Intelligent internal audit method and system based on deep learning and unsupervised learning
By employing intelligent internal auditing methods that combine deep learning and unsupervised learning, a behavioral baseline model is constructed and a deep learning model is adaptively configured. This addresses the issues of incomplete coverage, passive response, and low efficiency inherent in traditional internal auditing, achieving comprehensive monitoring and efficient auditing.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- YGSOFT INC
- Filing Date
- 2026-03-24
- Publication Date
- 2026-06-05
AI Technical Summary
Traditional internal audit techniques suffer from incomplete coverage, passive response, static rigidity, and low efficiency. They are difficult to identify new fraud patterns, and are also difficult to maintain, resulting in low audit efficiency.
An intelligent internal audit method based on deep learning and unsupervised learning is adopted. By acquiring historical multi-source business data of the enterprise, a behavioral baseline model is constructed, anomaly detection is performed using unsupervised learning algorithms, and a deep learning model is adaptively configured for in-depth analysis to generate a structured audit report.
It enables comprehensive monitoring of business activities, improves audit efficiency and accuracy, reduces costs, has dynamic adaptability, and ensures the standardization and consistency of audit work.
Smart Images
Figure CN122155884A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of intelligent auditing technology, specifically relating to an intelligent internal auditing method and system based on deep learning and unsupervised learning. Background Technology
[0002] Auditing is a systematic process of objectively collecting and evaluating evidence to ascertain the degree of consistency between the identification of relevant economic activities and phenomena and the established standards, and then communicating the results to interested users. It is carried out by specialized institutions and personnel in accordance with the law to examine the authenticity, legality, and effectiveness of the audited entity's financial and accounting revenues and expenditures and related economic activities, in order to maintain financial discipline, improve business management, enhance economic efficiency, and promote independent economic supervision activities for macroeconomic control.
[0003] Traditional internal auditing relies on the professional experience of auditors and manual sampling inspection. The main technical means used include two types: one is to use an automated auditing system based on a predefined rule base; the other is to use a risk screening tool based on a supervised learning model. However, the above technical means have obvious defects, such as (1) incomplete coverage and passive response: the predefined rule base can only find predefined and known types of violations, but cannot identify new and hidden fraud patterns. The supervised learning model relies on a large number of accurate labeled problem samples, but these sample data are difficult to obtain in actual audit scenarios and are difficult to deal with new risks outside the training set; (2) static rigidity and maintenance difficulties: once the rules and models are deployed, their judgment logic is fixed. When the enterprise's business model, accounting standards or fraud methods change, it is necessary to manually re-analyze and update the rules or retrain the model, which leads to a lack of adaptability and difficulty in maintenance; (3) low efficiency: auditors need to spend a lot of time on repetitive labor such as data sorting and basic verification, which makes it difficult for them to concentrate on in-depth professional judgment and verification of high-risk areas.
[0004] Therefore, how to provide an effective technical solution to address the problems of incomplete coverage, passive response, static rigidity, maintenance difficulties, and low efficiency in existing technologies has become an urgent problem to be solved. Summary of the Invention
[0005] The purpose of this invention is to provide an intelligent internal auditing method and system based on deep learning and unsupervised learning, in order to solve the above-mentioned problems existing in the prior art.
[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides an intelligent internal auditing method based on deep learning and unsupervised learning, comprising: The process involves acquiring historical multi-source business data of an enterprise, preprocessing the historical multi-source business data to obtain preprocessed historical multi-source business data, and using an unsupervised learning algorithm to learn from the preprocessed historical multi-source business data in order to construct a behavioral baseline model for normal business patterns. Acquire real-time multi-source heterogeneous data collected from different business systems within the enterprise, and perform anomaly detection on the real-time multi-source heterogeneous data based on the behavioral baseline model to obtain a potential anomaly dataset. For each potential anomaly in the potential anomaly dataset, the structure of the deep learning model is adaptively configured, and the configured deep learning model is used to perform deep analysis on the potential anomaly data to obtain structured analysis results. The structured analysis results of all potentially abnormal data are summarized to obtain a structured audit report.
[0007] In one possible design, historical multi-source business data of the enterprise is acquired, and the historical multi-source business data of the enterprise is preprocessed to obtain preprocessed historical multi-source business data, including: Raw, multi-source heterogeneous data is collected from multiple business systems within the enterprise, including structured and unstructured data. Based on preset business rules and statistical methods, missing and outlier values in structured and unstructured data are removed to obtain processed structured data and processed unstructured data. Natural language processing techniques are used to perform entity recognition on the processed structured data and the processed unstructured data to obtain a first entity and a second entity. The processed structured data and the processed unstructured data are aligned based on the same entities in the first entity and the second entity to obtain aligned structured data and aligned unstructured data. Feature extraction is performed on the aligned unstructured data corresponding to the second entity to obtain a structured feature vector. The aligned structured data, aligned unstructured data, and structured feature vectors are combined to obtain preprocessed historical multi-source business data.
