Machine learning based audit data anomaly transaction automatic identification system

Abstract

The application provides an audit data abnormal transaction automatic identification system based on machine learning, and relates to the technical field of data processing, which is used for identifying the correlation of a transaction object in time and amount dimensions, performing mode decomposition on transaction records according to the amount change trend and time continuity, generating a plurality of mode units, identifying the time span and amount amplitude of each mode unit, calculating the concentration degree of the transaction records in the time and amount dimensions, obtaining an aggregation intensity factor, combining mode units with a difference value of the aggregation intensity factor meeting a preset similar threshold value into a plurality of hierarchical modes, calculating the deviation degree of each hierarchical mode in the amount change direction and the time interval direction, identifying the dynamic difference degree of each hierarchical mode, obtaining a fluctuation difference index, determining the mode unit to which an abnormal record belongs, and obtaining an abnormal transaction identification result. The application realizes the automatic identification of complex split transactions by splitting and extracting abnormalities.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to an automatic identification system for abnormal transactions in audit data based on machine learning. Background Technology

[0002] Existing auditing systems typically employ rule-based anomaly detection methods. These methods identify potential problems in financial data by setting fixed rules, such as exceeding payment limits or abnormal transaction frequency. These rules are usually matched against predefined criteria, thus enabling the detection of common anomalies. For example, setting payment limits can identify excessively large transactions, or analyzing time periods can identify transactions occurring outside of working hours. This approach is effective for relatively simple scenarios.

[0003] Existing rule-based auditing systems have significant shortcomings when dealing with complex transaction patterns. For example, when identifying anomalies in multiple small-value split transactions, they lack the flexibility to detect such split transactions and may fail to make accurate judgments. For instance, if a supplier splits a large order into several small transactions for multiple payments, traditional rule engines may not be able to effectively identify it, causing the system to overlook this potential anomaly risk. Summary of the Invention

[0004] The purpose of this invention is to provide an automatic identification system for abnormal transactions in audit data based on machine learning, which aims to solve the problems mentioned in the background art.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: An automatic identification system for abnormal transactions in audit data based on machine learning, the system comprising: The model module is used to build an anomaly detection model based on an autoencoder. The anomaly detection model is used to perform unsupervised learning on audit data and identify abnormal data therein. The mapping module is used to acquire audit transaction data and combine the transaction records of the transaction objects within a fixed time period to identify the correlation between the transaction objects in the time and amount dimensions, thereby obtaining a mapping dataset. The decomposition module is used to decompose transaction records according to the trend of amount change and time continuity based on the mapping dataset, generate multiple pattern units, and obtain a structured pattern set. The aggregation module is used to identify the time span and amount range of each pattern unit based on the set of structured patterns, calculate the degree of concentration of transaction records in the time and amount dimensions, and obtain the aggregation strength factor. The reconstruction module is used to combine pattern units whose aggregation intensity factor difference meets the preset similar threshold into multiple hierarchical patterns, establish a multi-level pattern structure between transaction records, and obtain reconstructed data. The difference module is used to calculate the degree of deviation of each level pattern in the direction of amount change and time interval based on the reconstructed data, identify the degree of dynamic difference of each level pattern, and obtain the fluctuation difference index. The identification module is used to determine the pattern unit to which the abnormal record belongs by comparing the combined characteristics of the aggregation intensity factor and volatility difference index in the multi-layer pattern structure, and obtain the abnormal transaction identification result.

[0006] Furthermore, the mapping module includes: The transaction record unit is used to extract the transaction time and transaction amount of each transaction object based on the audited transaction data, determine the transaction record of each transaction object, and obtain the transaction record data; The time allocation unit is used to allocate each transaction record to a fixed time period based on the transaction time in the transaction record data, thereby obtaining time period transaction data; The amount recognition unit is used to classify transaction records with the same amount change trend corresponding to the transaction object based on the transaction amount in the transaction record data, and obtain amount-related data. The mapping dataset generation unit is used to combine the relationships between each transaction record in the time and amount dimensions based on the transaction data and amount correlation data over a time period to obtain the mapping dataset.

[0007] Furthermore, the decomposition module includes: The amount change trend unit is used to extract the amount change magnitude of each transaction record based on the mapping dataset, calculate the trend value of the amount change magnitude, and obtain the amount change trend data. The time continuity detection unit is used to calculate the time interval between each transaction record and the preceding and following transaction records based on the transaction time of each transaction record, so as to obtain time continuity data; The pattern classification unit is used to classify transaction records according to the trend of amount change and the continuity of time based on the amount change data and the time continuity data, so as to obtain a set of classification patterns; The structured pattern unit is used to identify the correlation between transaction records in terms of amount and time based on the classification pattern set, generate multiple pattern units, and obtain a structured pattern set.

[0008] Furthermore, the aggregation module includes: The time distribution analysis unit is used to extract the start and end times of continuous transaction records within each pattern unit based on the structured pattern set, and to calculate the time distribution dispersion to obtain time distribution feature data. The quantitative unit for amount fluctuation is used to extract the increase or decrease of the amount of each transaction based on the set of structured patterns, and to calculate the gradient and stability coefficient of the amount change to obtain the characteristic data of amount fluctuation. The cross-dimensional correlation unit is used to calculate the correlation factor between time dispersion and monetary fluctuation amplitude based on time distribution characteristic data and monetary fluctuation characteristic data, so as to obtain time-money correlation data. The aggregation strength factor unit is used to calculate the degree of concentration of each pattern unit in the time and amount dimensions based on time and amount-related data, and obtain the aggregation strength factor.

[0009] Furthermore, the polymerization strength factor unit includes: The aggregation strength factor calculation unit is used to calculate the inverse centralization of time dispersion based on the ratio of time distribution dispersion to fixed time period length, thus obtaining the time centralization term; calculate the amount centralization term based on the ratio of amount change gradient to amount stability coefficient; calculate the basic aggregation degree by weighted fusion of the time centralization term and the amount centralization term, thus obtaining the basic aggregation term; and calculate the cross-dimensional amplification effect and suppress low correlation intervals based on the correlation factor, time centralization term, and amount centralization term, thus obtaining the interactive correlation term. Based on the basic aggregation term and the interaction-related term, the aggregation degree after cross-dimensional correction is calculated to obtain the interaction correction term; based on the number of transaction records and the proportion of record coverage time for each pattern unit, the sample sufficiency weight is calculated to obtain the confidence adjustment term; based on the joint proportion of the proportion of outliers and the proportion of abnormal fluctuations in amount within the pattern unit, the attenuation coefficient for the aggregation degree is calculated to obtain the noise suppression term. The interaction correction term, confidence adjustment term, and noise suppression term are fused to obtain the polymerization intensity factor.

[0010] Furthermore, the reconstruction module includes: The difference matrix construction unit is used to calculate the factor difference of the aggregation intensity factor between any two mode units, and arranges each factor difference according to the mode unit number to obtain the factor difference matrix; The preliminary clustering unit is used to extract the cluster centers of factor differences based on the distribution characteristics of each element in the factor difference matrix, and to obtain similar pattern groups. The threshold determination unit is used to calculate a preset similarity threshold based on the density of cluster centers in the similar pattern grouping, and to filter similar pattern units that meet the preset similarity threshold to obtain a similar pattern set; Hierarchical combination building units are used to merge similar pattern units into a hierarchical pattern based on a set of similar patterns. Multiple hierarchical patterns are formed through repeated iterations to obtain hierarchical combination data. The multi-level structure generation unit is used to calculate the dependency weights between hierarchical patterns based on the hierarchical combination data, establish a multi-level pattern structure, and obtain reconstructed data.

[0011] Furthermore, the difference module includes: The amount direction deviation unit is used to extract the direction of amount change of each transaction record in each level pattern based on the reconstructed data, and calculate the difference of amount change vector between adjacent transaction records to obtain amount deviation data. The time interval deviation unit is used to calculate the time interval between each transaction record and its adjacent transaction records based on the reconstructed data, and to calculate the dispersion of the time interval sequence to obtain the time deviation data. The dynamic difference identification unit is used to calculate the overall degree of deviation based on the amount deviation data and the time deviation data, identify the hierarchical pattern of deviation in both time and amount directions, and obtain dynamic difference data. The volatility difference index unit is used to integrate the comprehensive deviation of each level of pattern based on dynamic difference data, calculate the dynamic difference of the level pattern, and obtain the volatility difference index.

[0012] Furthermore, the volatility difference index unit includes: The volatility difference index calculation unit is used to calculate the relative volatility of amount changes and time changes based on amount deviation data and time deviation data, and obtain a two-dimensional deviation ratio term; calculate the consistency of the direction of amount change in the time series based on the trend of amount deviation data, and obtain a direction deviation consistency term; and calculate the coupling strength of time fluctuation based on the volatility sequence of time deviation data, and obtain a dynamic coupling strength term. Based on the two-dimensional deviation ratio term, the directional deviation consistency term, and the dynamic coupling strength term, the interaction strength between amount and time deviation in the two-dimensional space is calculated to obtain the nonlinear response term. The two-dimensional deviation ratio term, the directional deviation consistency term, the dynamic coupling strength term, and the nonlinear response term are weighted and fused to calculate the dynamic difference degree of the hierarchical pattern and obtain the fluctuation difference index.

