A fund data tracing method

Abstract

The application is suitable for the technical field of fund tracing, and discloses a fund data tracing method, which comprises the following steps: generating an isolated database based on original files, assigning a file number to each original file, defining each transaction record in the original file as a node, and outputting node data and a node number; extracting each node transaction attribute and a rule parameter based on the node data, and generating a tracing metadata table; matching the nodes based on the rule parameter to obtain a comprehensive matching strength, generating a correlation table and a link table based on the comprehensive matching strength; generating a rule record document and a topology graph based on the correlation table, the link table and the tracing metadata table, obtaining a global hash value, and generating a complete evidence package. The method can identify hidden fund splitting and fund combination fund circulation behaviors, solve the problems of broken, incomplete and untrustworthy results of existing tracing links, and improve the completeness and accuracy of fund links.

Description

Technical Field

[0001] This invention relates to the field of fund traceability technology, specifically a method for tracing fund data. Background Technology

[0002] With rapid economic development, economic crimes are becoming increasingly sophisticated in both methods and techniques. Funds traceability has become a crucial technological means for tracking, analyzing, and confirming the origins of funds, and its necessity is increasingly evident in the current economic and regulatory environment. This technology is not a dispensable add-on, but a key infrastructure and risk control tool. Funds traceability technology can penetrate complex and concealed networks of fund flows, effectively combating money laundering, terrorist financing, telecommunications fraud, and other illegal activities. It is a powerful tool for law enforcement agencies to track down illicit funds and recover economic losses. Simultaneously, it is also a necessary means for financial institutions to meet global anti-money laundering and anti-tax evasion regulatory requirements. The lack of this technology will lead to regulatory ineffectiveness, hefty fines, and systemic financial risks. At a broader economic and social level, funds traceability technology is key to building a transparent and trustworthy market environment. It supports tax authorities in identifying complex cross-border tax evasion activities, ensuring that all national taxes are collected; and it can also investigate insider trading and commercial fraud, maintaining the fair order of the capital market. For individuals and businesses, this technology serves as a firewall against the misuse of accounts for illegal purposes and is also an important basis for tracing the source of economic losses and protecting their legitimate rights and interests.

[0003] In existing technologies, fund tracing relies solely on hard rule matching of explicit fields, which cannot identify hidden fund flows such as split transfers, mergers and aggregations, and multi-layered transfers. It can only generate a single linear link, lacking semantic parsing, tamper-proof evidence storage, and visualization topology, resulting in broken and incomplete tracing links, unreliable results, and failure to meet judicial evidence collection requirements. Summary of the Invention

[0004] The purpose of this invention is to provide a method for tracing financial data, in order to solve the problems of broken and incomplete traceability links, unreliable results, and inability to meet the requirements of judicial evidence collection in existing technologies.

[0005] The objective of this invention can be achieved through the following technical solution: a method for tracing financial data, comprising:

[0006] An isolated database is generated based on the original files, and a file number is assigned to each original file. Each transaction record in the original file is defined as a node, and the node data and node number are output.

[0007] Based on node data, extract the transaction attributes and rule parameters of each node to generate a traceability metadata table;

[0008] Based on the rule parameters, nodes are matched to obtain the comprehensive matching strength, and an association table and a link table are generated based on the comprehensive matching strength.

[0009] Based on the association table, link table, and source traceability metadata table, a rule record document and topology diagram are generated, a global hash value is obtained, and a complete evidence package is generated.

[0010] Preferably, the node data includes the transferring account, the receiving account, the transaction time, and the amount.

[0011] Preferably, the specific steps for obtaining the node number are as follows:

[0012] The node number is obtained by adding the current file number, the line number of the current node in the original file, and the integer part of the node amount, taking the absolute value, multiplying it by the preset scaling factor, and adding the node's global auto-incrementing counter. The node's global auto-incrementing counter is an integer variable that is automatically incremented by one each time a new node is generated, starting from the beginning.

[0013] Preferably, the rule parameters specifically include a time proximity threshold, a splitting and merging time period length, a relative amount error threshold, a matching strength threshold, and an amount deviation time length.

