Financial intelligence auditing method, device and equipment and storage medium

Abstract

The application relates to the technical field of intelligent financial auditing, and discloses a financial intelligent auditing method, device, equipment and storage medium. The method comprises the following steps: obtaining auditing bills, behavior data and business data; standardizing and fusing the data into unified structured features; distributing the unified structured features to a rule engine and an intelligent risk control engine in a zero-copy mode in parallel through an asynchronous non-blocking mode; the rule engine outputs a Boolean result of compliance verification, and the intelligent risk control engine outputs a risk score; competitive consensus decision is made according to the Boolean result and the risk score, and a risk decision conclusion, a risk basis and an execution instruction are generated. Through parallel calling and competitive consensus decision of hard rules and soft models, the application moves the risk control point from post-audit to submission in the middle of the process, improves the auditing efficiency, identifies hidden irregularities, and realizes efficient, accurate and interpretable intelligent financial auditing.

Description

Technical Field

[0001] This application relates to the field of intelligent financial auditing technology, specifically to a financial intelligent auditing method, apparatus, equipment, and storage medium. Background Technology

[0002] With the digitalization of corporate finance and the expansion of business scale, financial auditing presents characteristics such as multi-source and heterogeneous documents, long auditing chains, and strong hidden risks. Traditional financial auditing solutions have significant shortcomings and are difficult to adapt to the auditing requirements of a platform-based, end-to-end, and high-real-time approach. Specifically, these shortcomings include the following: Fragmented review process: Existing solutions are mostly executed sequentially, including document collection, OCR recognition, rule verification, and manual review. Data flows in isolation between business systems, recognition tools, and review terminals, resulting in process breakpoints.

[0003] The review process lacks intelligence and is weak in identifying hidden risks: Traditional reviews rely on manual verification, while intelligent solutions only call the rule engine and have no ability to identify hidden violation patterns such as time-series anomalies, related fraud, and group evasion; moreover, the use of serial calls results in high review response delays and cannot meet the real-time review requirements when business is submitted.

[0004] The decision-making mechanism is simplistic and lacks multi-engine consensus logic: it relies solely on the rule engine to make deterministic judgments without combining the probabilistic predictions of the risk control model. The rules are too rigid and prone to false alarms.

[0005] Therefore, there is an urgent need to propose a financial intelligent auditing method that relies on an auditing platform, supports multi-engine parallel processing, and has competitive consensus decision-making capabilities. Summary of the Invention

[0006] To address the aforementioned issues, this application provides a financial intelligent auditing method, apparatus, equipment, and storage medium. The core of this method is to achieve standardized fusion of multi-source data, asynchronous non-blocking zero-copy parallel scheduling, and competitive consensus decision-making between the rule engine and the intelligent risk control engine through an auditing platform. This shifts risk control from post-audit to in-process submission, solving the technical problems of low efficiency, poor accuracy, and difficulty in identifying hidden violations in traditional auditing.

[0007] The technical solution adopted in this application is as follows: Firstly, this application provides a financial intelligent auditing method, which includes: Acquire audit invoices, behavioral data, and business data; among which, audit invoices include invoice images and audit metadata; Standardize behavioral data and business data to obtain related business heterogeneous data, call the OCR engine to extract key fields from the invoice image to obtain invoice structure data, and integrate the invoice structure data, audit metadata and related business heterogeneous data into a unified structured feature; Unified structured features are distributed to the rule engine and intelligent risk control engine in parallel with zero copy through an asynchronous and non-blocking method; The rules engine performs compliance checks on the unified structured features based on preset financial audit rules, and outputs a boolean result indicating whether the rule was hit and the rule number that was hit. The intelligent risk control engine assesses the risk level of unified structured features based on a trained risk identification model and outputs a risk score. Competitive consensus decision-making is conducted based on the hit or miss result and risk score, generating risk decision conclusions, risk basis, and corresponding execution instructions.

[0008] Optionally, obtain audit tickets, behavioral data, and business data, including: Obtain audit tickets and behavior data reported by edge computing nodes; Obtain business data from the business system; the business data includes: job level limits, travel standards, contract information, and project information.

[0009] Optionally, behavioral and business data are standardized to obtain related heterogeneous business data. An OCR engine is then used to extract key fields from the invoice image to obtain invoice structure data. This invoice structure data, audit metadata, and related heterogeneous business data are then integrated into a unified structured feature, including: The behavioral and business data are formatted, cleaned, redundant removed, and mapped in a standardized manner to obtain heterogeneous data related to business processes. Key fields are extracted from the invoice image using an OCR engine to obtain the invoice structure data; The data on invoice structure, audit metadata, and heterogeneous data from related business processes are aligned and merged to form a unified structured feature.

[0010] Optionally, the rules engine performs compliance checks on the unified structured features based on preset financial audit rules, outputting a boolean result indicating whether a match was found and the matched rule number, including: The rule engine is invoked to perform compliance verification on the unified structured features based on preset financial audit rules; among which, the preset financial audit rules include at least: spatiotemporal consistency sub-rules, budget limit sub-rules, invoice validity sub-rules, and entity compliance sub-rules; If any sub-rule fails the validation, output the hit result and the corresponding rule number; If all sub-rule validations pass, then output a miss result.

[0011] Optionally, the risk identification model is a hybrid deep learning architecture, including a feature embedding layer, a relation-aware layer, a temporal memory layer, and a discriminative output layer connected in sequence; The feature embedding layer is used to convert discrete features in a uniform structured feature set into a dense vector; The relation-aware layer is used to aggregate features of entity relations using GCN graph convolutional networks to identify associated fraud risks; The temporal memory layer is used to learn temporal features of submission time, submission frequency, and operation trajectory using a Transformer self-attention network to identify abnormal operation patterns. The output layer is used to output a risk score in the range of 0 to 1 using the Softmax activation function.

[0012] Optionally, the risk identification model can be trained using the following methods: Construct an initial risk identification model; Unsupervised learning samples are constructed using historically unlabeled, uniformly structured features; The initial risk identification model is pre-trained in unsupervised mode using unsupervised learning samples to learn the feature distribution, thus obtaining a pre-trained risk identification model. Using historically labeled risk-free unified structured features as positive samples and historically labeled risky unified structured features as negative samples, we use oversampling techniques to enhance the negative samples in multiple dimensions and expand the samples to form enhanced negative samples. Based on the positive samples and enhanced negative samples, we construct supervised learning samples. The pre-trained risk identification model is fine-tuned using supervised learning samples to obtain a well-trained risk identification model. During the supervised fine-tuning process, a focus loss function is used to reduce the weight of positive samples and increase the weight of enhanced negative samples.

[0013] Optionally, a competitive consensus decision is made based on the hit or miss result and the risk score, generating a risk decision conclusion, risk basis, and corresponding execution instructions, including: If the rule engine outputs a hit result, the risk decision conclusion is determined to be an interception warning; If the rule engine outputs a no-match result and the risk score exceeds the preset threshold, the risk decision conclusion is determined to be a second verification. If the rule engine outputs a no-match result and the risk score does not exceed the preset threshold, the risk decision conclusion is to automatically allow passage. The risk basis is formed based on the contribution of each feature in the unified structured features to the interception warning and secondary verification risk decision-making conclusions; Generate audit results that include risk decision conclusions, risk basis, and corresponding execution instructions.

[0014] Secondly, this application also provides a financial intelligent auditing device, the device comprising: The data acquisition unit is used to acquire audit tickets, behavioral data, and business data; among which, audit tickets include ticket images and audit metadata; The feature fusion unit is used to standardize behavioral data and business data to obtain related business heterogeneous data, call the OCR engine to extract key fields from the invoice image to obtain invoice structure data, and fuse the invoice structure data, audit metadata and related business heterogeneous data into a unified structured feature. The parallel scheduling unit is used to distribute the unified structured features to the rule engine and the intelligent risk control engine in a parallel manner with zero copy through an asynchronous and non-blocking approach. The rule engine performs compliance verification on the unified structured features based on preset financial audit rules and outputs a boolean result indicating whether the rule is hit and the hit rule number. The intelligent risk control engine evaluates the risk level of the unified structured features based on a trained risk identification model and outputs a risk score. The consensus decision-making unit is used to make competitive consensus decisions based on the hit or miss results and risk scores, and to generate risk decision conclusions, risk basis and corresponding execution instructions.

[0015] Thirdly, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described financial intelligent auditing method.

