Intelligent auditing method, device, computer storage medium, and electronic device

Abstract

The application discloses an intelligent auditing method and device, a computer storage medium and an electronic device, and relates to the technical field of artificial intelligence. The method comprises the following steps: obtaining structured data corresponding to a target business scenario; mapping the structured data to a data item model according to a field mapping rule to generate standardized data, wherein the field mapping rule is used to uniformly map data from different business systems to standard data defined by the data item model, and the data item model is used to provide a unified data expression specification for different business systems; obtaining a target auditing rule matched with the target business scenario, and dynamically selecting a calculation mode of the standardized data according to a response requirement of the target auditing rule to obtain target data; and evaluating the target data based on the target auditing rule to generate an auditing check result. The application solves the technical problem that the auditing rule and the data structure cannot be accurately adapted in the prior art.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and more specifically, to an intelligent auditing method, apparatus, computer storage medium, and electronic device. Background Technology

[0002] During the digital operation of enterprises, different business systems (such as order systems, payment systems, financial systems, etc.) have different construction cycles, technical architectures and data standards, resulting in significant differences in the structured data generated in terms of field naming, data format and semantic expression.

[0003] When faced with changes in business scenarios or the addition of new data sources, existing audit systems require the redevelopment, testing, and deployment of corresponding data adaptation code, making it difficult to achieve unified expression and reuse of data across systems. Furthermore, due to the lack of unified semantic specifications for data fields across different systems, audit rules often fail to perform evaluations due to misaligned field mappings, thus failing to accurately identify business anomalies and impacting the maintainability and scalability of audit work.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides an intelligent auditing method, apparatus, computer storage medium, and electronic device to at least solve the technical problem that auditing rules and data structures cannot be accurately adapted in the prior art.

[0006] According to one aspect of the embodiments of this application, an intelligent auditing method is provided, comprising: acquiring structured data corresponding to a target business scenario; mapping the structured data to a data item model according to field mapping rules to generate standardized data, wherein the field mapping rules are used to uniformly map data from different business systems to standard data defined by the data item model, and the data item model is used to provide a unified data expression specification for different business systems; acquiring target auditing rules that match the target business scenario, and dynamically selecting a calculation method for the standardized data according to the response requirements of the target auditing rules to obtain target data; and evaluating the target data based on the target auditing rules to generate audit verification results.

[0007] Optionally, the structured data of the target business scenario is obtained, including: collecting raw data generated by multiple business systems in the target business scenario; cleaning and transforming the raw data to obtain structured data corresponding to the target business scenario. The data cleaning includes deduplication, missing value handling, outlier handling, and format standardization of the raw data, while the data transformation includes unstructured data transformation, data association and integration, and data anonymization of the raw data.

[0008] Optionally, before mapping structured data to the data item model according to field mapping rules, the method further includes: defining a general data item, wherein the general data item includes common attributes of the business scenario; constructing a dedicated data item for the target business scenario based on the general data item, and reserving custom data items, wherein the dedicated data item inherits from the general data item and adds business scenario attributes on the basis of the general data item; and constructing a data item model based on the general data item, the dedicated data item, and the custom data item.

[0009] Optionally, after constructing a data item model based on general data items, specific data items, and custom data items, the method further includes: identifying field information of structured data, and performing correlation analysis between the field information and the attribute features of specific data items in the data item model to generate a candidate mapping relationship set; processing the candidate mapping relationship set based on the rule mapping model to output N candidate mapping rules as field mapping rules, wherein the rule mapping model is used to calculate the recommendation weight of each candidate mapping rule based on the historical records of each candidate mapping rule in the candidate mapping relationship set through graph neural networks and attention mechanisms, and sorting all candidate mapping rules in the candidate mapping relationship set in descending order according to the recommendation weight, and outputting the top N candidate mapping rules, where N is a positive integer greater than or equal to 1.

[0010] Optionally, acquiring target audit rules that match the target business scenario includes: collecting a multi-dimensional training dataset, wherein the multi-dimensional training dataset includes historical audit rules, abnormal data records, business process feature data, system data, and rule execution effect data; based on the multi-dimensional training dataset, generating multiple candidate audit rules through an association rule mechanism and a time series model, wherein the association rule mechanism is used to mine data item association conditions under static business logic, the time series model is used to capture the time series evolution pattern of abnormal data, and the candidate audit rules include static rules based on data item association conditions and dynamic rules based on time series evolution patterns; and outputting candidate audit rules that match the target business scenario as target audit rules according to preset business scenario complexity classification conditions, wherein the business scenario complexity classification conditions divide different business scenarios into N levels according to complexity, and assign candidate audit rules corresponding to the complexity according to the level, where N is an integer greater than 1.

[0011] Optionally, the calculation method for standardized data is dynamically selected according to the response requirements of the target audit rule to obtain the target data, including: when the response requirement of the target audit rule is event-triggered mode, the standardized data is continuously calculated to obtain the target data, wherein the event-triggered mode indicates that the calculation task is started within the target duration after receiving the standardized data; when the response requirement of the target audit rule is batch processing mode, the standardized data is calculated within a preset time window to obtain the target data, wherein the batch processing mode indicates that the calculation task is started on all the standardized data accumulated within the preset time window at the end of the preset time window.

[0012] Optionally, based on the target audit rules, the target data is evaluated to generate audit verification results, including: converting the target audit rules into execution condition judgment logic; evaluating each piece of sub-data in the target data using the execution condition judgment logic, marking sub-data that meets the execution condition judgment logic as abnormal sub-data; marking sub-data that does not meet the execution condition judgment logic as normal sub-data; and integrating the abnormal sub-data and normal sub-data to obtain the audit verification results.

[0013] Optionally, after integrating the abnormal sub-data and normal sub-data to obtain the audit verification result, the method further includes: intelligently identifying the sub-data in the target data that is not covered by the target audit rules based on an anomaly identification mechanism to obtain hidden abnormal data. The anomaly identification mechanism is used to detect hidden abnormal data that cannot be covered by the target audit rules by analyzing the numerical distribution characteristics, temporal behavior patterns, and abnormal change information of the correlation fields between sub-data from different business systems of the sub-data not covered by the target audit rules; and adding the hidden abnormal data to the audit verification result.

[0014] Optionally, after adding implicit abnormal data to the audit verification results, the method further includes: classifying and archiving normal sub-data in the audit verification results according to business scenarios to form an audit trajectory, which is used to trace the processing of target data; sending abnormal warning information to the target system for abnormal sub-data in the audit verification results and receiving processing opinions from the target system, wherein the abnormal warning information includes the abnormal type, abnormal cause and related data; performing structured field matching and semantic consistency verification between the processing opinions and the corresponding abnormal sub-data, if the verification passes, associating and archiving the abnormal sub-data and the corresponding processing opinions to form a compliance audit record; if the verification fails, returning the abnormal sub-data and the corresponding processing opinions to the target system for reprocessing.

[0015] Optionally, the intelligent auditing method also includes: statistically analyzing the performance indicators of the audit verification results, and using the performance indicators and processing opinions as incremental training data, wherein the performance indicators include anomaly identification accuracy, false negative rate, and false positive rate; and based on the incremental training data, triggering adaptive optimization of the recommendation mechanism of the target auditing rules and the mapping mechanism of the data item model.

[0016] According to another aspect of the embodiments of this application, an intelligent auditing device is also provided, comprising: an acquisition unit for acquiring structured data corresponding to a target business scenario; a mapping unit for mapping the structured data to a data item model according to field mapping rules to generate standardized data, wherein the field mapping rules are used to uniformly map data from different business systems to standard data defined by the data item model, and the data item model is used to provide a unified data expression specification for different business systems; a calculation unit for acquiring target auditing rules that match the target business scenario, and dynamically selecting a calculation method for the standardized data according to the response requirements of the target auditing rules to obtain target data; and a generation unit for evaluating the target data based on the target auditing rules to generate audit verification results.

