WO2022250188A1 - Système de détection de fraude basé sur une analyse de données de niveau bas et procédé associé - Google Patents

Système de détection de fraude basé sur une analyse de données de niveau bas et procédé associé Download PDF

Info

Publication number
WO2022250188A1
WO2022250188A1 PCT/KR2021/006699 KR2021006699W WO2022250188A1 WO 2022250188 A1 WO2022250188 A1 WO 2022250188A1 KR 2021006699 W KR2021006699 W KR 2021006699W WO 2022250188 A1 WO2022250188 A1 WO 2022250188A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
low
financial transaction
transaction
abnormal
Prior art date
Application number
PCT/KR2021/006699
Other languages
English (en)
Korean (ko)
Inventor
김성수
황희준
이명훈
김미희
Original Assignee
주식회사 유스비
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 주식회사 유스비 filed Critical 주식회사 유스비
Priority to PCT/KR2021/006699 priority Critical patent/WO2022250188A1/fr
Publication of WO2022250188A1 publication Critical patent/WO2022250188A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/04—Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem"
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/02—Payment architectures, schemes or protocols involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/02—Banking, e.g. interest calculation or account maintenance

Definitions

  • the present invention analyzes financial transaction-related data related to customer media environment information, financial transaction type information, etc. of customers conducting financial transactions at a low level by artificial intelligence to effectively detect abnormal financial transactions.
  • Abnormal finance based on low-level data analysis It relates to a Fraud Detection System (FDS) and its method.
  • FDS Fraud Detection System
  • Fraud Detection System is a security method that collects various information from the payer to create a pattern, then catches the pattern and other abnormal payments and blocks the payment route. It is characterized by active security intervention based on big data. FDS consists of information collection function, analysis and detection function, response function, monitoring and audit function, and is attracting attention as an essential security method at a time when fintech becomes important.
  • the conventional FDS method has a problem in that hackers, voice phishing criminals, and money laundering criminals using cryptocurrency can easily manipulate financial transaction-related data to incapacitate the FDS service.
  • the present invention is an abnormal financial transaction based on low-level data analysis that can effectively detect abnormal financial transactions and automate them with artificial intelligence by analyzing user media environment information, financial transaction type information, etc. of customers conducting financial transactions at a low level. It is to provide a detection system (FDS) and method thereof.
  • FDS detection system
  • the present invention is to provide an abnormal financial transaction detection service based on low-level data analysis suitable for a customer's transaction type by determining a low-level type most suitable for detecting an abnormal financial transaction according to a customer's transaction type.
  • An abnormal financial transaction detection system based on low-level data analysis includes: a data collection unit configured to collect financial transaction-related data related to customer user media environment information and financial transaction type information; a low-level data converter configured to convert the collected data related to financial transactions into low-level data; a low-level data analysis unit configured to analyze the low-level data by an artificial intelligence model; and an abnormal transaction determining unit configured to detect an abnormal transaction based on a low-level analysis result of the artificial intelligence model.
  • the low-level data may include at least one of assembly language, machine language (hex code data, binary code data, etc.) ASCII data, and EBCO data.
  • the low-level data conversion unit includes: a customer transaction type analysis unit configured to analyze a transaction type of the customer based on the financial transaction related data; a low-level type determination unit configured to determine one of a plurality of low-level types including assembly language, hexacode, binary code, ASCII, and EBCO according to the transaction type of the customer; and a low-level conversion unit configured to convert the financial transaction-related data into low-level data corresponding to the low-level type.
  • the low-level data converter includes: a hexacode converter configured to convert the financial transaction-related data into hexacode data; a binary code converter configured to convert the financial transaction-related data into binary code data; an ASCII conversion unit configured to convert the financial transaction-related data into ASCII data; an EBCO conversion unit configured to convert the financial transaction-related data into EBCO data; and an assembly language conversion unit configured to convert the financial transaction related data into assembly language data.
  • the low-level data analysis unit includes: a hexacode-based FDS analysis unit configured to predict a first or more financial transaction probability by extracting features related to an abnormal financial transaction by a hexacode-based artificial intelligence model based on the hexacode data; a binary code-based FDS analyzer configured to predict a second abnormal financial transaction probability by extracting features related to an abnormal financial transaction by a binary code-based artificial intelligence model based on the binary code data; an ASCII-based FDS analysis unit configured to predict a third abnormal financial transaction probability by extracting features related to an abnormal financial transaction by an ASCII-based artificial intelligence model based on the ASCII data; an EBCO-based FDS analyzer configured to predict a fourth abnormal financial transaction probability by extracting features related to an abnormal financial transaction by an EBCO-based artificial intelligence model based on the EBCO data; and an assembly language-based FDS analyzer configured to predict a fifth or higher probability of financial transactions by extracting features related to abnormal financial transactions by an assembly language-based artificial intelligence model
  • the abnormal transaction determining unit may include: a customer transaction type analysis unit configured to analyze a transaction type of the customer based on the financial transaction related data; a weight setting unit configured to set weights of assembly language, machine language (hexadecimal code, binary code, etc.), ASCII, and EBCO according to the transaction type of the customer; and applying the weights to the first or higher financial transaction probability, the second or higher financial transaction probability, the third or higher financial transaction probability, the fourth or higher financial transaction probability, and the fifth or higher financial transaction probability to determine the abnormal transaction.
  • An abnormal transaction determination unit configured to detect may include.