[0016] Fourthly, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the aforementioned intelligent financial auditing method. The above-mentioned technical solution adopted in this application can achieve the following beneficial effects: This application utilizes a unified access and standardized processing platform for multi-source heterogeneous data. It employs asynchronous non-blocking and zero-copy technologies to call the rule engine and intelligent risk control engine in parallel, eliminating the overhead of serial waiting and duplicate data copying, achieving millisecond-level review. The rule engine implements strong constraint verification for explicit violations, while the intelligent risk control engine identifies hidden fraud risks. By combining the outputs of both through competitive consensus decision-making, it avoids false alarms and compensates for model blind spots, significantly improving review accuracy. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A schematic diagram of the structure of a financial intelligent auditing system based on edge perception and middleware linkage according to an embodiment of this application is shown; Figure 2 A flowchart illustrating a front-end edge awareness method executed by a service terminal according to an embodiment of this application is shown. Figure 3 A flowchart illustrating a financial intelligent auditing method performed by an auditing platform according to an embodiment of this application is shown. Figure 4 A flowchart illustrating an instruction processing feedback method executed by a service terminal according to an embodiment of this application is shown. Figure 5 A flowchart illustrating a risk control optimization method performed by a backend management server according to an embodiment of this application is shown. Figure 6 A schematic diagram of the structure of a financial intelligent auditing device according to an embodiment of this application is shown; Figure 7 A schematic diagram of the structure of a risk control optimization device according to an embodiment of this application is shown; Figure 8 A schematic diagram of the structure of an electronic device according to an embodiment of this application is shown. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] Figure 1 A schematic diagram of the structure of a financial intelligent auditing system 100 based on edge perception and middleware linkage according to an embodiment of this application is shown. (Refer to...) Figure 1 As shown, the financial intelligent audit system 100 based on edge perception and middle platform linkage provided in this embodiment includes: an audit middle platform 102, multiple business terminals 101 communicatively connected to the audit middle platform 102, and may also include a backend management server 103 communicatively connected to the audit middle platform 102. The business terminals 101 are used to collect invoice data in real time in response to invoice audit applications, preprocess, pre-verify, and structurally encapsulate the invoice data to form audit invoices, and transmit the audit invoices to the audit middle platform 102. The audit middle platform 102 is used to call the OCR engine to identify and parse the audit invoices, combine related heterogeneous business data, and asynchronously and non-blockingly call the rule engine and intelligent risk control engine in parallel to execute the audit. Based on the multi-engine audit results, a comprehensive judgment is made to generate a risk decision conclusion, and an execution instruction corresponding to the risk decision conclusion is issued to the business terminals 101. The business terminals 101 are used to execute the corresponding processing procedures according to the execution instructions and transmit the instruction execution results to the audit middle platform 102. The audit middle platform 102 is used to record the entire process audit data and instruction execution results in the audit log.

[0020] The financial intelligent audit system 100 proposed in this embodiment, based on edge perception and middle platform linkage, adopts a three-layer distributed architecture of "front-end edge perception layer - financial intelligent audit layer - risk control optimization layer". It consists of multiple business terminals 101, audit middle platform 102, and back-end management server 103, and realizes integrated financial audit full-link linkage of "perception-decision-execution-optimization".

[0021] It should be noted that the financial intelligent auditing system 100 based on edge perception and middle platform linkage can also consist only of an auditing middle platform 102 and multiple business terminals 101 that communicate with the auditing middle platform 102. Even without a backend management server 103, the system can still implement the core methods of front-end data collection, middle platform analysis, and front-end response.

[0022] Business Terminal 101 is a lightweight operating device deployed in various business scenarios, which may include, but is not limited to, expense reimbursement collection machines, mobile APPs, financial data entry terminals, business application PCs, etc. It serves as the system's "grassroots observation post".

[0023] Business terminal 101 and audit platform 102 establish bidirectional real-time communication using a long connection combining WebSocket and gRPC, realizing a second-level closed loop of front-end data collection, platform analysis, and front-end response.

[0024] Business terminal 101 is equipped with containerized edge computing nodes. For example, Docker / K3s containerization technology is used to deploy edge computing nodes on each business terminal 101. The edge computing nodes are used to listen for users' ticket approval applications through Hook technology or message middleware (such as Kafka / RabbitMQ) subscribers, and collect the corresponding ticket data and behavior data in real time when a ticket approval application is detected.

[0025] The following section provides a detailed introduction to the front-end edge awareness method executed by business terminal 101. Figure 2 A flowchart illustrating a front-end edge awareness method executed by a service terminal 101 according to an embodiment of this application is shown. (Refer to...) Figure 2 As shown, the front-end edge awareness method executed by the service terminal 101 includes the following steps: Step S210: In response to the invoice review application, collect invoice data and behavioral data in real time; wherein, the invoice data includes: invoice image and metadata.

[0026] When an employee initiates a document review application (such as submitting a reimbursement form or entering an invoice) through the business terminal 101, the containerized edge computing node (i.e., the grassroots observation post) deployed on the business terminal 101 is immediately triggered to complete the following full-dimensional data collection.

[0027] Ticket Image: Image information of the ticket.

[0028] Metadata: The source and business information associated with the invoice, which may include, but is not limited to: submitter information, submission time, fee type, fee amount, project code, and invoice header.

[0029] Behavioral data: Information related to the actions of enterprise employees, which may include, but is not limited to: submission frequency, device information, and operation trajectory.

[0030] For example, when employee A submits a travel expense reimbursement application through a payment terminal and clicks "save and submit", the edge computing node immediately collects employee A's employee ID, submission time, travel type, total reimbursement amount, project code, and invoice header. At the same time, it collects images of air tickets, hotel and restaurant invoices, and synchronously collects employee A's submission frequency, device information, and operation trajectory, thus completing the collection of invoice data and behavioral data.

[0031] Step S220 involves preprocessing, pre-verifying, and structurally encapsulating the invoice data to form an audit invoice.

[0032] Before data leaves the network, business terminal 101 completes preprocessing, pre-verification, and structured encapsulation. On the one hand, it filters out obviously invalid and incomplete invoice review applications at the source, significantly reducing the invalid data processing pressure and computational load of review platform 102, and improving overall review efficiency. On the other hand, through local preprocessing and structured encapsulation, it avoids the exposure of sensitive financial information during transmission, reduces the risk of data leakage, and ensures that the data format transmitted to review platform 102 is uniform, providing a high-quality data foundation for subsequent multi-engine concurrent review by review platform 102, thereby achieving efficient connection between front-end edge awareness and intelligent review platform.

[0033] Preprocessing includes: data anonymization and data deduplication of metadata to obtain preprocessed metadata.

[0034] Sensitive information such as employee ID numbers and invoice headers is masked, retaining only non-sensitive fields. Duplicate metadata is eliminated through methods such as data hash value comparison to avoid data redundancy.

[0035] Pre-verification includes: verifying the integrity of pre-processed metadata, verifying the legality of invoices, and verifying the reasonableness of fee amounts. Once the pre-verification is passed, the audit metadata is obtained.

[0036] After preprocessing, three-level pre-validation can be performed based on a lightweight local rule base to filter obviously invalid invoice review applications.

[0037] Data integrity verification may include, but is not limited to, verifying whether the invoice image is clear and whether the metadata fields are complete.

[0038] Verification of invoice validity may include, but is not limited to, checking whether the invoice header is the full name of the company, whether the submission time is within the valid business cycle, and whether the project code format is correct.

[0039] The verification of the reasonableness of the fee amount may include, but is not limited to, checking whether the fee amount exceeds the basic threshold (such as the single transaction limit) and whether the detailed amount matches the total amount.

[0040] For example, if the invoice submitted by an employee is addressed to an individual rather than a company, the pre-verification will fail, and the business terminal 101 will display a message saying "Invoice header is invalid, please resubmit," and the invoice will no longer be transmitted to the review platform 102.

[0041] The structured encapsulation includes: generating a unique tracking code for the audit metadata, binding the audit metadata carrying the unique tracking code to the ticket image in both directions and signing it, and then encapsulating it in JSON or Protobuf format to obtain the audit ticket.

[0042] Generate a globally unique UUID tracking code for each audit metadata (corresponding to each invoice audit application) for use in the entire audit data association process.

[0043] Binding invoice images to audit metadata with digital signatures prevents data tampering and ensures the traceability of audit leads.

[0044] The invoice image and audit metadata are encapsulated into a standardized audit invoice data package in JSON or Protobuf format, which facilitates rapid parsing and analysis by the audit platform 102.

[0045] Step S230: After encrypting the audit ticket, transmit the data along with the behavior data to the audit platform 102.

[0046] The national cryptographic algorithm SM4 is used to encrypt the audit documents, and then the encrypted audit documents, along with the behavioral data, are transmitted stably, in real time, and securely to the audit platform 102 via a WebSocket+gRPC long connection.

[0047] In this embodiment, the containerized edge computing node deployed on the business terminal 101 is fundamentally different from traditional passive real-time data acquisition technology. Traditional real-time data acquisition only serves as a data transport tool, unidirectionally uploading raw data to the review platform 102 for processing; while the grassroots observation post of this application, as a front-end risk control perception node, can complete data preprocessing, pre-verification, and structured encapsulation locally on the business terminal 101, and establish bidirectional real-time communication with the review platform 102. It has the ability to receive applications and intercept data at the front end, thereby improving data security from the source, reducing the processing pressure on the review platform 102, and realizing real-time risk control linkage across the entire chain. Specific comparisons are shown in Table 1.

[0048] Table 1. Comparison between edge computing nodes and traditional real-time acquisition technologies:

[0049] The audit platform 102 is the core decision-making module of the system. It adopts a microservice architecture and is deployed on the enterprise's private cloud or server cluster. As the "brain" of the system, it realizes intelligent financial auditing, decision-making and instruction issuance.

[0050] The audit platform 102 uses shared memory and a TEE trusted execution environment to achieve secure data storage and efficient access.