[0014] Preferably, the specific steps for generating the traceability metadata table are as follows:

[0015] For each node, an extraction record is generated. The extraction record includes node number, file number, transaction attributes, start position, and end position. The transaction attributes include transfer-out account, transfer-in account, transaction time, amount, and other optional fields. Other optional fields include, but are not limited to, transaction remarks, transaction channel, transaction serial number, and transaction currency.

[0016] The format of each transaction attribute of each node is standardized, and a conversion record is generated. The conversion record includes the original value before conversion, the standard value after conversion, and the type of conversion rule used.

[0017] Complete the missing transaction attributes after the format is standardized, and generate a completion record. The completion record includes the value before completion, the value after completion, the identifier on which the completion is based, and the source of the completion.

[0018] Store the preset rule parameters, extracted records, transformed records, and completed records into the traceability metadata table, and bind them with the corresponding node numbers.

[0019] Preferably, the specific steps for obtaining the comprehensive matching strength are as follows:

[0020] Obtain candidate matching node group. Candidate matching node group refers to an ordered node group consisting of one transfer-in transaction node and one transfer-out transaction node, wherein the transfer-in account of the transfer-in transaction node is equal to the transfer-out account of the transfer-out transaction node, and the transaction time of the transfer-in transaction node is later than the transaction time of the transfer-out transaction node.

[0021] The initial matching strength is obtained based on the candidate matching nodes;

[0022] The candidate matching node group is split and merged to obtain the overall matching strength.

[0023] Preferably, the specific steps for obtaining the initial matching strength based on candidate matching nodes are as follows:

[0024] For each candidate matching node group, take the transaction time of each node as the center, and take a time length of amount deviation before and after it. Obtain other nodes with the same transfer-in account or the same transfer-out account as the node. Calculate the average transaction amount of the other nodes. Obtain the absolute value of the difference between the current node's amount and the corresponding average value. Then divide the absolute value by the sum of the average value and one to obtain the amount deviation rate of the node.

[0025] The total deviation rate is obtained by adding the deviation rates of the two nodes.

[0026] The time matching coefficient is determined by comparing the transaction time difference between the two nodes with the time proximity threshold. If the time difference does not exceed half of the time proximity threshold, the time matching coefficient is the first coefficient. If the time difference is greater than half but does not exceed the time proximity threshold, the time matching coefficient is the second coefficient. If the time difference exceeds the time proximity threshold, the time matching coefficient is zero. The initial matching strength is equal to the time matching coefficient multiplied by one and the difference between the total deviation rate.

[0027] Preferably, the specific steps for splitting and merging funds in the candidate matching node group and obtaining the comprehensive matching strength are as follows:

[0028] For the incoming transaction node in the candidate matching node group, within the preset splitting and merging time period, find the subsequent nodes whose outgoing account is the same as the incoming account of the incoming transaction node, sort the amounts of all subsequent nodes from largest to smallest and accumulate them sequentially. When the difference between the accumulated sum and the amount of the incoming transaction node is less than the preset relative error threshold and the number of accumulated transactions is not less than two, it is determined to be a fund split, and the comprehensive matching strength of the candidate matching node group formed by the incoming transaction node and each subsequent node participating in the accumulation is updated to the larger value between the initial matching strength and the preset high matching strength.

[0029] For the outgoing transaction node in the candidate matching node group, within the preset splitting and merging time period, find the predecessor node whose transfer-in account is the same as the outgoing account of the outgoing transaction node. Sort the amounts corresponding to all predecessor nodes from largest to smallest and accumulate them sequentially. When the difference between the accumulated sum and the amount of the outgoing transaction node is less than the preset relative error threshold and the number of accumulated transactions is not less than two, it is determined to be a fund merger. The comprehensive matching strength of the candidate matching node group formed by each predecessor node participating in the accumulation and the outgoing transaction node is updated to the larger value between the initial matching strength and the preset high matching strength.

[0030] If neither splitting nor merging is identified, the initial matching strength is maintained as the overall matching strength of the candidate matching node group.

