases where numbers are excessively frequent, because under-frequent occurrences do not constitute a suspicion of fraud.

[0023] Significance score transformation: Convert the p-value to a significance score in the range of 0-1.

[0024] when The smaller the value (i.e., the more significant the deviation), the better. The closer it is to 1.

[0025] Step 4.2: Benford Anomaly Propagation (a) Calculate the deviation for each number category For each first digit Calculate the relative deviation between its actual frequency and the expected frequency:

[0026] in For numbers The actual frequency of occurrence.

[0027] (b) Rarity-weighted According to Benford's Law, low-value numbers (such as 1 and 2) naturally occur more frequently, while high-value numbers (such as 8 and 9) occur less frequently. An unusually excessive occurrence of rare numbers is more suspicious. Therefore, a rarity weight is introduced:

[0028] This weighting gives the over-occurrence of the number 9 (with an expected probability of only 4.6%) a higher outlier weight than the number 1 (with an expected probability of 30.1%).

[0029] (c) Calculation of comprehensive abnormality score By combining deviation, rarity weights, and binomial significance test, the number category is calculated. Overall abnormality score:

[0030] in: Only considering overoccurrence ( ) situation; Significance factor The range is This ensures that the baseline score is retained even if the statistical test is not significant.

[0031] (d) Normalization

[0032] (e) Propagation of abnormal scores Propagate the outlier score for the numeric category to each record:

[0033] in For the first The first digit of the record.

[0034] Step 4.3: Tail Entropy Anomaly Propagation For the set of last digits (in In theory, the last digit of a natural transaction follows a uniform distribution.

[0035] (a) Deviation calculation Uniformly distributed desired frequency The deviation of each last digit is:

[0036] (b) Rounding sensitivity weighting When artificially manipulating financial data, there is a tendency to round amounts to "integer" (ending in 0) or "half-integer" (ending in 5). Introducing a rounding sensitivity weight:

[0037] (c) Significance of the binomial test A binomial test is performed on the last digit; the null hypothesis is that the last digit is digit. The probability of its occurrence follows a uniform distribution with an expected value of 0.10.

[0038] (d) Overall abnormal score

[0039] (e) Normalization and propagation

[0040]

[0041] in For the first The last digit of each record.

[0042] Step 4.4: Integrate the weighting of substantive monetary amounts with the final risk score Simple distribution anomalies may be minor noise. To comply with the principle of substantive auditing, monetary weights are introduced.

[0043] Final risk score:

[0044] in: These are the weighting coefficients for each constraint; the default values ​​are...

[0045] Penalize large transactions based on monetary importance. For context factors: Transactions that occurred over the weekend:

[0046] Transactions that occurred late at night (22:00-06:00):

[0047] Transactions occurring at the end of the month / quarter:

[0048] Normal time period:

[0049] Step 4.5: Multi-constraint conflict localization Establish anomaly vector .

[0050] If a certain value If multiple constraints are triggered simultaneously (such as violating both the Benford distribution and being a temporal outlier), the risk level increases exponentially:

[0051] in Indicates the number of constraints triggered.

[0052] S5: Output Results The system output includes: 1. Top-K Anomaly List: By Sorting specific voucher numbers, amounts, and dates 2. Attribution Labels: Label the cause for each anomaly, for example: "Voucher #12345 (High Risk): Excessive occurrence of the first digit 9 (deviation +180%, significance 0.92) + Huge amount" "Voucher #67890 (Medium Risk): Excessive occurrence of zeros at the end (suspicion of rounding)" 3. Anomaly propagation details: Outputs the deviation, significance score, and propagation weight for each number category, supporting audit traceability.