[0051] The audit platform 102 stores received audit documents and related heterogeneous business data (including behavioral and business data) in shared memory, using a zero-copy approach for access and reading by the OCR engine, rule engine, and intelligent risk control engine. This allows multiple engines to simultaneously read the same data address, avoiding repeated serialization and deserialization of data packets between different microservices and significantly improving data reading efficiency.

[0052] Meanwhile, the audit platform 102 uses a Trusted Execution Environment (TEE) to protect the data in shared memory. This means that a TEE is introduced at the memory computing level to ensure that data remains protected in shared memory even when concurrently accessed by multiple engines.

[0053] The audit platform 102 is used to acquire audit invoices, behavioral data, and business data. Audit invoices include invoice images and audit metadata. The behavioral and business data are standardized to obtain related heterogeneous business data. The OCR engine is used to extract key fields from the invoice images to obtain invoice structure data. The invoice structure data, audit metadata, and related heterogeneous business data are then merged into a unified structured feature. This unified structured feature is distributed asynchronously and non-blockingly to the rule engine and intelligent risk control engine in parallel with zero copies. The rule engine performs compliance checks on the unified structured feature based on preset financial audit rules, outputting a boolean result indicating whether the rule was hit and the hit rule number. The intelligent risk control engine assesses the risk level of the unified structured feature based on a trained risk identification model, outputting a risk score. Competitive consensus decisions are made based on the hit / miss result and the risk score, generating risk decision conclusions, risk basis, and corresponding execution instructions.

[0054] The following is a detailed introduction to the financial intelligent auditing methods implemented by the auditing platform 102. Figure 3 A flowchart illustrating a financial intelligent auditing method performed by an auditing platform 102 according to an embodiment of this application is shown. (Refer to...) Figure 3 As shown, the financial intelligent auditing method executed by the auditing platform 102 includes the following steps: Step S310: Obtain audit invoices, behavioral data, and business data.

[0055] The audit platform 102 establishes a unified data access and processing layer to receive data from business terminals 101 and other business systems and perform pre-processing.

[0056] The audit platform 102 receives behavioral data and encrypted audit tickets from the business terminal 101. After completing the national cryptographic SM4 decryption and integrity verification, it extracts the ticket image and audit metadata.

[0057] Simultaneously, business data is obtained from business systems (such as corporate financial systems, corporate contract systems, etc.). Business data may include, but is not limited to: job level limits, travel standards, contract information, and project information.

[0058] Step S320: Standardize the behavioral data and business data to obtain related business heterogeneous data, call the OCR engine to extract key fields from the invoice image to obtain invoice structure data, and integrate the invoice structure data, audit metadata and related business heterogeneous data into a unified structured feature.

[0059] The audit platform 102 performs pre-processing on behavioral and business data, including format unification, data cleaning, redundancy removal, and standardized mapping, to obtain heterogeneous data related to business that are formatted uniformly and can be directly used for audit analysis.

[0060] Meanwhile, the audit platform 102 calls the OCR engine to recognize and parse the invoice image, extracting key fields such as amount, bank account number, tax number, invoice date, merchant name, travel information and location information, to obtain structured invoice data.

[0061] Furthermore, the audit platform 102 aligns and merges the fields of the invoice structure data, audit metadata, and heterogeneous data of related businesses to form a unified structured feature for parallel auditing by multiple engines, ensuring that the input data of the rule engine and the intelligent risk control engine are standardized and complete.

[0062] In step S330, the unified structured features are distributed to the rule engine and the intelligent risk control engine in parallel with zero copy through an asynchronous non-blocking method.

[0063] Based on heterogeneous protocol adaptation using the task orchestration bus, the 102 audit platform standardizes the inputs and outputs of the OCR engine, rule engine, and intelligent risk control engine through an adapter pattern. After eliminating protocol differences between heterogeneous engines, it employs a Go coroutine or Actor model to asynchronously and non-blockingly distribute unified structured features to the rule engine and intelligent risk control engine in parallel via shared memory in a zero-copy manner. Multiple engines can independently and concurrently read data and perform audit calculations without waiting for preceding engines to complete, avoiding multiple data copies and transmission losses, further improving audit concurrency and response speed.

[0064] Step S340: The rule engine performs compliance verification on the unified structured features based on the preset financial audit rules, and outputs a boolean result indicating whether the rule is hit and the hit rule number.

[0065] The audit platform 102 calls the rule engine to perform compliance verification on the unified structured features based on the preset financial audit rules; among them, the preset financial audit rules include at least: spatiotemporal consistency sub-rules, budget limit sub-rules, invoice validity sub-rules, and entity compliance sub-rules.

[0066] If any sub-rule fails the validation, the hit result and the corresponding rule number will be output.

[0067] If all sub-rule validations pass, then output a miss result.

[0068] The preset financial audit rules are pre-configured, strongly binding financial compliance rules, including at least: time-space consistency sub-rules, budget limit sub-rules, invoice validity sub-rules, and entity compliance sub-rules. The rule engine performs Boolean logic checks on each of the above sub-rules based on the invoice structure data, audit metadata, and heterogeneous data from related businesses contained in the unified structured features, to determine whether the current invoice audit application complies with the company's financial system and compliance requirements.

[0069] The spatiotemporal consistency sub-rule is used to verify whether the business behavior corresponding to the invoice matches reasonably in terms of time and space. The spatiotemporal consistency sub-rule may include, but is not limited to, verifying whether the location information on the invoice corresponds to the merchant information, whether the invoice date overlaps with the business execution time, and whether the location information matches the itinerary information. If there is a logical contradiction in spatiotemporal consistency, the spatiotemporal consistency sub-rule verification will fail.

[0070] The budget limit sub-rule is used to verify whether the expense amount of an invoice exceeds the corresponding budget standard and job level limit. The budget limit sub-rule may include, but is not limited to, verifying whether the expense amount exceeds the city travel standard corresponding to the employee's job level, whether it exceeds the total project budget, whether it exceeds the single reimbursement limit, and whether the detailed expenses meet the limit requirements for the corresponding expense type. If the amount exceeds the corresponding limit standard, the budget limit sub-rule verification fails.

[0071] The bill validity period sub-rule is used to verify the legality and validity of the invoice issuance date. This sub-rule may include, but is not limited to, verifying whether the invoice issuance date is within the valid business cycle and whether the invoice issuance date and submission date exceed the stipulated reimbursement deadline. If the bill validity period does not meet the requirements, the bill validity period sub-rule verification will fail.

[0072] The entity compliance sub-rule is used to verify the legality and compliance of merchant information. This sub-rule may include, but is not limited to, verifying whether the invoice header is the company's full legal name, whether the tax number is valid, and whether the invoice header and tax number match. If the entity information does not fall within the scope of compliant reimbursement, the entity compliance sub-rule verification will fail.

[0073] If any sub-rule fails validation, the rule engine outputs a hit result and the corresponding rule number. Only if all sub-rules pass validation does the rule engine output a miss result.

[0074] For example: Employee A submits a travel expense reimbursement application through business terminal 101. Business terminal 101 reports the approved invoice and behavioral data to the review platform 102. After integrating the business data, the review platform 102 obtains a unified structured feature and calls the rule engine to perform sub-rule verification. The rule engine verification finds that: the location information of the invoice is Beijing, while the destination recorded in the project information is Shanghai. The spatial information of the two does not match, so the spatiotemporal consistency sub-rule verification fails; or, the amount of the invoice is 2,000 yuan, which exceeds the limit for employee A's job level, so the budget limit sub-rule verification fails. Since at least one sub-rule verification fails, the rule engine determines that this invoice review application violates a rule and outputs the result of the violation, as well as the rule numbers corresponding to the spatiotemporal consistency sub-rule and the budget limit sub-rule, so that the review platform 102 can make subsequent risk decisions and issue instructions.

[0075] In step S350, the intelligent risk control engine assesses the risk level of the unified structured features based on the trained risk identification model and outputs a risk score.

[0076] The intelligent risk control engine loads a pre-trained risk identification model and performs high-dimensional feature extraction and risk inference on unified structured features. During the inference phase, the intelligent risk control engine inputs the unified structured features into the pre-trained risk identification model, which sequentially undergoes feature embedding, relationship awareness, temporal memory, and discriminative output, ultimately outputting a risk score in the range of 0 to 1. This risk score is used to compete with the rule engine's hit or miss results for consensus-based decision-making.

[0077] The risk identification model employs a hybrid deep learning architecture, specifically comprising a feature embedding layer, a relationship-aware layer, a temporal memory layer, and a discriminative output layer, all connected in sequence. These layers are cascaded to identify abnormal behaviors, hidden connections, and fraud patterns behind unified structured features, and output a risk score. A higher risk score indicates a higher degree of suspicion and risk level for the invoice review application.

[0078] The feature embedding layer is used to convert discrete features in a unified structured feature set into continuous dense vectors, thereby realizing the vectorized representation of non-numerical features.

[0079] Discrete features may include, but are not limited to, submitter information, merchant information, and fee type. The feature embedding layer projects high-dimensional sparse discrete features onto a low-dimensional dense vector space through embedding mapping, obtaining standardized feature embedding vectors, which provide a unified computational foundation for subsequent relationship perception and temporal memory.

[0080] The relationship-aware layer uses a GCN graph convolutional network to aggregate features of entity relationships in order to identify the risk of associated fraud.

