Digital employee behavior tracing method and apparatus

Abstract

This embodiment provides a method for tracing the behavior of digital employees. During the execution of digital employees, multi-level behavior acquisition probes are deployed to capture multi-granularity behavioral data of technical operations, data status, system environment, and reasoning processes, and these data are labeled with related identifiers. After being de-identified in a structured manner according to a unified behavior record model, the data is mapped into semantic behavior records through a semantic mapping rule base. The semantic behavior records are read and associated edges are established based on control flow, data flow, conditions, and abnormal causal categories to construct a causal relationship graph of the execution process. Judgment basis is recorded for decision points. Explicit and implicit anomalies are detected, and the root cause is traced back from the abnormal node to the root cause node along the causal relationship graph to generate root cause tracing results. Chained hashes are calculated on the semantic behavior records, timestamped signatures are attached to construct an audit evidence chain, and an interpretable audit report is generated. Behavioral patterns are mined from historical records to update the detection rules and semantic mapping rule base, which are then fed back to the acquisition probes.

Description

Technical Field

[0001] This application relates to the field of robotic process automation, specifically to a method and apparatus for tracing digital employee behavior. Background Technology

[0002] Digital employees, including robotic process automation (RPA) robots, AI agents, and automated scripts, perform tasks in business processes such as financial processing, customer service, and approval workflows. Existing digital employee systems often exhibit black-box characteristics, only recording the start and end states of tasks, lacking detailed records of intermediate processes. When business anomalies and compliance issues arise, it's difficult to trace specific execution details and decision-making basis, failing to meet the audit traceability requirements of heavily regulated industries such as finance, healthcare, and government. Existing log recording systems mostly use technology-oriented, low-level log formats, recording atomic operations at the technical level such as API calls, database operations, and UI element clicks. Business personnel and auditors find it difficult to correlate technical operations with business semantics, resulting in low audit efficiency and a high risk of overlooking critical issues.

[0003] The execution process of digital employees involves complex logic such as multi-system interactions, conditional branching, loop iteration, and exception handling. Existing logging methods are mostly linear log streams, lacking the ability to express the execution logic structure. They cannot clearly show the basis for conditional judgments, the reasons for branch selection, and the boundary conditions of loop execution, etc., which are key decision points. When it is necessary to analyze why one branch was executed instead of another, it is often necessary to manually reconstruct the entire execution context, which is time-consuming and error-prone. When abnormal results such as data errors, process interruptions, and business violations occur during the execution of digital employees, the anomalies may stem from a variety of reasons, such as input data problems, changes in the system environment, process design flaws, and external system failures. Existing logging methods lack effective root cause tracing capabilities, and the average anomaly location time is long, with most of the time spent on information collection and log analysis.

[0004] With the application of large language models in digital employees, the uncertainty and complexity of the execution process further increase. The reasoning process of large models, tool call decisions, and multi-turn dialogue contexts are difficult to record and interpret using traditional log methods, posing a challenge to existing auditing methods. Existing robotic process automation log recording methods mostly record the robot's operation steps and execution results through structured log formats, which can be used for basic execution recording and fault diagnosis, but do not cover interpretable expressions at the business semantic level, causal tracing of execution decisions, construction of compliance-oriented evidence chains, and specialized auditing of the reasoning process. Therefore, there is a need for a digital employee behavior tracing method that combines multi-level behavior collection, business semantic mapping, causal relationship modeling, root cause tracing, and tamper-proof evidence storage. Summary of the Invention

[0005] To address the problems of existing digital employee execution processes being black-box, technical logs being difficult to correlate with business semantics, lacking causal expression and root cause tracing capabilities for execution logic, and being difficult to audit the reasoning process, this application provides a digital employee behavior tracing method and apparatus. It can transform the black-box execution process into semantic behavior records through multi-level behavior collection and semantic mapping, support decision-making basis queries and root cause reverse tracing through causal relationship graphs of the execution process, meet compliance audit requirements through tamper-proof evidence storage and interpretable audit reports, and form continuously evolving audit capabilities through behavior pattern mining and rule feedback, thereby improving the completeness of execution process records, business understandability, and anomaly location efficiency.

[0006] To solve at least one of the above problems, this application provides the following technical solution:

[0007] Firstly, this application provides a method for tracing the behavior of digital employees, comprising: deploying multi-level behavior acquisition probes during the execution of digital employee tasks to capture multi-granularity behavior data of technical operations, data states, system environments, and reasoning processes, and labeling them with association identifiers; desensitizing the labeled behavior data in a structured manner according to a unified behavior record model; mapping the structured technical operations and technical objects to business actions and entities according to a preset semantic mapping rule base to generate semantic behavior records; reading the semantic behavior records; and establishing relationships between operation, data, condition, and state nodes based on the association categories of control flow causality, data flow causality, condition causality, and abnormal causality. The system constructs a causal relationship graph of the execution process by associating edges and records the judgment basis for decision points. It detects explicit and implicit anomalies in the execution process and traces back from the anomaly node to the root cause node along the causal relationship graph to generate root cause tracing results. It calculates chain hashes for each semantic behavior record and attaches a trusted timestamp signature for tamper-proof evidence storage to build an audit evidence storage chain. It selects a template from the preset report template system according to the audience category to generate an interpretable audit report. It mines behavior patterns from historical execution records to build a behavior knowledge base. After updating the anomaly detection rules and the semantic mapping rule base according to the behavior patterns and audit feedback, it feeds back to the multi-level behavior collection probe.

[0008] Furthermore, it also includes: deploying behavior acquisition probes in the execution environment of the digital employee according to the technical operation layer, data state layer, system environment layer, and inference process layer. The technical operation layer probes capture interface operations, interface calls, and database operations; the data state layer probes capture variable changes and business data snapshots; the system environment layer probes capture the operating environment and resource consumption; and the inference process layer probes capture prompts, model outputs, and tool calls. The acquisition is triggered before and after operations and at key nodes using a combination of event-driven and periodic sampling methods. The multi-granularity behavior data is labeled with association identifiers including execution instance identifiers, operation sequence numbers, causal association identifiers, and data lineage identifiers. The execution instance identifier indicates a complete task execution, the causal association identifier indicates the causal dependency between operations, and the data lineage identifier indicates the evolution relationship of data items at different stages. Based on this, discrete behavior data can be indexed by sequence and causal association within the same execution instance.

[0009] Furthermore, it also includes: organizing the labeled behavioral data into structured behavioral records containing record identifiers, behavioral types, behavioral subjects, behavioral objects, behavioral parameters, and behavioral results according to a unified behavioral record model; using Coordinated Universal Time (UTC) timestamps to unify time expression and record time zone information; performing masking processing on sensitive fields such as ID card numbers and bank card numbers according to preset sensitive rules; and performing sequence continuity and time monotonicity integrity checks on the structured behavioral records; based on the semantic mapping rule library accumulated from process design metadata, business system metadata, and manual annotation, mapping the technical operations of the structured behavioral records to business actions, mapping technical objects to business entities, and mapping technical parameters to business meanings; generating hierarchical semantic expressions containing operation layers, activity layers, and task layers and organizing them into semantic behavioral records; and triggering rule supplementation after displaying the original technical description of operation markers not covered by the semantic mapping rule library.

[0010] Furthermore, it also includes: identifying operation nodes, data nodes, condition nodes, and state nodes from the semantic behavior records; establishing association edges containing relationship types and descriptions between nodes based on the association categories of control flow causality, data flow causality, condition causality, and abnormal causality; representing the execution of the next operation triggered by the completion of the previous operation; representing the output of the previous operation as the input of the next operation by the data flow causality; and constructing an execution process causal relationship graph by merging the association edges; recording decision inputs, decision rules, and decision results for the condition judgment, branch selection, and loop control decision points in the execution process causal relationship graph; combining the decision inputs, decision rules, and decision results to generate decision interpretations; establishing data lineage chains containing sources, transformations, and destinations for the data items involved in the processing and associating them with the corresponding nodes; thereby enabling the judgment basis and data evolution process of any decision point to be queried along the causal relationship graph.