  • An abnormal financial transaction detection method based on low-level data analysis includes: collecting, by a data collection unit, financial transaction-related data related to user media environment information and financial transaction type information of a customer; converting the collected financial transaction-related data into low-level data by a low-level data conversion unit; analyzing the low-level data using an artificial intelligence model by a low-level data analysis unit; and detecting, by an abnormal transaction determination unit, an abnormal transaction based on a low-level analysis result of the artificial intelligence model.
  • the converting the low-level data into low-level data may include: analyzing, by a customer transaction type analyzer, a transaction type of the customer based on the financial transaction related data; Determining, by the low-level type determining unit, one of a plurality of low-level types including assembly language, machine language (Hex code, binary code, etc.), ASCII, and EBCO, according to the transaction type of the customer. step; and converting the financial transaction-related data into low-level data corresponding to the low-level type by a low-level conversion unit.
  • the converting of the low-level data into low-level data may include: converting the financial transaction-related data into hexacode data by a hexacode converter; converting the financial transaction-related data into binary code data by a binary code conversion unit; converting the financial transaction-related data into ASCII data by an ASCII conversion unit; converting the financial transaction-related data into EBCO data by an EBCO conversion unit; and converting the financial transaction-related data into assembly language data by an assembly language conversion unit.
  • the step of analyzing the low-level data extracting features related to abnormal financial transactions by a hexacode-based artificial intelligence model based on the hexacode-based FDS analysis unit based on the hexacode data to obtain a first or higher probability of financial transactions predicting; Predicting a probability of a second or more financial transaction by extracting features related to an abnormal financial transaction by a binary code-based artificial intelligence model based on the binary code data by a binary code-based FDS analysis unit; Predicting a third abnormal financial transaction probability by an ASCII-based FDS analysis unit by extracting features related to an abnormal financial transaction by an ASCII-based artificial intelligence model based on the ASCII data; predicting a fourth abnormal financial transaction probability by extracting features related to abnormal financial transactions by an EBCO-based artificial intelligence model based on the EBCO data by an EBCO-based FDS analysis unit; and extracting features related to abnormal financial transactions by an assembly language-based FDS analysis unit based on the assembly language data based on an assembly language-
  • the detecting of the abnormal transaction may include: analyzing, by a customer transaction type analyzer, a transaction type of the customer based on the financial transaction related data; setting, by a weight setting unit, weights of assembly language, machine language (Hex code, binary code, etc.), ASCII, and EBCO according to the transaction type of the customer; and the abnormal transaction determination unit determines the first or higher probability of financial transaction, the second or higher probability of financial transaction, the third or higher probability of financial transaction, the fourth or higher probability of financial transaction, and the fifth or higher probability of financial transaction. It may include; detecting an abnormal transaction by applying weights.
  • An abnormal financial transaction detection method based on low-level data analysis further includes: analyzing the transaction type of the customer based on the financial transaction-related data by a customer transaction type analyzer; , The step of analyzing the low-level data may include: extracting a plurality of code regions from the low-level data according to the transaction type of the customer; and analyzing the low-level data by setting a weight for each code region according to the transaction type of the customer.
  • a computer program recorded on a computer-readable recording medium is provided to execute the low-level data analysis-based abnormal financial transaction detection method.
  • financial transaction-related data related to user media environment information and financial transaction type information of customers conducting financial transactions are analyzed at a low level using artificial intelligence to effectively detect abnormal financial transactions and to artificially detect them.
  • An abnormal financial transaction detection system and method based on low-level data analysis that can be automated with intelligence are provided.
  • an abnormal financial transaction detection service based on low-level data analysis suitable for the customer's transaction type by determining the most suitable low-level type for detecting abnormal financial transactions according to the customer's transaction type. have.
  • FIG. 1 is a block diagram of an abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention.
  • FIG. 2 is a block diagram of a low-level data converter constituting an abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention.
  • 3 and 4 are exemplary diagrams illustrating that financial transaction-related data is converted into low-level data according to an embodiment of the present invention.
  • FIG. 5 is a block diagram of a low-level data converter constituting an abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention.
  • FIG. 6 is a block diagram showing a low-level data analysis unit, an artificial intelligence model, and an abnormal transaction decision unit constituting an abnormal financial transaction detection system based on low-level data analysis according to another embodiment of the present invention.
  • FIG. 7 is a flowchart of an abnormal financial transaction detection method based on low-level data analysis according to an embodiment of the present invention.
  • step S130 of FIG. 7 is a flowchart illustrating step S130 of FIG. 7 .
  • FIG. 9 is a flowchart illustrating steps S140 and S150 of FIG. 7 .
  • ' ⁇ unit' used in this specification is a unit that processes at least one function or operation, and may mean, for example, software, an FPGA, or a hardware component. Functions provided by ' ⁇ unit' may be performed separately by a plurality of components or may be integrated with other additional components.
  • ' ⁇ unit' in this specification is not necessarily limited to software or hardware, and may be configured to be in an addressable storage medium or configured to reproduce one or more processors.
  • embodiments of the present invention will be described in detail with reference to the drawings.