[0017] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located performs the above-described intelligent auditing method.

[0018] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors cause the one or more processors to perform the above-described intelligent auditing method.

[0019] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which implement the above-described intelligent auditing method when executed by a processor.

[0020] In this embodiment, a field mapping mechanism based on a unified data item model is adopted. By converting structured data from different business systems into standardized data that conforms to the standard data format defined by the data item model according to preset field mapping rules, the purpose of enabling a single audit rule to adapt to multiple heterogeneous data sources is achieved. This realizes the technical effect of decoupling audit rules from the underlying data structure, thereby solving the technical problem in the prior art that audit rules and data structures cannot be accurately adapted. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0022] Figure 1 This is a flowchart of an optional intelligent auditing method according to an embodiment of this application;

[0023] Figure 2 This is an architecture diagram of an optional intelligent auditing platform system according to an embodiment of this application;

[0024] Figure 3 This is an execution flowchart of an optional intelligent audit system according to an embodiment of this application;

[0025] Figure 4 This is a schematic diagram of an optional intelligent auditing device according to an embodiment of this application. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] According to an embodiment of this application, a method embodiment of an intelligent auditing method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] According to the embodiments of this application, an intelligent auditing system (hereinafter referred to as the system) can be used as the execution subject of the intelligent auditing method of this application embodiment. The intelligent auditing system can be a software system or an embedded system combining software and hardware. Of course, the execution subject of the method in the embodiments of this application can also be other forms of execution subject, such as devices or equipment. Those skilled in the art should know that this application does not particularly limit the specific form of the execution subject of the method.

[0030] Figure 1 This is a flowchart of an optional intelligent auditing method according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0031] Step S101: Obtain structured data corresponding to the target business scenario;

[0032] Optionally, structured data refers to data output by various business systems of an enterprise in the form of fixed fields, such as field records in a database table, which can be directly read by a program.

[0033] Optionally, the system extracts raw data from multiple business systems involved in the target business scenario through a data access component. For example, in a financial audit scenario, it obtains table data containing order information from the order management system and document data of payment transactions from the payment system. The data collection process is configured according to business needs, supporting scheduled extraction or real-time synchronization, which helps the acquired data cover the time and business scope required for the current audit.

[0034] Step S102: According to the field mapping rules, the structured data is mapped to the data item model to generate standardized data. The field mapping rules are used to uniformly map data from different business systems to the standard data defined by the data item model. The data item model is used to provide a unified data expression specification for different business systems.

[0035] Optionally, field mapping rules are a set of manually defined transformation relationships used to explain how the original fields of a business system correspond to standard fields in the data item model. For example, the "total_amount" field in the order system can be mapped to the "order amount" field in the data item model.

[0036] Optionally, field mapping rules include: direct mapping, such as "order_amount" being directly mapped to "order amount"; calculation mapping, such as "price" being multiplied by "quantity" and mapped to "total order amount"; enumeration mapping, such as "pay_status=0" being mapped to "unpaid" and "pay_status=1" being mapped to "paid"; and range mapping, such as "amount" being mapped to "small order" and "large order" according to a range.

[0037] Optionally, the data item model defines the core data items required for all audits in a certain business scenario, as well as their corresponding names, types, and meanings, such as order amount, payment status, customer identifier, etc., without relying on the field naming of any specific system.

[0038] Optionally, the system renames fields, converts units, and normalizes formats for structured data from different business systems according to pre-configured field mapping rules. For example, "order_amount" is uniformly converted to "order amount," and "pay_status=0" is uniformly converted to "payment status=unpaid." The mapping process is executed according to the rules one by one, processing each field in each data record, and finally outputting a set of standardized data whose field names, types, and meanings all conform to the data item model specification, thereby achieving semantic uniformity of data from different business systems.

[0039] Step S103: Obtain the target audit rules that match the target business scenario, and dynamically select the calculation method for the standardized data according to the response requirements of the target audit rules to obtain the target data;

[0040] Optionally, the target audit rules are judgment logic designed for specific business scenarios. For example, if the order amount is greater than 10,000 yuan and the payment status is unpaid, it is marked as abnormal.

[0041] Optionally, response requirements refer to the timeliness requirements of the rule when it is executed, such as whether an immediate response is required or periodic aggregation is allowed.

[0042] Optionally, the system loads the corresponding audit rules from the rule base based on the business scenario associated with the current audit task. When a rule requires an immediate response, the system processes each standardized data point individually, immediately executing rule judgments and generating a single result. When a rule allows batch processing, the system reads all standardized data points within a preset time window, performs aggregation operations, and generates summary data. The system automatically selects between these two methods based on the rule configuration, requiring no manual intervention. This achieves flexible adaptation between audit rules and calculation methods, allowing the same rule to be used for both real-time monitoring and scheduled auditing. This enhances the system's ability to support different business needs and avoids resource waste or response delays caused by rigid calculation methods.

[0043] Step S104: Based on the target audit rules, evaluate the target data and generate audit verification results.

[0044] Optionally, the system compares the target data against each target audit rule. For example, if the target data consists of all order records where "the order amount is greater than 10,000 yuan and the payment status is unpaid," the system checks each record to see if it meets the conditions of the target audit rule. Records that meet the conditions are marked as abnormal, and those that do not are marked as normal. Finally, an audit verification result table containing the processing results of all records is output, recording the judgment status of each data point and the name of the rule on which it was based.

[0045] In one optional embodiment, obtaining structured data for the target business scenario includes: collecting raw data generated by multiple business systems under the target business scenario; cleaning and transforming the raw data to obtain structured data corresponding to the target business scenario, wherein data cleaning includes deduplication, missing value handling, outlier handling, and format standardization of the raw data, and data transformation includes unstructured data transformation, data association and integration, and data anonymization of the raw data.

[0046] Optionally, raw data refers to initial data records directly generated by various business systems that have not yet undergone unified processing. Raw data comes from diverse sources and has different formats, and may come from relational databases, non-relational databases, files, or interfaces, such as tables in the relational database of the order system, documents in the document-based database of the payment system, and CSV files exported from the financial system.

[0047] Optionally, the system configures data collection tasks based on the target business scenario, extracting raw data from different business systems. For example, in a financial audit scenario, order information is periodically extracted from a relational database, and payment transaction changes in a document-based database are monitored in real time. Simultaneously, it supports batch importing manually entered expense reports from Excel files. During the collection process, the system automatically records the source system, collection time, and data volume for each piece of data, forming basic metadata.

[0048] Alternatively, data cleaning is the process of correcting and purifying raw data, including removing duplicate records, filling in invalid values, identifying abnormal values, and standardizing data formats, with the aim of improving data quality.

[0049] Optionally, deduplication refers to identifying and removing identical or duplicate primary key data records; missing value handling refers to reasonably supplementing or marking cases where key fields are empty or invalid; outlier handling refers to identifying and isolating values ​​that violate business logic; and format standardization refers to unifying data units, time formats, encoding methods, etc. from different sources into a consistent standard.

[0050] Optionally, the system proactively constructs a data cleaning engine to process each item of the collected raw data. For duplicate records, they are compared and deleted based on the primary key field; for missing key fields such as amount and time, they are filled using correlated data or median; for values ​​exceeding a reasonable range, they are marked as abnormal and transferred to an abnormal data table for manual verification; for date formats, different formats such as "yyyyMMdd" and "MM / DD / YYYY" are uniformly converted to the standard "yyyy-MM-dd HH:mm:ss"; and monetary units are uniformly converted to avoid calculation errors caused by unit confusion. Through the data cleaning engine, the system improves the accuracy and consistency of the raw data, reduces the risk of misjudgment caused by dirty data, and ensures that subsequent mapping and auditing are based on reliable data.