[0081] The relationship-aware layer uses submitters, bank accounts, and merchants as entity nodes, and transaction behaviors, expense records, affiliations, fund transfers, and contractual relationships as edges to construct a financial risk relationship graph. Iterative aggregation of features from neighboring nodes is achieved through graph convolution operations, enabling deep perception of relationships. During the graph convolution feature aggregation process using GCN in the relationship-aware layer, the centrality and connectivity indices of each entity node are further calculated. By analyzing the importance, connectivity, and community aggregation status of nodes in the relationship graph, potential high-level hidden risks such as group fraud, multi-person collaborative violations, centralized manipulation by related parties, and covert collusion between employees and merchants are identified.

[0082] The temporal memory layer uses a Transformer self-attention network to learn temporal features of submission time, submission frequency, and operation trajectory to identify abnormal operation patterns.

[0083] The temporal memory layer is used to learn and memorize long-span temporal behavioral characteristics. Taking submission time, submission frequency, and operation trajectory as input, it captures employees' historical behavioral habits, periodic patterns, and abnormal deviations through a self-attention mechanism. This effectively identifies temporal anomalies such as sudden large expense claims, high-frequency submissions in the early morning, concentrated applications within a short period, and drastic deviations from historical behavior, achieving precise capture of hidden operational trajectories. For example, the temporal offset can be determined by calculating the Mahalanobis distance between the current behavior and the historical baseline.

[0084] The output layer uses the Softmax activation function to output a risk score in the range of 0 to 1.

[0085] The discriminant output layer receives features from the relational perception layer and the temporal memory layer, integrates these features through a fully connected layer, and uses the Softmax activation function to map the output to the 0-1 range to obtain the final risk score. The risk score characterizes the risk level of the current invoice review application: the closer the risk score is to 1, the higher the probability of fraud and anomalies; the closer the risk score is to 0, the higher the compliance credibility.

[0086] For training the risk identification model, considering the financial audit scenario with scarce violation samples and extremely imbalanced positive and negative samples, a combined training strategy of unsupervised pre-training, negative sample augmentation, supervised fine-tuning, and focus loss function constraints is adopted. The specific steps are as follows: Construct an initial risk identification model. This initial risk identification model consists of a feature embedding layer, a GCN relationship-aware layer, a Transformer temporal memory layer, and a discriminative output layer.

[0087] Unsupervised learning samples are constructed using historically unlabeled unified structured features; the initial risk identification model is then pre-trained using these unsupervised learning samples to learn the feature distribution, resulting in a pre-trained risk identification model.

[0088] Using a massive amount of unlabeled, uniformly structured features from historical data as unsupervised learning samples, the initial risk identification model is pre-trained in an unsupervised manner. This allows the initial risk identification model to learn the normal feature distribution patterns, resulting in a pre-trained risk identification model. This process endows the pre-trained risk identification model with basic understanding capabilities.

[0089] Using historically labeled risk-free unified structured features as positive samples and historically labeled risky unified structured features as negative samples, we use oversampling techniques to enhance the negative samples in multiple dimensions and expand the sample to form enhanced negative samples. Based on the positive samples and enhanced negative samples, we construct supervised learning samples.

[0090] Since the number of negative samples is scarce, the SMOTE oversampling technique is used to enhance the negative samples in multiple dimensions and expand the sample space, thereby generating enhanced negative samples and alleviating the problem of sample imbalance.

[0091] The pre-trained risk identification model is fine-tuned using supervised learning samples to obtain a well-trained risk identification model. During the supervised fine-tuning process, a focus loss function is used to reduce the weight of positive samples and increase the weight of enhanced negative samples.

[0092] After constructing supervised learning samples using positive samples and enhanced negative samples, the pre-trained model is then subjected to supervised fine-tuning. During the fine-tuning process, a focal loss function is used to reduce the weight of risk-free samples, increase the risk identification model's attention to risky samples, and enhance the model's sensitivity to identifying hidden risks.

[0093] The formula for the focus loss function is as follows: , formula (1).

[0094] in, This represents the class balance coefficient, used to balance the training weights of samples (positive samples and boosted negative samples). Indicates the predicted probability; This represents the focus parameter, used to reduce the loss weight of risk-free samples, allowing the model to focus more on learning the hidden violation features of risky samples.

[0095] The Adam optimizer is used, with an initial learning rate of 0.001, a first-order moment decay factor of 0.9, a second-order moment decay factor of 0.999, a weight decay of 1e-5, a maximum of 200 training epochs, and a batch size of 64. Cosine annealing decay is employed, with the learning rate multiplied by 0.95 every 10 epochs. Training terminates when the training set focal loss function value falls below 0.01 or the validation set accuracy fails to improve for 5 consecutive epochs.

[0096] Step S360: Based on the hit or miss result and risk score, a competitive consensus decision is made to generate a risk decision conclusion, risk basis and corresponding execution instructions, and the execution instructions corresponding to the risk decision conclusion are sent to the business terminal 101.

[0097] The review platform 102, based on the hit / miss Boolean result from the rules engine and combined with the risk score output by the intelligent risk control engine, executes a competitive consensus decision: If the rule engine outputs a hit result, the risk decision conclusion is determined to be an interception warning; If the rule engine outputs a no-match result and the risk score exceeds the preset threshold, the risk decision conclusion is determined to be a second verification. If the rule engine outputs a no-match result and the risk score does not exceed the preset threshold, the risk decision conclusion is to automatically allow passage.

[0098] For example: if the rules engine outputs a hit result, it is directly judged as high risk, and the review platform 102 generates an interception warning risk decision conclusion; if the rules engine outputs a hit result, but the risk score output by the intelligent risk control engine exceeds 0.85, there may be hidden anomalies, and the review platform 102 generates a secondary verification risk decision conclusion; if the rules engine outputs a hit result, and the risk score output by the intelligent risk control engine does not exceed 0.85, it is judged as low risk, and the review platform 102 generates an automatic release risk decision conclusion.

[0099] Simultaneously, the audit platform 102, based on the contribution of each feature in the unified structured features to the risk decision-making conclusions of interception warnings and secondary verification, forms a risk basis, and then generates audit results including risk decision conclusions, risk basis, and corresponding execution instructions. Based on SHAP / LIME interpretable AI technology, a risk basis heatmap can be generated, clearly marking the key features leading to the risk determination of interception warnings and secondary verification. Based on the risk decision conclusions, execution instructions include: interception warning instructions, secondary verification execution, and automatic release instructions.

[0100] For example: Employee A submits a receipt review application for a travel expense reimbursement of 15,000 yuan. If the rule engine determines that the "amount exceeds the job level threshold" has been triggered, it will directly generate a risk decision conclusion to block and warn, based on the risk that "the amount of a single reimbursement exceeds the individual job level threshold".

[0101] For example, employee A submits a 1200 yuan office supplies reimbursement request for review. The rules engine verifies the unified structured features and confirms no match. However, the intelligent risk control engine, through a risk identification model, determines that employee A's historical average office supplies reimbursement amount over the past 6 months is only 300 yuan. This reimbursement amount suddenly increases to four times the historical average, and the submission time is 2 AM, using uncommon equipment, exhibiting significant abnormal behavior. The final risk score is 0.92, exceeding the preset risk threshold. The review platform 102, based on competitive consensus decision-making logic, determines the risk decision for the second verification, citing "significant deviation of the reimbursement amount from the individual's historical average, abnormal operation timing, and abnormal equipment" as the risk basis.

[0102] For another example: Employee A submits a reimbursement request for 800 yuan in local transportation expenses. The rules engine verifies the unified structured features and confirms no match. The intelligent risk control engine, based on a risk identification model, infers that: Employee A's historical reimbursement behavior is stable; the amount, frequency, time, and device used in this reimbursement are consistent with past habits, with no abnormal correlations, no temporal deviations, and no hidden fraudulent features. The final risk score is 0.12, lower than the preset risk threshold. The review platform 102, based on competitive consensus decision logic, determines an automatic approval risk decision.

[0103] After the decision is made, the review platform 102 encapsulates the risk decision conclusion, risk basis, and execution instructions into a standardized instruction package, and sends it to the corresponding business terminal 101 through a two-way real-time communication link.

[0104] Table 2 below shows a detailed comparison between the rules engine and the intelligent risk control engine.

[0105] Table 2: Detailed comparison of the rule engine and the intelligent risk control engine:

[0106] This embodiment combines hard rule decisions based on preset financial audit rules by a rule engine with soft model decisions based on a trained risk identification model by an intelligent risk control engine. This ensures strong compliance constraints while identifying hidden fraud, significantly improving the accuracy of identifying financial anomalies and hidden fraud. It also provides interpretability and meets the compliance requirements of financial audits.

[0107] Figure 4 A flowchart illustrating an instruction processing feedback method executed by a service terminal 101 according to an embodiment of this application is shown. (Refer to...) Figure 4 As shown, the instruction processing feedback method executed by the service terminal 101 includes the following steps: Choose one of the following steps S410 to S430 to perform.

[0108] Step S410: Execute blocking submission according to the interception warning instruction.

[0109] If the warning instruction is intercepted, the business terminal 101 will immediately block the submission of the invoice review application, lock the operation interface, display the basis for the risk, and prompt the user that the application has been rejected.

[0110] Step S420: Trigger secondary audit based on secondary verification instruction.

