A financial abnormal behavior intelligent analysis method fusing multi-source service data

Abstract

This invention relates to the field of data analysis, and more particularly to an intelligent analysis method for financial anomaly behavior that integrates multi-source business data. The method includes: collecting and standardizing raw data from diverse business sources; obtaining a time-series interval compression factor by quantitatively analyzing the degree of interval compression of supplier transaction time series; obtaining a threshold adhesion tension factor by nonlinearly modeling the relationship between transaction amount and approval threshold; obtaining an optimized clustering distance and performing cluster analysis by jointly correcting the distance of basic statistical features using the time-series interval compression factor and the threshold adhesion tension factor; and obtaining the financial anomaly behavior analysis result by comprehensively judging the cluster analysis results and corresponding factor values. This method addresses the problem in existing financial auditing where cluster analysis based on conventional Euclidean distance struggles to distinguish abnormal transaction behaviors with homogeneous statistical features but significantly different time-series distribution and approval threshold adhesion patterns.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, and in particular to an intelligent analysis method for financial anomaly behavior that integrates multi-source business data. Background Technology

[0002] As enterprises advance their digital transformation, operational activities such as procurement, contract performance, and fund settlement are continuously accumulated in the form of structured data within enterprise information systems. Financial risk control and internal auditing are gradually shifting from manual spot checks to intelligent analysis based on multi-source business data. In existing technologies, to identify potential fraudulent suppliers, abnormal procurement behavior, or irregular settlement patterns, data sources typically include the enterprise's procurement management system and fund settlement system. Historical transaction records of suppliers within a preset statistical period are aggregated and modeled, and clustering algorithms are used to automatically discover abnormal groups. A common approach is to extract statistical features such as total transaction amount, total transaction frequency, and average transaction amount from transaction records to construct supplier feature vectors. Then, the similarity between different supplier feature vectors is calculated based on conventional distance metrics such as Euclidean distance. Finally, density clustering or partitioning clustering algorithms are used to divide suppliers into multiple behavioral clusters, and outliers or specific clusters are output as abnormal objects to assist financial personnel in subsequent verification.

[0003] However, in actual corporate procurement and payment scenarios, simply relying on the aforementioned macroscopic statistical characteristics and using conventional Euclidean distance for cluster analysis often fails to reliably distinguish transaction patterns with homogeneous statistical characteristics but significantly different behavioral mechanisms, resulting in insufficient accuracy in anomaly identification. On the one hand, legitimate periodic fixed payment behaviors and illegal order splitting to circumvent approval behaviors may exhibit highly consistent total amounts, total frequency, and average amounts within the statistical period, making the distance between the two types of behaviors in the feature space extremely small or even overlapping. The clustering results easily classify them into the same category, leading to missed detections. On the other hand, even if existing technologies attempt to introduce time-related statistics into the feature vector, they often fail to function effectively due to the large differences in the dimensions and numerical scales of each dimension. For example, the amount feature is usually in the range of thousands to tens of thousands of yuan, while the transaction time interval feature is usually in the range of hours to days. When directly calculating Euclidean distance, the subtle distribution differences in the time dimension are easily masked by the numerical differences in the amount dimension, making it difficult for the algorithm to perceive the temporal closeness of transactions and the specific fit of transaction amounts to approval thresholds. Furthermore, in actual business operations, high-frequency and intensive transactions are not necessarily illegal. Enterprises may make multiple payments in a short period of time during project initiation, centralized procurement, or sudden spare parts needs. If there is a lack of quantitative characterization of the constraint relationship between transaction amount and approval threshold, existing clustering methods are prone to generating false alarms for legitimate transactions, increasing the review costs for risk control personnel, and reducing the usability and stability of audit models.

[0004] Therefore, how to build a distance measurement mechanism that can simultaneously characterize the density of transaction time distribution and the correlation of transaction amount thresholds for multi-source business data scenarios without relying on manually setting complex rules, in order to improve the ability of cluster analysis to identify hidden order splitting circumvention behavior and reduce the risk of misjudging legitimate dense business, has become an urgent problem to be solved by existing intelligent financial auditing technologies. Summary of the Invention

[0005] In view of this, the present invention aims to propose an intelligent analysis method for abnormal financial behavior that integrates multi-source business data, in order to solve the problem that existing financial auditing based on conventional Euclidean distance clustering analysis is unable to distinguish abnormal transaction behaviors with homogeneous statistical characteristics but significantly different temporal distribution and approval threshold matching patterns.

[0006] To achieve the above objectives, the technical solution of the present invention is implemented as follows:

[0007] A method for intelligent analysis of abnormal financial behavior that integrates multi-source business data, the method comprising:

[0008] Step S1: Obtain a set of basic transaction parameters by collecting raw data from various business operations, standardizing and processing the data;

[0009] Step S2: Obtain the time series interval compression factor by quantitatively analyzing the degree of interval compression of the supplier transaction time series;

[0010] Step S3: Obtain the threshold adhesion tension factor by performing nonlinear modeling on the fit between transaction amount and approval threshold;

[0011] Step S4: By jointly correcting the basic statistical feature distance with the temporal interval compression factor and the threshold adhesion tension factor, the optimized clustering distance is obtained and cluster analysis is performed;

[0012] Step S5: By comprehensively judging the cluster analysis results and corresponding factor values, obtain the financial abnormal behavior analysis results.

