An audit data analysis requirement analysis method and system based on a metadata relationship graph

Abstract

This application discloses a method and system for audit data analysis requirements parsing based on metadata relationship graphs. By acquiring audit text, metadata relationship graphs, audit rule bases, business-level templates, and business benchmark data, the audit text undergoes semantic flow parsing and is mapped to the metadata relationship graph. A field strength correlation graph is generated through propagation calculation. Activated nodes are selected based on field strength thresholds and their relationships are expanded using the audit rule base to construct activated subgraph data. Based on the business-level templates, the activated subgraphs are reconstructed into a tree-like parsing structure and pruned according to field strength to generate a pruned parsing tree. Finally, node perturbation coefficients are calculated based on the business benchmark data and hierarchically aggregated according to the tree structure to generate an audit requirement perturbation graph. This transforms the traditional audit data analysis process, which relies on manual experience, into an automated and intelligent graph calculation process, significantly improving the accuracy, comprehensiveness, and efficiency of audit data analysis.

Description

Technical Field

[0001] This invention relates to the field of audit data processing and information analysis, specifically to an audit data analysis requirement analysis method and system based on metadata relationship graphs. Background Technology

[0002] With the deepening of audit informatization, the data environment faced by auditors has expanded from traditional relational databases to complex big data environments encompassing data warehouses, data lakes, and various business systems. Against this backdrop, the scale of data to be analyzed by auditors is growing exponentially, with diverse sources and varying structures. This makes accurately identifying core information relevant to audit objectives from massive amounts of data the primary challenge of audit data analysis. Audit requirements are typically presented in natural language text, and the business scope, analysis objects, and constraints contained within them need to be accurately understood and transformed into executable data analysis tasks. The accuracy and efficiency of this transformation process directly determine the quality and depth of subsequent audit data analysis.

[0003] Currently, the analysis of audit data primarily employs keyword matching or predefined templates. In practice, auditors search the metadata directory based on business terms appearing in the text requirements to locate potentially relevant data tables and fields, and then write structured query statements based on their experience to extract data. Some systems attempt to introduce natural language processing technology to segment and recognize entities in the audit text, comparing the recognition results with a data dictionary to achieve a certain degree of automated matching. Other solutions are based on rule engines, allowing users to pre-configure audit logic judgment conditions, and then executing rule screening after data loading to detect abnormal records. These methods improve the efficiency of audit data analysis to some extent, but their core processing logic still relies mainly on linear matching and the execution of preset rules.

[0004] However, the above methods have several technical shortcomings in practical applications. Natural language auditing requirements often contain multi-dimensional and multi-layered semantic information. Simply relying on keyword matching is insufficient to achieve accurate mapping between semantic units and data entities, resulting in significant noise or omissions in the matching results. Anomaly detection in auditing operations typically requires cross-data table and cross-business process correlation analysis, but existing methods lack the ability to effectively model and extend the logical relationships implicit in audit rules, preventing deep-seated correlation data from being automatically included in the analysis. Furthermore, the data entity sets obtained through simple matching are often large in scale and lack importance measurement, leading to redundant and scattered analysis results, requiring auditors to expend considerable effort on manual screening and judgment. More importantly, existing technologies generally stop at locating relevant data entities and cannot further combine the normal operation benchmarks of the business system to quantitatively assess the degree of data anomalies, thus failing to provide clear guidance on prioritizing suspicious points. Summary of the Invention

[0005] In view of the above-mentioned actual situation, this application proposes an audit data analysis requirement parsing method and system based on metadata relationship graph, in order to solve the technical problems existing in the prior art, such as the difficulty in accurately mapping natural language audit requirements to data entities, the inability to integrate audit rules for logical expansion, the redundancy and dispersion of analysis results, and the lack of ability to quantify the degree of data anomalies.

[0006] A method for parsing audit data analysis requirements based on metadata relationship graphs, the method comprising the following steps: S1, Obtain the data to be processed, which includes audit text data, metadata relationship graph, audit rule base, business level template, and business benchmark data; the metadata relationship graph is a graph structure data constructed with data tables, fields, and reports in the audit domain as nodes and data flow and business logic relationships as edges; the audit rule base is a collection of predefined audit logic judgment conditions and anomaly detection modes; the business level template is predefined structure data describing the hierarchical relationship between various metadata entities in the audit domain; S2, perform semantic flow parsing and graph propagation processing on the audit text data and metadata relationship graph. The semantic flow parsing and graph propagation processing is to parse the audit text into semantic flow information and map it to relevant nodes in the metadata relationship graph, and calculate the node association strength through relationship propagation, thereby generating a field strength association graph. S3, perform node filtering and relationship expansion processing on the field strength correlation graph and audit rule base. The node filtering and relationship expansion processing is to determine the active node based on the field strength threshold, and construct the active subgraph data by expanding the relationship in the metadata relationship graph based on the active node and in combination with the audit rule base. S4, perform structural reconstruction processing on the activated subgraph data and the business level template. The structural reconstruction processing is to construct a tree-shaped parsing structure based on the node hierarchical membership relationship defined by the business level template, and to prune the tree-shaped parsing structure based on the node field strength to generate a pruned parsing tree. S5, perform perturbation mapping and hierarchical aggregation processing on the pruned parse tree and business benchmark data. The perturbation mapping and hierarchical aggregation processing calculates the node perturbation coefficient based on the business indicator value and business benchmark data corresponding to the node, performs weight mapping in combination with the node field strength, and performs hierarchical aggregation on the perturbation coefficient according to the tree structure to generate an audit requirement perturbation map.

[0007] Furthermore, step S2 includes the following sub-steps: S201, the audit text data is subjected to semantic flow deconstruction processing to obtain multiple semantic flow channels. The semantic flow deconstruction processing is based on dependency parsing and semantic role labeling to split the audit requirement text into subject semantic units, object semantic units and condition semantic units. Each semantic unit constitutes an independent semantic flow channel, and the source term of each channel is extracted as the diffusion source point. S202, the semantic flow channel and metadata relationship graph are subjected to field diffusion and superposition calculation processing to obtain a field strength association graph. The field diffusion and superposition calculation processing starts from the source term of each semantic flow channel and propagates the field strength value outward with a decay function on the metadata relationship graph. Each node receives the field strength value from different channels and superimposes it to form a field strength mark that reflects the comprehensive association strength between the node and the audit requirements.

[0008] Furthermore, step S3 includes the following sub-steps: S301, Perform field strength threshold filtering on the field strength correlation map to obtain an active node set. The field strength threshold filtering process is to traverse the nodes in the field strength correlation map according to a preset field strength threshold, and extract the nodes whose field strength marker values ​​are greater than or equal to the threshold to form an active node set reflecting the correlation elements. S302, perform rule matching and secondary field propagation processing on the set of activated nodes and the audit rule base to obtain activated subgraph data. The rule matching and secondary field propagation processing involves matching the set of activated nodes with the rule conditions in the audit rule base, propagating the secondary field outward along its associated edge for successfully matched nodes, and the intensity of the secondary field decays with the propagation distance. The newly activated nodes and paths are incorporated into the graph structure to form activated subgraph data containing multiple layers of association relationships.

[0009] Furthermore, step S4 includes the following sub-steps: S401, the activated subgraph data and the business layer template are subjected to structural anchoring combination processing to obtain an initial tree with anchoring weights. The structural anchoring combination processing is to traverse the nodes in the activated subgraph data, and based on the three-level membership relationship of business domain, data table and field defined in the business layer template, attach each node to the corresponding layer position. At the same time, the anchoring strength between nodes in the same layer is determined according to the weight of the original association edge between nodes in the activated subgraph data, and the anchoring strength is marked as the structural weight of the node in the tree. S402, the initial tree with anchored weights is subjected to field strength hierarchical pruning to obtain a pruned parse tree. The field strength hierarchical pruning process involves calculating the mean and variance of the field strength of each level node in the initial tree, determining the adaptive pruning baseline for each level based on the variance, removing nodes with field strength values ​​lower than the adaptive pruning baseline and their subordinate child nodes, retaining nodes with field strength values ​​higher than or equal to the adaptive pruning baseline, and reorganizing the retained nodes into a pruned parse tree according to the original hierarchical membership.

[0010] Furthermore, step S5 includes the following sub-steps: S501, the field strength benchmark deviation calculation process is performed on the pruned parse tree and the business benchmark data to obtain a parse tree with perturbation labels. The field strength benchmark deviation calculation process is to traverse the nodes in the pruned parse tree, extract the metadata field corresponding to each node, generate the corresponding index calculation logic according to the metadata relationship graph and obtain the index value from the business data, find the benchmark threshold range of the field in the business benchmark data, calculate the degree of deviation between the index value and the benchmark threshold range, and perform weighted calculation in combination with the node field strength value to quantify the degree of deviation into a perturbation coefficient, and assign the perturbation coefficient as an additional label to the node. S502, the perturbation maximum value aggregation and graph construction process is performed on the perturbation maximum value aggregation of the perturbation maximum value aggregation and graph construction process to obtain the audit requirement perturbation graph. The perturbation maximum value aggregation and graph construction process is based on the hierarchical structure of the perturbation maximum value aggregation ...

[0011] Furthermore, the semantic flow deconstruction processing is based on dependency parsing and semantic role labeling to split the audit requirement text into subject semantic units, object semantic units, and conditional semantic units. Each semantic unit constitutes an independent semantic flow channel, and the source terms of each channel are extracted as diffusion sources, including semantic unit identification and role assignment processing and source term extraction and channel construction processing. The field diffusion and superposition calculation processing starts from the source terms of each semantic flow channel and propagates the field strength value outward with a decay function on the metadata relationship graph. Each node receives the field strength values ​​from different channels and superimposes them to form a field strength mark that reflects the comprehensive correlation strength between the node and the audit requirement, including field diffusion propagation processing and field strength superposition mark processing.

[0012] Furthermore, the field strength threshold screening process involves traversing the nodes in the field strength correlation graph based on a preset field strength threshold, extracting nodes whose field strength marker values ​​are greater than or equal to the threshold, and forming an active node set reflecting the correlation elements. This includes threshold setting and dynamic calibration processing, as well as node screening and set construction processing. The rule matching and secondary field propagation processing involves matching the active node set with the rule conditions in the audit rule base, propagating the secondary field outward along its correlation edge for successfully matched nodes, with the secondary field intensity decreasing as the propagation distance increases, and incorporating the newly activated nodes and paths into the graph structure to form active subgraph data containing multi-layer correlation relationships. This includes rule matching triggering processing and secondary field diffusion and subgraph construction processing.

[0013] Furthermore, the structural anchoring combination processing involves traversing the nodes in the activated subgraph data, attaching each node to its corresponding hierarchical position based on the three-level membership relationships of business domain, data table, and field defined in the business hierarchy template, and determining the anchoring strength between nodes at the same level based on the original association edge weights between nodes in the activated subgraph data. This anchoring strength is then used as the structural weight of the node in the tree for marking, including node attachment and tree construction processing, as well as anchoring strength calculation and marking processing. The field strength hierarchical pruning processing involves calculating the mean and variance of the field strength of each level of nodes in the initial tree, determining the adaptive pruning baseline for each level based on the variance, removing nodes with field strength values ​​lower than the adaptive pruning baseline and their subordinate child nodes, retaining nodes with field strength values ​​higher than or equal to the adaptive pruning baseline, and reorganizing the retained nodes into a pruning parsing process according to the original hierarchical membership relationships, including adaptive determination of pruning baseline processing and recursive pruning and tree reconstruction processing.