[0111] If it is a secondary verification instruction, the business terminal 101 will pause the automatic process, jump to the waiting state, and simultaneously generate an expedited secondary verification task to push to the relevant financial audit personnel, prompting the user that further secondary verification is required.

[0112] Step S430: Complete the review process according to the automatic release instruction.

[0113] If it is an automatic release instruction, the business terminal 101 completes the review process and automatically submits it to the subsequent business system for subsequent steps such as accounting and payment.

[0114] Step S440: Transmit the instruction execution result to the audit platform 102 so that the audit platform 102 records the entire process audit data and instruction execution result into the audit log.

[0115] After completing the corresponding instruction execution operations of interception warning, secondary verification, or automatic release, business terminal 101 transmits the instruction execution status, front-end interface response results, and user operation information (such as viewing prompts, initiating appeals, resubmitting, etc.) back to the audit platform 102 in real time. Upon receiving the instruction execution results, audit platform 102 integrates the full-process audit data, including multi-engine audit results, risk decision conclusions, and execution instruction content, and archives it uniformly, writing it into the audit log library for persistent storage. This forms an immutable, traceable, and auditable complete audit chain, providing true and complete data basis for subsequent strategy optimization and compliance verification.

[0116] In addition, the review platform 102 can statistically analyze indicators such as the interception success rate and appeal rate of each business terminal 101 in real time, dynamically adjust the credit score and credit limit of the corresponding business terminal 101 based on the statistical results, and synchronize the credit level to the pre-verification rule base of the business terminal 101 to achieve linkage and adaptation between the front-end pre-verification strategy and the credit level.

[0117] In addition, if a user files an appeal, the business terminal 101 will simultaneously report the appeal information, and the review platform 102 will automatically schedule a high-performance computing engine to perform a second in-depth verification and re-decision.

[0118] This embodiment moves the risk control point from post-audit to in-process submission, enabling real-time blocking of violations and further reducing losses caused by risk applications.

[0119] The back-end management server 103 is the optimization hub of the system, used to gather data from the entire audit process. Through the indicator evaluation layer, root cause analysis layer, strategy evolution layer, and iterative update layer, it carries out indicator evaluation, risk root cause analysis, common feature mining, and audit strategy iterative optimization, thereby achieving a closed loop for the entire risk prevention and control process.

[0120] The backend management server 103 is used to collect audit data corresponding to each audited document; the audit data includes: unified structured features and risk decision conclusions; the unified structured features are constructed based on audited documents, behavioral data, and business data; the risk decision conclusions are generated by synchronously calling the rule engine to perform compliance verification on the unified structured features based on preset financial audit rules and outputting hit or miss results, and synchronously calling the intelligent risk control engine to perform risk level assessment on the unified structured features based on the trained risk identification model and outputting risk scores, and generating competitive consensus decisions based on hit or miss results and risk scores; the risk decision conclusions include: interception warnings, The process involves secondary verification and automatic release; analysis of audit data to identify risk patterns; these risk patterns include: a first-type risk pattern and / or a second-type risk pattern; the first-type risk pattern is derived from the difference analysis between risk decision conclusions and audit document fact labels; the second-type risk pattern is derived from clustering and correlation analysis of audit data with an automatic release risk decision conclusion; based on the identified risk patterns, an audit strategy optimization plan is generated; this optimization plan includes: a rule optimization plan and a model optimization plan; the preset financial audit rules are updated based on the rule optimization plan, and the parameters of the risk identification model are updated based on the model optimization plan.

[0121] The following is a detailed introduction to the risk control optimization methods implemented on the backend management server 103. Figure 5 A flowchart illustrating a risk control optimization method executed by a backend management server 103 according to an embodiment of this application is shown. (Refer to...) Figure 5 As shown, the risk control optimization method executed by the backend management server 103 includes the following steps: Step S510: Collect audit data corresponding to each audit document; wherein, the audit data includes: unified structured features and risk decision conclusions; the unified structured features are constructed based on audit documents, behavioral data and business data; the risk decision conclusions include: interception warning, secondary verification, and automatic release.

[0122] The back-end management server 103 regularly collects audit data generated during the entire audit process of each audited document. The audit data includes unified structured features and risk decision conclusions. The risk decision conclusions include three categories: interception warning, secondary verification, and automatic release.

[0123] In addition, the backend management server 103 also obtains the fact tags of the audited invoices. The fact tags are automatically generated by the business system based on the processing results of the entire audited invoice process, including reimbursed tags and rejected tags. The reimbursed tag is used to indicate that the audited invoice has finally completed the reimbursement process, and the rejected tag is used to indicate that the audited invoice will not be reimbursed.

[0124] Step S520 involves statistically analyzing the risk decision conclusions and audited invoice fact labels through the indicator evaluation layer to obtain accuracy indicators and efficiency indicators. Among them, the accuracy indicators include the hit rate of the rule engine and the precision and recall rate of the intelligent risk control engine; the efficiency indicators include the proportion of non-secondary verification.

[0125] The backend management server 103 uses a built-in indicator evaluation layer to statistically analyze risk decision conclusions and audit document fact labels, forming accuracy and efficiency indicators for users to evaluate the system's operational effectiveness.

[0126] Accuracy metrics include: the hit rate of the rule engine, and the precision and recall rate of the intelligent risk control engine.

[0127] The hit rate of the rule engine can be expressed as "the number of invoice review applications for which the rule engine outputs a hit result / the total number of invoice review applications that participate in the review".

[0128] The accuracy of the intelligent risk control engine can be expressed as "the number of invoice review applications that were ultimately marked with a reimbursement rejection label among the invoice review applications whose risk scores output by the intelligent risk control engine exceeded the preset threshold / the number of invoice review applications whose risk scores output by the intelligent risk control engine exceeded the preset threshold".

[0129] The recall rate of the intelligent risk control engine can be expressed as "the number of invoice review applications whose risk scores output by the intelligent risk control engine exceed the preset threshold / the number of invoice review applications that are ultimately marked with the reimbursement rejection label".

[0130] Efficiency indicators include: the percentage of cases that do not require secondary verification.

[0131] The proportion of non-secondary verification can be expressed as "the number of invoice review applications with a risk decision conclusion of non-secondary verification / the total number of invoice review applications participating in the review".

[0132] Step S530: Analyze the audit data to identify risk patterns; wherein, the risk patterns include: a first type of risk pattern and / or a second type of risk pattern; the first type of risk pattern is obtained based on the difference analysis between the risk decision conclusion and the factual label of the audit document; the second type of risk pattern is obtained based on the correlation analysis of the audit data with the risk decision conclusion of automatic release.

[0133] This step comprises two parallel sub-steps: difference analysis to identify the first type of risk pattern and clustering and association analysis to identify the second type of risk pattern. It can be executed through the root cause analysis layer of the backend management server 103.

[0134] When the backend management server 103 performs differential analysis to identify the first type of risk pattern, it obtains the fact labels of the audited invoices. The fact labels include: reimbursed label and reimbursement rejected label. Audited invoices with a risk decision conclusion of interception warning or secondary verification and a fact label of reimbursement rejected are identified as false alarm cases. Audited invoices with a risk decision conclusion of automatic release and a fact label of reimbursement rejected are identified as missed alarm cases. False alarm features and missed alarm features are extracted from the unified structured features corresponding to the false alarm cases and missed alarm cases as the first type of risk pattern.

[0135] False alarm cases are those where the risk decision conclusion is to intercept and issue a warning or conduct secondary verification, but the audited invoice's factual label is marked as reimbursed. This indicates that the rules engine or intelligent risk control engine incorrectly intercepted or identified risks in normally compliant audited invoices.

[0136] The underreported cases are those where the risk decision conclusion was automatic approval, but the fact label on the reviewed invoices was marked as "reimbursement rejected." This indicates that the rules engine or intelligent risk control engine failed to identify the actual existing violation risk.

[0137] For each false positive case, its uniform structured features are extracted to form a false positive feature set; for each false negative case, its uniform structured features are extracted to form a false negative feature set. Then, feature significance analysis methods (such as calculating the difference between the mean of each feature in false positive cases and the mean of all automatically released cases, or using information gain, chi-square test, etc.) are used to select the top K features that contribute the most to false positives / false negatives, which are then used as false positive features / false negative features.

[0138] When the backend management server 103 performs clustering and association analysis to identify the second type of risk pattern, it constructs a feature space and association graph based on the unified structured features of the audit data whose risk decision conclusion is automatic release. Anomaly detection algorithms are executed in the feature space and association graph to identify abnormal data clusters, abnormal subgraph structures, and temporal complementary patterns that deviate from the normal distribution. The common features of abnormal data clusters, abnormal subgraph structures, and temporal complementary patterns are determined as the second type of pattern.

[0139] The backend management server 103 extracts unified structured features from all audit data whose risk decision conclusion is automatic release. Feature dimensions may include, but are not limited to, merchant information, invoice amount, invoice time, bank account number, contract information, etc. Continuous features are standardized using Z-scores, and discrete features are one-hot encoded or embedded vectorized to construct a feature space. Simultaneously, a relationship graph is constructed using entities such as suppliers, bank accounts, invoice issuers, and equipment information as nodes, and transactions, shared accounts, operation on the same equipment, and related projects as edges.