  • An abnormal financial transaction detection system based on low-level data analysis converts financial transaction-related data related to customer user media environment information and financial transaction type information into low-level data representing one-dimensional information. data), and analyze the low-level data by an artificial intelligence model to detect abnormal transactions.
  • an abnormal financial transaction detection system 100 based on low-level data analysis may include a data collection unit 200 and an abnormal financial transaction detection unit 300 .
  • the data collection unit 200 may be configured to collect financial transaction-related data related to customer user media environment information and financial transaction type information from a customer terminal (not shown).
  • the customer terminal is a terminal used by a customer, and may be, for example, a terminal used by a fintech company, a blockchain exchange, a bank, a securities company, an insurance company, various other financial institutions, or individual customers.
  • User media environment information includes, for example, hardware-related information such as Internet/smartphone/PDA/VM banking (eg, device model name, CPU information, HDD information, MAC information, etc.), application-related information (eg, OS version information, browser information, manufacturer information, security program information, software use information, etc.), network-related information (eg, IP information, VPN information, proxy IP information, connection network information, etc.).
  • hardware-related information such as Internet/smartphone/PDA/VM banking (eg, device model name, CPU information, HDD information, MAC information, etc.)
  • application-related information eg, OS version information, browser information, manufacturer information, security program information, software use information, etc.
  • network-related information eg, IP information, VPN information, proxy IP information, connection network information, etc.
  • the financial transaction type information may include, for example, transaction-related information such as a transaction pattern or transaction tendency, such as a customer's transfer amount, account, time, and access.
  • Data related to financial transactions of customers collected from customer terminals are, for example, application services of fintech companies, e-wallet opening of blockchain exchanges, online banking account opening of banks, securities trading app account opening of securities companies, and online information related to insurance companies. Data for various financial transaction services such as insurance application may be included.
  • the data collection unit 200 may include an input device and/or a receiving device receiving data from a customer terminal.
  • the customer's financial transaction-related data collected by the data collection unit 200 may be transmitted to the abnormal financial transaction detection unit 300 .
  • the abnormal financial transaction detection unit 300 includes a low-level data conversion unit 310, a low-level data analysis unit 320, an artificial intelligence model 330, an abnormal transaction determination unit 340, and an artificial intelligence learning unit 350. can include
  • the low-level data conversion unit 310 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into low-level data.
  • the low-level data conversion unit 310 may convert customer financial transaction-related data into low-level data by, for example, web forensics.
  • the customer's financial transaction-related data is converted into assembly language, machine language (hexacode data, binary code data, etc.), ASCII by the low-level data conversion unit 310 data, and low-level data including at least one of EBCO data.
  • the low-level data conversion unit 310 includes a hexadecimal code conversion unit 312, a binary code conversion unit 314, an ASCII conversion unit 316, an EBCO conversion unit 318, and an assembly language A conversion unit 319 may be included.
  • the hexacode conversion unit 312 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into hexadecimal code data corresponding to a hexadecimal hexadecimal code type.
  • the binary code conversion unit 314 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into binary code data corresponding to a binary code type.
  • the ASCII conversion unit 316 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into ASCII data corresponding to an ASCII code type.
  • the EBCO conversion unit 318 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into EBCO data corresponding to an EBCO code type.
  • the assembly language conversion unit 319 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into assembly language data corresponding to an assembly language code type.
  • 3 and 4 are exemplary diagrams illustrating that financial transaction-related data is converted into low-level data according to an embodiment of the present invention.
  • 3 shows an example of hexacode data
  • FIG. 4 shows an example of binary code data.
  • the artificial intelligence model 330 extracts patterns (10, 20, 30) (40, 50, 60) of a specific area from low-level data, and extracts the extracted patterns (10, 20, 30) (40, 50, 60) can be learned to detect abnormal financial transactions by analyzing the rules.
  • the low-level data analysis unit 320 will be configured to analyze the low-level data converted by the low-level data conversion unit 310 using the artificial intelligence model 330 learned by the artificial intelligence learning unit 350.
  • the artificial intelligence learning unit 350 may learn an artificial intelligence model by converting generally collected customer transaction data into low-level data and extracting features corresponding to patterns of the low-level data.
  • the features learned by the artificial intelligence learning unit 350 include transaction type information such as internet/smart phone/PDA/VM banking related to the transaction data requested by the customer, IP address of the customer terminal, VPN information, proxy IP information, connection network Network information such as information, device information of the customer terminal (device model name, CPU information, HDD information, device type such as MAC information), OS version, browser, manufacturer, security program, application information such as software use, location of the customer terminal Information (Korea, North Korea, China, Russia, etc.), Internet access protocol (TCPIP, UDP, etc.), transaction time, connection maintenance time, transfer amount, transaction pattern/tendency information such as account information, etc. may be included.
  • transaction type information such as internet/smart phone/PDA/VM banking related to the transaction data requested by the customer, IP address of the customer terminal, VPN information, proxy IP information, connection network Network information such as information, device information of the customer terminal (device model name, CPU information, HDD information, device type such as MAC information), OS version, browser, manufacturer, security program
  • the abnormal transaction determination unit 340 may be configured to detect abnormal transactions based on the low-level analysis result of the low-level data analysis unit 320 using the artificial intelligence model 330 .