[0013] Furthermore, the identification module includes: The combined feature extraction unit is used to perform feature mapping between the aggregation intensity factor and the fluctuation difference index of each mode unit, calculate the interaction correlation degree, and obtain combined feature data. The feature difference unit is used to calculate the feature difference value between each mode unit based on the combined feature data, and to establish a feature difference curve based on the feature difference value to obtain the feature difference data. The pattern matching unit is used to calculate the matching deviation value between the combined features and the pattern features in the multi-layer pattern structure based on the feature difference data, identify abnormal transaction records, and obtain preliminary abnormal data. The anomaly identification unit is used to filter and re-evaluate abnormal transaction records based on preliminary abnormal data, determine the pattern unit to which the abnormal transaction record belongs, and obtain the abnormal transaction identification result.

[0014] Furthermore, the combined feature extraction unit includes: The normalization processing unit is used to normalize the aggregation intensity factor and fluctuation difference index of each mode unit, eliminate dimensional bias, and obtain normalized feature data. The feature mapping unit is used to map the aggregation intensity factor and the volatility difference index to the same feature space based on the normalized feature data, and to calculate the density of the feature distribution to obtain the feature mapping matrix. The interaction weight calculation unit is used to calculate the interaction weight between the aggregation intensity factor and the volatility difference index based on their covariance ratio and gradient direction, and obtain the interaction weight data. The correlation generation unit is used to perform weighted integration on the feature mapping matrix based on the interaction weight data, calculate the interaction correlation of each mode unit in the time dimension and the monetary dimension, and obtain the combined feature data.

[0015] The above-described solution of the present invention has at least the following beneficial effects: This invention synchronously maps transaction data across time and monetary dimensions, enabling discrete transaction records to be combined into a continuous transaction sequence within a fixed time period. This establishes a correspondence between time intervals and monetary changes on the data surface, achieving a two-dimensional description of transaction behavior. The behavioral pattern of each transaction object within a given time window is standardized and expressed as a matrix. Each element in the matrix represents the activity density or transaction magnitude of that object within a specific time period and monetary range. This facilitates subsequent operations on the same scale and eliminates deviations caused by different recording time granularities or inconsistent monetary units, ensuring the comparability and consistency of data during the dimensional fusion process.

[0016] This invention extracts trends and analyzes time intervals from transaction records, calculates the difference in the amount change of each transaction and the time interval sequence, and divides the entire transaction sequence into pattern units. This decomposes the originally continuous and complex time series data into segments with similar fluctuation characteristics and time density, which is equivalent to structural segmentation of the transaction flow. This decomposition process achieves information localization, enabling each pattern unit to independently represent the transaction characteristics of a certain stage. This facilitates subsequent modules in calculating cross-stage relationships and local pattern differences, providing a data foundation for quantitative pattern aggregation and similarity analysis.

[0017] This invention utilizes time span and monetary magnitude data from a structured pattern set to calculate the dispersion of time distribution and the magnitude of monetary fluctuations, fusing these two metrics to generate a aggregation strength factor. This achieves a quantitative characterization of the concentration of transaction activities; the concentration in the time dimension reflects the density of transactions, while the concentration in the monetary dimension reflects the directional consistency of transaction fluctuations, capable of expressing cross-dimensional coupling structures. The aggregation strength factor enables transaction data to have single-scale comparability in a high-dimensional feature space, facilitating subsequent hierarchical clustering and similarity calculations. It also ensures transferable comparability of data across different time windows, guaranteeing scale consistency and feature comparability within the system's data processing.

[0018] This invention combines multiple similar pattern units into a hierarchical pattern by aggregating the difference relationship of the intensity factor, generating a multi-layer pattern structure at the data level. Nodes represent pattern units, and edges represent connections with similar factor differences, achieving a structural expression of the global similarity of transaction data. This allows similar transaction behaviors scattered across different time periods to be uniformly represented in the data structure. It not only preserves the local features of each pattern unit but also reveals their global similarity relationships at the structural level, providing a stable reference framework for subsequent difference calculations. This transforms transaction data from a planar sequence into a graph structure with hierarchical and dependent relationships, enabling the system to perform structured analysis of transaction behavior at multiple scales.

[0019] This invention calculates the deviation of the direction and time interval of the amount change in each transaction record in the reconstructed hierarchical pattern. It calculates the direction difference of the transaction record vector and the discreteness of the time interval sequence in a two-dimensional space to obtain a quantitative result reflecting the dynamic consistency within the pattern. The amount deviation data reflects the stability of the transaction direction, and the time deviation data reflects the rhythmic pattern of the event interval. The dynamic difference data serves as a joint description of the temporal stability and the regularity of the amount change within the pattern, mapping the differences between patterns into a continuously measurable deviation function. This achieves the transformation from qualitative judgment to quantitative description, possessing both comparative and dynamic dimensions of information, and providing a directly comparable deviation benchmark for the final anomaly determination of the system. Attached Figure Description

[0020] Figure 1 This is a flowchart of an automatic identification system for abnormal transactions in audit data based on machine learning, provided in an embodiment of the present invention. Detailed Implementation

[0021] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0022] like Figure 1 As shown, embodiments of the present invention propose an automatic identification system for abnormal transactions in audit data based on machine learning, the system comprising: The model module is used to build an anomaly detection model based on an autoencoder. The anomaly detection model is used to perform unsupervised learning on audit data and identify abnormal data therein. The mapping module is used to acquire audit transaction data and combine the transaction records of the transaction objects within a fixed time period to identify the correlation between the transaction objects in the time and amount dimensions, thereby obtaining a mapping dataset. The decomposition module is used to decompose transaction records according to the trend of amount change and time continuity based on the mapping dataset, generate multiple pattern units, and obtain a structured pattern set. The aggregation module is used to identify the time span and amount range of each pattern unit based on the set of structured patterns, calculate the degree of concentration of transaction records in the time and amount dimensions, and obtain the aggregation strength factor. The reconstruction module is used to combine pattern units whose aggregation intensity factor difference meets the preset similar threshold into multiple hierarchical patterns, establish a multi-level pattern structure between transaction records, and obtain reconstructed data. The difference module is used to calculate the degree of deviation of each level pattern in the direction of amount change and time interval based on the reconstructed data, identify the degree of dynamic difference of each level pattern, and obtain the fluctuation difference index. The identification module is used to determine the pattern unit to which the abnormal record belongs by comparing the combined characteristics of the aggregation intensity factor and volatility difference index in the multi-layer pattern structure, and obtain the abnormal transaction identification result.

[0023] In this embodiment of the invention, the model module is used to construct an anomaly recognition model based on an autoencoder. The anomaly recognition model is used to perform unsupervised learning on audit data and identify abnormal data therein, providing a unified and measurable anomaly signal carrier for subsequent operations. The mapping module is used to acquire audit transaction data and combine transaction records of transaction objects within a fixed time period according to the data, identify the correlation between transaction objects in the time and amount dimensions, and obtain a mapping dataset, providing directly calculable input for subsequent pattern decomposition and aggregation measurement. The decomposition module is used to perform pattern decomposition of transaction records according to the amount change trend and time continuity based on the mapping dataset, generating multiple pattern units to obtain a structured pattern set. Long sequences are divided into basic units, providing a reasonably granular carrier for subsequent measurement of concentration and construction of hierarchical structure. The aggregation module is used to identify the time span and amount range of each pattern unit based on the structured pattern set, calculate the concentration of transaction records in the time and amount dimensions, obtain an aggregation strength factor, making the clustering degree of each pattern unit comparable, and providing a measurement benchmark for subsequent hierarchical combination and reconstruction.

[0024] The reconstruction module combines pattern units whose aggregation intensity factor differences meet preset thresholds into multiple hierarchical patterns, establishing a multi-layered pattern structure among transaction records to obtain reconstructed data. The data is transformed from a linear sequence into a structured set of adjacent dependencies, providing a clear reference framework for subsequent deviation calculations within the structure. The difference module calculates the degree of deviation of each level of pattern in terms of the direction of amount change and time interval based on the reconstructed data, identifies the dynamic difference degree of each level of pattern, and obtains the volatility difference index. The deviation of the amount direction and time rhythm is presented with a unified index to characterize process differences and provide a second independent data evidence chain for anomaly attribution. The identification module determines the pattern unit to which the abnormal record belongs by comparing the combination characteristics of the aggregation intensity factor and volatility difference index in the multi-layered pattern structure, obtaining the abnormal transaction identification result. Abnormal records present an outlier state in the feature space in the form of combinations of high concentration and high deviation or structural inconsistency and process mutation. Using pattern units as carriers and multi-layered structures as references, the module outputs anomaly identification results with clear sources and traceable paths.

[0025] The model module is used to construct an anomaly detection model based on an autoencoder. This anomaly detection model is used to perform unsupervised learning on audit data and identify anomalous data. Specifically, it includes: First, raw transaction data is imported from the audit database. This data includes fields such as transaction object identifiers, transaction timestamps, and transaction amounts. To ensure the consistency of the model input, the system performs time-series encoding on the time field, mapping timestamps to periodic time features, such as using sine and cosine functions to represent intraday moments or weekly cycles. Simultaneously, transaction amounts are standardized so that transactions of different currencies or amounts can be learned by the model on the same scale. The cleaned and standardized data is then organized into transaction sequences according to transaction object and time order. Each sequence is divided into fixed-length window samples, each corresponding to a set of multi-dimensional feature vectors, which are input into the autoencoder structure. The autoencoder model then consists of an encoder and a decoder. The encoder compresses the high-dimensional input transaction data into the latent space, generating a low-dimensional feature representation; the decoder attempts to reconstruct the original input from this latent representation. The system trains the model by minimizing the reconstruction error between the input and the reconstruction result. Training does not rely on any labeled samples, thus constituting unsupervised learning. This process enables the model to automatically capture the time-dependent features and amount fluctuation patterns of the transaction data, forming an adaptive representation of normal transaction patterns in the latent space. When the system receives new transaction data, the model judges the degree of deviation between the data and the learned normal pattern based on the size of the reconstruction error. The greater the deviation, the more difficult it is to reconstruct the record in the model's representation space, that is, there are potential abnormal features.

