JP2023183187A - Program, and information processing device - Google Patents

Abstract

To detect an abnormal transaction in audit data with unsupervised learning for each transaction, and to present a cause of the abnormality.SOLUTION: First calculation means 113 calculates, as a first feature amount, a feature amount based on correlation between a quantitative variable and a qualitative variable designated by a scenario selected by a user for each of a plurality of transaction records included in data designated by the user. Second calculation means 114 calculates, as a second feature amount, a feature amount based on correlation between two qualitative variables designated by the scenario selected by the user for each of the plurality of transaction records. Integrating means 115 calculates an integrated feature amount by integrating the first feature amount and the second feature amount calculated for each combination of variables indicated by the set scenario. Estimating means 116 estimates the probability that the transaction record is abnormal, based on the integrated feature amount calculated by the integrating means 115 based on the first feature amount and the second feature amount to display the result on a display unit 15.SELECTED DRAWING: Figure 6

Description

The present invention relates to a program and an information processing device used for audit work.

Audit work requires detecting abnormal transactions in journals and the like, as well as identifying the variables that cause the abnormalities. It is a heavy burden for humans to perform this work. Therefore, it is possible to use machine learning to detect abnormal transactions from journals and the like.

When using supervised learning, a considerable amount of labeled training data is required, but in many cases, each transaction in audit data such as a journal is not labeled. Generally, the number of transactions included in audit data is enormous, and it is not realistic to perform a process of assigning labels to them in order to create training data necessary for machine learning. Therefore, attempts are being made to use unsupervised learning to detect abnormal transactions that may be fraudulent.

Here, data representing transactions usually includes items expressed on a proportional scale such as sales amount, as well as items expressed on a nominal scale such as business partner names and product names to be traded, and items expressed on an interval scale such as dates. It is. When using unsupervised learning, the nominal scale is not a numerical value, so it cannot be used as a statistic. Therefore, it is also conceivable to use the nominal scale in the feature amount calculation using a numerical method such as ONE-HOT expression.

Patent Document 1 discloses a method for extracting attributes of data points, scaling the attributes into numerical values, clustering the data points using a k-means clustering algorithm, and generating outlier scores for each to determine fraudulent data points. A computer-implemented system and method is described.

U.S. Pat. No. 5,900,301 describes a method in which a computer-implemented system detects fraudulent data points using locality-sensitive hashing and local outlier factor algorithms. In this document, a computer-implemented system extracts attributes of a data point, scales them numerically, converts the scaled attributes into a feature vector, and dot-products the data points represented by the random vector and the feature vector. , and generate a locality-sensitive hash table.

Special Publication No. 2021-530013 Special Publication No. 2021-530017

However, as shown in Patent Document 1 and Patent Document 2 mentioned above, even if qualitative variables (also called categorical variables) such as nominal scales are quantified, the number of business partners etc. recorded in journals etc. is enormous. Therefore, it is not realistic to adopt such a method.

Furthermore, these methods cannot handle multiple nominal scales and proportional scales simultaneously in consideration of their correlation. Therefore, with these methods, even if an abnormal transaction is detected, it is difficult to estimate the cause of which variable contributes to the abnormal transaction.

One of the objects of the present invention is to use unsupervised learning to detect abnormal transactions in audit data such as sales data, journal entry slips, journals, etc. on a transaction-by-transaction basis, and to present the cause of the abnormality.

In one aspect, the present invention provides a setting means for setting a computer to a combination of variables to be noted in data including a plurality of transaction records, and a quantitative variable that is the variable to be noted included in each transaction record. a first calculation means for calculating a first feature amount based on a correlation with a qualitative variable; and a second calculation means for calculating a second feature amount based on a correlation between two qualitative variables that are the variables of interest included in each transaction record. The first feature quantity and the amount calculated for each combination of variables set by the setting means for each transaction record using a second calculation means, the first calculation means, and the second calculation means. A program is provided for functioning as an estimating means for estimating the possibility that the transaction record is abnormal based on the second feature amount.

In a preferred embodiment, the estimating means calculates an integrated feature amount by integrating the first feature amount and the second feature amount calculated for each of the set combinations using respective determined coefficients. The probability is estimated based on the integrated feature amount, and the coefficient is an index value determined from the correlation between the integrated feature amount and all the first feature amount and the second feature amount. It is characterized by being determined to meet certain criteria.

In a preferred embodiment, the first calculation means classifies the data into a plurality of groups for each of the qualitative variables depending on the similarity of trends in the quantitative variables included in the transaction records, and The method is characterized in that the statistical rarity of each transaction record is calculated as the first feature amount.