[0008] In one possible design, the structured data includes at least one of the following: accounting vouchers, accounting books, accounting statements, bank receipts, bank statements, and business documents; the unstructured data includes at least one of the following: accounting vouchers, accounting books, accounting statements, bank receipts, bank statements, business documents, scanned copies of contracts, and approval document texts.
[0009] In one possible design, an unsupervised learning algorithm is used to learn the preprocessed historical multi-source business data, including at least one of the following: Clustering algorithms are used to perform cluster analysis on the preprocessed historical multi-source business data to obtain first potential abnormal data, which includes historical multi-source business data points that do not belong to the core cluster or are located in sparse areas. The local outlier factor algorithm is used to detect fluctuation anomalies in the preprocessed historical multi-source business data to obtain second potential anomaly data. The second potential anomaly data includes historical multi-source business data points whose local density deviation is greater than a preset anomaly threshold.
[0010] In one possible design, a clustering algorithm is used to perform cluster analysis on the preprocessed historical multi-source business data to obtain first potential anomaly data, including: Extract multiple travel expense reimbursement records from the preprocessed historical multi-source business data, and construct a feature vector for each travel expense reimbursement record to obtain the travel expense reimbursement feature vector; The travel expense reimbursement feature vector is standardized to obtain the standardized travel expense reimbursement feature vector. Obtain predetermined core parameters, including neighborhood radius and minimum number of samples. Based on neighborhood radius and minimum number of samples, use DBSCAN algorithm to perform cluster analysis on the standardized travel expense reimbursement feature vector to obtain core clusters and outliers far from the core clusters. The core clusters are used to characterize common reimbursement patterns. Outliers are considered the first potential anomalies.
[0011] In one possible design, a local outlier factor algorithm is used to detect fluctuation anomalies in the preprocessed historical multi-source business data to obtain second potential anomaly data, including: The preprocessed historical multi-source business data is converted into multivariate samples using a preset sliding window to obtain multiple new data points. The LOF algorithm is used to calculate the local outlier factor for each new data point. The local outlier factor is used to characterize the degree of deviation of the local density of the new data point from the average local density of its nearest neighbors. The local outlier factor of each new data point is compared according to the preset outlier threshold. If the local outlier factor of each new data point is greater than the preset outlier threshold, the new data point is determined to be an outlier. New data points identified as anomalous, along with their corresponding local outliers, are considered as second potential anomalous data.
[0012] In one possible design, the structure of the deep learning model is adaptively configured for each potentially anomalous data point in the potentially anomalous dataset, including: When the potential abnormal data in the potential abnormal dataset is a transaction event, the deep learning model is configured with a graph attention network architecture. When the potential abnormal data in the potential abnormal dataset is an accounting entry sequence, the deep learning model is configured with a hybrid model architecture of convolutional neural network layers and bidirectional long short-term memory network layers.
[0013] In one possible design, when the configured deep learning model is a graph attention network architecture, the configured deep learning model is used to perform deep analysis on the potential anomaly data to obtain structured analysis results, including: Based on the potential abnormal data, relevant entities and their corresponding relationships are extracted from the pre-built data warehouse, and a local multi-relationship architecture graph is constructed based on the relevant entities and their corresponding relationships. The nodes in the local multi-relationship architecture graph are projected using a pre-built relation-specific encoder to obtain the projected node features. Using a graph attention network, the projected node features and the neighbor information of each node are aggregated through an attention mechanism to obtain structured analysis results. The structured analysis results include the risk probability that the potential abnormal data belongs to an abnormal related transaction pattern.
[0014] In one possible design, when the configured deep learning model is a hybrid model architecture of convolutional neural network layers and bidirectional long short-term memory network layers, the configured deep learning model is used to perform deep analysis on the potential anomalous data to obtain structured analysis results, including: Semantic vectors are extracted from the summary text of the accounting entry sequence to obtain text vectors. The text vectors are then concatenated with the structured feature vectors to obtain the entry features. Local features of journal entries are extracted using convolutional neural network layers. These local features are then input into bidirectional long short-term memory (LSTM) network layers. The LSTM network layers capture the contextual information of these local features to obtain structured analysis results. These structured analysis results include the probability that the potential abnormal data belongs to an irrational sequence.
