A financial data intrusion detection method and system based on data analysis

Abstract

The application relates to the technical field of data security, and discloses a financial and accounting data intrusion detection method and system based on data analysis, which comprises the following steps: extracting a fine-grained feature vector of an operation node from a financial and accounting information system, wherein the fine-grained feature vector comprises a data sensitivity entropy value and an operation time sequence continuity coefficient; constructing a correlation graph atlas by taking the operation node as an entity; performing feature aggregation by using a graph neural network to generate a deep feature representation; constructing a time sequence feature matrix based on the deep feature representation; identifying a normal business period; extracting a historical feature vector sequence from the normal business period to train a time sequence prediction model; inputting a measured feature vector at a current time into the model to calculate a residual error between the measured feature vector and a predicted feature vector; and finally generating an abnormal score. By fusing business semantics and behavior time sequences, the application realizes accurate identification of financial and accounting data intrusion behaviors, reduces a false alarm rate, has high interpretability and strong robustness, and effectively improves the security protection capability of a financial and accounting system.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a method and system for detecting intrusion into financial and accounting data based on data analysis. Background Technology

[0002] As enterprises continue to improve their level of informatization, accounting information systems have become the core support platform for enterprise operations. Traditional intrusion detection systems are mostly based on network traffic analysis or system log monitoring, and use rule matching or statistical thresholds to judge anomalies. They are difficult to adapt to the complex operational logic and data flow of accounting business, and cannot meet the high security requirements of the accounting environment.

[0003] In accounting and finance scenarios, operational behaviors have a high degree of business semantics and temporal dependence. Most existing detection methods ignore the business logic relationship between operations and only focus on the frequency or permissions of a single operation. They cannot build a behavioral profile with business semantics and are difficult to identify highly concealed and disguised intrusion behaviors. In addition, the sensitivity of accounting and finance data varies greatly, and the operational risk level of different subjects and fields is different. Existing technologies lack a quantitative assessment mechanism for data sensitivity.

[0004] On the other hand, accounting operations have obvious cyclical fluctuations. For example, during the month-end closing period, the amount of data access and the frequency of operations increase significantly. These cyclical fluctuations are often misjudged as abnormal by traditional detection models, resulting in a large number of false alarms and increasing the burden of operation and maintenance.

[0005] In summary, accounting systems urgently need an intelligent intrusion detection mechanism that can deeply integrate accounting business logic, quantify behavioral characteristics, model periodic fluctuations, and provide interpretable output to improve the security protection capabilities of accounting systems. Summary of the Invention

[0006] The purpose of this invention is to propose a data analysis-based method and system for detecting intrusions into accounting data in order to solve the problems in the prior art.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: A data analysis-based method for detecting intrusions into accounting data includes the following steps: S1. Collect multi-source operation data from the accounting information system, and extract fine-grained feature vectors for each operation node based on the accounting business flow logic. The fine-grained feature vectors include data sensitivity entropy values ​​and operation timing coherence coefficients. S2, using operation nodes as entity nodes and the temporal dependencies and business logic relationships between operation nodes as edges, construct an association graph, use the fine-grained feature vector as the initial feature vector of the entity nodes, and use a deep learning model based on graph neural networks to perform feature aggregation to generate a deep feature representation of the entity nodes. S3. Construct a time-series feature matrix based on the deep feature representation. Based on a preset historical time window, identify normal business cycles from the time-series feature matrix and extract the corresponding historical feature vector sequence for training the time-series prediction model and generating a prediction function that describes the fluctuation pattern of normal business behavior. S4. Extract the measured feature vector at the current moment from the time series feature matrix, input it into the trained time series prediction model to obtain the predicted feature vector, calculate the residual between the measured feature vector and the predicted feature vector, quantify the degree of behavioral deviation after stripping periodic fluctuations, and generate anomaly scores.

[0008] A data analysis-based accounting data intrusion detection system includes: The data acquisition and feature extraction module is used to collect multi-source operation data from the accounting information system and extract fine-grained feature vectors for each operation node based on the accounting business flow logic. The fine-grained feature vectors include data sensitivity entropy values ​​and operation time sequence coherence coefficients. The graph construction and feature aggregation module is used to construct an association graph with operation nodes as entity nodes and temporal dependencies and business logic relationships between operation nodes as edges. The fine-grained feature vectors are used as the initial feature vectors of entity nodes, and a deep learning model based on graph neural networks is used to perform feature aggregation to generate deep feature representations of entity nodes. The normal business behavior baseline construction module is used to construct a time series feature matrix based on the deep feature representation, identify normal business cycles from the time series feature matrix based on a preset historical time window, and extract the corresponding historical feature vector sequence for training a time series prediction model and generating a prediction function that describes the fluctuation pattern of normal business behavior. The anomaly identification and scoring module is used to extract the measured feature vector at the current time from the time-series feature matrix, input it into the trained time-series prediction model to obtain the predicted feature vector, calculate the residual between the measured feature vector and the predicted feature vector, quantify the degree of behavioral deviation after stripping periodic fluctuations, and generate anomaly scores.

[0009] The beneficial effects of the technical solution provided by this invention include at least the following: This invention introduces data sensitivity entropy and operation sequence coherence coefficient to construct a fine-grained feature extraction mechanism with accounting business semantics, accurately quantifying the sensitivity and behavioral norms of operation nodes. Compared with traditional methods, this invention achieves effective identification of high-risk operations at the feature level, significantly improves the detection capability of covert intrusion behavior, and reduces the risk of false negatives.

[0010] This invention constructs an operation node association graph based on graph neural networks, integrates temporal dependencies and business logic relationships, and generates node feature representations with deep semantics. This method can not only capture complex dependencies between operations, but also perform high-order feature aggregation in the graph structure, improve the recognition accuracy of abnormal behavior in complex business scenarios, and has strong generalization ability and adaptability.

[0011] This invention identifies business cycles and combines them with historical data to construct a normal behavior prediction model, thereby effectively separating and modeling periodic fluctuations. This method can build a stable behavior baseline in a dynamically changing business environment, significantly reduce false alarms caused by periodic fluctuations, and improve the robustness and practicality of the detection system.