[0011] Furthermore, it also includes: capturing and identifying explicit anomalies by capturing thrown errors and failure states during execution; identifying implicit anomalies such as operation timeouts, retry limits exceeding limits, data verification failures, and deviations from expected execution paths according to preset threshold conditions; classifying identified anomalies by system, data, logic, and business type, and grading them according to fatal, severe, general, and warning levels; collecting anomaly context containing the operation sequence, variable state, and environmental conditions before the anomaly occurs; tracing back layer by layer from the anomaly node along the causal relationship graph to trace the direct cause and preceding causes to the root cause node; generating root cause hypotheses containing input data, environmental changes, process design, and external dependencies based on the anomaly type and the anomaly context; verifying the root cause hypotheses through data validation and historical comparison, and assessing the data impact range and business impact of the anomaly; and converging to generate a root cause tracing result containing anomaly description, root cause analysis, and impact assessment.

[0012] Furthermore, it also includes: calculating the hash of each semantic behavior record, so that the hash calculation of each record includes the hash value of the previous record to form a hash chain; attaching a trusted timestamp signature to key records and anchoring the root hash of the hash chain to a trusted third-party evidence storage platform according to a preset period; controlling the reading, writing and export of audit records according to role permissions and prohibiting deletion during the retention period; constructing an audit evidence storage chain by associating the original behavior data, semantic interpretation, causal relationship and operation subject; selecting the corresponding template from the preset report template system according to the audience categories of business personnel, technical personnel, auditors and management personnel; organizing the semantic behavior records, the audit evidence storage chain and the root cause tracing results; automatically extracting the execution overview and execution timeline and generating key operation summaries and decision link descriptions; and adding flowchart views and cause-effect graph views for visualization to generate an interpretable audit report that supports drill-down and conditional filtering.

[0013] Furthermore, it also includes: mining normal execution patterns containing operation sequence patterns and abnormal related patterns containing abnormal precursor features from historical execution records; organizing the mined patterns into structured patterns according to triggering conditions, behavior sequences, expected results, and confidence levels; establishing associations between operation types, abnormal types, and root cause types based on the relationship categories of cause, resolution, and association to construct a behavior knowledge base; supplementing abnormal detection rules based on abnormal related patterns in the behavior knowledge base; improving root cause hypothesis generation based on historical root cause patterns; correcting the semantic mapping rule base based on audit feedback; validating the updated rules and comparing the effect indicators before and after the update; and after successful verification, feeding the updated rules back to the multi-level behavior acquisition probe and abnormal detection rule base to form a continuous learning closed loop of acquisition, mapping, modeling, tracing, and updating.

[0014] Secondly, this application provides a digital employee behavior tracing device, comprising: a behavior acquisition module, used to deploy behavior acquisition probes in the execution environment of the digital employee according to the technical operation layer, data state layer, system environment layer, and reasoning process layer, capture multi-granularity behavior data and label execution instance identifiers and causal association identifiers, and generate structured behavior records based on a unified behavior record model and desensitize sensitive fields; a semantic mapping module, used to map the technical operations and technical objects of the structured behavior records to business actions and business entities based on a semantic mapping rule library accumulated from process design metadata, business system metadata, and manual annotation, generating semantic behavior records containing operation layer, activity layer, and task layer; and a causal modeling module, used to read the semantic behavior records and, based on control... The association categories of flow causality, data flow causality, conditional causality, and abnormal causality are established by creating association edges between operation, data, condition, and state nodes to construct a causal relationship graph of the execution process, and the judgment basis and data lineage chain are recorded for decision points; the source tracing analysis module is used to detect explicit and implicit anomalies in the execution process and classify and grade them, and trace back from the abnormal node to the root cause node along the causal relationship graph of the execution process to generate root cause tracing results containing root cause analysis and impact assessment; the evidence storage report module is used to calculate chain hashes for each of the semantic behavior records and attach a trusted timestamp signature to construct an audit evidence storage chain, generate an interpretable audit report based on the audience category, and update the anomaly detection rules and the semantic mapping rule base by mining behavior patterns from historical execution records before feeding back to the behavior collection probe.

[0015] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the digital employee behavior tracing method.

[0016] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the digital employee behavior tracing method described above.

[0017] Fifthly, this application provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the digital employee behavior tracing method described above.

[0018] As can be seen from the above technical solution, this application provides a digital employee behavior tracing method and device. It captures multi-granularity behavior data through multi-level behavior acquisition probes and performs structured desensitization. It maps technical operations to business semantics through a semantic mapping rule base to generate semantic behavior records. It records the judgment basis for decision points through the causal relationship graph of the execution process and traces back from the abnormal node to the root cause node. It constructs an audit evidence chain through chain hashing and trusted timestamp signature and generates an interpretable audit report. It updates the anomaly detection rules and semantic mapping rule base according to behavior pattern mining and feeds back to the behavior acquisition probes, forming a continuous learning closed loop of acquisition, mapping, modeling, tracing and updating. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0020] Figure 1 This is a flowchart illustrating the digital employee behavior tracing method in the embodiments of this application;

[0021] Figure 2 This is a schematic diagram of the layered architecture and device structure of the audit trail and behavior tracing system that can be used to explain the digital employee execution process in the embodiments of this application;

[0022] Figure 3 This is a schematic diagram of the multi-level behavioral data collection, structured normalization, and semantic mapping process in the embodiments of this application;

[0023] Figure 4 This is a schematic diagram of the process of constructing a causal relationship graph, tracking decision points, and tracing data lineage in the embodiments of this application;

[0024] Figure 5 This is a schematic diagram of the anomaly detection and causal chain back-tracing root cause tracing process in the embodiments of this application;

[0025] Figure 6 This is a schematic diagram of the closed-loop process of anti-tampering audit evidence storage, interpretable report generation, and behavior pattern feedback in the embodiments of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of this application, but not all embodiments.

[0027] Considering the black-box nature of existing digital employee execution processes, the difficulty in associating technical logs with business semantics, the lack of causal expression and root cause tracing capabilities for execution logic, and the difficulty in auditing the reasoning process, this application provides a digital employee behavior tracing method. Through multi-level behavior collection and semantic mapping, causal relationship graph modeling, anomaly detection and root cause tracing, tamper-proof evidence storage and interpretable reports, the method records the entire execution process of digital employees, provides business interpretation, traces anomalies, and conducts compliance audits.

[0028] This application provides an embodiment of a digital employee behavior tracing method, see [link to embodiment]. Figure 1 The method specifically includes the following:

[0029] Step S101: Deploy multi-level behavior collection probes during the execution of digital employees to capture multi-granularity behavior data of technical operations, data status, system environment and reasoning process, and label them with related identifiers. The labeled behavior data is desensitized in a structured manner according to a unified behavior record model. Based on a preset semantic mapping rule library, the structured technical operations and technical objects are mapped to business actions and entities to generate semantic behavior records.

[0030] In this embodiment, the method runs on a digital employee execution monitoring and audit trail system, such as... Figure 1 As shown, the system adopts a layered architecture consisting of a behavior acquisition layer, a semantic mapping layer, a causal modeling layer, an evidence storage and reporting layer, and a source tracing and analysis layer, running synchronously during the execution of business processes by digital employees. Multi-level behavior acquisition probes are embedded into the digital employee execution environment in a bypass manner, capturing behavioral data according to the technical operation layer, data state layer, system environment layer, and reasoning process layer, such as... Figure 3 As shown.