[0015] Secondly, the present invention provides an intelligent internal audit system based on deep learning and unsupervised learning, comprising: The learning module is used to acquire historical multi-source business data of the enterprise, preprocess the historical multi-source business data of the enterprise to obtain preprocessed historical multi-source business data, and use an unsupervised learning algorithm to learn from the preprocessed historical multi-source business data in order to build a behavioral baseline model of normal business mode. The anomaly detection module is used to acquire real-time multi-source heterogeneous data collected from different business systems within the enterprise, and to perform anomaly detection on the real-time multi-source heterogeneous data based on the behavioral baseline model to obtain a potential anomaly dataset. The configuration analysis module is used to adaptively configure the structure of the deep learning model for each potential anomaly data in the potential anomaly dataset, and use the configured deep learning model to perform in-depth analysis on the potential anomaly data to obtain structured analysis results. The results summary module is used to summarize the structured analysis results of all potentially abnormal data and generate a structured audit report.
[0016] Thirdly, the present invention provides a computer device comprising a memory, a processor, and a transceiver connected in sequence and communication, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the intelligent internal audit method based on deep learning and unsupervised learning as described in the first aspect above.
[0017] Fourthly, the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, perform the intelligent internal audit method based on deep learning and unsupervised learning as described in the first aspect above.
[0018] Fifthly, the present invention provides a computer program product containing instructions that, when executed on a computer, cause the computer to perform the intelligent internal auditing method based on deep learning and unsupervised learning as described in the first aspect above.
[0019] The beneficial effects of this invention are as follows: This invention discloses an intelligent internal audit method and system based on deep learning and unsupervised learning. It acquires historical multi-source business data from an enterprise, preprocesses the historical multi-source business data to obtain preprocessed historical multi-source business data, and uses an unsupervised learning algorithm to learn from the preprocessed historical multi-source business data to construct a behavioral baseline model for normal business patterns. It then acquires real-time multi-source heterogeneous data collected from different business systems within the enterprise, performs anomaly detection on the real-time multi-source heterogeneous data based on the behavioral baseline model, and obtains a potential anomaly dataset. For each potential anomaly in the potential anomaly dataset, it adaptively configures the structure of a deep learning model and uses the configured deep learning model to perform in-depth analysis on the potential anomaly data to obtain structured analysis results. Finally, it summarizes the structured analysis results of all potential anomaly data to obtain a structured audit report. This invention achieves comprehensive monitoring of business activities by acquiring historical multi-source business data from enterprises, fundamentally changing the sampling-dependent audit model, improving audit efficiency and reducing audit costs. Subsequently, an unsupervised learning algorithm is used to learn from the historical multi-source business data to construct a behavioral baseline model. This model is then used to detect real-time acquired data, thereby improving the accuracy and foresight of anomaly identification. Auditors do not need to organize the raw, heterogeneous multi-source data collected by the business system. Furthermore, the model structure is adaptively configured for different time periods. When enterprise business models, accounting standards, or fraudulent methods change, rules and models can be directly reconfigured, facilitating maintenance and providing dynamic adaptability. This ensures the standardization and consistency of audit work and facilitates application and promotion. Attached Figure Description
[0020] Figure 1 A flowchart illustrating the intelligent internal audit method based on deep learning and unsupervised learning provided in this embodiment of the invention; Figure 2 A block diagram of an intelligent internal audit system based on deep learning and unsupervised learning provided in an embodiment of the present invention; Figure 3 A structural diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation
[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in conjunction with the accompanying drawings and descriptions of the embodiments or the prior art. Obviously, the following description of the structure of the accompanying drawings is only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.
[0022] It should be understood that although the terms first, second, etc., may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another. For example, a first unit may be referred to as a second unit, and similarly, a second unit may be referred to as a first unit, without departing from the scope of the exemplary embodiments of the invention.
[0023] It should be understood that the term "and / or" that may appear in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, B exists alone, and A and B exist simultaneously. The term " / and" that may appear in this document describes another relationship between related objects, indicating that two relationships can exist. For example, A / and B can mean: A exists alone, and A and B exist alone. In addition, the character " / " that may appear in this document generally indicates that the related objects before and after it are in an "or" relationship.