[0031] Preferably, the specific steps for generating the association table are as follows:

[0032] All candidate matching pairs with a comprehensive matching strength not lower than the matching strength threshold are retained and stored in the association table. Each record in the association table is an association pair. Each association pair contains the predecessor node number, the successor node number, the comprehensive matching strength, and an identifier indicating whether it belongs to splitting or merging.

[0033] Preferably, the complete evidence package specifically includes a mapping pointer and hash value of the original file, a source metadata table, an association table, a link table, a rule record document, an evidence chain hash value, and a topology graph, wherein the mapping pointer of the original file is a read-only pointer pointing to the storage location of the original file.

[0034] The beneficial effects of this invention are:

[0035] 1. When calculating the initial matching strength between two nodes, this invention uses the transaction time of each node as the center. Within a preset time length for amount deviation, it statistically analyzes the average historical transaction amount of the same account, calculates the deviation rate of the current amount relative to this average, and then combines the time difference to obtain the matching coefficient, thereby comprehensively assessing the possibility of fund association. Then, for the inflow transaction node, it searches for subsequent outflow nodes within the splitting and merging time period, accumulating them in descending order of amount. If the error between the accumulated sum and the inflow amount is less than the relative error threshold and the number of transactions is not less than two, it is determined to be a fund split. For the outflow transaction node, the determination of fund merging is similar. After successful identification, the comprehensive matching strength of the corresponding candidate node matching group is correspondingly increased to be higher than that of the ordinary candidate node matching group. This method can identify hidden fund splitting and merging fund flow behaviors, solving the problems of broken, incomplete, and unreliable results in existing traceability links, and improving the integrity and accuracy of fund links.

[0036] 2. This invention creates an isolated database independent of the original file, without creating copies of the original file. It only stores read-only mapping pointers to the storage location of the original file and records the hash verification value of the original file. All intermediate processing data is stored in the isolated database, and the system strictly prohibits direct modification of the original file or deletion of the mapping pointers. This invention ensures the immutability of the original financial data. Any subsequent tampering with the original data or intermediate processing results will be detected due to inconsistent hash values, providing a reliable evidence basis and solving the problems of easily tampered data and low reliability of results in existing traceability methods.

[0037] 3. When generating the traceability metadata table, this invention records the original source location, format conversion process, and basis for filling missing values ​​for each transaction attribute, forming a complete traceability metadata table. Then, based on matching strength, it filters related pairs to generate a relationship table, and starting from the absence of a predecessor node, it ultimately constructs all possible fund flow links and stores them in a link table. Based on the link table, it assigns node layer numbers and coordinates, generating a directed topology graph to comprehensively display the fund network. Finally, it sequentially concatenates the original file hash value, the values ​​before and after conversion of each node, the completion record, the strength of the related pairs, the link node sequence, and the rule document, calculates the SHA-256 global hash value, and stores it in a read-only evidence chain file. Any modification to the original data or intermediate results will result in inconsistent hash values, thus achieving tamper-proof protection. The complete evidence package of this invention can be directly used for forensic identification and auditing, meeting the legal requirements for the authenticity, completeness, and traceability of the evidence chain. Attached Figure Description

[0038] The present invention will now be further described with reference to the accompanying drawings.

[0039] Figure 1 This is a flowchart of the method provided in an embodiment of the present invention. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] Please see Figure 1 As shown, the present invention is a method for tracing the source of financial data, comprising:

[0042] S100: Generates an isolated database based on the original files, assigns a file number to each original file, defines each transaction record in the original file as a node, and outputs node data and node number.

[0043] In this embodiment of the invention, the original file refers to the original financial data file, including but not limited to bank statements, payment platform statements and transaction details records;

[0044] It should be noted that the original files are opened in read-only mode, without modifying the file content or copying the files to the temporary directory; only a read-only access path is created for each original file.

[0045] An isolated database is an independent, isolated file-based database created within the system. The isolated database is completely separated from the original file storage path. The isolated database only stores read-only mapping pointers of the original files and all intermediate data generated by subsequent processing.