[0031] In one feasible implementation, the technical operation layer probe captures interface clicks and keyboard inputs, API call requests, responses and time consumption, database operation statements and affected fields, and file read / write paths. The data state layer probe captures the pre-change and post-change values ​​of internal variables and generates snapshots of business data at key business nodes. The system environment layer probe captures the runtime environment version, target system response status, and resource consumption. The inference process layer probe captures prompts, model outputs, thought chains, and tool calls for digital employees driven by large models. The data collection timing adopts a combination of event-driven and periodic sampling. Operation-level data collection is triggered before and after operation execution, environmental information that changes slowly is sampled at preset periods, and full state collection is forced at key business nodes defined in the process.

[0032] Based on this, the collected multi-granularity behavioral data is labeled with association identifiers. The labels include execution instance identifiers, operation sequence numbers, causal relationship identifiers, and data lineage identifiers. The execution instance identifier indicates a complete task execution, the operation sequence number indicates the order of operations within the execution instance, the causal relationship identifier indicates the causal dependency between operations, and the data lineage identifier indicates the evolution relationship of data items at different stages. Behavioral data for which a sequence number could not be obtained is registered with a missing identifier and a supplementary collection is triggered.

[0033] Optionally, the labeled behavioral data is organized into structured behavioral records based on a unified behavioral record model. The unified behavioral record model is organized using fields such as record identifier, execution instance identifier, timestamp, behavior type, behavior subject, behavior object, behavior parameters, and behavior result. Behavior types are further subdivided into primary categories such as interface interaction, data processing, system communication, process control, and artificial intelligence decision-making. Time is uniformly recorded using Coordinated Universal Time (UTC) timestamps accurate to milliseconds, while time zone information is also recorded to support cross-time zone scenarios. Identifiers are standardized using a unified encoding system.

[0034] In one specific implementation, sensitive fields such as ID card number, bank card number, and password in the structured behavior record are identified and masked according to preset sensitive field rules. The original sensitive data is stored separately in encrypted form and can only be decrypted and viewed by authorized auditors. Based on this, integrity checks are performed on the structured behavior record, sequence continuity checks are performed to check whether the operation sequence numbers are consecutive to identify missed data collection, and time reasonableness checks are performed to check the monotonically increasing nature of the timestamp. If the checks fail, an alarm is generated and a re-collection or marking is triggered.

[0035] Once the structured behavior records are ready, business semantic mapping is performed according to the preset semantic mapping rule base, such as... Figure 3 As shown. The semantic mapping rule base is built from process design metadata, business system metadata, and manual annotation. It contains four types of mapping rules: operation semantics, object semantics, parameter semantics, and combination semantics. It maps the technical operation of clicking the submit button to the business action of submitting an application form, maps data tables to corresponding business entities, and maps status values ​​to business meanings such as approval.

[0036] The mapping generates a hierarchical semantic representation containing an operation layer, an activity layer, and a task layer. The operation layer semantics describe the business meaning of a single operation, the activity layer semantics describe a business activity consisting of a group of related operations, and the task layer semantics describe the business description of a complete task. Based on this, the semantic records are organized according to a preset narrative template and output to step S102 and the evidence storage report stage. Operations not covered by the semantic mapping rule base are registered with unmapped identifiers and their original technical descriptions are displayed, while simultaneously triggering the rule supplementation process.

[0037] Step S102: Read the semantic behavior record, establish association edges between operation, data, condition and state nodes according to the association categories of control flow causality, data flow causality, condition causality and abnormal causality, construct the execution process causal relationship graph, record the judgment basis for decision points, detect explicit and implicit abnormalities in the execution process, and trace back from the abnormal node to the root cause node along the causal relationship graph to generate the root cause tracing result.

[0038] The semantic behavior record output in step S101 is read into the causal modeling stage, such as... Figure 1 As shown, semantic behavior records of the same execution are associated with execution instance identifiers and timestamps. Based on this, four types of causal nodes are identified: operation nodes, data nodes, condition nodes, and status nodes. Operation nodes correspond to a technical operation or business action, data nodes correspond to business data items involved in processing, condition nodes correspond to condition judgments, and status nodes correspond to the state of business objects and the system.

[0039] In one feasible implementation, association edges are established between nodes based on four types of associations, such as... Figure 4 As shown. Control flow causality represents the execution of the next operation triggered by the completion of the previous operation; data flow causality represents the output of the previous operation as the input of the next operation; conditional causality represents the selection and execution of the corresponding branch when a condition is met; and abnormal causality represents the triggering of the processing flow due to the occurrence of an exception. Associated edges include relation type, relation strength, and relation description attributes. Graph construction obtains the static structure of control flow causality by parsing the process definition, analyzes data read / write to trace data flow causality, and analyzes condition judgments to construct conditional causality.

[0040] Based on this, decision points in the causal relationship graph of the execution process are specifically tracked. Conditional judgments, branch selections, and loop control decision points in the execution process are identified. Variable values, system states, and external data at the decision point constitute the decision input. The applied conditional expressions constitute the decision rules. The selected branches and loop continuation / exit constitute the decision results. Combining the decision inputs, decision rules, and decision results generates a decision interpretation, making the basis for judgments such as executing large-amount approval processes due to amounts exceeding thresholds searchable.

[0041] Optionally, a data lineage chain is established for each data item involved in the processing. The data lineage chain records the original source of the data item, the format conversions and computational merging operations it undergoes, and its final destination, linking the source, conversion, and destination into a complete lineage chain and associating it with the corresponding nodes. Based on this, the state transitions of business objects and the system are tracked, recording the triggering event for each transition, the state before the transition, and the state after the transition. The actual state machine is reconstructed and compared with the expected state machine for analysis.

[0042] Once the causal relationship graph is ready, anomaly detection is performed during the execution process, such as... Figure 5 As shown, explicit anomaly detection captures errors and failures thrown during execution. Implicit anomaly detection identifies operation timeouts, retry limits exceeding limits, data verification failures, and deviations from expected execution paths based on preset threshold conditions. The timeout threshold is set to a preset multiple of the historical average execution time or a fixed upper limit, and the retry threshold is set to a preset number of attempts. Based on this, identified anomalies are categorized by system, data, logic, and business type, and graded into fatal, severe, general, and warning levels.

[0043] In one specific implementation, when an exception occurs, an exception context is collected and a causal chain backtracking is performed. The exception context includes the sequence of operations prior to the exception, the variable and system states at the time of the exception, the input data at the time of the exception, and the environmental conditions at the time of the exception. The backtracking proceeds layer by layer along the causal relationship graph from the exception node, tracing back the operation that directly caused the exception as the direct cause, then tracing back the preceding causes of the direct cause, and so on, until the root cause node or the tracing boundary is reached. The backtracking depth is limited by a preset number of steps or a time window.

[0044] Based on this, root cause hypotheses are generated according to the anomaly type and context. These hypotheses cover input data format errors and missing data, target system changes and network anomalies, unhandled process boundary conditions, and external interface failures. The root cause hypotheses are verified through data validation to ensure they meet the expected data, and historical comparisons are used to compare the differences between normal and abnormal execution. The potential data scope affected by the anomaly and its business impact on the current and related tasks are assessed. The resulting root cause analysis, including anomaly description and impact assessment, is then output to step S103 and the operations and maintenance system.

[0045] Step S103: Calculate chained hashes for each semantic behavior record and attach a trusted timestamp signature to prevent tampering and build an audit evidence chain. Select a template from the preset report template system according to the audience category to generate an interpretable audit report. Mine behavior patterns from historical execution records to build a behavior knowledge base. Update the anomaly detection rules and the semantic mapping rule base according to the behavior patterns and audit feedback, and then feed back to the multi-level behavior collection probe.

[0046] The semantic behavior record and root cause tracing results output in step S102 are read into the evidence storage report stage, such as... Figure 1 As shown. For each semantic behavior record, its hash is calculated using a secure hash algorithm or a national cryptographic algorithm, ensuring that the hash calculation of each record includes the hash value of the previous record, forming a hash chain, such as... Figure 6 As shown, hash chains enable the subsequent tampering with any record to fail and thus be detected, causing subsequent hash verifications to fail.