  • Low-level data is not easy to manipulate to avoid FDS even for hackers with high hacking ability, and when manipulated by a hacker, its inherent characteristics are changed, so it is possible to determine whether or not it has been manipulated.
  • abnormal financial transactions are effectively detected by analyzing user media environment information, financial transaction type information, etc. of customers conducting financial transactions at a low level, and it can be automated with artificial intelligence. .
  • an alarm may be generated to a person in charge of a task related to preventing an abnormal financial transaction.
  • the low-level data conversion unit 310 may include a customer transaction type analysis unit 310a, a low-level type determination unit 310b, and a low-level conversion unit 310c.
  • the customer transaction type analysis unit 310a may be configured to analyze the transaction type of the corresponding customer based on the customer's financial transaction-related data collected by the data collection unit 200 .
  • the customer's transaction type is the transaction request amount, transaction target, type of customer terminal, region (country), and institution to which the customer belongs (fintech company, blockchain exchange, bank, securities company, insurance company, other financial institutions or individual customers) , Internet access protocol type, transaction time type, connection maintenance time type, etc. can be set and classified in various ways.
  • the low-level type determination unit 310b determines a plurality of rows including assembly language, machine language (hexacode, binary code, etc.), ASCII and EBCO according to the customer's specific transaction type analyzed by the customer transaction type analysis unit 310a. It can be configured to determine the low level type of any one of the level types.
  • the low-level type determining unit 310b may learn a low-level type showing the best FDS performance for each transaction type of the customer, and then determine a low-level type that is most suitable for the FDS according to the transaction type of the customer.
  • the low-level conversion unit 310c may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into low-level data corresponding to the low-level type determined by the low-level type determination unit 310b.
  • the FDS service suitable for the customer's transaction type can be provided by determining the low-level type most suitable for the FDS according to the customer's transaction type and converting the customer's financial transaction-related data into the corresponding low-level type.
  • FIG. 6 is a block diagram showing a low-level data analysis unit, an artificial intelligence model, and an abnormal transaction decision unit constituting an abnormal financial transaction detection system based on low-level data analysis according to another embodiment of the present invention.
  • the low-level data analysis unit 320 includes a hexacode-based FDS analysis unit 322, a binary code-based FDS analysis unit 324, an ASCII-based FDS analysis unit 326, A BCO-based FDS analysis unit 328 and an assembly language-based FDS analysis unit 329 may be included.
  • the hexacode-based FDS analysis unit 322 extracts features related to abnormal financial transactions by the hexacode-based artificial intelligence model 332 based on the hexacode data converted by the hexacode conversion unit 312 to obtain the first or higher It can be configured to predict the probability of a financial transaction.
  • the binary code-based FDS analysis unit 324 extracts features related to the abnormal financial transaction by the binary code-based artificial intelligence model 334 based on the binary code data converted by the binary code conversion unit 314, and second or higher It can be configured to predict the probability of a financial transaction.
  • the ASCII-based FDS analysis unit 326 extracts features related to the abnormal financial transaction by the ASCII-based artificial intelligence model 336 based on the ASCII data converted by the ASCII conversion unit 316 to determine the probability of the third abnormal financial transaction. It can be configured to predict.
  • the EBCO-based FDS analysis unit 328 extracts features related to abnormal financial transactions by the EBCO-based artificial intelligence model 338 based on the EBCO data converted by the EBCO conversion unit 318 to determine the fourth or higher probability of financial transactions It can be configured to predict.
  • the assembly language-based FDS analysis unit 329 extracts features related to abnormal financial transactions by the assembly language-based artificial intelligence model 339 based on the assembly language data converted by the assembly language conversion unit 319, and calculates a fifth or higher probability of financial transactions. It can be configured to predict.
  • the abnormal transaction determining unit 340 may include a customer transaction type analyzing unit 342 , a weight setting unit 344 , and an abnormal transaction determining unit 346 .
  • the customer transaction type analyzer 342 analyzes the customer's transaction type based on the customer's financial transaction-related data collected by the data collection unit 200. can be configured to
  • the weight setting unit 344 may be configured to set weights of assembly language, hexacode, binary code, ASCII, and EBCO according to the transaction type of the customer analyzed by the customer transaction type analysis unit 342 .
  • the abnormal transaction determination unit 346 may be configured to detect abnormal transactions by applying the weights set by the weight setting unit 344 to the probability of a plurality of abnormal financial transactions predicted for each of various low-level types.
  • the abnormal transaction determination unit 346 determines the probability of the first abnormal financial transaction predicted by the hexacode-based FDS analysis unit 322 and the second abnormal financial transaction predicted by the binary code-based FDS analysis unit 324 probability, the third or higher financial transaction probability predicted by the ASCII-based FDS analysis unit 326, the fourth or higher financial transaction probability predicted by the EBCO-based FDS analysis unit 328, and the assembly language-based FDS analysis unit 329
  • Abnormal transactions may be detected by applying the weights set by the weight setting unit 344 to the probability of the fifth abnormal financial transaction predicted by the above.
  • FDS services suitable for the customer's transaction type can be provided by combining FDS analysis results of various low-level types by setting and applying weights of various low-level types according to the customer's transaction type. have.
  • the low-level data analysis unit 320 extracts a plurality of code areas from each low-level data for each of various low-level types, and the customer's transaction type analysis unit 342 analyzes An abnormal financial transaction may be detected by setting a weight for each code area according to the transaction type by a weight setting unit.
  • a plurality of code regions extracted from each low-level data may be different for each low-level type.