[0014] Furthermore, the field strength benchmark deviation calculation process involves traversing and pruning the nodes in the parse tree, extracting the metadata fields corresponding to each node, generating corresponding indicator calculation logic based on the metadata relationship graph, obtaining indicator values ​​from business data, searching for the benchmark threshold range of the field in the business benchmark data, calculating the degree of deviation between the indicator value and the benchmark threshold range, and performing weighted calculations in conjunction with the node field strength values. The degree of deviation is quantified into a disturbance coefficient, and the disturbance coefficient is assigned as an additional label to the node. This includes indicator value acquisition and deviation calculation processing, as well as field strength weighting and disturbance coefficient generation processing. The disturbance maximum value aggregation and graph construction processing is based on the hierarchical structure of the parse tree with disturbance labels. Following a bottom-up order, the disturbance coefficient of each parent node is determined to be the maximum value among the disturbance coefficients of all its direct child nodes, forming the aggregated disturbance value of each level node. The node paths and aggregated disturbance values ​​are organized into audit requirement indication data in graph form, including disturbance maximum value aggregation processing and aggregated graph construction processing.

[0015] Furthermore, this application also discloses an audit data analysis requirement parsing system based on metadata relationship graphs, the system comprising: The acquisition unit is used to acquire data to be processed, which includes audit text data, metadata relationship graph, audit rule base, business level template, and business benchmark data. The metadata relationship graph is a graph structure data constructed with data tables, fields, and reports in the audit domain as nodes and data flow and business logic relationships as edges. The audit rule base is a collection of predefined audit logic judgment conditions and anomaly detection modes. The business level template is a predefined structure data describing the hierarchical relationship between various metadata entities in the audit domain. The semantic propagation unit is used to perform semantic flow parsing and graph propagation processing on the audit text data and metadata relationship graph. It parses the audit text into semantic flow information and maps it to relevant nodes in the metadata relationship graph. It also calculates the node association strength through relationship propagation, thereby generating a field strength association graph. The activation extension unit is used to perform node filtering and relationship expansion processing on the field strength correlation graph and the audit rule base. It determines the activation node based on the field strength threshold, and expands the relationship in the metadata relationship graph based on the activation node and the audit rule base to construct the activation subgraph data. The pruning and reconstruction unit is used to perform structural reconstruction processing on the activated subgraph data and the business level template, so as to construct a tree-shaped parsing structure according to the node hierarchical membership relationship defined by the business level template, and perform pruning processing on the tree-shaped parsing structure based on the node field strength, thereby generating a pruned parsing tree; The perturbation aggregation unit is used to perform perturbation mapping and hierarchical aggregation processing on the pruned parse tree and business benchmark data. It calculates the node perturbation coefficient based on the business indicator value corresponding to the node and the business benchmark data, and performs weight mapping in combination with the node field strength. It then performs hierarchical aggregation of the perturbation coefficient according to the tree structure to generate an audit requirement perturbation map.

[0016] The audit data analysis requirement parsing method and system proposed in this application based on metadata relationship graphs achieves semantic precision parsing of audit requirements, logical deep integration of audit rules, dynamic focusing and dimensionality reduction of metadata structures, and quantitative aggregation and presentation of audit doubts. It transforms the traditional audit data analysis process that relies on human experience into an automated and intelligent graph calculation process, significantly improving the accuracy, comprehensiveness and efficiency of audit data analysis. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the process for proposing an audit data analysis requirement parsing method based on metadata relationship graphs, as proposed in this application. Figure 2 This is a schematic diagram of the field strength propagation attenuation and multi-channel superposition effect in this embodiment; Figure 3 This is a diagram illustrating the field strength threshold triggering and secondary field propagation effect in this embodiment; Figure 4 This is a schematic diagram illustrating the logic for aggregating maximum disturbance values ​​and focusing audit requirements in this embodiment; Figure 5 This application provides a schematic diagram of the audit data analysis requirement parsing system structure based on metadata relationship graphs in an embodiment of the present application. Detailed Implementation

[0018] The simulation technology route in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0020] The features and performance of the present invention will be further described in detail below with reference to embodiments. Please refer to the appendix. Figure 1 As shown, an audit data analysis requirement parsing method based on metadata relationship graphs is described, the method comprising the following steps: S1. Obtain the data to be processed, which includes audit text data, metadata relationship graph, audit rule base, business level template, and business benchmark data. The audit text data is unstructured text describing the scope of the audited business and the analysis objectives in natural language. The metadata relationship graph is a graph structure constructed using data tables, fields, and reports in the audit domain as nodes and data flow and business logic relationships as edges. The audit rule base is a collection of predefined audit logic judgment conditions and anomaly detection modes. The business level template is predefined structured data describing the hierarchical relationships between various metadata entities in the audit domain. The business benchmark data is indicator thresholds and fluctuation range data describing the normal operating status of the business system. In some implementations, the data to be processed specifically includes audit text data, metadata relationship graphs, audit rule bases, business-level templates, and business benchmark data. These data describe the knowledge and constraints of the audit business from different dimensions. Specifically, audit text data is unstructured text describing the scope and analysis objectives of the audit business in natural language form, such as the requirements description in an audit notice or the key area description in an audit work plan. Its content includes semantic elements such as the audit subject, audit object, and audit conditions. This data serves as the starting point for the entire parsing process and will be subsequently deconstructed into multiple semantic flow channels. It should be noted that the audit text data is obtained by reading requirements documents from the audit information system or text content entered through the user interface. Its format is plain text or tagged text, without any predefined structured tags. Therefore, it is necessary to use natural language processing technology for deep semantic understanding.

[0021] In this embodiment, the metadata relationship graph is a graph structure built using data tables, fields, and reports in the audit domain as nodes and data flow relationships and business logic relationships as edges. This graph is formally represented as a directed graph. , where the set of nodes These represent data table nodes, field nodes, and report nodes, respectively, and are edge sets. It includes data flow edges (representing the direction of data flow between tables and between tables and reports) and business logic relationship edges (representing computational dependencies, foreign key associations, or business rule constraints between fields). Preferably, the construction of the metadata relationship graph relies on the collection of metadata from the audit business system and knowledge modeling by domain experts. For example, table and field information is extracted through database dictionaries, data flow is obtained through data lineage analysis tools, and business logic relationships are defined through audit experience, thereby forming a relational network covering the entire audit domain. This graph provides a spatial topology for subsequent semantic flow diffusion.

[0022] In some implementations, the audit rule base is a collection of predefined audit logic judgment conditions and anomaly detection patterns. Each rule is encapsulated as an executable logical expression or algorithm model to identify abnormal data in specific business scenarios. For example, the "three-item matching" rule for procurement can be represented as the judgment condition that "the purchase order amount, the warehouse receipt amount, and the invoice amount are inconsistent." This rule will be matched with the activation node in subsequent steps and trigger secondary field propagation. Furthermore, the rules in the audit rule base can be organized according to audit domains, such as financial audit rules, engineering audit rules, performance audit rules, etc. Each rule includes a rule identifier, applicable business objects, logical condition expressions, and anomaly threshold parameters. The rule base is stored in a relational database or graph database in structured data form for dynamic loading and invocation by the system at runtime.

[0023] In this embodiment, the business hierarchy template is a predefined structured data describing the hierarchical relationships between various metadata entities in the audit domain. This template clarifies the three-level nested relationships between business domains, data tables, and fields, such as the hierarchical path of "supply chain domain - procurement management - purchase order table - order amount field". Specifically, the business hierarchy template can be formalized as a tree structure. The node set N contains business domain nodes, data table nodes, and field nodes, while the edge set P represents parent-child relationships. Each non-leaf node represents a business category or data set, and leaf nodes represent observable field metrics. Preferably, this template is pre-built based on the audit business standard system and can be updated regularly according to audit practices. Its function is to hierarchically organize the unordered nodes in the metadata relationship graph according to business semantics, providing an anchoring framework for subsequent field strength-driven reconstruction and hierarchical pruning.

[0024] In some implementations, business baseline data refers to threshold and fluctuation range data that describe the normal operating status of the business system. For example, the normal fluctuation range for the "monthly procurement amount" field can be set to [value missing]. Where L is the lower threshold and U is the upper threshold, this data is typically derived from historical data statistical analysis or industry standards. Furthermore, the business benchmark data is represented in dictionary form. ,in For field identifiers, This serves as the baseline range for the field. Preferably, the generation of business baseline data relies on time-series analysis of historical business data, determining the normal fluctuation range by calculating the mean and standard deviation, or setting a fixed threshold using expert experience. This data is used in step S5 to calculate the degree of deviation between the node field strength value and the baseline value, thereby quantifying the disturbance coefficient.

[0025] It should be noted that the five types of data mentioned above are logically interconnected and jointly support subsequent processing. Audit text data provides the semantic source of requirements, the metadata relationship graph provides the spatial carrier for semantic diffusion, the audit rule base introduces domain logic constraints, the business-level templates provide the skeleton for structured reconstruction, and the business benchmark data provides a reference standard for anomaly quantification. In specific implementation, these data are loaded into memory through a unified data interface and indexed to support efficient querying. For example, a graph database is used to store the metadata relationship graph, and a rule engine is used to load the audit rule base, thereby ensuring that subsequent steps can quickly access the required information.

[0026] S2, perform semantic flow parsing and graph propagation processing on the audit text data and metadata relationship graph, parse the audit text into semantic flow information and map it to relevant nodes in the metadata relationship graph, and calculate the node association strength through relationship propagation, thereby generating a field strength association graph; Furthermore, this step includes the following sub-steps: S201, the audit text data is subjected to semantic flow deconstruction processing to obtain multiple semantic flow channels. The semantic flow deconstruction processing is based on dependency parsing and semantic role labeling to split the audit requirement text into subject semantic units, object semantic units and condition semantic units. Each semantic unit constitutes an independent semantic flow channel, and the source term of each channel is extracted as the diffusion source point. Furthermore, the semantic flow deconstruction process is based on dependency parsing and semantic role labeling to split the audit requirement text into subject semantic units, object semantic units, and condition semantic units. Each semantic unit constitutes an independent semantic flow channel, and the source terms of each channel are extracted as diffusion sources. This includes semantic unit identification and role assignment processing and source term extraction and channel construction processing. The semantic unit identification and role assignment processing involves performing dependency parsing on natural language sentences in the audit text data to obtain the grammatical dependencies between words, and then performing semantic role labeling to identify argument components related to the predicate core in the sentence, thereby decomposing the audit requirement text into subject semantic units, object semantic units, and condition semantic units. The source term extraction and channel construction processing involves extracting core terms with domain representation capabilities from each semantic unit as diffusion sources for that channel, and defining each semantic unit as an independent semantic flow channel. This channel uses the diffusion source point as the starting identifier and the semantic unit type as the channel type label, providing an initial activation position for subsequent field-based diffusion on the metadata relationship graph.