[0047] In one feasible implementation, a trusted timestamp signature is attached to key records to prove the time of their existence, and the root hash of the hash chain is anchored to a trusted third-party evidence storage platform at preset intervals. Based on this, storage security protection is implemented for the stored audit records. Role-based access control differentiates between write, query, export, and delete permissions for records. Sensitive audit records are encrypted and stored with keys managed by a security module. Audit records are synchronized to off-site backups in real time, deletion is prohibited during the retention period, and deletion operations require multiple authorizations and are recorded.

[0048] Based on this, an audit evidence storage chain is constructed by associating original behavioral data, semantic interpretation, causal relationships, timestamps, and the operating entity. This chain provides a mechanism for verifying completeness and authenticity and supports exporting evidence packages containing content and verification information according to audit needs. Audit records are assigned tiered retention periods based on business importance and compliance requirements. Expired records are archived or securely destroyed. Records involving pending audits and litigation are automatically extended in retention. Any evidence storage anomalies are registered with an anomaly flag and an alarm is triggered.

[0049] Once the audit evidence chain is ready, an interpretable audit report is generated based on the audience category, such as... Figure 6 As shown. The preset report template system includes execution summary reports, detailed audit reports, decision audit reports, data audit reports, and compliance audit reports. The appropriate template is selected based on the audience categories of business personnel, technical personnel, auditors, and management. From the perspective of business personnel, business terminology is used and technical details are hidden, while from the perspective of auditors, compliance points are emphasized and evidence is provided.

[0050] In one specific implementation, report content is automatically generated. It automatically extracts the task name, execution time range, and execution results to form an execution overview; generates an execution timeline in chronological order; automatically identifies key operations such as data modifications and external submissions to generate key operation summaries; generates decision chain descriptions for important business decisions; and adds flowchart views that overlay the actual execution path onto the process design diagram and cause-effect diagram views that display key causal relationships. The report supports drill-down from summary to detailed records and supports filtering by time and operation type.

[0051] In parallel processing paths, behavioral patterns are mined from historical execution records, and a behavioral knowledge base is built, such as... Figure 6 As shown, normal execution patterns containing operation sequence patterns and abnormal related patterns containing precursor features are mined from historical execution records. The mined patterns are organized into structured patterns according to triggering conditions, behavior sequences, expected results, and confidence levels. Based on the relationship categories of cause, resolution, and association, associations are established between operation type, abnormal type, and root cause type entities to build a behavioral knowledge base and support retrieval by similarity.

[0052] Based on this, the behavioral knowledge base is applied to real-time processing and fed back to update the rules. Anomaly-related patterns are transformed to supplement anomaly detection rules, historical root cause patterns are used to improve the generation of root cause hypotheses for new anomalies, and pattern accumulation and auditor feedback are used to revise the semantic mapping rule base. The updated rules are validated by comparing the mapping accuracy and anomaly detection rate before and after the update. Once validated, the updated rules are fed back to the multi-level behavioral acquisition probes and anomaly detection rule base in step S101, forming a continuous learning closed loop of acquisition, mapping, modeling, tracing, and updating, ensuring that the efficiency of root cause localization of new anomalies continuously improves with knowledge accumulation.

[0053] As can be seen from the above description, the digital employee behavior tracing method provided in this application can transform the black-box execution process into a semantic behavior record that can be understood by humans through multi-level behavior collection and semantic mapping, support decision-making basis query and root cause reverse tracing through the causal relationship graph of the execution process, meet compliance audit requirements through tamper-proof evidence storage and interpretable audit reports, and form a continuously evolving audit capability through behavior pattern mining and rule feedback.

[0054] In one embodiment of the digital employee behavior tracing method of this application, see [link to relevant documentation]. Figure 3 It can also specifically include the following:

[0055] Step S201: Deploy behavior acquisition probes in the execution environment of the digital employee according to the technical operation layer, data state layer, system environment layer and inference process layer. The technical operation layer probes capture interface operations, interface calls and database operations. The data state layer probes capture variable changes and business data snapshots. The system environment layer probes capture the operating environment and resource consumption. The inference process layer probes capture prompt words, model output and tool calls. The acquisition is triggered before and after the operation and at key nodes by combining event-driven and periodic sampling.

[0056] Step S202: Label the multi-granularity behavioral data with association identifiers including execution instance identifier, operation sequence number, causal association identifier and data lineage identifier. The execution instance identifier marks a complete task execution, the causal association identifier marks the causal dependency between operations, and the data lineage identifier marks the evolution relationship of data items at different stages. Based on this, discrete behavioral data can be indexed by sequence and causal association within the same execution instance.

[0057] Step S101 describes a behavior acquisition layer that deploys multi-level behavior acquisition probes in the execution environment of the digital employee, such as... Figure 3As shown, the acquisition probes are deployed in layers: technical operation layer, data state layer, system environment layer, and inference process layer. The technical operation layer probes are connected to the execution interface of the digital employee in a bypass manner to capture the target elements and operation parameters of the interface operation, the name, request, response and return status code of the interface call, the statement-affected fields and transaction boundaries of the database operation, and the path and content summary of the file operation.

[0058] The data state layer probe captures the pre-change and post-change values ​​of internal variables of the digital employee, as well as the operations that triggered the changes. It also generates a complete state snapshot of the processed business data at key business nodes, and records the data flow path from the source system to the target system. The system environment layer probe captures the operating system and dependent component versions, the target system's response time and availability status, and processor and memory resource consumption. The inference process layer probe captures prompts, model outputs, thought processes, and tool call parameter results for large model-driven digital employees.

[0059] The multi-level behavior acquisition probes are triggered to acquire data using a combination of event-driven and periodic sampling methods, such as... Figure 3 As shown. The event-driven approach triggers data collection before and after each operation to ensure complete operation-level recording; the state change-triggered approach triggers data collection when a change in data state is detected; the periodic sampling approach samples information with slow changes such as environmental state at a preset period; and the critical node forced collection approach forces full state collection at key business nodes defined in the process.

[0060] Based on this, the collected multi-granularity behavioral data is labeled with association identifiers. The execution instance identifier uses a globally unique code to identify a complete task execution; the operation sequence number identifies the order of operations within the execution instance; the causal association identifier identifies the causal dependencies between operations; and the data lineage identifier identifies the evolution relationship of data items at different stages. The labeled behavioral data is written to the collection cache using the execution instance identifier as the primary key, enabling discrete behavioral data to be indexed by operation sequence number and causal association identifier within the same execution instance.

[0061] The integrity of the association identifier is guaranteed by the collection side verification. If the operation sequence number or causal association identifier fails to be obtained, the missing identifier is registered and the supplementary collection is triggered. The behavior data that fails to be supplemented retains the original timestamp and is marked as to be completed in the subsequent structuring process. The collection cache is used to execute the instance identifier and operation sequence number for step S102 to read in sequence at the causal modeling entry point.

[0062] In one embodiment of the digital employee behavior tracing method of this application, see [link to relevant documentation]. Figure 3 It can also specifically include the following:

[0063] Step S301: Organize the labeled behavioral data into structured behavioral records containing record identifier, behavior type, behavior subject, behavior object, behavior parameters and behavior results according to the unified behavior record model. Use Coordinated Universal Time timestamps to unify time expression and record time zone information. Perform masking processing on sensitive fields such as ID card number and bank card number according to preset sensitive rules. Perform sequence continuity and time monotonicity integrity checks on the structured behavioral records.

