A proxy accounting risk management method for financial data anomaly detection

Abstract

The application relates to the technical field of data processing, and discloses a proxy accounting risk control method for financial data anomaly detection. The method obtains a document of a proxy accounting subject and converts the document into a feature vector, and constructs a directed multigraph in a graph database. A network connected component is extracted to generate a routing signature, and abnormal data flow is isolated into sandbox memory according to a signature modification message queue partition key. An anti-fake tax control interface is called to obtain an invoicing timestamp, and a summary accounting voucher is disassembled into an atomic event sequence. An in-memory first-in-first-out token bucket is established, a compliance verification ratio is generated by calculating a physical flow transfer time lag difference in combination with the invoicing timestamp, and an object relationship mapping interceptor is used to split a document amount according to the ratio, a persistent statement is rewritten to redirect a risky amount to an isolated transition account, and an external automatic tax reporting communication link is controlled according to an account balance state. The application restores a bottom-layer document micro time sequence, and realizes abnormal computing power isolation and bottom-layer blocking of high-risk tax reporting data.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a method for risk management of outsourced bookkeeping in detecting financial data anomalies. Background Technology

[0002] Accounting agencies typically centrally manage the independent accounting systems of numerous small and medium-sized enterprises (SMEs). Their daily operations involve the entry and accounting of massive amounts of VAT invoices, inbound and outbound documents, and cash flow records. To mitigate tax compliance risks, the platform needs to perform financial data anomaly detection on transactions between multiple entities. Identifying irregularities such as cross-enterprise fraudulent invoicing, wash trading, and fund looping is a core aspect of the risk control system for accounting agencies.

[0003] Existing bookkeeping systems generally use basic message middleware for data flow and distribution. All companies' bookkeeping instructions and invoice data are queued and polled in the same underlying queue. In practice, accounting staff typically perform batch summary bookkeeping at the end of the month, merging multiple real transactions from different dates into a single accounting voucher. Upon receiving the bookkeeping instructions from the upper layer, the underlying database framework generates fixed persistent write statements. The amount on legally valid invoices is considered an indivisible whole and is directly and fully recorded in standard accounting accounts such as inventory or main business revenue. When the preset tax declaration period arrives, the system's tax filing module periodically reads the summarized balances of these accounts and automatically uploads the declaration message to the tax bureau via an external network interface.

[0004] However, existing risk management technologies for outsourced accounting suffer from significant delays in the entry of legitimate invoices into regular accounting systems when their computing resources are heavily consumed by risk control tasks. Month-end summary accounting operations lead to a collapse in the granularity of underlying data. The system captures all document entry times as a uniform end-of-period accounting date, resulting in the loss of the micro-issue sequence of individual invoices. For irregular transactions such as instantaneous reciprocal invoicing and inverted sales / inventory, which violate normal warehousing and circulation patterns, the system loses the benchmark parameters for calculating physical flow delays. Existing risk warnings are limited to application-level alerts. Risky amounts and compliant funds are mixed within the same business category, lacking mandatory underlying numerical separation and storage isolation. Therefore, this invention provides a method for risk management of outsourced accounting based on the detection of financial data anomalies to address the shortcomings of existing technologies. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a risk management method for outsourced accounting based on the detection of financial data anomalies. This method solves the problems of existing outsourced accounting systems, which often suffer from loss of underlying data timing accuracy due to batch aggregation accounting operations when handling multi-entity accounts, making it difficult to accurately calculate the physical flow delay of goods. Furthermore, it addresses the lack of an interception mechanism during the data persistence writing stage for cross-enterprise abnormal transactions, resulting in risky accounting data being directly recorded in standard accounting subjects and uploaded through the automatic tax filing interface, making it difficult to achieve physical isolation of the underlying data and block external communication links.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for risk management of outsourced bookkeeping in detecting financial data anomalies, comprising the following steps: The original documents and cash flow data of multiple enterprises are obtained and transformed into feature vectors containing document amounts and product identification codes. A directed multigraph is then constructed in the graph database engine with the enterprise entities as nodes and the feature vectors as edge attributes. Within the directed multigraph, a subgraph matching algorithm is executed to extract connected components that satisfy the set network topology characteristics, and a corresponding route signature is generated for the connected components using a cryptographic hash function. Modify the partition key of the message queue according to the routing signature, drive the data flow containing the connected component nodes to the high-risk sandbox memory queue, and call the anti-counterfeiting tax control application interface to obtain the invoice timestamp, and decompose the summary accounting voucher in the high-risk sandbox memory queue into an atomic event sequence; A first-in-first-out token bucket is established in the memory database for the product identification code. Virtual tokens are generated using the input documents in the atomic event sequence and pushed into the first-in-first-out token bucket. When processing the sales documents, the corresponding number of virtual tokens are pulled from the first-in-first-out token bucket and the physical flow time delay difference is calculated in combination with the invoice timestamp to generate the compliance verification ratio. Based on the compliance verification ratio, the document amount is divided, and the accounting subject code of the persistent write statement is modified through the object relational mapping interceptor. The risky amount is redirected to the isolated transition account, and the communication link of the external automatic tax filing interface is controlled according to the balance status of the isolated transition account.

[0007] Preferably, the construction of a directed multigraph in the graph database engine, with enterprise entities as nodes and the feature vectors as edge attributes, further includes: Structured information is extracted from the original documents and fund flow data and transformed into feature vectors. The feature vectors include document entry timestamps, document amounts, commodity identification codes, flow direction attributes, and the absolute physical quantity of the commodity. Extract the unified social credit code of each enterprise participating in the transaction as the unique identifier of the node in the directed multigraph, and use the unique identifier to match the entities and establish the association relationship between cross-enterprise accounts; Based on the flow direction attribute in the feature vector, a directed edge from the shipper node to the receiver node is established within the graph database engine, and the feature vector as a whole is mounted and persisted as the attribute data of the corresponding directed edge.

[0008] Preferably, the step of generating a corresponding routing signature for the connected components using a cryptographic hash function further includes: A traversal search is performed within the constructed global directed multigraph. By comparing the network path hop limit, document amount decay rate, and node in-degree warning threshold, network regions with closed-loop or star-shaped cluster topology features are extracted and constructed as connected components. Extract the unified social credit codes of all participating nodes within the connected component, arrange them in lexicographical order, and then concatenate them sequentially with the feature vector attributes corresponding to the relevant directed edges to form source text data used to characterize a specific network topology. The constructed source text data is input into a preset encrypted hash operation model to perform hash operation, and the generated fixed-length feature string is output as the routing signature for controlling the underlying data splitting.

[0009] Preferably, before the connected components construct the source text data, the following steps are further included: The total number of nodes covered by the extracted connected components is verified simultaneously to determine whether the actual calculated total number of nodes exceeds the system's preset single-processing capacity limit. When the total number of nodes exceeds the single processing capacity limit, the connected components are divided into multiple independent sub-connected components that meet the memory capacity conditions based on the modularity algorithm.

