CN106340138A - Transaction behavior detection method and device - Google Patents
Transaction behavior detection method and device Download PDFInfo
- Publication number
- CN106340138A CN106340138A CN201610705443.XA CN201610705443A CN106340138A CN 106340138 A CN106340138 A CN 106340138A CN 201610705443 A CN201610705443 A CN 201610705443A CN 106340138 A CN106340138 A CN 106340138A
- Authority
- CN
- China
- Prior art keywords
- feature vectors
- sampling feature
- service equipment
- behavior
- financial self
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F19/00—Complete banking systems; Coded card-freed arrangements adapted for dispensing or receiving monies or the like and posting such transactions to existing accounts, e.g. automatic teller machines
- G07F19/20—Automatic teller machines [ATMs]
- G07F19/207—Surveillance aspects at ATMs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
- G06F18/2415—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on parametric or probabilistic models, e.g. based on likelihood ratio or false acceptance rate versus a false rejection rate
- G06F18/24155—Bayesian classification
Abstract
The invention discloses a transaction behavior detection method and device. The method comprises the following steps: when detecting that the current user is in a state of getting close to financial self-service equipment, acquiring operation information of operation of the current user to the financial self-service equipment; generating a current sample feature vector according to the operation information; identifying whether behavior corresponding to the current sample feature vector is an abnormal transaction behavior based on statistical mode identification technology, wherein a preset template feature vector comprises a preset template feature vector corresponding to a normal transaction behavior and/or the abnormal transaction behavior. By the adoption of the technical scheme, the financial self-service equipment can detect the abnormal transaction behavior such as card stealing, so that the function of the financial self-service equipment is completed, and the information security and the fund security of a bank card user are guaranteed.
Description
Technical field
The present invention relates to detection technique field, more particularly to a kind of trading activity detection method and device.
Background technology
With electronic, networking growing, with by ATM (automated teller
Machine, atm) transaction that carries out withdrawing the money concludes the business and brings many facilities for user for the finance self-help of representative.However, finance is certainly
Help equipment cannot obtain the supervision of staff in running in real time, got over based on the abnormal trading activity of financial self-service equipment
Come more.Information for user and fund etc. bring many hidden danger safely.
In recent years, bank card user repeatedly by " stealing card " event of strange land bankcard consumption in China various places.Offender
Gather bank card information by hidden harvester is installed on gate control system and card inserting mouth, and replicated using replicating read write line
Bank card, obtains clone's card, thus successfully stealing card.With the increasingly variation stealing card mode, general antitheft card device cannot
Realize antitheft card protection for all of robber's card mode, and installation robber card detection apparatus not only can be significantly on financial self-service equipment
Increase hardware cost, and antitheft card device need with steal card device update and constantly carry out upgrading improve it is impossible to
The long-term effectiveness keeping Anti-theft card function.Therefore, the antitheft card device of existing financial self-service equipment is due to can not effectively reduce
Steal and block successful probability, financial self-service equipment can be led to when carrying out fund allocation to there is larger fund security hidden danger.
Additionally, also having numerous other types of abnormal trading activity except stealing card behavior.Such as in general, crime
, in order to hoodwink people, after it steals bank card, the institute that can take out in batches in bank card is rich for molecule.Existing finance self-help
Equipment can not efficiently identify out such abnormal transaction.Therefore, in order to ensure the information security of user's bank card and effectively know
Do not go out abnormal transaction, financial self-service equipment need to be carried out certain perfect.
Content of the invention
In view of this, the present invention provides a kind of trading activity detection method and device, to realize setting to based on finance self-help
Standby abnormal trading activity is detected.
In a first aspect, embodiments providing a kind of trading activity detection method, comprising:
When active user is detected and being in proximity state with respect to financial self-service equipment, obtain described active user to institute
State the operation information that financial self-service equipment is operated；
Current sampling feature vectors are generated according to described operation information；
Identify whether the corresponding behavior of described current sampling feature vectors is abnormal transaction based on statistical-simulation spectrometry technology
Class behavior, wherein, described default template characteristic vector include default corresponding to arm's length dealing class behavior and/or abnormal transaction class
The template characteristic vector of behavior.
Further, described operation information includes operating time information and action type information；Wherein, described in described basis
Operation information generates current sampling feature vectors, comprising:
Obtain the time close to described financial self-service equipment for the described active user, as initial time；
Calculated between the described time operating corresponding operating time and described initial time according to described operating time information
Every；
It is in the duration of proximity state according to described time interval, described active user with respect to described financial self-service equipment
Generate current sampling feature vectors with action type information.
Further, described according to described operation information generate current sampling feature vectors, also include:
Count number of times and/or the amount of money of described active user held bank card historical trading；
Current sampling feature vectors are generated according to described operation information and described number of times and/or the amount of money.
Further, the close degree of relatively described current sampling feature vectors and default template characteristic vector, according to than
Relatively result identifies whether the corresponding behavior of described current sampling feature vectors is abnormal transaction class behavior, comprising:
Determined between described current sampling feature vectors and default template characteristic vector based on statistical-simulation spectrometry technology
Distance value；
Identify that according to the relation between described distance value and predeterminable range value described current sampling feature vectors are corresponding
Whether behavior is abnormal transaction class behavior.
Further, detecting before active user is in proximity state with respect to financial self-service equipment, also including:
The sampling feature vectors corresponding to arm's length dealing class behavior and/or abnormal class behavior of concluding the business of collection predetermined number；
Based on statistical-simulation spectrometry technology, the sampling feature vectors being gathered are trained, obtain corresponding to arm's length dealing
Class behavior and/or the default template characteristic vector of abnormal transaction class behavior.