[0064] Step S302: Based on the semantic mapping rule base built from process design metadata, business system metadata and manual annotation, the technical operations of the structured behavior records are mapped to business actions, technical objects are mapped to business entities, and technical parameters are mapped to business meanings. A hierarchical semantic expression containing operation layer, activity layer and task layer is generated and organized into semantic behavior records. Operation tags not covered by the semantic mapping rule base are not mapped and the original technical description is displayed before rule supplementation is triggered.

[0065] After the labeled behavioral data is ready as described in step S101, structured normalization is performed according to the unified behavioral record model, such as... Figure 3 As shown, the unified behavior recording model is organized using fields such as record identifier, execution instance identifier, timestamp, behavior type, behavior subject, behavior object, behavior parameters, and behavior result. Behavior types are categorized into primary types such as interface interaction, data processing, system communication, process control, and artificial intelligence decision-making, and further subdivided into secondary and tertiary types. Extended attributes are attached to interface element attributes and interface request / response details based on the behavior type.

[0066] Time is uniformly expressed using Coordinated Universal Time (UTC) timestamps accurate to milliseconds, while time zone information is recorded to support cross-time zone scenarios and establish a mapping relationship with accounting dates and business times. Identifiers are standardized using a unified coding system: system identifiers are associated with system name, type, and environment; user identifiers are associated with roles and permissions; and data object identifiers use business primary keys such as order numbers and customer numbers. Sensitive fields such as ID card numbers, bank card numbers, and passwords are identified and masked according to preset sensitive field rules, and the original sensitive data is stored separately with encryption.

[0067] Based on this, the structured behavior records are subjected to integrity checks, sequence continuity checks to identify whether the operation sequence numbers are continuous in order to identify missed collections, time rationality checks to check the monotonic increase and rationality of the timestamps, and association integrity checks to check the integrity of causal relationships and data lineage. When the checks fail, alarms are generated and re-collection or marking is triggered, thereby ensuring that the structured behavior record sequences entering the semantic mapping are continuous and association is complete.

[0068] Once the structured behavior record is ready, business semantic mapping is performed according to the semantic mapping rule base, such as... Figure 3As shown. The semantic mapping rule base is constructed from process design metadata exported by the process design tool, field descriptions and data dictionary metadata of the business system being operated on, and manual annotations of historical records by auditors. It includes four types of mapping rules: operation semantics, object semantics, parameter semantics, and combination semantics. For operations that have not yet been mapped, the semantics are intelligently inferred based on naming conventions and contextual information.

[0069] The mapping generates a hierarchical semantic representation containing operation, activity, and task layers. The operation layer semantics describe the business meaning of a single operation, the activity layer semantics describe a business activity consisting of a group of related operations, and the task layer semantics describe the business description of a complete task. Conditional judgment decision points are supplemented with business explanations. Based on this, semantic behavior records are generated by filling in the preset narrative template. The narrative style can be configured into concise mode, detailed mode, and technical mode. Operations not covered by the semantic mapping rule base are registered with unmapped identifiers and the original technical descriptions are displayed, triggering rule supplementation. Semantic behavior records are available for reading at the causal modeling entry point in step S301.

[0070] In one embodiment of the digital employee behavior tracing method of this application, see [link to relevant documentation]. Figure 4 It can also specifically include the following:

[0071] Step S401: Identify operation nodes, data nodes, condition nodes, and state nodes from the semantic behavior record. Based on the association categories of control flow causality, data flow causality, condition causality, and abnormal causality, establish association edges containing relationship types and relationship descriptions between each node. Control flow causality represents the completion of the previous operation triggering the execution of the next operation. Data flow causality represents the output of the previous operation as the input of the next operation. Combine all association edges to construct a causal relationship graph of the execution process.

[0072] Step S402: Record the decision input, decision rules and decision results for the condition judgment, branch selection and loop control decision points in the causal relationship graph of the execution process, combine the decision input, decision rules and decision results to generate decision interpretation, establish a data lineage chain containing source, transformation and destination for the data items involved in the processing and associate it with the corresponding nodes, so that the judgment basis and data evolution process of any decision point can be queried along the causal relationship graph.

[0073] After the semantic behavior record in step S301 is ready, the causal relationship graph construction is performed, such as... Figure 4 As shown, semantic behavior records of the same execution are associated with execution instance identifiers and timestamps, and operation nodes, data nodes, condition nodes, and status nodes are identified from them. Operation nodes correspond to a technical operation or business action, data nodes correspond to business data items involved in processing, condition nodes correspond to condition judgments, and status nodes correspond to the status of business objects and the system. When missing node information is recorded, the original record is backtracked to complete it.

[0074] Based on four types of relationships—control flow causality, data flow causality, conditional causality, and anomaly causality—association edges are established between nodes, such as... Figure 4 As shown. Control flow causality represents the execution of the next operation triggered by the completion of the previous operation; data flow causality represents the output of the previous operation as the input of the next operation; conditional causality represents the selection of the corresponding branch for execution when a condition is met; and abnormal causality represents the triggering of the processing flow due to the occurrence of an exception. Associated edges are accompanied by relationship type, relationship strength, and relationship description attributes. By parsing the process definition, the static structure of the control flow is obtained; data read / write operations are analyzed to trace the causal relationships of the data flow; and the causal relationship graph of the execution process is constructed by combining all associated edges.

[0075] Based on this, the decision points in the causal relationship graph of the execution process are specifically tracked, such as... Figure 4 As shown, the system identifies decision points for conditional judgments, branch selections, and loop control. It records the variable values, system state, and external data at each decision point to form the decision input; records the applied conditional expressions to form the decision rules; and records the selected branches and loop continuation / exit to form the decision results. Finally, it combines the decision inputs, decision rules, and decision results to generate a decision interpretation.

[0076] For each data item involved in processing, a data lineage chain is established. This chain records the original source of the data item, the format conversions and computational merging operations it undergoes, and its destination in database writes and API submissions. The source, conversions, and destinations are linked together to form a complete lineage chain and associated with the corresponding data nodes. Based on this, the state transitions of business objects and the system are tracked, recording the triggering event for each transition, the state before the transition, and the state after the transition. The actual state machine is reconstructed and compared with the expected state machine for analysis.

[0077] Accordingly, the basis for judgment at any decision point and the data evolution process can be queried along the causal relationship graph. After the decision explanation and data lineage are associated with the corresponding node, they are written into the graph storage along with the causal relationship graph. The graph uses the execution instance identifier as the primary key for step S501 at the anomaly detection entry point and step S601 at the report generation entry point.

[0078] In one embodiment of the digital employee behavior tracing method of this application, see [link to relevant documentation]. Figure 5 It can also specifically include the following:

[0079] Step S501: During execution, capture the thrown errors and failure states to identify explicit exceptions, and identify implicit exceptions such as operation timeout, retry limit exceedance, data verification failure and execution path deviation from the expected value according to preset threshold conditions. Classify the identified exceptions according to system, data, logic and business type and classify them according to fatal, severe, general and prompt levels. When an exception occurs, collect the exception context containing the operation sequence before the exception, variable state and environmental conditions.

[0080] Step S502: Tracing back layer by layer from the anomaly node along the causal relationship graph, tracing the direct cause and preceding cause to the root cause node, generating root cause hypotheses containing input data, environmental changes, process design and external dependencies based on the anomaly type and the anomaly context, verifying the root cause hypotheses with data validation and historical comparison, and assessing the data impact range and business impact of the anomaly, and combining them to generate root cause tracing results containing anomaly description, root cause analysis and impact assessment.

[0081] After the causal relationship graph is ready in step S401, anomaly detection is performed, such as... Figure 5 As shown. Explicit exception detection captures errors, exceptions, and failure states thrown during the execution process. Implicit exception detection identifies timeout exceptions (operation execution time exceeds the expected threshold), retry exceptions (operation retries exceed the threshold), data exceptions (data validation failure and format exceptions), and logical exceptions (execution path does not match expectations) according to preset threshold conditions. The timeout threshold condition is set as a preset multiple of the historical average time consumption or a fixed upper limit and is set differently according to the operation type.

