CN104090835B - eID (electronic IDentity) and spectrum theory based cross-platform virtual asset transaction audit method - Google Patents

Abstract

The invention discloses an eID (electronic IDentity) and spectrum theory based cross-platform virtual asset transaction audit method. The core concept of the technology includes that modeling is performed on transaction operation logs of cross-platform virtual assets and an audit rule base is constructed, the associated audit analysis on the user transaction logs is implemented through transaction attributes by combining with an eID technology, and the ideal virtual asset transaction audit accuracy rate is obtained finally. According to the eID and spectrum theory based cross-platform virtual asset transaction audit method, data related attributes are fully considered when a data model is established and the method can adapt to the variability of the user transaction attributes and the uncertainty of transaction behaviors; the dynamic correction can be performed on the rule base according to audit results through the construction of the rule base; the detection method is simple and the high accuracy can be obtained in the virtual asset transaction log testing phase.

Description

Cross-platform fictitious assets transaction auditing method based on eid and spectral theory

Technical field

This technology belongs to Networks and information security field and in particular to a kind of cross-platform virtual based on eid and spectral theory Transaction in assets auditing method.

Background technology

Eid is the english abbreviation of electronic ID card (electronic ident i ty), and full name is citizen's network electronic body Part mark, is alienation form on network for the resident identification card.Eid is the authority of remote proving individual true identity on network Electronic information file, signs and issues (http://eid.cn/khat i by Ministry of Public Security citizen network identity identifying system seid.html).It is the one group of unique network identifier and digital certificate being generated by netizen's personally identifiable information, and netizen Real information is saved in third party's trust authority.Smart chip card is other identification informations of function and user (as title, e- Mai l, identification card number etc.) bundle, the checking information of user identity is provided on network so that each netizen is in network Have in virtual environment and the corresponding true identity of only one of which.Eid has authority, security and public credibility, and it avoids directly Connect the privacy compromise problem leading to using identity card, realize " front end is anonymous, rear end real name " mechanism truly.At present, As a major project of the Department of Science and Technology, eid starts test run in some areas such as Beijing, Shanghai and uses, mainly on internet Remote identity be identified and verify, such as campus network, ecommerce, the network media, online service etc..Beijing post and telecommunications is big School garden net has achieved the service function based on eid substantially, and achieves the achievement of stage.The use of eid is this skill The realization of art is laid a good foundation.

Fictitious assets transaction audit is mainly the exception detecting in process of exchange, that is, by concluding the business related day to fictitious assets Will is associated analyzing, and finds the violation operation behavior to fictitious assets for the user in time.Abnormal audit is the important of data mining Content, its implementation has multiple.Abnormal auditing method based on classification: the abnormal audit technique based on classification is two ranks Section process, including study stage and sorting phase.In the study stage, also known as the training stage, set up and describe predefined data class Or the grader of concept set, by effective mark training set structural classification device；Sorting phase, also known as test phase, utilizes and divides One test object is labeled as normal or abnormal by class device.Its use is assumed based on general as follows: empty in given feature Between in, grader (tan p n, steinbach m, the kumar distinguishing normal and abnormal data class must be constructed v.introduct ion to data mining[j].2006.).Based on closest abnormal audit technique: given feature is empty Between in data set, it is possible to use distance metric is quantifying the similitude between object.Intuitively, away from the object of other objects Can be considered abnormal, the method based on propinquity supposes: abnormal data deviates significantly from data set with the propinquity of its arest neighbors In other data and their neighbours between propinquity (byers s, raftery a e.nearest-neighbor clutter removal for est imat ing features in spat ial point processes[j] .journal of the american stat i st ical assoc iat ion,1998,93(442):577-584.). Statistics exception audit technique: statistics exception audit technique is assumed to the normality of data.They suppose in data set Normal subjects produced by a random process (generation model), therefore, normal subjects occur in the high probability of this stochastic model In region, and in low probability region to as if abnormal.The general thoughts of this technology are: one matching data-oriented collection of study Generation model, then identify the object in this model low probability region, they be considered as exception (aggarkal c c, phi l ip s y.outl i er detect ion ki th uncertain data[c]//sdm.2008:483-493.).Information By abnormal audit technique: information theory technology adopts the different information theory sides such as kolmogorov complexity, entropy and relative entropy The information content that method analyze data is concentrated.The use of this technology is based on the fact that the exception in data set can cause data set to believe The irregular change of breath amount.The step of information-theoretical abnormality detection technology is as follows: data-oriented collection d, finds out the one of this data set So that the value of c (d)-c (d-i) is maximum, the data in subset i is considered as abnormal to individual smallest subset i, and wherein c (d) represents number Complexity (keogh e, lonardi s, ratanamahatana c a.tokards parameter-free data according to d mining[c]//proceedings of the tenth acm sigkdd internat i onal conference on knokl edge di scovery and data mining.acm,2004:206-215.).Exception audit based on spectral theory Technology: spectral technology finds a kind of approximate representation of data by one group of attribute comprising data set principal character.Different based on spectrum Often audit technique assumes that data can be mapped in the subspace of low dimensional and normal data has notable area with abnormal data Not.Therefore this technology typically finds such subspace using PCA, in this subspace, abnormal data easily quilt Identification (agovic a, banerjee a, ganguly a r, et al.6anomaly detect ion in transportat ion corridors us ing manifold embedding[j].knokledge di scovery from sensor data,2008:81-105.).