[0046] It should be noted that the original file itself is not copied into the isolated database. Instead, a read-only mapping pointer points to the storage location of the original file, while recording the hash check value of the original file. The system does not allow any data in the isolated database to directly modify the original file, nor does it allow the mapping pointer of the original file to be overwritten or deleted.

[0047] Each original file is assigned a file number equal to the current clock milliseconds + process identifier + filename character length;

[0048] The current clock milliseconds refers to the clock milliseconds since the original file was stored in the system;

[0049] A process identifier is a unique numerical identifier assigned by the system to a software program that performs the fund traceability method. Each time the software program is started, the system assigns a different process identifier, which is used to distinguish different process instances.

[0050] The file name character length refers to the number of characters contained in the original file name string, including but not limited to letters, numbers, and symbols in the file name and extension;

[0051] Node data includes the sending account, receiving account, transaction time, and amount;

[0052] It should be noted that the amounts have positive and negative signs; positive values ​​indicate the amount transferred in, and negative values ​​indicate the amount transferred out.

[0053] The node number refers to the unique node number assigned to each node when the system reads a complete node record. Specifically, the node number is obtained by adding the current file number, the line number of the current node in the file, and the integer part of the node amount, taking the absolute value, multiplying the absolute value by 10,000, and then adding the node's global auto-incrementing counter.

[0054] It should be noted that 10,000 is a preset scaling factor that determines the maximum range of values ​​for the node's global auto-increment counter. Its value can be dynamically adjusted according to actual needs. The node's global auto-increment counter is an integer variable that is automatically incremented by one each time a new node is generated, starting from the beginning.

[0055] The line number of the current node in the file refers to the line number of the transaction record in the original file. For example, if the first transaction record in the original file is located on the second line, then the corresponding line number of the current node in the file is two.

[0056] An auto-incrementing counter is an integer variable that automatically increments by one each time a new node is generated. It assigns a unique, sequentially increasing node number to each newly generated node within the same original data.

[0057] Furthermore, the aforementioned method for tracing financial data also includes:

[0058] S200: Based on node data, extract the transaction attributes and rule parameters of each node to generate a traceability metadata table.

[0059] In this embodiment of the invention, for each node, the source of each field in the original file of that node is determined based on the starting position and field length of the field in the original file associated with the node number, and each field is a transaction attribute of each node.

[0060] Transaction attributes include the sending account, receiving account, transaction time, amount, and other optional fields, including but not limited to transaction remarks, transaction channel, transaction serial number, and transaction currency.

[0061] Record the name, file number, line number, start position, and end position of the original file containing each transaction attribute;

[0062] For each node, an extraction record is generated, which includes the node number, file number, transaction attributes, start position, and end position. All extraction records are then stored in the traceability metadata table.

[0063] The format of each transaction attribute of each node is standardized. Specifically, the transaction time is uniformly converted to the Gregorian calendar year, month, day, hour, minute, and second format; the amount is converted to a number with the currency symbol and thousandths separator removed and the positive and negative signs are retained; the transfer-out account and transfer-in account are uniformly converted to uppercase with spaces removed; and other optional fields are processed according to preset rules.

[0064] It should be noted that the preset rules refer to the standardized rules for other optional fields, such as removing special characters from transaction remarks, mapping synonyms to standard values ​​for transaction channels, removing spaces and padding the transaction serial number, etc.

[0065] When standardizing the format, the conversion record of each transaction attribute is recorded. The conversion record includes the original value before conversion, the standard value after conversion, and the conversion rule type used. The conversion rule type includes, but is not limited to, date template number, amount thousandths removal, and account number processing. The conversion record is stored in the traceability metadata table and bound to the corresponding node number.

[0066] After standardizing the format of each transaction attribute at each node, check for any missing information. Missing information includes, but is not limited to, missing account name, missing account number, missing transaction channel, and missing transaction remarks.

[0067] If any missing information exists, it will be filled in. The filling is based on the following criteria: extracting known information corresponding to the same account number from other nodes in the isolated database and filling in the information, and querying the institution name corresponding to the prefix of the account number from the external public prefix library. The known information includes, but is not limited to, the account name and the institution name.