[0053] The present invention also provides a system for implementing the above method, comprising: Data preprocessing module: used for data cleaning, multidimensional slicing and feature extraction (first digit, last digit, timestamp); Distributed computation engine: Built-in KL divergence calculator, Shannon entropy calculator, and chi-square tester; Binomial test module: Performs a binomial test on each number category and calculates statistical significance; Anomaly propagation engine (core module): Time series analysis module: performs STL decomposition and residual anomaly detection; Risk scoring module: integrates multi-dimensional constraint scores, monetary weights, and contextual factors; Visualization output module: Generates a list of abnormal vouchers, attribution tags, and analysis reports; The anomaly propagation engine (core module) includes: Deviation calculation unit: Calculates the relative deviation of each number category; Weighting calculation unit: Calculates rarity weight and rounding sensitivity weight; Significance fusion unit: Incorporates the results of the binomial test into the outlier score; Score propagation unit: maps numerical category scores to specific records.

[0054] The financial anomaly precise location method and system based on anomaly propagation and multidimensional numerical fingerprinting proposed in this invention has the following beneficial effects: 1. Microscopic positioning of linear complexity: Anomaly propagation method reduces computational complexity from... Down to It supports real-time analysis of millions of financial data points, overcoming the computational bottleneck of the traditional Leave-One-Out method.

[0055] 2. Rigorous statistical anomaly detection: The introduction of binomial test for significance analysis avoids false alarms and false negatives caused by empirical thresholds, ensuring the scientific nature of anomaly detection.

[0056] 3. Domain-adaptive weight design: Rarity weighting makes the system more sensitive to anomalies of rare numbers (such as 9).

[0057] The rounding sensitivity weight enhances detection of typical patterns of financial fraud (rounding to 0 or 5).

[0058] 4. Complete attribution chain: The final risk score can be traced back to the specific numerical category deviation, statistical significance, and weight calculation process, meeting audit traceability and compliance requirements.

[0059] 5. Strong anti-interference capability: Combining Benford's Law (natural law), Shannon entropy (anti-modification) and the multidimensional constraints of time series models, it makes it difficult for attackers to satisfy all mathematical constraints at the same time, increasing the cost of fraud.

[0060] 6. In line with audit logic: The introduction of logarithmic weighting of amounts and context factors ensures that the system prioritizes reporting "large and abnormal" data, which is in line with the principle of audit substance. Attached Figure Description

[0061] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating the overall process of the anomaly propagation method of the present invention. Figure 2 This is a schematic diagram of the data flow in this invention; Figure 3 This is a rarity weight table for each first digit of the present invention; Figure 4 This diagram shows a technical comparison between the abnormal propagation method of the present invention and traditional methods. Figure 5 This is a schematic diagram of the data flow in this invention; Figure 6 This is the abnormal propagation process of the first digit of the present invention; Figure 7 This is the process for propagating the anomaly in the last digit of the present invention. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0063] Reference manual attached Figure 1 — Figure 7 As shown: Example 1: Detection of Typical Financial Fraud Scenarios Scenario description: In order to inflate profits, a company fabricated a large number of sales vouchers starting with "9" (such as 99,000 yuan, 95,000 yuan) in an attempt to bypass the integer approval threshold.

[0064] Testing process: 1. The system extracted the first digit of all sales vouchers and found that the number "9" appeared 124 times (out of a total of 2000 vouchers). 2. Ben Ford's expectations: Expected number of times = 92 3. Actual frequency:

[0065] 4. Deviation: (+34.8%) 5. Binomial test p-value = 0.00031, significance.

[0066] 6. Rarity weight:

[0067] 7. Overall Score:

[0068] Output result: 124 vouchers starting with the digit 9 were marked as high-risk. Attribution label: "Excessive occurrence of the first digit 9 (deviation +34.8%, statistically significant), consistent with characteristics of fraudulent sales receipts." Example 2: Detection of rounding up expense claims Scenario description: When submitting expense reports, finance staff habitually round the amount to a multiple of ten yuan (ending in 0) or a multiple of five yuan (ending in 5).

