JP2017191577A - Server device and misconduct determination method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a server device to prevent misconduct and a misconduct determination method.SOLUTION: A server device includes: a communication unit for receiving code information including first information and second information from a user terminal; an information accumulation unit for classifying the received code information according to types of the first information, associating the second information with terminal identification information to identify a user terminal that has transmitted the code information for each type, and accumulating them in time series; and a misconduct determination unit for identifying unauthorized second information on the basis of a pattern along the time series of the accumulated second information and determining that a user terminal having terminal identification information corresponding to the unauthorized second information is an unauthorized terminal.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a server device and a fraud determination method.

  In recent years, points and discount privileges are given to customers in order to encourage customers to use stores and the like. Provision of points, discount benefits, and the like to customers is performed using a paper medium or an electronic medium that can be obtained via a homepage on the Internet.

  When providing points, discount benefits, etc. to customers using electronic media, at the store, for example, provide a two-dimensional code that records information related to the granting of points or discount benefits, and the customer is a terminal such as his / her mobile phone. By reading the code using the camera provided in the URL and accessing the site corresponding to the URL information included in the two-dimensional code, the customer's point balance is updated or a discount privilege is given (Patent Document 1). .

JP 2010-250623 A

  However, when a two-dimensional code is provided at a store, if the two-dimensional code is fixed, the customer will receive points and discount benefits many times using code information acquired when the customer uses the store. There is a risk of unauthorized use. In addition, there is a possibility that fraudulent persons who obtain a two-dimensional code image acquired when a customer uses the store, obtain a point, a discount privilege, or the like by an unauthorized person who does not use the store may be performed.

  In view of the above problems, an object of the present invention is to provide a server device and a fraud determination method for preventing fraud.

  The server device according to an embodiment of the present invention classifies the received code information for each of the first information by classifying the received code information for each communication unit that receives code information including first information and second information from a user terminal. An information storage unit that stores the second information and terminal identification information that identifies the user terminal that transmitted the code information in time series, and a pattern along the time series of the stored second information And a fraud determination unit that identifies fraudulent second information and determines that the user terminal of the terminal identification information corresponding to the fraudulent second information is fraudulent.

  The fraud determination unit may change the second information when the pattern along the time series of the accumulated second information returns to the original second information within a predetermined number of times after the second information is changed. May be identified as fraudulent.

  The fraud determination unit, when the pattern along the time series of the accumulated second information returns to the original second information within a predetermined time after the second information is changed, May be identified as fraudulent.

  The fraud determination unit is a user terminal that has not been determined to be fraudulent based on the pattern along the time series of the second information, when the corresponding terminal identification information is accumulated more than a predetermined number of times in a predetermined period, The user terminal of the terminal identification information accumulated for the predetermined number of times or more may be determined to be illegal.

  The communication unit receives third information from the user terminal, and the information storage unit stores the third information in time series in association with the second information and terminal identification information corresponding to the second information. The fraud determination unit determines that the user terminal satisfying a predetermined condition for the third information among the user terminals that are not determined to be fraud based on the time-series pattern of the second information is fraudulent. May be.

  The third information is GPS information indicating a current position of the user terminal, and the fraud determination unit may determine that the user terminal is illegal when the position indicated by the GPS information is outside a predetermined area. .

  The third information is ID information of a beacon received by the user terminal, and the fraud determination unit includes a beacon ID information associated with the first information and a beacon ID information received from the user terminal. If they do not match, the user terminal may be determined to be illegal.

  The fraud determination unit includes the time when the communication unit receives code information from the user terminal among the user terminals that are not determined to be fraud based on the time-series pattern of the second information. If it is outside the time associated with, the user terminal may be determined to be illegal.

  The fraud determination method according to an embodiment of the present invention receives code information including first information and second information from a user terminal, classifies the received code information for each first information, The second information and terminal identification information for identifying the user terminal that transmitted the code information are associated with each other and accumulated in a time series, and the illegal information is obtained based on the accumulated time-series pattern of the second information. Specifying second information, and determining that the user terminal of the terminal identification information corresponding to the unauthorized second information is unauthorized.

  A service providing system according to an embodiment of the present invention includes a server device and a data processing device, wherein the server device receives code information including first information and second information from a user terminal. The communication unit and the received code information are classified for each of the first information, and for each classification, the second information and terminal identification information for identifying the user terminal that transmitted the code information are associated with each other and stored in time series. To identify unauthorized second information on the basis of a time-sequential pattern of the accumulated second information and to identify a user terminal having terminal identification information corresponding to the unauthorized second information. A fraud determination unit, and the information storage unit sets a flag indicating fraud in association with the terminal identification information of the user terminal determined to be fraudulent, and through the first communication unit, the fraud The flag indicating First notification information indicating that the data has been received and terminal identification information corresponding to the flag indicating fraud are transmitted to the data processing device, and the data processing device corresponds to the first notification information and the flag indicating fraud A second communication unit that receives the terminal identification information to be received, and a fraud confirmation result that informs that the first notification information has been received and indicates whether the user terminal corresponding to the received terminal identification information is illegal The fraud confirmation unit receives the second notification information based on the fraud confirmation result and the terminal identification information of the user terminal via the second communication unit. Send to.

  The first communication unit receives the second notification information and the terminal identification information of the user terminal, and the information storage unit corresponds to the terminal identification information of the user terminal based on the second notification information. The flag indicating fraud attached may be changed.