Further, described operation information includes action type information, described action type information include insert bank card,
Press beating keyboard or button, point touching screen, take out bank note, put into bank note, take out bank card, noncontact card-reading apparatus read non-
Contact card information, input biological characteristic recognition information, put paper money mouth open, put paper money mouth close, strip spue and read two dimension
Code information.
Second aspect, embodiments provides a kind of trading activity detection means, comprising:
Operation information acquisition module, for being in proximity state with respect to financial self-service equipment active user is detected
When, obtain the operation information that described active user is operated to described financial self-service equipment；
Sampling feature vectors generation module, for generating current sampling feature vectors according to described operation information；
Characteristic vector comparison module, for vectorial close of relatively described current sampling feature vectors and default template characteristic
According to comparative result, degree, identifies whether the corresponding behavior of described current sampling feature vectors is to steal card class behavior, wherein, described
Default template characteristic vector include the default template characteristic corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior to
Amount.
Further, described sampling feature vectors generation module includes:
Initial time acquiring unit, for obtaining the time close to described financial self-service equipment for the described active user, as
Initial time；
Time interval computing unit, for according to described operating time information calculate described operation the corresponding operating time with
The time interval of described initial time；
First signal generating unit, for according to described time interval, described active user with respect to described financial self-service equipment
It is in the duration of proximity state and action type information generates current sampling feature vectors.
Further, described sampling feature vectors generation module also includes:
Statistic unit, for counting number of times and/or the amount of money of described active user held bank card historical trading；
Second signal generating unit, special for current sample is generated according to described operation information and described number of times and/or the amount of money
Levy vector.
Further, described characteristic vector comparison module includes:
Distance determining unit, for determining the distance between described current sampling feature vectors and default template characteristic vector
Value；
Activity recognition unit, for identifying described current sample according to the relation between described distance value and predeterminable range value
Whether the corresponding behavior of eigen vector is abnormal transaction class behavior.
Further, this device also includes:
Sampling feature vectors acquisition module, for being in close to shape with respect to financial self-service equipment active user is detected
Before state, the sampling feature vectors corresponding to arm's length dealing class behavior and/or abnormal class behavior of concluding the business of collection predetermined number；
Template characteristic vector determining module, for being entered to the sampling feature vectors being gathered based on statistical-simulation spectrometry technology
Row training, obtains the default template characteristic vector corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior.
Further, described operation information includes action type information, described action type information include insert bank card,
Press beating keyboard or button, point touching screen, take out bank note, put into bank note, take out bank card, noncontact card-reading apparatus read non-
Contact card information, input biological characteristic recognition information, put paper money mouth open, put paper money mouth close, strip spue and read two dimension
Code information.
A kind of trading activity detection scheme provided in an embodiment of the present invention, is detecting active user with respect to finance self-help
When equipment is in proximity state, obtain the operation information that active user is operated to financial self-service equipment, then according to operation
Information generates current sampling feature vectors, after current sampling feature vectors and default template vector are compared, according to comparing
Result identifies whether the behavior corresponding to current sampling feature vectors is abnormal transaction class behavior.By using above-mentioned technical side
Case, financial self-service equipment can detect the abnormal transaction class behavior such as robber's card, and the function of perfect financial self-service equipment is it is ensured that silver
The information security of row card user and fund security.
Brief description
By reading the detailed description that non-limiting example is made made with reference to the following drawings, other of the present invention
Feature, objects and advantages will become more apparent upon:
Fig. 1 is a kind of flow chart of trading activity detection method that the embodiment of the present invention one provides；
Fig. 2 is a kind of flow chart of trading activity detection method that the embodiment of the present invention two provides；
Fig. 3 is a kind of flow chart of trading activity detection method that the embodiment of the present invention three provides；
Fig. 4 is a kind of structured flowchart of trading activity detection means that the embodiment of the present invention four provides.
Specific embodiment
The present invention is described in further detail with reference to the accompanying drawings and examples.It is understood that this place is retouched
The specific embodiment stated is used only for explaining the present invention, rather than limitation of the invention.It also should be noted that, in order to just
Part related to the present invention rather than full content is illustrate only in description, accompanying drawing.
It also should be noted that, for the ease of description, illustrate only in accompanying drawing part related to the present invention rather than
Full content.It should be mentioned that some exemplary embodiments are described before exemplary embodiment is discussed in greater detail
Become the process described as flow chart or method.Although operations (or step) are described as the process of order by flow chart,
It is that many of which operation can be implemented concurrently, concomitantly or simultaneously.Additionally, the order of operations can be by again
Arrange.Described process can be terminated when its operations are completed, it is also possible to have the additional step being not included in accompanying drawing.
Described process can correspond to method, function, code, subroutine, subprogram etc..
Embodiment one
Fig. 1 is a kind of flow chart of trading activity detection method that the embodiment of the present invention one provides.The method of the present embodiment
Can be executed by trading activity detection means, wherein this device can be realized by software and/or hardware, typically can be integrated in finance certainly
Help in equipment.As shown in figure 1, the trading activity detection method that the present embodiment provides specifically includes following steps:
Step 110, when active user is detected and being in proximity state with respect to financial self-service equipment, obtain active user
The operation information that financial self-service equipment is operated.
Wherein, financial self-service equipment can be the self-service equipments such as ATM, automatic cash dispenser or access integral machine.
Preferably, it is possible to use whether infrared sensor (also known as the nearly sensor of people) detection user set close to finance self-help
Standby.Specifically, when user is close to financial self-service equipment, certain part of user's body can be in infrared detection region,
The infrared ray that infrared emission tube in infrared sensor sends is blocked due to user and can reflex to infrared receiver tube, when infrared
After line reception pipe receives the infrared signal being reflected by user, that is, user is detected close to this financial self-service equipment.Hot
When outside line reception pipe does not receive the infrared signal being reflected by user, that is, show that user leaves financial self-service equipment.User
Can be considered that user sets with respect to finance self-help close to financial self-service equipment within the time period left between financial self-service equipment
Standby it is in proximity state.Additionally, for detecting whether having user can also be ultrasound wave close to the sensor of financial self-service equipment
Sensor.Its detection method is similar with infrared sensor, and here is omitted.