[0024] Example: like Figure 1 As shown, the first aspect of this embodiment provides an intelligent internal auditing method based on deep learning and unsupervised learning, which can be executed, but is not limited to, by a computer device or virtual machine with certain computing resources, such as a personal computer or smartphone, or by a virtual machine; the intelligent internal auditing method includes, but is not limited to, the following steps: S1. Obtain the enterprise's historical multi-source business data, preprocess the enterprise's historical multi-source business data to obtain preprocessed historical multi-source business data, and use an unsupervised learning algorithm to learn from the preprocessed historical multi-source business data in order to construct a behavioral baseline model of normal business mode; Specifically, in step S1, historical multi-source business data of the enterprise is obtained, and the historical multi-source business data of the enterprise is preprocessed to obtain preprocessed historical multi-source business data, including: S11. Collect raw multi-source heterogeneous data from multiple business systems within the enterprise, wherein the raw multi-source heterogeneous data includes structured data and unstructured data; S12. Based on preset business rules and statistical methods, remove missing values and outliers from structured and unstructured data to obtain processed structured data and processed unstructured data; S13. Entity recognition is performed on the processed structured data and the processed unstructured data using natural language processing technology to obtain the first entity and the second entity. The processed structured data and the processed unstructured data are aligned based on the same entities in the first entity and the second entity to obtain aligned structured data and aligned unstructured data. Feature extraction is performed on the aligned unstructured data corresponding to the second entity to obtain a structured feature vector. S14. Combine the aligned structured data, the aligned unstructured data, and the structured feature vectors to obtain preprocessed historical multi-source business data.
[0025] It should be noted that a standardized set of API interfaces, JDBC / ODBC database connectors, and file monitoring services are used to collect data from multiple business systems within the enterprise. These internal business systems include a financial system, supplier management system, ERP system, financial accounting system, tax filing platform, business travel service platform, and engineering management system. The structured data includes at least one of the following: accounting vouchers, accounting books, accounting statements, bank receipts, bank statements, and business documents. The unstructured data includes at least one of the following: accounting vouchers, accounting books, accounting statements, bank receipts, bank statements, business documents, scanned copies of contracts, and approval document texts. Structured data refers to data with fixed fields directly obtained from the business system, while unstructured data refers to data sources that require processing to extract information. A pre-defined business rule could be the voucher debit-credit balance, which states that in each accounting voucher, the sum of debit amounts equals the sum of credit amounts, ensuring that every economic transaction is completely recorded, guaranteeing the accuracy of accounting records and the reliability of financial statements. A pre-defined statistical method could be the 3σ principle, which states that in a normally distributed dataset, the vast majority of data points will cluster around the mean, while data points far from the mean have an extremely low probability of appearing. Pre-defined business rules and statistical methods are used to handle missing and outlier values in the data.
[0026] In specific implementation, natural language processing (NLP) technology is used to perform entity recognition on the processed structured data to obtain a first entity. NLP technology is also used to perform entity recognition on the processed unstructured data to obtain a second entity. Based on the common entities in the first and second entities, the processed structured and unstructured data are aligned to obtain an aligned dataset. This aligned dataset includes aligned structured and unstructured data. The first and second entities include, but are not limited to, amounts, dates, and responsible parties. Feature extraction is performed on the unstructured data corresponding to the second entity to obtain a structured feature vector. Furthermore, deep feature extraction is performed on the aligned structured data. For example, the transaction frequency and concentration of suppliers within a rolling time window are calculated. Specific extraction rules are set by technical personnel and are not limited here. This data is stored in the corresponding subject domain table of the audit-specific data warehouse. The unstructured data and its corresponding structured feature vectors are stored in an object repository and associated with the structured data through indexes.
[0027] Furthermore, in step S1, the preprocessed historical multi-source business data is learned using an unsupervised learning algorithm, which includes at least one of the following: S15. A clustering algorithm is used to perform cluster analysis on the preprocessed historical multi-source business data to obtain the first potential abnormal data, which includes historical multi-source business data points that do not belong to the core cluster or are located in a sparse region. S16. The local outlier factor algorithm is used to detect fluctuation anomalies in the preprocessed historical multi-source business data to obtain second potential anomaly data. The second potential anomaly data includes historical multi-source business data points with local density deviation greater than a preset anomaly threshold.
[0028] Specifically, a clustering algorithm is used to perform clustering analysis on the preprocessed historical multi-source business data to obtain the first potential anomaly data, including: S15.1. Extract multiple travel expense reimbursement records from the preprocessed historical multi-source business data, and construct a feature vector for each travel expense reimbursement record to obtain a travel expense reimbursement feature vector; S15.2. Standardize the travel expense reimbursement feature vector to obtain the standardized travel expense reimbursement feature vector; S15.3. Obtain predetermined core parameters, including neighborhood radius and minimum number of samples. Based on neighborhood radius and minimum number of samples, use DBSCAN algorithm to perform cluster analysis on the standardized travel reimbursement feature vector to obtain core clusters and outliers far from the core clusters. The core clusters are used to characterize common reimbursement patterns. S15.4. Outliers are considered as the first potential anomalies.
[0029] It should be noted that multiple travel expense records include amount, location, department, job level, and consumption type. The amount is logarithmically processed, and the location is city-coded. By standardizing the travel expense feature vector, the dimensional differences between different features can be eliminated. In this embodiment, the neighborhood radius is set to 0.5, and the minimum number of samples is set to 10. After outputting outliers, a preliminary label and an anomaly score of deviation from the nearest cluster center are generated for each outlier. The DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm is a density-based clustering algorithm. Its principle is to discover clusters of arbitrary shapes by identifying high-density regions in the data space and to automatically identify noise points.