[0010] Preferably, the step of calling the anti-counterfeiting tax control application interface to obtain the invoice timestamp and decomposing the summary accounting vouchers in the high-risk sandbox memory queue into atomic-level event sequences further includes: Intercept data streams generated by abnormal connectivity components, overwrite the partition key in the original message encapsulation header of the data stream with the previously generated routing signature, recalculate the target shard index using the underlying routing component of the message middleware, and isolate the data stream to a high-risk sandbox memory queue. The number of external attachments associated with a document record is checked within the high-risk sandbox memory queue. When the number of external attachments exceeds the preset summary judgment threshold, the document is confirmed to have entered a state of accounting granularity collapse and the current database write transaction is suspended. The anti-counterfeiting tax control application interface is called through the communication protocol to send a data retrieval request, obtain the real invoice details behind the suspended write transaction and the invoice timestamp, and use the invoice details to reconstruct the summary accounting voucher that has lost the real time sequence precision into an independent atomic event sequence.

[0011] Preferably, the step of establishing a first-in-first-out (FIFO) token bucket for the product identification code in the memory database, generating virtual tokens using the input documents in the atomic event sequence, and pushing them into the FIFO token bucket further includes: Extract the unified social credit code of the target enterprise participating in the business flow and concatenate it with the commodity identification code. Use the generated composite feature string as a unique key name to establish a first-in-first-out token bucket with boundary isolation attributes in the memory database. Traverse the reconstructed atomic-level event sequence. When the document flow direction is identified as an incoming business, extract the absolute physical quantity of the goods recorded in the incoming document as a weight parameter to generate a composite virtual token. The invoice timestamp of the corresponding input document is written as an attribute tag into the virtual token for binding, and the virtual token carrying the attribute tag is pushed into the tail of the first-in-first-out token bucket queue to perform a stack operation.

[0012] Preferably, the step of generating the compliance verification ratio further includes: When a document with a sales transaction direction is received, the corresponding first-in-first-out token bucket is located based on the unique key name. Virtual tokens with a cumulative weight value equal to the number of sales documents are extracted from the head of the queue of the first-in-first-out token bucket, and the weight of the head token is dynamically deducted and split. Obtain the invoice timestamp corresponding to the sales invoice, and subtract the invoice timestamp written as attribute tags in each of the extracted virtual tokens to calculate the single physical flow time delay difference value for restoring the actual goods flow time. The calculated physical flow delay difference is substituted into the dynamically set flow delay safety range for logical comparison. The ratio of the total weight of the virtual tokens that are judged to be compliant to the total weight of the virtual tokens extracted in this sales request is collected, and a compliance verification ratio for quantifying compliance is generated based on the ratio.

[0013] Preferably, when extracting virtual tokens with a cumulative weight value equal to the number of sales documents from the head of the first-in-first-out token bucket queue, an anomaly audit interception mechanism is driven by the inventory status verification and comparison results: The total weight balance of existing virtual tokens inside the located first-in-first-out token bucket is obtained in real time, and it is determined whether the total weight balance meets the retrieval quantity requirement of the corresponding sales document application. When the total weight balance is less than the required quantity and triggers an inventory gap, an overdraft token with a specific identifier is generated for the difference part to make up the shortage. The generated overdraft token is written into the inventory inversion exception label, and the overdraft token is excluded from the calculation process of the physical transfer time lag difference for independent review.

[0014] Preferably, splitting the document amount according to the compliance verification ratio, modifying the accounting subject code of the persistent write statement through an object-relational mapping interceptor, and redirecting the risky amount to an isolated transition subject further includes: Extract the total tax-inclusive amount, tax-exclusive principal, and tax amount values in the original accounting instruction, multiply them by the compliance verification ratio, and use the operation logic of retaining decimal places and subtraction as a fallback to losslessly split each amount value in the original accounting instruction into a compliance value part and a corresponding risky amount part; When constructing the persistent write statement for database execution in the application business layer, trigger the object-relational mapping interceptor at the system bottom layer, extract the standard business accounting subject code originally recorded, and rewrite the persistent write statement using the abstract syntax tree parsing mechanism; Using the rewritten syntax tree structure, continue to map the parameters containing the compliance value part to the standard business accounting subject code, and redirect and map the parameters bound with the risky amount part to a preset isolated transition subject and then submit them to the database for execution.

[0015] Preferably, controlling the communication link of the external automatic tax filing interface according to the balance status of the isolated transition subject further includes: Before reaching the preset declaration node and triggering the network external tax filing timing task, independently send a query request for the isolated transition subject to the underlying database to obtain the end balance status data of the enterprise entity; When it is determined that the balance status of the obtained isolated transition subject is greater than zero, trigger the permission control service to revoke the tax filing identity authentication token resident in the corresponding enterprise entity, and send an access control policy to the underlying gateway to cut off the physical communication link connecting to the external automatic tax filing interface; After receiving the manual review instruction and the database update feedback that the write-off adjustment of the isolated transition subject makes the balance status zero, automatically resume issuing the tax filing identity authentication token and revoke the access control policy of the underlying gateway to restore the communication link.

[0016] The present invention provides an agency bookkeeping risk control method for financial data anomaly detection. It has the following beneficial effects: 1. This invention generates routing signatures by extracting connected components with topological characteristics from a graph database, and modifies the partition key of a message queue based on these signatures, directing the data streams generated by the corresponding nodes to a high-risk sandbox memory queue. Based on the sharding index recalculation of the underlying message middleware, it achieves underlying memory isolation between abnormal data and regular accounting data without changing the upper-level architecture of the agency accounting application. This avoids the subsequent high-frequency time-series unpacking calculations consuming the system computing power of the main business link, ensuring the stability of the regular accounting processing flow.

[0017] 2. This invention obtains genuine invoice details and invoice timestamps by calling the anti-counterfeiting tax control application interface. It then decomposes the aggregated accounting vouchers, which suffer from granular collapse, into atomic-level event sequences and calculates the physical flow time lag difference of purchase and sales documents within an established FIFO token bucket. This extracts the true micro-time-series data masked by manual month-end batch consolidation accounting, restoring static financial aggregated amounts to a unidirectional commodity flow process with strict time benchmarks. This provides accurate data support for objectively verifying the time consumption of physical warehousing and circulation of goods.

[0018] 3. This invention utilizes an object-relational mapping interceptor and an abstract syntax tree parsing mechanism to rewrite persistent write statements. Based on the compliance verification ratio, it splits the invoice amount and redirects the risky portion to an isolated transition account. Based on the balance status of this account, it cuts off the communication link with the external automatic tax filing interface. This design moves the traditional application-layer post-verification to the database's underlying write stage, implementing physical network link blocking before internal accounting data is automatically filed with the external tax terminal, forcibly triggering manual auditing, and achieving a closed-loop risk management system from amount segmentation to network connectivity control. Attached Figure Description

[0019] Figure 1 This is a system architecture diagram of the present invention; Figure 2 This is a flowchart of the method steps of the present invention; Figure 3 This is a ROC curve comparing the anomaly detection performance of the present invention. Figure 4 This is a bar chart comparing the system throughput and memory consumption of the present invention. Figure 5 This is a histogram showing the distribution of token bucket time delay difference values ​​according to the present invention.