[0013] Furthermore, the process of collecting and standardizing raw data from diverse business operations to obtain a set of basic transaction parameters includes:

[0014] By connecting to the enterprise's procurement management system and fund settlement system through a data interface protocol, the system collects the original business transaction data of the suppliers within a preset historical statistical period for the supplier group to be analyzed. The original business transaction data includes at least the unique order number, unique supplier identifier, transaction timestamp, and transaction amount data for each transaction.

[0015] The collected raw transaction data is filtered for validity, and invalid transaction records with transaction status of cancellation or failure are removed. The retained transaction amount data is processed to unify the numerical format, converting the transaction amount into floating-point number format and the transaction time into standard timestamp format.

[0016] The processed raw transaction data is grouped according to the unique identifier of the supplier, and then sorted in order from earliest to latest according to the timestamp of the transaction occurrence within each supplier group to form the transaction time series and transaction amount series of the corresponding supplier.

[0017] Based on the sorted transaction time series and transaction amount series, the total number of transactions for each supplier within the statistical period is statistically obtained as the total number of transactions parameter, the sorted transaction time series is extracted as the transaction time series parameter, and the corresponding transaction amount series is extracted as the transaction amount series parameter, thus forming a basic transaction parameter set.

[0018] Furthermore, the step of obtaining a time-series interval compression factor by quantitatively analyzing the degree of interval compression of the supplier transaction time series includes:

[0019] By performing adjacent transaction interval analysis on the supplier's transaction time series data, transaction time interval compression feature data is obtained.

[0020] The time interval compression factor is obtained by performing nonlinear mapping and scaling on the transaction time interval compression feature data.

[0021] Furthermore, the step of obtaining transaction time interval compression feature data by performing adjacent transaction interval analysis on the supplier transaction time series data includes:

[0022] For any target supplier, extract the transaction time series data corresponding to that target supplier from the basic transaction parameter set;

[0023] Based on transaction time series data, the time difference between the timestamps of two adjacent transactions is calculated sequentially, and each adjacent time difference is used as the actual transaction time interval data corresponding to the target supplier.

[0024] The statistical period time span parameter is obtained by acquiring the statistical period time span parameter through historical statistical periods. Based on the statistical period time span parameter and the total number of transactions of the target supplier, the theoretical average transaction time interval of the target supplier within the statistical period is calculated. The theoretical transaction time interval is then compared with the actual transaction time interval to obtain the interval deviation assessment data, which reflects the degree of compression of the actual transaction time interval relative to the theoretical average transaction time interval. The interval deviation assessment data is used as the transaction time interval compression feature data of the target supplier.

[0025] Furthermore, the step of obtaining the time-series interval compression factor by performing nonlinear mapping and scale unification processing on the transaction time interval compression feature data includes:

[0026] For any target supplier, based on the transaction time interval compression feature data corresponding to the target supplier, the deviation evaluation data of each interval is subjected to exponential enhancement processing to amplify the time compression effect when the actual transaction time interval is significantly smaller than the theoretical average transaction time interval.

[0027] The deviation assessment data of each interval after index enhancement processing are summed and averaged to obtain the overall time compression assessment value of the target supplier within the statistical period;

[0028] By performing a logarithmic mapping on the overall time compression assessment value and adding the logarithmic mapping result to a constant 1, the time interval compression factor corresponding to the target supplier can be obtained.

[0029] Furthermore, the step of obtaining the threshold adhesion tension factor by nonlinearly modeling the relationship between transaction amount and approval threshold includes:

[0030] By performing threshold correlation analysis on supplier transaction amount data, we can obtain transaction amount threshold matching feature data.

[0031] By performing nonlinear enhancement processing on the transaction amount threshold fitting feature data, threshold adhesion response evaluation data is obtained;

[0032] The threshold adhesion tension factor is obtained by scaling and normalizing the threshold adhesion response evaluation data.

[0033] Furthermore, the step of performing threshold correlation analysis on supplier transaction amount data to obtain transaction amount threshold matching feature data includes:

[0034] For any target supplier, extract the transaction amount sequence data corresponding to that target supplier within the statistical period from the set of basic transaction parameters;

[0035] Set the approval threshold parameter corresponding to the transaction amount sequence data; by calculating the difference between each transaction amount and the corresponding approval threshold, the degree of deviation between each transaction amount and the approval threshold can be obtained;

[0036] Set a smoothing factor, add the square of the deviation between each transaction amount and the corresponding approval threshold to the smoothing factor and take the square root. Use the resulting calculation as the denominator and each transaction amount as the numerator. Use the resulting fraction as the degree of fit between the transaction amount and the approval threshold. Use all the calculated degree of fit between the transaction amount and the approval threshold as the transaction amount threshold fit feature data for the target supplier.

[0037] Furthermore, the step of obtaining threshold adhesion response evaluation data by performing nonlinear enhancement processing on the transaction amount threshold adhesion feature data includes:

[0038] For any target supplier, obtain the transaction amount threshold matching feature data corresponding to the target supplier; based on the transaction amount threshold matching feature data, sum the matching degree between each transaction amount and the approval threshold, and divide the summation result by the total number of transactions to obtain the average threshold matching strength assessment of the target supplier; perform exponential function mapping on the average threshold matching strength assessment, and use the result after exponential function mapping as the threshold adhesion response assessment data corresponding to the target supplier.