[0082] Based on this, the identified anomalies are classified and graded, such as... Figure 5 As shown. Anomaly types are categorized into system anomalies, data anomalies, logical anomalies, business anomalies, and security anomalies. Anomaly severity levels are categorized as fatal (causing task failure), severe (affecting business correctness), general (recoverable or with minor impact), and potential risk warnings. Behavioral anomaly detection based on historical behavior patterns identifies behaviors that deviate from normal patterns to a threshold degree. Each anomaly is written to the anomaly queue using its anomaly identifier as the primary key.

[0083] Collect the exception context when an exception occurs, such as Figure 5 As shown. The anomaly context includes the sequence of operations before the anomaly, the variable and system states at the time of the anomaly, the input data at the time of the anomaly, and the environmental conditions at the time of the anomaly. The collection scope is limited by a preset number of backtracking steps or a time window. Based on this, the causal relationship graph is traced back layer by layer from the anomaly node, tracing back the operation that directly caused the anomaly as the direct cause, and then tracing back the preceding causes that led to the source of the erroneous data, tracing back layer by layer until the root cause node or the tracing boundary.

[0084] Based on the anomaly type and its context, root cause hypotheses are generated. These hypotheses cover issues such as incorrect input data format, missing or out-of-range input data, environmental changes related to target system changes and network anomalies, unhandled boundary conditions and inadequate anomaly handling in process design, and external dependencies related to external interface failures and third-party system anomalies. The root cause hypotheses are then validated through data verification to ensure the data meets the expected assumptions, by comparing historical data to discrepancies between normal and abnormal execution, and by matching historical similar anomaly patterns.

[0085] After verifying the root cause, assess the scope of impact, trace the data range that the anomaly may affect to identify potential erroneous data, and evaluate the impact of the anomaly on current and related tasks, as well as the potential business impact of delays, errors, and compliance risks. Based on this, combine the anomaly description, root cause analysis, causal chain, and impact assessment to generate root cause tracing results. The root cause tracing results use the anomaly identifier as the primary key for step S601 to read at the report generation entry point and output to the operations and maintenance system and audit system.

[0086] In one embodiment of the digital employee behavior tracing method of this application, see [link to relevant documentation]. Figure 6 It can also specifically include the following:

[0087] Step S601: Calculate the hash of each semantic behavior record, so that the hash calculation of each record includes the hash value of the previous record to form a hash chain. Attach a trusted timestamp signature to key records and anchor the root hash of the hash chain to a trusted third-party evidence storage platform according to a preset period. Control the reading, writing, and export of audit records according to role permissions and prohibit deletion during the retention period. Construct an audit evidence storage chain by associating the original behavior data, semantic interpretation, causal relationship, and operating entity.

[0088] Step S602: Select the corresponding template from the preset report template system according to the audience categories of business personnel, technical personnel, auditors and management, organize the semantic behavior record, the audit evidence chain and the root cause tracing results, automatically extract the execution overview and execution timeline and generate key operation summary and decision link description, and generate an interpretable audit report that supports drill-down and conditional filtering by adding flowchart view and cause-effect graph view visualization presentation.

[0089] After the root cause analysis results and semantic behavior records in step S501 are ready, perform tamper-proof audit evidence storage, such as... Figure 6 As shown, the hash of each semantic behavior record is calculated using a secure hash algorithm or national cryptographic algorithm, ensuring that the hash calculation of each record includes the hash value of the previous record, forming a hash chain. A trusted timestamp signature is attached to key records to prove the time of the record's existence. The root hash of the hash chain is anchored to a trusted third-party evidence storage platform at a preset period.

[0090] Based on this, storage security protection is implemented for the stored audit logs, such as... Figure 6 As shown, role-based access control distinguishes between write, query, export, and delete permissions for records. Sensitive audit records are encrypted and stored with keys managed by the security module. Audit records are synchronized to off-site backup storage in real time. Deletion of audit records is prohibited during the retention period, and deletion operations require multiple authorizations and are recorded. This ensures that audit records are tamper-proof and deletions are traceable.

[0091] An audit evidence storage chain is constructed by linking original behavioral data, semantic interpretation, causal relationships, timestamps, and the operating entity. This chain establishes connections between various evidence elements, forming a complete evidence network and providing a mechanism for verifying integrity and authenticity. It supports exporting evidence packages containing evidence content and verification information according to audit needs. Audit records are assigned tiered retention periods based on business importance and compliance requirements. Expired records are archived or securely destroyed, while records involving pending audits and litigation are automatically extended in retention.

[0092] Once the audit evidence chain is ready, an interpretable audit report is generated by selecting a template from the pre-set report template system based on the audience category, such as... Figure 6 As shown. The preset report template system includes execution summary reports, detailed audit reports, decision audit reports, data audit reports, and compliance audit reports. From the perspective of business personnel, business terminology is used and technical details are hidden. From the perspective of technical personnel, technical details are included to facilitate problem identification. From the perspective of auditors, compliance points are emphasized and evidence is provided. From the perspective of management, risks and exceptions are summarized and highlighted.

[0093] The report content is automatically generated and includes visual presentations, such as... Figure 6 As shown, the system automatically extracts the task name, execution time range, and execution result to form an execution overview, generates an execution timeline in chronological order, automatically identifies key operations such as data modifications and external submissions to generate key operation summaries, generates decision chain descriptions for the root cause tracing results of important business decisions, and adds a flowchart view that overlays the actual execution path onto the process design diagram and a cause-effect diagram view that shows key causal relationships. The interpretable audit report supports drilling down from the summary to detailed records, jumping by association, and filtering by time and operation type conditions. The report is output to the audit user with the task execution instance identifier as the primary key.

[0094] In one embodiment of the digital employee behavior tracing method of this application, see [link to relevant documentation]. Figure 6 It can also specifically include the following:

[0095] Step S701: Mine normal execution patterns containing operation sequence patterns and abnormal related patterns containing abnormal precursor features from historical execution records. Organize the mined patterns into structured patterns according to triggering conditions, behavior sequences, expected results and confidence levels. Based on the relationship categories of cause, resolution and association, establish associations between operation type, abnormal type and root cause type entities to build a behavioral knowledge base.

[0096] Step S702: Supplement anomaly detection rules based on anomaly-related patterns in the behavior knowledge base, improve root cause hypothesis generation based on historical root cause patterns, and revise the semantic mapping rule base based on audit feedback. Verify the effectiveness of the updated rules by comparing the effect indicators before and after the update. After verification, feed the updated rules back to the multi-level behavior acquisition probe and anomaly detection rule base to form a continuous learning closed loop of acquisition, mapping, modeling, tracing, and updating.

[0097] After the interpretable audit report is output in step S602, behavioral patterns are mined from historical execution records and a behavioral knowledge base is built, such as... Figure 6 As shown, normal execution patterns containing operation sequence patterns, data processing patterns, and time distribution patterns are mined from historical execution records. Abnormal related patterns with abnormality precursor characteristics are mined. Branch patterns of conditional branch selection distribution are analyzed. Based on this, the mined patterns are organized into structured patterns according to triggering conditions, behavior sequences, expected results, and confidence levels, and classified according to business scenarios and abnormality types.

[0098] Based on the relationship categories of cause, solution, association, dependency, and similarity, establish associations between operation types, exception types, root cause types, system types, and data type entities to construct a behavioral knowledge base, such as... Figure 6 As shown, the behavioral knowledge base supports retrieving relevant patterns by similarity and supports question answering and reasoning based on knowledge graphs, thereby applying the accumulated patterns and knowledge to real-time processing.