[0026] The anomaly detection model obtained through this training process plays a core driving role in the entire system's data flow. For the mapping module, the reconstruction error signal output by the model, as one of the important features of transaction records, is used as a data weight when establishing the time-amount mapping relationship, helping subsequent modules distinguish between high-confidence and low-confidence transactions during the combination process. For the decomposition module, the latent space feature vector provided by the model provides a basis for calculating the similarity of transaction trends, making the extraction of amount change trends not only dependent on numerical differences but also referencing the nonlinear relationships learned by the model. For the aggregation module, the distribution features extracted during the model training phase provide a statistical reference for calculating the aggregation strength factor, making the calculation of the aggregation degree adaptive based on the data distribution. For the reconstruction module, the sample similarity matrix in the model's latent space can serve as an auxiliary indicator for hierarchical pattern combination, improving the rationality of hierarchical structure construction. For the difference module, the model's weight distribution of time and amount features provides weight guidance in the deviation calculation, making the calculation of dynamic difference degree more consistent with the intrinsic characteristics of transactions. Finally, in the identification module, the reconstruction error, latent space representation, and anomaly confidence distribution generated by the model are comprehensively used for the pattern attribution and anomaly confirmation of abnormal transaction records. In summary, the model module achieves unsupervised learning of audit data through an autoencoder, transforming raw transaction data into a latent feature representation that includes three-dimensional relationships of time, amount, and structure. This enables the entire system to have adaptive modeling capabilities for machine learning, providing a data representation foundation and anomaly reference scale for the mapping, decomposition, aggregation, reconstruction, difference, and identification modules.

[0027] In a preferred embodiment of the present invention, the mapping module includes: The transaction record unit is used to extract the transaction time and transaction amount of each transaction object based on the audited transaction data, determine the transaction record of each transaction object, and obtain the transaction record data; The time allocation unit is used to allocate each transaction record to a fixed time period based on the transaction time in the transaction record data, thereby obtaining time period transaction data; The amount recognition unit is used to classify transaction records with the same amount change trend corresponding to the transaction object based on the transaction amount in the transaction record data, and obtain amount-related data. The mapping dataset generation unit is used to combine the relationships between each transaction record in the time and amount dimensions based on the transaction data and amount correlation data over a time period to obtain the mapping dataset.

[0028] In this embodiment of the invention, the transaction recording unit is used to extract the transaction time and transaction amount of each transaction object based on audited transaction data, determine the transaction record of each transaction object, and obtain transaction record data. By unifying the units of time and amount and merging duplicate entries, the original heterogeneous data is standardized into computable sequence data. The time allocation unit is used to allocate each transaction record to a fixed time period based on the transaction time in the transaction record data, obtain time period transaction data, and establish a single-value mapping between discrete events and a continuous time axis, so that records of different objects and different dates can be compared on the same scale. The amount recognition unit is used to identify the transaction amount based on the transaction time in the transaction record data. The amount data categorizes transaction records with similar trends in amount change, resulting in amount-related data. This data characterizes the relative changes in the direction and magnitude of amount changes at both the event and segment levels, transforming information that only has numerical values ​​into structural information with direction and connectivity. The mapping dataset generation unit combines the relationships between each transaction record in the time and amount dimensions based on the transaction data and amount-related data over a time period, resulting in a mapping dataset. The combination of the time and amount dimensions uniformly expresses when and how the changes occur within the same carrier, ensuring that the combined representation remains storable and computable even with a large number of objects and long time periods.

[0029] The time allocation unit is used to assign each transaction record to a fixed time period based on the transaction time in the transaction record data, thereby obtaining time period transaction data, specifically including: First, the system extracts the transaction time for each record from the transaction log data and unifies all transaction times to the same audit time zone, ensuring millisecond-level accuracy. For multiple records of the same transaction object, the system renumbers them according to their chronological order, forming a continuous time series. When establishing fixed time periods, the system sets a reference time at the beginning of the entire audit interval and divides the timeline into several consecutive time periods based on a pre-defined time period length, such as fifteen minutes, one hour, or one day. Then, the system uniquely assigns each transaction record to the corresponding time period based on its time information. The system saves detailed records of the original transactions for each transaction object and time period combination, including transaction amount, transaction direction, transaction channel, and related identification information. Simultaneously, without altering the original data, the system generates time-period level statistical data, such as the number of transactions, total transaction amount, number of income and expenditure transactions, maximum and minimum amount difference, amount variance, and start and end times for that time period. Through the above steps, two types of structured data outputs are generated: one is a time period transaction detail table, which records the time period corresponding to each transaction; the other is a time period statistics table, which records the overall characteristics of transactions in each time period, thus obtaining time period transaction data.

[0030] The amount recognition unit is used to classify transaction records with the same amount change trend corresponding to the transaction object based on the transaction amount in the transaction record data, thereby obtaining amount-related data, specifically including: First, the difference in amount between each transaction and its predecessor is calculated to represent the direction and magnitude of the amount change. A robust normalization method based on median absolute deviation is used to transform all differences into changes on a uniform scale. Then, the boundaries of three trend intervals—upward, downward, and stable—are automatically determined based on the distribution of these changes. This division is dynamically determined according to the amount distribution characteristics of each transaction, enabling comparisons of transaction data of different scales under the same standard. For each transaction record, the system labels it as an upward trend, downward trend, or stable state based on the direction and magnitude of its amount change. The system also calculates the similarity between different transaction records, considering the consistency of the direction of amount change, the similarity of the magnitude of change, and the time interval between the two transactions. The shorter the time interval and the closer the direction of amount change, the higher the similarity between the transactions. The system connects highly similar transaction records and, through connected component analysis or density clustering, classifies these transactions with the same amount change trend into several similar trend categories. The final output of the monetary correlation data includes two parts: one part is the correspondence between each transaction record or time period and its trend category number; the other part is the statistical summary information of each trend category, which records the number of transactions, trend percentage, monetary distribution range and time coverage of the category.

[0031] In a preferred embodiment of the present invention, the decomposition module includes: The amount change trend unit is used to extract the amount change magnitude of each transaction record based on the mapping dataset, calculate the trend value of the amount change magnitude, and obtain the amount change trend data. The time continuity detection unit is used to calculate the time interval between each transaction record and the preceding and following transaction records based on the transaction time of each transaction record, so as to obtain time continuity data; The pattern classification unit is used to classify transaction records according to the trend of amount change and the continuity of time based on the amount change data and the time continuity data, so as to obtain a set of classification patterns; The structured pattern unit is used to identify the correlation between transaction records in terms of amount and time based on the classification pattern set, generate multiple pattern units, and obtain a structured pattern set.

[0032] In this embodiment of the invention, the amount change trend unit is used to extract the amount change range of each transaction record based on the mapping dataset, calculate the trend value of the amount change range, and obtain amount change trend data, mapping the absolute size of a single amount to dimensionless change information, forming a trend description that can be directly calculated between different objects and different amount scales; the time continuity detection unit is used to calculate the time interval between each transaction record and the preceding and following transaction records based on the transaction time of each transaction record, obtaining time continuity data, converting timestamp differences into dimensionless intervals and continuity scores, avoiding interference from differences in the original time units to subsequent analysis; the pattern classification unit... Based on the trend data of amount changes and the continuity data of time, the transaction records are classified according to the trend of amount changes and the continuity of time, resulting in a set of classification patterns. This eliminates short-term overlap between different states and ensures high consistency within the same segment, providing direct and unambiguous input for the generation of subsequent structured units. The structured pattern unit is used to identify the correlation between each transaction record in the dimensions of amount and time based on the set of classification patterns, generating multiple pattern units to obtain a set of structured patterns. This allows long sequences to be expressed as a set of referable, comparable, and connectable objects, avoiding repeated aggregation calculations from the record layer and providing structured input for subsequent modules.

[0033] The pattern classification unit is used to classify transaction records according to the trend of amount change and the continuity of time based on the amount change data and the time continuity data, resulting in a set of classification patterns, specifically including: First, all transaction records for the same trading entity are acquired. The system sequentially reads the amount change trend information and time continuity information contained in the records according to time sequence. Each feature value is normalized, that is, the numerical distribution of each feature is centered and standardized to ensure it falls within a uniform reference range. Then, trend labels describing the trading behavior are generated, with upward trend, downward trend, and approximately unchanged states labeled in text form within the records. Simultaneously, based on the transaction time interval and continuity indicators, records are labeled as continuous or discontinuous. After completing the dual labeling, the system begins sequential scanning of continuous records: when the trend labels and continuity labels of two adjacent records are the same, and the difference in their change magnitude and time interval are within a preset allowable range, the system considers them to belong to the same transaction segment and includes the record in the current segment; when the trend state or time interval exceeds the allowable range, the system ends the aggregation of the current segment and starts a new segment. After a segment is formed, the system automatically merges adjacent segments. If the trend labels and continuity labels of two segments are consistent, and the difference in amount and time interval at the boundary is within a reasonable range, the system merges these two segments into a complete segment. The system collects basic data for each segment, including the number of transactions within the segment, start and end times, average amount, standard deviation of amount, average time interval, and volatility. This data, along with segment tags and time ranges, is then encapsulated to form a set of classification patterns.