[0012] This invention, while generating anomaly scores, further decouples residual components and identifies anomalous feature groups to generate interpretable anomaly pattern information. This mechanism not only outputs detection results but also provides semantic descriptions and location information of anomalous behavior, greatly improving the response efficiency and troubleshooting accuracy of maintenance personnel and providing strong technical support for the security management of accounting systems. Attached Figure Description

[0013] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 A flowchart of the method provided in an embodiment of the present invention; Figure 2 This is a system structure diagram provided for an embodiment of the present invention. Detailed Implementation

[0015] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a data analysis-based financial data intrusion detection method and system proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0016] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0017] The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0018] The following description, in conjunction with the accompanying drawings, details a specific solution for a data analysis-based financial data intrusion detection method and system provided by this invention.

[0019] Please see Figure 1 The diagram illustrates a flowchart of a data analysis-based financial data intrusion detection method according to an embodiment of the present invention. The method includes the following steps: S1, collect multi-source operation data from the accounting information system, and extract fine-grained feature vectors of each operation node based on the accounting business flow logic. The fine-grained feature vectors include data sensitivity entropy value and operation time sequence coherence coefficient. S2, with operation nodes as entity nodes and temporal dependencies and business logic relationships between operation nodes as edges, constructs an association graph, uses fine-grained feature vectors as initial feature vectors of entity nodes, and uses a deep learning model based on graph neural networks to aggregate features and generate deep feature representations of entity nodes. S3: Construct a time-series feature matrix based on deep feature representation; Based on a preset historical time window, identify normal business cycles from the time-series feature matrix and extract the corresponding historical feature vector sequence for training the time-series prediction model and generating a prediction function that describes the fluctuation pattern of normal business behavior. S4 extracts the measured feature vector at the current time from the time series feature matrix, inputs it into the trained time series prediction model, obtains the predicted feature vector, calculates the residual between the measured feature vector and the predicted feature vector, quantifies the degree of behavioral deviation after stripping periodic fluctuations, and generates anomaly scores.

[0020] In one embodiment of the present invention, the data sensitivity entropy value is determined in the following manner: Obtain the depth of the accounting subject to which the corresponding data field belongs in the subject system tree in the multi-source operation data, and determine its subject level weight; Traverse the pre-set financial statement reconciliation rule base to identify target report items that have direct or indirect reconciliation relationships with data fields; Based on the length of the reconciliation path between the data field and the target report item, calculate the reconciliation relationship weight, and normalize the reconciliation relationship weight to obtain the correlation coefficient. The basic sensitivity score of the data field is calculated based on the subject level weight and correlation coefficient. The basic sensitivity score is then mapped to a preset entropy range to generate a data sensitivity entropy value.

[0021] It should be noted that, in this embodiment, taking a certain enterprise financial information system as an example, assuming that a bookkeeping operation belonging to the "bank deposit" accounting subject is collected, the data field involved is "bank deposit - ICBC account", the corresponding amount is 1 million yuan, and its data sensitivity entropy value is calculated in the following way.

[0022] The first step is to determine the hierarchical weights of the accounts: The accounting account system tree structure of this company is shown in Table 1: Table 1: Schematic diagram of the accounting subject system structure of an enterprise Level 1 Subject (Depth 1) Assets Level 2 Subjects (Depth 2) Current assets Level 3 Subjects (Depth 3) Cash and cash Level 4 Subjects (Depth 4) bank deposits Level 5 Subjects (Depth 5) Bank Deposits - ICBC Account The subject level weight W_level is calculated using the following formula: W_level = α × depth; Where α is the subject level coefficient (α=0.2 in this embodiment), and depth is the depth of the subject in the system tree. The calculated value is: W_level = 0.2 × 5 = 1.0.

[0023] The second step is to determine the weight of the reconciliation relationship: traverse the pre-set financial statement reconciliation relationship rule base to identify target report items that have a reconciliation relationship with "Bank Deposits - ICBC Account", as shown in Table 2: Table 2: Schematic diagram of target report items that are related to "Bank Deposits - ICBC Account" The weight of the reconciliation relationship, W_rel, is calculated according to the following formula: W_rel = β × (1 / D); Where β is the path coefficient (β=0.8 in this embodiment), and D is the reconciliation path length (minimum is 1), calculated separately: Direct reconciliation (D=1): W_rel1 = 0.8 × (1 / 1) = 0.8; Indirect reconciliation 1 (D=2): W_rel2 = 0.8 × (1 / 2) = 0.4; Indirect cross-reference 2 (D=3): W_rel3 = 0.8 × (1 / 3) ≈ 0.267.

[0024] The third step is to sum the weights of the above reconciliation relationships and normalize them to the [0,1] interval to obtain the normalized result C_rel: C_rel = (W_rel1 + W_rel2 + W_rel3) / (β × maximum possible path number), where the maximum possible path number is the number of all identified reconciliation paths (in this embodiment, the maximum possible path number = 3), calculated as: C_rel = (0.8 + 0.4 + 0.267) / (0.8 × 3) = 1.467 / 2.4 ≈ 0.611.

[0025] The fourth step is to calculate the basic sensitivity score S_base using a weighted product: S_base = W_level ×(1 + γ × C_rel), where γ is the correlation adjustment coefficient (γ=0.5 in this embodiment). The result is: S_base =1.0 × (1 + 0.5 × 0.611) = 1.0 × 1.3055 = 1.3055.

[0026] The fifth step is to map the basic sensitivity score to the preset entropy range [0,1] using the Sigmoid function, and obtain the mapping result H: H = 1 / (1 + e^(-k × (S_base - S0))), where k is the steepness coefficient (k=2.0 in this embodiment), S0 is the baseline offset (S0=1.0 in this embodiment), and e is the natural constant. The calculation yields: H = 1 / (1 + e^(-2.0× (1.3055 - 1.0))) = 1 / (1 + e^(-0.611)) ≈ 1 / (1 + 0.543) ≈ 0.648.

[0027] Ultimately, the data sensitivity entropy value of the "bank deposit - ICBC account" operation node was determined to be 0.648.