In fictitious assets transaction audit, it is abnormal, because fictitious assets that the exception relevant with fictitious assets is generally situation There is polytype, different types of fictitious assets attribute is different；And the operation to similar fictitious assets for the different users Different, this is related to the diversity of fictitious assets transaction platform.Therefore, the audit of fictitious assets comprises two aspect contents: virtual The audit of Asset operation daily record and the audit of fictitious assets attribute information.Therefore solely using certain technology above-mentioned to virtual money The transaction produced carry out abnormal audit not science it is also difficult to obtain higher Detection accuracy.Existing abnormal auditing method side Overweight transfer attribute or the frequency attribute of Audit data, the association attributes of little focused data.

Content of the invention

For the defect of prior art, this technology has just taken into full account asking of data association attributes when setting up data model Topic, and adapt to customer transaction attribute polytropy and the probabilistic feature of trading activity.This technology is by using spectral theory Method builds the audit regulation storehouse that according to auditing result, it can be carried out with dynamic corrections, and combines the realization of eid technology to virtual The cross-platform audit of transaction in assets.In fictitious assets transaction log test phase, the detection method that this technology uses is not only simple And higher precision can be obtained.

The core concept of this technology is exactly that the transactional operation daily record to fictitious assets is modeled and constructs audit regulation storehouse, Using transaction attribute, customer transaction daily record is realized with association audit analysis then in conjunction with eid technology, finally obtain preferably virtual Transaction in assets audit accuracy rate.The present invention program is as follows:

Step 1, the arm's length dealing log recording of certain class fictitious assets given, referred to as training set；For this training set, root According to the uniqueness of eid, it is pre-processed: merge the transaction log of identical eid user, ordinal number when transactional operation is converted into According to counting the transaction attribute information of each eid user, form customer transaction attribute information base φ；

Step 2, the transactional operation daily record founding mathematical models for user: by ordinal number during the transactional operation of every eid user According to being split, segmentation length is l；Additionally, the number of operation different in log recording is designated as n, can be so every The transactional operation sequence of individual l length creates the matrix c of n × n size_l；The transverse and longitudinal coordinate of this matrix is all different types of operation, and Matrix element is exactly the frequency to appearance in window size h for the corresponding operation, and that is, in h continuous operation, certain operates to appearance Number of times；Matrix c_lEach element represent operate between the degree of association；

Step 3, extract the main feature of customer transaction operation behavior using spectral theory: by the training set matrix stack that obtains of conversion be C={ c₁,c₂,…,c_n, size is all n × n, calculates Mean Matrix c by equation (1)_mean, n is ordinal number when in training set Sum according to section；