[0051] Optionally, unstructured data transformation refers to extracting structured information from data without fixed field formats; data association and integration refers to splicing data from different systems through common identifiers according to business logic to form a complete data view; data desensitization refers to processing fields involving personal privacy or sensitive information to retain necessary business information while preventing information leakage.

[0052] Optionally, the system extracts unstructured data, such as text in scanned invoices, by using preset keyword matching to retrieve fields like amount, date, and invoice number, and then converts them into structured fields. For the order and payment systems, the system uses the "order number" as the association key to merge the order amount, customer information, payment status, and payment time into a single record containing the complete transaction history. For sensitive fields such as customer name, ID number, and bank card number, encryption algorithms are used for anonymization, such as replacing "Zhang San" with "Zhang". "Retains the necessary information for identification, but cannot restore the original content."

[0053] Optionally, the system breaks down data silos through the above steps, enabling fragmented information that was originally scattered across multiple business systems to form a complete business chain. This also helps ensure compliance in data usage, allowing unstructured information to be used in a structured way, expanding the data coverage of audits, and the de-identification process also meets the management requirements for data security and privacy protection.

[0054] In an optional embodiment, before mapping structured data to a data item model according to field mapping rules, the method further includes: defining a general data item, wherein the general data item includes common attributes of business scenarios; constructing a dedicated data item for the target business scenario based on the general data item, and reserving custom data items, wherein the dedicated data item inherits from the general data item and adds business scenario attributes on the basis of the general data item; and constructing a data item model based on the general data item, the dedicated data item, and the custom data item.

[0055] Optionally, generic data items refer to data fields that are common in multiple business scenarios, have common semantics and structure, and do not depend on specific business types. Examples include unique identifiers, data creation time, and data source systems. These fields are the basic units for cross-system data interaction within an enterprise.

[0056] Optionally, by sorting out the data fields shared by various business systems, a set of standardized common data items can be extracted and a unified naming convention can be established. For example, "Amount" can be uniformly named "Amount_Yuan", and "Time" can be uniformly named "Time_yyyyMMddHHmmss", to avoid different names such as "total_amount", "order_sum", and "cost".

[0057] Optionally, a dedicated data item refers to a special field that is extended from a general data item for a specific business scenario. Dedicated data items inherit all the attributes of the general data items and add business attributes specific to that scenario. For example, in a financial audit scenario, dedicated fields such as "Invoice Amount_Yuan", "Tax Amount_Yuan", and "Reimbursement Number" are extended from general items such as "Amount_Yuan" and "Time_yyyyMMddHHmmss".

[0058] Optionally, custom data items are reserved extension interfaces that allow users to add non-standard fields according to specific needs, such as "compliance code" or "internal approval number" specific to a certain industry.

[0059] Optionally, in the data item model configuration platform, a target business scenario can be selected, and the system will automatically load general data items as a base. Business personnel can then manually add scenario-specific fields, such as invoice type, payment method, and approval status, specifying the data type, value range, and business meaning of these fields. Simultaneously, the system retains a custom field input area, allowing administrators to temporarily add non-general fields, such as "regional regulatory code," for temporary audit needs without modifying the core model.

[0060] Optionally, the system uses general data items as the first-layer infrastructure, dedicated data items as the second-layer business adaptation layer, and custom data items as the third-layer elastic expansion layer, combining them into a complete data item model through a configuration platform. The model is stored in a tree structure, supporting version management and access control. For example, the financial audit model consists of basic fields, financial-specific fields, and optional custom fields.

[0061] In an optional embodiment, after constructing a data item model based on general data items, specific data items, and custom data items, the method further includes: identifying field information of structured data, and performing correlation analysis between the field information and the attribute features of specific data items in the data item model to generate a candidate mapping relationship set; processing the candidate mapping relationship set based on a rule mapping model to output N candidate mapping rules as field mapping rules, wherein the rule mapping model is used to calculate the recommendation weight of each candidate mapping rule based on the historical records of each candidate mapping rule in the candidate mapping relationship set through a graph neural network and attention mechanism, and sorting all candidate mapping rules in the candidate mapping relationship set in descending order according to the recommendation weight, and outputting the top N candidate mapping rules, where N is a positive integer greater than or equal to 1.

[0062] Optionally, field information refers to metadata characteristics such as the original field name, data type, value range, and example value from the structured data of the business system.

[0063] Optionally, the attribute characteristics of a dedicated data item are the field name, data type, business meaning, and historical usage patterns defined in the data item model for a specific business scenario. For example, in structured data, there is a field named "pay_amt" of type integer with a value range of 0-999999; while the dedicated data item "order amount_yuan" in the data item model has the same data type and business semantics.

[0064] Optionally, the system automatically scans the input structured data and extracts metadata information for all fields, including field names, data types, maximum and minimum values, and null value rate. Then, it compares all fields with the corresponding business-specific data items in the data item model, establishing preliminary mapping relationships based on name similarity, data type consistency, and historical mapping records. For example, if the system finds a high match between "order_total" and "order amount_yuan", it generates a candidate mapping relationship. All possible matching combinations constitute a candidate mapping relationship set, the number of which dynamically changes according to the complexity of the data fields.

[0065] Optionally, the rule mapping model is an analytical model built on historical mapping behavior. It does not directly generate new rules, but evaluates the credibility of current candidate mapping relationships by analyzing past successful mapping cases.

[0066] Optionally, the recommendation weight is a value calculated by the rule mapping model for each candidate mapping rule, reflecting the likelihood that the candidate mapping rule will be adopted by historical users, based on factors such as whether the mapping rule has been successfully used, whether it appears in similar data sources, and whether the field semantics are stable over a long period of time.

[0067] Optionally, the rule mapping model takes historical mapping records as input to construct a relational graph structure containing information such as data source fields, data item model fields, number of successful mappings, and usage frequency. Through a graph neural network, the model analyzes the association paths between fields and data items, identifying which fields frequently co-occur with which data items. Subsequently, an attention mechanism is used to weight each candidate mapping rule, prioritizing those mapping relationships that have been repeatedly verified in similar business scenarios and are semantically stable. The model finally sorts the candidate mapping rules from highest to lowest recommendation weight and outputs the top three candidate mapping rules as recommendations for configuration personnel to refer to and confirm.

[0068] Optionally, the steps for the rule mapping model to generate field mapping rules are as follows:

[0069] Step 1 involves feature extraction and quantification of the data sources (including current and historical data sources), data item models, and relationships to obtain core features. These core features include data source features (type, number of fields, data type, etc., quantified as one-hot encoding or continuous values), data item model features (hierarchical level, business tags, value range, etc.), historical mapping features (mapping success rate, rule type, modification frequency, etc.), and relationship features (historical correlation between the data source and the data item model, similarity of mapping rules for data sources of the same type, and semantic correlation between fields).

[0070] Step 2: Construct a heterogeneous graph model for the graph neural network. The heterogeneous graph model includes three types of nodes (data source nodes, data item model nodes, and mapping rule nodes) and two types of edges (mapping relationship between data source and data item model, and association relationship between data source and historical mapping rule). The weight of the edge is determined by the cosine similarity of the associated features.

[0071] Step 3: Use a graph attention network to aggregate the features of the nodes, and calculate the weights of neighboring nodes through a self-attention mechanism to update the features of the current node. The calculation formula is as shown in formula (1):

[0072] (1)

[0073] in, For the updated features of the i-th node, The features of the i-th node before the update. Let be the attention weight of the j-th node to the i-th node, W be the feature transformation matrix, and σ be the activation function. Let be the set of neighboring nodes of the i-th node.