[0020] The module includes: 10. Data acquisition and mapping module; 20. Topology identification module; 30. Routing isolation and unpacking module; 40. Time delay verification module; and 50. Redirection and blocking module. Detailed Implementation

[0021] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] See attached document Figure 1 , Figure 1 This is a system architecture diagram according to an embodiment of the present invention. The present invention provides a risk management system for agency bookkeeping with financial data anomaly detection, which may include: a data acquisition and mapping module 10, a topology identification module 20, a route isolation and unpacking module 30, a time delay verification module 40, and a redirection and blocking module 50.

[0023] The data acquisition and mapping module 10 is configured to connect to the agency bookkeeping business terminal to obtain the original documents and cash flow data of the agency bookkeeping entity. It converts the original documents and cash flow data into feature vectors containing document entry timestamps, document amounts, product identification codes, and flow directions. It also constructs a directed multigraph in the graph engine. The nodes of the directed multigraph represent the enterprise entities participating in the transaction, and the edges represent the business flow between entities.

[0024] The topology identification module 20 is communicatively connected to the data acquisition and mapping module 10. It is used to perform subgraph isomorphic matching operations in a directed multigraph, identify connected components that satisfy the set network topology characteristics, extract the set of nodes and edges in the connected components, and generate routing signatures for the connected components using a cryptographic hash function.

[0025] The routing isolation and unpacking module 30 is communicatively connected to the topology identification module 20. It is used to modify the partition key of the message middleware according to the routing signature. By modifying the partition key, the data stream generated by the corresponding node is directed to the isolated memory queue. It also calls the anti-counterfeiting tax control application interface. Based on the invoicing flow and timestamp data returned by the anti-counterfeiting tax control application interface, it performs virtual event sequence penetration unpacking on the summary accounting voucher in the isolated memory queue, and decomposes the summary accounting voucher into an atomic-level event sequence with invoicing timestamp.

[0026] The time delay verification module 40 is communicatively connected to the routing isolation and unpacking module 30. It is used to establish a first-in-first-out token bucket for the product identification code in the memory database, convert the input documents into virtual tokens and push them into the first-in-first-out token bucket. The virtual tokens are bound to the corresponding invoice timestamps. When the output documents are received, the module pulls the corresponding number of virtual tokens from the first-in-first-out token bucket, calculates the physical flow time delay difference between the output document occurrence time and the invoice timestamp bound to the virtual token, and generates the compliance verification ratio for this output transaction based on the physical flow time delay difference.

[0027] The redirection and blocking module 50 communicates with the time-delay verification module 40 to obtain the compliance verification ratio and divide the document amount when generating persistent write statements. It uses the object-relational mapping interceptor to modify the accounting subject code of the persistent write statement, maps the amount of different division ratios to the standard business accounting subject and the preset isolation transition subject respectively, and obtains the balance status of the isolation transition subject in the database. When the balance status is greater than zero, it revokes the tax filing identity authentication token of the corresponding enterprise entity in the system and cuts off the communication link of the external automatic tax filing interface.

[0028] See attached document Figure 2 , Figure 2 This is a flowchart illustrating a method for risk management in outsourced bookkeeping based on the detection of financial data anomalies according to an embodiment of the present invention. The present invention provides a method for risk management in outsourced bookkeeping based on the detection of financial data anomalies, comprising the following steps: S100: Obtain original documents and cash flow data of multiple enterprises, and map the extracted structured features to the node and edge attributes of a directed multigraph in the graph database. S200 executes a subgraph matching algorithm within a directed multigraph to locate connected components that meet the set topological feature conditions and outputs the routing signatures of the connected components. S300 receives the routing signature and modifies the partition key of the message queue to isolate the data stream. It retrieves invoice data through an external interface and performs physical time-series restoration and unpacking on the data for which accounting summary has occurred. S400 establishes a first-in-first-out token bucket for product identification coding, performs push and pop operations on the unpacked atomic-level documents, calculates the flow lag by comparing the timestamps of sales and purchases, and generates a compliance verification ratio. S500 replaces accounting subject codes in the object-relational mapping layer based on the compliance verification ratio and controls the start and stop of the external tax reporting communication interface based on the numerical status of the isolated transition subject.

[0029] Regarding step S100, in this embodiment, to break the physical isolation of a single enterprise's accounting system, the data acquisition and mapping module 10 is configured to connect to the agency accounting business terminal, thereby acquiring original documents and cash flow data from multiple entities. Specifically, since the agency accounting system typically deploys accounting databases for multiple independent enterprises, the data acquisition and mapping module 10 can cross the boundaries of a single enterprise's accounting system and perform global data extraction. As a preferred approach, original documents include value-added tax invoices and inbound / outbound documents, while cash flow data includes detailed records of income and expenditure from bank statements.

[0030] For extracting unstructured text information from original documents and financial transaction data, those skilled in the art can use existing optical character recognition algorithms and regular expression matching techniques to parse structured data. The process of using computer vision and natural language processing for text structuring is well-known in the field and will not be elaborated upon here. To avoid data loss due to document corruption or entry omissions that could lead to anomalies in subsequent graph calculations, the system performs field integrity checks after parsing, removing or marking abnormal records lacking key fields, thereby ensuring the logical completeness of the data mapping process.

[0031] After acquiring structured data, to facilitate efficient processing by the underlying graph computation engine, the data acquisition and mapping module 10 transforms it into standardized multidimensional feature vectors. The system independently establishes a corresponding feature vector for each underlying business flow event, defining a single business flow event as... The constructed feature vector is represented as Its matrix representation structure is as follows: ; In the formula, This represents the absolute timestamp of the document entry into the bookkeeping agency system. It is used to characterize the system time when the bookkeeping agent submits the bookkeeping instruction on the terminal device. Its value is automatically obtained by the system clock of the terminal or server. This represents the total amount including tax recorded in the document, and its value is a floating-point number greater than zero. The unique product identification code corresponding to the business flow is used. The product identification code adopts the tax classification code under the standard classification of the tax system or the inventory unit code of the enterprise, and is usually stored in string format. This attribute represents the direction of business flow. It is configured as a binary number, with a value of 1 indicating the input flow documents of the enterprise entity and a value of 0 indicating the output flow documents of the enterprise entity. It represents the absolute physical quantity of the goods recorded in the document, which is determined by extracting the corresponding value from the document details and is usually a positive real number.

[0032] Based on the feature vectors established above, the data acquisition and mapping module 10 constructs a cross-entity directed multigraph in the underlying graph database engine. Since a single graph structure cannot reflect frequent transactions, the graph database engine adopts a storage system that supports attribute graph models, enabling the directed multigraph to be represented as a global network graph in the underlying data structure. The set of nodes in the global network graph. Representing the participating corporate entities, the data collection and mapping module 10 extracts the unified social credit code of each corporate entity as the unique identifier of the network graph node, and then establishes the entity association relationship between cross-corporate accounts through unique identifier matching.

[0033] The set of edges in the global network graph Records of business transactions between business entities. Specific to the two business nodes where the transaction occurred. and , in satisfying Under these conditions, the data acquisition and mapping module 10 uses the flow direction attribute in the feature vector. Within the graph engine, directed edges are established from the shipper node to the recipient node. Considering that multiple transactions often occur between enterprises in real-world business environments, the directed multigraph data structure allows multiple directed edges to be established between identical node pairs based on transaction frequency. Finally, the data acquisition and mapping module 10 constructs the feature vectors... The entire data is mounted and persisted as attribute data of directed edges, completing the physical mapping of discrete financial data to the underlying multidimensional network topology data structure, thereby providing complete underlying data support for subsequent topology model recognition.