In a preferred embodiment, the setting means sets a combination selected by the user from among the plurality of predetermined combinations as the combination of the variables of interest.

In a preferred embodiment, the setting means includes an acquisition means for acquiring the type of data, and the setting means selects a combination according to the type of data from among the plurality of predetermined combinations of the variables to be focused on. It is characterized by being set as .

In a preferred embodiment, the qualitative variable is identification information of the department that conducted the transaction indicated by the transaction record.

In a preferred embodiment, the quantitative variable is the amount of the transaction indicated by the transaction record.

In a preferred embodiment, the first calculation means calculates, as the first feature amount, an amount determined from a ratio of the quantitative variable under conditions in which the qualitative variable is included in the transaction record.

In a preferred embodiment, the second calculation means calculates a lift calculated by dividing the proportion of each value of the two qualitative variables included in the transaction record by the product of the proportion of each value included in the transaction record. The method is characterized in that the second feature amount is calculated using the value.

In one aspect, the present invention provides a setting means for setting a combination of variables to be noted in data including a plurality of transaction records, and a quantitative variable and a qualitative variable that are the variables to be noted included in each transaction record. and a second calculation means for calculating a second feature amount based on the correlation between the two qualitative variables that are the variables of interest included in each transaction record. and the first feature quantity and the second feature quantity calculated for each combination of variables set by the setting means for each transaction record using the first calculation means and the second calculation means. An information processing apparatus is provided, comprising: an estimation means for estimating the possibility that the transaction record is abnormal based on a feature amount.

The present invention uses unsupervised learning to detect abnormal transactions in audit data such as sales data, journal entry slips, and journals on a transaction-by-transaction basis, and to present the cause of the abnormality.

1 is a diagram showing an example of the configuration of an information processing device 1. FIG. The figure which shows the example of transaction DB121. A diagram showing an example of a transaction table 1212. The figure which shows the example of scenario DB122. The figure which shows the example of setting DB123. 1 is a diagram showing an example of a functional configuration of an information processing device 1. FIG. The figure which shows the example of the whole distribution of the quantitative variable of interest. The figure which shows the example of the distribution for each group of the quantitative variable of interest. A diagram showing an example of the number of simultaneous occurrences. The figure which shows the example of a lift value. FIG. 3 is a flow diagram illustrating an example of the flow of operations for estimating the possibility of an abnormality in a transaction record. FIG. 7 is a flow diagram showing an example of the flow of operation for calculating the first feature amount. FIG. 7 is a flowchart showing an example of the flow of operation for calculating the second feature amount.

<Embodiment>
<Configuration of information processing device>
FIG. 1 is a diagram showing an example of the configuration of an information processing device 1. As shown in FIG. The information processing device 1 shown in FIG. 1 includes a processor 11, a memory 12, a communication section 13, an operation section 14, and a display section 15. These structures are communicatively connected to each other, for example by a bus.

The processor 11 controls each part of the information processing device 1 by reading and executing a program stored in the memory 12 . The processor 11 is, for example, a CPU (Central Processing Unit).

The operation unit 14 includes operators such as operation buttons, a keyboard, a touch panel, and a mouse for issuing various instructions, and receives operations and sends signals to the processor 11 according to the contents of the operations. This operation is, for example, a press on a button, a gesture on a touch panel, or the like.

The display unit 15 has a display screen such as a liquid crystal display, and displays images under the control of the processor 11. A transparent touch panel of the operation unit 14 may be placed on top of the display screen.

The communication unit 13 is a communication circuit that communicably connects the information processing device 1 to an external device or the like by wire or wirelessly.

The memory 12 is a storage means for storing an operating system read into the processor 11, various programs, data, and the like. The memory 12 includes a RAM (Random Access Memory) and a ROM (Read Only Memory). Note that the memory 12 may include a solid state drive, a hard disk drive, or the like. The memory 12 also stores a transaction DB 121, a scenario DB 122, and a setting DB 123.

<Transaction DB structure>
FIG. 2 is a diagram showing an example of the transaction DB 121. The transaction DB 121 is a database that stores a table describing a plurality of transactions for each transaction identification information. The transaction DB 121 shown in FIG. 2 has a data ID list 1211 and a transaction table 1212.

The data ID list 1211 is a table that stores data IDs that are identification information of data describing transactions, data names, and type IDs that indicate the types of data in association with each other. Each data ID listed in the data ID list 1211 is associated with one transaction table 1212.