[0027] In some implementations, the semantic unit identification and role assignment processing specifically employs a dependency parser based on a deep neural network to perform syntactic structure parsing on the audit text data, generating a dependency relation tree with the predicate verb as the core node. This tree structure is represented as a directed graph. , where the set of nodes The set of directed edges corresponding to each word in the text This indicates the type of dependency relationship between words, such as subject-predicate, verb-object, and attributive-head relationships. Further, semantic role labeling is performed based on the dependency relationship tree. This labeling process treats each predicate verb as a trigger word in an argument framework, identifying the argument roles associated with that trigger word. Specifically, these include agent, patient, and condition roles. The agent role typically corresponds to the executor of the action or the bearer of responsibility; the patient role corresponds to the recipient of the action or the object affected; and the condition role corresponds to the time, place, manner, scope, or constraints of the action. For example, for the audit text data "inspecting large abnormal transactions in 2023 purchase orders," after dependency parsing and semantic role labeling, the core predicate "inspect" can be identified as having an implicit audit subject or gap, "purchase orders" and "large abnormal transactions" as patient semantic units, and "2023" as the condition semantic unit. This forms three semantic units corresponding to different demand dimensions. It should be noted that the semantic role labeling process is based on a pre-trained semantic role labeling model. This model takes word sequences and their dependencies as input and outputs the semantic role label of each word relative to the target predicate. This calculation process is a conventional technique in the field of natural language processing, and those skilled in the art can implement its specific functions based on publicly available literature. Therefore, it will not be elaborated on here.

[0028] In this embodiment, the source term extraction and channel construction process involves further extracting source terms that characterize the core semantics of each semantic unit after acquiring the semantic units. Source terms refer to words or phrases within the semantic unit that have the highest information load and can be mapped to nodes in the metadata relation graph. Specifically, for the set of words contained in each semantic unit, source terms are determined by calculating the domain term weights and syntactic centrality of the words. The domain term weights are obtained based on a term recognition model pre-trained from an audit domain corpus, and the syntactic centrality is measured based on the depth and out-degree of the words in the dependency tree. Preferably, for subject semantic units, source terms are typically words representing the business entity or responsible department; for object semantic units, source terms are words representing data objects or business matters; and for conditional semantic units, source terms are modifying words representing time ranges, monetary ranges, or business types. For example, in the aforementioned embodiment, the object semantic unit "large abnormal transaction" can be extracted as the source term "transaction amount" or "abnormal identifier", depending on whether there is a matching field node in the metadata relationship graph.

[0029] Furthermore, each semantic unit, after being extracted from source terms, is formalized into a semantic flow channel. Where k is the channel index, Represents the semantic unit type, taking values ​​from a set. , This refers to the set of source term terms extracted from this semantic unit. , This is a channel identifier used for reference in subsequent processing. It should be noted that this is the source term set. It may contain multiple words. For example, the object semantic unit "large abnormal purchase order" may contain two source terms: "purchase order" and "large amount". These two terms will serve as the starting nodes for subsequent field diffusion, thus forming multiple diffusion source points on the metadata relationship graph to ensure comprehensive coverage of semantic information. Preferably, for time-related source terms in conditional semantic units, such as "2023", they will not only serve as diffusion source points but will also be recorded as time constraint parameters in subsequent field strength attenuation calculations to limit the time validity of nodes during the diffusion process.

[0030] In this embodiment, through the aforementioned semantic unit identification and role assignment processing, as well as source term extraction and channel construction processing, the unstructured audit text data is transformed into several structured semantic flow channels. Each channel carries a type label and a set of source terms, providing a clear initial activation point for field-based diffusion in subsequent steps. Specifically, the generation of semantic flow channels separates the diverse audit requirements that were originally mixed in the same text into independent semantic dimensions. For example, "checking large anomalies in purchase orders" is simultaneously decomposed into an object channel targeting the "purchase order" object and a conditional channel targeting the "large anomaly" condition. These two channels will diffuse separately in subsequent steps and form a superimposed effect on the metadata relationship graph, thereby accurately reflecting the composite impact of different dimensions in the text requirements on the same data node. This processing method ensures the complete decomposition and structured expression of semantic information, avoids semantic ambiguity or information loss caused by single keyword matching, and lays a precise semantic foundation for subsequent field-strength-based association analysis.

[0031] S202, the semantic flow channel and metadata relationship graph are subjected to field diffusion and superposition calculation processing to obtain a field strength association graph. The field diffusion and superposition calculation processing starts from the source term of each semantic flow channel and propagates the field strength value outward with a decay function on the metadata relationship graph. Each node receives the field strength value from different channels and superimposes it to form a field strength mark that reflects the comprehensive association strength between the node and the audit requirements. Furthermore, the field diffusion and superposition calculation process starts from the source terms of each semantic flow channel and propagates the field strength value outward with a decay function on the metadata relationship graph. Each node receives the field strength values ​​from different channels and superimposes them to form a field strength mark that reflects the comprehensive correlation strength between the node and the audit requirements. This includes field diffusion propagation processing and field strength superposition mark processing. The field diffusion propagation processing maps each source term in each semantic flow channel to the corresponding node in the metadata relationship graph. Using this node as the diffusion source, the field strength value is propagated to the adjacent nodes along the relationship edges in the graph according to a preset decay function. The propagation process follows the distance decay principle, that is, the farther away the node is from the diffusion source, the smaller the field strength value it receives. The field strength superposition mark processing accumulates and sums the field strength values ​​from different semantic flow channels and different source points in the same channel on the same node. The accumulated result is used as the comprehensive field strength mark of the node, thereby generating a field strength association graph with a field strength value attached to the node.

[0032] In some implementations, the field-based diffusion propagation process divides each semantic flow channel Source term set Each term in Mapping to metadata relationship graph The corresponding node in This mapping is based on the text matching degree between terms and node names or attributes. Specifically, it can be calculated using edit distance or vector space similarity. The node with the highest matching degree is selected as the diffusion source point. This process is a well-known entity linking technique and will not be elaborated here. Furthermore, for each diffusion source point... Its initial field strength is defined as a unit value of 1, representing the complete association between the node and the semantic flow channel. Subsequently, with... Starting from a node, perform a breadth-first traversal outwards along the directed or undirected edges of the graph. For any node reached during the traversal... Calculate from Graph distance to v The distance is defined as the number of edges traversed by the shortest path. If the edges have weights, the distance can be defined as the weighted path length. Preferably, the unweighted shortest path hop count is used as the distance metric to simplify calculation and maintain the intuitiveness of semantic propagation. Specifically, the graph distance calculation process is based on the topological structure of the metadata relation graph and uses a breadth-first search algorithm to start from the source node. Solve for the shortest path hop count to the target node v. Specifically, for a given diffusion source point... The source node is used as the starting point for the search, with an initial distance value of 0. This node is then marked as visited. All its adjacent nodes are then traversed. These adjacent nodes are directly connected to the source node through edges in the metadata relationship graph. The distance value is increased by 1 with each layer traversed, until the target node v is found or all reachable nodes have been traversed. This breadth-first search process ensures that the layer number recorded when the target node v is first reached is the number of edges traversed by the shortest path. If node v is not visited after the search is completed, v is determined to be unreachable from the source node, and the graph distance is defined as infinity, with a corresponding field strength value of 0. In this embodiment, the graph distance calculation process further incorporates the directed edge characteristics of the metadata relationship graph. When the edges in the graph are directional, the breadth-first search only traverses along the outgoing direction of the edge, i.e., it propagates from the source node along the data flow direction or business logic direction. If the target node is located upstream or on the reverse path of the source node, it is also determined to be unreachable. Preferably, to support bidirectional propagation, the directed graph can be converted into an undirected graph for distance calculation, or both outgoing and incoming edges can be considered simultaneously. The specific choice depends on whether the semantic influence in the business scenario allows for back propagation. This calculation process is a classic algorithm implementation in graph theory, and those skilled in the art can implement its specific functions based on publicly available literature; therefore, it will not be elaborated upon here.

[0033] In this embodiment, the field diffusion propagation process employs a decay function. The source point field strength is attenuated along the distance and then assigned to the target node; the attenuation function is... It is a monotonically decreasing function defined on non-negative integers, satisfying and Specifically, it adopts an exponential decay form. ,in The attenuation coefficient controls the rate at which the field strength decreases with increasing distance, and d represents the distance metric from the source node to the target node in the graph structure; alternatively, a linear attenuation form can be used. ,in For the attenuation rate, when The field strength decays to zero. Preferably, the decay coefficient is... and The size and density of the metadata relationship graph are pre-defined; for example, for a graph containing thousands of nodes, a value of 10 ... or This causes the field strength to approach zero after propagating for 3 to 5 hops. It should be noted that node v originates from a single source point. Received field strength value Defined as: ,in Find the shortest path length. If node v is parallel to the source node... If they overlap, then .

[0034] Furthermore, for the same semantic flow channel There may be multiple source terms mapped to different nodes, and these source terms propagate field strength and channels independently. The field strength value generated at node v Defined as the sum of the field strength values ​​propagated to v from all source points in the channel: , where i represents the index identifier of different source terms within the same semantic flow channel. This summation method reflects the superposition effect of different source terms on node correlation within the same semantic dimension. For example, if two source terms, "purchase order" and "purchase contract," appear simultaneously in the object semantic unit, then the "supplier" node, which is related to both of these objects, will obtain a higher field strength value.

[0035] In some implementations, the field strength superposition labeling process accumulates the field strength values ​​generated by all semantic flow channels at node v to obtain a comprehensive field strength label for node v. The calculation formula is as follows: Where K is the total number of semantic flow channels, and k represents the index number of the semantic flow channel, used to distinguish the multiple independent semantic flow channels obtained after the semantic flow deconstruction process in step S201. This linear superposition method assumes that the contributions of each semantic channel to the node correlation are independent and additive, which meets the composite characteristics of multi-dimensional semantic requirements. Preferably, different weights can be assigned to subjects, objects, or conditions according to the semantic unit type. To reflect the relative importance of different semantic roles in audit requirements, for example, the weight of the object unit can be set to 1.0, the weight of the condition unit to 0.8, and the weight of the subject unit to 0.6. Then the overall field strength label is corrected as follows: Weighting coefficient It can be pre-set based on experience in the auditing field, or it can be learned from historical data through machine learning methods.

[0036] In this embodiment, after field diffusion propagation and field strength superposition marking processing, the metadata relationship map is obtained. Each node v in the array is assigned a real value. This value reflects the overall correlation strength between the node and the requirements described in the input audit text data. Attaching the node's field strength value as a node attribute to the original graph creates a field strength correlation graph. ,in The mapping function from nodes to field strength values. This graph not only preserves the original metadata relationship structure but also marks the semantic relevance of each node to the audit requirements, providing a quantitative basis for field strength threshold screening in subsequent steps. It should be noted that the calculation of field strength values ​​depends only on the source node of the semantic flow channel and the topology of the graph, and does not involve the values ​​of any business data. Therefore, this step purely completes the preliminary association mapping from audit requirements to data nodes at the semantic and structural levels.