  • a plurality of code areas extracted from each low-level data and a weight (relationship with ideal financial transaction) of each code area may be determined or set by a learned artificial intelligence model, or may be selected or input by an expert.
  • the hexacode-based FDS analysis unit 322 extracts first code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the hexacode data, and assigns a weight set to each of the first code areas. It can be applied to detect abnormal financial transactions.
  • the first code areas selected from the hexacode data may be changed according to the customer's transaction type, and the weights of the first code areas may also be set differently according to the customer's transaction type.
  • the binary code-based FDS analysis unit 324 extracts second code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the binary code data, and assigns a weight set to each of the second code areas. It can be applied to detect abnormal financial transactions.
  • the second code areas selected from the binary code data may be changed according to the customer's transaction type, and the weights of the second code areas may also be set differently according to the customer's transaction type.
  • the ASCII-based FDS analysis unit 326 extracts third code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the ASCII data, and applies a weight set to each of the third code areas. Abnormal financial transactions can be detected.
  • the third code regions selected from the ASCII data may be changed according to the customer's transaction type, and the weights of the third code regions may also be set differently according to the customer's transaction type.
  • the EBCO-based FDS analysis unit 328 extracts fourth code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the EBCO data, and applies a set weight to each of the fourth code areas to obtain Abnormal financial transactions can be detected.
  • the fourth code areas selected from the EBCO data may be changed according to the customer's transaction type, and the weights of the fourth code areas may also be set differently according to the customer's transaction type.
  • the assembly language-based FDS analysis unit 329 extracts fifth code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the assembly language data, and applies a set weight to each of the fifth code areas. Abnormal financial transactions can be detected.
  • the fifth code regions selected from the assembly language data may be changed according to the customer's transaction type, and the weights of the fifth code regions may also be set differently according to the customer's transaction type.
  • the FDS artificial intelligence model can be learned using general transaction data (learning data) (S110).
  • the artificial intelligence learning unit 350 may learn an artificial intelligence model by converting generally collected customer transaction data into low-level data and extracting features corresponding to patterns of the low-level data.
  • the features learned by the artificial intelligence learning unit 350 include transaction type information such as internet/smart phone/PDA/VM banking related to the transaction data requested by the customer, IP address of the customer terminal, VPN information, proxy IP information, connection network Network information such as information, device information of the customer terminal (device model name, CPU information, HDD information, device type such as MAC information), OS version, browser, manufacturer, security program, application information such as software use, location of the customer terminal Information (Korea, North Korea, China, Russia, etc.), Internet access protocol (TCPIP, UDP, etc.), transaction time, connection maintenance time, transfer amount, transaction pattern/tendency information such as account information, etc. may be included.
  • transaction type information such as internet/smart phone/PDA/VM banking related to the transaction data requested by the customer, IP address of the customer terminal, VPN information, proxy IP information, connection network Network information such as information, device information of the customer terminal (device model name, CPU information, HDD information, device type such as MAC information), OS version, browser, manufacturer, security program
  • the data collection unit 200 provides financial transaction-related data requested by the customer from the customer terminal (eg, fintech company app service, blockchain exchange e-wallet opening, bank online banking account opening, securities company stock trading app account). data) may be collected (S120).
  • financial transaction-related data eg, fintech company app service, blockchain exchange e-wallet opening, bank online banking account opening, securities company stock trading app account. data
  • User media environment information includes, for example, hardware-related information such as Internet/smartphone/PDA/VM banking (eg, device model name, CPU information, HDD information, MAC information, etc.), application-related information (eg, OS version information, browser information, manufacturer information, security program information, software use information, etc.), network-related information (eg, IP information, VPN information, proxy IP information, connection network information, etc.).
  • hardware-related information such as Internet/smartphone/PDA/VM banking (eg, device model name, CPU information, HDD information, MAC information, etc.)
  • application-related information eg, OS version information, browser information, manufacturer information, security program information, software use information, etc.
  • network-related information eg, IP information, VPN information, proxy IP information, connection network information, etc.
  • the financial transaction type information may include, for example, transaction-related information such as a transaction pattern or transaction tendency, such as a customer's transfer amount, account, time, and access.
  • the low-level data conversion unit 310 may convert the customer's financial transaction-related data collected by the data collection unit 200 into low-level data (S130).
  • the low-level data conversion unit 310 may convert customer financial transaction-related data into low-level data by, for example, web forensics.
  • the customer's financial transaction-related data by the low-level data conversion unit 310 includes at least one of assembly language, machine language (hexadecimal code data, binary code data, etc.), ASCII data, and EBCO data. It can be converted into low-level data.
  • the low-level data analysis unit 320 may analyze the low-level data converted by the low-level data conversion unit 310 using the artificial intelligence model 330 learned by the artificial intelligence learning unit 350. (S140).
  • the abnormal transaction determination unit 340 may detect an abnormal transaction based on the low-level analysis result analyzed by the low-level data analysis unit 320 using the artificial intelligence model 330 (S150).
  • Low-level data is not easy to manipulate to avoid FDS even for hackers with high hacking ability, and when manipulated by a hacker, its inherent characteristics are changed, so it is possible to determine whether or not it has been manipulated.