Transaction table 1212 is a table that stores data including multiple transaction records. FIG. 3 is a diagram showing an example of the transaction table 1212. For example, the transaction table 1212 shown in FIG. It includes "name", "unit price", "quantity", "amount", etc. Each row in this table represents each item.

The transaction record is a record that has values for each of these items. Columns in this table represent transaction records. Each transaction record is attached with identification information such as a serial number for distinguishing it from other transaction records.

Item values include quantitative variables and qualitative variables. A quantitative variable is a variable expressed as a numerical value indicating a quantity, such as "time", "amount", etc. Quantitative variables are interval scales and proportional scales.

Qualitative variables are variables that are not expressed as numerical values indicating quantities, such as "seller" and "product name." Qualitative variables are nominal and ordinal.

<Scenario DB configuration>
FIG. 4 is a diagram showing an example of the scenario DB 122. The scenario DB 122 is a database that stores predetermined scenarios. Here, the scenario is information in which a combination of variables of interest in data including a plurality of transaction records is associated with a procedure for calculating a feature amount using those variables. This scenario was compiled in advance by an auditor with a certain level of knowledge and experience.

The scenario DB 122 shown in FIG. 4 has the following items: "number", "scenario name", "feature description", and "variable to be used". Further, each scenario is stored in association with a feature value calculation procedure (not shown) corresponding to the content of the feature value explanatory text.

For example, the scenario numbered 2 in the scenario DB 122 shown in FIG. 4 has the scenario name "The difference between the order date and the sales recording date is abnormally short." In addition, the feature value description for this scenario is ``a value that represents the rarity of the difference in number of days, taking into account the variety.'' In this scenario, the order date and sales date included in the transaction record are used to calculate the difference between them, and this difference is used as a new quantitative variable. That is, the variables used in the scenario may be variables included in the transaction record as they are, or may be variables generated using one or more variables included in the transaction record.

Furthermore, in a scenario, variables used to evaluate a certain transaction record may be generated only from variables included in that transaction record, but other transaction records that have a specific relationship with that transaction record may also be used. It may be a variable that is generated using variables included in . The variables used to evaluate a transaction record are other transaction records that share a qualitative variable, such as the ratio of quantity to the previous year's average for the same product and same customer, and are concluded at the same time as the transaction record. It may be generated using a value such as an average value calculated from transaction records within a period that satisfies certain conditions.

<Configuration of settings DB>
FIG. 5 is a diagram showing an example of the setting DB 123. The setting DB 123 is a database that stores scenarios selected by the user from among the scenarios stored in the scenario DB 122 for each data ID. The setting DB 123 shown in FIG. 5 has a data ID list 1231 and a scenario number list 1232.

The data ID list 1231 is a list listing data IDs that are identification information of data to be audited among the data stored in the transaction DB 121. Each data ID written in the data ID list 1231 is associated with one scenario number list 1232.

The scenario number list 1232 is a list listing scenario numbers set by the user via the operation unit 14 for the data identified by the data ID. For example, the setting DB 123 shown in FIG. 5 shows that the user has selected "2", "4", "7", etc. as the scenario number for the data with the data ID "D1".

As shown in FIG. 5, the scenario number list 1232 may have a column for weighting factors. This weighting factor column stores a weighting factor by which each feature amount calculated in the scenario identified by the corresponding scenario number is multiplied. Note that when a plurality of feature quantities are generated for one scenario, a weighting coefficient may be set for each of the plurality of feature quantities.

<Functional configuration of information processing device>
FIG. 6 is a diagram showing an example of the functional configuration of the information processing device 1. As shown in FIG. In FIG. 6, the communication unit 13 of the information processing device 1 is omitted.

The processor 11 of the information processing device 1 executes the program stored in the memory 12 to obtain the acquisition means 111, the setting means 112, the first calculation means 113, the second calculation means 114, the integration means 115, and the estimation means 116. functions as

The acquisition unit 111 receives an operation for specifying data from the user via the operation unit 14 . The acquisition means 111 then acquires the specified data from the transaction DB 121 stored in the memory 12. At this time, the processor 11 reads out a list of scenarios from the scenario DB 122 and causes the display unit 15 to display the list.

The user views the displayed list of scenarios and selects a scenario to be used for the specified data. The setting unit 112 receives an operation for selecting a scenario from the user via the operation unit 14. Then, the setting means 112 stores a number indicating the selected scenario in the setting DB 123.

In other words, the setting means 112 is an example of a setting means that sets a combination selected by the user as a combination of variables of interest from among a plurality of combinations of variables specified in a predetermined scenario.