[0028] The above calculation formula belongs to the conventional mathematical transformation method in this field. The subject system depth and the identification of the reconciliation path are common knowledge in the field of accounting informatization. The values ​​of parameters α, β, γ, and k can be preset through historical data statistics or expert experience. The entropy mapping function can be a conventional normalization function such as Sigmoid or Tanh. The specific choice does not affect the implementation of the technical solution.

[0029] In one embodiment of the present invention, the operation timing coherence coefficient is determined in the following manner: Obtain historical operation logs from multi-source operation data and calculate the support of each operation sequence pattern in the historical operation logs. Extract operation sequence patterns with support exceeding a preset support threshold as frequent operation sequence patterns, and establish a standard business process template library according to their respective business types; Each operation node and its temporal neighbors are obtained from multi-source operation data and arranged according to a preset time window to form a local operation sequence; Based on the longest common subsequence algorithm, the sequence similarity between the local operation sequence and each template in the standard business process template library is calculated, and the standard business process template with the highest sequence similarity is extracted as the optimal matching template. Calculate the expected position offset between the expected position index and the actual position index of the current operation node in the optimal matching template, and then weight and fuse the sequence similarity with the expected position offset to generate the operation temporal coherence coefficient.

[0030] It should be noted that, in this embodiment, taking the "monthly closing" business process of a certain enterprise's financial information system as an example, the operation sequence continuity coefficient is calculated according to the following example: The first step is to establish a standard business process template library: (1) Extract historical operation logs from the past 12 months (assuming approximately 3600 records in this embodiment), and group them by month to calculate the frequency of occurrence of each operation sequence pattern: (2) Define the sequence of operation nodes arranged in chronological order in the "monthly settlement" business as an operation sequence pattern, for example: Mode A: Revenue recognition → Cost transfer → Depreciation accrual → Tax calculation → Profit and loss transfer → Report generation; Mode B: Revenue recognition → Cost transfer → Tax calculation → Depreciation accrual → Profit and loss transfer → Report generation; Mode C: Revenue recognition → Cost transfer → Profit and loss transfer → Depreciation accrual → Tax calculation → Report generation; (3) Calculate the support of each operation sequence pattern using the following formula: Support = (Number of occurrences of the operation sequence pattern / Total number of monthly closing transactions) × 100%. Assume the statistical and calculation results are shown in Table 3. Table 3: Support Level of Operation Sequence Pattern under Monthly Closing Process (4) The preset support threshold is set to 80%. Sequence patterns with support exceeding the threshold are extracted as frequent operation sequence patterns. In this embodiment, pattern A is extracted as the frequent operation sequence pattern, and then a monthly standard business process template T_monthend is generated based on pattern A, as follows: Template T_monthend = [OP001(Revenue Recognition), OP002(Cost Transfer), OP003(Depreciation Accrual), OP004(Tax Calculation), OP005(Profit and Loss Transfer), OP006(Generate Reports)]; In addition, for other business types such as "quarterly reports" and "annual reports", the same method is used to establish corresponding standard business process templates.

[0031] The second step is to construct the current local operation sequence: Collect the operation logs of the current operation node within the last 30 minutes and arrange them in chronological order to form a local operation sequence. Assume that the local operation sequence L = [OP001, OP002, OP004, OP003], where OP003 is the current operation node.

[0032] The third step is to calculate sequence similarity: (1) Based on the longest common subsequence algorithm, the longest common subsequence (LCS) of the local operation sequence L and the template T_monthend is calculated. The longest common subsequence is: [OP001, OP002, OP003, OP004] (length=4). (2) The sequence similarity Sim is calculated using the following formula: Sim = LCS length / max(T_monthend length, L length) = 4 / max(6, 4) = 4 / 6 ≈ 0.667; The fourth step is to determine the optimal matching template: calculate the similarity between L and each template in the template library. In this embodiment, the similarity between L and the monthly closing template T_monthend is 0.667. Assuming that the similarity between L and the quarterly report template T_quarter is 0.333 and the annual report template T_year is 0.167, the monthly closing template T_monthend with the highest similarity is selected as the optimal matching template.

[0033] Step 5: Calculate the expected position offset: The current operating node is OP003 (depreciation accrual), its expected position index in the template T_monthend is 3 (counting from 1), and its actual position index in the current sequence L is 4. The expected position offset Offset is calculated using the following formula: Offset = |actual position index - expected position index| / template length. The calculated value is: Offset = |4 - 3| / 6 = 1 / 6 ≈ 0.167.

[0034] Step 6: The sequence similarity and expected position offset are fused using a weighted average method to obtain the operation temporal coherence coefficient C_t: C_t = w_1 × Sim + w_2 × (1 - Offset), where w_1 and w_2 are weight coefficients, and w_1 + w_2 = 1. In this embodiment, w_1 = 0.6 and w_2 = 0.4 are taken, and the calculated result is: C_t = 0.6 × 0.667 + 0.4 × (1 - 0.167) = 0.6 × 0.667 + 0.4 × 0.833 = 0.4002 + 0.3332 = 0.7334.

[0035] Ultimately, the timing continuity coefficient of operation node OP003 (depreciation accrual) at the current moment was determined to be 0.7334.

[0036] Sequence pattern mining is common knowledge in the field of data mining. Support calculation and frequent pattern extraction are routine operations. The longest common subsequence (LCS) algorithm is a classic algorithm in computer science. Weighted fusion is a routine numerical processing method. The weight coefficients can be determined by grid search, expert experience or historical data fitting. The length of the time window used to construct the current local operation sequence (30 minutes in this embodiment) can be dynamically adjusted according to business characteristics.