[0034] Regarding step S200, in this embodiment, to detect potential abnormal transaction associations in enterprise accounting transactions, the topology identification module 20 is configured to perform in-depth topology scanning within the graph engine. Considering the significant consumption of system computing resources by global graph scanning, the system adopts a mechanism combining incremental data threshold triggering and periodic scheduled tasks to perform subgraph isomorphic matching operations within the previously constructed directed multigraph, thereby achieving a balance between detection real-time performance and system computing load.

[0035] To accurately locate abnormal transaction links, the system predefines a set of high-risk network topology features. As a preferred approach, this set includes two lower-level feature structures: closed-loop topology and star-cluster topology. For the detection of closed-loop topology, the system traverses the graph nodes to find directed paths with overlapping start and end points, and evaluates the number of connected hops on these paths. Does it meet the requirements? In the formula This represents the preset maximum number of loop jumps, typically set to 3 or 4 based on the common link length for wash trading in the industry. Further, the system extracts the amount values ​​of the documents corresponding to the first and last edges on the directed path to calculate the attenuation rate. Attenuation rate The calculation formula is configured as follows: ; In the formula, This represents the total amount of the documents at the starting edge of the directed path. This represents the total amount of the documents at the end of the line. If the judgment result satisfies... Then it is locked as a closed-loop feature, where This indicates the system's allowed threshold for tolerating monetary losses, typically set to 0.05 to cover normal tax cost deviations.

[0036] In addition to loopback, the system also performs star topology detection to address the common risk of virtual invoice aggregation in proxy accounting. Specifically, the system analyzes the in-degree and out-degree distribution of each node and identifies abnormal nodes based on the following judgment logic: ; In the formula, The in-degree statistics representing the target node are usually mapped to the number of input invoices or the number of inflows of funds for that enterprise. The out-degree statistics for this node are mapped to the number of sales invoices or the number of outflowing funds. The preset in-degree warning threshold for aggregation, The threshold value for the out-of-range warning is set based on the historical normal transaction frequency distribution range of the target company's industry. When the above judgment logic is met, the system determines that it meets the abnormal clustering characteristics.

[0037] For the specific subgraph matching process of retrieving the aforementioned preset high-risk topological features in a directed multigraph, those skilled in the art can use the existing VF2 algorithm or Ullmann algorithm. The operational logic of using depth-first search and state space tree to determine subgraph isomorphism is a well-known technology in the field and will not be elaborated here.

[0038] After successfully matching a network region that meets the set topological characteristics, the system needs to implement precise data flow isolation for that region. The topology identification module 20 extracts the successfully matched local network structure from the global directed multigraph and marks it as an abnormal connected component. This component contains all the associated enterprise nodes that constitute a specific high-risk feature, as well as the set of directed edges between nodes that carry business attributes. Considering that extremely complex clustered topologies may lead to an excessively large graph structure extracted in a single operation, which could cause an algorithm dead zone due to memory overflow in subsequent processing, the system simultaneously verifies the total number of nodes in the connected component during the extraction phase. When the total number of nodes exceeds the system's set single processing capacity limit, a community detection algorithm based on modularity or edge weight is invoked to reduce the dimensionality and segment the massive connected region, dividing it into multiple independent sub-connected components, thereby ensuring the stability and logical integrity of the overall system processing flow.

[0039] To provide a definitive basis for data routing control to the underlying message middleware, the topology identification module 20 uses a cryptographic hash function to generate route signatures for the extracted abnormal connected components. In the specific calculation process, the module extracts the unified social credit codes of all participating nodes within the abnormal connected component, arranges them lexicographically, and combines them sequentially with the timestamps and monetary attributes of the relevant directed edges to form a feature string, thus creating the source text that identifies this feature structure. The system inputs the source text into a preset cryptographic hash function. The algorithm performs a hash operation and outputs a fixed-length string as the routing signature for that connected component. The formula for this calculation process is expressed as follows: ; In the formula, The source text data representing the abnormally connected components of the input. This represents the generated signature. Cryptographic hash function. The SHA-256 message digest algorithm can be preferred to ensure that the route signature has a high degree of uniqueness and collision resistance. This route signature is finally output to the underlying flow control gateway as a unique deterministic instruction identifier for subsequent implementation of mandatory physical isolation operations for data flows.

[0040] Regarding step S300, in this embodiment, the route isolation and unpacking module 30 is configured to receive the route signature output by the pre-topology scan and perform data flow interception and reconstruction based on the communication protocol at the underlying level. Conventional agency accounting systems typically rely on the default polling strategy of message middleware or hash calculation based on the enterprise's unified social credit code for data distribution. This approach can mix potentially high-risk abnormal data with regular accounting data in the same memory queue, which can easily lead to subsequent high-complexity deep verification consuming excessive computing resources and causing blockage of the main business link. In order to achieve physical isolation of underlying data without increasing physical server hardware, when the data gateway captures a new financial data stream generated by a node belonging to the abnormal connectivity component, it forcibly intercepts its write process to the main merging queue by embedding an interceptor component on the message producer side.

[0041] Based on this, the route isolation and unpacking module 30 executes a low-level message fragmentation isolation mechanism based on route signatures. Specifically, the system extracts the original message encapsulation header of the intercepted data stream and modifies its default partition key to the route signature generated in the preceding steps. Based on the modified partition key, the underlying routing component of the message middleware recalculates the target storage shard, with the calculation logic configured as follows: ; In the formula, This represents the recalculated physical index of the target isolation partition; Hash functions built into message middleware; This represents the total number of high-risk sandbox memory queue nodes pre-defined by the system, and its value is configured based on the available memory capacity of the cluster nodes. By forcibly overwriting the partition key at the message sending level, the system accurately directs high-risk data streams generated by specific nodes to dedicated high-risk sandbox memory queues. Without changing the transparency of upper-layer applications, this achieves physical-level hard isolation between underlying computing resources and regular business operations, thereby reserving independent memory space for subsequent high-frequency time-series unpacking calculations.

[0042] After data enters the high-risk sandbox memory queue, the system performs a granularity collapse judgment on accounting entries. In actual outsourced accounting scenarios, finance personnel often use batch summary accounting at the end of the month, merging multiple transactions from different dates into a single accounting voucher. This manual operation causes the system-entered timestamps in the structured feature vector of the documents to lose the accuracy of the actual business occurrence time, making the originally scattered transactions appear to have occurred all at the same time at the data level.

[0043] To identify this state, the system extracts the number of external counterparties associated with a single document record in the sandbox queue or the number of underlying original invoice attachments and records them as follows: This value is obtained by parsing the attachment association table corresponding to the voucher in the bookkeeping agency system database, and its value is a non-negative integer. The system configuration includes a preset summary judgment threshold. Considering the principle of recording each transaction individually in standard financial accounting, this threshold is usually set to 1.