As a result, the combination of variables of interest specified by the scenario in the specified data is set in the setting DB 123. That is, this setting means 112 is an example of a setting means that sets a combination of variables to be noted in data including a plurality of transaction records.

The first calculation means 113 calculates feature quantities based on the correlation between quantitative variables and qualitative variables specified by the scenario stored in the setting DB 123, for each of the plurality of transaction records included in the data specified by the user. Calculate as the first feature amount.

The set scenario specifies, for example, a set of qualitative variables and quantitative variables as variables of interest. The reason for this is that the degree of abnormality of the data is not only estimated based on the rarity of the quantitative variable itself, but also the degree of abnormality of the data is estimated by considering the correlation with the qualitative variable to identify its rarity. .

FIG. 7 is a diagram showing an example of the overall distribution of quantitative variables of interest. The horizontal axis in FIG. 7 is the value of the quantitative variable listed as a variable of interest in the set scenario. This horizontal axis is divided into multiple sections. The vertical axis in FIG. 7 is the number of data items having values of quantitative variables belonging to the corresponding category. The value indicated by the dashed-dotted line in Figure 7 is the expected value of the quantitative variable mentioned above, and is calculated by, for example, (value of quantitative variable) x (number of data items having that value) / (number of total data items). be done.

Here, it is assumed that a certain transaction record included in the data has the value indicated by the arrow shown in FIG. Since this value is not far from the expected value in FIG. 7, it is difficult to judge it as abnormal as a whole.

FIG. 8 is a diagram showing an example of the distribution of quantitative variables of interest for each group. The horizontal and vertical axes of FIG. 8 are the same as those of FIG. The distribution of quantitative variables shown in FIG. 7 is classified into (a), (b), and (c) for each group to which qualitative variables listed as variables of interest in the scenario belong.

For example, assume that the set scenario lists the sector in which the transaction was made as a qualitative variable, and the transaction amount as a quantitative variable. Based on this scenario, the information processing device 1 uses a statistical method to classify the data into a plurality of groups, for example, depending on the similarity of trends in quantitative variables. This statistical method is, for example, a decision tree.

Note that, as described above, when the scenario lists the department that made the transaction as a qualitative variable, this qualitative variable is an example of a qualitative variable that is identification information of the department that made the transaction indicated by the transaction record. Furthermore, as described above, when the scenario lists the transaction amount as a quantitative variable, this quantitative variable is an example of a quantitative variable that is the transaction amount indicated by the transaction record.

As a result, (a) shown in FIG. 8 shows the transaction record of group 1 including department A, department D, and department E, and (b) shows the transaction record of group 2 including department B, department F. Transaction records of group 3 including department C are classified into c).

When expected values are calculated using classified transaction records, the expected values will vary, as shown by the dashed-dotted lines in FIG. Here, the values indicated by the arrows shown in FIG. 7 are relatively far from the expected values in group 1 and may be determined to be abnormal.

The first calculation means 113 calculates an abnormality score indicating the abnormality degree of each transaction record using the following equation (1) that includes the probability p of occurrence of a quantitative variable on the premise of the occurrence of a qualitative variable. The abnormality score shown in this formula (1) is expressed by the logarithm of the reciprocal of the occurrence probability p such that the smaller the occurrence probability p described above is, the larger the value is. This abnormality score is the first feature amount in the present invention.

This first feature amount includes information on the correlation between the qualitative variables and quantitative variables specified by the scenario. For example, in the above example, the first feature uses the so-called conditional probability p, so under the condition that the transaction record includes a qualitative variable, the statistical rarity (rareness) of the quantitative variable included in the transaction record is gender).

Therefore, for example, if the quantitative variable is the transaction amount, even if the transaction amount is not uncommon in the whole, qualitative variables such as the person in charge of the transaction, the department, or the product handled in the transaction When the combination is rare, the information processing device 1 calculates a relatively high abnormality score for this transaction record. Therefore, for example, abnormalities in the combination of qualitative and quantitative variables are detected, such as ``the transaction amount is too high for a transaction in this department'' or ``this amount is too high for this product.''

Further, the first feature amount in this case is divided into groups and evaluates the degree of abnormality of transaction records within the group. Therefore, even if there is so-called multimodality in the entire data, detection of the degree of abnormality is relatively unlikely to be affected by it.

In other words, the first calculation means 113 is an example of a first calculation means that calculates a first feature amount based on the correlation between a quantitative variable and a qualitative variable, which are variables of interest included in each transaction record.