  A program according to an embodiment of the present invention receives code information including first information and second information from a user terminal in a computer, classifies the received code information for each first information, The second information and the terminal identification information for identifying the user terminal that transmitted the code information are associated with each other and accumulated in time series, and the illegality is determined based on the time-series pattern of the accumulated second information. And determining the user terminal of the terminal identification information corresponding to the unauthorized second information to be unauthorized.

  According to one embodiment of the present invention, it is possible to provide a server device and a fraud determination method for preventing fraud.

It is the schematic which shows the structure of the service provision system which concerns on one Embodiment of this invention. It is a figure explaining an example of the flow for the code information acquisition performed with a user terminal. It is a block diagram which shows the structure of the server apparatus which concerns on one Embodiment of this invention. It is a figure explaining an example of the flow of the fraud determination function performed with the server apparatus which concerns on one Embodiment of this invention. It is a figure explaining an example of the flow of the fraud determination function performed with the server apparatus which concerns on one Embodiment of this invention. It is a block diagram which shows an example of a structure of the fraud determination function which concerns on one Embodiment of this invention. It is a block diagram which shows an example of a structure of an information storage part. It is a figure which shows an example of the type information and terminal identification information which were matched mutually with the information management database and were accumulate | stored in time series. It is a block diagram which shows the structure of the information processing apparatus which concerns on one Embodiment of this invention. It is a figure explaining an example of the flow of the fraud confirmation function performed with the information processing apparatus which concerns on one Embodiment of this invention. It is a block diagram which shows an example of a structure of the fraud confirmation function which concerns on one Embodiment of this invention. It is a schematic diagram which shows the display screen in information processing. It is a figure which shows an example of the type information and terminal identification information which were matched mutually with the information management database and were accumulate | stored in time series. It is a figure which shows an example of the type information and terminal identification information which were matched mutually with the information management database and were accumulate | stored in time series.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The following embodiments are examples of the embodiments of the present invention, and the present invention is not limited to these embodiments. In addition, the same code | symbol represents the same thing in several drawing, and the repeated description is abbreviate | omitted.

(Embodiment)
A server device, a program, and a service providing system including the server device according to an embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing an overall configuration of a service providing system 100 according to an embodiment of the present invention.

  As shown in FIG. 1, a service providing system 100 according to an embodiment of the present invention includes a server device 101 and an information processing device 103. The server apparatus 101 and the information processing apparatus 103 are connected via the network 105 and can communicate with each other.

  The server apparatus 101 receives code information transmitted from the user terminals 107 (107-1 to 107-5) via the network 105. In FIG. 1, five user terminals 107, 107-1 to 107-5, are shown, but the number of user terminals 107 is not limited to this.

  As a premise, when a customer uses a store, two-dimensional code information including service information related to point grants, discount privileges, etc. is provided from the store to the customer. The store has a plurality of types of two-dimensional code information. The store provides different types of two-dimensional code information to customers who use the store depending on the date and time zone. Here, the two-dimensional code information is, for example, an image in which code information such as a QR code (registered trademark) or a barcode is embedded. The two-dimensional code information is displayed on an electronic medium such as a paper medium or a display at a store and provided to a customer.

  FIG. 2 is a diagram for explaining an example of the flow of the code information acquisition function executed on the user terminal 107. The code information acquisition function is realized by the CPU executing a control program stored in a storage unit built in the user terminal. First, the customer images the two-dimensional code information provided from the store using a camera built in the user terminal 107 possessed by the customer (S201). The user terminal 107 includes a code reading unit that can read two-dimensional code information. The code reading unit acquires code information from the acquired two-dimensional code information (S202). In addition to the service information, the code information includes at least store identification information (first information) that can identify the name of the store that provided the two-dimensional code information, and the type of the two-dimensional code information provided from the store. Type information (second information). The code information includes a predetermined URL. The customer connects to the server apparatus 101 by connecting to the URL included in the code information using the user terminal 107, and transmits the code information to the server apparatus 101 (S203). When code information is transmitted from the user terminal 107 to the server apparatus 101, terminal identification information (information identifying the user terminal) of the user terminal that transmitted the code information, for example, a user ID is transmitted to the server apparatus 101 together with the code information. Is done.

(Server device)
[Hardware]
FIG. 3 is a block diagram showing the configuration of the server apparatus 101 according to an embodiment of the present invention. The server device 101 includes a control unit 301, a storage unit 303, and a communication unit 205. These components are connected to each other via a bus 307.

  The control unit 301 includes an arithmetic processing circuit such as a CPU. The control unit 301 causes the CPU to execute the control program 303a stored in the storage unit 303, and realizes various functions in the server device 101. The realized functions include a fraud determination function. Further, the realized function may include a determination correction function based on the result of fraud confirmation executed in the information processing apparatus 103.

  The storage unit 303 is a storage device such as a nonvolatile memory or a hard disk. The storage unit 303 stores a control program 303a for realizing the fraud determination function. The control program 303a may be provided in a state stored in a computer-readable recording medium such as a magnetic recording medium, an optical recording medium, a magneto-optical recording medium, or a semiconductor memory. In this case, the server apparatus 101 only needs to include a device that reads the recording medium. The control program may be downloaded via a network such as the Internet.

  The communication unit 305 is connected to a communication line such as the Internet or a LAN based on the control of the control unit 301, and transmits / receives information to / from an external device such as the user terminal 107 or the information processing device 103. Note that the function of the storage unit 303 may be realized by an external device capable of communicating in the communication unit.