[0037] Please see the appendix Figure 2 As shown, attached Figure 2This diagram illustrates the field strength propagation attenuation and multi-channel superposition effect in this embodiment. The diagram uses propagation distance as the horizontal axis and field strength value as the vertical axis to illustrate the basic mechanism of semantic flow field diffusion propagation and field strength superposition calculation in step S202. The horizontal axis represents the number of path hops traversed by the source term mapping node along the metadata relationship graph to the target node. The left vertical axis represents the field strength attenuation value of a single semantic flow channel propagating to nodes at different distances. The right vertical axis represents the comprehensive field strength value after multiple source points or multiple semantic flow channels are superimposed on the same node. As can be seen from the multiple attenuation curves in the diagram, the field strength contribution of a single source term in the graph gradually decreases with increasing propagation distance. Different attenuation curves correspond to different attenuation coefficients, reflecting the differences in the propagation range of different semantic flow channels in the graph. Furthermore, the diagram uses discrete points and their connecting lines to illustrate the superposition effect of multiple source point propagation results on the same node. That is, when multiple source points or multiple semantic flow channels act on the same node simultaneously, their field strength values ​​are accumulated through summation, thereby forming the comprehensive field strength label of the node. The field strength of a single semantic source point decreases with propagation distance in the graph, while the field strength contributions of multiple source points and multiple semantic flow channels at the same node can be superimposed to form a higher comprehensive field strength value. The resulting node field strength value characterizes the comprehensive semantic association strength between the node and the input audit requirements, providing a quantitative basis for subsequent steps such as field strength threshold selection and activation subgraph construction. It should be noted that... Figure 2 The superimposed field strength values ​​are schematically represented by connecting dots and lines, which is only used to illustrate the trend of the combined field strength changing with the propagation distance and does not limit the calculation form in the specific implementation.

[0038] S3, perform node filtering and relationship expansion processing on the field strength correlation graph and audit rule base, determine the activation node according to the field strength threshold, and expand the relationship in the metadata relationship graph based on the activation node and in combination with the audit rule base to construct activation subgraph data; Furthermore, this step includes the following sub-steps: S301, Perform field strength threshold filtering on the field strength correlation map to obtain an active node set. The field strength threshold filtering process is to traverse the nodes in the field strength correlation map according to a preset field strength threshold, and extract the nodes whose field strength marker values ​​are greater than or equal to the threshold to form an active node set reflecting the correlation elements. Furthermore, the field strength threshold screening process involves traversing the nodes in the field strength correlation graph based on a preset field strength threshold, extracting nodes whose field strength marker values ​​are greater than or equal to the threshold, and forming an active node set reflecting the correlation elements. This includes threshold setting and dynamic calibration processing, and node screening and set construction processing. The threshold setting and dynamic calibration processing determines the field strength critical value used to distinguish core correlation nodes from weak correlation nodes based on the statistical distribution characteristics of the field strength values ​​of all nodes in the field strength correlation graph. The node screening and set construction processing involves traversing the graph nodes one by one and making conditional judgments based on the critical value, extracting nodes that meet the field strength threshold conditions, and organizing them into an active node set. Each node in this set carries its original field strength marker value, which serves as the input basis for subsequent rule matching and secondary field propagation.

[0039] In some embodiments, the threshold setting and the field strength correlation spectrum generated in step S202 of the dynamic calibration process are used to obtain the field strength correlation spectrum. The set of field strength values ​​for all nodes in the middle Statistical analysis is then performed on this set to determine the distribution pattern of the electric field strength values. Specifically, the mean of the electric field strength values ​​at all nodes is calculated. and standard deviation The baseline threshold is determined based on the relationship between the mean and the standard deviation. ,in This is an adjustment coefficient used to control the stringency of the screening. Furthermore, considering that different audit business scenarios have different sensitivity requirements for correlation strength, the adjustment coefficient... It can adaptively adjust based on preset sensitivity parameters in the audit rule base. For example, for audit scenarios involving large sums of money that are concerned about abnormal fluctuations, it can be set... To raise the screening threshold, only strongly correlated nodes are retained; for compliance audit scenarios requiring comprehensive coverage, settings can be configured... This expands the range of activated nodes. Preferably, the threshold setting can also employ a quantile method, where the field strength values ​​are sorted in ascending order and the p-th percentile is taken as the threshold. For example, take This method selects nodes with field strength values ​​in the top 20% as active nodes. It is independent of the specific distribution of field strength values ​​and therefore exhibits stronger robustness. It should be noted that the final determination of the threshold is a conventional technique that can be flexibly chosen by those skilled in the art based on actual needs; it is provided here as an example only and not as a limitation.

[0040] In this embodiment, the node selection and set construction process is based on a preset field strength threshold T for the field strength correlation map. Iterate through all nodes in the array, and for each node... Compare their field strength marker values The relationship between the value of the threshold T and the value of the threshold T, if the condition is met. Then the node will be added to the set of active nodes. The formal representation of this process is as follows: Where T is the critical field strength value determined by the step threshold setting and dynamic calibration processing. Furthermore, when including a node in the set of active nodes, all attribute information of that node in the original field strength correlation graph is retained, including node type (data table node, field node, or report node), node name, business meaning description, and most importantly, the comprehensive field strength value. These attribute information are stored as key-value pairs associated with node identifiers, forming structured active node data records. Specifically, the set of active nodes can be represented as a set with attributes. ,in and These represent the node's type attribute and name attribute, respectively.

[0041] In some implementations, to improve screening efficiency and adapt to the processing requirements of large-scale metadata relationship graphs, the node screening and set construction process adopts a parallel traversal strategy. The node set of the field strength correlation graph is divided into multiple subsets, which are then distributed to different computing threads or nodes for simultaneous threshold comparison. Finally, the screening results of each subset are merged into a complete set of activated nodes. This parallel processing method is a common optimization technique in the field of big data processing, and those skilled in the art can implement its specific process based on existing technology; therefore, it will not be elaborated upon here. It should be noted that the set of activated nodes obtained after screening... It is a subset of the field strong correlation graph, which contains all core metadata entities that have strong semantic association with audit requirements. These entities will serve as the starting point for the next step of rule matching and secondary field propagation, thereby introducing audit logic rules into the parsing process.

[0042] In this embodiment, the construction of the activation node set realizes the transition from semantic association to logical association. Each node in the set not only carries the field strength value from the semantic flow channel, but more importantly, it is marked as an "activation source" in subsequent processing, that is, in step S302, secondary field propagation is performed outward according to the logical conditions in the audit rule base. Preferably, in order to facilitate rapid retrieval in subsequent processing, the activation node set is indexed and organized according to node type and business domain, for example, table node index, field node index, and report node index are constructed respectively, so that when performing rule matching in step S302, the corresponding activation node can be quickly located according to the business object type to which the rule applies. Through the above method, step S301 completes the transformation from field strength association graph to activation node set, providing the target for the intervention of audit logic rules.

[0043] S302, perform rule matching and secondary field propagation processing on the set of activated nodes and the audit rule base to obtain activated subgraph data. The rule matching and secondary field propagation processing is to match the set of activated nodes with the rule conditions in the audit rule base, and propagate the secondary field outward along its associated edge for the successfully matched node. The intensity of the secondary field decreases with the propagation distance. The newly activated nodes and paths are incorporated into the graph structure to form activated subgraph data containing multiple layers of association. Furthermore, the rule matching and secondary field propagation processing involves matching the set of active nodes with the rule conditions in the audit rule base. For successfully matched nodes, the secondary field is propagated outward along their associated edges. The intensity of the secondary field decreases with the propagation distance. The newly activated nodes and paths are incorporated into the graph structure, forming an activated subgraph data containing multiple layers of relationships. This includes rule matching triggering processing and secondary field diffusion and subgraph construction processing. The rule matching triggering processing is based on the logical conditions defined by each rule in the audit rule base. It performs condition judgment on each node in the set of active nodes, identifies all nodes that satisfy the rule antecedents, and records the matched rule identifier and the type of the associated relationship edge defined in the rule. The secondary field diffusion and subgraph construction processing uses successfully matched nodes as diffusion sources. It performs a breadth-first traversal outward along the metadata relationship graph according to the edge type specified by the rule. During the traversal, the intensity of the secondary field at each arriving node is calculated according to a preset decay function. All propagated nodes and their path edges are incorporated into the graph structure. At the same time, the secondary field values ​​received by each node from different source points are superimposed to form activated subgraph data containing node field strength markers and relationship edges.

[0044] In some implementations, the rule matching triggering process first obtains the set of active nodes generated in step S301, wherein each node v carries its type attribute. ,name and the original field strength value The audit rule base R consists of several rules, each rule... Formalize it as a triple ,in It is a logical expression defined on node type, attribute, or value, such as "node type is 'data table' and table name contains 'procurement'", which can be described using predicate logic or scripting language; It is the set of edge types associated with the rule, specifying which relational edges should be followed for secondary field propagation starting from the matching node. For example, for the "three-single matching" rule, It can include a "Purchase Order - Goods Receipt" side and a "Purchase Order - Invoice" side; This is the rule weight, used to adjust the influence of the rule's contribution when superimposing secondary fields. Specifically, for each activated node... Iterate through each rule r in the rule base R and calculate the logical expression. If the result is true, then node v is determined to match rule r, and the matching information is recorded as a triple. Store the matching result set M. It should be noted that the calculation of rule conditions falls under rule engine technology well-known to those skilled in the art, and can be implemented using forward linking reasoning or event-based condition evaluation; the specific implementation methods will not be elaborated here. Preferably, to improve matching efficiency, the rule base can be pre-indexed according to node type, so that only rules related to the node type need to be evaluated, reducing unnecessary computational overhead.

[0045] In this embodiment, the secondary field diffusion and subgraph construction process is based on each record in the matching result set M. With node v as the diffusion source, in the metadata relationship graph upper edge The specified edge type is traversed breadth-first, with the propagation depth limited to a preset maximum number of layers L (e.g., L=3). This limit controls the spread of the secondary field, preventing infinite spread that could lead to an excessively large subgraph. For a path starting from the source vertex v and traversing l hops... Any node reached Calculate the secondary field contribution value generated at node u during this propagation. Its calculation uses an exponential decay form: Where l represents the number of edges traversed in the shortest path from source node v to target node u in the metadata relationship graph, i.e., the propagation hop count. When l=1, it represents a direct neighbor node, and when l=2, it represents a node one hop away. The preset attenuation factor controls the rate at which the secondary field strength decays with increasing distance; These are the rule weights, used to reflect the differences in importance of different rules within the audit logic; This represents the original field strength value of the source point v. If the same node u is reached by multiple source points (possibly from different rules or different source points of the same rule), then the total secondary field strength of node u is obtained by summing all the secondary field contributions received. : ,in This represents the sum of secondary field contributions received by node u from all matching rules and the source node. (v,r) is an element in the matching result set M, specifically referring to a successfully matched node v and its matched rule r. Node v belongs to the set of active nodes obtained in step S301, and rule r belongs to the audit rule base R and satisfies the rule conditions. True. The condition "u is reachable from v via r" is only true if node u can start from the source node v and follow the set of edge types specified by rule r. The contribution value generated by this propagation when reached after a finite number of traversals in the metadata relation graph G. Only then are they included in the summation term. This accumulation method reflects the combined reinforcing effect of multiple audit logic rules on the same data node. Furthermore, during the traversal process, each time a node u is reached, the path edges traversed from the source node v to u are recorded, and these edges will be included in the final activation subgraph.