[0074] Step 4: The feature learning is completed through a two-layer graph attention network, the embedding vectors of each data source node are output, the cosine similarity between the embedding vectors of each data source node is calculated, and the historical data sources corresponding to the pre-selected similarity greater than or equal to 0.75 are selected. The mapping rules associated with the historical data sources are extracted to form a candidate mapping rule pool.

[0075] Step 5: Construct the feature vector of the current data source, the feature vector of the data item model, and the feature vector of the candidate mapping rule in the candidate mapping rule pool. Concatenate the three feature vectors to obtain the fused feature.

[0076] Step 6: Calculate the attention weight of each candidate mapping rule using a fully connected layer and a softmax function, as shown in formula (2):

[0077] (2)

[0078] in, Let R be the attention weight of the Rth candidate rule. , Here is the weight matrix, and b is the bias term. It is a hyperbolic positive activation function. The fusion feature corresponding to the k-th candidate rule is... The fusion feature corresponding to the Rth candidate rule is... It is an exponential function.

[0079] Step 7: Combine attention weights with the success rate of rule historical mapping to calculate the rule recommendation score. The calculation formula is as shown in formula (3):

[0080] (3)

[0081] in, Let R be the recommended score for the Rth candidate rule. To improve the success rate of historical rule mapping, This is a coefficient, with a value of 0.3. The feature vector of the current data source. For historical data source feature vectors, This is the cosine similarity function.

[0082] Optionally, after obtaining the field mapping rules, a visual configuration tool can be invoked to automatically extract sample data to perform mapping tests and verify the mapping accuracy (≥99.8%). If mapping anomalies exist (such as mismatched field types or values ​​exceeding the model range), prompts and correction suggestions will be provided in real time, which helps to make the field mapping rules usable.

[0083] Optionally, after completing the rule configuration, the mapping operation is performed in both real-time and batch modes to obtain the mapped standardized data, which is then stored. Real-time mapping is performed using a streaming computing engine with a latency of less than or equal to 100ms, improving audit timeliness. Batch mapping is performed using a fast computing engine, executed according to a scheduled window. During the mapping process, abnormal mapping data is automatically identified, stored in a temporary table, and alerts are pushed out, allowing technical personnel to investigate and adjust the rules for remapping.

[0084] Optionally, the system uses metadata management tools to manage the entire lifecycle of all field mapping rules, ensuring traceability of origin, destination, and accountability. This lifecycle management includes the following operations:

[0085] 1. Mapping Log Recording: Automatically records the creator, creation time, modification history, and effective time of each mapping rule, as well as the execution log of the mapping rule, such as the daily mapping data volume, mapping success rate, and details of abnormal data;

[0086] 2. Data lineage tracing: Establish a complete data lineage chain, clearly showing the mapping relationship between the original data source fields, the transformed fields, and the data item model fields. When an anomaly occurs in a certain link of the data, the mapping link can be quickly located to find the root cause of the problem.

[0087] 3. Mapping rule version management: Supports version control of mapping rules. Each time a mapping rule is modified, a new version will be generated. Historical versions are retained and can be rolled back at any time to avoid data mapping anomalies due to rule modification errors.

[0088] 4. Access Control: Based on the role-based access control model, different mapping rule operation permissions (such as viewing, adding, modifying, and approving) are assigned to technical personnel, which helps to standardize and ensure the security of mapping rule configuration.

[0089] In some embodiments, the system does not obtain field mapping rules by constructing a graph structure. Instead, it calculates the semantic similarity of field names, data types, and value distributions between the current data source to be mapped and historical data sources based on the mapping records between historical data sources and data item models. Simultaneously, a collaborative filtering method is used to recommend the most frequently matched candidate rules based on the historical behavior of similar data sources being mapped to the same data items. The recommendation results are sorted by similarity score, and the top X rules are selected as candidate mapping rules.

[0090] It should be noted that the above method is suitable for environments with few data source types, small historical mapping record size, limited system resources, and no graph computing framework deployment capability.

[0091] In some embodiments, the system uses data source characteristics (such as data source type, number of fields, field name keywords, and data type distribution), data item model characteristics (business scenario, data item category, and whether it is numerical), and historical mapping success rate as input features to construct a classification model. Decision trees or random forests are used to predict which data item instance the current data source should map to, outputting a list of recommendation rules. Model training uses historical successful mapping records as positive samples and failed or manually corrected records as negative samples.

[0092] It should be noted that the above method is suitable for scenarios that require high model interpretability, avoid graph structure complexity, and have structured labeled data.

[0093] In some embodiments, the system inputs the data source field name, field annotation, and data sample text, along with the data item model's name, business description, and value example text, into a pre-trained text classification model to generate semantic embedding vectors. The cosine similarity between the two sets of vectors is calculated to determine the semantic matching degree between the field and the data item. Candidate pairs with similarity higher than a threshold are ranked based on historical mapping success rates, and recommendation rules are output.

[0094] It should be noted that the above method is suitable for scenarios where the data source fields have messy names, ambiguous semantics, and sufficient labeled samples.

[0095] In one optional embodiment, obtaining target audit rules that match the target business scenario includes: collecting a multidimensional training dataset, wherein the multidimensional training dataset includes historical audit rules, abnormal data records, business process feature data, system data, and rule execution effect data; based on the multidimensional training dataset, generating multiple candidate audit rules through an association rule mechanism and a time series model, wherein the association rule mechanism is used to mine data item association conditions under static business logic, the time series model is used to capture the time series evolution pattern of abnormal data, and the candidate audit rules include static rules based on data item association conditions and dynamic rules based on time series evolution patterns; and outputting candidate audit rules that match the target business scenario as target audit rules according to preset business scenario complexity classification conditions, wherein the business scenario complexity classification conditions divide different business scenarios into N levels according to complexity, and assign candidate audit rules corresponding to the complexity according to the level, where N is an integer greater than 1.

[0096] Optionally, the multidimensional training dataset refers to the M types of structured data systematically collected to construct audit rules, covering rule sources, abnormal behavior, business logic, compliance requirements, and historical usage, which constitute the comprehensive basis for rule generation.

[0097] Optionally, historical audit rules refer to audit rules that have been enabled and recorded in the past, along with their configuration parameters; abnormal data records are cases that have been manually identified as abnormal during the audit process, along with their corresponding context information; business process characteristic data describes typical operation paths and key control points for various business scenarios, such as the "application-approval-payment" process for financial reimbursement; system data comes from the company's internal management systems or industry standards; and rule execution effect data records the accuracy, false alarm rate, omission rate, and usage frequency of each rule in the past.

[0098] Optionally, the audit management department takes the lead in compiling all activated and deactivated audit rules from the past three years and archiving them into a structured rule base; extracting manually confirmed abnormal events from the abnormal event handling system, marking the triggering fields, business processes, and processing results of the abnormal events; sorting through business process documents such as finance, supply chain, and compliance, and extracting key control nodes and data flow logic; converting quantifiable clauses in corporate policy documents into structured conditions; and finally, extracting the operational statistics of each rule from the system logs to form a complete dataset. All data is stored uniformly in a rule training library as the basis for subsequent analysis.

[0099] Alternatively, association rule mechanism is an analytical method used to discover stable co-occurrence relationships between data items.

[0100] Optionally, static rules are fixed judgment conditions based on co-occurrence relationships and do not change over time. Time series models are used to analyze the trends or abnormal clustering patterns of data over time. Dynamic rules are rules generated based on time series patterns and reflect the evolutionary patterns of behavior.