$c_{mean}=\frac{1}{n}\underset{i=1}{\overset{n}{\σ}}{c}_i---\left(1\right)$

Each matrix in matrix stack c deducts Mean Matrix c_meanObtain new matrix stack c '；For the n × n square in c ' Battle array c_i', 1 × n can be rewritten as²VectorI.e.1≤i ≤ n, constructs covariance matrix e, size is n²×n², the implication of matrix e element be exactly operate to operation to the degree of association before；

$e=\underset{i=1}{\overset{n}{\σ}}{\widehat{c_i}}^t\widehat{c_i}---\left(2\right)$

Characteristic value according to pca method calculating matrix e is λ_iWith corresponding characteristic vector According to the property of spectral theory and matrix e,Constitute n²×n²One group of orthogonal basis of dimension space.From n²Individual feature Before selecting in vector, k is so that the principal component contributor rate of this k feature reaches predetermined threshold η, that is,

$\frac{{\mathrm{\σ}}_{i=1}^k{\mathrm{\λ}}_i}{{\mathrm{\σ}}_{i=1}^{n^2}{\mathrm{\λ}}_i}\&greaterequal;\mathrm{\η}---\left(3\right)$

This k characteristic vector just represents the main feature of customer transaction behavior.

Step 4, pass through customer transaction behavior main feature construction audit regulation storehouse.Any fictitious assets transaction log conversion Time series data matrix can use vector product

$x_i=v_i\·{\hat{c}}^t,1\≤i\≤k---\left(4\right)$

Calculate its coordinate representation in the main feature space that k characteristic vector is constituted, be designated as x=(x₁,…,x_k), wherein The c of n × n is rewritten into 1 × n²'sCalculated by above formula, the time series data matrix of any higher-dimension can convert based on feature empty Between coordinate representation, reached the purpose of dimensionality reduction；

$\underset{i=1}{\overset{k}{\σ}}{x}_i{v}_i=\underset{i=1}{\overset{k}{\σ}}(a_i+b_i)=\underset{i=1}{\overset{k}{\σ}}{a}_i+\underset{i=1}{\overset{k}{\σ}}{b}_i---\left(5\right)$

Wherein a_iIn element by x_iv_iThe value that middle element is more than threshold alpha is constituted, and remaining constitutes b_i；Positive divisor module a_iInstead Reflect the most possible generation sequence of operation of user during arm's length dealing, and b_iThen reflect the operation of most unlikely appearance Sequence；Calculate in c ' coordinate representation in main feature space for each matrix by formula (4), (5) and constitute positive divisor module groupWith negative factor module groupSoJust constitute fictitious assets transaction log to examine Meter rule base；

Step 5, fictitious assets transactional operation and transaction Attribute Association audit: for arbitrary user's fictitious assets to be detected Transaction time series data s, sends out according to the attribute that the eid that user uses inquires about s associative operation in transaction attribute information base φ first Whether raw probability all reaches threshold value ζ set in advance, if reaching, building matrix m by step 2, otherwise just not reaching in matrix m The row or column being located to the Attribute Association operation of threshold value ζ adds penalty factor θ, and θ value is determined by practical application；Then deduct average Matrix c_meanObtain m ', and according to formula (4), formula (5) calculates positive and negative factor module a of this time series data_i' and b_i′；Finally forWithIn each group of module, calculate the whether normal judgment value of this section of fictitious assets transaction log of user according to following equalities；

For auditor's judgement value ε, there is a following audit regulation:

IfAndThen audit as normal；

IfAndThen audit as exception；

IfAnd

If i.Then audit as normal；

Ii. otherwise audit as exception；

IfAnd

If i.Then audit as exception

Ii. otherwise audit as normal；

Step 6, algorithm correction, if this technology correct judgment and auditing result is normal, user's respective transaction are operated Attribute information adds attribute information base φ, and carries out probability statistics according to user eid；If this technology misjudgment and auditing result For normal, then the negative factor module of the generation of user's time series data is added negative factor module groupIf this technology misjudgment and Auditing result is abnormal, then the positive divisor module of the generation of user's time series data is added positive divisor module group

This technology of the present invention has just taken into full account the problem of data association attributes when setting up data model, and adapts to Customer transaction attribute polytropy and the probabilistic feature of trading activity.The rule base that this technology builds can be according to auditing result Dynamic corrections are carried out to it.In fictitious assets transaction log test phase, the detection method that this technology uses not only simple but also Higher precision can be obtained, Social benefit and economic benefit is notable.