  • abnormal financial transactions are effectively detected by analyzing user media environment information, financial transaction type information, etc. of customers conducting financial transactions at a low level, and it can be automated with artificial intelligence. .
  • an alarm may be generated to a person in charge of a task related to preventing an abnormal financial transaction.
  • step S130 of FIG. 7 is a flowchart illustrating step S130 of FIG. 7 .
  • the customer transaction type analyzer 310a analyzes the customer's transaction type based on the customer's financial transaction-related data collected by the data collection unit 200. It can (S132).
  • the customer's transaction type is the transaction request amount, transaction target, type of customer terminal, region (country), customer's institution (fintech companies, blockchain exchanges, banks, securities companies, insurance companies, etc. Customer), Internet access protocol type, transaction time type, connection maintenance time type, etc.
  • the low-level type determination unit 310b determines the customer's transaction type analyzed by the customer transaction type analysis unit 310a, assembly language, machine language (Hex code, binary code, etc.), a plurality of low-level including ASCII and EBCO. One of the low-level types may be determined (S134).
  • the low-level conversion unit 310c may convert the customer's financial transaction-related data collected by the data collection unit 200 into low-level data corresponding to the low-level type determined by the low-level type determination unit 310b. (S136).
  • an FDS service suitable for the customer's transaction type can be provided by determining the low-level type most suitable for the FDS according to the customer's transaction type and converting the customer's financial transaction-related data into the corresponding low-level type.
  • the low-level data analyzer 320 may analyze low-level data according to various low-level types (S142).
  • the hexacode-based FDS analysis unit 322 extracts features related to abnormal financial transactions by the hexacode-based artificial intelligence model 332 based on the hexacode data converted by the hexacode converter 312 Thus, the first or higher financial transaction probability may be predicted.
  • the binary code-based FDS analysis unit 324 extracts features related to abnormal financial transactions by the binary code-based artificial intelligence model 334 based on the binary code data converted by the binary code conversion unit 314. Thus, the probability of the second or higher financial transaction may be predicted.
  • the ASCII-based FDS analysis unit 326 extracts features related to the abnormal financial transaction by the ASCII-based artificial intelligence model 336 based on the ASCII data converted by the ASCII conversion unit 316, and third or higher You can predict the probability of a financial transaction.
  • the EBCO-based FDS analysis unit 328 extracts features related to abnormal financial transactions by the EBCO-based artificial intelligence model 338 based on the EBCO data converted by the EBCO conversion unit 318 to obtain a fourth or higher You can predict the probability of a financial transaction.
  • the assembly language-based FDS analysis unit 329 extracts features related to abnormal financial transactions by the assembly language-based artificial intelligence model 339 based on the assembly language data converted by the assembly language conversion unit 319, You can predict the probability of a financial transaction.
  • the customer transaction type analysis unit 342 may analyze the transaction type of the customer requesting the financial transaction based on the customer's financial transaction-related data collected by the data collection unit 200 (S144).
  • the weight setting unit 344 may set the weights of assembly language, machine language (Hex code, binary code, etc.), ASCII, and EBCO according to the transaction type of the customer analyzed by the customer transaction type analysis unit 342 (S152).
  • the abnormal transaction determination unit 346 determines the probability of the first or more financial transactions predicted by the hexacode-based FDS analysis unit 322, the probability of the second or more financial transactions predicted by the binary code-based FDS analysis unit 324, and the ASCII-based The third or more financial transaction probability predicted by the FDS analysis unit 326, the fourth or more financial transaction probability predicted by the EBCO-based FDS analysis unit 328, and the second prediction by the assembly language-based FDS analysis unit 329 Abnormal transactions may be detected by applying the weights set by the weight setting unit 344 to the probability of 5 or more financial transactions (S154).
  • FDS services suitable for the customer's transaction type can be provided by combining FDS analysis results of various low-level types by setting and applying weights of various low-level types according to the customer's transaction type. have.
  • the embodiments described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components.
  • the devices, methods and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate (FPGA) array), programmable logic units (PLUs), microprocessors, or any other device capable of executing and responding to instructions.
  • ALU arithmetic logic unit
  • FPGA field programmable gate
  • PLUs programmable logic units
  • microprocessors or any other device capable of executing and responding to instructions.
  • a processing device may run an operating system and one or more software applications running on the operating system.
  • a processing device may also access, store, manipulate, process, and generate data in response to execution of software.
  • a processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It will be understood that it can include
  • a processing device may include a plurality of processors or a processor and a controller. Also, other processing configurations are possible, such as a parallel processor.
  • Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. You can command the device.
  • Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.
  • the method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium.
  • Computer readable media may include program instructions, data files, data structures, etc. alone or in combination.
  • Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software.
  • Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CDROMs and DVDs, and ROMs, RAMs, and flash memories.
  • the hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Finance (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Software Systems (AREA)
  • Human Resources & Organizations (AREA)
  • Development Economics (AREA)
  • Computer Security & Cryptography (AREA)
  • Game Theory and Decision Science (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Operations Research (AREA)
  • Quality & Reliability (AREA)
  • Tourism & Hospitality (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Medical Informatics (AREA)
  • Technology Law (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mathematical Physics (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