Exemplary, when sensor has detected user and has been toward or away from financial self-service equipment, this user can be logical
Cross financial self-service equipment to carry out the user of arm's length dealing or carry out the abnormal user concluding the business by financial self-service equipment,
Want to take out money in bank card as wanted to steal the lawless person of bank card information or stolen bank card information
Offender etc..Different types of user is different due to demand, so the operation that financial self-service equipment is carried out is also different.Behaviour
May include operating time information and action type information as information, wherein action type information may include financial self-service equipment institute energy
The operation enough detecting.Exemplary, action type information mays include: insertion bank card, presses beating keyboard or button, point touching
Screen, take out bank note, put into bank note, taking out bank card, noncontact card-reading apparatus, to read contactless card information, input biological special
Levy identification information, put paper money mouth open, put paper money mouth close, strip spue and read 2 D code information etc. operation.For example, if used
Family carries out operation of withdrawing the money, and the operation that user is carried out includes: insertion bank card, by beating keyboard (input bank card password), by hitting
Button or point touching screen (selection type of transaction), press beating keyboard or button (selection withdraw funds), take out bank note, press and hit button
Or the operation such as point touching screen (card is moved back in selection) and taking-up bank card.User when aforesaid operations are carried out to financial self-service equipment,
Financial self-service equipment typically can receive corresponding instruction or information.For example, after insertion bank card, financial self-service equipment may be read into
Bank card information, then can detect that user has carried out inserting the operation of bank card；Or detected whether by infrared sensor
Card inserts, if it has, user is then detected to have carried out inserting the operation of bank card.And for example, user presses beating keyboard or button
When, financial self-service equipment can receive accordingly by the information of hitting, then can detect that user has carried out pressing the behaviour of beating keyboard or button
Make.For example, when lawless person installs false keyboard on original keyboard of financial self-service equipment, if touching original keyboard, this
When, financial self-service equipment also can detect by this operation of beating keyboard.For example, if offender wants to take out in bank card
Money, the amount of money that its withdrawal mode may carry out several times and withdraw cash every time is not very big, and financial self-service equipment can detect that
Current bank is stuck within one day and carried out multiple transaction of withdrawing the money.
Exemplary, when operating time information may include active user financial self-service equipment carried out with corresponding during each operation
Between point, can refer to the system time of Beijing time or financial self-service equipment to determine.
Step 120, according to operation information generate current sampling feature vectors.
Exemplary, active user is in the duration of proximity state as current sample characteristics with respect to financial self-service equipment
One of vector element, determines the other elements in current sampling feature vectors according to operating time information.For example, can will work as
Time interval between the adjacent operation of each two of front user is as the element in current sampling feature vectors；Also one can be chosen
Individual reference time point (if user is close to the moment of financial self-service equipment), calculates each operation and the reference time point of active user
Between time interval, as the element in current sampling feature vectors.The present embodiment does not limit to putting in order of each element
Fixed, but should be consistent with putting in order of each element in default template characteristic vector hereinafter described, in order to be compared.
In general, when lawless person enters the operation of pirate card, the key seldom to financial self-service equipment for the lawless person
Disk is operated, financial self-service equipment can by the sensors such as infrared ray detect lawless person close to financial self-service equipment and from
Open the time of financial self-service equipment, and calculate duration, obtain one of current sampling feature vectors element, if being not detected by
Any operation, then current sampling feature vectors can be generated according to this duration, the element of other positions can pass through certain way
Process is configured, for example, supplied with default value (as 0).Lawless person, in order to obtain bank card password, sets in finance self-help
When installing false keyboard on standby original keyboard, if touching original keyboard, now, financial self-service equipment also can detect by hitting
This operation of keyboard, now can determine that two elements in current sampling feature vectors, the element of other positions is according to above-mentioned side
Formula is processed.
Step 130, it is whether abnormal based on the identification corresponding behavior of current sampling feature vectors of statistical-simulation spectrometry technology
Transaction class behavior.
Wherein, described default template characteristic vector inclusion is default concludes the business corresponding to arm's length dealing class behavior and/or exception
The template characteristic vector of class behavior.
Exemplary, can identify that current sampling feature vectors specifically can refer to based on above-mentioned based on statistical-simulation spectrometry technology
Current sampling feature vectors are carried out identification and classification by technology of identification, can find the row approximate with it according to current sampling feature vectors
For classification, and corresponding for current sampling feature vectors behavior classification is included into wherein.Exemplary it is also possible to be based on statistical model
Technology of identification determines the distance between described current sampling feature vectors and default template characteristic vector value, then according to described away from
Relation between value and predeterminable range value to judge whether the corresponding behavior of described current sampling feature vectors is abnormal transaction
Class behavior.Wherein, the ultimate principle of statistical-simulation spectrometry (statistic pattern recognition) is: has similarity
Sample close to each other in model space, and form " group ", i.e. " things of a kind come together, people of a mind fall into the same group ".Its analysis method is to be surveyed according to pattern
Characteristic vector x obtainingi=(xi1,xi2,...,xid) t (i=1,2 ... n) a given pattern is included into c class ω1,
ω2,...ωcIn, then according to the distance between pattern function come identification and classification.Wherein, t represents transposition；N is sample points；d
For sample characteristics number.Specifically, it is possible to use the method such as Euclidean distance or mahalanobis distance comes judgment sample characteristic vector and mould
The close degree of plate features vector.Specifically, in the present embodiment, the behavior of user can be divided into two classes, i.e. arm's length dealing
Class and abnormal transaction class.By judging the corresponding characteristic vector of current behavior and arm's length dealing class behavior and/or abnormal transaction class
The corresponding characteristic vector of behavior apart from size, current behavior is sorted out.