Brief description

Fig. 1 is the inventive method schematic flow sheet

Fig. 2 is inventive network structural representation

Specific embodiment

To further illustrate technical scheme below by specific embodiment:

Because this technology is to be realized based on the application of eid, the therefore transaction of fictitious assets needs to carry out with eid binding. The transaction log record that fictitious assets transaction platform based on eid produces to user in further detail, for whole transaction flow Carried out careful division, be divided into multiple different transactional operation, such as e-commerce transaction Operation Log can be converted into following Time series data:

Each above-mentioned transactional operation of correspondence, all can have corresponding transaction attribute information, be such as logged in ip, clearing have gold Volume, payment have account etc., and this needs accounts for according to the concrete application of this technology.

In the implementation process of technology, netizen's activities on the internet are all bound with eid.With electronics As a example commercial affairs, user is required for the unified certification of eid in whole process of exchange.The related behaviour of each transaction of so user Make and eid verification process all can be recorded in fictitious assets database server each time, and hand over to improve fictitious assets Easy transaction capabilities, these servers are based on distributed.It is distributed virtual that this technology is mainly aiming at these Asset database is audited offline, finds abnormal data therein.

The core concept of this technology is exactly that the transactional operation daily record to fictitious assets is modeled and constructs audit regulation storehouse, Using transaction attribute, customer transaction daily record is realized with association audit analysis then in conjunction with eid technology, finally obtain preferably virtual Transaction in assets audit accuracy rate.Its specific implementation step is as follows:

Step 1) give certain class fictitious assets arm's length dealing log recording, referred to as training set.For this training set, root According to the uniqueness of eid, it is pre-processed: merge the transaction log of identical eid user, ordinal number when transactional operation is converted into According to；Count the transaction attribute information of each eid user, form customer transaction attribute information base φ.

If table 1 is exactly the attribute information base example of one section of log recording statistics in e-commerce transaction fictitious assets database φ

Table one simplified example of 1 attribute information base

Step 2) for user transactional operation daily record founding mathematical models.By ordinal number during the transactional operation of every eid user According to being split, segmentation length is l.Depending on l is typically by the concrete application of this technology, because dissimilar fictitious assets will be completed Transactional operation number be indefinite, this to using this application customer transaction be accustomed to related.Additionally, can produce in user transaction process Raw a lot of associative operations, in log recording, the number of different operation is n, can be so the transactional operation sequence of each l length Row create the matrix c of n × n size_l.The transverse and longitudinal coordinate of this matrix is all different types of operation, and matrix element is exactly to correspond to Operation (on the time, front, the corresponding operation of ordinate is rear for the corresponding operation of abscissa) is occurred in window size h Frequency, i.e. certain operation number of times to appearance in h continuous operation.Matrix c_lEach element represent operate between association Degree, numerical value bigger illustrate this operation to association tightr, that is, customer transaction carry out previous operation after h step in carry out after one The possibility of individual operation is very big.

Parameter in this step can be selected according to different fictitious assets transaction platforms, and different platforms is to transaction The granularity of division of operation is inconsistent, and that is, n is unequal, can take union or the common factor of the division of each transaction platform.This depends on this The specific environment of technology application, if occuring simultaneously, then mitigates system resource burden, but audit precision reduces；If union, then increase System burden, but audit precision is improved.But, generally, user can complete certain within about 10 operations Fictitious assets is concluded the business, and therefore segmentation length is l=10.Window size h is usually the integral multiple splitting length l, because only that this Attribute information between sample ability digging user fictitious assets transaction.