[0101] Optionally, the system first employs an association rule mining algorithm to analyze historical audit rules and abnormal data records, identifying frequently occurring field combinations. For example, the combination of "order amount > 10,000 yuan" and "payment status = unpaid" occurs more than 80% of the time, forming a static rule: "order amount > 10,000 yuan and payment status = unpaid." Simultaneously, a time-series analysis method is used to arrange abnormal data records in chronological order, identifying behavioral patterns such as "number of unpaid orders per customer per day ≥ 2" and "amount increasing for three consecutive days without payment," generating dynamic rules. These two types of rules together constitute a candidate audit rule set, with each rule accompanied by triggering conditions and source evidence.

[0102] Optionally, the business scenario complexity classification criteria are graded based on factors such as the number of steps in the business process, the number of data sources, and the complexity of rule combinations. In this embodiment, they are used to distinguish between basic, medium, and advanced audit scenarios.

[0103] Optionally, the system automatically determines the complexity level of the target business scenario based on its characteristics, such as the number of systems involved, the complexity of data fields, and the number of historical rules. For example, financial reimbursement auditing only requires interfacing with one system and using one rule, and is classified as Level 1; supply chain inbound / outbound cross-auditing involves three systems—purchasing, warehousing, and payment—and requires simultaneous verification of quantity, amount, and time, and is classified as Level 3. Based on the level, the system filters matching rules from the candidate rule set: Level 1 scenarios only push a single static rule, while Level 3 scenarios output a combination of multiple static and dynamic rules, with relationships marked. After final confirmation by business personnel, this set of rules becomes the target audit rule.

[0104] Optionally, the specific steps to obtain the target audit rules are as follows:

[0105] Step 1, Training Data Preparation: Constructing a multi-dimensional training dataset helps ensure data comprehensiveness and effectiveness. Specifically, it includes five categories of data: a historical business audit rule base, including valid and invalid rules, labeled with rule type, applicable scenarios, and configuration parameters; abnormal data records, including historical audit-identified abnormal data and manually labeled abnormal data, labeled with abnormal type, abnormal cause, and related data items; business process feature data, including data categorized by business scenario, such as financial audit and supply chain audit, labeled with core audit indicators, business logic, and data flow paths for each scenario; industry standards and internal corporate regulations data, including financial audit standards and compliance control requirements, converted into quantifiable feature parameters; and rule execution effect data, including annotated anomaly identification accuracy, false positive rate, false negative rate, execution time, and selection frequency for each historical rule.

[0106] Step 2 employs a two-stage training model: first, the association rule mining algorithm is trained; then, the time-series model is trained; and finally, fusion optimization is performed. In the first stage, based on static data in the training data, such as historical rules and data item relationships, the association rule mining algorithm is trained. Minimum support (≥5%) and minimum confidence (≥80%) are set to mine strong association rules between data items (e.g., the association confidence between "order amount > 10,000 yuan" and "unpaid" is ≥85%), generating a candidate set of basic rules for both stages.

[0107] Step 3 introduces fusion weights, where static rules have a weight of 0.6 and time-series rules have a weight of 0.4. The two basic rule candidate sets are then fused and sorted to filter out invalid and redundant rules, forming the final recommendation pool as the accurate rule recommendation result. The classification of audit rules in the recommendation pool follows two hierarchical logics:

[0108] 1. User type classification: Audit rules in the recommendation pool are divided into "general templates" and "refined suggestions". Business novices only see general rules, while senior business personnel see refined rules, avoiding novice users being confused by complex rules and senior personnel wasting time on basic rules.

[0109] 2. Classified by business scenario: The rules in the recommendation pool will be matched according to the categories of "basic scenario, complex scenario, and special scenario". Basic scenario will only push simple rules from the recommendation pool, complex scenario will push combined rules from the recommendation pool, that is, a combination of static and dynamic rules, and special scenario will push customized rules from the recommendation pool, which helps the recommendation results fit the needs of the scenario.

[0110] Optionally, the system constructs an audit rule generation and matching process through a three-step mechanism of "multi-dimensional data collection - rule generation - on-demand recommendation". Based on historical behavior, system requirements, and abnormal cases, it intelligently extracts two types of rules: static and dynamic, and pushes them in a hierarchical manner according to the complexity of business scenarios, thereby reducing the threshold for rule configuration and improving the standardization, systematization and reusability of audit work.

[0111] In some embodiments, a frequent itemsets mining algorithm based on frequent pattern trees is used to mine frequent itemsets of data items in historical audit rule bases and anomaly records. This algorithm constructs a frequent pattern tree, scans the dataset once, and compresses and stores itemset information, directly extracting frequent items without generating candidate sets, thus reducing intermediate computation. A support threshold of ≥5% and a confidence threshold of ≥80% are set, and association rules meeting these conditions are output as a static audit rule candidate set.

[0112] It should be noted that the above method is suitable for scenarios with large amounts of data, complex rule combinations (such as more than 10 fields), and where it is necessary to improve the efficiency of rule mining.

[0113] In some embodiments, the system uses a Transformer model to learn the anomaly evolution patterns of audit data over time. The input is a sequence of historical audit results, and a long-distance dependency is modeled using a self-attention mechanism to predict possible anomaly patterns in future time periods. The output is anomaly rule suggestions with a time window, such as "If the same customer's order amount is >10,000 yuan and unpaid within 2 consecutive days, an alert will be triggered."

[0114] It should be noted that the above method is applicable to scenarios with long time series data (such as historical records exceeding 1000 time points) and anomaly patterns with complex periodic or nonlinear characteristics.

[0115] In some embodiments, the system uses logistic regression to linearly model the static features of data items, outputting the probability of each rule being triggered; then, through a rule tree, rules with probabilities higher than a threshold are filtered and combined hierarchically to form executable audit rules. The nodes of the rule tree are defined manually or automatically, such as "Amount > 10,000 yuan" as the root node and "Payment Status = Unpaid" as the child node, ultimately outputting combined rules.

[0116] It should be noted that the above method is suitable for scenarios with relatively simple business rules, few data dimensions (such as ≤8 fields), and where it is desirable to avoid training complex models.

[0117] In some embodiments, the system constructs a heterogeneous graph of three types of nodes: data items, exception types, and business scenarios. The edges between nodes are defined by historical rule application relationships (e.g., "abnormal invoice amount" often appears in the "financial audit" scenario). A graph embedding method is used to represent the nodes as low-dimensional vectors. By calculating the vector similarity between the business scenario to be identified and historical scenarios, audit rules that are semantically similar to the business scenario to be identified are recommended.

[0118] It should be noted that the above method is applicable to scenarios with a wide variety of business scenarios and implicit relationships between rules and scenarios (such as overlap between "supply chain audit" and "financial audit" in certain rules). This method can uncover non-explicit rule relationships, but it requires the construction and maintenance of a graph structure, and is highly dependent on data quality and graph construction rules.

[0119] In one optional embodiment, the calculation method for standardized data is dynamically selected according to the response requirements of the target audit rule to obtain target data, including: when the response requirements of the target audit rule are in event-triggered mode, the standardized data is continuously calculated to obtain target data, wherein the event-triggered mode indicates that the calculation task is started within a target duration after receiving the standardized data; when the response requirements of the target audit rule are in batch processing mode, the standardized data is calculated within a preset time window to obtain target data, wherein the batch processing mode indicates that the calculation task is started on all the standardized data accumulated within the preset time window at the end of the preset time window.

[0120] Optionally, the event-triggered mode means that the execution of audit rules is driven by the arrival of data events rather than fixed time points, which is suitable for scenarios with high timeliness requirements.

[0121] Optionally, the target duration is the latency tolerance time defined in the rule configuration. For example, after receiving a new piece of data, the system needs to complete the calculation and output the result within 1 second to support real-time monitoring.