[0046] In some implementations, after the above diffusion and superposition, all nodes that are propagated (i.e., The nodes constitute the set of secondary nodes. The set of nodes in its activated subgraph data. Defined as the union of the original active node and its secondary nodes: Edge set Includes all two endpoints. Furthermore, the edges existing in the metadata relation graph G also include the path edges actually traversed during this propagation process, ensuring the connectivity of the subgraph structure. Each node Field strength marking Defined as the superposition of the primary field strength and the secondary field strength: ,in This indicates that node v is in the activated subgraph. The field strength marker value in the data comprehensively reflects the semantic association strength between the node and the original audit requirements, as well as the logical association strength derived from the audit rules. This refers to nodes that belong only to the set of active nodes but not to the set of secondary nodes; that is, nodes with strong semantic associations but not propagated to by any rules. This refers to nodes that belong only to the set of secondary nodes but not to the set of active nodes; that is, nodes that do not have strong semantic connections but are introduced due to audit rule logic. This definition ensures that the field strength of each node comprehensively reflects the combined effect of semantic connections (original field strength) and logical connections (secondary field strength). Preferably, in practical implementation, to simplify processing, a unified superposition formula can be directly applied to all nodes. ,in This is an indicator function that adds a pointer if v belongs to the original active node. Otherwise, don't add it. But considering... Nodes in the field may also be propagated to by secondary fields, at which point... This approach better reflects the superposition effect of multiple associations, so a superposition method is adopted in this embodiment.

[0047] In this embodiment, the activation subgraph data can be formally represented as a weighted graph. ,in This expression defines the mapping relationship between nodes and field strength values ​​in the activation subgraph data, where... Represents the set of nodes The function to the real number set R assigns a real value to each node as its comprehensive field strength label. This subgraph includes both core nodes directly semantically related to audit requirements (original active nodes) and indirectly related nodes derived from audit rule logic (secondary nodes), with the edges between nodes retaining the original business relationship structure. In this way, domain knowledge from the audit rule base is successfully introduced, expanding the field strength graph, which was originally based solely on semantic associations, into a relational network integrating audit logic. This provides a more comprehensive data foundation for subsequent structured reconstruction based on business-level templates. It should be noted that the depth L of secondary field propagation and the attenuation factor... The value of L can be set according to the typical length of the logical chain in the actual audit scenario. For example, for anomaly detection involving multiple business links, the value of L can be increased appropriately. However, it is necessary to balance the computational overhead with the size of the subgraph. This parameter adjustment is a conventional design choice for those skilled in the art.

[0048] Please see the appendix Figure 3 As shown, attached Figure 3 This diagram illustrates the field strength threshold triggering and secondary field propagation effect in this embodiment. The diagram uses the node sequence as the horizontal axis and the node field strength value and secondary field propagation intensity as the vertical axis to represent the relationship between field strength threshold screening and rule triggering propagation in steps S301 and S302. The horizontal axis represents the node position sequence sorted from highest to lowest original field strength value; the left vertical axis represents the original field strength value of the node; and the right vertical axis represents the secondary field propagation intensity triggered by the node after rule matching. The original field strength distribution curve shown in the diagram generally shows a downward trend, reflecting the distribution of association strength obtained by different nodes after semantic diffusion propagation. Simultaneously, a field strength threshold line parallel to the horizontal axis is set in the diagram to represent the field strength screening condition in step S301. Nodes exceeding this threshold line are identified as active nodes and enter the rule matching processing stage.

[0049] Furthermore, attached Figure 3The secondary field trigger intensity curve in step S302 is used to illustrate the propagation effect of rule matching and secondary field propagation. Above the field strength threshold line, i.e., within the active node region, some nodes trigger secondary field propagation after meeting the audit rule conditions, thus forming a high secondary field intensity value at the corresponding position. Below the threshold line, nodes that fail the threshold screening typically do not participate in rule trigger propagation, and their secondary field intensity is close to zero. It should be noted that the peak position of the secondary field trigger intensity is not necessarily consistent with the peak position of the original field strength. This indicates that some nodes with moderate original field strength may still generate high secondary field propagation intensity when matching multiple high-weight rules, thus reflecting the superposition effect between semantic association and rule logical association. Therefore, active nodes with high semantic association are identified through field strength threshold screening. Then, using these nodes as propagation sources, secondary field diffusion is triggered along specified relation edges according to the rule conditions in the audit rule base, and the nodes and paths involved in the propagation process are incorporated into the graph structure, thus forming an activated subgraph containing multiple layers of association relationships. (Appendix) Figure 3 The trend of the secondary field propagation intensity is only illustrative and is used to help understand the quantitative mechanism of rule matching triggering and secondary field propagation, without limiting the numerical form in the specific implementation.

[0050] S4, perform structural reconstruction processing on the activated subgraph data and the business level template to construct a tree-shaped parsing structure according to the node hierarchical membership relationship defined by the business level template, and perform pruning processing on the tree-shaped parsing structure based on the node field strength to generate a pruned parsing tree; Furthermore, this step includes the following sub-steps: S401, the activated subgraph data and the business layer template are subjected to structural anchoring combination processing to obtain an initial tree with anchoring weights. The structural anchoring combination processing is to traverse the nodes in the activated subgraph data, and based on the three-level membership relationship of business domain, data table and field defined in the business layer template, attach each node to the corresponding layer position. At the same time, the anchoring strength between nodes in the same layer is determined according to the weight of the original association edge between nodes in the activated subgraph data, and the anchoring strength is marked as the structural weight of the node in the tree. Furthermore, the structural anchoring combination process involves traversing the nodes in the activated subgraph data. Based on the three-level membership relationships (business domain, data table, and field) defined in the business hierarchy template, each node is attached to its corresponding hierarchical position. Simultaneously, the anchoring strength between nodes at the same level is determined based on the weights of the original association edges between nodes in the activated subgraph data. This anchoring strength is then used as the structural weight of the node in the tree for marking. This process includes node attachment and tree construction, as well as anchoring strength calculation and marking. The node attachment and tree construction process maps each node in the activated subgraph data to its corresponding position in a three-level tree structure composed of business domain nodes, data table nodes, and field nodes, according to the predefined hierarchical membership relationships in the business hierarchy template. This transforms the original graph structure without hierarchical relationships into a tree structure with clear parent-child membership relationships. The anchoring strength calculation and marking process calculates the mutual affinity between all nodes at the same level in the tree structure based on the original association edges and their weights between nodes in the activated subgraph data. This affinity measure is then quantified as a structural weight and attached to each node, forming an initial tree with anchoring weights.

[0051] In some implementations, the node mounting and tree construction process first obtains the activation subgraph data generated in step S302, wherein the node set It includes business domain nodes, data table nodes, field nodes, and possible report nodes, with field strength markers attached to the nodes. Business hierarchy template It is a predefined tree structure, a set of nodes. Includes business domain nodes, data table nodes, and field nodes, edge sets. To show the parent-child relationship, for example This indicates that the data table belongs to this business domain. This indicates that the field belongs to this data table. Specifically, for each node... Based on its node type and identifier, the system searches for its parent node and path in the business hierarchy template H. If the node type is a field node, its parent node should be a specific data table node; if the node type is a data table node, its parent node should be a specific business domain node; if the node type is a business domain node, it is the root node and does not require a parent node. After traversal, all nodes in the active subgraph are organized into one or more trees rooted at business domain nodes according to the search results. The parent-child edges in the trees are defined by the membership relationships in the template, while retaining the original field strength labels of the nodes. It should be noted that if a node cannot find a corresponding membership in the template, the node is considered an isolated node and will not participate in the subsequent tree structure construction. However, this situation rarely occurs in the construction of a complete audit metadata system and is a boundary case that can be foreseen by those skilled in the art. It can be handled by predefined default mounting rules, such as temporarily mounting the unmountable node to a virtual root node, which will not be elaborated here.

[0052] In this embodiment, the tree structure obtained after node mounting It can be formally represented as , where the node set The set of nodes and edge sets that have been successfully mounted. For the father-son relationship, The field strength value reserved for each node. This tree structure may contain multiple root nodes (i.e., multiple business domains), forming a forest. For ease of subsequent processing, preferably, a virtual root node is introduced. All business domain nodes are treated as its child nodes, thus transforming the forest into a tree with a virtual root node as its root. The field strength value of the virtual root node is set to 0 or the maximum value of the field strength of all child nodes. The specific value does not affect the pruning operation.

[0053] In some implementations, the anchoring strength calculation and marking process are based on the original associated edge weights between nodes in the activated subgraph data, which is a tree Each node in the tree calculates its anchoring strength, which reflects the tightness of the business logic association between the node and its sibling nodes at the same level. Specifically, for the tree... For any node v in the array, define the set of its sibling nodes. ,in represents the set of nodes at the same tree level as node v; u is the traversal tree. Any node when all nodes are in the set; It is a tree The set of nodes, namely the set of active subgraph nodes that have been successfully mounted to the business-level template; Indicates that node u is in the tree The depth values ​​in the tree are used; for example, the root node has a depth of 0, its child nodes have a depth of 1, and so on; that is, all nodes with the same tree depth as v. This is derived from the activation subgraph data. Extract node set Induced subgraph The edges in this subgraph Each edge is assigned an original weight. This weight is defined during the construction of the metadata relationship graph, such as the strength of data flow or the tightness of business logic relationships. The anchoring strength of node v. The anchoring strength of a node is defined as the sum of the weights of all edges connected to it at the same level. In other words, the anchoring strength of a node is equal to the sum of the weights of all edges connecting it to other nodes at the same level. If node v has no edges connected to it at the same level, then... This definition reflects the importance of a node's local connectivity within its layer. Higher anchoring strength indicates a closer business logic relationship between the node and its peers, and thus a higher tendency to be retained during subsequent pruning.

[0054] Furthermore, considering that the importance of different sides may vary depending on the audit scenario, a weighted summation method can be used, i.e. ,in This is an adjustment coefficient for the edge type, which can be preset based on empirical values ​​in the audit rule base. Preferably, to facilitate the combined application of anchoring strength and field strength values ​​in subsequent processing, the anchoring strength can be normalized, for example, by dividing it by the maximum value of the anchoring strength of all nodes in the same layer, so that its value is within the range of [0,1].

[0055] In this embodiment, after anchoring strength calculation and marking processing, the initial tree Each node v in the data is given an additional attribute. This forms an initial tree with anchored weights. ,in For the nodal field strength, The tree structure retains the semantic association strength (field strength) of nodes in the activation subgraph while incorporating the local structural importance (anchoring strength) based on business logic relationships. This provides a dual basis for subsequent field strength-based hierarchical pruning, enabling the pruning process to consider both the importance of a node itself and the closeness of its business association with sibling nodes at the same level, thus generating a parse tree that is more focused on audit requirements. It should be noted that the anchoring strength calculation between nodes at the same level relies only on the original association edges already existing in the activation subgraph, without introducing additional external data, ensuring the consistency and reproducibility of the processing.

[0056] S402, the initial tree with anchor weights is subjected to field strength hierarchical pruning to obtain a pruned parse tree. The field strength hierarchical pruning process is to calculate the mean and variance of the field strength of each level node in the initial tree, determine the adaptive pruning baseline of each level based on the variance of ... Furthermore, the field strength hierarchical pruning process involves calculating the mean and variance of the field strength of nodes at each level in the initial tree, determining the adaptive pruning baseline for each level based on the variance, removing nodes with field strength values ​​lower than the adaptive pruning baseline and their subordinate child nodes, retaining nodes with field strength values ​​higher than or equal to the adaptive pruning baseline, and reorganizing the retained nodes according to their original hierarchical affiliation into a pruning parse tree process, including adaptive determination of pruning baseline and recursive pruning and tree reconstruction.