[0037] In one embodiment of the present invention, the steps of using fine-grained feature vectors as initial feature vectors for entity nodes and employing a deep learning model based on graph neural networks to perform feature aggregation and generate deep feature representations of entity nodes include: For each entity node, identify other entity nodes that have a direct connection with it as its neighbor nodes. Set the order K. For each entity node, perform K-order aggregation. In the k-th (k=1, 2...K)-th order aggregation, the entity node aggregates the feature vectors of its neighbor nodes after the (k-1)-th order aggregation, generating the feature vector of the entity node after the k-th order aggregation. The feature vector after the 0th iteration is the initial feature vector. In each aggregation process, the attention weights of different neighboring nodes to the entity node are calculated based on the edge type between the current entity node and its neighboring nodes and the operation timing coherence coefficient. The feature vectors of the neighboring nodes are then weighted and summed based on the attention weights to obtain the feature vector of the entity node after this aggregation. The feature vector generated after K-order aggregation of each entity node is used as the deep feature representation of that entity node.

[0038] In each aggregation process, the steps for calculating the attention weights of different neighboring nodes for the current entity node, based on the edge types between the current entity node and its neighboring nodes and the operational temporal coherence coefficient, include: Get the edge types between an entity node and its neighboring nodes. Edge types include temporal dependency edges and business logic relationship edges. Preset basic attention weights for different edge types, with the basic attention weight of business logic relationship edges being greater than that of temporal dependency edges; Obtain the operation timing coherence coefficients corresponding to neighboring nodes, and generate attention decay factors based on the comparison results between the operation timing coherence coefficients and preset coefficient thresholds. The basic attention weights are multiplied by the attention decay factor, and the result is normalized to obtain the attention weights used for feature aggregation.

[0039] It should be noted that, in this embodiment, taking the node "depreciation accrual" as an example, the attention weight is calculated as follows when performing feature aggregation with neighboring nodes: The first step is to obtain the edge type and preset basic weight: (1) Assume that the neighboring nodes of the node “Depreciation Accrual” include “Cost Transfer” (connected by time-series dependency edge), “Tax Calculation” (connected by time-series dependency edge) and “Fixed Asset Registration” (connected by business logic relationship edge); (2) The basic attention weight of the business logic relationship edge is set to 0.7, and the basic attention weight of the temporal dependency edge is set to 0.3, so as to reflect that the importance of business logic relationship in financial data intrusion detection is higher than that of simple temporal relationship.

[0040] The second step is to obtain the temporal coherence coefficients of neighboring nodes and generate the decay factor: (1) Obtain the operation sequence continuity coefficients of each neighbor node, assuming they are 0.91 for "cost carry-over", 0.88 for "tax calculation" and 0.62 for "fixed asset registration"; (2) The preset coefficient threshold is 0.7. When the time sequence continuity coefficient is not lower than the preset coefficient threshold, the attenuation factor is 1.0. When the time sequence continuity coefficient is lower than the threshold, the attenuation factor is the ratio of the time sequence continuity coefficient to the preset coefficient threshold. According to this rule, the attenuation factor of "cost carry-over" and "tax calculation" is 1.0, while the attenuation factor of "fixed asset registration" is 0.62 / 0.7≈0.886.

[0041] The third step is to multiply the basic attention weight by the decay factor to obtain the initial weight of each neighbor node. The calculation results are: "Cost Carry-forward" 0.3 × 1.0 = 0.3, "Tax Calculation" 0.3 × 1.0 = 0.3, "Fixed Asset Registration" 0.7 × 0.886 = 0.62.

[0042] The fourth step is to perform Softmax normalization on the initial weights of all neighboring nodes so that the sum of all weights is 1, thus obtaining the final attention weights used for feature aggregation. In this embodiment, after normalization, "Cost Carry-forward" obtains an attention weight of approximately 0.296, "Tax Calculation" obtains an attention weight of approximately 0.296, and "Fixed Asset Registration" obtains an attention weight of approximately 0.408. It can be seen that although "Fixed Asset Registration" suffers weight decay due to its lower temporal continuity, it still obtains the largest attention weight in the end because of its higher edge type base weight, reflecting the dominant role of business logic relationships in aggregation.

[0043] In the subsequent feature aggregation process, the central node "depreciation accrual" will sum the feature vectors of its neighboring nodes according to the aforementioned attention weights. The neighboring node with the larger weight contributes more to the feature update of the central node.

[0044] In one embodiment of the present invention, the steps of constructing a time-series feature matrix based on deep feature representation, identifying normal business cycles from the time-series feature matrix based on a preset historical time window, and extracting the corresponding historical feature vector sequence include: The deep feature representations of each operation node are reorganized according to the time dimension, with time points as rows and operation nodes as columns, to construct a temporal feature matrix; Fourier transform is performed on the time series feature matrix within the preset historical time window to extract its time domain features and frequency domain features. Based on the time domain features and frequency domain features, periodic fluctuation patterns in the time series data are detected, and the start and end points of each business cycle interval are determined. The length of the historical time window must cover at least one complete business cycle. Based on the pre-set accounting business calendar, the detected periodic fluctuation patterns are labeled with business semantics to identify the business cycle type corresponding to each business cycle interval, including monthly closing cycle, quarterly report cycle and annual report cycle. From the identified business cycle intervals, select the intervals that match the preset normal business cycle template and use them as the normal business cycle intervals. From the normal business cycle interval, extract the row vectors of the time series feature matrix within the corresponding time range, and use them as the historical feature vector sequence to form the initial training dataset; The initial training dataset is processed to remove outlier samples, resulting in a training dataset, which is then divided into a training set and a validation set for training and validation of the time series prediction model.

[0045] It should be noted that, in this embodiment, taking the operational data of a company's financial information system from January to March of a certain year as an example, the process of identifying normal business cycles and extracting historical feature vector sequences is as follows: The first step is to construct the time-series feature matrix: Suppose that the company's financial information system has 12 operation nodes. Each operation node is aggregated by a graph neural network to generate an 8-dimensional deep feature representation. The data from January to March, a total of 90 days, is reorganized according to the time dimension, with each day as a time point. Each time point contains the 8-dimensional features of the 12 operation nodes, constructing a time-series feature matrix of 90 rows and 96 columns (12 nodes × 8-dimensional features). Each row of this matrix corresponds to a date, and each column corresponds to a certain dimension feature of a certain operation node. The values ​​in the matrix reflect the deep feature representation of that node on that day.