[0068] Retrieve the completion record for each missing case. The completion record includes the missing attribute name, the value before completion is set to empty, the value after completion, the identifier of the basis for completion, and the source of the basis for completion. Store the completion record in the traceability metadata table and bind it with the corresponding node number.

[0069] Rule parameters refer to the preset values ​​and judgment conditions used when performing node matching, splitting and merging identification. The rule parameters are pre-configured and stored in the traceability metadata table. The rule parameters specifically include the time proximity threshold, the length of the splitting and merging time period, the relative error threshold of the amount, the matching strength threshold, and the time length of the amount deviation.

[0070] The time proximity threshold is used to determine whether the transaction time difference between two nodes is within a reasonable range. It is set based on business scenario experience and is usually 3600 seconds.

[0071] The split / merge time period length is used to limit the time range to be searched when identifying split or merge behavior, and it is usually taken as half of the nearest time threshold.

[0072] The relative error threshold for amounts is the maximum allowable relative error when splitting and merging or matching amounts. It is a fixed value set empirically, usually 5% of the corresponding amount when splitting and merging.

[0073] The matching strength threshold is the minimum matching strength score used to determine whether there is a valid financial relationship between two nodes. It is set through sample analysis and is usually 0.7.

[0074] The time range for the amount deviation is the time range used when calculating the average amount of the account where the node is located. It is preset by the transaction frequency and is usually 1800 seconds.

[0075] The source metadata table includes extracted records, transformed records, completed records, and preset rule parameters.

[0076] Furthermore, the aforementioned method for tracing financial data also includes:

[0077] S300: Based on rule parameters, nodes are matched to obtain comprehensive matching strength, and association table and link table are generated based on comprehensive matching strength.

[0078] In this embodiment of the invention, the comprehensive matching strength is an indicator used to measure whether there is a real fund transfer relationship between two nodes. Its value range is usually between 0 and 1. The higher the value, the greater the possibility that the two transactions constitute a fund transfer link.

[0079] The steps to obtain the overall matching strength are as follows:

[0080] First, obtain the candidate matching node group. Specifically, for node i, if its transfer-in account is equal to the transfer-out account of another node j, and node i's transaction time is later than the transaction time of another node j, then (i,j) is taken as the candidate matching node group.

[0081] For candidate pair (i,j), obtain their corresponding amounts, denoted as follows: and Taking the transaction time of node i as the center, take a time length of amount deviation before and after it, obtain all nodes with the same transfer-in account as node i within the time length of amount deviation, and calculate the average amount of these nodes. If no node with the same receiving account as node i exists within the time period of the deviation of the amount, then let Then, taking the transaction time of node j as the center, take a time length of amount deviation before and after it, and obtain the average amount of all nodes with the same transfer account as node j within that time length of amount deviation. If no node with the same outgoing account as node j exists within the time period of the deviation of the amount, then let ;

[0082] It should be noted that within the time frame of the amount deviation, the transaction amount of the same account usually fluctuates around a central value, such as salary deposits and daily expenses. The average value within the time frame of the amount deviation is obtained. If the current amount deviates too much from the average value, the current transaction may be special and its matching credibility should be reduced.

[0083] Calculate the deviation rate of amount for i and j respectively. and , and The calculation formula is similar to that of the others. This embodiment uses... The calculation formula will be explained. The calculation formula is: Then and Add to get , The range of values ​​is The smaller the value, the closer the amounts of the two accounts are to their respective average amounts.

[0084] Based on the comparison between the time difference between candidate matching node groups and the time proximity threshold T, the time matching coefficient is obtained. Specifically, for candidate matching node group (i,j), its corresponding transaction time is obtained. and Then calculate the time difference. Its calculation formula is Then the time difference Compare with the time proximity threshold T, if ,but ,like ,but ,like ,but ,in, ;

[0085] It should be noted that the values ​​of k1 and k2 are determined based on business experience and experimental verification, and the specific values ​​can be fine-tuned according to the transaction scenario or audit requirements.