[0034] The structured pattern unit is used to identify the correlation between transaction records in terms of amount and time based on the classification pattern set, generating multiple pattern units to obtain a structured pattern set, specifically including: First, a uniquely identified pattern unit is generated for each segment. Each pattern unit includes information such as time range, trend label, continuity label, and statistical characteristics, while also recording the index relationship with the original transaction record. Next, the system establishes a unified feature description for each pattern unit, including typical features such as average amount change, trend consistency, average time interval, time volatility, mean amount, and standard deviation of amount. The system determines the association between units based on time sequence and pattern similarity: when the end time of one pattern unit is earlier than the start time of another pattern unit, and the time interval between them is within an allowable range, the system calculates their difference in the feature space, including average amount change, time interval, trend direction, and consistency difference. If the difference is below a preset threshold, the two pattern units are considered to be associated, and a directed connection is established in the system. All pattern units and their interrelationships together constitute a hierarchical and directional graph structure. An outer interval index is also established for each pattern unit, recording its minimum coverage interval in time and amount ranges, and calculating the interval overlap ratio between adjacent units. All pattern units, their statistical attributes, time and amount range information, adjacency relationships, and index mappings are integrated to generate a structured pattern set.

[0035] In a preferred embodiment of the present invention, the aggregation module includes: The time distribution analysis unit is used to extract the start and end times of continuous transaction records within each pattern unit based on the structured pattern set, and to calculate the time distribution dispersion to obtain time distribution feature data. The quantitative unit for amount fluctuation is used to extract the increase or decrease of the amount of each transaction based on the set of structured patterns, and to calculate the gradient and stability coefficient of the amount change to obtain the characteristic data of amount fluctuation. The cross-dimensional correlation unit is used to calculate the correlation factor between time dispersion and monetary fluctuation amplitude based on time distribution characteristic data and monetary fluctuation characteristic data, so as to obtain time-money correlation data. The aggregation strength factor unit is used to calculate the degree of concentration of each pattern unit in the time and amount dimensions based on time and amount-related data, and obtain the aggregation strength factor.

[0036] In this embodiment of the invention, the time distribution analysis unit is used to extract the start and end times of continuous transaction records within each pattern unit according to the structured pattern set, and calculate the time distribution dispersion to obtain time distribution feature data. The time distribution dispersion measures the strength of interval fluctuations, making pattern units of different lengths and densities comparable on the same scale. The amount fluctuation quantification unit is used to extract the increase or decrease of the amount of each transaction according to the structured pattern set, and calculate the gradient and stability coefficient of the amount change to obtain amount fluctuation feature data. The gradient reflects the average level of the amount change per unit time, and the stability coefficient describes the gradient fluctuation amplitude, ensuring that the data from different amount units are comparable. The system features several key features: 1) Alignment of pattern units with different accounting frequencies within the same measurement space; 2) Cross-dimensional correlation units, which calculate the correlation factor between time dispersion and amount fluctuation based on time distribution and amount fluctuation data to obtain time-amount correlation data; 3) Cross-dimensional alignment numerically characterizes the linkage between when and how much occurs, providing relevant items for subsequent calculations; and 4) Aggregation strength factor units, which calculate the concentration of each pattern unit in the time and amount dimensions based on time-amount correlation data to obtain aggregation strength factors. This achieves an objective conversion from a set of multiple indicators to a unified scale, while retaining local reference values ​​to support subsequent independent evaluation and comparison of local segments.

[0037] The time distribution analysis unit is used to extract the start and end times of continuous transaction records within each pattern unit based on the structured pattern set, and to calculate the time distribution dispersion to obtain time distribution feature data, specifically including: First, the transaction records in each pattern unit are arranged in ascending order of time, and the timestamp data of each transaction is extracted. For the time series within a pattern unit, the system calculates the time interval between every two adjacent transactions to form a time interval sequence. Based on this time interval sequence, the system uses statistical analysis to calculate the average interval value and the variance or median absolute deviation value to reflect the concentration and volatility characteristics of the time distribution. Subsequently, the dispersion index of the time distribution is calculated. This index can be defined as the ratio of the time interval variance to the average interval, or the entropy function can be used to quantify the uniformity of the transaction distribution. For example, the time period is divided into several equally wide time windows, and the number of transactions in each window is counted to obtain a frequency distribution sequence, and the dispersion of the transaction time distribution is calculated. When the entropy value is low, it indicates that the transactions are concentrated in a specific time period; when the entropy value is high, it indicates that the transaction distribution is relatively uniform. Finally, the system combines the above results such as the average interval, variance, dispersion, and entropy value to form the time distribution feature data.

[0038] The quantitative unit for amount fluctuation is used to extract the increase or decrease in the amount of each transaction based on the set of structured patterns, and to calculate the gradient and stability coefficient of the amount change to obtain the amount fluctuation characteristic data, specifically including: First, the system calculates the amount difference between adjacent transaction records to obtain an amount increase / decrease sequence. The system performs absolute value processing on this sequence to obtain the magnitude of amount change, and divides it by the corresponding time interval to obtain the amount change gradient sequence, describing the rate of change of amount per unit time. The system can employ smoothing algorithms on the gradient sequence, such as moving median filtering or robust regression smoothing, to reduce the impact of single abnormal transactions. The system calculates the mean, standard deviation, and direction switching rate of the amount gradient. The direction switching rate is obtained by comparing the direction of increase / decrease of amount in adjacent transactions, reflecting the continuity or volatility of the direction of transaction amount change. An amount stability coefficient is also introduced to measure the smoothness of transaction amount changes; it can be defined as the reciprocal of the gradient variance or a normalized relative stability index. The system outputs the quantitative results of the amount change gradient, amount change stability coefficient, and direction switching rate as amount volatility characteristic data.

[0039] The cross-dimensional correlation unit is used to calculate the correlation factor between time dispersion and monetary fluctuation amplitude based on time distribution characteristic data and monetary fluctuation characteristic data, thereby obtaining time-monetary correlation data, specifically including: First, the time interval series and the amount change magnitude series are paired, ensuring a one-to-one correspondence between each time interval and its corresponding amount change, forming a time-amount paired dataset. The system then calculates the correlation factor using statistical correlation methods and uses the Pearson correlation coefficient to calculate the linear correlation between the two series. Simultaneously, based on mutual information, the degree of information dependence between time intervals and amount changes is measured, and a normalized mutual information value is obtained through probability density estimation. This value is then normalized, mapping all correlation results to a uniform numerical range, such as 0 to 1, and the overall time-amount correlation index is calculated. This index objectively reflects the correspondence between the temporal closeness of transaction activities and the intensity of amount changes. When the two are highly correlated, it indicates that fluctuations in transaction amounts often occur intensively over time; when they are unrelated, it indicates that the time and amount change characteristics are independent. Finally, the overall correlation factor, mutual information index, and correlation distribution within a local window are output, yielding the time-amount correlation data.

[0040] In a preferred embodiment of the present invention, the polymerization strength factor unit includes: The aggregation strength factor calculation unit is used to calculate the inverse centralization of time dispersion based on the ratio of time distribution dispersion to fixed time period length, thus obtaining the time centralization term; calculate the amount centralization term based on the ratio of amount change gradient to amount stability coefficient; calculate the basic aggregation degree by weighted fusion of the time centralization term and the amount centralization term, thus obtaining the basic aggregation term; and calculate the cross-dimensional amplification effect and suppress low correlation intervals based on the correlation factor, time centralization term, and amount centralization term, thus obtaining the interactive correlation term. Based on the basic aggregation term and the interaction-related term, the aggregation degree after cross-dimensional correction is calculated to obtain the interaction correction term; based on the number of transaction records and the proportion of record coverage time for each pattern unit, the sample sufficiency weight is calculated to obtain the confidence adjustment term; based on the joint proportion of the proportion of outliers and the proportion of abnormal fluctuations in amount within the pattern unit, the attenuation coefficient for the aggregation degree is calculated to obtain the noise suppression term. The interaction correction term, confidence adjustment term, and noise suppression term are fused to obtain the polymerization intensity factor.