[Illegal judgment function]
The fraud determination function realized by the control unit of the server apparatus 101 executing the control program stored in the storage unit will be described. A part or all of the configuration for realizing the fraud determination function described below may be realized by hardware.

  4A and 4B are diagrams illustrating an example of the flow of the fraud determination function 400 executed by the server apparatus 101. FIG. First, as illustrated in FIG. 4A, the server apparatus 101 receives code information and terminal identification information of the user terminal that has transmitted the code information from the user terminal 107 via the network 105 (S401). Here, when the code information and the terminal identification information of the user terminal that has transmitted the code information have not been received, a standby state is waited for reception.

  Next, the server apparatus 101 classifies the code information and the terminal identification information of the user terminal that has transmitted the code information for each store information (first information) included in the received code information (S402). The type information (second information) indicating the type of the two-dimensional code information included in the code information classified into the above and the terminal identification information of the user terminal that transmitted the code information are associated with each other and stored in time series (S403). . The server apparatus 101 continuously executes the processes of S401 to S403.

  Furthermore, as shown in FIG. 4B, the server apparatus 101 identifies unauthorized type information based on a time-series pattern of accumulated type information (S404).

  Next, when there is illegal type information, the server apparatus 101 determines that the user terminal of the terminal identification information corresponding to the specified illegal type information is illegal (S405).

  Next, the server apparatus 101 sets a flag indicating fraud in association with the terminal identification information corresponding to the type information identified as fraud stored in time series (S406), and the flag indicating fraud is set. 1st notification information which notifies that, and the terminal identification information of the user terminal determined to be unauthorized are transmitted to the information processing apparatus 103 (S407). The server apparatus 101 may execute the processes of S404 to S407 continuously or intermittently.

  Hereinafter, the fraud determination function 400 will be described in more detail with reference to the drawing illustrating the configuration of the fraud determination function 400 according to an embodiment of the present invention. FIG. 5 is a block diagram showing an example of the configuration of the fraud determination function 400 according to an embodiment of the present invention. The fraud determination function includes a communication unit 501, an information storage unit 503, and a fraud determination unit 505.

  The communication unit 501 receives code information from the user terminal 107 via the network 105. As described above, the code information includes service information and at least store identification information and type information. The communication unit 501 transmits the received code information and the terminal identification information of the user terminal that has transmitted the code information to the information storage unit 503.

  The information storage unit 503 receives code information and terminal identification information from the communication unit 501. The information storage unit 503 first classifies the received code information and terminal identification information for each store identification information included in the received code information, and transmits the code information and the terminal of the user terminal that has transmitted the code information for each classification. The identification information is associated with each other and stored in time series.

  FIG. 6 is a block diagram illustrating an example of the configuration of the information storage unit 503. The information storage unit 503 includes a classification unit 601 and an information management database 603. Although three information management databases 603 are shown in FIG. 5, the number of information management databases 603 is not limited to three and may be one or more.

  The classification unit 601 classifies the received code information and terminal identification information for each store identification information included in the received code information. In other words, the classification unit 601 classifies the code information and the terminal identification information for each store that provided the two-dimensional code information. The classification unit 601 transmits the code information and terminal identification information classified for each store identification information to the corresponding information management database 603. In the present embodiment, there is an information management database 603 corresponding to each store identification information, that is, each store providing the two-dimensional code information. However, in one information management database 603, for each store identification information, that is, for each store that provided the two-dimensional code information, the code information and the terminal identification information of the user terminal that transmitted the code information are associated with each other. It may be accumulated and managed.

  The information management database 603 stores the code information classified for each store identification information and the terminal identification information of the user terminal that has transmitted the code information in a time series in association with each other. More specifically, the information management database 603 stores the type information included in the code information and the terminal identification information of the user terminal that has transmitted the code information in a time series in association with each other. That is, the information management database 603 stores, in a time series, the type information indicating the type of the two-dimensional code information and the terminal identification information of the user terminal in association with each store that provided the two-dimensional code information.

  When the information management database 603 first receives the code information classified by the classification unit 601 for each store identification information and the terminal identification information of the user terminal that has transmitted the code information, the terminal identification information is stored in the information management database 603. Check whether it is accumulated.

  When the terminal identification information is already stored, the type information included in the code information and the terminal identification information are associated with the terminal identification information and stored in the information management database 603 in time series. The service information corresponding to the terminal identification information is updated based on the service information related to point grants and discount benefits. On the other hand, when information regarding the terminal identification information is not accumulated, the type information included in the code information is newly recorded in the information management database 503 in association with the terminal identification information of the user terminal 107 that has transmitted the code information. And accumulated.

  The fraud determination unit 505 identifies fraudulent type information based on a time-series pattern of type information stored in the information management database 603, and transmits the terminal identification information corresponding to the identified type information Is determined to be illegal. A method for determining the user terminal that has transmitted the illegal code information by the fraud determination unit 505 will be described below.

  FIG. 7 is a diagram illustrating an example of type information and terminal identification information that are associated with each other in the information management database 603 and accumulated in time series. As shown in FIG. 7, in the information management database 603, the type information included in the code information (indicated as the code type in FIG. 7) is the terminal identification information (in FIG. 7) of the user terminal 107 that transmitted the code information. Are stored in time series in association with the user ID. Further, when the type information and the terminal identification information are associated with each other and stored in the information management database 603, the time when the server apparatus 101 receives the code information from the user terminal 107 and the service information (in FIG. 7, as the point balance) May be stored in association with the type information and the terminal identification information.