Specifically, when more current sampling feature vectors are with the close degree of default template characteristic vector, can be working as
Front sampling feature vectors are compared with the template characteristic vector of arm's length dealing class behavior, if gained distance is poor with predeterminable range
Not little, then current behavior is arm's length dealing class behavior；If gained is larger apart from difference, current behavior is abnormal transaction class
Behavior.Specifically, also current sampling feature vectors can be handed over extremely with the template characteristic vector sum of arm's length dealing class behavior respectively
The template characteristic vector of easily class behavior is compared, if be less than with the distance value of the template characteristic vector of arm's length dealing class behavior
With the distance value of abnormal class template characteristic vector of concluding the business, then current behavior is arm's length dealing class behavior, otherwise is abnormal transaction class
Behavior.
Further, arm's length dealing class can be divided into withdrawal class, deposit class and remittance class etc. again.Current sample can be determined respectively
The distance between the corresponding default template characteristic vectors such as characteristic vector and withdrawal class, deposit class and remittance class value, if with any
A kind of the distance between the corresponding default template characteristic vector of arm's length dealing class value meets the requirements (such as less than a certain distance value),
It is regarded as arm's length dealing class behavior；If distance value all undesirable it is believed that being abnormal transaction class behavior.
Further, abnormal transaction class behavior can be divided into robber's card class behavior and the exception trading activity of non-robber's card class again.When logical
When crossing the comparison of distance and identifying that the behavior of active user belongs to abnormal transaction class behavior, can respectively with steal card class behavior and non-
The template characteristic vector stealing the exception trading activity of card class is compared.After comparing, if recognition result with steal card class behavior away from
From close to, then the behavior of active user can determine for steal card class behavior, otherwise for non-robber card class exception trading activity.
The trading activity detection method that the embodiment of the present invention one provides, sets with respect to finance self-help active user is detected
For when being in proximity state, obtain the operation information that active user is operated to financial self-service equipment, then according to operation letter
Breath generates current sampling feature vectors.After current sampling feature vectors and default template vector are compared, according to than
Relatively result identifies whether the behavior corresponding to current sampling feature vectors is abnormal transaction class behavior.By using above-mentioned technology
Scheme, financial self-service equipment can detect the abnormal transaction class behavior such as robber's card, the function of perfect financial self-service equipment it is ensured that
The information security of bank card user and fund security.
On the basis of above-described embodiment, if may also include that, current sampling feature vectors pair are judged according to comparative result
The behavior answered is abnormal transaction class behavior, then carry out warning process.Alert process may include to corresponding with financial self-service equipment
Background server sends and the information warning of abnormal trading activity is detected, so as staff and alarm arrest lawless person or
Person removes robber's card relevant apparatus on financial self-service equipment etc. in time, ensures that normal users use safety during financial self-service equipment
Property.
Embodiment two
Fig. 2 is a kind of flow chart of trading activity detection method that the embodiment of the present invention two provides.The present embodiment is to enforcement
Step " generating current sampling feature vectors according to operation information " in example one is optimized.With reference to Fig. 2, the embodiment of the present invention
Specifically include following steps:
Step 210, when active user is detected and being in proximity state with respect to financial self-service equipment, obtain active user
The operation information that financial self-service equipment is operated.
Step 220, obtain active user close to the time of financial self-service equipment, as initial time.
Step 230, the time interval according to operation information calculating operation corresponding operating time and initial time.
When sensor detects user close to financial self-service equipment, associated components (as controller) in financial self-service equipment
Current time can be recorded as initial time, i.e. 0 point of follow-up timing.When user carries out arm's length dealing, financial self-service equipment
User is often detected it is operated, the time of current operation can be recorded, and calculate and between the time of initial time
Every.Specifically, when user's insertion bank card, the infrared sensor of financial self-service equipment card inserting mouth can detect plug-in card, and this moves
Make, then infrared sensor can record current card action the signal transmission detecting to correlation control unit in controller
Moment, then calculate this card action and 0 point of time interval.Other actions and the time of initial time that user withdraws the money
The record at interval is similar with plug-in card This move.
In the present embodiment, operation includes set financial self-service equipment being possible to operated, so not necessarily only
It is confined to withdraw the money.If a certain step in not comprising in the operation being currently able to detect that to operate or the operation of a few step,
The time interval of that step or a few step of then corresponding to operation can be designated as 0.For example, put into this operation of bank note in operation, but
It is not need to carry out this single stepping, then the time interval putting into this operation of bank note and initial time during withdrawing the money
It is designated as 0.
Step 240, it is in duration and the behaviour of proximity state with respect to financial self-service equipment according to time interval, active user
Make type information and generate current sampling feature vectors.
Exemplary, if lawless person has touched original key of financial self-service equipment during installing false keyboard
Disk, and when financial self-service equipment is not detected by other operations, then the element in current sampling feature vectors include lawless person and touch
Encounter and be in the duration of proximity state with the time interval of initial time and lawless person with financial self-service equipment during keyboard.
Exemplary, when offender steals money in bank card by financial self-service equipment, this offender's
Withdrawal mode may be carried out several times, and withdrawal may not be using same bank card every time.Therefore, finance self-help sets
The standby current sampling feature vectors being generated may also comprise in same bank card one day the total degree of transaction and total amount or with
The total degree that one user concludes the business in preset time period.
Step 250, it is whether abnormal based on the identification corresponding behavior of current sampling feature vectors of statistical-simulation spectrometry technology
Transaction class behavior.