[0039] Furthermore, the step of obtaining the threshold adhesion tension factor by performing scale mapping and comprehensive normalization processing on the threshold adhesion response evaluation data includes:

[0040] For any target supplier, obtain the transaction amount sequence data, total number of transactions and approval threshold parameters corresponding to the target supplier within the statistical period, and obtain the threshold stickiness response evaluation data corresponding to the target supplier.

[0041] Based on the transaction amount sequence data, the transaction amounts of each transaction in the transaction amount sequence data are summed to obtain the total transaction amount of the target supplier within the statistical period; the total transaction amount is divided by the product of the total number of transactions and the approval threshold parameter to obtain the threshold utilization rate assessment of the target supplier.

[0042] The threshold utilization rate assessment data is multiplied by the threshold adhesion response assessment data, and the result of the multiplication is used as the threshold adhesion tension factor corresponding to the target supplier.

[0043] Furthermore, the step of obtaining the optimized clustering distance and performing cluster analysis by jointly correcting the basic statistical feature distance using a time interval compression factor and a threshold adhesion tension factor includes:

[0044] For each supplier within the statistical period, the total transaction amount, total number of transactions, and average transaction amount are statistically obtained based on the set of basic transaction parameters. The total transaction amount, total number of transactions, and average transaction amount are then used as the basic statistical feature vector of the supplier.

[0045] For any first supplier and any second supplier, based on the basic statistical feature vectors of the first supplier and the second supplier, calculate the difference between them in each dimension, sum the squares of the differences in each dimension, and then take the square root of the sum of squares. Use the square root result as the basic statistical feature distance between the first and second suppliers. Obtain the time interval compression factor and threshold adhesion tension factor corresponding to the first supplier, and obtain the time interval compression factor and threshold adhesion tension factor corresponding to the second supplier. Multiply the time interval compression factor of the first supplier and the time interval compression factor of the second supplier and take the square root to obtain the time joint correction coefficient. Then, multiply the threshold adhesion tension factor of the first supplier and the second supplier... The threshold adhesion tension factor is multiplied and square rooted to obtain the threshold joint correction coefficient; the basic statistical feature distance is multiplied sequentially with the time-series joint correction coefficient and the threshold joint correction coefficient, and the result of the multiplication is used as the optimized clustering distance between the first supplier and the second supplier; a clustering distance matrix is ​​constructed based on the optimized clustering distance between all suppliers, and the clustering distance matrix is ​​input into the density clustering algorithm to perform clustering analysis. When performing clustering analysis, the neighborhood scanning radius is set, and the minimum number of neighborhood samples for the core object is set; according to the clustering analysis results, suppliers that are not assigned to any density cluster are marked as noise objects or abnormal objects, and the set of noise objects or abnormal objects and the corresponding clustering results are used as the output results of the clustering analysis.

[0046] Compared with the prior art, the present invention has the following advantages:

[0047] This invention presents an intelligent analysis method for financial anomalies that integrates multi-source business data. By introducing a nonlinear correction mechanism with explicit business semantics into the clustering distance metric, it effectively distinguishes between supplier transaction patterns that are statistically similar but fundamentally different in their formation mechanisms. In actual financial auditing scenarios, for periodic normal payments and abnormal payments occurring frequently within a short period, this solution can leverage the tightness of the transaction time distribution and the structural fit between transaction amounts and approval thresholds to amplify key information masked by traditional distance metrics. This significantly improves the sensitivity of clustering results to hidden abnormal behaviors and reduces the risk of misjudgment due to statistical homogeneity.

[0048] From a technical perspective, this solution achieves automated and interpretable identification of abnormal financial behavior without relying on manual rule enumeration or adding extra labeled data. On one hand, by jointly modeling time compression features and threshold constraint features, the clustering algorithm can more accurately characterize the real differences between supplier behaviors, reducing false positives for legitimate high-frequency business. On the other hand, by embedding business constraints into the distance space in a continuous and computable form, abnormal behavior naturally presents as a high-deviation feature in the data distribution, facilitating the location and hierarchical management of risk objects, thereby improving the stability, practicality, and promotional value of the financial risk control system in complex business environments. Attached Figure Description

[0049] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0050] Figure 1 This is a flowchart illustrating an intelligent analysis method for financial anomaly behavior that integrates multi-source business data, as described in an embodiment of the present invention. Detailed Implementation

[0051] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0052] See Figure 1 This is a flowchart of a method for intelligent analysis of financial anomalies that integrates multi-source business data, as provided in Embodiment 1 of the present invention. Figure 1 As shown, a method for intelligent analysis of financial anomalies that integrates multi-source business data may include:

[0053] Step S1: Collect raw data from various business operations, standardize and process it to obtain a set of basic transaction parameters.