  For example, as shown in FIG. 7, the user ID corresponding to the code information received by the server apparatus 101 at 9:00:00 on April 1, 20XX is 123 @ ne. jp, type information included in the code information is A, and the point balance is 123 points. This is because the terminal identification information of the user terminal 107 that transmitted the code information is 123 @ ne. The type of the two-dimensional code information provided from the store by the customer who has the user terminal 107 that has transmitted the code information is A, and the customer has 123 points.

  As described above, fraud determination unit 505 identifies fraudulent type information based on a time-series pattern of type information stored in information management database 603, and terminal identification information corresponding to the identified type information Is determined to be unauthorized. For example, in the pattern of type information along the time series, the fraud determination unit 505 returns to the original predetermined type within a predetermined number of times after the type has changed from a predetermined type to a different type in time series. In this case, the different type is specified as incorrect type information, and the user terminal that has transmitted the terminal identification information corresponding to the different type information is determined to be illegal. Here, the predetermined number of times is an arbitrary number, and may be, for example, once. In the following, as an example, when the fraud determination unit 505 returns to the original predetermined type within one time after the type has changed from a predetermined type to a different type in the type information pattern in time series The different types are specified as incorrect type information.

  As shown in FIG. 7, the type information included in the code information received by the server apparatus 101 from 9:00:00 on April 1, 20XX to 10: 20: 0 on April 1, 20XX is A. The type information included in the code information received by the server apparatus 101 at 10:25:15 on April 1, 20XX is B, and from 20:30 on April 1, 20XX to 20XX The type information included in the code information received by the server apparatus 101 by 14: 58: 00: 00 on April 1 is A. In this case, the type information patterns accumulated in the information management database 603 from April 1, 20XX, 9:00:00 to April 20, 20XX, 14: 58: 0 are A, A,... A, B, A,... Here, “...” Indicates that A is continuous. In this type information pattern, the type information returns to A immediately after the type information changes from A to B. Therefore, the fraud determination unit 505 identifies type information whose type is B as fraudulent type information, and the 456 @ ne. The user terminal having the terminal identification information jp is determined to be invalid.

  On the other hand, as shown in FIG. 7, the type information included in the code information received by the server apparatus 101 at 14: 58: 00: 00 on April 1, 20XX is A, and immediately after April 1, 20XX. The type information included in the code information received by the server apparatus 101 at 15: 5: 30 is C, and is included in the code information received by the server apparatus 101 at 15:15:00 on April 1, 20XX. The type information included in the code information received by the server apparatus 101 after 15: 15: 00: 00 on April 1, 20XX is also C. In this case, the type information patterns stored in the information management database 603 after 14: 58: 00: 00 on April 1, 20XX are A, C, C,. Here, “...” Indicates that C is continuous. In this type information pattern, after the type information changes from A to C, C does not return to A but continues twice or more. Therefore, the fraud determination unit 505 does not identify type information whose type is C as illegal type information.

  In the above, when the fraud determination unit 505 returns to the original predetermined type within a predetermined number of times after the type has changed from a predetermined type to a different type in the pattern of type information along the time series, A case where a different type is specified as invalid type information has been described. However, the fraud determination method in the fraud determination unit 505 is not limited to this. For example, in the type information pattern along the time series, the fraud determination unit 505 determines that when the type changes from a predetermined type to a different type and then returns to the original predetermined type within a predetermined time, the different type May be specified as illegal type information. Here, the predetermined time is an arbitrary period.

  In order to distinguish a user terminal that has transmitted code information including type information determined to be illegal from other user terminals, the fraud determination unit 505 displays terminal identification information corresponding to the type information identified as illegal in the information storage unit 503. This is transmitted to the information management database 603.

  The information management database 603 sets a flag indicating fraud in association with the terminal identification information corresponding to the type information identified as fraud.

  For example, as illustrated in FIG. 7, in the present embodiment, the information management database 603 includes the 456 @ ne. Corresponding to the user terminal determined to be illegal by the fraud determination unit 505. A flag “NG” indicating fraud is added in association with the terminal identification information “jp”. The information management database 603 may record a flag indicating that the type information included in the received code information is normal in association with the terminal identification information. For example, as illustrated in FIG. 7, in the present embodiment, the information management database 603 includes a 456 @ ne. In association with other terminal identification information excluding the terminal identification information jp, a flag “OK” indicating that it is not illegal is set.

  When the flag indicating fraud associated with the terminal identification information is set in the information management database 603, the information storage unit 503 first notification information indicating that the flag indicating fraud has been set via the communication unit 501. And the terminal identification information corresponding to the flag indicating fraud are transmitted to the information processing apparatus 103. Further, the information storage unit 503 transmits the store identification information included in the code information including the illegal type information to the information processing apparatus 103 in association with the first notification information and the terminal identification information.

(Information processing device)
[Hardware]
Next, the information processing apparatus 103 included in the service providing system 100 according to the present embodiment will be described. FIG. 8 is a block diagram showing the configuration of the information processing apparatus 103 according to an embodiment of the present invention. The information processing apparatus 103 includes a control unit 801, a storage unit 803, a communication unit 805, a display unit 807, a signal processing unit 809, and a sound output unit 811. Each of these components is connected to each other via a bus 813.

  The control unit 801 includes an arithmetic processing circuit such as a CPU. The control unit 801 executes the control program 803a stored in the storage unit 803 by the CPU, and causes the information processing apparatus 103 to realize various functions. The realized functions include a fraud confirmation function.

  The storage unit 803 is a storage device such as a nonvolatile memory or a hard disk. The storage unit 803 stores a control program 803a for realizing the fraud confirmation function. The control program 803a may be provided in a state stored in a computer-readable recording medium such as a magnetic recording medium, an optical recording medium, a magneto-optical recording medium, or a semiconductor memory. In this case, the information processing apparatus 103 only needs to include a device that reads the recording medium. The control program may be downloaded via a network such as the Internet.

  The communication unit 805 is connected to a communication line such as the Internet or a LAN based on the control of the control unit 801, and transmits / receives information to / from an external device such as the server device 101. Note that the function of the storage unit 803 may be realized by an external device capable of communicating in the communication unit.

  The display unit 807 is a display device such as a liquid crystal display or an organic EL display, and displays a screen based on control by the control unit 801. The signal processing unit 809 includes a sound source that generates an audio signal from a digital signal, an A / D converter, a D / A converter, and the like. The signal processing unit 809 generates an audio signal from a digital signal based on control by the control unit 801. The sound output unit 811 outputs a sound based on the audio signal generated by the signal processing unit 809. Note that the display unit 807 or the sound output unit 811 may be omitted.

[Incorrect check function]
The fraud confirmation function realized by the control unit of the information processing apparatus 103 executing the control program stored in the storage unit will be described. A part or all of the configuration for realizing the fraud confirmation function described below may be realized by hardware.

  FIG. 9 is a diagram illustrating an example of the flow of the fraud confirmation function 900 executed by the information processing apparatus 103. First, the information processing apparatus 103 receives first notification information indicating that a flag indicating fraud has been set from the server apparatus 101, and corresponding terminal identification information and store identification information (first information) via the network 105. (S901). Here, when the first notification information and the corresponding terminal identification information and store identification information have not been received, a standby state is waited for reception.

  Next, the information processing apparatus 103 notifies that the first notification information has been received (S902), and notifies the service user whether or not the fraud determination on the user terminal of the terminal information corresponding to the first notification information is appropriate. Prompt for confirmation. Next, the information processing apparatus 103 receives the fraud confirmation result input from the service user (S903), and transmits the second notification information based on the fraud confirmation result to the server apparatus 101 together with the terminal information (S904). .

(Information processing device)
Hereinafter, the fraud confirmation function 900 will be described in more detail with reference to the drawings illustrating the configuration of the fraud confirmation function 900 according to an embodiment of the present invention. FIG. 10 is a block diagram showing an example of the configuration of the fraud confirmation function 900 according to an embodiment of the present invention. The fraud confirmation function 900 includes a communication unit 1001 and a fraud confirmation unit 1003.

  The communication unit 1001 includes first notification information indicating that a flag indicating fraud has been set, terminal identification information corresponding to the flag indicating fraud, and store identification included in code information including type information identified as fraud Information (first information) is received from the server apparatus 101 via the network 105.

  The fraud confirmation unit 1003 notifies a service user, for example, a store, that the first notification information has been received. For example, due to human error or display failure, temporarily incorrect 2D code information is provided to the customer, and the customer reads the code information read from the incorrect 2D code information to the server device 101, which is illegal. It may be determined that. Therefore, the fraud confirmation unit 503 uses, for example, the store identification information to the store that provided the two-dimensional code information to the user terminal determined to be fraudulent, and the user terminal of the customer using the store is determined to be fraudulent. When the two-dimensional code information is provided to the user terminal determined to be illegal, the store is prompted to confirm whether a human error or a display failure has occurred. Note that the information processing apparatus 103 notifies that the customer's user terminal is determined to be unauthorized by the display on the display unit 807 and the sound output from the sound output unit 811. For example, the fraud confirmation unit 1003 provides a service user with a user interface for notifying that the first notification information has been received. The user interface is a touch interface displayed on the display unit 807 of the information processing apparatus 103, for example. Note that the notification method is not limited thereto, and the fraud confirmation unit 1003 may notify that the first notification information has been received by vibrating the information processing apparatus 103.

  The fraud confirmation unit 1003 receives an input of the fraud confirmation result by the service user via the user interface provided to the service user. The fraud confirmation unit 1003 transmits second notification information based on the fraud confirmation result to the server apparatus 101 via the communication unit 1001. For example, when the user terminal is determined to be illegal due to a human error or a display failure in the store, the fraud confirmation unit 1003 indicates that the user terminal determined to be illegal is not illegal. And the terminal identification information of the user terminal are transmitted to the server apparatus 101 via the communication unit 1001. Note that if the user terminal determined to be fraudulent is actually transmitted by the user terminal as a result of fraud confirmation by the service user, the fraud confirmation unit 1003 determines that the user terminal is fraudulent. The second notification information indicating that is actually illegal may be transmitted to the server apparatus 101.

  The server apparatus 101 realizes a determination correction function in response to the result of fraud confirmation by the fraud confirmation function realized by the information processing apparatus 103. Part or all of the configuration for realizing the determination correction function may be realized by the hardware of the server apparatus 101 described above. In the present embodiment, the determination correction function is realized by the communication unit 501 and the information storage unit 503. Specifically, the communication unit 501 receives, via the network 105, second notification information indicating that the user terminal determined to be unauthorized from the information processing apparatus 103 is not unauthorized and the terminal identification information of the user terminal. . When the information storage unit 503 receives the second notification information and the terminal identification information of the user terminal from the communication unit 501, the information storage unit 503 stores the unauthorized information associated with the terminal identification information stored in the information management database 603 in time series. Change the flag indicating.

  As described above, in the fraud determination function 300 according to the present embodiment, the classification unit 601 classifies the code information including the store identification information and the type information received from the user terminal 107 for each store identification information, The management database 603 associates the type information included in the classified code information with the terminal identification information for identifying the user terminal that transmitted the code information, and accumulates them in time series. The fraud determination unit 505 identifies fraudulent type information based on the time-series pattern of the accumulated type information, and determines that the user terminal of the terminal identification information corresponding to the identified type information is fraudulent.

  According to this embodiment, unauthorized use of the two-dimensional code information provided by the store to the customer can be prevented. In addition, according to the present embodiment, the type of the two-dimensional code information provided to the customer is set in the store in order to determine the illegal type information based on the time-series pattern of the type information accumulated in the server apparatus 101. Can be omitted, and the burden on the store can be reduced.

(Modification)
In the embodiment described above, in the fraud determination function 300, the fraud determination unit 505 identifies the illegal type information based on the time-series pattern of the type information stored in the information management database 603, and specifies the specified type. The user terminal that transmitted the terminal identification information corresponding to the information is determined to be illegal. Specifically, the fraud determination unit 505 returns to the original predetermined type within a predetermined number of times or within a predetermined time after the type information pattern along the time series has changed from a predetermined type to a different type. In this case, the different type is specified as incorrect type information. However, the fraud determination method in the fraud determination unit 505 is not limited to this. Hereinafter, another example of the fraud determination method in the fraud determination unit 505 will be described.

(Modification 1)
The fraud determination unit 505 specifies code information including type information that is not identified as fraud after identifying the type information based on the time-series pattern of the type information stored in the information management database 603. Further, an unauthorized user terminal may be determined based on the terminal identification information of the user terminal that transmitted the message, that is, the user terminal that has not been determined to be unauthorized. Specifically, the fraud determination unit 505 stores a predetermined number or more of the same terminal identification information in a predetermined period for the terminal identification information of the user terminal that has transmitted code information including type information that has not been identified as fraudulent. If it is, the user terminal of the terminal identification information is determined to be illegal. Here, the predetermined period is an arbitrary period, and may be one hour, for example. Further, the predetermined number is an arbitrary number, and may be 3 or more, for example.

  FIG. 11 is a diagram illustrating an example of type information and terminal identification information that are associated with each other in the information management database 603 and accumulated in time series. As shown in FIG. 11, the type information included in the code information received by the server apparatus 101 from April 1, 20XX, 9:00:00 to April 1, 20XX, 9: 45: 0 The type information included in the code information received by the server apparatus 101 from 10:20:20 on April 1, 20XX to 10:30:30 on April 1, 20XX is B, and 20XX The type information included in the code information received by the server apparatus 101 from April 1, 2010 at 10:30:35 to April 20, 20XX at 15: 5: 30 is A. In this case, the type information patterns accumulated in the information management database 603 from April 1, 20XX, 9:00:00 to April 1, 20XX, 15: 5: 30 are A, A, A, B, B, B, A, A, A. Here, as in the above-described embodiment, the fraud determination unit 505 changes the type from the predetermined type to a different type in the pattern of the type information along the time series, and the original predetermined predetermined within one time. When returning to the type, when the different type is specified as illegal type information, the fraud determination unit 505 determines that the illegal type information is illegal from the type information pattern of A, A, A, B, B, B, A, A, A. The type information cannot be specified. That is, when the customer repeatedly accesses the server apparatus 101 repeatedly using the same two-dimensional code information, the fraud determination unit 505 cannot identify the illegal type information based on the type information pattern. .

  However, when the fraud determination unit 505 further determines a fraudulent user terminal based on the terminal identification information of the user terminal that has transmitted code information including type information that has not been identified as fraud, based on the type information pattern. An unauthorized user terminal that could not be identified can be identified. For example, if the fraud determination unit 505 stores three or more pieces of the same terminal identification information within one hour for the terminal identification information of a user terminal that has transmitted code information including type information that has not been identified as fraud, When determining that the user terminal of the terminal identification information is illegal, the fraud determination unit 505 uses the server apparatus 101 from 10:20:20 on April 1, 20XX to 10:30:30 on April 1, 20XX. 345 @ ne. Which transmitted the received code information. The user terminal having the terminal identification information jp is determined to be invalid.

  As described above, by using the terminal identification information in addition to the type information pattern, the fraud determination unit 505 may not be able to identify the illegal type information based on the type information pattern in time series. Furthermore, an unauthorized user terminal can be specified based on the terminal identification information of the user terminal.

(Modification 2)
In addition, the fraud determination unit 505 is transmitted from a user terminal that has not been determined to be fraud after identifying fraudulent type information based on a time-series pattern of type information stored in the information management database 603. An unauthorized user terminal may be determined based on the position information (third information) of the user terminal. The position information is, for example, GPS information indicating the current position of the user terminal. When a beacon is installed in a store used by a customer, the location information may be information notifying that a beacon signal has been received, for example, beacon ID information. The position information transmitted from the user terminal is stored in the information management database 603 in time series in association with the type information and the terminal identification information.

  FIG. 12 is a diagram illustrating an example of type information and terminal identification information that are associated with each other in the information management database 603 and accumulated in time series. As shown in FIG. 12, all the type information included in the code information received by the server device 101 from April 1, 20XX, 9:00:00 to April 1, 20XX, 14: 58: 0. A. In this case, the type information patterns stored in the information management database 603 from April 1, 20XX, 9:00:00 to April 20, 20XX, 14: 58: 0 are A, A, A, A, A, A, A, A. Here, as in the above-described embodiment, the fraud determination unit 505 changes the type from the predetermined type to a different type in the pattern of the type information along the time series, and the original predetermined predetermined within one time. When returning to the type, if the different type is specified as illegal type information, the fraud determination unit 505 determines that the type information is invalid from the type information pattern of A, A, A, A, A, A, A, A. Cannot be specified. In other words, when the two-dimensional code information acquired by the customer in the past coincides with the current two-dimensional code information, the fraud determination unit 505 cannot identify the illegal type information based on the type information pattern.

  However, when the fraud determination unit 505 further determines a fraudulent user terminal based on position information transmitted from a user terminal that has transmitted code information including type information that has not been identified as fraud, the fraud determination unit 505 uses a type information pattern. It is possible to identify an unauthorized user terminal that could not be identified based on the information. For example, the GPS information transmitted from the user terminal to which the fraud determination unit 505 has transmitted code information including type information that has not been identified as fraud is more than the GPS information corresponding to the location of the store that provided the two-dimensional code information. When it deviates more than the threshold value, the user terminal can be determined to be illegal. In this case, the fraud determination unit 505, for example, the GPS information indicating the location of the store stored in the data table in which the GPS information indicating the location of the store and the store identification information are associated, and the GPS transmitted from the user terminal An unauthorized user terminal may be specified by comparing the information.

  For example, the GPS information corresponding to the location of the store that provided the two-dimensional code information is longitude 139.766084 ° and latitude 35.681382 °, and the fraud determination unit 505 uses the GPS information transmitted from the user terminal as the location of the store. When the longitude or latitude is deviated by ± 0.05 ° or more from the GPS information indicating the user terminal, the user terminal is determined to be illegal. In this case, as shown in FIG. 12, the terminal identification information is 567 @ ne., Which transmits GPS information whose longitude and latitude are shifted by 0.05 ° or more from the GPS information corresponding to the store location. It is determined that the user terminal of jp is illegal. That is, the fraud determination unit 505 determines that the user terminal is illegal when the position of the user terminal that transmitted the code information is not within a predetermined area from the store.

  Further, fraud determination unit 505 determines a further fraudulent user terminal based on ID information of a beacon installed in a store that is transmitted from a user terminal that has transmitted code information including type information that has not been identified as fraud. In this case, the fraud determination unit 505 can identify an unauthorized user terminal based on a time-series pattern of beacon ID information stored in the information management database 603. The fraud determination unit 505 also includes the beacon ID information stored in the data table in which the ID information of the beacon installed in the store and the store identification information are associated, and the ID information of the beacon transmitted from the user terminal. May be used to identify an unauthorized user terminal.

  As described above, by using the position information in addition to the type information pattern, the fraud determination unit 505 can identify the incorrect type information based on the type information pattern along the time series. Furthermore, an unauthorized user terminal can be specified based on the position information of the user terminal.

(Modification 3)
In addition, the fraud determination unit 505 identifies fraudulent type information based on a time-series pattern of type information stored in the information management database 603, and then transmits it from a user terminal that has not been determined to be fraudulent. An unauthorized user terminal may be determined based on the time when the server apparatus 101 receives the code information. For example, the fraud determination unit 505 includes the store business hours information stored in the data table in which the store business hours information and the store identification information are associated with each other, and the time when the server apparatus 101 receives the code information from the user terminal 107. If the time when the code information is received is outside the business hours of the store or outside the certain time from the business hours, the user terminal that has transmitted the code information is determined to be illegal.

  As described above, by using the time information in addition to the type information pattern, the fraud determination unit 505 can identify the incorrect type information based on the type information pattern along the time series. Furthermore, an unauthorized user terminal can be specified based on the time when the code information is received from the user terminal.

(Modification 4)
In addition, the fraud determination unit 505 specifies code information including type information that has not been identified as fraud after identifying fraudulent type information based on a time-series pattern of type information stored in the information management database 603. It is also possible to perform two or more fraud determinations among the three user terminal fraud determinations using the terminal identification information, the position information, and the time information described in the first to third modifications. .

  In the first to third modifications described above, the fraud determination unit 505 specifies a code including type information that has not been identified as fraud after identifying fraudulent type information based on a time-series pattern of type information. Further fraud determination is performed on the user terminal that transmitted the information, that is, the user terminal that has not been determined to be illegal, using the terminal identification information, the position information, and the time information. However, it is possible to omit identification of illegal type information based on a time-series pattern of type information, and to identify all user terminals 107 that have transmitted code information to the server apparatus 101, terminal identification information, position information, and / or The fraud determination may be performed using the time information.

  For example, the fraud determination unit 505 may identify an unauthorized user terminal based on the terminal identification information of the user terminal for all the user terminals 107 that have transmitted the code information to the server apparatus 101. In this case, the server apparatus 101 may not classify the code information received from the user terminal 107 for each store identification information. Therefore, the classification unit 601 in the information storage unit 503 of the fraud determination function 400 can be omitted.

  Further, the fraud determination unit 505 may specify an unauthorized user terminal based on the position information of the user terminal for all the user terminals 107 that have transmitted the code information to the server apparatus 101. Further, the fraud determination unit 505 identifies an unauthorized user terminal based on the time when the server apparatus 101 receives the code information from the user terminal 107 for all the user terminals 107 that have transmitted the code information to the server apparatus 101. May be.

DESCRIPTION OF SYMBOLS 100 Service provision system 101 Server apparatus 103 Information processing system 105 Network 107 User terminal 301 Control part 303 Storage part 305 Communication part 400 Fraud determination function 501 Communication part 503 Information accumulation part 505 Fraud determination part 601 Classification part 603 Information management database 801 Control part 803 Storage unit 805 Communication unit 807 Display unit 809 Signal processing unit 811 Sound output unit 900 Fraud confirmation function 1001 Communication unit 1003 Fraud confirmation unit

Claims (12)

A communication unit that receives code information including the first information and the second information from the user terminal;
An information storage unit that classifies the received code information for each of the first information, and stores the second information and terminal identification information for identifying the user terminal that has transmitted the code information in time series in association with each other. When,
A fraud determination unit that identifies fraudulent second information based on a time-sequential pattern of the accumulated second information and determines that the user terminal of the terminal identification information corresponding to the fraudulent second information is fraudulent. When,
A server device comprising:   The fraud determination unit changes the time-series pattern of the accumulated second information when the second information changes and returns to the original second information within a predetermined number of times after the second information changes. The server device according to claim 1, wherein the second information is specified as illegal.   The fraud determination unit changes the time-series pattern of the accumulated second information when the second information changes and returns to the original second information within a predetermined time after the second information changes. 2. The server device according to claim 1, wherein the information is specified as illegal.   The fraud determination unit is a user terminal that has not been determined to be fraudulent based on the pattern along the time series of the second information, when the corresponding terminal identification information is accumulated more than a predetermined number of times in a predetermined period, The server device according to any one of claims 1 to 3, wherein a user terminal having terminal identification information accumulated more than the predetermined number of times is determined to be illegal. The communication unit receives third information from the user terminal,
The information storage unit stores the third information in time series in association with the second information and terminal identification information corresponding to the second information,
The fraud determination unit determines that a user terminal that satisfies the predetermined condition of the third information among the user terminals that are not determined to be fraud based on a pattern along the time series of the second information is fraudulent. Item 4. The server device according to any one of Items 1 to 3. The third information is GPS information indicating a current position of the user terminal,
When the position indicated by the GPS information is outside a predetermined area,
The server device according to claim 5, wherein the user terminal is determined to be illegal. The third information is ID information of a beacon received by the user terminal,
The fraud determination unit determines that the user terminal is illegal when the ID information of the beacon associated with the first information does not match the ID information of the beacon received from the user terminal. The server device described in 1.   The fraud determination unit includes the time when the communication unit receives the code information from the user terminal among the user terminals that are not determined to be fraud based on the time-series pattern of the second information. The server device according to any one of claims 1 to 3, wherein the user terminal is determined to be invalid if it is outside the time associated with the information. Receiving code information including the first information and the second information from the user terminal;
Classifying the received code information for each of the first information;
For each classification, the second information and terminal identification information for identifying the user terminal that transmitted the code information are associated with each other and accumulated in time series,
Identifying unauthorized second information based on a time-series pattern of the accumulated second information, and determining that the user terminal of the terminal identification information corresponding to the unauthorized second information is unauthorized.
Fraud determination method including Including a server device and a data processing device,
The server device
A first communication unit that receives code information including first information and second information from a user terminal;
An information storage unit that classifies the received code information for each of the first information, and stores the second information and terminal identification information for identifying the user terminal that has transmitted the code information in time series in association with each other. When,
A fraud determination unit that identifies fraudulent second information based on a time-sequential pattern of the accumulated second information and determines that the user terminal of the terminal identification information corresponding to the fraudulent second information is fraudulent. And comprising
The information storage unit sets a flag indicating fraud in association with the terminal identification information of the user terminal determined to be fraudulent, and a first notification indicating that the flag indicating fraud is set via the first communication unit Information and terminal identification information corresponding to the flag indicating fraud are transmitted to the data processing device,
A second communication unit configured to receive the first notification information and terminal identification information corresponding to the flag indicating fraud;
A fraud confirmation unit for notifying that the first notification information has been received and receiving an input of a fraud confirmation result indicating whether or not the user terminal corresponding to the received terminal identification information is fraudulent,
The fraud confirmation unit transmits second notification information based on the fraud confirmation result and terminal identification information of the user terminal to the server device via the second communication unit.
Service provision system. The first communication unit receives the second notification information and terminal identification information of the user terminal,
The service providing system according to claim 10, wherein the information storage unit changes a flag indicating fraud associated with terminal identification information of the user terminal based on the second notification information. On the computer,
Receiving code information including the first information and the second information from the user terminal;
Classifying the received code information for each of the first information;
For each classification, the second information and terminal identification information for identifying the user terminal that transmitted the code information are associated with each other and accumulated in time series,
Identifying unauthorized second information based on a time-series pattern of the accumulated second information, and determining that the user terminal of the terminal identification information corresponding to the unauthorized second information is unauthorized.
A program for running

Images