Step 3) extract the main feature of customer transaction operation behavior using spectral theory.By the matrix stack that training set conversion obtains it is C={ c₁,c₂,…,c_n, size is all n × n, calculates Mean Matrix c by equation (1)_mean, n is ordinal number when in training set Sum according to section.

$c_{mean}=\frac{1}{n}\underset{i=1}{\overset{n}{\σ}}{c}_i---\left(1\right)$

Each matrix in matrix stack c deducts Mean Matrix c_meanObtain new matrix stack c '.For the n × n square in c ' Battle array c_i', 1 × n can be rewritten as²VectorI.e.1≤i ≤n.Construction covariance matrix e, size is n²×n², the implication of matrix e element be exactly operate to operation to the degree of association before.

$e=\underset{i=1}{\overset{n}{\σ}}{\widehat{c_i}}^t\widehat{c_i}---\left(2\right)$

Characteristic value according to pca method calculating matrix e is λ_iWith corresponding characteristic vector According to the property of spectral theory and matrix e,Constitute n²×n²One group of orthogonal basis of dimension space.From n²Individual feature Before selecting in vector, k is so that the principal component contributor rate of this k feature reaches predetermined threshold η, that is,

$\frac{{\mathrm{\σ}}_{i=1}^k{\mathrm{\λ}}_i}{{\mathrm{\σ}}_{i=1}^{n^2}{\mathrm{\λ}}_i}\&greaterequal;\mathrm{\η}---\left(3\right)$

The selection of η value is related to the time complexity of this technology and the accuracy rate of audit, and usual value not only can for 0.9 Obtain the principal character of user's fictitious assets transaction moreover it is possible to ensure higher audit precision.

Characteristic vector v that covariance matrix e extracts₁,v₂,…,v_kWith matrix c_iProperty the same, both be from same Individual vector space, represent each operation between correlation degree.1×n²Vector v_iThe matrix v of n × n size can be written as_i(1 ≤ i≤k) it is not necessary to using all of characteristic vector it is possible to by any customer transaction daily record time series data matrix by n²Individual feature K in vector shows, and therefore this k characteristic vector just represents the main feature of customer transaction behavior.

Step 4) pass through customer transaction behavior main feature construction audit regulation storehouse.Any fictitious assets transaction log conversion Time series data matrix can use vector product

$x_i=v_i\·{\hat{c}}^t,1\≤i\≤k---\left(4\right)$

Calculate its coordinate representation in the main feature space that k characteristic vector is constituted, be designated as x=(x₁..., xk), its The c of middle n × n is rewritten into 1 × n²'sCalculated by above formula, the time series data matrix of any higher-dimension can convert based on feature The coordinate representation in space, has reached the purpose of dimensionality reduction.

$\underset{i=1}{\overset{k}{\σ}}{x}_i{v}_i=\underset{i=1}{\overset{k}{\σ}}(a_i+b_i)=\underset{i=1}{\overset{k}{\σ}}{a}_i+\underset{i=1}{\overset{k}{\σ}}{b}_i---\left(5\right)$

Above formula can calculate positive divisor module a of time series data matrix_iWith negative factor module b_i, wherein a_iIn element by x_iv_iThe value that middle element is more than threshold alpha is constituted, and remaining constitutes b_i.Positive divisor module a_iReflect and use during arm's length dealing The most possible generation sequence of operation in family, and b_iThen reflect the sequence of operation of most unlikely appearance.Calculated by formula (4), (5) Coordinate representation in main feature space for each matrix constitute positive divisor module group in c 'With negative factor modulus Block groupSoJust constitute fictitious assets transaction log audit regulation storehouse.By series of computation, Finally give the easy model of virtual money of eid userWithThese models are stored on specific audit database server, so that Use when afterwards the transaction log record of eid user being audited.