[0046] The second step is to detect periodic fluctuations using Fourier transform: Take the above 90-day time series feature matrix as the historical time window, perform Fourier transform on the data in the matrix to convert the time domain data into frequency domain data, observe the energy distribution of each frequency component in the frequency domain, if a significant peak appears at a certain frequency, it indicates that there is a periodic fluctuation in the time series data corresponding to that frequency. If analysis reveals a significant peak at a frequency of approximately 30 days within this historical time window, it indicates a monthly periodicity in the data. Simultaneously, the presence of a weaker peak at a frequency of 7 days reflects operational differences between weekdays and weekends. Based on the frequency domain detection results combined with the time domain waveform, the start and end points of each business cycle interval can be determined. For example, assuming the time domain waveform shows a significant increase in data fluctuations around January 31st, followed by a similar fluctuation pattern around February 28th, then January 25th to February 5th can be identified as the first business cycle interval, and February 25th to March 7th as the second business cycle interval.

[0047] Step 3, Business semantic annotation: The business calendar is labeled according to the pre-set accounting business calendar. The accounting business calendar is usually used to record the company's routine financial work arrangements. For example, the monthly closing preparation begins on the 25th of each month, the peak period for monthly closing is from the 26th to the 31st, the report generation and review period is from the 1st to the 5th of the following month, and quarterly reports need to be prepared at the end of each quarter. Based on this, the accounting business calendar will semantically label the detected business cycle intervals. For example, the first interval (January 25th to February 5th) is labeled as "monthly closing cycle", the second interval (February 25th to March 7th) is labeled as "monthly closing cycle", and it is noted that the interval from February 25th to March 7th includes the end of the quarter, so it is further labeled as "quarterly report cycle".

[0048] Step 4: Filter the normal business cycle period: The preset normal business cycle template library includes standard monthly closing cycle templates and standard quarterly report cycle templates. The standard monthly closing cycle template is defined as a distribution pattern of "3 days for monthly closing preparation, 5 days for peak monthly closing period, and 4 days for reporting period". The standard quarterly report cycle template adds "2 days for quarterly report preparation" on the basis of monthly closing. The detected business cycle intervals were matched with the above template. Assuming one business cycle interval is from January 25 to February 5, a total of 12 days, including 3 days for preparation, 5 days for peak period, and 4 days for reporting, it matches the standard monthly closing template perfectly and is selected as a normal monthly closing cycle interval. Another business cycle interval is from February 25 to March 7, a total of 11 days, including 3 days for preparation, 5 days for peak period, and 3 days for reporting, and also includes 1 day for quarterly report preparation. It deviates from the standard template and is not included in the normal cycle interval for the time being, and will be further processed in the abnormal sample removal step.

[0049] Step 5: Extract the historical feature vector sequence: From the selected normal monthly settlement cycle interval (January 25 to February 5 above), the row vectors of the time series feature matrix corresponding to these 12 days are extracted, resulting in feature data for a total of 12 time points. Each time point contains 96-dimensional features, forming a 12-row, 96-column historical feature vector sequence, which is then added to the initial training dataset.

[0050] The sixth step is to remove outlier samples from the initial training dataset to obtain the training dataset. This dataset is then randomly divided into a training set and a validation set in an 8:2 ratio for use in the training and validation of the subsequent time series prediction model.

[0051] In one embodiment of the present invention, the step of removing outlier samples from the initial training dataset includes: Obtain intrusion detection logs containing historical anomaly scores, and extract the operation time points marked as intrusion behaviors; A protection time window is set with the operation time point as the center, and the historical feature vector sequence within the protection time window is marked as a suspected abnormal sample; Calculate the statistical distribution difference between suspected abnormal samples and historical feature vector sequences within normal business cycles. When the statistical distribution difference exceeds a preset difference threshold, the suspected abnormal samples are removed from the initial training dataset. Historical feature vectors that were not marked as suspected anomalous samples but whose anomalous scores exceeded the preset filtering threshold were also treated as anomalous samples and removed from the initial training dataset.

[0052] It should be noted that, in this embodiment, taking the initial training dataset of a certain enterprise's financial information system from January to March of a certain year as an example, the initial training dataset contains 90 historical feature vector sequences, each sequence corresponding to the deep feature representation of an operation node on a certain date. The process for removing abnormal samples from this initial training dataset is as follows: The first step is to mark suspected abnormal samples based on historical intrusion logs: The system's intrusion detection logs are reviewed. These logs record the anomaly scores and judgment results generated by each detection. Operation time points that were clearly marked as "intrusion behavior" between January and March are extracted from them. Assuming that the query found that January 28 and February 15 were marked as intrusion, protection time windows of 2 days before and after these two operation time points are set as the center. For January 28, the protection window covers 5 days from January 26 to January 30. For February 15, the protection window covers 5 days from February 13 to February 17. All historical feature vector sequences within these two time windows are marked as "suspected anomalous samples".

[0053] The second step is to calculate the statistical distribution differences and remove samples identified as outliers: Select normal business cycle data that was not marked as suspected anomaly within the same period as the reference benchmark. For example, select data that was not marked during the period from January 1 to January 25 (assuming a total of 20 days). Calculate the mean vector and covariance matrix of the reference benchmark data in each feature dimension. For each suspected anomaly sample, calculate its Mahalanobis distance from the reference benchmark (used to comprehensively measure the degree of deviation of the sample from the normal distribution in the multidimensional feature space). Assuming that, based on calculations, among the samples within the window from January 26th to January 30th, the Mahalanobis distance for January 28th is 8.2, which is greater than the preset difference threshold (in this embodiment, the preset difference threshold is set to 5.0), while the Mahalanobis distances for other dates within the window do not exceed the threshold. Similarly, among the samples within the window from February 13th to February 17th, the Mahalanobis distance for February 15th is 7.6, which is greater than the preset difference threshold, while the distances for other dates do not exceed the threshold. Based on this, January 28th and February 15th are confirmed as samples with significantly abnormal statistical distributions and are removed from the initial training dataset. The remaining samples marked as suspected anomalies (January 26th, January 27th, January 29th, January 30th, February 13th, February 14th, February 16th, and February 17th) are retained.