[0140] In the feature space, the density-based clustering algorithm DBSCAN (Density-Based Spatial Clustering of Applications with Noise) is used to cluster the feature space and identify anomalous data clusters that deviate from the normal distribution. These anomalous data clusters are very close to each other in the feature space, but have clear boundaries with the vast majority of automatically released data. Algorithm parameters can be set as follows: for example, a neighborhood radius of 0.5 and a minimum number of neighborhood points of 5.

[0141] In the association graph, a community detection algorithm (Louvain) based on modularity optimization is used to automatically divide closely connected subgraphs. If the transaction behavior of entities in a subgraph exhibits certain common characteristics, the subgraph is marked as an anomalous subgraph structure. For example, if the transaction behavior of all suppliers in a supplier subgraph exhibits the characteristic of evading higher-level approval (e.g., each transaction amount is below the higher-level approval threshold of 50,000 yuan), then the subgraph is marked as an anomalous subgraph structure.

[0142] To uncover more subtle behaviors, cross-correlation analysis is performed on the time series involved in the feature space. For example, the daily invoicing amount series of supplier A and supplier B are as follows: and Calculate latency Cross-correlation coefficients If there exists a certain Make If the total amount curve of the two suppliers is consistently below the approval threshold (strong negative correlation), it is determined to be a collaborative risk avoidance mode.

[0143] The common features in the above-mentioned abnormal data clusters, abnormal subgraph structures, and time-series complementary patterns (such as bank account similarity > 85%, identical invoice printer signature codes, and amounts consistently within the 0.9 to 1.0 times threshold range) are identified as the second type of risk pattern.

[0144] Step S540: Based on the identified risk patterns, generate an audit strategy optimization plan; wherein the audit strategy optimization plan includes: a rule optimization plan and a model optimization plan.

[0145] A sandbox simulation environment is built in the backend management server 103 to simulate and evaluate policy adjustments without affecting online business.

[0146] Specifically, based on the false alarm characteristics in the first type of risk model, a first sub-scheme is generated to reduce the sensitivity of the preset financial audit rules or reduce the weight of the corresponding feature in the risk identification model; based on the false negative characteristics in the first type of risk model, a second sub-scheme is generated to increase the sensitivity of the preset financial audit rules or increase the weight of the corresponding feature in the risk identification model; based on the common characteristics in the second type of risk model, a third sub-scheme is generated to add audit rules or add model features; through reinforcement learning, the first, second, and third sub-schemes are used as candidate actions, with improvements in accuracy or efficiency indicators as rewards, and the candidate actions or combinations of candidate actions are simulated and evaluated in a sandbox simulation environment, and the scheme with the best evaluation result is selected as the audit strategy optimization scheme.

[0147] Based on the identified risk patterns, three types of sub-solutions are automatically generated as candidate actions for reinforcement learning: The first sub-solution (targeting false alarm characteristics): reduce the sensitivity of preset financial audit rules (for example, relax the threshold for exceeding accommodation standards from 5% to 10%), or reduce the weight of the corresponding characteristics in the risk identification model.

[0148] The second sub-solution (targeting underreporting characteristics): increase the sensitivity of preset financial audit rules (for example, reduce the threshold for the frequency of submissions by the same device in the early morning from 5 times / hour to 3 times / hour), or increase the weight of the corresponding characteristics in the risk identification model.

[0149] The third sub-option (addressing new common features in the second risk model): adding new audit rules and / or adding new model features.

[0150] The process of generating the third sub-scheme is as follows: (a) Feature saliency assessment: The saliency of common features is assessed, the contribution of each feature to the abnormal clustering is calculated, and features whose contribution exceeds a preset threshold are taken as key features.

[0151] For each new common feature in the second type of risk pattern, calculate its contribution to the abnormal clustering (e.g., using information gain or SHAP value). Features with a contribution exceeding a preset threshold (e.g., 0.6) are selected as key features.

[0152] (b) Automatically generate new audit rules: Select a matching logic template from the preset logic template library based on the attributes of key features and fill the key features into the logic template to generate candidate rules. Backtest the candidate rules using audit data in the sandbox simulation environment, calculate the false alarm rate and hit rate of the candidate rules. If the false alarm rate and hit rate meet the preset requirements, the candidate rule is determined as a new audit rule.

[0153] Automatic candidate rule generation: Based on the attributes of key features (such as numerical, categorical, or temporal), a matching template is selected from a pre-defined logical template library. For example, for the "bank account similarity" feature, the template is: "If the similarity of {attribute} between any two entities in the {supplier set} exceeds {threshold}%, then trigger an alert and block." The optimal threshold is automatically determined using the Otsu's Method.

[0154] Rule induction optimization: The RIPPER algorithm (Repeated Incremental Pruning to ProduceError Reduction) is used to prune the generated candidate rules. During the growth phase, the algorithm continuously adds predicates (e.g., amount, time, correlation), and during the pruning phase, it removes redundant conditions that may lead to overfitting, ultimately outputting concise candidate rules with strong generalization ability.

[0155] Simulation backtesting: In a sandbox environment, candidate rules are applied to historical audit data to calculate the false positive rate and hit rate. If the false positive rate is lower than a preset threshold (e.g., 5%) and the hit rate is higher than expected, the candidate rule is added as a new audit rule.

[0156] (c) Automatically generate model feature configuration: Identify key features or combinations of key features as new model features and generate model feature configurations for updating the input dimensions of the risk identification model.

[0157] The first, second, and third sub-schemes and their combinations are used as candidate actions for reinforcement learning, with improvements in accuracy and efficiency metrics as rewards. Q-learning or Deep Q-Network (DQN) is used to perform multiple simulation iterations for each candidate action in a sandbox environment. The action or action combination with the highest cumulative reward is selected as the final optimized review strategy.

[0158] Step S550: Update the preset financial audit rules based on the rule optimization scheme, and update the parameters of the risk identification model based on the model optimization scheme.

[0159] In response to the rule optimization scheme, the backend management server 103 will deploy the newly added audit rules to the rule engine in shadow mode so that they run but only record the hit or miss results. In response to the confirmation that the false alarm rate in shadow mode is lower than the preset threshold, the newly added audit rules will be incorporated into the preset financial audit rules.

[0160] For newly added audit rules, a shadow mode is used for secure deployment. This means the new audit rule is deployed to the rule engine in a "logging only, not blocking" manner, running in parallel with existing rules. The hit / miss results of the new audit rule in real business flows are continuously monitored. If the false positive rate is below a preset threshold (e.g., 5%) after 7 consecutive days of operation, the new audit rule is incorporated into the preset financial audit rules upon confirmation. If the false positive rate exceeds the threshold, the system automatically rolls back the new audit rule and records the reason for further optimization.

[0161] Alternatively, for model optimization schemes, the model feature configuration can be sent to the feature embedding layer of the risk identification model, triggering incremental training of the risk identification model so that the model feature configuration takes effect during subsequent financial intelligent audits.

[0162] The model feature configuration is added to the feature embedding layer of the risk identification model to expand the dimension of the input vector. The risk identification model is fine-tuned using a focus loss function combined with positive samples and enhanced negative samples. An active learning strategy is employed to select samples whose predicted confidence levels are at the boundary, and these samples are prioritized for annotation by senior reviewers. Annotated samples participate in stochastic gradient descent updates in real time. After the update is complete, the new model parameters are pushed to the intelligent risk control engine of the review platform 102 via hot deployment, achieving seamless switching.

[0163] In addition, the relationship graphs identified in the second type of risk pattern can be written into the audit platform 102 as background knowledge for subsequent calls by the intelligent risk control engine.

[0164] To further illustrate the technical effectiveness of this system, two specific implementation examples are provided, based on actual corporate financial audit scenarios, covering two core scenarios: real-time interception of travel expense reimbursements and optimization of supplier fraud detection.

[0165] Example 1: Real-time interception of high-risk travel expenses.

[0166] Scenario Description: Employee A of a large company submitted an international travel expense reimbursement application through the system, which included multiple airfare, hotel, and catering invoices, with a reimbursement amount of 15,000 yuan, far exceeding his historical average of 5,000 yuan. Moreover, the invoices had consecutive numbers. Traditional review would require centralized manual processing, which would result in a risk delay of several weeks.

[0167] The implementation process of the system provided in this application is as follows: Business terminal 101 data acquisition and preprocessing: The edge node of the acquiring machine collects ticket images, metadata and behavioral data in real time, completes preprocessing and pre-verification, and transmits them to the middle platform after encapsulation and encryption. The audit platform handles 102 concurrent audits: It acquires business data and extracts invoice structure data through the OCR engine. Based on the invoice structure data, metadata, and business data, the rule engine determines that "the amount exceeds twice the historical average" and the intelligent risk control engine identifies the risks of "consecutive invoices and supplier litigation". The risk score is 0.92. Consensus Decision: The review platform 102 determines that the issue is an interception warning and issues an interception warning instruction; Business terminal 101 executes: The acquiring machine locks the submit button, pops up a warning prompt, and completes the interception.

[0168] Technical effects: Risk response time has been reduced from weeks to 2 seconds, enabling real-time interception of large-scale fraudulent expense claims, preventing financial losses, and standardizing employee compliance operations.

[0169] Example 2: Discovery and optimization of supplier collaborative fraud patterns.