[0054] This step aims to provide cleaned basic data for subsequent feature extraction and optimization calculations. First, the enterprise's procurement management system and fund settlement system are connected through a data interface protocol. For the supplier group to be analyzed, the original business transaction data corresponding to the suppliers are collected within a preset historical statistical period. In this embodiment of the invention, the historical statistical period is set to 12 months. The original business transaction data includes at least the unique order number, unique supplier identifier, transaction timestamp, and transaction amount data corresponding to each transaction.

[0055] The collected raw transaction data undergoes validity screening, removing invalid transaction records with cancelled or failed transaction statuses. The retained transaction amount data undergoes standardized formatting, converting transaction amounts to floating-point numbers and transaction timestamps to standard timestamps. The processed raw transaction data is grouped according to the supplier's unique identifier, and within each supplier group, it is sorted in ascending order of transaction timestamps, forming a corresponding supplier's transaction time series and transaction amount series. Based on the sorted transaction time series and transaction amount series, the total number of transactions for each supplier within the statistical period is calculated as the total number of transactions parameter. The sorted transaction time series is extracted as the transaction time series parameter, and the corresponding transaction amount series is extracted as the transaction amount series parameter, forming a basic transaction parameter set.

[0056] This completes the process of collecting raw data from diverse business operations, standardizing and processing it, and obtaining a set of basic transaction parameters.

[0057] Step S2: Quantitatively analyze the degree of time series compression of supplier transactions to obtain the time series interval compression factor.

[0058] In anomaly detection scenarios targeting supplier transaction behavior, pseudo-isomorphism exists, leading to a decrease in the accuracy of existing clustering algorithms. Specifically, legitimate periodic payment behaviors (e.g., monthly service fees paid by companies to fixed service providers) and illegal order splitting to circumvent approvals (e.g., splitting a large payment into multiple smaller payments within a short period to avoid large approval thresholds) may exhibit highly similar macro-statistical characteristics, such as total transaction amount, total number of transactions, and average transaction amount, within a selected statistical period. If Euclidean distance is calculated solely based on these statistics, these two fundamentally different behaviors appear extremely close in the feature space, making it difficult for clustering algorithms to effectively separate illegal behavior from normal behavior. To address this issue, a correction variable that quantifies the temporal proximity of transactions is needed. The design logic of this variable is as follows: For normal periodic transactions, the actual transaction intervals are usually close to the average interval over the entire statistical period. In this case, the correction variable should remain neutral and not significantly change the original distance metric. However, for abnormal order splitting behavior, since multiple payments need to be completed within a limited time, the actual transaction intervals will be significantly smaller than the theoretical average interval. In this case, the correction variable should exhibit non-linear growth, thereby amplifying the distance between this data point and other normal data points. Through this differentiated processing based on the degree of time series interval compression, suppliers with similar statistical characteristics but different time series patterns can be distinguished in the clustering space.

[0059] In summary, this invention first performs adjacent transaction interval analysis on supplier transaction time series data to obtain transaction interval compression feature data. Specifically, for any target supplier, the corresponding transaction time series data is extracted from the basic transaction parameter set. Based on the transaction time series data, the time difference between the timestamps of two adjacent transactions is calculated sequentially, and each adjacent time difference is used as the actual transaction interval data corresponding to the target supplier. The statistical period time span parameter is obtained through historical statistical periods. Based on the statistical period time span parameter and the total number of transactions of the target supplier, the theoretical average transaction interval of the target supplier within the statistical period is calculated. The theoretical transaction interval is then compared with each actual transaction interval to obtain interval deviation assessment data reflecting the degree of compression of the actual transaction interval relative to the theoretical average transaction interval. The interval deviation assessment data is used as the transaction interval compression feature data corresponding to the target supplier.

[0060] After obtaining the transaction interval compression feature data, the time interval compression factor is obtained by performing nonlinear mapping and scaling on the transaction interval compression feature data. Specifically, for any target supplier, based on the transaction interval compression feature data corresponding to the target supplier, the interval deviation assessment data is subjected to exponential enhancement processing to amplify the time compression effect corresponding to when the actual transaction interval is significantly smaller than the theoretical average transaction interval. In this embodiment of the invention, the interval sensitivity coefficient used for exponential enhancement is set to 2. The interval deviation assessment data after exponential enhancement processing are summed and the average value is calculated to obtain the overall time compression degree assessment value of the target supplier within the statistical period. The overall time compression degree assessment value is logarithmically mapped and the logarithmic mapping result is added to a constant 1 to obtain the corresponding time interval compression factor of the target supplier.

[0061] In one implementation, it is assumed that the total number of transactions by the supplier is ;No. The transaction and the first The time difference between the timestamps of the transactions is The statistical period time span parameter is: The interval sensitivity coefficient used for exponential enhancement is Then, the expression for calculating the time interval compression factor corresponding to the target supplier is:

[0062]

[0063] in, This indicates the time interval compression factor corresponding to the target supplier; This indicates the total number of transactions for the supplier. Indicates the time span parameter of the statistical period; Indicates the first The transaction and the first The time difference between the timestamps of the transactions; This represents the interval sensitivity coefficient used for exponential enhancement.

[0064] It should be noted that this formula is constructed around the business characteristic that order splitting leads to a significant compression of transaction time intervals. Firstly, to measure the degree of time interval compression, a ratio structure is constructed internally within the formula, namely the numerator... This represents the theoretical average time interval under a given statistical period and number of transactions, assuming a perfectly uniform distribution of transactions; the denominator is... It represents the actual time interval between two adjacent transactions.