[0122] Optionally, when the target audit rule is configured in event-triggered mode, the system continuously monitors the input stream of standardized data. Whenever a new standardized data record arrives, the system immediately starts a timer. If no update or conflict information for that data is received within the set target time period (e.g., less than or equal to 100ms), the system immediately executes the audit rule logic based on that data. For example, if the rule is "Order amount_yuan>10000 and payment status=unpaid", after receiving a record that meets this condition, the system completes the judgment within 100ms, marks it as abnormal, and generates target data for use by the early warning module.

[0123] Optionally, batch processing mode refers to audit tasks that do not rely on individual data triggers, but instead process all data accumulated within a specific time period after the period ends. This mode is suitable for scenarios where timeliness requirements are not high, but comprehensive statistics are required.

[0124] Optionally, the preset time window is a period set by business personnel, such as 1 a.m. to 2 a.m. every day, or 11 p.m. to 0 a.m. every Friday, for centralized processing of massive amounts of data.

[0125] Optionally, when the target audit rule is configured for batch processing, the system continuously receives and caches standardized data within a preset time window, without immediately performing calculations. Once the time window ends, the system reads all the data accumulated during that period at once and executes the rule logic centrally. For example, for the rule "daily cumulative reimbursement amount exceeds the budget," the system summarizes all reimbursement records from the previous day at 2:00 AM, calculates the total amount for each employee, and outputs the target data that meets the overspending criteria.

[0126] Optionally, the system differentiates between event-triggered and batch processing modes to achieve precise adaptation between audit calculation methods and business requirements. Event-triggered mode facilitates the timely detection of critical anomalies, while batch processing mode supports the stable operation of global and periodic analyses. Both automatically select execution strategies based on rule response requirements, avoiding resource waste or response delays caused by a one-size-fits-all approach to calculations.

[0127] In one optional embodiment, the target data is evaluated based on the target audit rules to generate an audit verification result, including: converting the target audit rules into execution condition judgment logic; evaluating each piece of sub-data in the target data using the execution condition judgment logic, marking sub-data that meets the execution condition judgment logic as abnormal sub-data; marking sub-data that does not meet the execution condition judgment logic as normal sub-data; and integrating the abnormal sub-data and normal sub-data to obtain the audit verification result.

[0128] Optionally, the execution condition judgment logic transforms the target audit rules from natural language or configuration text into structured judgment expressions that can be directly parsed and executed by a computer, such as the logical expression: Amount > 10000 ∧ Payment Status == 'Unpaid'.

[0129] Optionally, the system receives the target audit rule selected by the user and, according to preset syntax specifications, converts the target audit rule into a set of Boolean logical expressions that can be parsed by the program. For example, the rule "Customer ID is in the banned list and order amount exceeds 5000 yuan" is converted to: Customer ID ∈ Banned List ∧ Order Amount _ Yuan > 5000. This logical expression does not depend on a specific data source and is only related to standardized field names, which helps to ensure consistent execution under different data inputs.

[0130] Optionally, sub-data refers to each independent record in the target data, such as an order record or a payment transaction. Abnormal sub-data is a single data record that, after evaluation, is determined to violate the target audit rules. Normal sub-data refers to a single data record that does not violate the target audit rules.

[0131] Optionally, the system reads each sub-data item in the target data one by one and substitutes it into the execution condition judgment logic generated in the previous step for judgment. For example, if the field value of a certain sub-data item is: order amount_yuan=12000, payment status=unpaid, the system judges according to the logical expression. If the condition is true, the record is marked as abnormal sub-data. All records that meet the conditions are grouped into the abnormal list, and the original field value of the abnormal sub-data and the triggering rule number are recorded.

[0132] Optionally, after evaluating all sub-data, the system will categorize records not marked as abnormal as normal sub-data. Subsequently, the abnormal and normal sub-data will be merged in their original order or by business identifier to form a structured audit verification result file. This file includes fields such as a unique identifier for each data entry, judgment status, triggering rule, and occurrence time, for use in subsequent audits, archiving, or process linkage. During the verification process, multiple rules can be executed in parallel.

[0133] In an optional embodiment, after integrating the abnormal sub-data and normal sub-data to obtain the audit verification result, the method further includes: intelligently identifying the sub-data in the target data that is not covered by the target audit rules based on an anomaly identification mechanism to obtain hidden abnormal data. The anomaly identification mechanism is used to detect hidden abnormal data that cannot be covered by the target audit rules by analyzing the numerical distribution characteristics, temporal behavior patterns, and abnormal change information of the correlation fields between sub-data from different business systems of the sub-data not covered by the target audit rules; and adding the hidden abnormal data to the audit verification result.

[0134] In an optional embodiment, after adding implicit abnormal data to the audit verification results, the method further includes: classifying and archiving the normal sub-data in the audit verification results according to business scenarios to form an audit trajectory, which is used to trace the processing of the target data; sending abnormal warning information to the target system for abnormal sub-data in the audit verification results and receiving processing opinions from the target system, wherein the abnormal warning information includes the abnormal type, abnormal cause and associated data; performing structured field matching and semantic consistency verification between the processing opinions and the corresponding abnormal sub-data, and if the verification passes, associating and archiving the abnormal sub-data and the corresponding processing opinions to form a compliance audit record; if the verification fails, returning the abnormal sub-data and the corresponding processing opinions to the target system for reprocessing.

[0135] Optionally, the audit trail records the complete path information of each piece of data from input, processing to final result, including metadata such as data source, processing time, rules used, and judgment result.

[0136] Optionally, the system categorizes each normal sub-data item in the audit verification results into the corresponding business scenario's archive directory based on its business type. For example, all normal order data that passes financial audit are uniformly categorized into the "Financial Audit - Normal Records" folder, with additional record fields: original data source system, processing time, executed audit rule number, and verification status as passed. The system establishes a complete and traceable data processing archive through the audit trajectory, helping to ensure that every transaction or operation deemed normal is traceable.

[0137] Optionally, the target system refers to the downstream system responsible for business processing or approval, such as a financial reimbursement system or an order management system.

[0138] Optionally, the anomaly warning information is a notification proactively pushed by the system, including the type of anomaly, its cause, and the relevant raw data fields. The handling opinion is a description of the action filled in by the business personnel in the target system, such as: "The customer has been notified of payment"; "Data entry error, request for cancellation."

[0139] Optionally, after identifying abnormal sub-data, the system generates an early warning message in a preset format, including the abnormality type, cause, and associated data fields, and sends it to the corresponding target system via the system interface. Upon receiving the warning, the user on the target system fills in their feedback and submits it on their interface. The system receives this feedback and binds it to the original abnormality record.

[0140] Optionally, the system automatically checks whether each processing opinion contains required fields; if any are missing, it is deemed to be inappropriately formatted. Simultaneously, it compares the processing content with the reason for the anomaly. For example, if the anomaly reason is "multiple large unpaid amounts from the same customer in a single day," while the processing opinion is "payment has been chased," without specifying whether subsequent actions are controlled, it is considered semantically incomplete. If both checks pass, the system associates the anomaly sub-data, warning information, and processing opinion, storing them in the compliance audit record database. If any check fails, the system returns the record to the target system with the message "Processing opinion is incomplete or inconsistent with the anomaly; please provide supplementary information."

[0141] In one optional embodiment, the intelligent auditing method further includes: statistically analyzing the performance indicators of the audit verification results, and using the performance indicators and processing opinions as incremental training data, wherein the performance indicators include anomaly identification accuracy, false negative rate, and false positive rate; and based on the incremental training data, triggering adaptive optimization of the recommendation mechanism of the target auditing rules and the mapping mechanism of the data item model.

[0142] Optionally, performance indicators are quantitative evaluation data of the audit system's operational effectiveness, including anomaly identification accuracy (the proportion of correctly identified anomalies out of all actual anomalies), false negative rate (the proportion of actual anomalies that were not identified), and false positive rate (the proportion of normal data that was incorrectly marked as anomalies).