Sont divulgués un système de détection de fraude basé sur une analyse de données de niveau bas et un procédé associé. Le système utilise l'intelligence artificielle pour analyser, à un niveau bas, des données relatives à une transaction financière et associées à des informations sur l'environnement du support de l'utilisateur et à des informations sur le type de transaction financière relatives à un client effectuant une transaction financière, ce qui détecte efficacement une transaction financière anormale et automatise la détection par l'intermédiaire de l'intelligence artificielle. Selon un mode de réalisation de la présente invention, un système de détection de fraude basé sur une analyse de données de niveau bas comprend : une unité de collecte de données conçue pour collecter des données relatives à une transaction financière et associées aux informations sur l'environnement du support de l'utilisateur et aux informations sur le type de transaction financière relatives à un client ; une unité de conversion de données de niveau bas conçue pour convertir les données relatives à la transaction financière collectées en données de niveau bas ; une unité d'analyse de données de niveau bas conçue pour analyser les données de niveau bas au moyen d'un modèle d'intelligence artificielle ; et une unité de détermination de transaction anormale conçue pour détecter une transaction anormale sur la base du résultat de l'analyse des données de niveau bas obtenu au moyen du modèle d'intelligence artificielle.
PCT/KR2021/006699 2021-05-28 2021-05-28 Système de détection de fraude basé sur une analyse de données de niveau bas et procédé associé WO2022250188A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/KR2021/006699 WO2022250188A1 (fr) 2021-05-28 2021-05-28 Système de détection de fraude basé sur une analyse de données de niveau bas et procédé associé