In addition, this first calculation means 113 classifies the data into a plurality of groups for each qualitative variable according to the similarity of trends in the quantitative variables included in the transaction records, and classifies the data into a plurality of groups for each qualitative variable. This is an example of a first calculation means that calculates statistical rarity as a first feature quantity.

Further, this first calculation means 113 is an example of a first calculation means that calculates, as a first feature amount, an amount determined from the ratio of quantitative variables under conditions in which a qualitative variable is included in a transaction record.

The second calculation means 114 shown in FIG. 6 calculates a feature quantity based on the correlation between two qualitative variables specified by the scenario stored in the setting DB 123 for each of a plurality of transaction records included in the data specified by the user. is calculated as the second feature amount.

The set scenario specifies, for example, a set of two qualitative variables as variables of interest. The reason for this is to identify the rarity of two qualitative variables being included in one transaction record at the same time and estimate the degree of abnormality of the data.

FIG. 9 is a diagram showing an example of the number of simultaneous occurrences. The table shown in FIG. 9 classifies all transaction records included in certain data by the combination of department and person in charge included in each transaction record, and records the number of occurrences of each transaction record. For example, it can be seen from FIG. 9 that 8456 combinations of department A and person in charge α are included in the total data. On the other hand, it can be seen that only one combination of department B and person in charge γ is included in all the data.

FIG. 10 is a diagram showing an example of lift values. The table shown in FIG. 10 shows the probability of simultaneous occurrence of the combination of department and person in charge and its lift value in each transaction record corresponding to the table shown in FIG. Here, the probability of simultaneous occurrence is the value obtained by dividing the number of occurrences for the combination of the department and person in charge by the total number of occurrences. The lift value is a value obtained by dividing the simultaneous occurrence probability by the product of the individual probability of occurrence for each department and person in charge. This lift value is expressed, for example, by the following equation (2).

In this equation (2), both X and Y are qualitative variables. A and B are realized values of X and Y, respectively. Furthermore, p(X=A, Y=B) is the probability when X is A and Y is B. That is, p(X=A, Y=B) is the rate at which each value of two qualitative variables, which are the variables of interest, are both included in the transaction record. Furthermore, p(X=A) and p(Y=B) are the probability that X is A and the probability that Y is B, respectively. Therefore, p(X=A)p(Y=B) is the product of the respective proportions in which the respective values of the two qualitative variables that are the variables of interest are included in the transaction records. Lift (X=A, Y=B), which is the left side of equation (2), is a lift value.

The abnormality score shown in Equation (2) is expressed by the logarithm of the reciprocal of Lift (X=A, Y=B) so that the smaller the above-mentioned lift value is, the larger the value is. The logarithm of the reciprocal of a certain number is, in other words, the logarithm of that number minus one. The abnormality score shown in equation (2) is the second feature amount in the present invention. The second calculation means 114 calculates the abnormality score obtained from the lift value as the above-mentioned second feature quantity. The above-mentioned lift value is used, for example, in mail-order sites and the like to recommend products to customers. This recommendation is a process that refers to the purchasing trends of a group of customers who have purchased a certain product and recommends products that are likely to be purchased together with that product to a customer who has purchased that product. . In recommendations, the higher the lift value of a product combination, the higher the probability that the products in that combination are purchased together.

On the other hand, in the present invention, this lift value is used for the opposite purpose to that described above. That is, the information processing device 1 uses the fact that the lower the lift value is, the statistically rarer the combination is, and estimates that the transaction record in which the combination occurs is more likely to be abnormal.

In other words, this second calculation means 114 is an example of a second calculation means that calculates a second feature amount based on the correlation between two qualitative variables that are variables of interest included in each transaction record.

In addition, this second calculation means 114 calculates the proportion of each of the values of two qualitative variables, which are the variables of interest, being included in the transaction record by the product of the respective proportions of those values being included in the transaction record. This is an example of a second calculation means that calculates a second feature amount using the divided lift value.

The integrating means 115 calculates an integrated feature amount by integrating the above-mentioned calculated first feature amount and second feature amount for each combination of variables indicated by the set scenario. Although it can be seen that the first feature amount and the second feature amount each individually indicate an abnormality, it is easier to understand the results if there is a reference index indicating which transaction record to focus on. Therefore, the processor 11 of the information processing device 1 functions as the integrating means 115 to calculate an integrated feature amount by integrating the first feature amount and the second feature amount. The integrated feature amount is expressed by the following equation (3).