[0099] The abnormality-related patterns are transformed to supplement the abnormality detection rules to improve the identification coverage of known abnormal precursors. Historical root cause patterns are used to improve the generation of root cause hypotheses for new abnormalities to shorten the root cause localization path. The accumulated patterns and the auditors' judgment feedback on historical records are used to revise the semantic mapping rule base to expand the semantic mapping coverage. Based on this, the auditors' judgments and revisions are fed back to the knowledge base to form a knowledge feedback loop.

[0100] The updated rules are validated before being reverted, such as... Figure 6 As shown. The validity verification compares the semantic mapping accuracy and anomaly detection rate on the reserved samples before and after the update. The rules that pass the verification are fed back to the multi-level behavior acquisition probe and anomaly detection rule base in step S101. The rules that fail the verification are rolled back and the verification failure mark is registered. The continuous learning mechanism continuously monitors and identifies new behavior patterns and tracks the prediction accuracy of the patterns to eliminate the failed patterns.

[0101] This forms a continuous learning closed loop of collection, mapping, modeling, tracing, and updating. The collection probe adjusts the collection granularity and annotation strategy according to the backflow rules, the semantic mapping rule base expands the mapping entries according to the backflow rules, and the anomaly detection rule base updates the threshold conditions and precursor features according to the backflow rules, so that the efficiency of root cause localization of new anomalies and the business understandability of audit records continue to improve with system operation and knowledge accumulation.

[0102] To implement all or part of the method, this application provides an embodiment of an apparatus for implementing the digital employee behavior tracing method, see [link to embodiment]. Figure 2 The device specifically includes the following components:

[0103] The behavior collection module is used to deploy behavior collection probes in the execution environment of digital employees according to the technical operation layer, data status layer, system environment layer and reasoning process layer, capture multi-granularity behavior data and label execution instance identifiers and causal association identifiers, and generate structured behavior records based on a unified behavior record model and desensitize sensitive fields.

[0104] The semantic mapping module is used to map the technical operations and technical objects of the structured behavior records into business actions and business entities based on the semantic mapping rule library accumulated from process design metadata, business system metadata and manual annotation, and generate semantic behavior records containing operation layer, activity layer and task layer.

[0105] The causal modeling module is used to read the semantic behavior records, establish correlation edges between operation, data, condition and state nodes based on the correlation categories of control flow causality, data flow causality, condition causality and abnormal causality, construct the causal relationship graph of the execution process, and record the judgment basis and data lineage chain for decision points.

[0106] The source analysis module is used to detect explicit and implicit anomalies in the execution process and classify and grade them. It traces back from the abnormal node to the root cause node along the causal relationship map of the execution process to generate root cause source analysis results containing root cause analysis and impact assessment.

[0107] The evidence storage report module is used to calculate the chain hash of each semantic behavior record and attach a trusted timestamp signature to build an audit evidence storage chain. It generates an interpretable audit report based on the audience category, and updates the anomaly detection rules and the semantic mapping rule library by mining behavior patterns from historical execution records, and then feeds back to the behavior collection probe.

[0108] The behavior acquisition module deploys behavior acquisition probes in the digital employee's execution environment according to the technical operation layer, data status layer, system environment layer, and reasoning process layer. It captures multi-granularity behavior data containing technical operations, data status, system environment, and reasoning processes using a combination of event-driven and periodic sampling methods. The data is then labeled with execution instance identifiers, operation sequence numbers, causal relationship identifiers, and data lineage identifiers. Structured behavior records are generated based on a unified behavior record model, with sensitive fields such as ID card numbers and bank card numbers de-identified. The semantic mapping module, based on a semantic mapping rule library built from process design metadata, business system metadata, and manual annotation, maps the technical operations of the structured behavior records to business actions and technical objects to business entities. This generates layered semantic expressions containing operation, activity, and task layers, which are then organized into semantic behavior records.

[0109] The causal modeling module reads the semantic behavior records, identifies operation, data, condition, and state nodes, and establishes association edges between nodes based on the correlation categories of control flow causality, data flow causality, conditional causality, and abnormal causality to construct a causal relationship graph of the execution process. For conditional judgments and branch selection decision points, it records decision inputs, decision rules, and decision results to generate decision explanations, and establishes data lineage chains containing sources, transformations, and destinations for the data items involved in the processing. The source tracing analysis module detects explicit and implicit anomalies in the execution process and classifies them by type and level. When an anomaly occurs, it collects the anomaly context and traces back along the causal relationship graph of the execution process from the anomaly node to the root cause node, generates a root cause hypothesis, and evaluates its impact scope after data verification and historical comparison, generating a root cause tracing result containing root cause analysis and impact assessment.

[0110] The evidence storage report module calculates the hash of each semantic behavior record to form a hash chain and attaches a trusted timestamp signature to key records. The root hash is anchored to a trusted third-party evidence storage platform at a preset period. An audit evidence storage chain is constructed by associating the original behavior data, semantic interpretation, causal relationships, and operating entities. Based on the audience categories of business personnel, technical personnel, auditors, and management, a template is selected from a preset report template system to generate an interpretable audit report with flowchart and causal graph views. The evidence storage report module further mines normal execution patterns and abnormal related patterns from historical execution records to construct a behavior knowledge base. Based on the behavior patterns and audit feedback, it supplements anomaly detection rules and corrects the semantic mapping rule base. After validity verification, the updated rules are fed back to the behavior collection probe, forming a continuous learning closed loop of collection, mapping, modeling, tracing, and updating.

[0111] As can be seen from the above description, the digital employee behavior tracing device provided in this application embodiment can perform interpretable audit tracking and behavior tracing of the execution process of digital employees through the coordinated efforts of five modules: behavior collection, semantic mapping, causal modeling, tracing analysis and evidence storage report.

[0112] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described method.

[0113] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0114] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described method.

[0115] In this embodiment, multi-level behavior acquisition probes capture multi-granularity behavior data and perform structured anonymization. A semantic mapping rule base maps technical operations to business semantics to generate semantic behavior records. A causal relationship graph of the execution process records the judgment basis for decision points and traces back from abnormal nodes to root cause nodes. An audit evidence chain is constructed using chained hashing and trusted timestamp signatures to generate an interpretable audit report. Behavior pattern mining updates the anomaly detection rules and semantic mapping rule base back to the behavior acquisition probes, forming a continuous learning closed loop of acquisition, mapping, modeling, tracing, and updating.

[0116] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for tracing digital employee behavior, characterized in that, The method includes: During the execution of digital employees, multi-level behavior collection probes are deployed to capture multi-granularity behavior data of technical operations, data status, system environment and reasoning process, and label them with related identifiers. The labeled behavior data is desensitized in a structured manner according to a unified behavior record model. Based on a preset semantic mapping rule library, the structured technical operations and technical objects are mapped to business actions and entities to generate semantic behavior records. Read the semantic behavior record, establish association edges between operation, data, condition and state nodes according to the association categories of control flow causality, data flow causality, condition causality and abnormal causality, construct the execution process causal relationship graph, record the judgment basis for decision points, detect explicit and implicit abnormalities in the execution process, and backtrack from the abnormal node to the root cause node along the causal relationship graph to generate the root cause tracing result. Each semantic behavior record is calculated with a chain hash and a trusted timestamp signature for tamper-proof evidence storage, and an audit evidence storage chain is constructed. An interpretable audit report is generated by selecting a template from a preset report template system based on the audience category. Behavioral patterns are mined from historical execution records to construct a behavioral knowledge base. After updating the anomaly detection rules and the semantic mapping rule base according to the behavioral patterns and audit feedback, the data is fed back to the multi-level behavioral collection probe.