[0044] Based on the different results of the above determinations, the system executes differentiated time base calibration and unpacking strategies. For cases where no accounting granularity collapse is determined... For document records, the system directly utilizes existing structured parsing results to uniformly replace the system-entered timestamp parameter in the feature vector with the accurate physical invoicing time recorded on the original document, ensuring that all documents sent to the subsequent time delay verification module 40 maintain absolute physical consistency on the time axis.

[0045] When the system detects When the system determines that the underlying data has experienced granular collapse in its accounting entries and the original system-entered timestamps have become invalid, it triggers an instruction to suspend the current database write transaction. For the suspended summary accounting vouchers, the routing isolation and unpacking module 30 calls the underlying anti-counterfeiting tax control application interface to perform virtual event sequence penetration unpacking. The system carries the authentication password of the agency accounting entity and the accounting cycle parameters of the suspended voucher, and sends a data retrieval request to the underlying ledger database through the external interface to obtain the anti-counterfeiting serial numbers and precise invoicing timestamp data of all underlying genuine invoices covered by the summary voucher. For the specific implementation of calling third-party interfaces through external communication networks to obtain structured messages in a specific format, those skilled in the art can use the standard Hypertext Transfer Security Protocol combined with an Extensible Markup Language parsing library. Its communication interaction logic is a well-known technology in the field and will not be elaborated here. To avoid the centralized retrieval of the anti-counterfeiting tax control interface causing rate limiting and circuit breaking of the external State Taxation Administration's API interface, the system has built a leaky bucket algorithm in the interface call layer to shape and control the number of concurrent requests, ensuring that the peak of retrieval requests in a short period of time is always within the maximum throughput threshold allowed by the external system.

[0046] After obtaining the underlying invoice details, the system stores the collapsed original feature vector in memory. Forced disassembly and reconstruction are performed. The system bases its decisions on the number of returned actual invoice details. The original summary record was torn into A virtual event sequence is formed by constructing a subset of independent atomic-level events. The specific mathematical expression of the reconstruction is: ; In the above sequence, each atomic event vector Configured as .in, This indicates that the anti-counterfeiting tax control interface returned the first... The absolute physical invoice timestamp of each invoice, accurate to the second, restores the true moment of business occurrence that was obscured by the aggregation process. and These correspond to the amount and quantity of goods in each of the split invoices. To ensure data conservation and algorithmic logic integrity during the unpacking process, the system performs mandatory verification after unpacking to ensure... and .

[0047] If the verification fails or the interface call times out, the system marks the summary voucher as unpacking abnormal and moves it to a dead-letter queue awaiting manual intervention, thereby preventing the algorithm logic from entering a dead zone. After the above-mentioned penetrating unpacking and reconstruction, the system successfully restored the high-resolution time axis base, providing reliable atomic data support for the subsequent accurate measurement of microscopic physical time delays.

[0048] Regarding step S400, in this embodiment, the time-delay verification module 40 is configured to receive the atomic-level event sequence after unpacking the preceding sequence and perform compliance verification in memory by simulating the flow sequence of physical goods. In the commodity circulation process, from the supplier issuing an input invoice to realize the goods entering the warehouse, to the customer issuing an output invoice to realize the goods leaving the warehouse, there is bound to be a certain physical retention and storage time. Abnormal transactions in the agency bookkeeping scenario often manifest as input and output invoices being issued in a very short time, or the phenomenon of sales before purchase occurring. In order to objectively identify this physical characteristic at the data level, the time-delay verification module 40 executes a virtual token stacking mechanism based on commodity identification codes in the memory database.

[0049] Considering the red-ink invoice reversal behavior in the bookkeeping business, such as purchase or sales returns, the system identifies the red-ink reversal flag of documents during the preprocessing stage to ensure the monotonicity of the directed flow of the subsequent time-delay verification network. For reverse business records marked in red, the system treats them as independent exception adjustment items and bypasses them directly to the manual review and audit ledger, without including them in the subsequent automated calculation chain of token bucket push and pop, thus avoiding underlying array out-of-bounds and negative time-delay dead zones. At the same time, for regular document records that were determined not to have experienced bookkeeping granularity collapse in the previous steps, the system directly uses the existing structured parsing results to uniformly replace the system input timestamp parameter in the feature vector with the accurate physical invoicing time recorded on the original document, ensuring that all documents sent to the time-delay verification module 40 maintain absolute physical consistency on the time axis.

[0050] As a preferred approach, the in-memory database employs a Redis component based on key-value pair storage to support high-concurrency read and write operations. The time-latency verification module 40 extracts the unified social credit code of the target enterprise participating in the business flow and the corresponding commodity identification code of the document, concatenating them into a string. This combined feature string serves as the unique key, establishing an independent first-in-first-out (FIFO) token bucket structure for each type of commodity within each enterprise entity. This dimensional constraint ensures that the FIFO queue is strictly limited to the physical boundaries of a single legal entity, avoiding verification disorder caused by cross-enterprise data flow of similar commodities. To avoid memory overflow issues caused by generating discrete tokens one by one due to the large number of commodity transactions, the system iterates through the input atomic event vectors. When a document is determined to be an incoming transaction, the absolute physical quantity of the document record is extracted and directly used as a weight parameter to construct a composite virtual token with weight attributes, rather than mechanically breaking it down into a large number of single tokens.

[0051] To address potential non-integer measurement issues in actual business operations, the system performs a rounding operation on the quantity field based on the basic unit of measurement before conversion, ensuring that the generated token weight value is always a positive integer. Each composite virtual token generated by the conversion is bound to an attribute tag that records the precise physical invoicing timestamp of the corresponding input document. After completing the above encapsulation, the system pushes these composite virtual tokens carrying the invoicing timestamp attribute into the tail of the first-in-first-out token bucket queue corresponding to the product identification code, completing the virtual stacking operation of the input goods.

[0052] After the basic data structure is constructed, the time lag verification module 40 triggers the token popping and physical flow time lag calculation program based on the sales transaction data received by the system. When the time lag verification module 40 receives an atomic document marked as a sales transaction, the system extracts the quantity of the goods in the document and the invoicing timestamp of the current sales transaction. The time lag verification module 40 locates the corresponding first-in-first-out token bucket based on the enterprise and product composite key name, and continuously pulls composite virtual tokens with a cumulative weight value equal to the sales quantity from the head of the queue; during the pulling process, the weight of the composite tokens at the head of the queue is dynamically deducted or split according to the required quantity. Considering the extreme cases of incomplete historical data import in the early stage of agency accounting or insufficient inventory due to pre-sales by enterprises, the system is configured with a token overdraft protection mechanism. When the total weight of the existing virtual tokens in the bucket is less than the requested quantity, the system fills the gap with overdraft tokens with a specific identifier, marks it as an abnormal inventory inversion state for auditing, and avoids zero timestamps polluting normal time lag statistics.

[0053] For each successfully retrieved regular virtual token, the system calculates the physical transfer time lag difference. This calculation logic is configured as follows: ; In the formula, Indicates the first The physical flow time delay difference corresponding to each segmented and retrieved virtual token; This indicates the precise invoicing timestamp corresponding to the sales document that triggered the pull operation; Indicates the first Each virtual token is bound to a corresponding invoice timestamp for an incoming transaction. This calculation process reconstructs the physical time it takes for goods to flow through the enterprise from warehousing to outgoing.