[0030] Furthermore, the local outlier factor algorithm is used to detect fluctuation anomalies in the preprocessed historical multi-source business data to obtain second potential anomaly data, including: S15.5. Use a preset sliding window to convert the preprocessed historical multi-source business data into multivariate samples to obtain multiple new data points; S15.6. Calculate the local outlier factor for each new data point using the LOF algorithm. The local outlier factor is used to characterize the degree of deviation of the local density of the new data point from the average local density of its nearest neighbors. S15.7. Compare the local outlier factor of each new data point according to the preset outlier threshold. If the local outlier factor of each new data point is greater than the preset outlier threshold, then the new data point is determined to be an outlier. S15.8. New data points identified as anomalous and their corresponding local outliers are identified as second potential anomalous data.
[0031] It should be noted that the preprocessed historical multi-source business data is a monthly time series of key financial indicators, such as gross profit margin. In this embodiment, the preset sliding window size is 3. The preprocessed historical multi-source business data is segmented by the preset sliding window, and the data in each window is converted into a multivariate sample. A multivariate sample refers to a sample that contains observations at multiple time points. In this embodiment, the preset outlier threshold is set to 2. When the local outlier factor is greater than 2, the new data point is determined to be an anomaly.
[0032] In this embodiment, the LOF (Local Outlier Factor) algorithm is used to calculate the local outlier factor of each new data point. The specific calculation process is as follows: First, the distance to the nearest neighbor of each new data point is found. For each new data point, the average distance between it and its corresponding nearest neighbor is calculated to obtain the reachability distance. The local reachability density of each new data point is obtained based on the reachability distance, which is the reciprocal of the sum of all reachability distances. Then, for each new data point, the local outlier factor is obtained based on the local reachability density. Specifically, it is obtained by the ratio of the local reachability density of the new data point to the average local reachability density of its nearest neighbors.
[0033] In practice, after learning the preprocessed historical multi-source business data using an unsupervised learning algorithm, a list of potential abnormal data is output. Each potential abnormal data includes a data ID, source data ID, abnormality type, abnormality score, trigger time, and related data snapshot. Normal business behaviors are learned from the list of potential abnormal data, and a behavioral baseline model is built using normal business data.
[0034] S2. Acquire real-time multi-source heterogeneous data collected from different business systems within the enterprise, and perform anomaly detection on the real-time multi-source heterogeneous data based on the behavioral baseline model to obtain a potential anomaly dataset. In practice, anomaly detection is performed on real-time multi-source heterogeneous data using a behavioral baseline model to obtain a set containing anomalous data. For the specific detection process, refer to step S1.
[0035] S3. For each potential anomaly data in the potential anomaly dataset, adaptively configure the structure of the deep learning model, and use the configured deep learning model to perform in-depth analysis on the potential anomaly data to obtain structured analysis results; Specifically, in step S3, for each potential anomalous data point in the potential anomalous dataset, the structure of the deep learning model is adaptively configured, including: S31. When the potential abnormal data in the potential abnormal dataset is a transaction event, the deep learning model is configured with a graph attention network architecture; S32. When the potential abnormal data in the potential abnormal dataset is an accounting entry sequence, the deep learning model is configured as a hybrid model architecture of convolutional neural network layers and bidirectional long short-term memory network layers.
[0036] Specifically, when the configured deep learning model is a graph attention network architecture, the configured deep learning model is used to perform deep analysis on the potential anomaly data to obtain structured analysis results, including: S31.1. Based on the potential abnormal data, extract relevant entities and corresponding relationships from the pre-built data warehouse, and construct a local multi-relationship architecture diagram based on the relevant entities and corresponding relationships; S31.2. Project the nodes in the local multi-relationship architecture graph using a pre-built relation-specific encoder to obtain the projected node features; S31.3. Using a graph attention network, the projected node features and the neighbor information of each node are aggregated through an attention mechanism to obtain structured analysis results. The structured analysis results include the risk probability that the potential abnormal data belongs to an abnormal related transaction pattern.