[0057] The adaptive determination process of the pruning baseline involves calculating the statistical characteristics of the field strength values ​​of all nodes at each level in the initial tree with anchored weights, and then dynamically generating a unique pruning threshold for that level based on the degree of dispersion within the level. The recursive pruning and tree reconstruction process involves traversing the initial tree layer by layer starting from the root node. For nodes at each level that do not meet the pruning baseline conditions, the node and all its descendant nodes are removed from the tree structure. Finally, the remaining nodes are reorganized into a new tree structure according to the original parent-child connection relationship.

[0058] In some implementations, the adaptive determination of the pruning baseline takes an initial tree with anchored weights as input, where each node carries a field strength value. The tree is divided into different levels according to depth: the level of the root node is defined as zero, the level of business domain nodes is defined as one, the level of data table nodes is defined as two, the level of field nodes is defined as three, and so on, forming a multi-layered structure. For each level, the mean of the field strength values ​​of all nodes in that level is calculated, and the variance of the distribution of the field strength values ​​of all nodes in that level relative to the mean is also calculated.

[0059] Furthermore, an adaptive pruning baseline is determined based on the distribution variance of this layer and the mean field strength. The principle for setting this baseline is to retain nodes with field strength values ​​significantly higher than the average level within the layer, while removing nodes with relatively low field strength values. Preferably, the baseline is defined using a linear combination of the mean and variance, specifically by multiplying the mean and variance by a sensitivity coefficient and then summing the results. The sensitivity coefficient controls the strictness of the pruning. A larger sensitivity coefficient results in a higher pruning baseline, thus retaining fewer nodes; a smaller sensitivity coefficient results in a lower pruning baseline, thus retaining more nodes.

[0060] It should be noted that the sensitivity coefficient can be preset based on the audit scenario. For example, a larger sensitivity coefficient can be set for key audit scenarios that require high accuracy, while a smaller sensitivity coefficient can be set for general survey scenarios that require comprehensive coverage. This coefficient is a parameter that can be adjusted by those skilled in the art based on experience.

[0061] In another implementation, to avoid extreme values ​​having a significant impact on the mean, a pruning baseline can be constructed using the median and interquartile range. This method is more robust to outliers. Preferably, this embodiment uses the first combination of mean and variance because it is simple to calculate and consistent with the field strength perturbation calculation logic in subsequent steps.

[0062] In this embodiment, the recursive pruning and tree reconstruction process prunes the initial tree based on the adaptive pruning baselines determined at each level. The pruning process employs a depth-first traversal strategy, starting from the root node. For the currently visited node, the pruning baseline corresponding to the level where the node is located is obtained, and it is determined whether the field strength value of the node satisfies the condition of being greater than or equal to the pruning baseline of that level. If the condition is met, the node is retained, and all its child nodes are recursively traversed in depth-first order to continue the same judgment; if the condition is not met, the node and its entire subtree, i.e., the node and all its descendant nodes, are removed from the tree structure at once, and its child nodes are no longer traversed.

[0063] This recursive process ensures that once a node is determined to be below the baseline, all its child nodes, regardless of their own field strength, are removed. This aligns with the top-down filtering logic in audit requirements, meaning that if a business domain or data table as a whole has a weak correlation with the requirements, its subordinate fields, regardless of their strength, do not need to be considered separately.

[0064] After a complete recursive traversal, all nodes that meet the conditions form a set of retained nodes. The parent-child relationship between nodes is inherited from the initial tree, but only connecting edges where both ends are located in the set of retained nodes are retained, thus forming a new edge set. The pruned parse tree is composed of the set of retained nodes and the set of retained edges, and the field strength and anchoring strength properties of the retained nodes remain unchanged.

[0065] If the root node is removed, the pruned parse tree may be empty. This means that the auditing requirements cannot be mapped to any valid data structure, and a corresponding warning message can be returned. This situation falls under system boundary handling, and those skilled in the art can design corresponding exception handling logic based on actual needs.

[0066] Furthermore, after pruning, the number of nodes at each level can be counted. If the number of nodes retained at a certain level is zero, then its parent node may become a leaf node, which is allowed in a tree structure and does not affect subsequent processing.

[0067] In this embodiment, through the aforementioned field strength hierarchical pruning process, the initial tree, which originally contained a large number of redundant nodes, is simplified to retain only the core nodes and their paths highly relevant to audit requirements, forming a focused pruned parse tree. This tree retains the structured position of nodes in the business-level template while removing low-contribution branches through pruning, allowing subsequent steps to focus on calculating the perturbation coefficients of key nodes, thereby improving the relevance and efficiency of audit requirement analysis. It should be noted that the adaptive nature of the pruning baseline allows this method to adapt to initial trees of different sizes and field strength distributions without requiring manual setting of fixed thresholds, thus enhancing the method's versatility and robustness.

[0068] S5, perform perturbation mapping and hierarchical aggregation processing on the pruned parse tree and business benchmark data, calculate the node perturbation coefficient based on the business indicator value and business benchmark data corresponding to the node, perform weight mapping in combination with the node field strength, and perform hierarchical aggregation on the perturbation coefficient according to the tree structure to generate an audit requirement perturbation map. Furthermore, this step includes the following sub-steps: S501, the field strength benchmark deviation calculation process is performed on the pruned parse tree and the business benchmark data to obtain a parse tree with perturbation labels. The field strength benchmark deviation calculation process is to traverse the nodes in the pruned parse tree, extract the metadata field corresponding to each node, generate the corresponding index calculation logic according to the metadata relationship graph and obtain the index value from the business data, find the benchmark threshold range of the field in the business benchmark data, calculate the degree of deviation between the index value and the benchmark threshold range, and perform weighted calculation in combination with the node field strength value to quantify the degree of deviation into a perturbation coefficient, and assign the perturbation coefficient as an additional label to the node. Furthermore, the field strength benchmark deviation calculation process involves traversing and pruning the nodes in the parse tree, extracting the metadata fields corresponding to each node, generating corresponding index calculation logic based on the metadata relationship graph, obtaining index values ​​from business data, searching for the benchmark threshold range of the field in the business benchmark data, calculating the degree of deviation between the index value and the benchmark threshold range, and performing a weighted calculation based on the node's field strength value. The degree of deviation is quantified into a perturbation coefficient, and this perturbation coefficient is assigned as an additional marker to the node. This process includes index value acquisition and deviation calculation, as well as field strength weighting and perturbation coefficient generation. The calculation process involves extracting the actual indicator value of each node in the pruned parse tree from the business database during the audit period, based on the field definition and data source information associated with it in the metadata relationship graph. At the same time, it retrieves the benchmark threshold range corresponding to the field from the business benchmark data, and then calculates the deviation between the actual indicator value and the benchmark range. The field strength weighting and perturbation coefficient generation process is to weight and fuse the calculated deviation with the field strength value carried by the node in the pruned parse tree to generate a perturbation coefficient that comprehensively reflects the semantic association strength and the degree of actual data anomaly. This coefficient is then added to the node as a new attribute label.

[0069] In some implementations, the acquisition of indicator values ​​and the calculation of deviations are processed using a pruned parse tree as input. Each node corresponds to a metadata entity, which records information such as its field type, the data table it belongs to, and the data storage location in the metadata relationship graph. Specifically, for each node, a corresponding structured query statement or calculation expression is first generated based on the field identifier associated with it in the metadata relationship graph. This statement extracts the aggregated value or specific value of the field from the business database based on parameters such as the time range and business scope of the audit period, and records it as the actual indicator value. For example, if the node is the "purchase order amount" field, the indicator value can be the sum, average, or amount of all purchase order amounts during the audit period, or the amount of a specific transaction. The specific aggregation method is determined by the node type and the implicit measurement requirements of the audit needs. This generation process can be implemented based on the indicator calculation template predefined in the metadata relationship graph, which is a data query technique that can be conventionally implemented by those skilled in the art, and will not be elaborated here. Further, the benchmark threshold range corresponding to the node is found from the business benchmark data obtained in step S1. This range is represented as the lower threshold and the upper threshold. If there is no corresponding record for the node in the benchmark data, its benchmark range is set to unbounded or a default value is used, indicating no benchmark constraint. Subsequently, the deviation of the actual indicator value from the benchmark range is calculated. This deviation quantifies the magnitude of the actual data deviating from the normal fluctuation range. Preferably, the deviation is defined in a segmented manner: when the actual indicator value falls within the benchmark range, the deviation is zero; when the actual indicator value is lower than the lower threshold and the lower threshold is greater than zero, the deviation is calculated by dividing the difference between the lower threshold and the actual indicator value by the lower threshold; when the actual indicator value is higher than the upper threshold and the upper threshold is greater than zero, the deviation is calculated by dividing the difference between the actual indicator value and the upper threshold by the upper threshold. For cases where the benchmark boundary is zero or negative, absolute difference or other standardized forms can be used for processing. The specific implementation can be adjusted according to the characteristics of the business data. Those skilled in the art can design appropriate deviation measures according to actual needs. This is only an example.

[0070] In this embodiment, the field strength weighting and perturbation coefficient generation process weights and fuses the deviation degree of a node with its field strength value carried in the pruned parse tree to generate a perturbation coefficient. This fusion process reflects the combined effect of audit requirement relevance and actual data anomaly degree; that is, even if a node has a high field strength, if its actual data is within the normal range, the perturbation coefficient should be relatively low; conversely, even if a node has a medium field strength, if its data deviates significantly from the benchmark, it may generate a high perturbation coefficient. Preferably, a multiplicative form is used for fusion, that is, the perturbation coefficient equals the node field strength value multiplied by the deviation degree. This formula ensures that when the deviation degree is zero, the perturbation coefficient equals the field strength value, indicating that when there is no data anomaly, the perturbation only comes from semantic association; when the deviation degree is greater than zero, the perturbation coefficient is amplified on the basis of the field strength, and the amplification factor is positively correlated with the deviation degree. In another embodiment, a weighted sum form can be used, but the multiplicative form is more in line with the intuitive semantics of anomaly amplification and does not require the introduction of additional weight parameters, so this embodiment uses the multiplicative form. It should be noted that, in order to ensure that the numerical range of the perturbation coefficient is controllable, the degree of deviation can be truncated or normalized to prevent individual extreme outliers from causing the perturbation coefficient to be too large and dominating the subsequent aggregation results.

[0071] Furthermore, the calculated perturbation coefficients are assigned as additional attribute labels to the nodes, thus forming a parse tree with perturbation labels. This tree retains the original hierarchical structure, field strength values, and anchoring strength, and adds the perturbation coefficient attribute, providing a quantitative basis for subsequent steps of aggregation and graph construction based on perturbation values.

[0072] In this embodiment, through field strength benchmark deviation calculation processing, each node in the pruned parse tree is assigned a perturbation coefficient that comprehensively reflects semantic relevance and data anomaly. This coefficient allows the originally semantically based parsing results to further integrate the actual operational status of business data, thereby deepening the audit requirement analysis from which data is relevant to the requirements to which relevant data may have anomalies. This lays a crucial foundation for ultimately generating an audit requirement perturbation map focusing on anomalies. It should be noted that the acquisition of actual indicator values ​​depends on real-time or offline queries to the business database. This query process must ensure that the time range of the data is consistent with the time conditions implicit in the audit requirements. For example, if the conditional semantic unit in step S201 contains information for a specific year, the query should be limited to the data range of that year. The transmission and binding of this time constraint is a conventional design that can be implemented by those skilled in the art in combination with the context, and will not be elaborated here.