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/KR2021/006699 WO2022250188A1 (fr) 2021-05-28 2021-05-28 Système de détection de fraude basé sur une analyse de données de niveau bas et procédé associé

Publications (1)

Publication Number Publication Date
WO2022250188A1 true WO2022250188A1 (fr) 2022-12-01

Family

ID=84229931

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2021/006699 WO2022250188A1 (fr) 2021-05-28 2021-05-28 Système de détection de fraude basé sur une analyse de données de niveau bas et procédé associé

Country Status (1)

Country Link
WO (1) WO2022250188A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115729796A (zh) * 2022-12-23 2023-03-03 许伟 基于人工智能的异常操作分析方法及大数据应用系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2309465A1 (fr) * 2002-02-28 2011-04-13 Mastercard Europe SPRL Agencement d'authentification et procédé pour son utilisation avec des transactions financières
US20110251892A1 (en) * 2010-04-09 2011-10-13 Kevin Laracey Mobile Phone Payment Processing Methods and Systems
KR20120021120A (ko) * 2010-08-31 2012-03-08 주식회사 비즈모델라인 휘발성 데이터가 엔코딩된 전자적 코드 이미지를 통해 카드 거래를 처리하는 시스템과 이를 위한 단말장치
KR20160013733A (ko) * 2014-07-28 2016-02-05 주식회사 예티소프트 이상 금융거래의 실시간 탐지 시스템 및 방법
US20200145400A1 (en) * 2015-01-05 2020-05-07 GiveGab System and method for detecting malicious payment transaction activity using aggregate views of payment transaction data in a distributed network environment

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2309465A1 (fr) * 2002-02-28 2011-04-13 Mastercard Europe SPRL Agencement d'authentification et procédé pour son utilisation avec des transactions financières
US20110251892A1 (en) * 2010-04-09 2011-10-13 Kevin Laracey Mobile Phone Payment Processing Methods and Systems
KR20120021120A (ko) * 2010-08-31 2012-03-08 주식회사 비즈모델라인 휘발성 데이터가 엔코딩된 전자적 코드 이미지를 통해 카드 거래를 처리하는 시스템과 이를 위한 단말장치
KR20160013733A (ko) * 2014-07-28 2016-02-05 주식회사 예티소프트 이상 금융거래의 실시간 탐지 시스템 및 방법
US20200145400A1 (en) * 2015-01-05 2020-05-07 GiveGab System and method for detecting malicious payment transaction activity using aggregate views of payment transaction data in a distributed network environment

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115729796A (zh) * 2022-12-23 2023-03-03 许伟 基于人工智能的异常操作分析方法及大数据应用系统
CN115729796B (zh) * 2022-12-23 2023-10-10 中软国际科技服务有限公司 基于人工智能的异常操作分析方法及大数据应用系统

Similar Documents

Publication Publication Date Title
WO2020162680A1 (fr) Système et procédé de microservice
CN110120948B (zh) 基于无线和有线数据流相似性分析的非法外联监测方法
US20060198313A1 (en) Method and device for detecting and blocking unauthorized access
CN111107096A (zh) 一种Web站点安全防护方法及装置
WO2017155292A1 (fr) Procédé de détection d'anomalie et programme de détection d'anomalie
CN114584405A (zh) 一种电力终端安全防护方法及系统
WO2019160195A1 (fr) Appareil et procédé de détection de menaces malveillantes contenues dans un fichier, et support d'enregistrement associé
WO2022250188A1 (fr) Système de détection de fraude basé sur une analyse de données de niveau bas et procédé associé
CN105743880A (zh) 一种数据分析系统
CN112632535B (zh) 攻击检测方法、装置、电子设备及存储介质
CN111049828B (zh) 网络攻击检测及响应方法及系统
Rapaka et al. Intrusion detection using radial basis function network on sequences of system calls
Ghanshala et al. BNID: a behavior-based network intrusion detection at network-layer in cloud environment
WO2019066099A1 (fr) Système de détection de comportement anormal sur la base d'un modèle d'analyse intégré, et procédé associé
CN108920958A (zh) 检测pe文件异常行为的方法、装置、介质及设备
Jaber et al. Methods for preventing distributed denial of service attacks in cloud computing
Ponnusamy et al. Investigation on iot intrusion detection in wireless environment
KR20220160998A (ko) 로우레벨 데이터 분석 기반의 이상 금융거래 탐지 시스템 및 그 방법
KR100501210B1 (ko) 보안 게이트웨이의 커널 기반 고속 침입탐지 시스템 및 그방법
EP3964987A1 (fr) Dispositif d'apprentissage, dispositif de détermination, procédé d'apprentissage, procédé de détermination, programme d'apprentissage, et programme de détermination
WO2022065992A1 (fr) Procédé d'extraction d'un réseau de neurones artificiel à l'aide d'une vulnérabilité par fusion
WO2024106860A1 (fr) Procédé et système de détection de contenu web anormal basé sur une analyse de caractéristique de liens
WO2022211301A1 (fr) Procédé et système de détection d'un comportement anormal sur la base d'un ensemble d'auto-codeur
WO2022216142A1 (fr) Procédé et système pour sécuriser des modèles de réseau neuronal
CN116260605A (zh) 一种配电主站主机微隔离自动生成方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21943177

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE