A Reproducible Normalization Model for Forensic Analysis of Heterogeneous Bank Statements: Design and Internal-Consistency Evaluation on a Synthetic Corpus

Journal of Cybersecurity and Privacy, 2026

Full text Open access: Gold Metadata (CSL-JSON)
DOI 10.3390/jcp6050179
Data confidence 70 medium
How this score is calculated

It is built from checkable properties of the record itself: whether the article has a DOI, how many independent sources confirmed its data, whether the required fields are filled in, and how recent the latest confirmation is. Disagreement between sources and a missing identifier lower it. A value of 80 or above means the record was published without further checking; 60 to 79 means it is published at reduced confidence, with a manual check advisable. A record verified by an editor by hand is never pushed below 90 by a recalculation. This scores our data about the article, not the article itself.

Abstract

Bank statements are information-rich but labour-intensive forensic sources: differing formats, inconsistent field naming, incomplete counterparty attributes and mixed debit–credit conventions make cross-account comparison unsafe, and an automated summary is easily read later as established fact. We propose a reproducible normalization model converting heterogeneous statement records into one auditable transaction journal, each row bound to its source line. It separates the source document, the normalized record and the interpretive indicator, formalizes an eight-stage cycle from inventory and hash control to quality control and indicator generation, and attaches an evidential status to every reconstructed route. The evaluation is entirely synthetic: the corpus, whose defects have known type and position, was generated by the same authors who built the control layer, so the scores below are an internal-consistency check rather than evidence of performance on real bank exports. The corpus, its generator and a reference implementation of the model are released with the article. Across 1200 transactions from 30 files and 15 layouts, all 8 mandatory fields map completely while counterparty identifiers reach 0.573. The control layer flags 55 of the 57 injected defects with no false candidate; the two misses are undetectable by construction and are reported as such. Reclassifying one channel-only record changes precision from 1.000 to 0.982 and F1 from 0.982 to 0.973. On eight fault types the generator never produces, seven are surfaced in the defect log and one, a day–month swap, passes largely unnoticed. On data with no planted behavior, the indicators flag from none to 11 of 12 subjects depending on the threshold, so thresholds need calibration against a reference population. Removing the lineage tuple or the defect log leaves detection unchanged while removing source references or suppressing some logged warnings, showing that detection scores alone do not describe the output’s auditability. Validation on real exports and review by independent assessors remain open.