[0170] Scenario Description: A large enterprise's financial audit platform 102 has been running for three months, accumulating hundreds of thousands of audit records. The risk manager wants to uncover potential supplier collaborative fraud patterns that are not covered by the existing rule engine and intelligent risk engine.

[0171] The implementation process of the system provided in this application is as follows: Extract all audit data for the "Supplier Payment" category from the audit logs over the past month. Each data entry contains uniform structured features: merchant information, invoice amount, invoice date, bank account number, project information, etc.

[0172] The calculation shows that the current rule engine has a 72% coverage rate for identifying supplier payments, indicating a high risk of missed reports.

[0173] By constructing a feature space and running DBSCAN clustering, an anomalous cluster was found containing 15 suppliers. Their common characteristics were that the amount of a single invoice was between 48,000 and 49,900 yuan, and the invoice dates alternated.

[0174] A supplier association graph was constructed, and the Louvain algorithm was used to find that the 15 suppliers belong to the same community: they share the same last four digits of bank account numbers, the same invoice printer feature code, and their registered addresses are different rooms in the same office building.

[0175] Cross-correlation analysis was performed on the time series of invoice amounts for suppliers A and B, revealing a strong negative correlation. The combined amount curve for the two suppliers remained consistently between 49,000 and 99,000 yuan, perfectly circumventing the 50,000 yuan single-transaction approval threshold. This pattern was labeled as a "collaborative risk avoidance pattern," and its key features were extracted: {bank account similarity > 85%, amount / threshold ratio ∈ [0.96, 0.998], invoice time complementarity index < -0.7}.

[0176] Information gain calculation revealed that the two features "bank account similarity" and "amount to threshold ratio" contributed the most.

[0177] A template was selected from the template library: "If the similarity of bank account numbers between any two suppliers in the {supplier set} exceeds the {threshold}%, and their {single transaction amount} is greater than the {lower limit} times the approval threshold, an alert is triggered." The optimal similarity threshold was calculated using the Otsu method to be 87%, and the lower limit for the amount was 0.95 times the threshold. The initial rule contained three conditions. After trimming and removing the redundant "complementary invoicing time index" condition, a simplified rule was obtained: "Under the same procurement project, if the similarity of bank account numbers between two or more suppliers is ≥87%, and the amount of each invoice is ≥0.95 times the approval threshold, then a collaborative fraud alert is issued." This rule was applied to historical audit data from the past three months, showing a false positive rate of 3.2% and a hit rate of 94%. The new audit rule was deployed to the rule engine in shadow mode. After running for one week, the actual false positive rate was 2.8%, and it was subsequently incorporated into the preset financial audit rules.

[0178] Meanwhile, "bank account similarity" and "amount / threshold ratio" were added as new features to the feature embedding layer of the risk identification model, triggering incremental training. An active learning strategy was adopted, pushing samples with model-predicted risk scores between 0.8 and 0.9 to senior auditors for annotation. After fine-tuning the model, it was hot-deployed online.

[0179] The 15 identified abnormal suppliers and their related relationships were entered into the audit platform 102 and labeled as "suspected gang".

[0180] Figure 6 A schematic diagram of a financial intelligent auditing device according to an embodiment of this application is shown. (Refer to...) Figure 6 As shown, the financial intelligent auditing device 600 includes: The data acquisition unit 610 is used to acquire audit tickets, behavioral data, and business data; among which, audit tickets include ticket images and audit metadata; The feature fusion unit 620 is used to standardize behavioral data and business data to obtain related business heterogeneous data, call the OCR engine to extract key fields from the invoice image to obtain invoice structure data, and fuse the invoice structure data, audit metadata and related business heterogeneous data into a unified structured feature. The parallel scheduling unit 630 is used to distribute the unified structured features to the rule engine and the intelligent risk control engine in a parallel manner with zero copy through an asynchronous and non-blocking approach. The rule engine performs compliance verification on the unified structured features based on preset financial audit rules and outputs a boolean result indicating whether the rule is hit and the hit rule number. The intelligent risk control engine evaluates the risk level of the unified structured features based on a trained risk identification model and outputs a risk score. The consensus decision-making unit 640 is used to make competitive consensus decisions based on the hit or miss results and risk scores, and generate risk decision conclusions, risk basis and corresponding execution instructions.

[0181] In some optional implementations, the data acquisition unit 610 is specifically used to: acquire audit tickets and behavioral data reported by edge computing nodes; acquire business data from the business system; wherein the business data includes: job level limits, travel standards, contract information, and project information.

[0182] In some optional implementations, the feature fusion unit 620 is specifically used to: unify the format of behavioral data and business data, clean the data, remove redundancy and standardize the mapping to obtain related business heterogeneous data; extract key fields from the invoice image based on the OCR engine to obtain invoice structure data; and align and merge the invoice structure data, audit metadata and related business heterogeneous data to form a unified structured feature.

[0183] In some optional implementations, the parallel scheduling unit 630 is specifically used to: invoke the rule engine to perform compliance verification on the unified structured features based on preset financial audit rules; wherein, the preset financial audit rules include at least: spatiotemporal consistency sub-rules, budget limit sub-rules, invoice validity sub-rules, and subject compliance sub-rules; if any sub-rule fails the verification, the hit result and the corresponding rule number are output; if all sub-rules pass the verification, the hit result is output.

[0184] In some optional implementations, the risk identification model is a hybrid deep learning architecture, including a feature embedding layer, a relation-aware layer, a temporal memory layer, and a discriminative output layer connected in sequence. The feature embedding layer is used to convert discrete features in a unified structured feature set into dense vectors. The relation-aware layer is used to aggregate features of entity relations using a GCN graph convolutional network to identify associated fraud risks. The temporal memory layer is used to learn temporal features of submission time, submission frequency, and operation trajectory using a Transformer self-attention network to identify abnormal operation patterns. The discriminative output layer is used to output a risk score in the range of 0 to 1 using a Softmax activation function.

[0185] In some optional implementations, the risk identification model is trained using the following methods: constructing an initial risk identification model; constructing unsupervised learning samples using historically unlabeled uniform structured features; performing unsupervised pre-training on the initial risk identification model using the unsupervised learning samples to learn the feature distribution, resulting in a pre-trained risk identification model; using historically labeled risk-free uniform structured features as positive samples and historically labeled risky uniform structured features as negative samples, performing multi-dimensional feature enhancement and sample expansion on the negative samples using oversampling techniques to form enhanced negative samples; constructing supervised learning samples based on the positive samples and enhanced negative samples; and performing supervised fine-tuning on the pre-trained risk identification model using the supervised learning samples to obtain a trained risk identification model; wherein, during the supervised fine-tuning process, a focus loss function is used to reduce the weight of positive samples and increase the weight of enhanced negative samples.

[0186] In some optional implementations, the consensus decision unit 640 is specifically used for: if the rule engine outputs a hit result, then determining the risk decision conclusion as an interception warning; if the rule engine outputs a miss result and the risk score exceeds a preset threshold, then determining the risk decision conclusion as a secondary verification; if the rule engine outputs a miss result and the risk score does not exceed a preset threshold, then determining the risk decision conclusion as automatic release; forming a risk basis based on the contribution of each feature in the unified structured features to the interception warning and secondary verification risk decision conclusions; and generating an audit result including the risk decision conclusion, the risk basis, and the corresponding execution instructions.

[0187] Figure 7 A schematic diagram of a risk control optimization device according to an embodiment of this application is shown. (Refer to...) Figure 7 As shown, the risk control optimization device 700 includes: The data acquisition unit 710 is used to collect the audit data corresponding to each audit document; the audit data includes: unified structured features and risk decision conclusions; the unified structured features are constructed based on audit documents, behavioral data and business data; the risk decision conclusions include: interception warning, secondary verification, and automatic release; Risk analysis unit 720 is used to analyze audit data and identify risk patterns; wherein, the risk patterns include: a first type of risk pattern and / or a second type of risk pattern; the first type of risk pattern is obtained based on the difference analysis between risk decision conclusions and audit document fact labels; the second type of risk pattern is obtained based on the correlation analysis of audit data with risk decision conclusions of automatic release; The strategy generation unit 730 is used to generate an audit strategy optimization scheme based on the identified risk patterns; wherein the audit strategy optimization scheme includes: a rule optimization scheme and a model optimization scheme; The prevention and control optimization unit 740 is used to update the preset financial audit rules based on the rule optimization scheme and to update the parameters of the risk identification model based on the model optimization scheme.

[0188] In some optional implementations, the device further includes: an indicator evaluation unit, used to perform statistical analysis on risk decision conclusions and audit document fact labels through the indicator evaluation layer to obtain accuracy indicators and efficiency indicators; wherein, the accuracy indicators include: the hit rate of the rule engine, the precision rate and recall rate of the intelligent risk control engine; and the efficiency indicators include: the proportion of non-secondary verification.

[0189] In some optional implementations, the risk analysis unit 720 is specifically used to: obtain fact tags for audited invoices; wherein the fact tags include: reimbursed tags and reimbursement rejected tags; identify audited invoices with a risk decision conclusion of interception warning or secondary verification and a fact tag of reimbursement rejected as false alarm cases; identify audited invoices with a risk decision conclusion of automatic release and a fact tag of reimbursement rejected as missed alarm cases; extract false alarm features and missed alarm features from the unified structured features corresponding to false alarm cases and missed alarm cases as the first type of risk mode.