[0041] In this embodiment of the invention, the aggregation intensity factor calculation unit is used to calculate the reverse concentration degree of time dispersion based on the ratio of time distribution dispersion to the length of a fixed time period, thereby obtaining a time concentration term. This transforms the original irregular timestamps into a measurable time compactness scalar, avoiding information loss caused by approximating time density with frequency. Based on the ratio of the amount change gradient to the amount stability coefficient, the unit calculates the amount concentration term, achieving dimensionless calculation and enabling comparison of amount sequences from different currency ranges and units on the same scale. The unit then performs a weighted fusion of the time concentration term and the amount concentration term to calculate the basic aggregation degree, obtaining a basic aggregation term. This suppresses the influence of high uncertainty components during fusion and avoids the intervention of external subjective thresholds. Finally, based on the correlation factor, the time concentration term, and the amount concentration term, the unit calculates the cross-dimensional amplification effect and suppresses low-correlation intervals, obtaining an interactive correlation term to avoid unorganized aggregation or pure amount fluctuations. Unexpected impacts may arise during fusion. Based on the basic aggregation term and the interaction-related term, the aggregation degree after cross-dimensional correction is calculated to obtain the interaction correction term, ensuring that the interaction effect is superimposed within the upper bound of the basic aggregation without exceeding the bound, preventing a single component from excessively amplifying the overall aggregation degree. Based on the number of transaction records and the proportion of record coverage time for each pattern unit, the sample sufficiency weight is calculated to obtain the confidence adjustment term, avoiding discrete jumps and maintaining the basic assumptions of estimation reliability. Based on the joint proportion of the proportion of outliers and the proportion of abnormal fluctuations in amount within the pattern unit, the attenuation coefficient for the aggregation degree is calculated to obtain the noise suppression term, implementing bounded and interpretable deduction for units with abnormally dense or drastic fluctuations. The interaction correction term, confidence adjustment term, and noise suppression term are fused to obtain the aggregation strength factor, which is used for the similarity judgment and combined feature mapping in the hierarchical reconstruction stage, maintaining the consistency of the semantics of the data before and after and the determinism of the interface.

[0042] In a preferred embodiment of the present invention, the reconstruction module includes: The difference matrix construction unit is used to calculate the factor difference of the aggregation intensity factor between any two mode units, and arranges each factor difference according to the mode unit number to obtain the factor difference matrix; The preliminary clustering unit is used to extract the cluster centers of factor differences based on the distribution characteristics of each element in the factor difference matrix, and to obtain similar pattern groups. The threshold determination unit is used to calculate a preset similarity threshold based on the density of cluster centers in the similar pattern grouping, and to filter similar pattern units that meet the preset similarity threshold to obtain a similar pattern set; Hierarchical combination building units are used to merge similar pattern units into a hierarchical pattern based on a set of similar patterns. Multiple hierarchical patterns are formed through repeated iterations to obtain hierarchical combination data. The multi-level structure generation unit is used to calculate the dependency weights between hierarchical patterns based on the hierarchical combination data, establish a multi-level pattern structure, and obtain reconstructed data.

[0043] In this embodiment of the invention, the difference matrix construction unit is used to calculate the factor difference of the aggregation intensity factor between any two pattern units, and arrange each factor difference according to the pattern unit number to obtain the factor difference matrix, ensuring that the distance information between any two units is preserved and avoiding bias caused by local neighborhoods; the preliminary clustering unit is used to extract the cluster centers of the factor differences based on the distribution characteristics of each element in the factor difference matrix to obtain similar pattern groups, avoiding random splicing based solely on individual pairs of similarity; the threshold determination unit is used to calculate a preset similarity threshold based on the density of the cluster centers in the similar pattern groups, and to select patterns that meet the preset similarity threshold. The similarity pattern unit generates a set of similar patterns that numerically satisfy a consistent upper bound constraint, ensuring that the input for subsequent hierarchical combinations has uniform similarity quality. The hierarchical combination construction unit merges similar pattern units into a hierarchical pattern based on the similar pattern set, and forms multiple hierarchical patterns through repeated iterations to obtain hierarchical combination data, ensuring that hierarchical generation follows the dual constraints of numerical consistency and statistical stability. The multi-layer structure generation unit calculates the dependency weights between hierarchical patterns based on the hierarchical combination data, establishes a multi-layer pattern structure, and obtains reconstructed data, realizing data organization from fragment patterns to global multi-layer patterns, providing a structured carrier and reading interface for subsequent processing.

[0044] The preliminary clustering unit is used to extract cluster centers of factor differences based on the distribution characteristics of each element in the factor difference matrix, thereby obtaining similar pattern groups. Specifically, it includes: First, the distribution of each element in the matrix is ​​analyzed. Based on the set of difference elements in the upper triangular part of the matrix, the probability density function graph of the factor difference is generated by statistically analyzing its distribution density. Then, the distribution curve is smoothed to identify the peak points in the low difference interval and the inflection points in the high difference interval. The peak points represent similar difference ranges that occur frequently in the overall data and are candidate regions for potential cluster centers. Based on the local extrema of these candidate intervals, the system determines several preliminary cluster center values ​​and sets the clustering bandwidth range for adjacent differences using these center values ​​as a benchmark. Using each cluster center as a reference, the system extracts the pattern unit pairs corresponding to all elements in the factor difference matrix that fall within this bandwidth range, establishing preliminary similarity connections. This connection relationship can be viewed as a graph structure, where nodes represent pattern units, and the existence of edges indicates that the difference between two pattern units falls into the same cluster interval. The system performs connectivity analysis on this graph structure, identifying all connected components, each of which represents a preliminary similar pattern grouping. The system calculates the average difference, variance, number of nodes, and edge density within each group to describe the stability and density of the group. Groups with high density and low variance are marked as stable groups, and their center points will be used as the input basis for subsequent threshold determination to obtain similar pattern groups.

[0045] The threshold determination unit is used to calculate a preset similarity threshold based on the density of cluster centers in similar pattern groups, and to filter similar pattern units that meet the preset similarity threshold to obtain a similar pattern set, specifically including: First, the cluster center density within each group is calculated. This density is based on the distribution of differences between node pairs within the group. The mean, variance, and skewness of these differences are statistically analyzed within each group. Based on these statistics, a density coefficient is calculated, reflecting the average similarity between pattern units within the group and the consistency of the difference distribution. Using the density coefficients of the top few high-density groups in the global distribution as samples, an adaptive threshold function is constructed. A preset similarity threshold is calculated using linear or nonlinear functional relationships. This threshold represents the maximum allowable range of differences that can be considered similar within a group. Then, all differences within each group are compared with the preset similarity threshold. Pattern unit pairs less than or equal to the threshold are selected, and their connections are preserved. For edges exceeding the threshold, the system removes them from the graph structure and recalculates the node set for the remaining connected components to obtain a set of similar patterns.

[0046] The multi-layer structure generation unit is used to calculate the dependency weights between hierarchical patterns based on the hierarchical combination data, establish a multi-layer pattern structure, and obtain reconstructed data, specifically including: First, the dependency weights between patterns at each level are calculated, with each high-level pattern and its corresponding sub-patterns as the analysis objects. For any pair of sub-patterns and parent patterns, the system calculates the dependency weights based on two types of information: one is the proportion of pattern units contained in the sub-pattern to all child nodes of the parent pattern; the other is the similarity between the aggregation strength factor represented by the sub-pattern and the factor represented by the parent pattern. The system normalizes these two types of indicators to the [0,1] interval and then performs a weighted sum to obtain the dependency weights. After completing the single-layer weight calculation, the system normalizes the incoming edge weights of all parent patterns to ensure that the sum of the weights of all child nodes under the same parent node equals 1, achieving comparability between different levels. Then, based on nodes and dependency weights, directed connections between layers are constructed. If the system detects a circular dependency, it adjusts the node order through topological sorting to ensure that the overall structure forms an acyclic directed graph. The system stores the representative factor, variance, sample size, and sub-pattern node information of each node together to form reconstructed data.

[0047] In a preferred embodiment of the present invention, the difference module includes: The amount direction deviation unit is used to extract the direction of amount change of each transaction record in each level pattern based on the reconstructed data, and calculate the difference of amount change vector between adjacent transaction records to obtain amount deviation data. The time interval deviation unit is used to calculate the time interval between each transaction record and its adjacent transaction records based on the reconstructed data, and to calculate the dispersion of the time interval sequence to obtain the time deviation data. The dynamic difference identification unit is used to calculate the overall degree of deviation based on the amount deviation data and the time deviation data, identify the hierarchical pattern of deviation in both time and amount directions, and obtain dynamic difference data. The volatility difference index unit is used to integrate the comprehensive deviation of each level of pattern based on dynamic difference data, calculate the dynamic difference of the level pattern, and obtain the volatility difference index.

[0048] In this embodiment of the invention, the amount direction deviation unit is used to extract the direction of amount change of each transaction record in each level pattern according to the reconstructed data, and calculate the difference in amount change vectors between adjacent transaction records to obtain amount deviation data, thus transforming the sign change and adjacent differences of the original amount sequence into a quantifiable direction deviation trajectory; the time interval deviation unit is used to calculate the time interval between each transaction record and adjacent transaction records according to the reconstructed data, and calculate the dispersion of the time interval sequence to obtain time deviation data, thus transforming the rhythm information of the event interval into a dispersion representation, and obtaining a unified comparison benchmark between different levels and different activity objects; dynamic difference identification unit. The first unit, Yuan, is used to calculate the overall deviation degree based on the amount deviation data and the time deviation data, identify the hierarchical patterns of deviation in both time and amount directions, obtain dynamic difference data, and ensure that the results can be referenced and sorted by the hierarchical structure. Combined with the dependency order, the deviation is no longer an isolated point but a segment object related to the context. The second unit, the Fluctuation Difference Index, is used to fuse the overall deviation degree of each hierarchical pattern based on the dynamic difference data, calculate the dynamic difference degree of the hierarchical pattern, and obtain the Fluctuation Difference Index. It also includes statistical information from two independent sources: amount direction and time rhythm, reflecting the proportion of deviation on the time axis, ensuring that direct comparison and sorting can be performed between different levels.