Step 5) fictitious assets transactional operation and transaction Attribute Association audit.For arbitrary user's fictitious assets to be detected Transaction time series data s, sends out according to the attribute that the eid that user uses inquires about s associative operation in transaction attribute information base φ first Whether raw probability all reaches threshold value ζ set in advance (as the Nogata distribution statisticses of attribute information), if reaching, by step 2) structure Build matrix m, the row or column being otherwise just not up to the Attribute Association operation place of threshold value ζ in matrix m adds penalty factor θ, θ value Determined by practical application；Then deduct Mean Matrix c_meanObtain m ', and according to formula (4), formula (5) is just calculating this time series data Negative factor module a_i' and b_i′；Finally forWithIn each group of module, according to following equalities calculate the virtual money of this section of user Produce the whether normal judgment value of transaction log.

The value of ζ typically takes 0.8, and now the value of θ is more complicated, if a certain property value of this time transaction of eid user falls The interval probability entering is more than ζ, then θ is 0；If the interval probability that a certain property value of this time transaction of eid user falls into is less than ζ, Then θ is the difference of this interval probability and ζ.As the user 1 in table 1, no matter his certain dealing money is how many, this θ value for ζ- 0.5th, ζ -0.45 or ζ -0.05；And for user 2, if his dealing money is less than 1000 yuan, then this θ value is 0, if its It is worth, then the algorithm of θ value is identical with the situation of user 1.

For auditor's judgement value ε, there is a following audit regulation:

IfAndThen audit as normal；

IfAndThen audit as exception；

IfAnd

IfThen audit as normal；

Otherwise audit as exception；

IfAnd

IfThen audit as exception

Otherwise audit as normal.

From many-sided consideration such as computational complexity and audit accuracy rate, the value of ε is 0.8 to this technology.Table 2 is that an audit is real Example.

Table 2 is simply audited example

Step 6) algorithm correction.If this technology correct judgment and auditing result is normal, user's respective transaction is operated Attribute information adds attribute information base φ, and carries out probability statistics according to user eid；If this technology misjudgment and auditing result For normal, then the negative factor module of the generation of user's time series data is added negative factor module groupIf this technology misjudgment and Auditing result is abnormal, then the positive divisor module of the generation of user's time series data is added positive divisor module group

In sum, technical solution of the present invention has just taken into full account asking of data association attributes when setting up data model Topic, and adapt to customer transaction attribute polytropy and the probabilistic feature of trading activity.The rule base that this technology builds can So that dynamic corrections are carried out to it according to auditing result.In fictitious assets transaction log test phase, the detection of the use of this technology Method is not only simple but also can obtain higher precision.

Be more than exemplary description has been carried out to the present invention it is clear that the present invention realize do not limited by aforesaid way System, as long as employing the various improvement that technical solution of the present invention is carried out, or the not improved design by the present invention and technical scheme Directly apply to other occasions, all within the scope of the present invention.

Claims (1)

1. a kind of cross-platform fictitious assets transaction auditing method based on eid and spectral theory is it is characterised in that include following walking Rapid:

Step 1, the arm's length dealing log recording of certain class fictitious assets given, referred to as training set；For this training set, according to The uniqueness of eid, pre-processes to it: merges the transaction log of identical eid user, ordinal number when transactional operation is converted into According to counting the transaction attribute information of each eid user, form customer transaction attribute information base φ；

Step 2, the transactional operation daily record founding mathematical models for user: the transactional operation time series data of every eid user is entered Row segmentation, segmentation length is l；Additionally, the number of operation different in log recording is designated as n, can be so each l length Transactional operation sequence create n × n size matrix c_l；The transverse and longitudinal coordinate of this matrix is all different types of operation, and matrix Element is exactly the corresponding frequency operating to appearance in window size h, and that is, in h continuous operation, certain operation is secondary to occur Number；Matrix c_lEach element represent operate between the degree of association；

Step 3, extract the main feature of customer transaction operation behavior using spectral theory: be c=by the training set matrix stack that obtains of conversion {c₁,c₂,…,c_n, c_iIt is all n × n, 1≤i≤n, Mean Matrix c is calculated by equation (1)_mean, n is sequential in training set The sum of data segment；