Wherein, described default template characteristic vector include default corresponding to arm's length dealing class behavior and/or steal card class row
For template characteristic vector.
The embodiment of the present invention two on the basis of above-described embodiment, will " according to operation information generate current sample characteristics to
The process of amount " is refined, and calculates the operation corresponding operating time and initiates according to the temporal information of user's current operation
The time interval in moment, then generates sampling feature vectors, can further improve the accuracy of the abnormal class behavior of concluding the business of detection, carries
The safety in financial transaction for the high user.
Further, generate current sampling feature vectors according to described temporal information can also include: statistics is described current
The number of times of user's held bank card historical trading and/or the amount of money；According to described operation information and described number of times and/or amount of money life
Become current sampling feature vectors.
Exemplary, if the held bank card of active user is in intraday transaction count more than once, finance self-help sets
Standby this bank card business dealing number of times can be added up, and record total degree and the total amount conduct that this bank card was concluded the business in a day
Two elements in current sampling feature vectors.
Further, generate current sampling feature vectors according to described operation information can also include: to active user's
Identity is identified, and obtains active user's quantity using bank card in preset time period；Believed according to the described operating time
Breath, described active user are in the duration of proximity state and the quantity life of described bank card with respect to described financial self-service equipment
Become current sampling feature vectors.
Exemplary, financial self-service equipment can be entered to the identity of active user by the information of the held bank card of active user
Row identification, or active user is identified by the face identification device being arranged on financial self-service equipment.When finance self-help sets
Standby count active user when (in as one day) exceedes predetermined number threshold value using the quantity of bank card in preset time period, then
The transaction of active user can also be used as one kind of abnormal class behavior of concluding the business.Wherein, preset time period can arbitrarily be arranged.Present count
Amount threshold value specifically can be embodied in the corresponding default template characteristic vector of arm's length dealing class behavior.
Embodiment three
Fig. 3 is a kind of flow chart of trading activity detection method that the embodiment of the present invention three provides.The present embodiment is to above-mentioned
Process before " being in proximity state active user is detected with respect to financial self-service equipment " in embodiment is optimized.
With reference to Fig. 3, the embodiment of the present invention specifically includes following steps:
Step 310, the sample spy corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior of collection predetermined number
Levy vector.
Step 320, based on statistical-simulation spectrometry technology, the sampling feature vectors being gathered are trained, obtain corresponding to
Arm's length dealing class behavior and/or the default template characteristic vector of abnormal transaction class behavior.
Exemplary, default template characteristic vector can be the sampling feature vectors that user carries out arm's length dealing class behavior,
Can also be the sampling feature vectors that lawless person carries out abnormal transactional operation, or special for the sample of arm's length dealing class behavior
The sampling feature vectors levying vector sum transaction class behavior extremely are simultaneously as default template characteristic vector.Specifically, gather necessarily
The sampling feature vectors of the arm's length dealing class behavior of quantity, for example, can gather withdrawal, deposit or the remittance of the people of different age group
Money action, and consider some as the emergency case such as forget Password in action gatherer process.Collect arm's length dealing behavior
After action, its action is converted into sampling feature vectors by financial self-service equipment, then carries out pre- place to these sampling feature vectors
Reason, for example, can abandon some characteristic vectors very big with the time interval difference of other arm's length dealing class actions, and then extracts
Go out some conventional sampling feature vectors of arm's length dealing class behavior.After the pre-treatment, can be special to the sample of arm's length dealing class behavior
Levy vector set to be trained, the method for training can be trained by Bayes classifier in statistical-simulation spectrometry, also may be used
To be trained by other modes such as neural network filter.By training, select the arm's length dealing class behavior of optimum
Sampling feature vectors are as the default template characteristic vector of arm's length dealing class behavior.Exemplary, abnormal the pre- of class behavior of concluding the business
If the generating mode of template characteristic vector is similar with the default template characteristic vector of arm's length dealing class behavior.It should be noted that
During default template characteristic vector generates, financial self-service equipment also can count the held bank card of each user in one day
Transaction count and the amount of money, and the transaction count according to most of users and the amount of money are determining the default mould of arm's length dealing class behavior
The value of corresponding two elements in plate features vector, the transaction count according to only a few user and the amount of money are determining abnormal transaction class
The value of corresponding two elements in the default template characteristic vector of behavior.The selection of default template characteristic vector is to a certain extent
The probability detecting abnormal trading activity can be improved.
Step 330, when active user is detected and being in proximity state with respect to financial self-service equipment, obtain active user
The operating time information that financial self-service equipment is operated.
Step 340, obtain active user close to the time of financial self-service equipment, as initial time.
Step 350, the time interval according to operating time information calculating operation corresponding operating time and initial time.
Step 360, it is in duration and the behaviour of proximity state with respect to financial self-service equipment according to time interval, active user
Make type information and generate current sampling feature vectors.
Step 370, it is whether abnormal based on the identification corresponding behavior of current sampling feature vectors of statistical-simulation spectrometry technology
Transaction class behavior.
Wherein, described default template characteristic vector inclusion is default concludes the business corresponding to arm's length dealing class behavior and/or exception
The template characteristic vector of class behavior.
The present embodiment three on the basis of above-described embodiment, detect active user with respect to financial self-service equipment at
Process before proximity state is optimized, by gathering the characteristic vector of a number of arm's length dealing class behavior and different
Often after the characteristic vector of transaction class behavior, default template characteristic vector is obtained by training.Then compare user's current behavior pair
Close degree between the sampling feature vectors answered and default template characteristic vector, and then identify that whether user's current operation is
Abnormal transaction class behavior.It may be determined that going out accurately to preset template characteristic vector, improve follow-up inspection by using technique scheme
Survey the accuracy of abnormal class behavior of concluding the business, reduce that lawless person steals card or to steal the transaction extremely such as money in bank card successfully several
Rate, improves the safety in financial transaction for the user.