[0073] S502, the perturbation maximum value aggregation and graph construction process is performed on the perturbation maximum value aggregation of the perturbation maximum value aggregation and graph construction process to obtain the audit requirement perturbation graph. The perturbation maximum value aggregation and graph construction process is based on the hierarchical structure of the perturbation maximum value aggregation ...

[0074] Furthermore, the perturbation maximum value aggregation and graph construction process is based on the hierarchical structure of a parse tree with perturbation labels. Following a bottom-up order, the perturbation coefficient of each parent node is determined to be the maximum value among the perturbation coefficients of all its direct child nodes, forming the aggregated perturbation value of each level node. The node paths and aggregated perturbation values ​​are organized into a graph-based audit requirement indication data, including perturbation maximum value aggregation processing and aggregated graph construction processing. The perturbation maximum value aggregation processing recursively calculates from the leaf nodes upwards. For each node in the tree, its aggregated perturbation value is defined as the maximum value among the aggregated perturbation values ​​of all its direct child nodes, so that the aggregated value of each node reflects the degree of anomaly of the descendant node with the strongest perturbation in the subtree rooted at that node. The aggregated graph construction processing associates each node in the aggregated tree structure and its path information from the root node to that node with the corresponding aggregated perturbation value, organizing them in the form of a graph data structure to generate an indicative graph that can intuitively display the key areas of audit requirements.

[0075] In some implementations, the perturbation maximum aggregation process uses the perturbation-tagged parse tree generated in step S501. For input, where This represents the set of nodes retained after the field strength layering pruning process in step S402. These nodes cover business domains, data tables, and fields that are highly relevant to audit requirements. To preserve the set of parent-child relationship edges between nodes, the hierarchy is derived from the membership relationships defined in the business level template; It is the field strength value of the node, which is calculated by semantic flow diffusion and rule propagation in steps S202 and S302, and reflects the comprehensive semantic association strength between the node and the audit requirements; The anchoring strength of a node is obtained in step S401 based on the normalization of the original associated edge weights between nodes at the same level, characterizing the local importance of the node in the same-level business structure; P is the perturbation coefficient of the node, obtained in step S501 by comparing the deviation of the actual business indicator value from the benchmark threshold range with the field strength value. Weighted fusion generation quantifies the degree of data anomalies of nodes under the premise of semantic relevance. In this step, Let be the perturbation coefficient for node v. This coefficient comprehensively reflects the semantic association strength between the node and the audit requirements, as well as the degree of actual data anomalies. The aggregation process adopts a post-order traversal strategy, that is, processing child nodes before processing parent nodes. For a leaf node v in the tree (i.e., a node without child nodes), its aggregation perturbation value is... It is directly defined as its own perturbation coefficient. For an internal node v, let its set of direct children be . Then the aggregate perturbation value of v Defined as the maximum value of the aggregated perturbation values ​​of all direct child nodes, its calculation formula is as follows: v represents a parse tree with perturbation tags. Any node in the list; This indicates taking the maximum value among the aggregated perturbation values ​​of all direct child nodes of node v. The aggregate perturbation value of child node u; The disturbance coefficient calculated for node v in step S501 comprehensively reflects the semantic association strength between the node and the audit requirements, as well as the deviation of its actual business indicator value from the benchmark threshold. Defined as the aggregated perturbation value of node v, this value reflects the maximum perturbation coefficient of all nodes in the subtree rooted at node v. This recursive definition ensures that the aggregated perturbation value propagates from bottom to top along the tree structure, making the aggregated value of each node essentially represent the maximum perturbation coefficient of all nodes in the subtree rooted at it. Specifically, the aggregated value of a business domain node depends on the maximum perturbation value among all its subordinate data table nodes, the aggregated value of a data table node depends on the maximum perturbation value among all its subordinate field nodes, and the aggregated value of a field node is its own perturbation value. This aggregation method aligns with the "from macro to micro" focus logic in auditing, meaning that the degree of anomaly in a high-level business domain is determined by the most anomalous specific field within it, effectively highlighting audit priorities.

[0076] In this embodiment, after calculating the aggregated perturbation values ​​for all nodes, the aggregated graph construction process organizes the node and its path information along with the aggregated values ​​into audit requirement indication data in graph form. Specifically, for each node... Generate a path sequence from the root node (virtual root node or business domain root node) to node v. This path consists of the names or identifiers of the nodes along the route in hierarchical order, such as "Supply Chain Domain - Procurement Management - Purchase Order Table - Order Amount Field". Then, node v and its path are... and aggregated perturbation value Associative storage, forming a form like The key-value pairs or graph node attributes. For easier visualization or analysis later, all nodes, their paths, and aggregate values ​​can be integrated into a graph structure with attributes, denoted as the Audit Requirement Perturbation Graph. ,in This is a mapping from nodes to aggregate perturbation values. The graph retains the original tree-like hierarchical relationships, while each node is associated with an aggregate perturbation value, enabling auditors to quickly locate highlighted areas (nodes with high aggregate values ​​and their paths), thereby clarifying the scope of core suspicious points targeted by the audit requirements.

[0077] Furthermore, to enhance the interpretability of the graph, the aggregated perturbation values ​​can be visualized, for example, by using color gradients or node size to represent perturbation intensity, making highly perturbated nodes more visually prominent. Preferably, only nodes with aggregated perturbation values ​​greater than zero or exceeding a preset display threshold are retained in the output to further simplify the information. However, this optimization falls under the application-layer display scope and does not affect the core processing logic of this step. It should be noted that the aggregation of maximum perturbation values ​​and the graph construction process do not change the tree structure; they only append aggregated perturbation values ​​to the nodes. Therefore, the processing has linear time complexity and can be efficiently applied to large-scale audit metadata scenarios.

[0078] In this embodiment, through perturbation maximum value aggregation and graph construction, perturbation coefficients originally scattered in leaf nodes are effectively aggregated to upper-level nodes, forming a hierarchical anomaly indication from business domain to specific fields. The output audit requirement perturbation graph, in an intuitive path-aggregate value format, fully presents the mapping results and anomaly focal points of audit requirements at the metadata level, providing auditors with a basis that can be directly used for data analysis task planning. This graph includes both the semantic source of the requirement (reflected through node paths) and the degree of anomaly in the actual business data (reflected through aggregated perturbation values), achieving the ultimate goal of audit requirement parsing. For example, suppose the audit request is "to examine large and unusual purchase orders in 2023." After the aforementioned steps, the resulting audit request perturbation graph shows that the aggregate perturbation value of the "Purchasing Business Domain" node is 0.85, its child node "Purchasing Order Table" has an aggregate perturbation value of 0.85, and the aggregate perturbation value of the "Order Amount Field" child node of the "Purchasing Order Table" is 0.85 (i.e., the perturbation coefficient of this field itself). Meanwhile, the aggregate perturbation value of the "Supplier Table" node is only 0.12. This graph clearly shows auditors that the core focus of the audit request is on the "Order Amount Field" in the "Purchasing Order Table," and that this field exhibits significant data anomalies (high perturbation value). While supplier-related data is related to the purchasing business, its degree of anomaly is low, and it can be disregarded. Based on this, auditors can directly plan the data analysis task as follows: for the purchase order amount field in 2023, query large order records that exceed the benchmark threshold range (such as the industry average fluctuation range), and conduct extended verification by combining order details, contracts and other related data, thereby realizing the accurate transformation from vague textual requirements to specific and executable data analysis solutions.

[0079] Please see the appendix Figure 4 , attached Figure 4 This diagram illustrates the logic for aggregated disturbance values ​​and audit requirements in this embodiment. The diagram uses a top-down tree structure to illustrate the basic process of aggregated disturbance values ​​and graph construction in step S502. The top layer represents business domain nodes, the middle layer represents data table nodes, and the bottom layer represents field nodes. The hierarchical connections between nodes represent the membership structure between business domains, data tables, and fields. Different nodes in the diagram are represented by different shades of gray to indicate the relative magnitude of their aggregated disturbance values; darker gray indicates a higher aggregated disturbance value, thus highlighting nodes with higher anomalies.

[0080] In this illustrated structure, field nodes act as leaf nodes, and their grayscale directly corresponds to the node perturbation coefficient calculated in step S501; the grayscale of a data table node is determined by the maximum grayscale among all its direct child field nodes; and the grayscale of a business domain node is determined by the maximum grayscale among all its data table nodes. Through this bottom-up maximum value propagation method, the aggregated perturbation value of each node reflects the descendant node with the highest perturbation level in the subtree rooted at that node, thus achieving hierarchical aggregation of abnormal information. Furthermore, [the following is an appendix...] Figure 4 The bolded connection path highlights the complete path extending upwards from the high-perturbation field node to the data table node and then to the business domain node, illustrating the focusing process of audit requirements within the metadata hierarchy. This path indicates that the node with the highest perturbation among multiple field nodes will dominate the aggregated perturbation value of the upper-level nodes, thus forming an anomaly indication path in the tree structure that propagates from micro-fields to macro-business domains. Therefore, by aggregating the maximum values ​​from the bottom up, the perturbation coefficients scattered in the leaf nodes are gradually converged to the upper-level nodes, generating an audit requirement perturbation map with aggregated perturbation values ​​while maintaining the original hierarchical structure. This map can intuitively reflect the anomaly focus position of audit requirements in the business domain—data table—field hierarchy, thus providing a clear basis for the planning and execution of subsequent audit analysis tasks.

[0081] Based on the description of the above embodiments of the audit data analysis requirement parsing method based on metadata relationship graphs, this application also discloses an audit data analysis requirement parsing system based on metadata relationship graphs. This system can be a computer program (including program code) that runs the aforementioned audit data analysis requirement parsing method based on metadata relationship graphs. Please see the appendix. Figure 5 As shown, the audit data analysis requirement parsing system based on metadata relationship graphs can run the following units: The acquisition unit 110 is used to acquire data to be processed, which includes audit text data, metadata relationship graph, audit rule base, business level template, and business benchmark data; the metadata relationship graph is a graph structure data constructed with data tables, fields, and reports in the audit domain as nodes and data flow and business logic relationships as edges; the audit rule base is a collection of predefined audit logic judgment conditions and anomaly detection modes; the business level template is a predefined structure data describing the hierarchical relationship between various metadata entities in the audit domain. The semantic propagation unit 120 is used to perform semantic flow parsing and graph propagation processing on the audit text data and metadata relationship graph, parsing the audit text into semantic flow information and mapping it to relevant nodes in the metadata relationship graph, and calculating the node association strength through relationship propagation, thereby generating a field strength association graph; The activation extension unit 130 is used to perform node filtering and relationship extension processing on the field strength correlation graph and the audit rule base, determine the activation node according to the field strength threshold, and perform relationship extension on the metadata relationship graph based on the activation node and in combination with the audit rule base to construct activation subgraph data; The pruning and reconstruction unit 140 is used to perform structural reconstruction processing on the activated subgraph data and the business level template, so as to construct a tree-shaped parsing structure according to the node hierarchical membership relationship defined by the business level template, and perform pruning processing on the tree-shaped parsing structure based on the node field strength, thereby generating a pruned parsing tree. The perturbation aggregation unit 150 is used to perform perturbation mapping and hierarchical aggregation processing on the pruned parse tree and business benchmark data. It calculates the node perturbation coefficient based on the business indicator value corresponding to the node and the business benchmark data, and performs weight mapping in combination with the node field strength. It then performs hierarchical aggregation on the perturbation coefficient according to the tree structure to generate an audit requirement perturbation map.

