Method for data manipulation detection of numerical data values
A method for data manipulation detection of numerical data values uses a testing device. A Benford vector is ascertained from the frequencies expected, according to the Benford's distribution, for predefined initial number groups in a transformation unit by use of a composition data transformation that reproduces the frequencies in relation to one another. A random number generator is repeatedly used to generate randomly distributed numerical values, and multiple simulation vectors are ascertained from the frequencies of the initial number groups of the randomly distributed numerical values by the transformation unit. A detection unit is used to ascertain a simulation deviation from the Benford vector for each simulation vector and to store it in a memory, after which a group of numerical data values is read in via an input interface. A test vector and a test deviation of the test vector are ascertained by the transformation unit.
1. A method for detecting data manipulation of numerical data values using a testing apparatus, which comprises the steps of:
initially ascertaining a Benford vector from frequencies, expected in accordance with a Benford distribution, of predefined leading digit groups in a transformation unit of the testing apparatus by way of a composition data transformation in a form of an isometric composition data transformation that maps the frequencies in relation to one another;
generating repeatedly randomly distributed numerical values using a random number generator of the testing apparatus and a plurality of simulation vectors being ascertained from the frequencies of the predefined leading digit groups of the randomly distributed numerical values by way of the transformation unit that carries out a same said composition data transformation as for the frequencies of the predefined leading digit groups;
ascertaining a simulation deviation from the Benford vector for each of the simulation vectors by means of a detection unit and being stored in a test memory of the testing apparatus;
subsequently reading in a group of numerical data values via an input interface of the testing apparatus;
ascertaining a test vector from the frequencies of the predefined leading digit groups in the numerical data values of the group by way of the transformation unit, and ascertaining a test deviation of the test vector from the Benford vector by the detection unit;
subsequently ascertaining a relative number of stored simulation deviations that are greater than the test deviation by way of a testing unit of the testing apparatus; and
outputting a positive manipulation value via an output interface if the relative number falls below a predefined threshold value.
2. The method according to claim 1 , which further comprises selecting categories from a dataset of the numerical data values assigned to different categories using a filter unit on a basis of predefined filter parameters, and the numerical data values allocated to the categories are transferred as a group to the input interface of the testing apparatus.
3. The method according to claim 1 , wherein the composition data transformation of the transformation unit is a pivot coordinate transformation.
4. The method according to claim 1 , wherein the detection unit, for an incoming said test vector, outputs its Mahalanobis distance from the Benford vector.
5. The method according to claim 1 , wherein the numerical data values are numerical access data in relation to media data streams.
6. The method according to claim 1 , wherein the isometric composition data transformation is a pivot composition data transformation.