In this formula (3), s is an integrated feature amount, and x _n is the nth transaction record. Therefore, s(x _n ), which is the left side of equation (3), is the integrated feature amount for the n-th transaction record.

In Equation (3), f is the first feature amount or the second feature amount (hereinafter also simply referred to as "feature amount") calculated based on the scenario, and w is the weighting coefficient by which f is multiplied. . K is the total number of calculated feature amounts.

That is, the right side of Equation (3) indicates the sum of values obtained by multiplying K types of feature amounts for the n-th transaction record by respective weighting coefficients.

The integrating means 115 performs ensemble learning in unsupervised learning using K types of feature amounts f obtained for the n-th transaction record. The K types of feature amounts and the K types of weighting coefficients corresponding to each of the feature amounts are each expressed as a vector with K elements. A vector representation of the n-th transaction record and a corresponding feature vector whose elements are K types of feature amounts f are expressed by the following equation (4). T in equation (4) indicates transposition.

The individual transaction records contained in the data are not labeled. Therefore, normal ensemble learning methods such as boosting and bagging cannot be used. Therefore, the integrating means 115 determines each of the weighting coefficients w so that the sum of the squares of the correlation coefficients between the integrated feature quantity s and the individual feature quantities f becomes maximum. The method for determining the weighting coefficient w is as follows. That is, the integrating means 115 first defines the objective function E as shown in equation (5) below.

In equation (5), C represents a correlation coefficient, and T represents transposition. In this equation (5), the objective function E(w) is defined as a function of the weighting coefficient vector w, which indicates the sum of squares of the correlation coefficients between the integrated feature amount and the individual feature amounts. This objective function E(w) is an example of an index value found from the respective correlations between the integrated feature and all the first and second features. The integrating means 115 determines the weighting coefficient vector w based on this equation (5) so that the objective function E(w) is maximized.

Note that the correlation coefficient between the two variables x and y is a value obtained by dividing the covariance by the product of their respective standard deviations, and is expressed by the following equation (6). Note that in the formula, the symbol surrounding a variable with "<" and ">" represents the expected value or average value of that variable.

Further, the variance and covariance of the K types of calculated feature amounts are expressed by the following equation (7). N in equation (7) is the total number of transaction records included in the data. In equation (7), F _ij becomes a variance when i=j, and becomes a covariance when i≠j.

Here, each part of the objective function E(w) shown in equation (5) is expressed by the following equation (8) due to the linearity of the expected value. Each part of the objective function E(w) is the variance of the individual features, the variance of the integrated feature, and the covariance of the individual features and the integrated feature.

Here, the weighting coefficient vector w is a K-dimensional vector having weighting coefficients w _k corresponding to each of the K types of feature quantities as elements, regardless of the serial number n of the transaction record. Further, F is a K-order square matrix in which the element in the i-th row and the j-th column is F _ij . That is, F is a variance-covariance matrix of the feature amount f.

By substituting equation (8) into equation (5), the following equation (9) is obtained. Note that Λ is a square matrix of order K, and the element of the i-th row and j-column is Λ _ij . And δ _ij represents Kronecker's delta, which is 1 when i=j and 0 when i≠j.

That is, the problem of finding the weighting coefficient vector w used for the integrated feature amount s is a maximization problem shown in the following equation (10).

The maximization problem shown in equation (10) is equivalent to the eigenvalue problem shown in equation (11) below.

Therefore, the integrating means 115 solves this equation (11) to obtain the eigenvalues and eigenvectors. Then, the integrating means 115 calculates the integrated feature amount using the eigenvector corresponding to the obtained maximum eigenvalue as the weighting coefficient vector w. Note that the weighting coefficient w _k (k=1, 2,..., K), which is each element of the weighting coefficient vector w calculated here, is a combination of the integrated feature quantity and all the first feature quantities and second feature quantities. This is an example of a coefficient determined so that the index value obtained from each correlation satisfies or exceeds a determined standard.

The estimating means 116 estimates the possibility that the transaction record is abnormal based on the integrated feature amount calculated from the first feature amount and the second feature amount by the integrating means 115. Then, the estimating means 116 presents the above-mentioned possibilities to the user by displaying the estimated results on the display unit 15.

In other words, the estimation means 116 uses the first calculation means and the second calculation means to calculate the first feature amount and the second feature amount calculated for each combination of variables set by the setting means for each transaction record. This is an example of an estimation means that estimates the possibility that a transaction record is abnormal based on feature amounts.