Example IV
Fig. 4 is a kind of structured flowchart of trading activity detection means that the embodiment of the present invention four provides, and this device can be by soft
Part and/or hardware are realized, and are typically integrated in finance self-help system.As shown in figure 4, this system includes: operation information acquisition mould
Block 401, sampling feature vectors generation module 402 and characteristic vector comparison module 403.
Wherein, operation information acquisition module 401, for connecing active user is detected and be in respect to financial self-service equipment
During nearly state, obtain the operation information that described active user is operated to described financial self-service equipment.
Sampling feature vectors generation module 402, for generating current sampling feature vectors according to described operation information.
Characteristic vector comparison module 403, is corresponded to based on the described current sampling feature vectors of statistical-simulation spectrometry technology identification
Behavior be whether abnormal transaction class behavior, wherein, described default template characteristic vector include default corresponding to arm's length dealing
Class behavior and/or the template characteristic vector of abnormal transaction class behavior.
The trading activity detection means that the embodiment of the present invention four provides, sets with respect to finance self-help active user is detected
For when being in proximity state, the operation that active user is operated to financial self-service equipment is obtained by operation information acquisition module
Information, then generates current sampling feature vectors according to operation information.By characteristic vector comparison module current sample characteristics
After vectorial and default template vector is compared, the behavior according to corresponding to comparative result identifies current sampling feature vectors is
No for abnormal trading activity.By adopting technique scheme, financial self-service equipment can detect the abnormal transaction class such as robber's card
Behavior, the function of perfect financial self-service equipment is it is ensured that the information security of bank card user and fund security.
On the basis of above-described embodiment, sampling feature vectors generation module includes: initial time acquiring unit, is used for obtaining
Take described active user close to the time of described financial self-service equipment, as initial time；Time interval computing unit, for root
Calculate the described time interval operating corresponding operating time and described initial time according to described operating time information；First generation
Unit, for according to described time interval, described active user with respect to described financial self-service equipment be in proximity state when
Long-living become current sampling feature vectors with action type information.
On the basis of above-described embodiment, sampling feature vectors generation module also includes: statistic unit, described for counting
The number of times of active user's held bank card historical trading and/or the amount of money；
Second signal generating unit, special for current sample is generated according to described operation information and described number of times and/or the amount of money
Levy vector.
On the basis of above-described embodiment, characteristic vector comparison module includes: distance determining unit, for determining described working as
Front sampling feature vectors and the distance between default template characteristic vector value；Activity recognition unit, for according to described distance value
Relation between predeterminable range value to identify whether the corresponding behavior of described current sampling feature vectors is abnormal transaction class row
For.
On the basis of above-described embodiment, also include sampling feature vectors acquisition module, for active user is being detected
Before being in proximity state with respect to financial self-service equipment, collection predetermined number corresponding to arm's length dealing class behavior and/or different
The often sampling feature vectors of transaction class behavior；
Template characteristic vector determining module, for being entered to the sampling feature vectors being gathered based on statistical-simulation spectrometry technology
Row training, obtains the default template characteristic vector corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior.
On the basis of above-described embodiment, described operation information includes action type information, described action type packet
Include insertion bank card, press beating keyboard or button, point touching screen, take out bank note, put into bank note, take out bank card, noncontact reading
Card apparatus read contactless card information, input biological characteristic recognition information, put paper money mouth and open, put that paper money mouth is closed, strip tells
Go out and read 2 D code information.
The trading activity detection means providing in above-described embodiment can perform the transaction that any embodiment of the present invention is provided
Behavioral value method, possesses the corresponding functional module of execution method and beneficial effect.Not detailed description in the above-described embodiments
Ins and outs, can be found in the trading activity detection method that any embodiment of the present invention is provided.
Note, above are only presently preferred embodiments of the present invention and institute's application technology principle.It will be appreciated by those skilled in the art that
The invention is not restricted to specific embodiment described here, can carry out for a person skilled in the art various obvious changes,
Readjust and substitute without departing from protection scope of the present invention.Therefore although being carried out to the present invention by above example
It is described in further detail, but the present invention is not limited only to above example, without departing from the inventive concept, also
Other Equivalent embodiments more can be included, and the scope of the present invention is determined by scope of the appended claims.
Claims (12)
1. a kind of trading activity detection method is it is characterised in that include:
When active user is detected and being in proximity state with respect to financial self-service equipment, obtain described active user to described gold
Melt the operation information that self-service equipment is operated；
Current sampling feature vectors are generated according to described operation information；
Identify whether the corresponding behavior of described current sampling feature vectors is abnormal transaction class row based on statistical-simulation spectrometry technology
For, wherein, described default template characteristic vector include default corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior
Template characteristic vector.
2. method according to claim 1 it is characterised in that
Described operation information includes operating time information and action type information；
Current sampling feature vectors are generated according to described operation information, comprising:
Obtain the time close to described financial self-service equipment for the described active user, as initial time；
The described time interval operating corresponding operating time and described initial time is calculated according to described operating time information；
It is in duration and the behaviour of proximity state according to described time interval, described active user with respect to described financial self-service equipment
Make type information and generate current sampling feature vectors.
3. method according to claim 1 is it is characterised in that described generate current sample characteristics according to described operation information
Vector, also includes: the number of times of statistics described active user held bank card historical trading and/or the amount of money；
Current sampling feature vectors are generated according to described operation information and described number of times and/or the amount of money.
4. method according to claim 1 is it is characterised in that identify described current sample based on statistical-simulation spectrometry technology
Whether the corresponding behavior of characteristic vector is abnormal transaction class behavior, comprising:
Determine described current sampling feature vectors and the distance between default template characteristic vector value；
Identify the corresponding behavior of described current sampling feature vectors according to the relation between described distance value and predeterminable range value
Whether it is abnormal transaction class behavior.