[0143] Optionally, incremental training data refers to feedback information added on top of the original rules and mapping mechanisms to improve system performance.

[0144] Optionally, after each audit task is completed, the system automatically extracts statistical information from the verification results: total data volume, number of anomalies, actual number of anomalies after manual confirmation, number of correctly marked anomalies, and number of incorrectly marked normal data. It then calculates three indicators: accuracy, false negative rate, and false positive rate. Simultaneously, the system collects processing suggestions corresponding to all anomaly data, binds them to the original anomaly records, and forms structured records. This data is periodically aggregated and stored as new input data in the incremental data pool.

[0145] Optionally, the system automatically initiates an optimization process when it detects that the incremental training data has reached a preset scale. The recommendation mechanism increases the recommendation weight of relevant rules in similar scenarios based on frequently occurring anomaly patterns in the new data; the mapping mechanism enhances its ability to match similar fields based on feedback regarding field misuse. The optimization process only adjusts the rule recommendation order or mapping matching threshold, without modifying the core logic. This allows for the continuous evolution of rules and mapping mechanisms, enabling the system to automatically adapt to changes in business: rules become increasingly closer to real risks, mappings match fields more accurately, and the burden of manual configuration is reduced.

[0146] Figure 2 This is an architecture diagram of an optional intelligent auditing platform system according to an embodiment of this application. Figure 2 As shown, the intelligent audit platform system includes a basic foundation layer, a core business layer, and an application layer. The basic foundation layer includes a data platform and an AI platform; the core business layer includes a data access module, a data cleaning and transformation module, a data mapping module, a rule recommendation module, a data calculation module, an audit verification module, and a result feedback module; the application layer includes a front-end and a back-end.

[0147] Figure 3 This is an execution flowchart of an optional intelligent audit system according to an embodiment of this application. Figure 3As shown, the intelligent audit system first collects heterogeneous data sources from multiple systems within the enterprise through the data access module. Then, it uses the data cleaning and transformation module to clean and transform the heterogeneous data sources, obtaining structured data. Next, the data mapping module configures field mapping rules, and uses these rules to accurately map the structured data to the system's unified data item model, resulting in standardized data. The rule recommendation module then generates business audit rules adapted to the current business scenario. The data calculation module performs audit calculations using these business audit rules and the mapped standardized data, yielding calculated data. Finally, the audit verification module matches and verifies the calculated data against the audit rules configured by business personnel, identifying abnormal data in the business process and obtaining the audit verification results. Finally, the result feedback module provides categorized feedback on the audit verification results.

[0148] Figure 4 This is a schematic diagram of an optional intelligent auditing device according to an embodiment of this application. According to another embodiment of this application, an intelligent auditing device is also provided, including: an acquisition unit 401, a mapping unit 402, a calculation unit 403, and a generation unit 404.

[0149] The system includes: an acquisition unit 401 for acquiring structured data corresponding to the target business scenario; a mapping unit 402 for mapping the structured data to a data item model according to field mapping rules to generate standardized data, wherein the field mapping rules are used to uniformly map data from different business systems to standard data defined by the data item model, and the data item model is used to provide a unified data expression specification for different business systems; a calculation unit 403 for acquiring target audit rules that match the target business scenario, and dynamically selecting the calculation method for the standardized data according to the response requirements of the target audit rules to obtain target data; and a generation unit 404 for evaluating the target data based on the target audit rules to generate audit verification results.

[0150] Optionally, the acquisition unit 401 includes: a collection subunit for collecting raw data generated by multiple business systems in the target business scenario; and a processing subunit for cleaning and transforming the raw data to obtain structured data corresponding to the target business scenario. The data cleaning includes deduplication, missing value handling, outlier handling, and format standardization of the raw data. The data transformation includes unstructured data transformation, data association and integration, and data anonymization of the raw data.

[0151] Optionally, the intelligent auditing device further includes: a definition unit for defining general data items, wherein the general data items include common attributes of business scenarios; a first construction unit for constructing exclusive data items for target business scenarios based on the general data items, and reserving custom data items, wherein the exclusive data items inherit from the general data items and add business scenario attributes on the basis of the general data items; and a second construction unit for constructing a data item model based on the general data items, exclusive data items, and custom data items.

[0152] Optionally, the intelligent auditing device further includes: a first processing unit, used to identify field information of structured data and perform correlation analysis between the field information and the attribute features of exclusive data items in the data item model to generate a candidate mapping relationship set; and a second processing unit, used to process the candidate mapping relationship set based on a rule mapping model and output N candidate mapping rules as field mapping rules, wherein the rule mapping model is used to calculate the recommendation weight of each candidate mapping rule based on the historical records of each candidate mapping rule in the candidate mapping relationship set through a graph neural network and attention mechanism, and sort all candidate mapping rules in the candidate mapping relationship set in descending order according to the recommendation weight, and output the top N candidate mapping rules, where N is a positive integer greater than or equal to 1.

[0153] Optionally, the computing unit 403 includes: a collection subunit for collecting a multidimensional training dataset, wherein the multidimensional training dataset includes historical audit rules, abnormal data records, business process feature data, system data, and rule execution effect data; a generation subunit for generating multiple candidate audit rules based on the multidimensional training dataset through an association rule mechanism and a time series model, wherein the association rule mechanism is used to mine data item association conditions under static business logic, the time series model is used to capture the time series evolution pattern of abnormal data, and the candidate audit rules include static rules based on data item association conditions and dynamic rules based on time series evolution patterns; and a matching subunit for outputting candidate audit rules that match the target business scenario as target audit rules according to preset business scenario complexity classification conditions, wherein the business scenario complexity classification conditions divide different business scenarios into N levels according to complexity, and assign candidate audit rules corresponding to the complexity according to the level, where N is an integer greater than 1.

[0154] Optionally, the calculation unit 403 further includes: a first calculation subunit, used to continuously calculate the standardized data to obtain target data when the response requirement of the target audit rule is an event-triggered mode, wherein the event-triggered mode indicates that the calculation task is started within a target duration after receiving the standardized data; and a second calculation subunit, used to perform calculation on the standardized data within a preset time window to obtain target data when the response requirement of the target audit rule is a batch processing mode, wherein the batch processing mode indicates that the calculation task is started on all the standardized data accumulated within the preset time window at the end of the preset time window.

[0155] Optionally, the generation unit 404 includes: a transformation subunit for transforming the target audit rules into execution condition judgment logic; an evaluation subunit for evaluating each piece of sub-data in the target data using the execution condition judgment logic, marking sub-data that meets the execution condition judgment logic as abnormal sub-data, and marking sub-data that does not meet the execution condition judgment logic as normal sub-data; and an integration subunit for integrating the abnormal sub-data and normal sub-data to obtain the audit verification result.

[0156] Optionally, after integrating the abnormal sub-data and normal sub-data to obtain the audit verification result, the method further includes: intelligently identifying the sub-data in the target data that is not covered by the target audit rules based on an anomaly identification mechanism to obtain hidden abnormal data. The anomaly identification mechanism is used to detect hidden abnormal data that cannot be covered by the target audit rules by analyzing the numerical distribution characteristics, temporal behavior patterns, and abnormal change information of the correlation fields between sub-data from different business systems of the sub-data not covered by the target audit rules; and adding the hidden abnormal data to the audit verification result.

[0157] Optionally, the intelligent audit device further includes: a third processing unit, used to classify and archive normal sub-data in the audit verification results according to business scenarios to form an audit trajectory, which is used to trace the processing process of the target data; a fourth processing unit, used to send abnormal warning information to the target system for abnormal sub-data in the audit verification results and receive processing opinions from the target system, wherein the abnormal warning information includes the abnormal type, abnormal cause and related data; and a fifth processing unit, used to perform structured field matching and semantic consistency verification between the processing opinions and the corresponding abnormal sub-data. If the verification passes, the abnormal sub-data and the corresponding processing opinions are associated and archived to form a compliance audit record; if the verification fails, the abnormal sub-data and the corresponding processing opinions are returned to the target system for reprocessing.

[0158] Optionally, the intelligent auditing method further includes: a statistical unit, used to statistically analyze the performance indicators of the audit verification results and use the performance indicators and processing opinions as incremental training data, wherein the performance indicators include anomaly identification accuracy, false negative rate and false positive rate; and an optimization unit, used to adaptively optimize the recommendation mechanism of the target auditing rules and the mapping mechanism of the data item model based on the incremental training data.

[0159] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located performs the above-described intelligent auditing method.

[0160] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors cause the one or more processors to perform the above-described intelligent auditing method.

[0161] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which implement the above-described intelligent auditing method when executed by a processor.

[0162] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0163] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0164] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0165] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0166] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0167] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0168] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An intelligent auditing method, characterized in that, include: Obtain structured data corresponding to the target business scenario; According to the field mapping rules, the structured data is mapped to the data item model to generate standardized data. The field mapping rules are used to uniformly map data from different business systems to the standard data defined by the data item model. The data item model is used to provide a unified data expression specification for different business systems. Obtain target audit rules that match the target business scenario, and dynamically select the calculation method for the standardized data according to the response requirements of the target audit rules to obtain target data; Based on the target audit rules, the target data is evaluated, and audit verification results are generated.

2. The method according to claim 1, characterized in that, Obtain structured data for the target business scenario, including: Collect raw data generated by multiple business systems in the target business scenario; The original data is cleaned and transformed to obtain structured data corresponding to the target business scenario. The data cleaning includes deduplication, missing value handling, outlier handling, and format standardization of the original data. The data transformation includes unstructured data transformation, data association and integration, and data anonymization of the original data.

3. The method according to claim 1, characterized in that, Before mapping the structured data to the data item model according to the field mapping rules, the method further includes: Define common data items, wherein the common data items include common attributes of the business scenario; Based on the general data items, a dedicated data item is constructed for the target business scenario, and a custom data item is reserved. The dedicated data item inherits from the general data item and adds business scenario attributes on the basis of the general data item. A data item model is constructed based on the general data items, the specific data items, and the custom data items.

4. The method according to claim 3, characterized in that, After constructing the data item model based on the general data items, specific data items, and custom data items, the method further includes: Identify the field information of the structured data, and perform correlation analysis between the field information and the attribute features of the exclusive data items in the data item model to generate a candidate mapping relationship set; The candidate mapping relationship set is processed based on the rule mapping model, and N candidate mapping rules are output as field mapping rules. The rule mapping model is used to calculate the recommendation weight of each candidate mapping rule based on the historical record of each candidate mapping rule in the candidate mapping relationship set through graph neural network and attention mechanism, and sort all the candidate mapping rules in the candidate mapping relationship set in descending order according to the recommendation weight, and output the first N candidate mapping rules, where N is a positive integer greater than or equal to 1.

5. The method according to claim 1, characterized in that, Obtaining target audit rules that match the target business scenario includes: Collect a multidimensional training dataset, which includes historical audit rules, abnormal data records, business process feature data, system data, and rule execution effect data; Based on the multidimensional training dataset, multiple candidate audit rules are generated through an association rule mechanism and a time series model. The association rule mechanism is used to mine data item association conditions under static business logic, and the time series model is used to capture the time series evolution pattern of abnormal data. The candidate audit rules include static rules based on the data item association conditions and dynamic rules based on the time series evolution pattern. Based on the preset business scenario complexity classification conditions, candidate audit rules that match the target business scenario are output as target audit rules. The business scenario complexity classification conditions divide different business scenarios into N levels according to complexity, and assign candidate audit rules corresponding to the complexity according to the level. N is an integer greater than 1.

6. The method according to claim 1, characterized in that, Based on the response requirements of the target audit rules, the calculation method for the standardized data is dynamically selected to obtain the target data, including: When the response requirement of the target audit rule is an event-triggered mode, the standardized data is continuously calculated to obtain the target data. The event-triggered mode indicates that after receiving the standardized data, the calculation task is started within the target duration. When the response requirement of the target audit rule is in batch processing mode, the standardized data is calculated within a preset time window to obtain the target data. The batch processing mode indicates that at the end of the preset time window, a calculation task is started on all the standardized data accumulated within the preset time window.

7. The method according to claim 1, characterized in that, Based on the target audit rules, the target data is evaluated to generate audit verification results, including: Transform the target audit rules into execution condition judgment logic; For each piece of sub-data in the target data, the execution condition judgment logic is applied for evaluation. Sub-data that meets the execution condition judgment logic is marked as abnormal sub-data; sub-data that does not meet the execution condition judgment logic is marked as normal sub-data. The abnormal sub-data and the normal sub-data are integrated to obtain the audit verification result.

8. The method according to claim 7, characterized in that, After integrating the abnormal sub-data and the normal sub-data to obtain the audit verification result, the method further includes: For sub-data in the target data that are not covered by the target audit rules, intelligent identification is performed based on an anomaly identification mechanism to obtain hidden anomaly data. The anomaly identification mechanism is used to detect hidden anomaly data that cannot be covered by the target audit rules by analyzing the numerical distribution characteristics, temporal behavior patterns, and abnormal change information of the correlation fields between sub-data from different business systems of the sub-data that are not covered by the target audit rules. The hidden abnormal data is added to the audit and verification results.

9. The method according to claim 8, characterized in that, After adding the hidden anomaly data to the audit verification result, the method further includes: For the normal sub-data in the audit verification results, they are classified and archived according to business scenarios to form an audit trajectory. The audit trajectory is used to trace the processing of the target data. For the abnormal sub-data in the audit verification results, send abnormal warning information to the target system and receive the processing opinions fed back by the target system, wherein the abnormal warning information includes the abnormal type, abnormal cause and related data; The processing opinions are matched with the corresponding abnormal sub-data using structured field matching and semantic consistency verification. If the verification passes, the abnormal sub-data and the corresponding processing opinions are associated and archived to form a compliance audit record. If the verification fails, the abnormal sub-data and the corresponding processing opinions are returned to the target system for reprocessing.

10. The method according to claim 9, characterized in that, The method further includes: The performance indicators of the audit and verification results are statistically analyzed, and the performance indicators and the processing opinions are used as incremental training data. The performance indicators include anomaly identification accuracy, false negative rate, and false positive rate. Based on the incremental training data, the adaptive optimization of the recommendation mechanism of the target audit rules and the mapping mechanism of the data item model is triggered.

11. An intelligent auditing device, characterized in that, include: The acquisition unit is used to acquire structured data corresponding to the target business scenario; The mapping unit is used to map the structured data to the data item model according to the field mapping rules to generate standardized data. The field mapping rules are used to uniformly map data from different business systems to the standard data defined by the data item model. The data item model is used to provide a unified data expression specification for different business systems. The calculation unit is used to obtain target audit rules that match the target business scenario, and dynamically select the calculation method for the standardized data according to the response requirements of the target audit rules to obtain target data; The generation unit is used to evaluate the target data based on the target audit rules and generate audit verification results.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device on which the computer-readable storage medium is located performs the intelligent auditing method according to any one of claims 1 to 10.

13. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the intelligent auditing method according to any one of claims 1 to 10.

14. A computer program product, characterized in that, It includes a computer program or instructions that, when executed by a processor, implement the intelligent auditing method according to any one of claims 1 to 10.

Images