[0049] The amount direction deviation unit is used to extract the direction of amount change for each transaction record in each level of the pattern based on the reconstructed data, and to calculate the vector difference of amount change between adjacent transaction records to obtain amount deviation data, specifically including: First, transaction records within each tier are arranged chronologically to ensure temporal continuity across all transaction sequences. Then, the system sequentially takes two adjacent transaction records and calculates the difference between the amount of the later transaction and the amount of the earlier transaction to determine the current transaction's amount change. If the current transaction amount is greater than the previous transaction amount, the transaction direction is determined to be upward; if the current transaction amount is less than the previous transaction amount, the transaction direction is determined to be downward; if the two transaction amounts are equal, the amount is considered stable. The system records the direction of change of all transaction records sequentially to form a direction sequence. Using a certain time window, the system statistically analyzes the positive and negative proportions of consecutive transaction directions within the window to determine the main directional trend of amount change within that window. Further, the difference between two adjacent transaction directions is calculated to reflect the degree of directional change. By accumulating and averaging the direction differences of all transaction records chronologically, the system obtains a continuous curve representing the degree of deviation in the direction of amount change. For cases with multiple tiers, the system normalizes and aligns the direction deviation curves of different tiers with the time scale based on tier dependency information, forming amount deviation data.

[0050] The time interval deviation unit is used to calculate the time interval between each transaction record and its adjacent transaction records based on the reconstructed data, and to calculate the dispersion of the time interval sequence to obtain the time deviation data, specifically including: First, the system extracts the time information of each transaction record and calculates the time interval between adjacent transactions sequentially to obtain a time interval sequence, representing the time distribution characteristics between transactions. The system standardizes all time intervals by calculating the median and mean deviation of the time interval sequence, converting the original interval data into dimensionless relative values. Then, the system performs dispersion analysis on the standardized time interval sequence, calculating the variance or coefficient of variation of the time interval values ​​within a fixed-length time window to measure the stability of the trading rhythm within that time period. A smaller variance indicates more uniform transaction time intervals; a larger variance indicates unstable or sudden trading characteristics. Further calculation of the differences between consecutive time intervals reveals the changing trends of the trading rhythm. By superimposing the time interval dispersion curve and the difference curve in time, a time deviation curve is formed. Time deviation curves at different levels are then normalized to a uniform scale and smoothed at the boundaries to generate time deviation data.

[0051] The dynamic difference identification unit is used to calculate the overall degree of deviation based on the amount deviation data and the time deviation data, identify the hierarchical patterns of deviation in both time and amount directions, and obtain dynamic difference data, specifically including: First, the two types of deviation data are aligned along the time dimension to ensure that the monetary deviation and time deviation have a corresponding matching relationship at the same time point. Then, the two types of data are standardized separately to ensure their numerical distribution is within a directly comparable range. Next, for each time point, the standardized values ​​of both monetary and time deviations are extracted simultaneously and fused to generate a comprehensive deviation. This fusion can be achieved through linear weighting or sliding time integration, obtaining a comprehensive deviation value reflecting the degree of two-dimensional deviation at each time point. The comprehensive deviation value changes continuously along the time axis, forming a comprehensive deviation curve. Further, based on the structural information of the hierarchical pattern, the comprehensive deviation curve is divided into intervals, and the statistics of the comprehensive deviation value in each hierarchical pattern are calculated, such as the interval average or interval integral, to obtain the comprehensive deviation of the hierarchical pattern. Based on the relative relationship of these comprehensive deviation values ​​between different levels, hierarchical patterns with deviation characteristics in both the time and monetary directions are identified, resulting in dynamic difference data.

[0052] In a preferred embodiment of the present invention, the fluctuation difference index unit includes: The volatility difference index calculation unit is used to calculate the relative volatility of amount changes and time changes based on amount deviation data and time deviation data, and obtain a two-dimensional deviation ratio term; calculate the consistency of the direction of amount change in the time series based on the trend of amount deviation data, and obtain a direction deviation consistency term; and calculate the coupling strength of time fluctuation based on the volatility sequence of time deviation data, and obtain a dynamic coupling strength term. Based on the two-dimensional deviation ratio term, the directional deviation consistency term, and the dynamic coupling strength term, the interaction strength between amount and time deviation in the two-dimensional space is calculated to obtain the nonlinear response term. The two-dimensional deviation ratio term, the directional deviation consistency term, the dynamic coupling strength term, and the nonlinear response term are weighted and fused to calculate the dynamic difference degree of the hierarchical pattern and obtain the fluctuation difference index.

[0053] In this embodiment of the invention, the fluctuation difference index calculation unit is used to calculate the relative fluctuation degree of amount change and time change based on amount deviation data and time deviation data, obtaining a two-dimensional deviation ratio term, realizing a dimensionless comparison of amount deviation relative to time deviation, ensuring that the ratio term reflects the median structure of the sequence rather than individual peaks; based on the changing trend of amount deviation data, it calculates the consistency of the direction of amount change in the time series, obtaining a direction deviation consistency term, reflecting the sequence order at the direction level, realizing the orthogonal expression of both amplitude and direction information; based on the fluctuation sequence of time deviation data, it calculates the coupling strength of time fluctuation, obtaining a dynamic coupling strength term, avoiding... To avoid misjudgments caused by single sporadic peaks, the system characterizes the synchronous structure independently of absolute amplitude, providing independent evidence for subsequent analysis. Based on the two-dimensional deviation ratio term, directional deviation consistency term, and dynamic coupling strength term, the system calculates the interaction strength between monetary and temporal deviations in two-dimensional space, obtaining a nonlinear response term. This limits the influence of extreme values ​​and maintains monotonicity, forming a comparable and rankable interaction strength quantity. By weighted and fused the two-dimensional deviation ratio term, directional deviation consistency term, dynamic coupling strength term, and nonlinear response term, the system calculates the dynamic difference degree of hierarchical patterns, obtaining a fluctuation difference index. This ensures direct comparison between different hierarchical patterns, providing a single-scale input for subsequent analysis.

[0054] In a preferred embodiment of the present invention, the identification module includes: The combined feature extraction unit is used to perform feature mapping between the aggregation intensity factor and the fluctuation difference index of each mode unit, calculate the interaction correlation degree, and obtain combined feature data. The feature difference unit is used to calculate the feature difference value between each mode unit based on the combined feature data, and to establish a feature difference curve based on the feature difference value to obtain the feature difference data. The pattern matching unit is used to calculate the matching deviation value between the combined features and the pattern features in the multi-layer pattern structure based on the feature difference data, identify abnormal transaction records, and obtain preliminary abnormal data. The anomaly identification unit is used to filter and re-evaluate abnormal transaction records based on preliminary abnormal data, determine the pattern unit to which the abnormal transaction record belongs, and obtain the abnormal transaction identification result.

[0055] In this embodiment of the invention, a combined feature extraction unit is used to perform feature mapping between the aggregation intensity factor and the volatility difference index of each pattern unit, calculate the interaction correlation degree, and obtain combined feature data. This ensures that indicators under different dimensions can be fused on a unified scale, avoiding weight imbalance caused by differences in time span or monetary magnitude. A feature difference unit is used to calculate the feature difference value between each pattern unit based on the combined feature data, and establish a feature difference curve based on the feature difference value to obtain feature difference data. This quantitatively expresses the relative distribution of features between patterns, transforming the abstract multidimensional feature relationship into a measurable difference curve. A pattern matching unit is used to calculate the matching deviation value between the combined features and the pattern features in the multi-layer pattern structure based on the feature difference data, identify abnormal transaction records, obtain preliminary abnormal data, identify pattern units that significantly deviate from the hierarchical structure in the combined feature space, and achieve preliminary positioning of abnormal patterns. An anomaly identification unit is used to screen and re-determine abnormal transaction records based on the preliminary abnormal data, determine the pattern unit to which the abnormal transaction record belongs, obtain abnormal transaction identification results, distinguish between pattern deviation caused by real abnormal behavior and false anomalies caused by single occasional fluctuations, and ensure the accuracy of the results.

[0056] The feature difference unit is used to calculate the feature difference values ​​between each mode unit based on the combined feature data, and to establish a feature difference curve based on the feature difference values ​​to obtain feature difference data, specifically including: First, the system extracts the feature vector corresponding to each mode unit. This feature vector includes the aggregation intensity factor and fluctuation difference index of the mode unit. Then, the system calculates the overall mean and covariance matrix from the feature vectors of all mode units and performs a positive definiteness test on the covariance matrix. If the covariance matrix is ​​not invertible, a small correction value is added to its diagonal position to ensure invertibility. Next, the system uses the obtained covariance matrix and mean to perform a whitening transformation on all feature vectors, so that each feature vector has a standardized scale after processing. The system calculates the degree of difference between the feature vectors of any two mode units. This difference can be regarded as the distance between the two mode units in the feature space. When the number of mode units is large, the system only retains a few difference values ​​between each mode unit and its nearest neighbors, constructing a sparse difference matrix. Then, the system calculates the local average difference value and local density value for each mode unit. The local average difference represents the average degree of feature difference between the unit and its surrounding units, and the local density represents the degree of clustering of the unit in the feature space. The system sorts all pattern units based on the results of local average difference and local density: first, it sorts them from largest to smallest difference value; then, when difference values ​​are similar, it sorts them from smallest to largest density value, prioritizing the display of potential outliers. A feature difference sequence is generated and smoothed to eliminate noise. Using first-order differencing and median filtering, the system suppresses fluctuations in local outliers. Spline interpolation is then used to form a continuous feature difference curve. The system calculates the first-order slope and second-order curvature of this curve to determine the inflection point, which represents the transition boundary between similar and significantly outlier patterns. The difference matrix, local average difference, local density, and feature difference curve together form the feature difference data.

[0057] The pattern matching unit is used to calculate the matching deviation value between the combined features and the pattern features in the multi-layer pattern structure based on the feature difference data, identify abnormal transaction records, and obtain preliminary abnormal data, specifically including: First, a representative feature vector is extracted for each level of pattern. This representative feature is obtained by weighting the aggregation strength factor and volatility difference index of all pattern units within that level, where the weighting value is determined by the proportion of transaction records contained in the pattern unit. Based on the statistical distribution of the overall features, the system constructs a feature weight matrix to balance the relative contributions in both aggregation strength and volatility difference directions. Next, the deviation between each pattern unit and the representative features of each level is calculated. This deviation reflects the similarity between the pattern unit and the hierarchical structure; a larger deviation indicates a greater difference between the pattern unit and the hierarchical pattern in the feature space. Then, based on the inflection point information of the feature difference curve, a data-driven reference interval is determined, where the upper limit represents the location where the feature difference curve changes significantly. For each pattern unit, the system extracts the minimum deviation value and its corresponding level number across all levels, representing which level the unit is closest to. If the minimum deviation exceeds the upper limit of the reference interval, the unit is marked as a preliminary anomaly. If the minimum deviation is within the reference interval, the system performs a consistency check on the unit's nearest neighbor set, calculating the average deviation and variance of its nearest neighbor units at the same level to determine whether the unit deviates significantly within a local range. If the minimum deviation is below the lower limit of the reference interval, it is considered a normal unit. The set of pattern units marked as anomalies through preliminary screening or consistency verification is output as preliminary anomaly data, and each unit's corresponding level, minimum deviation, and nearest neighbor statistics are recorded.

[0058] The anomaly identification unit is used to filter and re-evaluate abnormal transaction records based on preliminary anomaly data, determine the pattern unit to which the abnormal transaction record belongs, and obtain the abnormal transaction identification result, specifically including: First, structural backtracking is performed on each pattern unit marked as anomalous to determine its position within the multi-layered pattern structure. Then, using the mapping relationships recorded in the reconstructed data, the transaction record coverage ratio and time coverage ratio of that pattern unit in the original data are calculated. The transaction record coverage ratio represents the ratio of the number of transaction records contained in that pattern unit to the total number of records for that transaction object; the time coverage ratio represents the ratio of the time range covered by that unit to the entire analysis interval. Simultaneously, the number of consecutive segments and the length of the longest consecutive segment of that pattern unit on the time axis are counted to distinguish between persistent and sporadic anomalies. Next, the structural consistency index between the anomalous pattern unit and its parent and sibling units at the same level is calculated. This index reflects the degree of difference between the pattern unit and its surrounding structure. If the consistency index is in a high-difference region, and both the transaction record coverage ratio and the time coverage ratio exceed a preset minimum threshold, the system classifies the unit as a structural anomaly; if the consistency index is low, it is considered a local noise anomaly. For structurally abnormal units, the system further examines the transaction time intervals and the direction of amount changes within the unit, calculating the dispersion of the time intervals and the consistency of the amount direction. When the time intervals within the unit deviate significantly in a statistical sense while the direction of amount changes remains consistent, its abnormal state is confirmed as valid. If the fluctuations in time intervals and the changes in direction are close to normal, it is downgraded to a suspicious but not definitive abnormality. For pattern units marked as local noise, a merging test is performed, attempting to connect them with adjacent abnormal candidates on the time axis. If the merged units meet the structural coverage and deviation conditions, the multiple small units are re-merged into a new abnormal unit, and the relevant indicators are recalculated. Finally, a list of corresponding abnormal transaction records is generated for all abnormal units that pass the screening and review, yielding the abnormal transaction identification results.

[0059] In a preferred embodiment of the present invention, the combined feature extraction unit includes: The normalization processing unit is used to normalize the aggregation intensity factor and fluctuation difference index of each mode unit, eliminate dimensional bias, and obtain normalized feature data. The feature mapping unit is used to map the aggregation intensity factor and the volatility difference index to the same feature space based on the normalized feature data, and to calculate the density of the feature distribution to obtain the feature mapping matrix. The interaction weight calculation unit is used to calculate the interaction weight between the aggregation intensity factor and the volatility difference index based on their covariance ratio and gradient direction, and obtain the interaction weight data. The correlation generation unit is used to perform weighted integration on the feature mapping matrix based on the interaction weight data, calculate the interaction correlation of each mode unit in the time dimension and the monetary dimension, and obtain the combined feature data.

[0060] In this embodiment of the invention, a normalization processing unit is used to normalize the aggregation intensity factor and fluctuation difference index of each mode unit, eliminate dimensional bias, obtain normalized feature data, establish a unified reference system at the dimensional and scale levels, and achieve comparability between the aggregation intensity factor and the fluctuation difference index; a feature mapping unit is used to map the aggregation intensity factor and fluctuation difference index to the same feature space based on the normalized feature data, calculate the density of the feature distribution, obtain the feature mapping matrix, and organize the discrete mode units into a continuous density field in the two-dimensional normalized space, providing a derivative basis for subsequent gradient and directionality analysis; interaction The weight calculation unit is used to calculate the interaction weight between the aggregation intensity factor and the volatility difference index based on their covariance ratio and gradient direction, thus obtaining interaction weight data. The covariance ratio reflects the strength of the overall linear coupling, and the gradient direction reflects the consistency between the local density gradient and the local feature direction. The correlation generation unit is used to perform weighted integration on the feature mapping matrix based on the interaction weight data, calculate the interaction correlation of each pattern unit in the time dimension and the monetary dimension, and obtain combined feature data. This transforms the local environment of the pattern unit from a point state description to a kernel integral description, objectively presenting the interaction correlation of the pattern units in the two-dimensional space.

[0061] The feature mapping unit is used to map the aggregation intensity factor and the volatility difference index to the same feature space based on the normalized feature data, and to calculate the density of the feature distribution to obtain the feature mapping matrix, specifically including: First, a unified two-dimensional feature space is established, with the aggregation intensity factor as the x-axis and the volatility difference index as the y-axis, constructing a feature plane that can be used to measure the relationship between the two types of features. Then, all pattern units are projected onto this plane according to their corresponding two feature values, ensuring that each pattern unit occupies a unique coordinate point in space. The system divides this plane into equally spaced grid regions, counting the number of pattern units falling into each grid to obtain preliminary distribution density data. Since trading behavior data may exhibit discreteness or extreme fluctuations in different dimensions, the system uses a Gaussian smoothing function to convolve the entire plane, making the density changes in local regions spatially represent a continuous function distribution. The system calculates the density gradient direction and magnitude for each grid unit in the feature space to characterize the spatial trend of feature changes. Finally, a feature mapping matrix is ​​generated based on the density data and gradient information, where each position corresponds to a specific spatial density value and local directional feature, reflecting the distribution state of the aggregation intensity factor and volatility difference index in the feature space and their local variation relationship.

[0062] The interaction weight calculation unit is used to calculate the interaction weight between the aggregation intensity factor and the volatility difference index based on their covariance ratio and gradient direction, thereby obtaining interaction weight data, specifically including: First, the covariance and individual variance of the aggregation intensity factor and volatility difference index are calculated globally to obtain the covariance ratio, representing the degree of linear coupling between the two types of features in the overall distribution. Then, for each pattern unit, the gradient direction of the density field in its region is extracted, representing the direction of change in the local feature distribution. Simultaneously, within the neighborhood of each pattern unit, local linear fitting is performed on the aggregation intensity and volatility difference features of surrounding sample points to obtain the main direction of change in that region. The density gradient direction is compared with the local trend direction, and the cosine of the angle between them is calculated as the directional consistency coefficient, describing the synergy of local features. Within the neighborhood of each pattern unit, the variance of aggregation intensity and volatility difference is calculated, and a contrast factor is obtained to characterize the significance of feature changes within that region. Based on the global covariance ratio, the directional consistency coefficient, and the contrast factor, interaction weight values ​​are calculated, representing the relative importance and local correlation strength of the pattern unit in the feature space, thus obtaining the interaction weight data.

[0063] The correlation generation unit is used to perform weighted integration on the feature mapping matrix based on the interaction weight data, calculate the interaction correlation of each mode unit in the time and monetary dimensions, and obtain combined feature data, specifically including: First, a local window is constructed in the two-dimensional feature space centered on the coordinates of each pattern unit. A weight function is defined based on the distance from the grid points within the window to the center point, giving higher weight to points that are closer in the calculation. The density values ​​in the feature mapping matrix are then weighted and integrated using the interaction weights as coefficients. This integrates the density relationships between each pattern unit and other points in its neighborhood into a continuous integral result, yielding a value reflecting the local feature coupling of the pattern unit. Based on this, marginal integration is performed along the horizontal (time dimension) and vertical (monetary dimension) directions to obtain one-dimensional correlation data. These results are then combined with the two-dimensional integral results to form a complete correlation vector, determining the interactive correlation information of the pattern units in the two-dimensional space and their feature dependencies in the single dimension, thus obtaining combined feature data.