5. method according to claim 1 it is characterised in that detect active user with respect to financial self-service equipment at
Before proximity state, also include:
The sampling feature vectors corresponding to arm's length dealing class behavior and/or abnormal class behavior of concluding the business of collection predetermined number；
Based on statistical-simulation spectrometry technology, the sampling feature vectors being gathered are trained, obtain corresponding to arm's length dealing class row
For and/or abnormal transaction class behavior default template characteristic vector.
6. method according to claim 1 is it is characterised in that described operation information includes action type information, described behaviour
Include inserting bank card, press beating keyboard or button, point touching screen, take out bank note, put into bank note, take out bank as type information
Card, noncontact card-reading apparatus read contactless card information, input biological characteristic recognition information, put paper money mouth and open, put paper money mouth
Close, strip spues and reads 2 D code information.
7. a kind of trading activity detection means is it is characterised in that include:
Operation information acquisition module, for when active user is detected and being in proximity state with respect to financial self-service equipment, obtaining
Take the operation information that described active user is operated to described financial self-service equipment；
Sampling feature vectors generation module, for generating current sampling feature vectors according to described operation information；
Characteristic vector comparison module, for identifying the corresponding row of described current sampling feature vectors based on statistical-simulation spectrometry technology
For being whether abnormal transaction class behavior, wherein, described default template characteristic vector include default corresponding to arm's length dealing class row
For and/or abnormal transaction class behavior template characteristic vector.
8. device according to claim 7 is it is characterised in that described sampling feature vectors generation module includes:
Initial time acquiring unit, for obtaining the time close to described financial self-service equipment for the described active user, as initial
Moment；
Time interval computing unit, for according to described operating time information calculate described operation the corresponding operating time with described
The time interval of initial time；
First signal generating unit, for being in respect to described financial self-service equipment according to described time interval, described active user
The duration of proximity state and action type information generate current sampling feature vectors.
9. device according to claim 7 is it is characterised in that described sampling feature vectors generation module also includes:
Statistic unit, for counting number of times and/or the amount of money of described active user held bank card historical trading；
Second signal generating unit, for according to described operation information and described number of times and/or the amount of money generate current sample characteristics to
Amount.
10. device according to claim 7 is it is characterised in that described characteristic vector comparison module includes:
Distance determining unit, for determining described current sampling feature vectors and the distance between default template characteristic vector value；
Activity recognition unit, special for identifying described current sample according to the relation between described distance value and predeterminable range value
Levy whether vectorial corresponding behavior is abnormal transaction class behavior.
11. devices according to claim 7 are it is characterised in that also include:
Sampling feature vectors acquisition module, for detect active user with respect to financial self-service equipment be in proximity state it
Before, the sampling feature vectors corresponding to arm's length dealing class behavior and/or abnormal class behavior of concluding the business of collection predetermined number；
Template characteristic vector determining module, for being instructed to the sampling feature vectors being gathered based on statistical-simulation spectrometry technology
Practice, obtain the default template characteristic vector corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior.
12. devices according to claim 7 are it is characterised in that described operation information includes action type information, described behaviour
Include inserting bank card, press beating keyboard or button, point touching screen, take out bank note, put into bank note, take out bank as type information
Card, noncontact card-reading apparatus read contactless card information, input biological characteristic recognition information, put paper money mouth and open, put paper money mouth
Close, strip spues and reads 2 D code information.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610705443.XA CN106340138B (en) | 2016-08-23 | 2016-08-23 | A kind of trading activity detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610705443.XA CN106340138B (en) | 2016-08-23 | 2016-08-23 | A kind of trading activity detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106340138A true CN106340138A (en) | 2017-01-18 |
| CN106340138B CN106340138B (en) | 2019-08-27 |
Family
ID=57825434
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610705443.XA Expired - Fee Related CN106340138B (en) | 2016-08-23 | 2016-08-23 | A kind of trading activity detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106340138B (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106997635A (en) * | 2017-03-03 | 2017-08-01 | 深圳怡化电脑股份有限公司 | The detection method and its device of a kind of note surface foreign matter |
| CN107609772A (en) * | 2017-09-08 | 2018-01-19 | 新智云数据服务有限公司 | A kind of data processing method and device for user's aerating |
| CN108053214A (en) * | 2017-12-12 | 2018-05-18 | 阿里巴巴集团控股有限公司 | A kind of recognition methods of wash sale and device |
| CN108682088A (en) * | 2018-05-14 | 2018-10-19 | 平安科技（深圳）有限公司 | Based on the cross-border determination method and device merchandised extremely of ATM |
| CN108960833A (en) * | 2018-08-10 | 2018-12-07 | 哈尔滨工业大学（威海） | A kind of abnormal transaction identification method based on isomery finance feature, equipment and storage medium |