Note that this estimating means 116 may include the function of the integrating means 115. In this case, the estimating means 116 integrates the first feature amount and the second feature amount calculated for each combination of set variables using a coefficient determined for each of the combinations to obtain an integrated feature amount. This is an example of an estimation means that calculates the probability that a transaction record is abnormal based on the integrated feature amount.

<Operation of information processing device>
<Overall operation>
FIG. 11 is a flow diagram illustrating an example of the flow of operations for estimating the possibility of an abnormality in a transaction record. The processor 11 of the information processing device 1 receives from the user, via the operation unit 14, a designation of a data ID for identifying data to be audited. Then, the processor 11 acquires the data identified by the specified data ID from the memory 12 (step S001).

Further, the processor 11 receives an operation from the user via the operation unit 14 to select a scenario to be applied to the above-mentioned data. The processor 11 sets the scenario indicated by the received operation (step S002).

When the data to be audited is acquired and a scenario applied to the data is set, the processor 11 calculates a first feature amount according to the scenario for each transaction record included in the data (step S100). Further, in parallel with this, the processor 11 calculates a second feature amount according to the scenario for each transaction record included in the data (step S200). Details of step S100 and step S200 will be described later. Note that step S100 and step S200 may be performed in parallel as shown in FIG. 11, or may be performed sequentially.

Once the first feature amount and the second feature amount are calculated, the processor 11 calculates an integrated feature amount based on them (step S003). Then, the processor 11 estimates the possibility of abnormality in the transaction record based on the calculated integrated feature amount (step S004), and presents the estimation result (step S005).

<Operation of calculating first feature amount>
FIG. 12 is a flow diagram illustrating an example of the flow of operation for calculating the first feature amount. The operation of calculating the first feature amount is the process of step S100 described above. The processor 11 classifies the data into groups for each qualitative variable using the above-described statistical method (step S101).

Next, the processor 11 calculates the average value within the group of quantitative variables specified in the scenario (step S102), and calculates the degree of abnormality of each transaction record as a first feature amount using conditional probability ( Step S103).

<Operation of calculating second feature amount>
FIG. 13 is a flow diagram illustrating an example of the flow of operations for calculating the second feature amount. The operation of calculating the second feature amount is the process of step S200 described above. The processor 11 totals the number of occurrences of the combination of two qualitative variables specified by the scenario selected by the user (step S201). Then, the processor 11 calculates the ratio of the aggregated number of occurrences of the above-mentioned combinations to the total number of occurrences as the probability of simultaneous occurrence (step S202).

Furthermore, the processor 11 calculates the probability of occurrence of each of the two qualitative variables included in the above-described combination (step S203). Then, the processor 11 calculates a second feature quantity using a lift value obtained by dividing the simultaneous occurrence probability calculated in step S202 by the product of the occurrence probabilities of the two qualitative variables calculated in step S203 (step S204). .

Through the operations described above, the information processing device 1 regards a history that deviates significantly from a normal pattern among data including the history of a plurality of transaction records as an abnormality, that is, a candidate for fraud, and raises an alert. As a result, the information processing device 1 can identify a suspicious history such as "shopping in Brazil two hours after shopping in Japan" along with its cause.

In short, this information processing device 1 estimates the possibility that each transaction record included in the data is abnormal, in association with a scenario, using an integrated feature amount that integrates the first feature amount and the second feature amount. A transaction record estimated to be abnormal is associated with a scenario that causes the abnormality, and qualitative variables and quantitative variables are specified in the scenario. Therefore, the information processing device 1 uses unsupervised learning to detect abnormal transactions (operations) in audit data such as sales data, journal entry slips (journals), and inventory data on a transaction-by-transaction basis. , can present the cause of the abnormality.

<Modified example>
The above is the description of the embodiment, but the content of this embodiment can be modified as follows. Moreover, the following modifications may be combined with each other.

<1>
In the embodiment described above, the information processing device 1 had the processor 11 configured with a CPU, but the control means for controlling the information processing device 1 may have another configuration.

That is, in addition to the CPU, the information processing device 1 includes various processors such as a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), and a programmable logic device. You may have it as

<2>
The operations of the processor in the embodiments described above may be performed not only by one processor, but also by the cooperation of a plurality of processors located at physically separate locations.

Furthermore, the order of each operation of the processor is not limited to the order described in the embodiments described above, and may be changed as appropriate.

<3>
In the embodiment described above, the scenario used to calculate the first feature amount and the second feature amount is selected by the user, but may be set depending on the type of data.