[0086] The initial matching strength S1 of the candidate matching node group (i,j) is calculated using the following formula: Then, split the funds of node i in the candidate matching node group (i,j) and merge the funds of node j.

[0087] It should be noted that the initial matching strength can take values ​​ranging from [value missing]. The closer the value is to k1, the closer the candidate matching pair (i,j) is in time and the low deviation in amount, meaning that the two transactions are very likely to constitute a real flow of funds.

[0088] The specific steps for splitting funds at node i are as follows: node i is an incoming transaction, and its receiving account is denoted as . To obtain subsequent nodes, the subsequent nodes refer to the accounts from which the transfer was made. The transaction time is after the transaction time of node i, and the time difference between subsequent nodes and node i does not exceed the length of the split-merge time period. Sort the amounts corresponding to all subsequent node groups from largest to smallest to form a subsequent amount sequence, and accumulate the amounts in the subsequent amount sequence one by one. After each accumulation, compare the sum with the given sum. If the difference is less than the relative error threshold and the cumulative number of transactions is not less than two, it is determined to be a fund split. That is, the amount received by node i is split into the transfer transactions of these subsequent nodes, and the comprehensive matching strength of the candidate matching node group (i, each subsequent node) formed by the subsequent nodes and node i is updated to the larger value between the corresponding initial matching strength and the preset high matching strength. If the cumulative sum is greater than 1 during the accumulation process, the fund split is determined to be a fund split. And the cumulative sum and If the difference is greater than the relative error threshold of the amount, then the subsequent nodes will no longer be evaluated;

[0089] The specific steps for merging funds at node j, where node j represents a transfer-out transaction, and its transfer-out account is set to... To obtain the predecessor node, the predecessor node refers to the node transferred to the account where the predecessor node is located. The transaction time must be before the transaction time corresponding to node j, and the time difference between the predecessor node and node j must not exceed the length of the split-merge time period. Sort the amounts corresponding to all predecessor node groups from largest to smallest to obtain the predecessor amount sequence, and then accumulate the amounts in the predecessor amount sequence one by one. After each accumulation, check the sum and... If the difference is less than the relative error threshold and the cumulative number of transactions is not less than two, it is determined as a fund merger. That is, the transfer-in transactions corresponding to these predecessor nodes are merged into the transfer-out transactions of node j. The comprehensive matching strength of the candidate matching node group (each predecessor node, j) formed by these predecessor nodes and node j is updated to the larger value between the corresponding initial matching strength and the preset high matching strength. If the cumulative sum is greater than 1 during the accumulation process, the fund is considered merged. And the cumulative sum and If the difference is greater than the relative error threshold of the amount, then the predecessor node will no longer be evaluated;

[0090] It should be noted that the receiving account is the same as the account for receiving funds, and the sending account is the same as the account for making payments.

[0091] It should be noted that high matching strength is an empirical threshold, usually set to 0.85, to ensure that the split and merge relationship has a higher overall matching strength than the ordinary overall matching strength, which facilitates link identification and visualization highlighting;

[0092] For candidate matching node groups that do not match any split or merge identification, their overall matching strength remains unchanged from the initial matching strength. If a candidate pair is simultaneously matched by split and merge identification, the larger value is taken as the overall matching strength.

[0093] Finally, all candidate matching pairs with a comprehensive matching strength not lower than the matching strength threshold are retained and stored in the association table. Each record in the association table contains the predecessor node number, the successor node number, the comprehensive matching strength, and an identifier indicating whether it belongs to splitting or merging. Each record in the association table is called an association pair.

[0094] The link table is used to record every complete flow path from the source of funds to the destination. Specifically, all nodes without predecessor nodes are taken as starting nodes. For each starting node, all related pairs with that starting node as the predecessor are searched in the association table to obtain its subsequent node list. If the subsequent node list is empty, the current path ends, and the node sequence from the starting node to the current node is recorded as a link. If the subsequent node list has multiple subsequent nodes, each subsequent node is taken as the current node, and the search continues to find all related pairs with the current node as the predecessor in the association table, and the search is repeated until the subsequent node list is empty. Each branch path generated in this way forms an independent link. Finally, all generated links are stored in the link table.