[0190] In some optional implementations, the risk analysis unit 720 is specifically used to: construct a feature space and a correlation graph based on the unified structured features of the audit data for which the risk decision conclusion is automatic release; execute an anomaly detection algorithm in the feature space and correlation graph to identify anomalous data clusters, anomalous subgraph structures, and temporal complementary patterns that deviate from the normal distribution; and determine the common features of the anomalous data clusters, anomalous subgraph structures, and temporal complementary patterns as a second type of pattern.

[0191] In some optional implementations, the strategy generation unit 730 is specifically used to: construct a sandbox simulation environment; generate a first sub-scheme based on the false alarm characteristics in the first type of risk mode to reduce the sensitivity of the preset financial audit rules or reduce the weight of the corresponding feature in the risk identification model; generate a second sub-scheme based on the false alarm characteristics in the first type of risk mode to increase the sensitivity of the preset financial audit rules or increase the weight of the corresponding feature in the risk identification model; generate a third sub-scheme based on the common characteristics in the second type of risk mode to add audit rules and / or add model features; and use the first, second, and third sub-schemes as candidate actions through reinforcement learning, with the improvement of accuracy or efficiency indicators as a reward, to simulate and evaluate the candidate actions or combinations of candidate actions in the sandbox simulation environment, and select the scheme with the best evaluation result as the audit strategy optimization scheme.

[0192] In some optional implementations, the strategy generation unit 730 is further specifically used for: evaluating the saliency of common features, calculating the contribution of each feature to the abnormal clustering, and using features whose contribution exceeds a preset threshold as key features; selecting a matching logical template from a preset logical template library based on the attributes of the key features and filling the logical template with the key features to generate candidate rules; backtesting the candidate rules using audit data in a sandbox simulation environment, calculating the false positive rate and hit rate of the candidate rules, and determining the candidate rules as new audit rules if the false positive rate and hit rate meet preset requirements; or, determining key features or combinations of key features as new model features and generating model feature configurations for updating the input dimensions of the risk identification model.

[0193] In some optional implementations, the prevention and control optimization unit 740 is specifically used to: for the rule optimization scheme, deploy the new audit rule to the rule engine in shadow mode so that it runs but only records the hit or miss results; in response to confirming that the false alarm rate in shadow mode is lower than a preset threshold, incorporate the new audit rule into the preset financial audit rule. Alternatively, for model feature configuration, the model feature configuration can be sent to the feature embedding layer of the risk identification model, triggering incremental training of the risk identification model so that the model feature configuration takes effect during subsequent financial intelligent audits.

[0194] Figure 8 This invention illustrates a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 8As shown, the electronic device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used for communication with external devices via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a financial intelligent auditing method or a risk control optimization method.

[0195] In one embodiment, the electronic device provided in this application includes a memory and a processor. The memory stores a database and a computer program that can run on the processor. When the processor executes the computer program, it implements the steps of a financial intelligent auditing method or a risk control optimization method.

[0196] The above is as stated in this application. Figure 6 The financial intelligent auditing device or illustrated in the embodiments is Figure 7 The method executed by the risk control optimization device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The steps of the method disclosed in the embodiments of this application can be directly embodied as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0197] In one embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of a financial intelligent audit method or a risk control optimization method are implemented.

[0198] It should be noted that the functions or steps that the above-mentioned electronic devices or computer-readable storage media can achieve can be referred to the relevant descriptions in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0199] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0200] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0201] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A financial intelligent auditing method, characterized in that, The method includes: Acquire audit invoices, behavioral data, and business data; among which, audit invoices include invoice images and audit metadata; Standardize behavioral data and business data to obtain related business heterogeneous data, call the OCR engine to extract key fields from the invoice image to obtain invoice structure data, and integrate the invoice structure data, audit metadata and related business heterogeneous data into a unified structured feature; Unified structured features are distributed to the rule engine and intelligent risk control engine in parallel with zero copy through an asynchronous and non-blocking method; The rules engine performs compliance checks on the unified structured features based on preset financial audit rules, and outputs a boolean result indicating whether the rule was hit and the rule number that was hit. The intelligent risk control engine assesses the risk level of unified structured features based on a trained risk identification model and outputs a risk score. Competitive consensus decision-making is conducted based on the hit or miss result and risk score, generating risk decision conclusions, risk basis, and corresponding execution instructions.

2. The financial intelligent auditing method according to claim 1, characterized in that, The acquisition of audit tickets, behavioral data, and business data includes: Obtain audit tickets and behavior data reported by edge computing nodes; Obtain business data from the business system; the business data includes: job level limits, travel standards, contract information, and project information.

3. The financial intelligent auditing method according to claim 1, characterized in that, The process of standardizing behavioral and business data yields related heterogeneous business data. An OCR engine is then used to extract key fields from the invoice image to obtain invoice structure data. Finally, the invoice structure data, audit metadata, and related heterogeneous business data are integrated into a unified structured feature, including: The behavioral and business data are formatted, cleaned, redundant removed, and mapped in a standardized manner to obtain heterogeneous data related to business processes. Key fields are extracted from the invoice image using an OCR engine to obtain the invoice structure data; The data on invoice structure, audit metadata, and heterogeneous data from related business processes are aligned and merged to form a unified structured feature.

4. The financial intelligent auditing method according to claim 1, characterized in that, The rule engine performs compliance checks on the unified structured features based on preset financial audit rules, and outputs a boolean result indicating whether a rule was matched and the matched rule number, including: The rule engine is invoked to perform compliance verification on the unified structured features based on preset financial audit rules; among which, the preset financial audit rules include at least: spatiotemporal consistency sub-rules, budget limit sub-rules, invoice validity sub-rules, and entity compliance sub-rules; If any sub-rule fails the validation, output the hit result and the corresponding rule number; If all sub-rule validations pass, then output a miss result.

5. The financial intelligent auditing method according to claim 1, characterized in that, The risk identification model is a hybrid deep learning architecture, including a feature embedding layer, a relation-aware layer, a temporal memory layer, and a discriminative output layer connected in sequence. The feature embedding layer is used to convert discrete features in a uniform structured feature set into a dense vector; The relation-aware layer is used to aggregate features of entity relations using GCN graph convolutional networks to identify associated fraud risks; The temporal memory layer is used to learn temporal features of submission time, submission frequency, and operation trajectory using a Transformer self-attention network to identify abnormal operation patterns. The output layer is used to output a risk score in the range of 0 to 1 using the Softmax activation function.

6. The financial intelligent auditing method according to claim 5, characterized in that, The risk identification model is trained using the following method: Construct an initial risk identification model; Unsupervised learning samples are constructed using historically unlabeled, uniformly structured features; The initial risk identification model is pre-trained in unsupervised mode using unsupervised learning samples to learn the feature distribution, thus obtaining a pre-trained risk identification model. Using historically labeled risk-free unified structured features as positive samples and historically labeled risky unified structured features as negative samples, we use oversampling techniques to enhance the negative samples in multiple dimensions and expand the samples to form enhanced negative samples. Based on the positive samples and enhanced negative samples, we construct supervised learning samples. The pre-trained risk identification model is fine-tuned using supervised learning samples to obtain a well-trained risk identification model. During the supervised fine-tuning process, a focus loss function is used to reduce the weight of positive samples and increase the weight of enhanced negative samples.

7. The financial intelligent auditing method according to claim 1, characterized in that, The competitive consensus decision-making process based on hit / miss results and risk scores, generating risk decision conclusions, risk basis, and corresponding execution instructions, includes: If the rule engine outputs a hit result, the risk decision conclusion is determined to be an interception warning; If the rule engine outputs a no-match result and the risk score exceeds the preset threshold, the risk decision conclusion is determined to be a second verification. If the rule engine outputs a no-match result and the risk score does not exceed the preset threshold, the risk decision conclusion is to automatically allow passage. The risk basis is formed based on the contribution of each feature in the unified structured features to the interception warning and secondary verification risk decision-making conclusions; Generate audit results that include risk decision conclusions, risk basis, and corresponding execution instructions.

8. A financial intelligent auditing device, characterized in that, The device includes: The data acquisition unit is used to acquire audit tickets, behavioral data, and business data; among which, audit tickets include ticket images and audit metadata; The feature fusion unit is used to standardize behavioral data and business data to obtain related business heterogeneous data, call the OCR engine to extract key fields from the invoice image to obtain invoice structure data, and fuse the invoice structure data, audit metadata and related business heterogeneous data into a unified structured feature. The parallel scheduling unit is used to distribute the unified structured features to the rule engine and the intelligent risk control engine in a parallel manner with zero copy through an asynchronous and non-blocking approach. The rule engine performs compliance verification on the unified structured features based on preset financial audit rules and outputs a boolean result indicating whether the rule is hit and the hit rule number. The intelligent risk control engine evaluates the risk level of the unified structured features based on a trained risk identification model and outputs a risk score. The consensus decision-making unit is used to make competitive consensus decisions based on the hit or miss results and risk scores, and to generate risk decision conclusions, risk basis and corresponding execution instructions.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the financial intelligent auditing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the financial intelligent auditing method as described in any one of claims 1 to 7.

Images