[0069] Testing process: 1. Statistical distribution of the last digit: The last digit 0 appeared 450 times, and the last digit 5 ​​appeared 380 times (total sample of 3000). 2. Uniform distribution expectation: The expectation of each last digit is 300 times. 3. Deviation of zero in the last digit: (+50%) 4. Rounding sensitivity weight:

[0070] 5. Overall Score:

[0071] Output result: Vouchers ending in 0 or 5 receive higher Tail anomaly scores. Attribution label: "Excessive occurrence of 0 / 5 at the end suggests possible manipulation to round up the number." It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, material, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, material, or apparatus.

[0072] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for precise localization of financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting, characterized in that, Includes the following steps: S1. Data Preprocessing: Preprocessing financial datasets Perform cleaning and extract the first digit of each record. and last digit ; S2, Binomial test significance analysis: for each number category Perform a binomial test and calculate its significance score: S3, Abnormal propagation of the first digit: (a) Calculate the first digit of each number. Deviation from Benford's expectations: ; (b) Calculate the rarity weights: ; (c) Calculate the comprehensive abnormality score: ; (d) After normalization, propagate the scores to the corresponding records: ; S4, Propagation of mantissa anomalies: (a) Calculate the last digit Deviation from a uniform distribution; (b) Apply rounding sensitivity weights to the last two digits, 0 and 5. ; (c) Calculate the overall anomaly score and propagate it to the corresponding record; S5. Risk Score Fusion: Combining the first digit score, last digit score, time series score, amount weight, and contextual factors to calculate the final risk score: S6. Output the sorted list of abnormal vouchers and their attribution labels.

2. The method for precise location of financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting as described in claim 1, characterized in that: The binomial test in step S2 uses a one-tailed test, focusing only on cases where numbers appear excessively.

3. The method for precise location of financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting as described in claim 1, characterized in that: The rarity weight in step S3(b) gives higher weight to rare numbers (such as 8 and 9) that are abnormally over-occurring than high-frequency numbers (such as 1 and 2).

4. The method for precise location of financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting as described in claim 1, characterized in that: The significance factor in step S3(c) The range is This ensures that the baseline score is retained even if the statistical test is not significant.

5. The method for precise location of financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting as described in claim 1, characterized in that: The rounding sensitivity weight in step S4 (b) enhances the detection of common rounding behaviors in financial data, assigning double weight to the last two digits 0 and 5.

6. The method for precise location of financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting as described in claim 1, characterized in that: The context factor in step S5 Unconventional times, such as weekend trading, late-night trading, and month-end / quarter-end trading, are assigned a weight greater than 1.

7. The method for precise location of financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting as described in claim 1, characterized in that: When a record triggers multiple abnormal conditions simultaneously, its risk score is increased accordingly based on the number of abnormal conditions triggered.

8. The method for precise location of financial anomalies based on anomaly propagation and multidimensional numerical fingerprinting as described in claim 1, characterized in that: The computational complexity of the method is It supports real-time processing of large-scale financial datasets.

9. A precise financial anomaly localization system based on anomaly propagation and multidimensional numerical fingerprinting, characterized in that: include Data preprocessing module: used to clean financial data and extract the first and last digits and timestamp features; Binomial test module: Used to perform a binomial test on each number category and output a statistical significance score; Anomaly propagation engine: includes deviation calculation unit, weight calculation unit, saliency fusion unit and score propagation unit, used to propagate anomalous scores at the numerical category level to specific records; Time series analysis module: used to perform time series decomposition and residual anomaly detection; Risk scoring module: used to integrate multidimensional constraint scores, monetary weights, and contextual factors to calculate the final risk score; Visualization output module: Used to generate a list of abnormal vouchers, attribution labels, and analysis reports.

10. The financial anomaly precise location system based on anomaly propagation and multidimensional numerical fingerprinting according to claim 9, characterized in that: The weight calculation unit in the anomaly propagation engine includes: Rarity weight calculation subunit: calculated based on Benford's expected probability. ; Rounding sensitivity weight calculation sub-unit: Assign double weight to the last two digits 0 and 5.

Images