[0095] Furthermore, the aforementioned method for tracing financial data also includes:

[0096] S400: Based on the association table, link table, and source metadata table, generate rule record documents and topology diagrams, obtain global hash values, and generate complete evidence packages.

[0097] In this embodiment of the invention, the rule record document is generated by reading all extracted records, transformed records, completed records, and rule parameters from the source metadata table, reading the comprehensive matching strength and split or merge identifier of each association pair from the association table, and reading the node sequence of each link from the link table. These contents are then concatenated in the order of processing time to form the record document.

[0098] Topology Graph: Node coordinates are generated based on the link table. Specifically, nodes in each link are assigned layer numbers according to their order in the link, with the starting node being layer 1 and subsequent nodes increasing sequentially. If a node appears in multiple links, its highest layer number is taken, and the layer number is multiplied by a fixed layer height as the ordinate. Nodes within the same layer are arranged from left to right according to their node numbers, and the x-coordinate is obtained by multiplying the sequence number by a fixed width. The coordinates of each node are recorded. At the same time, edge connections are generated based on the association table. Specifically, each association pair corresponds to a directed edge, recording the starting node number, ending node number, overall matching strength, and whether it is a split or merge behavior. The node coordinates, node attributes, and edge connections are merged into the topology graph. Node attributes refer to node number, transferring account, transferring receiving account, amount, and transaction time.

[0099] Global hash value: The hash value of each original file, the formatted values ​​and completion records of each node, the comprehensive matching strength of each association pair, the node sequence of each link, and the binary data of the rule record document are read sequentially. All the content is concatenated in order and the hash value is calculated using SHA-256. This hash value is stored in the evidence chain file in the root directory of the isolated database and set to read-only. Any tampering with the original data or intermediate processing results will result in inconsistent hash values, thereby achieving tamper-proof.

[0100] The complete evidence package includes the mapping pointers and hash values ​​of the original files, all tables in the isolated database, rule record documents, evidence chain hash values, and topology diagrams. All tables include the source metadata table, the association table, and the link table. The complete evidence package is a complete result from the original financial data to the final verifiable, traceable, and intuitively displayed result.

[0101] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0102] The preferred embodiments of the invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention.

Claims

1. A method for tracing the source of financial data, characterized in that, include: An isolated database is generated based on the original files, and a file number is assigned to each original file. Each transaction record in the original file is defined as a node, and the node data and node number are output. Based on node data, extract the transaction attributes and rule parameters of each node to generate a traceability metadata table; Based on the rule parameters, nodes are matched to obtain the comprehensive matching strength, and an association table and a link table are generated based on the comprehensive matching strength. Based on the association table, link table, and source traceability metadata table, a rule record document and topology diagram are generated, a global hash value is obtained, and a complete evidence package is generated.

2. The method for tracing the source of financial data according to claim 1, characterized in that, The specific steps for obtaining the node number are as follows: The node number is obtained by adding the current file number, the line number of the current node in the original file, and the integer part of the node amount, taking the absolute value, multiplying it by the preset scaling factor, and adding the node's global auto-incrementing counter. The node's global auto-incrementing counter is an integer variable that is automatically incremented by one each time a new node is generated, starting from the beginning.

3. The method for tracing the source of financial data according to claim 2, characterized in that, The rule parameters specifically include the time proximity threshold, the length of the splitting and merging time period, the relative error threshold of the amount, the matching strength threshold, and the time length of the amount deviation.

4. The method for tracing the source of financial data according to claim 3, characterized in that, The specific steps for generating the traceability metadata table are as follows: For each node, generate an extraction record, which includes the node number, file number, transaction attributes, start position, and end position. The format of each transaction attribute of each node is standardized, and a conversion record is generated. The conversion record includes the original value before conversion, the standard value after conversion, and the type of conversion rule used. Complete the missing transaction attributes after the format is standardized, and generate a completion record. The completion record includes the value before completion, the value after completion, the identifier on which the completion is based, and the source of the completion. Store the preset rule parameters, extracted records, transformed records, and completed records into the traceability metadata table, and bind them with the corresponding node numbers.