[0037] In practical implementation, relevant entities include, but are not limited to, companies, individuals, and bank accounts; corresponding relationships include, but are not limited to, transactions, equity, and approvals. Relevant entities are treated as nodes, and corresponding relationships as edges, thus constructing a local multi-relationship architecture graph. The core principle of the graph attention network is to assign different importance weights to the neighbors of each node through an attention mechanism. Based on these weights, the neighbor features are weighted and summed to update the node's representation. The pre-built relationship-specific encoder can be exemplified by a pre-built encoder for transfer relationships. This encoder is used to project onto the nodes, thereby unifying the relationship types between nodes and facilitating the subsequent aggregation of neighbor information. The projected node features and the neighbor information of each node are aggregated through the attention mechanism to obtain structured analysis results. The expression for the attention coefficient is: In the formula, Attention coefficient This is used to normalize the scores calculated for all neighbors j of node i, so that the sum of the attention weights of all neighbors j is 1. It is a non-linear activation function. This is used to perform a linear transformation on the concatenated vector using the attention vector 'a', compressing it into a scalar fraction. These are the node features after projection. For each node, we have its neighbor information. || is used to concatenate the vectors to output the risk probability that the transaction subgraph belongs to the abnormal associated transaction pattern. We also output the edge with the highest attention weight, which will be visualized later.
[0038] Furthermore, when the configured deep learning model is a hybrid model architecture of convolutional neural network layers and bidirectional long short-term memory network layers, the configured deep learning model is used to perform deep analysis on the potential abnormal data to obtain structured analysis results, including: S32.1. Extract semantic vectors from the summary text in the accounting entry sequence to obtain text vectors. Concatenate the text vectors with the structured feature vectors to obtain the entry features. S32.2. Use a convolutional neural network layer to extract local features of the journal entry features, input the local features into a bidirectional long short-term memory network layer, use the bidirectional long short-term memory network layer to capture the contextual information of the local features, and obtain structured analysis results. The structured analysis results include the probability that the potential abnormal data belongs to an unreasonable sequence.
[0039] It should be noted that the semantic vector of each entry is extracted from the summary text using the fine-tuned BERT model and concatenated with the structured feature vector mentioned above to obtain the entry features. The structured features here include, but are not limited to, account and amount.
[0040] S4. Summarize the structured analysis results of all potential anomalies to obtain a structured audit report; In one possible design, auditors review reports through a web interface, capturing and recording all actions. If an action is recorded as a negative sample feedback, it is labeled with a cause tag. If an action is interpreted as a correction signal to the model's original output, all interaction records and intermediate features of the model are combined to form a high-quality feedback record, which is written to a pre-built model feedback database in real time.
[0041] In a preferred embodiment, a timed task is set to initiate a model optimization task based on feedback data, achieving closed-loop evolution. New feedback records in the feedback database are acquired and aligned with corresponding original features and historical model outputs to construct an incremental training set. For unsupervised learning algorithms, sample points marked as false alarms are input into a dataset of normal baseline behavior. An online learning algorithm dynamically adjusts the cluster centers and boundaries and corrects the definition of normal patterns. Based on the incremental training set, a fine-tuning and catastrophic forgetting prevention strategy is used to train the graph attention network at a low learning rate. At this point, the loss function, based on the standard cross-entropy loss, introduces an elastic weight consolidation regularization term. The expression for the elastic weight consolidation regularization term is: In the formula, For the total loss function, These are the current model parameters. Losses due to new missions, This is the hyperparameter for regularization strength. These are the diagonal elements of the Fisher information matrix. For the i-th current model parameter, The parameters of the i-th old model are used to ensure that the important parameters learned in the old task are not significantly modified. The optimized model is evaluated on an independent validation set. If the evaluation performance meets the standard, it is automatically packaged into a new version and deployed to the production environment in a rolling update manner to replace the original model.
[0042] like Figure 2As shown, the second aspect of this embodiment provides an intelligent internal audit system based on deep learning and unsupervised learning, including: The learning module is used to acquire historical multi-source business data of the enterprise, preprocess the historical multi-source business data of the enterprise to obtain preprocessed historical multi-source business data, and use an unsupervised learning algorithm to learn from the preprocessed historical multi-source business data in order to build a behavioral baseline model of normal business mode. The anomaly detection module is used to acquire real-time multi-source heterogeneous data collected from different business systems within the enterprise, and to perform anomaly detection on the real-time multi-source heterogeneous data based on the behavioral baseline model to obtain a potential anomaly dataset. The configuration analysis module is used to adaptively configure the structure of the deep learning model for each potential anomaly data in the potential anomaly dataset, and use the configured deep learning model to perform in-depth analysis on the potential anomaly data to obtain structured analysis results. The results summary module is used to summarize the structured analysis results of all potentially abnormal data and generate a structured audit report.
[0043] The working process, working details, and technical effects of the intelligent internal audit system based on deep learning and unsupervised learning provided in the second aspect of this embodiment can be found in the intelligent internal audit method based on deep learning and unsupervised learning described in the first aspect, and will not be repeated here.