| CN109214224A (en) * | 2017-06-30 | 2019-01-15 | 阿里巴巴集团控股有限公司 | The Risk Identification Method and device of information coding |
| CN113705493A (en) * | 2021-09-01 | 2021-11-26 | 浙江大华技术股份有限公司 | Method and device for detecting financial transaction abnormal behavior and readable storage medium |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101299285A (en) * | 2007-12-11 | 2008-11-05 | 北京印刷学院 | Bank abnormity draw money detector and method thereof |
| CN101561866A (en) * | 2009-05-27 | 2009-10-21 | 上海交通大学 | Character recognition method based on SIFT feature and gray scale difference value histogram feature |
| CN101944174A (en) * | 2009-07-08 | 2011-01-12 | 西安电子科技大学 | Identification method of characters of licence plate |
| CN103544429A (en) * | 2012-07-12 | 2014-01-29 | 中国银联股份有限公司 | Anomaly detection device and method for security information interaction |
| CN103699823A (en) * | 2014-01-08 | 2014-04-02 | 同济大学 | Identity authentication system based on user behavior pattern and method thereof |
| CN104545890A (en) * | 2014-12-30 | 2015-04-29 | 深圳先进技术研究院 | Electrocardiosignal based identity recognition method and device |
| CN104794484A (en) * | 2015-04-07 | 2015-07-22 | 浙江大学 | Time series data nearest-neighbor classifying method based on subsection orthogonal polynomial decomposition |
| CN105005901A (en) * | 2015-07-09 | 2015-10-28 | 厦门快商通信息技术有限公司 | Financial field oriented transaction fraud detection system and method |
-
2016
- 2016-08-23 CN CN201610705443.XA patent/CN106340138B/en not_active Expired - Fee Related
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101299285A (en) * | 2007-12-11 | 2008-11-05 | 北京印刷学院 | Bank abnormity draw money detector and method thereof |
| CN101561866A (en) * | 2009-05-27 | 2009-10-21 | 上海交通大学 | Character recognition method based on SIFT feature and gray scale difference value histogram feature |
| CN101944174A (en) * | 2009-07-08 | 2011-01-12 | 西安电子科技大学 | Identification method of characters of licence plate |
| CN103544429A (en) * | 2012-07-12 | 2014-01-29 | 中国银联股份有限公司 | Anomaly detection device and method for security information interaction |
| CN103699823A (en) * | 2014-01-08 | 2014-04-02 | 同济大学 | Identity authentication system based on user behavior pattern and method thereof |
| CN104545890A (en) * | 2014-12-30 | 2015-04-29 | 深圳先进技术研究院 | Electrocardiosignal based identity recognition method and device |
| CN104794484A (en) * | 2015-04-07 | 2015-07-22 | 浙江大学 | Time series data nearest-neighbor classifying method based on subsection orthogonal polynomial decomposition |
| CN105005901A (en) * | 2015-07-09 | 2015-10-28 | 厦门快商通信息技术有限公司 | Financial field oriented transaction fraud detection system and method |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106997635A (en) * | 2017-03-03 | 2017-08-01 | 深圳怡化电脑股份有限公司 | The detection method and its device of a kind of note surface foreign matter |
| CN109214224A (en) * | 2017-06-30 | 2019-01-15 | 阿里巴巴集团控股有限公司 | The Risk Identification Method and device of information coding |
| CN109214224B (en) * | 2017-06-30 | 2022-05-27 | 阿里巴巴集团控股有限公司 | Risk identification method and device for information coding |
| CN107609772A (en) * | 2017-09-08 | 2018-01-19 | 新智云数据服务有限公司 | A kind of data processing method and device for user's aerating |
| CN108053214A (en) * | 2017-12-12 | 2018-05-18 | 阿里巴巴集团控股有限公司 | A kind of recognition methods of wash sale and device |
| CN108053214B (en) * | 2017-12-12 | 2021-11-23 | 创新先进技术有限公司 | False transaction identification method and device |
| CN108682088A (en) * | 2018-05-14 | 2018-10-19 | 平安科技（深圳）有限公司 | Based on the cross-border determination method and device merchandised extremely of ATM |
| CN108960833A (en) * | 2018-08-10 | 2018-12-07 | 哈尔滨工业大学（威海） | A kind of abnormal transaction identification method based on isomery finance feature, equipment and storage medium |
| CN113705493A (en) * | 2021-09-01 | 2021-11-26 | 浙江大华技术股份有限公司 | Method and device for detecting financial transaction abnormal behavior and readable storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106340138B (en) | 2019-08-27 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106340138A (en) | Transaction behavior detection method and device | |
| US10629036B2 (en) | Surveillance device | |
| US8161530B2 (en) | Behaviormetrics application system for electronic transaction authorization | |
| CN109345375B (en) | Suspicious money laundering behavior identification method and device | |
| Soltani et al. | A new user-based model for credit card fraud detection based on artificial immune system | |
| CN109462691B (en) | Implicit protection method and system based on multi-sensor data fusion | |
| CN105224849A (en) | A kind of multi-biological characteristic merges authentication identifying method and device | |
| CN105957271A (en) | Financial terminal safety protection method and system | |
| US10769896B1 (en) | Counter-fraud measures for an ATM device | |
| CN106792883A (en) | Sensor network abnormal deviation data examination method and system | |
| US11501303B2 (en) | Utilizing card movement data to identify fraudulent transactions | |
| CN110288015A (en) | A kind for the treatment of method and apparatus of portrait retrieval | |
| Barbará et al. | Mining malicious corruption of data with hidden Markov models | |
| Sujith | Crime detection and avoidance in ATM: a new framework | |
| Verma et al. | Analysis of supervised machine learning algorithms in the context of fraud detection | |
| EP1577856B1 (en) | A self-service terminal | |
| CN101692281A (en) | Safety monitoring method, safety monitoring device and automatic teller machine (ATM) system | |
| Jeragh et al. | Combining auto encoders and one class support vectors machine for fraudulant credit card transactions detection | |
| CN105335630B (en) | Personal identification method and identity recognition device | |
| WO2020063020A1 (en) | Method, device and system for identifying object | |
| Wang | The behavioral sign of account theft: Realizing online payment fraud alert | |
| US11881088B2 (en) | Hand action tracking for card slot tampering | |
| Rahman | Supervised machine learning algorithms for credit card fraudulent transaction detection: A comparative survey | |
| CN203535715U (en) | Automatic teller machine (ATM) with intelligent recognition system | |
| CN106325744B (en) | A kind of financial self-service equipment exchange method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20190827 Termination date: 20210823 |