[0082] The above description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the concept described herein through the above teachings or related technologies or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A method for parsing audit data analysis requirements based on metadata relationship graphs, characterized in that, The method includes the following steps: S1, Obtain the data to be processed, which includes audit text data, metadata relationship graph, audit rule base, business level template, and business benchmark data; the metadata relationship graph is a graph structure data constructed with data tables, fields, and reports in the audit domain as nodes and data flow and business logic relationships as edges; the audit rule base is a collection of predefined audit logic judgment conditions and anomaly detection modes; the business level template is predefined structure data describing the hierarchical relationship between various metadata entities in the audit domain; S2, perform semantic flow parsing and graph propagation processing on the audit text data and metadata relationship graph. The semantic flow parsing and graph propagation processing is to parse the audit text into semantic flow information and map it to relevant nodes in the metadata relationship graph, and calculate the node association strength through relationship propagation, thereby generating a field strength association graph. S3, perform node filtering and relationship expansion processing on the field strength correlation graph and audit rule base. The node filtering and relationship expansion processing is to determine the active node based on the field strength threshold, and construct the active subgraph data by expanding the relationship in the metadata relationship graph based on the active node and in combination with the audit rule base. S4, perform structural reconstruction processing on the activated subgraph data and the business level template. The structural reconstruction processing is to construct a tree-shaped parsing structure based on the node hierarchical membership relationship defined by the business level template, and to prune the tree-shaped parsing structure based on the node field strength to generate a pruned parsing tree. S5, perform perturbation mapping and hierarchical aggregation processing on the pruned parse tree and business benchmark data. The perturbation mapping and hierarchical aggregation processing calculates the node perturbation coefficient based on the business indicator value and business benchmark data corresponding to the node, performs weight mapping in combination with the node field strength, and performs hierarchical aggregation on the perturbation coefficient according to the tree structure to generate an audit requirement perturbation map.

2. The audit data analysis requirement parsing method based on metadata relationship graphs according to claim 1, characterized in that, Step S2 includes the following sub-steps: S201, the audit text data is subjected to semantic flow deconstruction processing to obtain multiple semantic flow channels. The semantic flow deconstruction processing is based on dependency parsing and semantic role labeling to split the audit requirement text into subject semantic units, object semantic units and condition semantic units. Each semantic unit constitutes an independent semantic flow channel, and the source term of each channel is extracted as the diffusion source point. S202, the semantic flow channel and metadata relationship graph are subjected to field diffusion and superposition calculation processing to obtain a field strength association graph. The field diffusion and superposition calculation processing starts from the source term of each semantic flow channel and propagates the field strength value outward with a decay function on the metadata relationship graph. Each node receives the field strength value from different channels and superimposes it to form a field strength mark that reflects the comprehensive association strength between the node and the audit requirements.

3. The audit data analysis requirement parsing method based on metadata relationship graphs according to claim 1, characterized in that, Step S3 includes the following sub-steps: S301, Perform field strength threshold filtering on the field strength correlation map to obtain an active node set. The field strength threshold filtering process is to traverse the nodes in the field strength correlation map according to a preset field strength threshold, and extract the nodes whose field strength marker values ​​are greater than or equal to the threshold to form an active node set reflecting the correlation elements. S302, perform rule matching and secondary field propagation processing on the set of activated nodes and the audit rule base to obtain activated subgraph data. The rule matching and secondary field propagation processing involves matching the set of activated nodes with the rule conditions in the audit rule base, propagating the secondary field outward along its associated edge for successfully matched nodes, and the intensity of the secondary field decays with the propagation distance. The newly activated nodes and paths are incorporated into the graph structure to form activated subgraph data containing multiple layers of association relationships.

4. The audit data analysis requirement parsing method based on metadata relationship graphs according to any one of claims 1-3, characterized in that, Step S4 includes the following sub-steps: S401, the activated subgraph data and the business layer template are subjected to structural anchoring combination processing to obtain an initial tree with anchoring weights. The structural anchoring combination processing is to traverse the nodes in the activated subgraph data, and based on the three-level membership relationship of business domain, data table and field defined in the business layer template, attach each node to the corresponding layer position. At the same time, the anchoring strength between nodes in the same layer is determined according to the weight of the original association edge between nodes in the activated subgraph data, and the anchoring strength is marked as the structural weight of the node in the tree. S402, the initial tree with anchored weights is subjected to field strength hierarchical pruning to obtain a pruned parse tree. The field strength hierarchical pruning process involves calculating the mean and variance of the field strength of each level node in the initial tree, determining the adaptive pruning baseline for each level based on the variance, removing nodes with field strength values ​​lower than the adaptive pruning baseline and their subordinate child nodes, retaining nodes with field strength values ​​higher than or equal to the adaptive pruning baseline, and reorganizing the retained nodes into a pruned parse tree according to the original hierarchical membership.

5. The audit data analysis requirement parsing method based on metadata relationship graphs according to claim 4, characterized in that, Step S5 includes the following sub-steps: S501, the field strength benchmark deviation calculation process is performed on the pruned parse tree and the business benchmark data to obtain a parse tree with perturbation labels. The field strength benchmark deviation calculation process is to traverse the nodes in the pruned parse tree, extract the metadata field corresponding to each node, generate the corresponding index calculation logic according to the metadata relationship graph and obtain the index value from the business data, find the benchmark threshold range of the field in the business benchmark data, calculate the degree of deviation between the index value and the benchmark threshold range, and perform weighted calculation in combination with the node field strength value to quantify the degree of deviation into a perturbation coefficient, and assign the perturbation coefficient as an additional label to the node. S502, the perturbation maximum value aggregation and graph construction process is performed on the perturbation maximum value aggregation of the perturbation maximum value aggregation and graph construction process to obtain the audit requirement perturbation graph. The perturbation maximum value aggregation and graph construction process is based on the hierarchical structure of the perturbation maximum value aggregation ...

6. The audit data analysis requirement parsing method based on metadata relationship graphs according to claim 2, characterized in that, The semantic flow deconstruction process is based on dependency parsing and semantic role labeling to split the audit requirement text into subject semantic units, object semantic units and condition semantic units. Each semantic unit constitutes an independent semantic flow channel, and the source terms of each channel are extracted as diffusion sources, including semantic unit identification and role assignment processing and source term extraction and channel construction processing. The field diffusion and superposition calculation process starts from the source term of each semantic flow channel and propagates the field strength value outward with a decay function on the metadata relationship graph. Each node receives the field strength value from different channels and superimposes it to form a field strength mark that reflects the comprehensive correlation strength between the node and the audit requirements. This includes field diffusion propagation processing and field strength superposition mark processing.

7. The audit data analysis requirement parsing method based on metadata relationship graphs according to claim 3, characterized in that, The field strength threshold screening process involves traversing the nodes in the field strength correlation graph based on a preset field strength threshold, extracting nodes whose field strength marker values ​​are greater than or equal to the threshold, and forming an active node set reflecting the correlation elements. This includes threshold setting and dynamic calibration processing, as well as node screening and set construction processing. The rule matching and secondary field propagation processing involves matching the active node set with the rule conditions in the audit rule base, propagating the secondary field outward along its correlation edge for successfully matched nodes, with the secondary field intensity decreasing as the propagation distance increases, and incorporating the newly activated nodes and paths into the graph structure to form active subgraph data containing multi-layer correlation relationships. This includes rule matching triggering processing and secondary field diffusion and subgraph construction processing.

8. The audit data analysis requirement parsing method based on metadata relationship graphs according to claim 4, characterized in that, The structural anchoring combination process involves traversing the nodes in the activated subgraph data, attaching each node to its corresponding hierarchical position based on the three-level membership relationship of business domain, data table, and field defined in the business hierarchy template, and determining the anchoring strength between nodes at the same level based on the original association edge weights between nodes in the activated subgraph data. The anchoring strength is then used as the structural weight of the node in the tree for marking, including node attachment and tree construction processing, as well as anchoring strength calculation and marking processing. The field strength hierarchical pruning process involves calculating the mean and variance of the field strength of nodes at each level in the initial tree, determining the adaptive pruning baseline for each level based on the variance, removing nodes with field strength values ​​lower than the adaptive pruning baseline and their subordinate child nodes, retaining nodes with field strength values ​​higher than or equal to the adaptive pruning baseline, and reorganizing the retained nodes according to their original hierarchical affiliation into a pruning parse tree process, which includes adaptive determination of pruning baseline and recursive pruning and tree reconstruction.

9. The audit data analysis requirement parsing method based on metadata relationship graphs according to claim 5, characterized in that, The field strength benchmark deviation calculation process involves traversing and pruning the nodes in the parse tree, extracting the metadata fields corresponding to each node, generating corresponding index calculation logic based on the metadata relationship graph, obtaining index values ​​from business data, searching for the benchmark threshold range of the field in the business benchmark data, calculating the degree of deviation between the index value and the benchmark threshold range, and performing weighted calculations based on the node field strength values. The degree of deviation is quantified into a disturbance coefficient, and the disturbance coefficient is assigned as an additional label to the node. This process includes index value acquisition and deviation calculation, as well as field strength weighting and disturbance coefficient generation. The perturbation maximum value aggregation and graph construction process is based on the hierarchical structure of the parse tree with perturbation labels. In a bottom-up order, the perturbation coefficient of each parent node is determined to be the maximum value among the perturbation coefficients of all its direct child nodes, forming the aggregated perturbation value of each level node. The node paths and aggregated perturbation values ​​are organized into a graph form of audit requirement indication data, including perturbation maximum value aggregation processing and aggregated graph construction processing.

10. An audit data analysis requirement parsing system based on metadata relationship graphs, characterized in that, The system includes: The acquisition unit is used to acquire data to be processed, which includes audit text data, metadata relationship graph, audit rule base, business level template, and business benchmark data. The metadata relationship graph is a graph structure data constructed with data tables, fields, and reports in the audit domain as nodes and data flow and business logic relationships as edges. The audit rule base is a collection of predefined audit logic judgment conditions and anomaly detection modes. The business level template is a predefined structure data describing the hierarchical relationship between various metadata entities in the audit domain. The semantic propagation unit is used to perform semantic flow parsing and graph propagation processing on the audit text data and metadata relationship graph. It parses the audit text into semantic flow information and maps it to relevant nodes in the metadata relationship graph. It also calculates the node association strength through relationship propagation, thereby generating a field strength association graph. The activation extension unit is used to perform node filtering and relationship expansion processing on the field strength correlation graph and the audit rule base. It determines the activation node based on the field strength threshold, and expands the relationship in the metadata relationship graph based on the activation node and the audit rule base to construct the activation subgraph data. The pruning and reconstruction unit is used to perform structural reconstruction processing on the activated subgraph data and the business level template, so as to construct a tree-shaped parsing structure according to the node hierarchical membership relationship defined by the business level template, and perform pruning processing on the tree-shaped parsing structure based on the node field strength, thereby generating a pruned parsing tree; The perturbation aggregation unit is used to perform perturbation mapping and hierarchical aggregation processing on the pruned parse tree and business benchmark data. It calculates the node perturbation coefficient based on the business indicator value corresponding to the node and the business benchmark data, and performs weight mapping in combination with the node field strength. It then performs hierarchical aggregation of the perturbation coefficient according to the tree structure to generate an audit requirement perturbation map.

Images