[0044] like Figure 3 As shown, the third aspect of this embodiment provides a computer device, including a memory, a processor, and a transceiver connected in sequence for communication. The memory stores a computer program, the transceiver sends and receives messages, and the processor reads the computer program and executes the intelligent internal auditing method based on deep learning and unsupervised learning as described in the first aspect. Specifically, the memory may include, but is not limited to, random-access memory (RAM), read-only memory (ROM), flash memory, first-in-first-out (FIFO) memory, and / or first-in-last-out (FILO) memory, etc.; the processor may include, but is not limited to, a microprocessor of the STM32F105 series. Furthermore, the computer device may also include, but is not limited to, a power module, a display screen, and other necessary components.
[0045] The working process, working details and technical effects of the aforementioned computer device provided in the third aspect of this embodiment can be found in the intelligent internal audit method based on deep learning and unsupervised learning described in the first aspect, and will not be repeated here.
[0046] The fourth aspect of this embodiment provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, perform the intelligent internal audit method based on deep learning and unsupervised learning as described in the first aspect. The computer-readable storage medium refers to a carrier for storing data, and may include, but is not limited to, computer-readable storage media such as floppy disks, optical disks, hard disks, flash memory, USB flash drives, and / or Memory Sticks. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
[0047] The working process, working details and technical effects of the aforementioned computer-readable storage medium provided in the fourth aspect of this embodiment can be found in the intelligent internal audit method based on deep learning and unsupervised learning as described in the first aspect, and will not be repeated here.
[0048] The fifth aspect of this embodiment provides a computer program product, including a computer program or instructions, which, when executed by a computer, are used to implement the intelligent internal audit method based on deep learning and unsupervised learning as described in the first aspect.
[0049] The working process, working details, and technical effects of the aforementioned computer program product provided in this embodiment can be found in the intelligent internal audit method based on deep learning and unsupervised learning as described in the first aspect, and will not be repeated here.
[0050] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. An intelligent internal auditing method based on deep learning and unsupervised learning, characterized in that, include: The process involves acquiring historical multi-source business data of an enterprise, preprocessing the historical multi-source business data to obtain preprocessed historical multi-source business data, and using an unsupervised learning algorithm to learn from the preprocessed historical multi-source business data in order to construct a behavioral baseline model for normal business patterns. Acquire real-time multi-source heterogeneous data collected from different business systems within the enterprise, and perform anomaly detection on the real-time multi-source heterogeneous data based on the behavioral baseline model to obtain a potential anomaly dataset. For each potential anomaly in the potential anomaly dataset, the structure of the deep learning model is adaptively configured, and the configured deep learning model is used to perform deep analysis on the potential anomaly data to obtain structured analysis results. The structured analysis results of all potentially abnormal data are summarized to obtain a structured audit report.
2. The intelligent internal audit method based on deep learning and unsupervised learning according to claim 1, characterized in that, Acquire historical multi-source business data of the enterprise, preprocess the historical multi-source business data of the enterprise to obtain preprocessed historical multi-source business data, including: Raw, multi-source heterogeneous data is collected from multiple business systems within the enterprise, including structured and unstructured data. Based on preset business rules and statistical methods, missing and outlier values in structured and unstructured data are removed to obtain processed structured data and processed unstructured data. Natural language processing techniques are used to perform entity recognition on the processed structured data and the processed unstructured data to obtain a first entity and a second entity. The processed structured data and the processed unstructured data are aligned based on the same entities in the first entity and the second entity to obtain aligned structured data and aligned unstructured data. Feature extraction is performed on the aligned unstructured data corresponding to the second entity to obtain a structured feature vector. The aligned structured data, aligned unstructured data, and structured feature vectors are combined to obtain preprocessed historical multi-source business data.
3. The intelligent internal auditing method based on deep learning and unsupervised learning according to claim 2, characterized in that, The structured data includes at least one of the following: accounting vouchers, accounting books, accounting statements, bank receipts, bank statements, and business documents; the unstructured data includes at least one of the following: accounting vouchers, accounting books, accounting statements, bank receipts, bank statements, business documents, scanned copies of contracts, and approval document texts.
4. The intelligent internal auditing method based on deep learning and unsupervised learning according to claim 1, characterized in that, Using an unsupervised learning algorithm to learn from the preprocessed historical multi-source business data includes at least one of the following: Clustering algorithms are used to perform cluster analysis on the preprocessed historical multi-source business data to obtain first potential abnormal data, which includes historical multi-source business data points that do not belong to the core cluster or are located in sparse areas. The local outlier factor algorithm is used to detect fluctuation anomalies in the preprocessed historical multi-source business data to obtain second potential anomaly data. The second potential anomaly data includes historical multi-source business data points whose local density deviation is greater than a preset anomaly threshold.