[0054] After obtaining the time delay difference, the time delay verification module 40 enters the physical baseline interval verification and compliance verification ratio output stage. The system configures corresponding physical time delay safety intervals for different categories of product identification codes. Regarding the method for determining this safe range, the system extracts the turnover time data of the target company or its peer companies during the historical period without tax violations, and dynamically sets the lower limit threshold by calculating the mean and standard deviation of normal samples. With upper limit threshold Lower threshold This represents the reasonable time required to complete logistics transportation and warehousing, and is usually set as a constant greater than zero to eliminate instantaneous invoicing characteristics lacking actual logistics support; upper limit threshold. This corresponds to the limit of a normal business turnover cycle.

[0055] The system will calculate each result Substitute the values ​​into the safe range for logical comparison. If The system determines whether the underlying product circulation process corresponding to the virtual token conforms to normal physical laws and marks its status as compliant; conversely, if the time lag difference falls outside the range, it determines that there is a risk of abnormal reversals or outdated data and marks its status as abnormal. The time lag verification module 40 counts the number of weights contained in the tokens marked as compliant in a single sales transaction, and generates a compliance verification ratio based on the ratio of this number to the total weight of the tokens retrieved in that sales transaction. The logical expression for generating the compliance verification ratio is as follows: ; In the formula, This represents the calculated compliance verification ratio, and its value ranges from [value missing]. Floating-point numbers between; This represents the total weight of the virtual tokens that were determined to be compliant in this verification. This represents the total number of token weights retrieved for this sales transaction request. Furthermore, for summary-type accounting instructions reconstructed through the preceding unpacking steps, after verification, the system divides the sum of compliant token weights from all atomic events under that summary instruction by the total outbound quantity corresponding to that summary document to calculate an overall comprehensive compliance verification ratio. This single comprehensive compliance verification ratio is output and persistently stored as a quantitative verification indicator. It serves as the sole proportional coefficient for subsequent amount segmentation and dynamic redirection of accounting subjects for the entire macro-summary document, thereby eliminating the mapping gap between micro-unpacking and macro-persistence statements.

[0056] In this embodiment, the redirection and blocking module 50 is configured to obtain the compliance verification ratio generated in the preceding steps and perform ratio-based document amount splitting and dynamic redirection of accounting subjects at the underlying level. In standard bookkeeping services, the monetary information carried by a statutory invoice is an indivisible atomic structure from a tax perspective. In order to achieve refined risk control and data isolation in the system's internal accounting logic, the redirection and blocking module 50 performs logical splitting operations on the invoice amount before generating the final persistent write statement.

[0057] To avoid database rollback due to violations of the double-entry bookkeeping principle, the system extracts the total amount including tax from the documents. Principal excluding tax and the corresponding tax amount and combined with compliance verification ratio Perform synchronous segmentation. Considering that floating-point multiplication is prone to loss of decimal precision, potentially causing a logical dead zone where the total amount after segmentation differs from the original document amount, the system employs a calculation method combining retaining a specific number of decimal places with a fallback subtraction to generate the corresponding amounts for the compliant and risky portions. The calculation formula is configured as follows: ; ; In the formula, Represents logarithmic values The system performs rounding operations and mandates two decimal places. It applies the same rounding and subtraction fallback logic to both the tax-exclusive principal and tax amount, calculating the compliant principal, risky principal, compliant tax amount, and risky tax amount respectively. Through these calculations, the system accurately breaks down a legally mandated invoice into two parts at the numerical processing level: normal business accounting and potential risk isolation, while strictly ensuring the balance of debits and credits in each part after the split.

[0058] After obtaining the specific values ​​after segmentation, the system then enters the dynamic account mapping stage of intercepting persistent write statements. Since conventional bookkeeping software generates fixed persistent write statements through the underlying object-relational mapping framework when processing bookkeeping instructions, defaulting to recording in standard business accounting accounts, this system, as a preferred approach, registers a dedicated interceptor component at the object-relational mapping layer. When the business layer generates a persistent write statement for this document, the interceptor component captures the statement and its bound parameter objects before they are submitted to the database engine for execution.

[0059] The system extracts the standard accounting subject codes from the original written statement. Furthermore, the persistent write statement is rewritten in a structured manner using abstract syntax tree parsing technology. The redirection and blocking module 50 not only expands the original single record insertion instruction into an independent write instruction with two entries, but also simultaneously splits and remaps the underlying bound parameter list.

[0060] In the reconstructed syntax tree, the system will include compliant amounts. The parameter objects continue to be mapped to standard business accounting items. Simultaneously, dynamically replace the accounting subject code of another branch, which will include the amount at risk. The parameter object is redirected and mapped to a preset isolated transition subject. This isolated transitional account is separate from regular profit and loss and asset accounts in the company's accounting system, and is specifically used to settle abnormal cash flows that cannot pass the time lag verification.

[0061] After completing the statement rewriting and parameter binding, the interceptor persists the modified statement and submits it to the database for execution. For the specific code implementation of SQL statement interception and abstract syntax tree rewriting based on the object-relational mapping framework, those skilled in the art can use existing MyBatis interceptors or Hibernate event listener mechanisms. The technical means of modifying the execution-time SQL statement using the framework's underlying interception proxy pattern are well-known in the field and will not be elaborated upon here.

[0062] When preparing to file tax returns at the end of the accounting period, the system relies on the aforementioned isolation results to implement an automatic tax filing interface blocking mechanism based on the account balance status. To prevent accounting data containing potentially abnormal characteristics from being automatically uploaded to the tax authorities, the redirection and blocking module 50 proactively sends a balance query request for the isolated transition accounts to the database before triggering the external tax filing scheduled task.

[0063] The system retrieves the segregated transitional accounts under the accounting agency. The final value of the period is recorded as the balance. When determining the balance status If this occurs, it indicates that the company has risky transaction documents that have not yet been cleared of abnormal status within the current accounting period, and the system will immediately block the normal tax filing process at the underlying level.

[0064] When implementing the blocking mechanism, the module invokes its internal access control service to revoke the tax filing authentication token of the corresponding enterprise entity residing in the system. Simultaneously, it sends access control policies to the underlying gateway, physically severing the network link between the enterprise's accounting system and the external automatic tax filing communication interface. This restriction mechanism forces business personnel to manually verify the at-risk amounts in the isolated transition accounts. Furthermore, once the business personnel complete the verification and execute the reversal adjustment instruction, When the system automatically revokes the access control policy of the underlying gateway and reissues the tax filing identity authentication token, it restores the network link of the automatic tax filing communication interface, thereby achieving a complete closed loop of the business process while ensuring the overall compliance of the data output by the agency accounting.

[0065] To better understand the technical solution of this invention, the following description is based on a specific application scenario.

[0066] In the actual operation scenario of a large accounting agency, the system has integrated data from over 500 independent accounting systems, including Company A (upstream trading), Company B (midstream logistics), and Company C (downstream retail). At the end of a certain month, Company A's accounting staff imported a batch of summary invoice data spanning the entire calendar month into the system and issued accounting instructions to generate main business revenue and inventory carry-forward.