[0065] In normal periodic payment scenarios, suppliers settle accounts at a relatively fixed frequency, and the actual time interval is close to the theoretical average time interval, making the aforementioned base ratio close to... In this case, after index In the calculations and subsequent summations and averages, the values ​​within the parentheses remain unchanged. Nearby, due to equal The final calculation The value is close to This means that for normal transactions with a relatively even distribution, this factor will not significantly affect the original distance calculation results, thus ensuring the algorithm's compatibility with normal business data. However, in detecting order splitting behavior, the phenomenon of submitting multiple orders intensively within a short period of time to reach the total amount leads to discrepancies in the actual time intervals of some adjacent transactions. This will be significantly smaller than the theoretical average time interval. In this case, the denominator in the formula decreases, causing the ratio of the base to increase, resulting in a value greater than... The state. Introducing an exponent. This compression ratio is further amplified nonlinearly, allowing even localized, densely traded characteristics to be reflected in the calculation results. Finally, by mapping the summed values ​​to the natural logarithm, this time-dimensional compression feature is transformed into a reasonable multiplication factor. Through this design, order splitting points that are originally close together in Euclidean space are multiplied by a factor... Subsequently, the distance between it and the cluster center is effectively increased, thereby helping the clustering algorithm to more accurately identify such abnormal behaviors with temporal clustering characteristics.

[0066] This completes the quantitative analysis of the degree of time series compression of supplier transactions, and the acquisition of the time series interval compression factor.

[0067] Step S3: Obtain the threshold adhesion tension factor by performing nonlinear modeling on the fit between transaction amount and approval threshold.

[0068] After introducing the time interval compression factor in step S2, although the algorithm can effectively identify high-frequency, intensive transactions within a short period, there are still subtle ambiguities that need to be addressed in real-world financial scenarios. Not all intensive transactions are illegal. For example, sudden bulk purchases made by a company due to the launch of a new project may also exhibit high frequency and intensity in terms of time distribution, but they are considered normal business operations in terms of compliance. The core difference lies in the relationship between transaction amounts and approval thresholds. For legitimate sudden purchases, the amount per transaction is usually determined by market pricing, with values ​​exhibiting a random or natural distribution around the threshold. In contrast, illegal order splitting aims to circumvent approval, so the amount per transaction is deliberately close to but slightly below the approval threshold (e.g., if the threshold is 5000 yuan, order amounts frequently appear at 4980 yuan or 4990 yuan). Existing clustering algorithms typically treat the amount as a simple numerical dimension and cannot perceive this deliberate approximation of the structural characteristics between the amount and a specific system threshold. Therefore, a new correction variable needs to be introduced to quantify the degree to which transaction amounts are constrained by thresholds. The design logic of this variable is that when the transaction amount exhibits an unnatural clustering and adsorption phenomenon near the threshold, this variable should be significantly increased, thereby further distinguishing legitimate intensive purchases from illegal order splitting in the cluster space.

[0069] In summary, this invention first performs threshold correlation analysis on supplier transaction amount data to obtain transaction amount threshold fitting feature data. Specifically, for any target supplier, the transaction amount sequence data corresponding to that target supplier within the statistical period is extracted from the basic transaction parameter set. An approval threshold parameter corresponding to the transaction amount sequence data is set; in this embodiment, the approval threshold parameter is set to 5000. This parameter can be adjusted according to the actual needs of the enterprise and is not required. By calculating the difference between each transaction amount and the corresponding approval threshold, the degree of deviation between each transaction amount and the approval threshold is obtained.

[0070] A smoothing factor is set, which is set to 1 in this embodiment of the invention; the square of the deviation between each transaction amount and the corresponding approval threshold is added to the smoothing factor and the square root is taken, and the result is used as the denominator, with each transaction amount as the numerator, and the fraction is used as the degree of fit between the transaction amount and the approval threshold; the degree of fit between all the calculated transaction amounts and the approval thresholds is used as the transaction amount threshold fit feature data for the target supplier.

[0071] After obtaining the transaction amount threshold matching feature data, nonlinear enhancement processing is applied to the transaction amount threshold matching feature data to obtain threshold adhesion response evaluation data. Specifically, for any target supplier, the transaction amount threshold matching feature data corresponding to that target supplier is obtained; based on the transaction amount threshold matching feature data, the degree of matching between each transaction amount and the approval threshold is summed, and the summation result is divided by the total number of transactions to obtain the average threshold matching strength evaluation of that target supplier; the average threshold matching strength evaluation is processed by an exponential function mapping, and the result after the exponential function mapping is used as the threshold adhesion response evaluation data corresponding to that target supplier.

[0072] After obtaining the threshold adhesion response assessment data, the threshold adhesion tension factor is obtained by scaling and normalizing the data. Specifically, for any target supplier, the transaction amount sequence data, total number of transactions, and approval threshold parameters for that supplier within the statistical period are obtained, along with the corresponding threshold adhesion response assessment data. Based on the transaction amount sequence data, the transaction amounts of each transaction in the sequence data are summed to obtain the total transaction amount for that target supplier within the statistical period. The total transaction amount is divided by the product of the total number of transactions and the approval threshold parameters to obtain the threshold utilization rate assessment for that target supplier. The threshold utilization rate assessment is multiplied by the threshold adhesion response assessment data, and the result is used as the threshold adhesion tension factor for the target supplier.