[0054] The third step is to filter unlabeled anomalous samples based on anomaly scores: In this embodiment, the preset filtering threshold is 0.85. For the remaining 80 dates that are not marked as suspected anomalies (90 days minus the 10 days that have been processed as described above), we check the anomaly scores generated in the historical detection. Suppose that the screening finds that the anomaly score of February 28 is 0.92 and the anomaly score of March 15 is 0.88, both of which exceed the filtering threshold. Although these two dates are not marked by the intrusion log, their anomaly scores indicate that the behavior pattern deviates from the normal. Therefore, these two samples are removed from the initial training dataset.

[0055] The fourth step involves adding the remaining 86 normal samples from the initial training dataset, which consisted of 90 samples.

[0056] In one embodiment of the present invention, the steps of extracting the measured feature vector at the current time from the time-series feature matrix, inputting it into the trained time-series prediction model to obtain the predicted feature vector, calculating the residual between the measured feature vector and the predicted feature vector, quantifying the degree of behavioral shift after removing periodic fluctuations, and generating anomaly scores include: Extract the measured feature vector containing the deep feature representation of all operation nodes at the current time from the temporal feature matrix; The measured feature vectors are input into the trained time series prediction model. Based on the normal business behavior fluctuation patterns it has learned, the time series prediction model outputs the predicted feature vectors corresponding to the current time. The difference between the measured feature vector and the predicted feature vector is calculated to obtain the residual vector. The residual vector is decoupled according to the feature dimension to obtain the residual components on each feature dimension. The feature dimensions include the data sensitivity entropy value dimension, the operation time sequence coherence coefficient dimension, and the deep feature representation dimension corresponding to each operation node. The residual components of each feature dimension are weighted and fused to generate the anomaly score at the current time.

[0057] It should be noted that, taking a real-time detection scenario at 10:00 AM on a certain day in a company's financial information system as an example, the anomaly score generation is implemented in the following way: The first step is to extract the measured feature vector at the current time: As before, assume there are 12 operation nodes in the system. Each operation node generates an 8-dimensional deep feature representation after being aggregated by a graph neural network. At 10:00 AM on that day, the feature row vector corresponding to that time point is extracted from the time-series feature matrix constructed in real time. It is known that the dimension of this vector is 96. This vector is denoted as the measured feature vector X_real.

[0058] The second step is to input the data into the time series prediction model to obtain the predicted values: Input X_real into the trained time series prediction model, which uses a long short-term memory network (LSTM) structure and has been trained on historical normal business cycle data, learning the fluctuation pattern of normal business behavior. Based on the input at the current moment, the time series prediction model outputs a prediction feature vector X_pred with the same dimension as the input, which represents the feature value that the time series prediction model predicts should appear at the current moment according to the fluctuation pattern of normal business behavior.

[0059] The third step is to calculate the residual vector and decouple it: Calculate the residual vector R = X_real - X_pred, and decouple the residual vector according to the feature dimension, decomposing it into three components, including: Data sensitivity entropy residual components: 12 dimensions in total, corresponding to the entropy prediction bias of each operation node; Operational timing coherence coefficient residual components: 12 dimensions in total, corresponding to the coherence prediction bias of each operation node; The deep feature representation of the residual components consists of 72 dimensions, corresponding to the prediction bias of other deep feature representations for each node. Positive values ​​in the residual components indicate that the measured value is higher than the predicted value, while negative values ​​indicate that the measured value is lower than the predicted value.

[0060] Step 4: Weighted fusion to generate anomaly scores: The residual components on each feature dimension are weighted and fused. The weighting principle is as follows: the data sensitivity entropy dimension has the highest weight, followed by the operation time sequence coherence coefficient dimension, and the deep feature representation dimension has a relatively low weight. In this embodiment, the weighting scheme is as follows: the total weight of the entropy dimension is 0.5 (averaged across all nodes), the total weight of the coherence dimension is 0.3 (averaged across all nodes), and the total weight of the deep feature dimension is 0.2 (averaged across all nodes). The weighted summation of the absolute values ​​of the entropy residuals of each node is: Σ(0.5 / 12 × |data sensitivity entropy residual components|); Weighted summation of the absolute values ​​of the continuity residuals at each node: Σ(0.3 / 12 × |operational timing continuity coefficient residual components|); The weighted summation of the absolute values ​​of the depth feature residuals for each node is: Σ(0.2 / 72 × |Depth feature representation residual components|); The anomaly score S is obtained by summing the three parts. The anomaly score S at the current moment is calculated to be 0.26 (the score range is from 0 to 1, and the higher the value, the more abnormal it is).

[0061] In one embodiment of the present invention, after generating the anomaly score at the current moment, the method further includes the following steps: Obtain the sign of the residual components in each feature dimension. The sign indicates the direction of deviation of the measured feature vector from the predicted feature vector. Cluster analysis is performed on feature dimensions with the same positive or negative sign to identify anomalous feature groups consisting of multiple consecutive feature dimensions with a consistent deviation direction; Based on the operation nodes and their feature types corresponding to the abnormal feature groups, abnormal pattern information is generated. The abnormal pattern information includes "abnormally high data sensitivity" or "abnormally low operation consistency". Abnormal pattern information is associated with and stored with abnormal scores, and then pushed to relevant management personnel and alarm terminals.

[0062] It should be noted that, in this embodiment, taking the anomaly detection result of an anomaly score S=0.26 at 10:00 AM on a certain day in a certain enterprise's financial information system as an example, the system needs to further identify and analyze the anomaly, including: The first step is to obtain the sign of the residual components: From the residual vector generated in the previous embodiment, extract the residual values ​​and their positive and negative signs for 96 feature dimensions.

[0063] The second step is to use group cluster analysis to identify groups with abnormal features: Cluster analysis was performed on feature dimensions with the same positive or negative sign. The analysis revealed that at the "Fixed Asset Registration" node, the residual of its data sensitivity entropy value was positive (+0.07), and the residuals of the 3rd and 5th dimensions in the deep feature representation of this node were also positive (+0.04 and +0.03), forming an anomalous feature group consisting of three consecutive feature dimensions with a consistent positive deviation direction.