5. The method for tracing the source of financial data according to claim 4, characterized in that, The specific steps for obtaining the comprehensive matching strength are as follows: Obtain candidate matching node group. Candidate matching node group refers to an ordered node group consisting of one transfer-in transaction node and one transfer-out transaction node, wherein the transfer-in account of the transfer-in transaction node is equal to the transfer-out account of the transfer-out transaction node, and the transaction time of the transfer-in transaction node is later than the transaction time of the transfer-out transaction node. The initial matching strength is obtained based on the candidate matching nodes; The candidate matching node group is split and merged to obtain the overall matching strength.

6. The method for tracing the source of financial data according to claim 5, characterized in that, The specific steps for obtaining the initial matching strength based on candidate matching nodes are as follows: For each candidate matching node group, take the transaction time of each node as the center, and take a time length of amount deviation before and after it. Obtain other nodes with the same transfer-in account or the same transfer-out account as the node. Calculate the average transaction amount of the other nodes. Obtain the absolute value of the difference between the current node's amount and the corresponding average value. Then divide the absolute value by the sum of the average value and one to obtain the amount deviation rate of the node. The total deviation rate is obtained by adding the deviation rates of the two nodes. The time matching coefficient is determined by comparing the transaction time difference between the two nodes with the time proximity threshold. If the time difference does not exceed half of the time proximity threshold, the time matching coefficient is the first coefficient. If the time difference is greater than half but does not exceed the time proximity threshold, the time matching coefficient is the second coefficient. If the time difference exceeds the time proximity threshold, the time matching coefficient is zero. The initial matching strength is equal to the time matching coefficient multiplied by one and the difference between the total deviation rate.

7. The method for tracing the source of financial data according to claim 6, characterized in that, The specific steps for splitting and merging funds in the candidate matching node group and obtaining the comprehensive matching strength are as follows: For the incoming transaction node in the candidate matching node group, within the preset splitting and merging time period, find the subsequent nodes whose outgoing account is the same as the incoming account of the incoming transaction node, sort the amounts of all subsequent nodes from largest to smallest and accumulate them sequentially. When the difference between the accumulated sum and the amount of the incoming transaction node is less than the preset relative error threshold and the number of accumulated transactions is not less than two, it is determined to be a fund split, and the comprehensive matching strength of the candidate matching node group formed by the incoming transaction node and each subsequent node participating in the accumulation is updated to the larger value between the initial matching strength and the preset high matching strength. For the outgoing transaction node in the candidate matching node group, within the preset splitting and merging time period, find the predecessor node whose transfer-in account is the same as the outgoing account of the outgoing transaction node. Sort the amounts corresponding to all predecessor nodes from largest to smallest and accumulate them sequentially. When the difference between the accumulated sum and the amount of the outgoing transaction node is less than the preset relative error threshold and the number of accumulated transactions is not less than two, it is determined to be a fund merger. The comprehensive matching strength of the candidate matching node group formed by each predecessor node participating in the accumulation and the outgoing transaction node is updated to the larger value between the initial matching strength and the preset high matching strength. If neither splitting nor merging is identified, the initial matching strength is maintained as the overall matching strength of the candidate matching node group.

8. The method for tracing the source of financial data according to claim 7, characterized in that, The specific steps for generating the association table are as follows: All candidate matching pairs with a comprehensive matching strength not lower than the matching strength threshold are retained and stored in the association table. Each record in the association table is an association pair. Each association pair contains the predecessor node number, the successor node number, the comprehensive matching strength, and an identifier indicating whether it belongs to splitting or merging.

9. The method for tracing the source of financial data according to claim 8, characterized in that, The complete evidence package specifically includes the mapping pointer and hash value of the original file, the source metadata table, the association table, the link table, the rule record document, the evidence chain hash value, and the topology graph. The mapping pointer of the original file is a read-only pointer pointing to the storage location of the original file.

Images