[0073] In one implementation, assume the first The transaction amount is The approval threshold parameter is: Smoothing factor is Then, the calculation expression for the threshold adhesion tension factor corresponding to the target supplier is:

[0074]

[0075] in, This represents the threshold adhesion tension factor corresponding to the target supplier; Indicates the first The amount of the transaction; This indicates the total number of transactions for the supplier. This represents the approval threshold parameter; Indicates the smoothing factor; Let e ​​represent the natural constant.

[0076] It should be noted that this formula is designed to reveal potential avoidance intentions by capturing the non-linear relationship between data and thresholds. The formula mainly consists of two product parts, corresponding to the characteristics of overall capital utilization and local threshold attraction. The first part of the formula calculates the ratio of the total transaction amount to the theoretical maximum total amount (i.e., all transactions reaching the threshold at the maximum). This term serves to weight the overall risk. In normal, sporadic purchases, the transaction amount is usually much smaller than the approval threshold, resulting in a smaller ratio, thus inhibiting... The overall value is used to avoid misjudging low-risk, small-amount, concentrated transactions; however, in order splitting scenarios, to maximize the efficiency of capital outflow, the overall transaction amount is often higher, and this ratio tends to be close to... This preserves the influence of subsequent terms. The second part of the formula (the exponent term to the right of the multiplication sign) is key to solving the problem. Among them, the fraction... Indicates when a certain transaction amount Extremely close to the threshold When, in the denominator Approaching This leads to a sharp increase in the overall score. This simulates the threshold's attraction to monetary value: the closer the amount is to the threshold, the greater the attraction. Simultaneously, molecules... The existence of this ensures that only transactions close to the threshold and of a large amount will trigger a high response, excluding transactions that are close to the threshold. The potential interference from small transactions (e.g., yuan) is addressed by mapping this accumulation to a multiplication factor using an exponential function. For legitimate, sudden purchases, even if they occur frequently, the calculation results are stable because the amounts are not intentionally close to the threshold. The value remained at a low level; however, for order splitting that deliberately circumvented approval, the value increased significantly because multiple amounts were tightly tied to the threshold. This significantly increases compliance risks. This design introduces a constraint dimension of business rules into the feature space, enabling the algorithm to accurately identify compliance risks hidden behind dense transactions.

[0077] Thus, the threshold adhesion tension factor was obtained by nonlinearly modeling the relationship between transaction amount and approval threshold.

[0078] Step S4: By jointly correcting the basic statistical feature distance with the temporal interval compression factor and the threshold adhesion tension factor, the optimized clustering distance is obtained and clustering analysis is performed.

[0079] After calculating the specific time interval compression factor and threshold adhesion tension factor for each supplier, this step introduces these two factors as dynamic weights into the calculation. In the distance calculation step of the clustering algorithm, specifically, for each supplier within the statistical period, the total transaction amount, total number of transactions, and average transaction amount of the supplier are statistically obtained based on the set of basic transaction parameters, and the total transaction amount, total number of transactions, and average transaction amount are used as the basic statistical feature vector of the supplier.

[0080] For any first supplier and any second supplier, based on the basic statistical feature vectors of the first supplier and the second supplier, calculate the difference between them in each dimension, sum the squares of the differences in each dimension, and then take the square root of the sum of squares. Use the square root result as the basic statistical feature distance between the first and second suppliers. Obtain the time interval compression factor and threshold adhesion tension factor corresponding to the first supplier, and obtain the time interval compression factor and threshold adhesion tension factor corresponding to the second supplier. Multiply the time interval compression factor of the first supplier and the time interval compression factor of the second supplier and take the square root to obtain the time joint correction coefficient. Then, multiply the threshold adhesion tension factor of the first supplier and the second supplier... The threshold adhesion tension factor is multiplied and square rooted to obtain the threshold joint correction coefficient; the basic statistical feature distance is multiplied sequentially with the time-series joint correction coefficient and the threshold joint correction coefficient, and the result of the multiplication is used as the optimized clustering distance between the first supplier and the second supplier; a clustering distance matrix is ​​constructed based on the optimized clustering distance between all suppliers, and the clustering distance matrix is ​​input into the density clustering algorithm to perform clustering analysis. When performing clustering analysis, the neighborhood scanning radius is set, and the minimum number of neighborhood samples for the core object is set; according to the clustering analysis results, suppliers that are not assigned to any density cluster are marked as noise objects or abnormal objects, and the set of noise objects or abnormal objects and the corresponding clustering results are used as the output results of the clustering analysis.

[0081] It should be noted that in this embodiment of the invention, the neighborhood scanning radius is set to 0.15 and the minimum number of neighborhood samples is 5. These clustering parameters can be adjusted according to the actual scenario and are not required.

[0082] Thus, the optimized clustering distance was obtained by jointly correcting the basic statistical feature distance using the temporal interval compression factor and the threshold adhesion tension factor, and then cluster analysis was performed.