[0064] The third step is to generate abnormal mode information: Based on the identified abnormal feature groups, combined with their corresponding operation nodes and feature types, readable abnormal pattern information is generated. For example, for the aforementioned abnormal feature groups of the "Fixed Asset Registration" node, since they are concentrated on the data sensitivity entropy value and related deep features, it indicates that the data sensitivity of this node is abnormally high, which may mean that there has been an increase in access to uncommon subjects, abnormal amounts, or operations involving sensitive fields, and the abnormal pattern information "Fixed Asset Registration - Abnormally High Data Sensitivity" is generated.

[0065] Step 4: Link storage and push: The identified abnormal pattern information is associated with the current abnormal score of 0.26 and stored in the following format: time xxxx-xx-xx (year-month-day) 10:00, abnormal score 0.26, abnormal pattern list ["Fixed Asset Registration - Data Sensitivity Abnormally Increased"], and corresponding residual component data; Subsequently, the system pushes the abnormal mode information to relevant management personnel. The push content includes: the time of the abnormality, the operation nodes and mode types involved, the abnormality score, and a brief investigation suggestion. At the same time, the abnormal mode information is also pushed to the alarm terminal and displayed in the "Abnormal Mode Warning" area of ​​the system interface for auditors to view.

[0066] Please see Figure 2 The diagram illustrates a flowchart of a data analysis-based accounting data intrusion detection system according to an embodiment of the present invention. The system includes: The data acquisition and feature extraction module is used to collect multi-source operational data from the accounting information system and extract fine-grained feature vectors for each operational node based on the accounting business flow logic. The fine-grained feature vectors include data sensitivity entropy values ​​and operation time sequence coherence coefficients. The graph construction and feature aggregation module is used to construct an association graph with operation nodes as entity nodes and temporal dependencies and business logic relationships between operation nodes as edges. It uses fine-grained feature vectors as initial feature vectors for entity nodes and uses a deep learning model based on graph neural networks to perform feature aggregation and generate deep feature representations of entity nodes. The normal business behavior baseline construction module is used to construct a time series feature matrix based on deep feature representation. Based on a preset historical time window, it identifies normal business cycles from the time series feature matrix and extracts the corresponding historical feature vector sequence for training the time series prediction model and generating a prediction function that describes the fluctuation pattern of normal business behavior. The anomaly identification and scoring module is used to extract the measured feature vector at the current time from the time series feature matrix, input it into the trained time series prediction model, obtain the predicted feature vector, calculate the residual between the measured feature vector and the predicted feature vector, quantify the degree of behavioral deviation after removing periodic fluctuations, and generate anomaly scores.

[0067] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A data analysis-based method for detecting intrusion into accounting data, characterized in that, The method includes: S1. Collect multi-source operation data from the accounting information system, and extract fine-grained feature vectors for each operation node based on the accounting business flow logic. The fine-grained feature vectors include data sensitivity entropy values ​​and operation timing coherence coefficients. S2, using operation nodes as entity nodes and the temporal dependencies and business logic relationships between operation nodes as edges, construct an association graph, use the fine-grained feature vector as the initial feature vector of the entity nodes, and use a deep learning model based on graph neural networks to perform feature aggregation to generate a deep feature representation of the entity nodes. S3. Construct a time-series feature matrix based on the deep feature representation. Based on a preset historical time window, identify normal business cycles from the time-series feature matrix and extract the corresponding historical feature vector sequence for training the time-series prediction model and generating a prediction function that describes the fluctuation pattern of normal business behavior. S4. Extract the measured feature vector at the current moment from the time series feature matrix, input it into the trained time series prediction model to obtain the predicted feature vector, calculate the residual between the measured feature vector and the predicted feature vector, quantify the degree of behavioral deviation after stripping periodic fluctuations, and generate an anomaly score. The data sensitivity entropy value is determined in the following manner: Obtain the depth of the accounting subject to which the corresponding data field belongs in the subject system tree in the multi-source operation data, and determine its subject level weight; Traverse the pre-set financial statement reconciliation rule base to identify target report items that have direct or indirect reconciliation relationships with the data fields; Based on the length of the reconciliation path between the data field and the target report item, the reconciliation relationship weight is calculated, and the reconciliation relationship weight is normalized to obtain the correlation coefficient. The basic sensitivity score of the data field is calculated based on the subject level weight and the correlation coefficient. The basic sensitivity score is then mapped to a preset entropy range to generate the data sensitivity entropy value. The operation timing coherence coefficient is determined in the following manner: Obtain historical operation logs from multi-source operation data and calculate the support of each operation sequence pattern in the historical operation logs. Extract operation sequence patterns with support exceeding a preset support threshold as frequent operation sequence patterns, and establish a standard business process template library according to their respective business types; Each operation node and its temporal neighbors are obtained from multi-source operation data and arranged according to a preset time window to form a local operation sequence; Based on the longest common subsequence algorithm, the sequence similarity between the local operation sequence and each template in the standard business process template library is calculated, and the standard business process template with the highest sequence similarity is extracted as the optimal matching template. Calculate the expected position offset between the expected position index and the actual position index of the current operation node in the optimal matching template, and then weight and fuse the sequence similarity with the expected position offset to generate the operation temporal coherence coefficient.

2. The accounting data intrusion detection method based on data analysis according to claim 1, characterized in that: The step of using the fine-grained feature vector as the initial feature vector of the entity node, and performing feature aggregation using a deep learning model based on graph neural networks to generate a deep feature representation of the entity node includes: For each entity node, identify other entity nodes that have a direct connection with it as its neighbor nodes. Set the order K. For each entity node, perform K-order aggregation. In the k-order aggregation, the entity node aggregates the feature vectors of its neighbor nodes after the (k-1)-order aggregation to generate the feature vector of the entity node after the k-order aggregation, where k = 1, 2...K. The feature vector after the 0th iteration is the initial feature vector. In each aggregation process, based on the edge type between the current entity node and its neighboring nodes and the operation timing coherence coefficient, the attention weights of different neighboring nodes to the entity node are calculated. The feature vectors of the neighboring nodes are weighted and summed based on the attention weights, which is used as the feature vector of the entity node after this aggregation. The feature vector generated after K-order aggregation of each entity node is used as the deep feature representation of that entity node.