[0064] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An automatic identification system for abnormal transactions in audit data based on machine learning, characterized in that: The system includes: The model module is used to build an anomaly detection model based on an autoencoder. The anomaly detection model is used to perform unsupervised learning on audit data and identify abnormal data therein. The mapping module is used to acquire audit transaction data and combine the transaction records of the transaction objects within a fixed time period to identify the correlation between the transaction objects in the time and amount dimensions, thereby obtaining a mapping dataset. The decomposition module is used to decompose transaction records according to the trend of amount change and time continuity based on the mapping dataset, generate multiple pattern units, and obtain a structured pattern set. The aggregation module is used to identify the time span and amount range of each pattern unit based on the set of structured patterns, calculate the degree of concentration of transaction records in the time and amount dimensions, and obtain the aggregation strength factor. The reconstruction module is used to combine pattern units whose aggregation intensity factor difference meets the preset similar threshold into multiple hierarchical patterns, establish a multi-level pattern structure between transaction records, and obtain reconstructed data. The difference module is used to calculate the degree of deviation of each level pattern in the direction of amount change and time interval based on the reconstructed data, identify the degree of dynamic difference of each level pattern, and obtain the fluctuation difference index. The identification module is used to determine the pattern unit to which the abnormal record belongs by comparing the combined characteristics of the aggregation intensity factor and volatility difference index in the multi-layer pattern structure, and obtain the abnormal transaction identification result.

2. The automatic identification system for abnormal transactions in audit data based on machine learning according to claim 1, characterized in that, The mapping module includes: The transaction record unit is used to extract the transaction time and transaction amount of each transaction object based on the audited transaction data, determine the transaction record of each transaction object, and obtain the transaction record data; The time allocation unit is used to allocate each transaction record to a fixed time period based on the transaction time in the transaction record data, thereby obtaining time period transaction data; The amount recognition unit is used to classify transaction records with the same amount change trend corresponding to the transaction object based on the transaction amount in the transaction record data, and obtain amount-related data. The mapping dataset generation unit is used to combine the relationships between each transaction record in the time and amount dimensions based on the transaction data and amount correlation data over a time period to obtain the mapping dataset.

3. The automatic identification system for abnormal transactions in audit data based on machine learning according to claim 2, characterized in that, The decomposition module includes: The amount change trend unit is used to extract the amount change magnitude of each transaction record based on the mapping dataset, calculate the trend value of the amount change magnitude, and obtain the amount change trend data. The time continuity detection unit is used to calculate the time interval between each transaction record and the preceding and following transaction records based on the transaction time of each transaction record, so as to obtain time continuity data; The pattern classification unit is used to classify transaction records according to the trend of amount change and the continuity of time based on the amount change data and the time continuity data, so as to obtain a set of classification patterns; The structured pattern unit is used to identify the correlation between transaction records in terms of amount and time based on the classification pattern set, generate multiple pattern units, and obtain a structured pattern set.

4. The automatic identification system for abnormal transactions in audit data based on machine learning according to claim 3, characterized in that, The aggregation module includes: The time distribution analysis unit is used to extract the start and end times of continuous transaction records within each pattern unit based on the structured pattern set, and to calculate the time distribution dispersion to obtain time distribution feature data. The quantitative unit for amount fluctuation is used to extract the increase or decrease of the amount of each transaction based on the set of structured patterns, and to calculate the gradient and stability coefficient of the amount change to obtain the characteristic data of amount fluctuation. The cross-dimensional correlation unit is used to calculate the correlation factor between time dispersion and monetary fluctuation amplitude based on time distribution characteristic data and monetary fluctuation characteristic data, so as to obtain time-money correlation data. The aggregation strength factor unit is used to calculate the degree of concentration of each pattern unit in the time and amount dimensions based on time and amount-related data, and obtain the aggregation strength factor.

5. The automatic identification system for abnormal transactions in audit data based on machine learning according to claim 4, characterized in that, The polymerization strength factor unit includes: The aggregation strength factor calculation unit is used to calculate the inverse centralization of time dispersion based on the ratio of time distribution dispersion to fixed time period length, thus obtaining the time centralization term; calculate the amount centralization term based on the ratio of amount change gradient to amount stability coefficient; calculate the basic aggregation degree by weighted fusion of the time centralization term and the amount centralization term, thus obtaining the basic aggregation term; and calculate the cross-dimensional amplification effect and suppress low correlation intervals based on the correlation factor, time centralization term, and amount centralization term, thus obtaining the interactive correlation term. Based on the basic aggregation term and the interaction-related term, the aggregation degree after cross-dimensional correction is calculated to obtain the interaction correction term; based on the number of transaction records and the proportion of record coverage time for each pattern unit, the sample sufficiency weight is calculated to obtain the confidence adjustment term; based on the joint proportion of the proportion of outliers and the proportion of abnormal fluctuations in amount within the pattern unit, the attenuation coefficient for the aggregation degree is calculated to obtain the noise suppression term. The interaction correction term, confidence adjustment term, and noise suppression term are fused to obtain the polymerization intensity factor.

6. The automatic identification system for abnormal transactions in audit data based on machine learning according to claim 5, characterized in that, The reconstruction module includes: The difference matrix construction unit is used to calculate the factor difference of the aggregation intensity factor between any two mode units, and arranges each factor difference according to the mode unit number to obtain the factor difference matrix; The preliminary clustering unit is used to extract the cluster centers of factor differences based on the distribution characteristics of each element in the factor difference matrix, and to obtain similar pattern groups. The threshold determination unit is used to calculate a preset similarity threshold based on the density of cluster centers in the similar pattern grouping, and to filter similar pattern units that meet the preset similarity threshold to obtain a similar pattern set; Hierarchical combination building units are used to merge similar pattern units into a hierarchical pattern based on a set of similar patterns. Multiple hierarchical patterns are formed through repeated iterations to obtain hierarchical combination data. The multi-level structure generation unit is used to calculate the dependency weights between hierarchical patterns based on the hierarchical combination data, establish a multi-level pattern structure, and obtain reconstructed data.

7. The automatic identification system for abnormal transactions in audit data based on machine learning according to claim 6, characterized in that, The difference module includes: The amount direction deviation unit is used to extract the direction of amount change of each transaction record in each level pattern based on the reconstructed data, and calculate the difference of amount change vector between adjacent transaction records to obtain amount deviation data. The time interval deviation unit is used to calculate the time interval between each transaction record and its adjacent transaction records based on the reconstructed data, and to calculate the dispersion of the time interval sequence to obtain the time deviation data. The dynamic difference identification unit is used to calculate the overall degree of deviation based on the amount deviation data and the time deviation data, identify the hierarchical pattern of deviation in both time and amount directions, and obtain dynamic difference data. The volatility difference index unit is used to integrate the comprehensive deviation of each level of pattern based on dynamic difference data, calculate the dynamic difference of the level pattern, and obtain the volatility difference index.

8. The automatic identification system for abnormal transactions in audit data based on machine learning according to claim 7, characterized in that, The volatility difference index unit includes: The volatility difference index calculation unit is used to calculate the relative volatility of amount changes and time changes based on amount deviation data and time deviation data, and obtain a two-dimensional deviation ratio term; calculate the consistency of the direction of amount change in the time series based on the trend of amount deviation data, and obtain a direction deviation consistency term; and calculate the coupling strength of time fluctuation based on the volatility sequence of time deviation data, and obtain a dynamic coupling strength term. Based on the two-dimensional deviation ratio term, the directional deviation consistency term, and the dynamic coupling strength term, the interaction strength between amount and time deviation in the two-dimensional space is calculated to obtain the nonlinear response term. The two-dimensional deviation ratio term, the directional deviation consistency term, the dynamic coupling strength term, and the nonlinear response term are weighted and fused to calculate the dynamic difference degree of the hierarchical pattern and obtain the fluctuation difference index.

9. The automatic identification system for abnormal transactions in audit data based on machine learning according to claim 8, characterized in that, The identification module includes: The combined feature extraction unit is used to perform feature mapping between the aggregation intensity factor and the fluctuation difference index of each mode unit, calculate the interaction correlation degree, and obtain combined feature data. The feature difference unit is used to calculate the feature difference value between each mode unit based on the combined feature data, and to establish a feature difference curve based on the feature difference value to obtain the feature difference data. The pattern matching unit is used to calculate the matching deviation value between the combined features and the pattern features in the multi-layer pattern structure based on the feature difference data, identify abnormal transaction records, and obtain preliminary abnormal data. The anomaly identification unit is used to filter and re-evaluate abnormal transaction records based on preliminary abnormal data, determine the pattern unit to which the abnormal transaction record belongs, and obtain the abnormal transaction identification result.

10. The automatic identification system for abnormal transactions in audit data based on machine learning according to claim 9, characterized in that, The combined feature extraction unit includes: The normalization processing unit is used to normalize the aggregation intensity factor and fluctuation difference index of each mode unit, eliminate dimensional bias, and obtain normalized feature data. The feature mapping unit is used to map the aggregation intensity factor and the volatility difference index to the same feature space based on the normalized feature data, and to calculate the density of the feature distribution to obtain the feature mapping matrix. The interaction weight calculation unit is used to calculate the interaction weight between the aggregation intensity factor and the volatility difference index based on their covariance ratio and gradient direction, and obtain the interaction weight data. The correlation generation unit is used to perform weighted integration on the feature mapping matrix based on the interaction weight data, calculate the interaction correlation of each mode unit in the time dimension and the monetary dimension, and obtain the combined feature data.

Images