[0067] At the system's underlying layer, the data acquisition and mapping module 10 captures the batch of original documents, transforms them into feature vectors, and mounts them onto the global directed multigraph. The topology recognition module 20, during periodic graph scanning in the background, discovers a high-frequency "A to B to C to A" closed-loop topology formed between companies A, B, and C, and further analyzes this topology by calculating the attenuation rate of document amounts at its starting and ending points. Below the system's set tolerance threshold The system then marks the connected component as abnormal and generates a route signature using the SHA-256 algorithm. .

[0068] Based on this routing signature, the interceptor of the underlying message middleware will forcibly tamper with the partition key of the new data stream containing the aforementioned enterprise transaction nodes, physically redirecting it to a high-risk sandbox memory queue. Within the sandbox, the system detects the number of external attachments corresponding to the accounting instructions entered by enterprise A. Much greater than the aggregated judgment threshold The system determined that a collapse in accounting granularity had occurred. It immediately suspended the write transaction and invoked the anti-counterfeiting tax control interface to perform a penetration unpacking. Unpacking revealed that transactions that were initially displayed as occurring uniformly on the "last day of the month" within the system actually exhibited a high degree of density in their physical invoicing timestamps. Invoices issued by A to B, B to C, and C to A all had actual invoicing intervals within 20 minutes.

[0069] The time lag verification module 40 extracts "Enterprise A's Unified Social Credit Code + Commodity Identification Code (e.g., a certain type of steel)" as the key name to locate the FIFO token bucket. The system retrieves virtual tokens based on the precise timestamp after unpacking and calculates the flow time lag difference. This is based on the lower limit of a reasonable time range for the actual logistics transportation of this batch of steel. It was set to 24 hours, and the unpacking calculations yielded... It only took 20 minutes to deviate from the safe range of physical flow time delay. Therefore, all virtual tokens generated in this batch were marked as abnormal, and the overall compliance verification ratio output by the system was negative. .

[0070] During the persistent write phase, the object-relational mapping layer interceptor captures the SQL statement for this summary posting. Based on... Based on the segmentation criteria, the interceptor rewrote the abstract syntax tree, redirecting the total amount including tax and the tax amount that should have been recorded in the standard accounts of "Inventory" and "Main Business Costs" to a pre-set isolated transition account by forcibly modifying the accounting account codes. .

[0071] Before triggering the external automatic tax filing task at the beginning of the following month, the system queries the underlying status of the company's accounting system and finds the balance status. The system immediately revoked Company A's tax filing authentication token and blocked the communication link, physically halting the tax filing process. Based on this, the accounting agency's review specialist conducted a thorough investigation, ultimately confirming that the closed loop involved no actual physical logistics flow. After manually removing the batch of abnormal documents and performing reversal adjustments... Only then did the system reissue the token and restore normal tax filing interface connectivity. This example fully demonstrates how this system can accurately intercept and fundamentally block high-risk financial and tax risks without interfering with the regular bookkeeping business flow.

[0072] The experiment used approximately 150,000 real purchase and sales invoices from a certain accounting platform as the test set, among which approximately 1,200 sets of high-risk document samples containing abnormal clustering and inverted characteristics were manually labeled.

[0073] See attached document Figure 3 , Figure 3 This is a performance comparison ROC curve of anomaly detection according to an embodiment of the present invention. The figure shows a performance comparison between the system of the present invention, a traditional baseline system based on SQL rule triggers, and a conventional graph neural network model without introducing time-series unpacking logic. The system of the present invention, with its accurate unpacking of accounting granularity collapse and microscopic reconstruction of physical time delays, achieves an area under the curve of 0.965, which is superior to 0.812 for the traditional rule system and 0.884 for the conventional graph model. In the low false positive rate range, the recall sensitivity of this system effectively avoids the false positive of normal corporate accounting data.

[0074] See attached document Figure 4 , Figure 4This is a bar chart comparing system throughput and memory consumption according to an embodiment of the present invention. The chart reflects the performance difference before and after the system adopts a routing isolation mechanism when a high-concurrency accounting instruction set arrives. Experimental data shows that without a sandbox isolation mechanism based on routing signatures, highly complex graph matching and time-delay verification easily cause main memory queue blockage, leading to an exponential increase in overall response latency at 5000 TPS. However, after the present system achieves physical traffic splitting by forcibly modifying the partition key, the response latency of the backbone accounting business remains stable within 50 milliseconds. Deep verification of high-risk data is smoothly restricted to asynchronous completion in an independent sandbox, achieving isolation of computing resources and ensuring smooth operation of the main business link.

[0075] See attached document Figure 5 , Figure 5 This is a histogram of token bucket latency difference distribution according to an embodiment of the present invention. The solid line envelope represents the log-normal distribution interval of historical compliant samples, based on which the system dynamically determines the safe interval. Clearly visible; while the areas marked with dotted lines represent the time lag distribution of intercepted abnormal documents in this embodiment, with their data highly concentrated within an extremely short time window close to the zero coordinate, or appearing as negative values. This difference in distribution further proves that the algorithm logic of using a first-in-first-out token bucket to simulate the physical flow of goods and serving as a compliance basis in the underlying mapping and segmentation is scientific and consistent with actual physical business laws.

Claims

1. A method for risk management in outsourced bookkeeping by detecting anomalies in financial data, characterized in that, Includes the following steps: The original documents and cash flow data of multiple enterprises are obtained and transformed into feature vectors containing document amounts and product identification codes. A directed multigraph is then constructed in the graph database engine with the enterprise entities as nodes and the feature vectors as edge attributes. Within the directed multigraph, a subgraph matching algorithm is executed to extract connected components that satisfy the set network topology characteristics, and a corresponding route signature is generated for the connected components using a cryptographic hash function. Modify the partition key of the message queue according to the routing signature, drive the data flow containing the connected component nodes to the high-risk sandbox memory queue, and call the anti-counterfeiting tax control application interface to obtain the invoice timestamp, and decompose the summary accounting voucher in the high-risk sandbox memory queue into an atomic event sequence; A first-in-first-out token bucket is established in the memory database for the product identification code. Virtual tokens are generated using the input documents in the atomic event sequence and pushed into the first-in-first-out token bucket. When processing the sales documents, the corresponding number of virtual tokens are pulled from the first-in-first-out token bucket and the physical flow time delay difference is calculated in combination with the invoice timestamp to generate the compliance verification ratio. Based on the compliance verification ratio, the document amount is divided, and the accounting subject code of the persistent write statement is modified through the object relational mapping interceptor. The risky amount is redirected to the isolated transition account, and the communication link of the external automatic tax filing interface is controlled according to the balance status of the isolated transition account.

2. The method for risk management of outsourced bookkeeping based on anomaly detection of financial data according to claim 1, characterized in that, The construction of a directed multigraph in the graph database engine, with enterprise entities as nodes and the feature vectors as edge attributes, further includes: Structured information is extracted from the original documents and fund flow data and transformed into feature vectors. The feature vectors include document entry timestamps, document amounts, commodity identification codes, flow direction attributes, and the absolute physical quantity of the commodity. Extract the unified social credit code of each enterprise participating in the transaction as the unique identifier of the node in the directed multigraph, and use the unique identifier to match the entities and establish the association relationship between cross-enterprise accounts; Based on the flow direction attribute in the feature vector, a directed edge from the shipper node to the receiver node is established within the graph database engine, and the feature vector as a whole is mounted and persisted as the attribute data of the corresponding directed edge.