$c_{mean}=\frac{1}{n}\underset{i=1}{\overset{n}{\σ}}{c}_i---\left(1\right)$

Each matrix in matrix stack c deducts Mean Matrix c_meanObtain new matrix stack c '；For n × n matrix c in c '_i', 1 × n can be rewritten as²VectorI.e. Construction covariance matrix e, size is n²×n², the implication of matrix e element be exactly operate to operation to the degree of association before；

$e=\underset{i=1}{\overset{n}{\σ}}{{\hat{c}}_i}^t{\hat{c}}_i---\left(2\right)$

Characteristic value according to pca method calculating matrix e is λ_iWith corresponding characteristic vector According to the property of spectral theory and matrix e,Constitute n²×n²One group of orthogonal basis of dimension space, from n²Individual feature Before selecting in vector, k is so that the principal component contributor rate of this k feature reaches predetermined threshold η, that is,

$\frac{{\mathrm{\σ}}_{i=1}^k{\mathrm{\λ}}_i}{{\mathrm{\σ}}_{i=1}^{n^2}{\mathrm{\λ}}_i}\&greaterequal;\mathrm{\η}---\left(3\right)$

This k characteristic vector just represents the main feature of customer transaction behavior；

Step 4, pass through customer transaction behavior main feature construction audit regulation storehouse；The sequential of any fictitious assets transaction log conversion Data matrix can use vector product

$\begin{array}{cc}{x}_i=v_i\·{\hat{c}}^t& 1\≤i\≤k\end{array}---\left(4\right)$

Calculate its coordinate representation in the main feature space that k characteristic vector is constituted, be designated as x=(x₁,…,x_k), wherein n × n C be rewritten into 1 × n²'sCalculated by above formula, the time series data matrix of any higher-dimension can convert based on feature space Coordinate representation, has reached the purpose of dimensionality reduction；

$\underset{i=1}{\overset{k}{\σ}}{x}_i{v}_i=\underset{i=1}{\overset{k}{\σ}}(a_i+b_i)=\underset{i=1}{\overset{k}{\σ}}{a}_i+\underset{i=1}{\overset{k}{\σ}}{b}_i---\left(5\right)$

Wherein a_iIn element by x_iv_iThe value that middle element is more than threshold alpha is constituted, and remaining constitutes b_i；Positive divisor module a_iReflect The most possible generation sequence of operation of user during arm's length dealing, and b_iThen reflect the operation sequence of most unlikely appearance Row；Calculate in c ' coordinate representation in main feature space for each matrix by formula (4), (5) and constitute positive divisor module group With negative factor module groupSoJust constitute the audit of fictitious assets transaction log Rule base；

Step 5, fictitious assets transactional operation and transaction Attribute Association audit: for arbitrary user's fictitious assets transaction to be detected Time series data s, occurs general first according to the attribute that the eid that user uses inquires about s associative operation in transaction attribute information base φ Whether rate all reaches threshold value ζ set in advance, if reaching, builds matrix m by step 2, is otherwise just not up to threshold in matrix m The row or column that the Attribute Association operation of value ζ is located adds penalty factor θ, and θ value is determined by practical application；Then deduct Mean Matrix c_meanObtain m ', and according to formula (4), formula (5) calculates positive and negative factor module a of this time series data_i' and b_i′；Finally forWith In each group of module, calculate the whether normal judgment value of this section of fictitious assets transaction log of user according to following equalities；

For auditor's judgement value ε, there is a following audit regulation:

IfAndThen audit as normal；

IfAndThen audit as exception；

IfAnd

If i.Then audit as normal；

Ii. otherwise audit as exception；

IfAnd

If i.Then audit as exception

Ii. otherwise audit as normal；

Step 6, algorithm correction, if this technology correct judgment and auditing result is normal, by user's respective transaction operational attribute Information adds attribute information base φ, and carries out probability statistics according to user eid；If this technology misjudgment and auditing result are just Often, then the negative factor module of the generation of user's time series data is added negative factor module groupIf this technology misjudgment and audit Result is abnormal, then the positive divisor module of the generation of user's time series data is added positive divisor module group