5. The intelligent internal auditing method based on deep learning and unsupervised learning according to claim 4, characterized in that, Clustering algorithms are used to perform cluster analysis on the preprocessed historical multi-source business data to obtain the first potential anomaly data, including: Extract multiple travel expense reimbursement records from the preprocessed historical multi-source business data, and construct a feature vector for each travel expense reimbursement record to obtain the travel expense reimbursement feature vector; The travel expense reimbursement feature vector is standardized to obtain the standardized travel expense reimbursement feature vector. Obtain predetermined core parameters, including neighborhood radius and minimum number of samples. Based on neighborhood radius and minimum number of samples, use DBSCAN algorithm to perform cluster analysis on the standardized travel expense reimbursement feature vector to obtain core clusters and outliers far from the core clusters. The core clusters are used to characterize common reimbursement patterns. Outliers are considered the first potential anomalies.
6. The intelligent internal auditing method based on deep learning and unsupervised learning according to claim 4, characterized in that, The local outlier factor algorithm is used to detect fluctuation anomalies in the preprocessed historical multi-source business data to obtain second potential anomaly data, including: The preprocessed historical multi-source business data is converted into multivariate samples using a preset sliding window to obtain multiple new data points. The LOF algorithm is used to calculate the local outlier factor for each new data point. The local outlier factor is used to characterize the degree of deviation of the local density of the new data point from the average local density of its nearest neighbors. The local outlier factor of each new data point is compared according to the preset outlier threshold. If the local outlier factor of each new data point is greater than the preset outlier threshold, the new data point is determined to be an outlier. New data points identified as anomalous, along with their corresponding local outliers, are considered as second potential anomalous data.
7. The intelligent internal audit method based on deep learning and unsupervised learning according to claim 2, characterized in that, For each potential anomaly in the potential anomaly dataset, the structure of the deep learning model is adaptively configured, including: When the potential abnormal data in the potential abnormal dataset is a transaction event, the deep learning model is configured with a graph attention network architecture. When the potential abnormal data in the potential abnormal dataset is an accounting entry sequence, the deep learning model is configured with a hybrid model architecture of convolutional neural network layers and bidirectional long short-term memory network layers.
8. The intelligent internal auditing method based on deep learning and unsupervised learning according to claim 7, characterized in that, When the configured deep learning model is a graph attention network architecture, the configured deep learning model is used to perform deep analysis on the potential anomaly data to obtain structured analysis results, including: Based on the potential abnormal data, relevant entities and their corresponding relationships are extracted from the pre-built data warehouse, and a local multi-relationship architecture graph is constructed based on the relevant entities and their corresponding relationships. The nodes in the local multi-relationship architecture graph are projected using a pre-built relation-specific encoder to obtain the projected node features. Using a graph attention network, the projected node features and the neighbor information of each node are aggregated through an attention mechanism to obtain structured analysis results. The structured analysis results include the risk probability that the potential abnormal data belongs to an abnormal related transaction pattern.
9. The intelligent internal auditing method based on deep learning and unsupervised learning according to claim 7, characterized in that, When the configured deep learning model is a hybrid model architecture of convolutional neural network layers and bidirectional long short-term memory network layers, the configured deep learning model is used to perform deep analysis on the potential abnormal data to obtain structured analysis results, including: Semantic vectors are extracted from the summary text of the accounting entry sequence to obtain text vectors. The text vectors are then concatenated with the structured feature vectors to obtain the entry features. Local features of journal entries are extracted using convolutional neural network layers. These local features are then input into bidirectional long short-term memory (LSTM) network layers. The LSTM network layers capture the contextual information of these local features to obtain structured analysis results. These structured analysis results include the probability that the potential abnormal data belongs to an irrational sequence.
10. An intelligent internal audit system based on deep learning and unsupervised learning, used to implement the method of any one of claims 1 to 9, characterized in that, include: The learning module is used to acquire historical multi-source business data of the enterprise, preprocess the historical multi-source business data of the enterprise to obtain preprocessed historical multi-source business data, and use an unsupervised learning algorithm to learn from the preprocessed historical multi-source business data in order to build a behavioral baseline model of normal business mode. The anomaly detection module is used to acquire real-time multi-source heterogeneous data collected from different business systems within the enterprise, and to perform anomaly detection on the real-time multi-source heterogeneous data based on the behavioral baseline model to obtain a potential anomaly dataset. The configuration analysis module is used to adaptively configure the structure of the deep learning model for each potential anomaly data in the potential anomaly dataset, and use the configured deep learning model to perform in-depth analysis on the potential anomaly data to obtain structured analysis results. The results summary module is used to summarize the structured analysis results of all potentially abnormal data and generate a structured audit report.