2. The digital employee behavior tracing method according to claim 1, characterized in that, The deployment of multi-level behavior acquisition probes during the execution of digital employee tasks captures multi-granularity behavioral data related to technical operations, data status, system environment, and reasoning processes, and annotates them with associated identifiers, including: In the execution environment of the digital employee, behavior acquisition probes are deployed in the technical operation layer, data state layer, system environment layer and inference process layer. The technical operation layer probes capture interface operations, interface calls and database operations; the data state layer probes capture variable changes and business data snapshots; the system environment layer probes capture the operating environment and resource consumption; and the inference process layer probes capture prompt words, model output and tool calls. The acquisition is triggered before and after the operation and at key nodes by combining event-driven and periodic sampling. The multi-granularity behavioral data is labeled with association identifiers including execution instance identifier, operation sequence number, causal association identifier, and data lineage identifier. The execution instance identifier indicates a complete task execution, the causal association identifier indicates the causal dependency between operations, and the data lineage identifier indicates the evolution relationship of data items at different stages. Based on this, discrete behavioral data can be indexed by sequence and causal association within the same execution instance.

3. The digital employee behavior tracing method according to claim 1, characterized in that, The process of desensitizing the labeled behavioral data according to a unified behavioral record model and mapping the structured technical operations and technical objects to business actions and entities based on a preset semantic mapping rule base to generate semantic behavioral records includes: The labeled behavioral data is organized into structured behavioral records containing record identifiers, behavioral types, behavioral subjects, behavioral objects, behavioral parameters, and behavioral results according to a unified behavioral record model. Coordinated Universal Time (UTC) timestamps are used to unify time expression and record time zone information. Sensitive fields such as ID card numbers and bank card numbers are masked according to preset sensitive rules. The structured behavioral records are checked for sequence continuity and temporal monotonicity integrity. Based on the semantic mapping rule base built from process design metadata, business system metadata, and manual annotation, the technical operations of the structured behavior records are mapped to business actions, technical objects are mapped to business entities, and technical parameters are mapped to business meanings. This generates a hierarchical semantic expression containing operation, activity, and task layers and organizes it into semantic behavior records. For operation tags not covered by the semantic mapping rule base, the original technical description is displayed before rule supplementation is triggered.

4. The digital employee behavior tracing method according to claim 1, characterized in that, The process establishes association edges between operation, data, condition, and state nodes based on the correlation categories of control flow causality, data flow causality, conditional causality, and anomaly causality, constructs a causal relationship graph of the execution process, and records the judgment criteria for decision points, including: The semantic behavior records identify operation nodes, data nodes, condition nodes, and state nodes. Based on the association categories of control flow causality, data flow causality, condition causality, and abnormal causality, association edges containing relationship types and relationship descriptions are established between each node. Control flow causality represents the completion of the previous operation triggering the execution of the next operation, and data flow causality represents the output of the previous operation as the input of the next operation. All association edges are combined to construct a causal relationship graph of the execution process. For the decision points of condition judgment, branch selection and loop control in the causal relationship graph of the execution process, record the decision input, decision rules and decision results, combine the decision input, decision rules and decision results to generate decision interpretation, establish a data lineage chain containing source, transformation and destination for the data items involved in the processing and associate it with the corresponding nodes, so that the judgment basis of any decision point and the data evolution process can be queried along the causal relationship graph.

5. The digital employee behavior tracing method according to claim 1, characterized in that, The process of detecting explicit and implicit anomalies during execution, and tracing back along the causal relationship graph from the anomaly node to the root cause node to generate root cause tracing results, includes: During execution, the system captures and identifies explicit exceptions by capturing thrown errors and failure states. It also identifies implicit exceptions such as operation timeouts, retry limits, data verification failures, and deviations from expected execution paths by using preset threshold conditions. The identified exceptions are classified by system, data, logic, and business type and graded by fatal, severe, general, and warning levels. When an exception occurs, the system collects the exception context, which includes the operation sequence before the exception, variable status, and environmental conditions. The cause-effect graph is traced back layer by layer from the anomaly node to the root cause node. Based on the anomaly type and the anomaly context, a root cause hypothesis is generated, which includes input data, environmental changes, process design and external dependencies. The root cause hypothesis is verified by data validation and historical comparison, and the data impact range and business impact of the anomaly are evaluated. The results are then combined to generate a root cause tracing result that includes anomaly description, root cause analysis and impact assessment.

6. The digital employee behavior tracing method according to claim 1, characterized in that, The process involves calculating chained hashes for each semantic behavior record and attaching a trusted timestamp signature for tamper-proof evidence storage, constructing an audit evidence storage chain, and generating an interpretable audit report by selecting a template from a preset report template system based on the audience category. This includes: The hash of each semantic behavior record is calculated, so that the hash calculation of each record includes the hash value of the previous record to form a hash chain. A trusted timestamp signature is attached to the key records, and the root hash of the hash chain is anchored to a trusted third-party evidence storage platform at a preset period. The audit records are read, written and exported in a hierarchical manner according to role permissions and are prohibited from being deleted during the retention period. The audit evidence storage chain is constructed by associating the original behavior data, semantic interpretation, causal relationship and operation subject. Based on the audience categories of business personnel, technical personnel, auditors, and management, the system selects the corresponding template from the preset report template system, organizes the semantic behavior records, the audit evidence chain, and the root cause tracing results, automatically extracts the execution overview and execution timeline, and generates key operation summaries and decision-making chain descriptions. The system also adds flowchart and cause-effect graph views for visualization, generating an interpretable audit report that supports drill-down and conditional filtering.

7. The digital employee behavior tracing method according to claim 1, characterized in that, The process of constructing a behavior knowledge base by mining behavior patterns from historical execution records, updating anomaly detection rules and the semantic mapping rule base based on the behavior patterns and audit feedback, and then feeding back to the multi-level behavior acquisition probe includes: The normal execution patterns containing operation sequence patterns and abnormal related patterns containing abnormal precursor features are mined from historical execution records. The mined patterns are organized into structured patterns according to triggering conditions, behavior sequences, expected results and confidence levels. Based on the relationship categories of cause, resolution and association, associations are established between operation type, abnormal type and root cause type entities to build a behavioral knowledge base. Based on the abnormality-related patterns in the behavioral knowledge base, the abnormality detection rules are supplemented; based on the historical root cause patterns, the root cause hypothesis generation is improved; based on the audit feedback, the semantic mapping rule base is corrected; the updated rules are validated and the effect indicators before and after the update are compared; after the validation is passed, the updated rules are fed back to the multi-level behavioral acquisition probe and the abnormality detection rule base, forming a continuous learning closed loop of acquisition, mapping, modeling, tracing and updating.

8. A digital employee behavior traceability device, characterized in that, The device includes: The behavior collection module is used to deploy behavior collection probes in the execution environment of digital employees according to the technical operation layer, data status layer, system environment layer and reasoning process layer, capture multi-granularity behavior data and label execution instance identifiers and causal association identifiers, and generate structured behavior records based on a unified behavior record model and desensitize sensitive fields. The semantic mapping module is used to map the technical operations and technical objects of the structured behavior records into business actions and business entities based on the semantic mapping rule library accumulated from process design metadata, business system metadata and manual annotation, and generate semantic behavior records containing operation layer, activity layer and task layer. The causal modeling module is used to read the semantic behavior records, establish correlation edges between operation, data, condition and state nodes based on the correlation categories of control flow causality, data flow causality, condition causality and abnormal causality, construct the causal relationship graph of the execution process, and record the judgment basis and data lineage chain for decision points. The source analysis module is used to detect explicit and implicit anomalies in the execution process and classify and grade them. It traces back from the abnormal node to the root cause node along the causal relationship map of the execution process to generate root cause source analysis results containing root cause analysis and impact assessment. The evidence storage report module is used to calculate the chain hash of each semantic behavior record and attach a trusted timestamp signature to build an audit evidence storage chain. It generates an interpretable audit report based on the audience category, and updates the anomaly detection rules and the semantic mapping rule library by mining behavior patterns from historical execution records, and then feeds back to the behavior collection probe.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the digital employee behavior tracing method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the digital employee behavior tracing method according to any one of claims 1 to 7.

Images