3. The accounting data intrusion detection method based on data analysis according to claim 2, characterized in that: The step of calculating the attention weights of different neighboring nodes to an entity node in each aggregation process, based on the edge type between the current entity node and its neighboring nodes and the operation timing coherence coefficient, includes: Obtain the edge types between the entity node and its neighboring nodes, where the edge types include temporal dependency edges and business logic relationship edges; Preset basic attention weights for different edge types, wherein the basic attention weight of the business logic relationship edge is greater than the basic attention weight of the temporal dependency edge; Obtain the operation timing coherence coefficient corresponding to the neighbor node, and generate an attention decay factor based on the comparison result between the operation timing coherence coefficient and a preset coefficient threshold. The basic attention weights are multiplied by the attention decay factor, and the result is normalized to obtain the attention weights used for feature aggregation.

4. The accounting data intrusion detection method based on data analysis according to claim 1, characterized in that: The steps of constructing a time-series feature matrix based on the deep feature representation, identifying normal business cycles from the time-series feature matrix based on a preset historical time window, and extracting the corresponding historical feature vector sequences include: The deep feature representations of each operation node are reorganized according to the time dimension, with time points as rows and operation nodes as columns, to construct a temporal feature matrix; Fourier transform is performed on the time-series feature matrix within the preset historical time window to extract its time-domain and frequency-domain features. Based on the time-domain and frequency-domain features, periodic fluctuation patterns in the time-series data are detected, and the start and end points of each business cycle interval are determined. The length of the historical time window covers at least one complete business cycle. Based on the pre-set accounting business calendar, the detected periodic fluctuation patterns are labeled with business semantics to identify the business cycle type corresponding to each business cycle interval, including monthly closing cycle, quarterly report cycle and annual report cycle. From the identified business cycle intervals, select the intervals that match the preset normal business cycle template and use them as the normal business cycle intervals. From the normal business cycle interval, extract the row vectors of the time series feature matrix within the corresponding time range, and use them as the historical feature vector sequence to form the initial training dataset; The initial training dataset is subjected to outlier removal to obtain the training dataset, which is then divided into a training set and a validation set for training and validation of the time series prediction model.

5. The accounting data intrusion detection method based on data analysis according to claim 4, characterized in that: The steps for removing outlier samples from the initial training dataset include: Obtain intrusion detection logs containing historical anomaly scores, and extract the operation time points marked as intrusion behaviors; Centered on the operation time point, a protection time window is set, and the historical feature vector sequence within the protection time window is marked as a suspected abnormal sample; Calculate the statistical distribution difference between the suspected abnormal sample and the historical feature vector sequence within the normal business cycle. When the statistical distribution difference exceeds a preset difference threshold, remove the suspected abnormal sample from the initial training dataset. Historical feature vectors that were not marked as suspected anomalous samples but whose anomalous scores exceeded the preset filtering threshold were also treated as anomalous samples and removed from the initial training dataset.

6. The accounting data intrusion detection method based on data analysis according to claim 1, characterized in that: The steps of extracting the measured feature vector at the current time from the time-series feature matrix, inputting it into the trained time-series prediction model to obtain the predicted feature vector, calculating the residual between the measured feature vector and the predicted feature vector, quantifying the degree of behavioral shift after removing periodic fluctuations, and generating anomaly scores include: Extract the measured feature vector containing the deep feature representation of all operation nodes at the current time from the temporal feature matrix; The measured feature vector is input into the trained time series prediction model, which outputs a predicted feature vector corresponding to the current time based on the normal business behavior fluctuation pattern it has learned. The difference between the measured feature vector and the predicted feature vector is calculated to obtain the residual vector. The residual vector is decoupled according to the feature dimension to obtain the residual components on each feature dimension. The feature dimension includes the data sensitivity entropy value dimension, the operation time sequence coherence coefficient dimension, and the deep feature representation dimension corresponding to each operation node. The residual components of each feature dimension are weighted and fused to generate the anomaly score at the current time.

7. The accounting data intrusion detection method based on data analysis according to claim 6, characterized in that: After generating the anomaly score for the current moment, the following steps are also included: Obtain the sign of the residual components in each feature dimension, where the sign indicates the direction of deviation of the measured feature vector from the predicted feature vector. Cluster analysis is performed on feature dimensions with the same positive or negative sign to identify anomalous feature groups consisting of multiple consecutive feature dimensions with a consistent deviation direction; Based on the operation nodes and their feature types corresponding to the abnormal feature groups, abnormal pattern information is generated, including "abnormally high data sensitivity" or "abnormally low operation continuity". The abnormal pattern information is associated with the abnormal score and stored, and then pushed to relevant management personnel and alarm terminals.

8. A data analysis-based accounting data intrusion detection system for implementing the data analysis-based accounting data intrusion detection method of claim 1, characterized in that, include: The data acquisition and feature extraction module is used to collect multi-source operation data from the accounting information system and extract fine-grained feature vectors for each operation node based on the accounting business flow logic. The fine-grained feature vectors include data sensitivity entropy values ​​and operation time sequence coherence coefficients. The graph construction and feature aggregation module is used to construct an association graph with operation nodes as entity nodes and temporal dependencies and business logic relationships between operation nodes as edges. The fine-grained feature vectors are used as the initial feature vectors of entity nodes, and a deep learning model based on graph neural networks is used to perform feature aggregation to generate deep feature representations of entity nodes. The normal business behavior baseline construction module is used to construct a time series feature matrix based on the deep feature representation, identify normal business cycles from the time series feature matrix based on a preset historical time window, and extract the corresponding historical feature vector sequence for training a time series prediction model and generating a prediction function that describes the fluctuation pattern of normal business behavior. The anomaly identification and scoring module is used to extract the measured feature vector at the current time from the time-series feature matrix, input it into the trained time-series prediction model to obtain the predicted feature vector, calculate the residual between the measured feature vector and the predicted feature vector, quantify the degree of behavioral deviation after stripping periodic fluctuations, and generate anomaly scores.

Images