[0083] Step S5: By comprehensively judging the cluster analysis results and the corresponding factor values, the analysis results of abnormal financial behavior are obtained.

[0084] For suppliers whose cluster analysis output is marked as noise points or belongs to a specific high-deviation cluster, the system marks them as suspected targets of order splitting fraud.

[0085] Subsequently, the system generates a diagnostic reason based on the specific value of the object's optimization factor: If Extremely high value If the value is medium, the system will prompt "Short-term high-frequency trading exists; the authenticity of the transaction needs to be verified"; if... Value and The system detected two extremely high values, prompting a warning: "There is evidence of deliberate order splitting to circumvent approval thresholds. An immediate compliance audit is recommended." Ultimately, the system will identify a list of abnormal suppliers, their corresponding transaction details, and the source of the abnormal information. The risk score generated by factor quantification produces a visual report, which is then sent to financial risk control personnel. Through this process, the present invention enables the precise identification of hidden financial anomalies by leveraging the inherent distribution characteristics of data, without requiring the manual setting of complex rules.

[0086] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for intelligent analysis of abnormal financial behavior that integrates multi-source business data, characterized in that, The method includes: Step S1: Obtain a set of basic transaction parameters by collecting raw data from various business operations, standardizing and processing the data; Step S2: Obtain the time series interval compression factor by quantitatively analyzing the degree of interval compression of the supplier transaction time series; Step S3: Obtain the threshold adhesion tension factor by performing nonlinear modeling on the fit between transaction amount and approval threshold; Step S4: By jointly correcting the basic statistical feature distance with the temporal interval compression factor and the threshold adhesion tension factor, the optimized clustering distance is obtained and cluster analysis is performed; Step S5: By comprehensively judging the cluster analysis results and corresponding factor values, obtain the financial abnormal behavior analysis results.

2. The intelligent analysis method for financial anomaly behavior that integrates multi-source business data according to claim 1, characterized in that, The process involves collecting raw data from diverse business operations, standardizing and processing it to obtain a set of basic transaction parameters, including: By connecting to the enterprise's procurement management system and fund settlement system through a data interface protocol, the system collects the original business transaction data of the suppliers within a preset historical statistical period for the supplier group to be analyzed. The original business transaction data includes at least the unique order number, unique supplier identifier, transaction timestamp, and transaction amount data for each transaction. The collected raw transaction data is filtered for validity, and invalid transaction records with transaction status of cancellation or failure are removed. The retained transaction amount data is processed to unify the numerical format, converting the transaction amount into floating-point number format and the transaction time into standard timestamp format. The processed raw transaction data is grouped according to the unique identifier of the supplier, and then sorted in order from earliest to latest according to the timestamp of the transaction occurrence within each supplier group to form the transaction time series and transaction amount series of the corresponding supplier. Based on the sorted transaction time series and transaction amount series, the total number of transactions for each supplier within the statistical period is statistically obtained as the total number of transactions parameter, the sorted transaction time series is extracted as the transaction time series parameter, and the corresponding transaction amount series is extracted as the transaction amount series parameter, thus forming a basic transaction parameter set.

3. The intelligent analysis method for financial anomaly behavior that integrates multi-source business data according to claim 1, characterized in that, The step of obtaining a time-series interval compression factor by quantitatively analyzing the degree of interval compression of supplier transaction time series includes: By performing adjacent transaction interval analysis on the supplier's transaction time series data, transaction time interval compression feature data is obtained. The time interval compression factor is obtained by performing nonlinear mapping and scaling on the transaction time interval compression feature data.

4. The intelligent analysis method for financial anomaly behavior that integrates multi-source business data according to claim 3, characterized in that, The step of analyzing adjacent transaction intervals in the supplier's transaction time series data to obtain transaction time interval compression feature data includes: For any target supplier, extract the transaction time series data corresponding to that target supplier from the basic transaction parameter set; Based on transaction time series data, the time difference between the timestamps of two adjacent transactions is calculated sequentially, and each adjacent time difference is used as the actual transaction time interval data corresponding to the target supplier. The statistical period time span parameter is obtained by acquiring the statistical period time span parameter through historical statistical periods. Based on the statistical period time span parameter and the total number of transactions of the target supplier, the theoretical average transaction time interval of the target supplier within the statistical period is calculated. The theoretical transaction time interval is then compared with the actual transaction time interval to obtain the interval deviation assessment data, which reflects the degree of compression of the actual transaction time interval relative to the theoretical average transaction time interval. The interval deviation assessment data is used as the transaction time interval compression feature data of the target supplier.

5. The intelligent analysis method for financial anomaly behavior that integrates multi-source business data according to claim 3, characterized in that, The process of obtaining the time-series interval compression factor by performing nonlinear mapping and scaling on the transaction time interval compression feature data includes: For any target supplier, based on the transaction time interval compression feature data corresponding to the target supplier, the deviation evaluation data of each interval is subjected to exponential enhancement processing to amplify the time compression effect when the actual transaction time interval is significantly smaller than the theoretical average transaction time interval. The deviation assessment data of each interval after index enhancement processing are summed and averaged to obtain the overall time compression assessment value of the target supplier within the statistical period; By performing a logarithmic mapping on the overall time compression assessment value and adding the logarithmic mapping result to a constant 1, the time interval compression factor corresponding to the target supplier can be obtained.