3. The method for risk management of outsourced bookkeeping based on anomaly detection of financial data according to claim 1, characterized in that, The step of generating a corresponding routing signature for the connected components using a cryptographic hash function further includes: A traversal search is performed within the constructed global directed multigraph. By comparing the network path hop limit, document amount decay rate, and node in-degree warning threshold, network regions with closed-loop or star-shaped cluster topology features are extracted and constructed as connected components. Extract the unified social credit codes of all participating nodes within the connected component, arrange them in lexicographical order, and then concatenate them sequentially with the feature vector attributes corresponding to the relevant directed edges to form source text data used to characterize a specific network topology. The constructed source text data is input into a preset encrypted hash operation model to perform hash operation, and the generated fixed-length feature string is output as the routing signature for controlling the underlying data splitting.

4. The method for risk management of outsourced bookkeeping based on anomaly detection of financial data according to claim 3, characterized in that, Before the connected components construct the source text data, the following steps are also included: The total number of nodes covered by the extracted connected components is verified simultaneously to determine whether the actual calculated total number of nodes exceeds the system's preset single-processing capacity limit. When the total number of nodes exceeds the single processing capacity limit, the connected components are divided into multiple independent sub-connected components that meet the memory capacity conditions based on the modularity algorithm.

5. The method for risk management of outsourced bookkeeping in accordance with claim 1, characterized in that, The step of calling the anti-counterfeiting tax control application interface to obtain the invoice timestamp and decomposing the summary accounting vouchers in the high-risk sandbox memory queue into atomic-level event sequences further includes: Intercept data streams generated by abnormal connectivity components, overwrite the partition key in the original message encapsulation header of the data stream with the previously generated routing signature, recalculate the target shard index using the underlying routing component of the message middleware, and isolate the data stream to a high-risk sandbox memory queue. The number of external attachments associated with a document record is checked within the high-risk sandbox memory queue. When the number of external attachments exceeds the preset summary judgment threshold, the document is confirmed to have entered a state of accounting granularity collapse and the current database write transaction is suspended. The anti-counterfeiting tax control application interface is called through the communication protocol to send a data retrieval request, obtain the real invoice details behind the suspended write transaction and the invoice timestamp, and use the invoice details to reconstruct the summary accounting voucher that has lost the real time sequence precision into an independent atomic event sequence.

6. The method for risk management of outsourced bookkeeping based on the detection of financial data anomalies according to claim 1, characterized in that, The step of establishing a first-in-first-out (FIFO) token bucket for the product identification code in the memory database, and generating virtual tokens using the input documents in the atomic event sequence and pushing them into the FIFO token bucket, further includes: Extract the unified social credit code of the target enterprise participating in the business flow and concatenate it with the commodity identification code. Use the generated composite feature string as a unique key name to establish a first-in-first-out token bucket with boundary isolation attributes in the memory database. Traverse the reconstructed atomic-level event sequence. When the document flow direction is identified as an incoming business, extract the absolute physical quantity of the goods recorded in the incoming document as a weight parameter to generate a composite virtual token. The invoice timestamp of the corresponding input document is written as an attribute tag into the virtual token for binding, and the virtual token carrying the attribute tag is pushed into the tail of the first-in-first-out token bucket queue to perform a stack operation.

7. The method for risk management of outsourced bookkeeping based on the detection of financial data anomalies according to claim 1, characterized in that, The step of generating the compliance verification ratio further includes: When a document with a sales transaction direction is received, the corresponding first-in-first-out token bucket is located based on the unique key name. Virtual tokens with a cumulative weight value equal to the number of sales documents are extracted from the head of the queue of the first-in-first-out token bucket, and the weight of the head token is dynamically deducted and split. Obtain the invoice timestamp corresponding to the sales invoice, and subtract the invoice timestamp written as attribute tags in each of the extracted virtual tokens to calculate the single physical flow time delay difference value for restoring the actual goods flow time. Substitute the calculated physical transfer time lag difference into the dynamically set transfer time lag safety interval for logical comparison, and summarize the ratio of the total weight of the virtual tokens determined to be compliant to the total weight of the virtual tokens extracted for this output tax request. Generate a compliance verification ratio for quantifying compliance based on this ratio.

8. The method for risk management of outsourced bookkeeping based on anomaly detection of financial data according to claim 7, characterized in that, When extracting virtual tokens with a cumulative weight value equal to the number of output tax documents from the head of the queue of the first-in, first-out token bucket, drive the exception audit interception mechanism based on the inventory status verification comparison result: Obtain in real time the total weight balance of the virtual tokens currently existing inside the located first-in, first-out token bucket, and determine whether the total weight balance meets the pull quantity requirement for the corresponding output tax document application; When the total weight balance is less than the required quantity and an inventory gap is triggered, generate an overdraft token with a specific identifier for the difference part to make up the shortage, write the generated overdraft token into the inventory negative balance exception label, and exclude the overdraft token from the calculation process of the physical transfer time lag difference for independent review.

9. The method for risk management of outsourced bookkeeping based on the detection of financial data anomalies according to claim 1, characterized in that, The splitting of the document amount according to the compliance verification ratio and the modification of the accounting subject code of the persistent write statement through the object-relational mapping interceptor, redirecting the risky amount to the isolation transition subject, further includes: Extract the total amount including tax, tax-exclusive principal, and tax amount values in the original accounting instruction, multiply them by the compliance verification ratio, and use the operation logic of retaining decimal places and subtraction as a fallback to losslessly split each amount value in the original accounting instruction into a compliant value part and the corresponding risky amount part; When constructing the persistent write statement for database execution at the application business layer, trigger the object-relational mapping interceptor at the system bottom layer, extract the standard business accounting subject code originally to be recorded, and rewrite the persistent write statement using the abstract syntax tree parsing mechanism; Using the rewritten syntax tree structure, continue to map the parameters containing the compliant value part to the standard business accounting subject code, and redirect and map the parameters bound with the risky amount part to the preset isolation transition subject and then submit them to the database for execution.

10. The method for risk management of outsourced bookkeeping based on the detection of financial data anomalies according to claim 1, characterized in that, The control of the communication link of the external automatic tax filing interface based on the balance status of the isolation transition subject further includes: Before reaching the preset declaration node and triggering the network external tax filing timing task, independently send a query request for the isolation transition subject to the bottom-layer database to obtain the end balance status data of the enterprise entity; When it is determined that the balance status of the obtained isolation transition subject is greater than zero, trigger the permission control service to revoke the tax filing identity authentication token resident in the corresponding enterprise entity, and send an access control policy to the bottom-layer gateway to cut off the physical communication link connecting to the external automatic tax filing interface; After receiving the manual review instruction and the database update feedback that the write-off adjustment of the isolation transition subject makes the balance status zero, automatically resume issuing the tax filing identity authentication token and revoke the access control policy of the bottom-layer gateway to restore the communication link.

Images