For example, the processor 11 of the information processing device 1 acquires a type ID indicating the type of data specified by the user from the data ID list 1211 of the transaction DB 121. Then, the processor 11 may set, in the setting DB 123, one or more scenario numbers that are associated in advance with the acquired type ID. Thereby, a combination of variables to be noted in the data specified by the scenario indicated by the set number etc. is specified.

In this case, the information processing device 1 has an acquisition means for acquiring the type of data, and sets a combination according to the type of data from among a plurality of predetermined combinations as a combination of variables to be focused on. This is an example of an information processing device.

<4>
In the embodiment described above, the program executed by the processor 11 of the information processing device 1 includes a setting means for setting a combination of variables to be noted in data including a plurality of transaction records, and a setting means for setting a combination of variables to be noted in data including a plurality of transaction records. a first calculation means for calculating a first feature based on the correlation between a quantitative variable and a qualitative variable; and a second calculation for calculating a second feature based on the correlation between two qualitative variables included in each transaction record. Based on the first feature quantity and the second feature quantity calculated for each combination of variables set by the setting means for each transaction record using the means, the first calculation means, and the second calculation means. , is an example of a program for functioning as an estimation means for estimating the possibility that a transaction record is abnormal.

This program can be provided in a state stored in a computer readable recording medium such as a magnetic recording medium such as a magnetic tape and a magnetic disk, an optical recording medium such as an optical disk, a magneto-optical recording medium, or a semiconductor memory. Further, this program may be downloaded via a communication line such as the Internet.

DESCRIPTION OF SYMBOLS 1... Information processing device, 11... Processor, 111... Acquisition means, 112... Setting means, 113... First calculating means, 114... Second calculating means, 115... Integrating means, 116... Estimating means, 12... Memory, 121... Transaction DB, 1211...Data ID list, 1212...Transaction table, 122...Scenario DB, 123...Setting DB, 1231...Data ID list, 1232...Scenario number list, 13...Communication section, 14...Operation section, 15...Display section .

Claims (10)

computer,
a setting means for setting a combination of variables to be focused on in data including multiple transaction records;
a first calculation means for calculating a first feature amount based on a correlation between a quantitative variable and a qualitative variable, which are the variables of interest included in each transaction record;
a second calculation means for calculating a second feature amount based on the correlation between two qualitative variables that are the variables of interest included in each transaction record;
Using the first calculation means and the second calculation means, the first feature amount and the second feature amount each calculated for each combination of variables set by the setting means for each transaction record. estimating means for estimating the possibility that the transaction record is abnormal based on;
A program to function as The estimation means calculates an integrated feature amount by integrating the first feature amount and the second feature amount calculated for each of the set combinations using respective determined coefficients, and Estimating the possibility based on the feature amount,
Claim 1, wherein the coefficient is determined such that an index value obtained from the correlation between the integrated feature amount and all the first feature amounts and the second feature amount satisfies a predetermined criterion. The program described in. The first calculation means classifies the data into a plurality of groups for each of the qualitative variables according to the similarity of trends in the quantitative variables included in the transaction records, and classifies each transaction record in each group. The program according to claim 1, wherein a statistical rarity of is calculated as the first feature quantity. 2. The program according to claim 1, wherein the setting means sets a combination selected by a user from among a plurality of predetermined combinations as the combination of variables to be noted. comprising an acquisition means for acquiring the type of data,
2. The program according to claim 1, wherein the setting means sets a combination according to the type of data as the combination of variables of interest from among a plurality of predetermined combinations. The program according to claim 1, wherein the qualitative variable is identification information of a department that made the transaction indicated by the transaction record. The program according to claim 1, wherein the quantitative variable is a transaction amount indicated by the transaction record. 2. The first calculation means calculates, as the first feature amount, an amount determined from a ratio of the quantitative variable under conditions in which the qualitative variable is included in the transaction record. program. The second calculation means uses a lift value obtained by dividing the proportion of each value of the two qualitative variables included in the transaction record by the product of the proportion of each value included in the transaction record. The program according to claim 1, further comprising calculating the second feature amount. a setting means for setting a combination of variables to be focused on in data including multiple transaction records;
a first calculation means for calculating a first feature amount based on a correlation between a quantitative variable and a qualitative variable, which are the variables of interest included in each transaction record;
a second calculation means for calculating a second feature amount based on the correlation between two qualitative variables that are the variables of interest included in each transaction record;
Using the first calculation means and the second calculation means, the first feature amount and the second feature amount each calculated for each combination of variables set by the setting means for each transaction record. estimating means for estimating the possibility that the transaction record is abnormal based on the
An information processing device having:

Images