6. The intelligent analysis method for financial anomaly behavior that integrates multi-source business data according to claim 1, characterized in that, The process of obtaining the threshold adhesion tension factor by nonlinearly modeling the relationship between transaction amount and approval threshold includes: By performing threshold correlation analysis on supplier transaction amount data, we can obtain transaction amount threshold matching feature data. By performing nonlinear enhancement processing on the transaction amount threshold fitting feature data, threshold adhesion response evaluation data is obtained; The threshold adhesion tension factor is obtained by scaling and normalizing the threshold adhesion response evaluation data.

7. The intelligent analysis method for financial anomaly behavior that integrates multi-source business data according to claim 6, characterized in that, The process of performing threshold correlation analysis on supplier transaction amount data to obtain transaction amount threshold matching feature data includes: For any target supplier, extract the transaction amount sequence data corresponding to that target supplier within the statistical period from the set of basic transaction parameters; Set the approval threshold parameter corresponding to the transaction amount sequence data; by calculating the difference between each transaction amount and the corresponding approval threshold, the degree of deviation between each transaction amount and the approval threshold can be obtained; Set a smoothing factor, add the square of the deviation between each transaction amount and the corresponding approval threshold to the smoothing factor and take the square root. Use the resulting calculation as the denominator and each transaction amount as the numerator. Use the resulting fraction as the degree of fit between the transaction amount and the approval threshold. Use all the calculated degree of fit between the transaction amount and the approval threshold as the transaction amount threshold fit feature data for the target supplier.

8. The intelligent analysis method for financial anomaly behavior that integrates multi-source business data according to claim 6, characterized in that, The process of obtaining threshold adhesion response evaluation data by performing nonlinear enhancement processing on the transaction amount threshold adhesion feature data includes: For any target supplier, obtain the transaction amount threshold matching feature data corresponding to the target supplier; based on the transaction amount threshold matching feature data, sum the matching degree between each transaction amount and the approval threshold, and divide the summation result by the total number of transactions to obtain the average threshold matching strength assessment of the target supplier; perform exponential function mapping on the average threshold matching strength assessment, and use the result after exponential function mapping as the threshold adhesion response assessment data corresponding to the target supplier.

9. The intelligent analysis method for financial anomaly behavior that integrates multi-source business data according to claim 6, characterized in that, The process of obtaining the threshold adhesion tension factor by performing scale mapping and comprehensive normalization on the threshold adhesion response evaluation data includes: For any target supplier, obtain the transaction amount sequence data, total number of transactions and approval threshold parameters corresponding to the target supplier within the statistical period, and obtain the threshold stickiness response evaluation data corresponding to the target supplier. Based on the transaction amount sequence data, the transaction amounts of each transaction in the transaction amount sequence data are summed to obtain the total transaction amount of the target supplier within the statistical period; the total transaction amount is divided by the product of the total number of transactions and the approval threshold parameter to obtain the threshold utilization rate assessment of the target supplier. The threshold utilization rate assessment data is multiplied by the threshold adhesion response assessment data, and the result of the multiplication is used as the threshold adhesion tension factor corresponding to the target supplier.

10. The intelligent analysis method for financial anomaly behavior that integrates multi-source business data according to claim 1, characterized in that, The process involves jointly correcting the basic statistical feature distance using a time-series interval compression factor and a threshold adhesion tension factor to obtain the optimized clustering distance and then performing cluster analysis, including: For each supplier within the statistical period, the total transaction amount, total number of transactions, and average transaction amount are statistically obtained based on the set of basic transaction parameters. The total transaction amount, total number of transactions, and average transaction amount are then used as the basic statistical feature vector of the supplier. For any first supplier and any second supplier, based on the basic statistical feature vectors of the first supplier and the second supplier, calculate the difference between them in each dimension, sum the squares of the differences in each dimension, and then take the square root of the sum of squares. Use the square root result as the basic statistical feature distance between the first and second suppliers. Obtain the time interval compression factor and threshold adhesion tension factor corresponding to the first supplier, and obtain the time interval compression factor and threshold adhesion tension factor corresponding to the second supplier. Multiply the time interval compression factor of the first supplier and the time interval compression factor of the second supplier and take the square root to obtain the time joint correction coefficient. Then, multiply the threshold adhesion tension factor of the first supplier and the second supplier... The threshold adhesion tension factor is multiplied and square rooted to obtain the threshold joint correction coefficient; the basic statistical feature distance is multiplied sequentially with the time-series joint correction coefficient and the threshold joint correction coefficient, and the result of the multiplication is used as the optimized clustering distance between the first supplier and the second supplier; a clustering distance matrix is ​​constructed based on the optimized clustering distance between all suppliers, and the clustering distance matrix is ​​input into the density clustering algorithm to perform clustering analysis. When performing clustering analysis, the neighborhood scanning radius is set, and the minimum number of neighborhood samples for the core object is set; according to the clustering analysis results, suppliers that are not assigned to any density cluster are marked as noise objects or abnormal objects, and the set of noise objects or abnormal objects and the corresponding clustering results are used as the output results of the clustering analysis.

Images