CN106340138B - A kind of trading activity detection method and device - Google Patents
A kind of trading activity detection method and device Download PDFInfo
- Publication number
- CN106340138B CN106340138B CN201610705443.XA CN201610705443A CN106340138B CN 106340138 B CN106340138 B CN 106340138B CN 201610705443 A CN201610705443 A CN 201610705443A CN 106340138 B CN106340138 B CN 106340138B
- Authority
- CN
- China
- Prior art keywords
- feature vectors
- sampling feature
- behavior
- service equipment
- information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Classifications
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F19/00—Complete banking systems; Coded card-freed arrangements adapted for dispensing or receiving monies or the like and posting such transactions to existing accounts, e.g. automatic teller machines
- G07F19/20—Automatic teller machines [ATMs]
- G07F19/207—Surveillance aspects at ATMs
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
- G06F18/2415—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on parametric or probabilistic models, e.g. based on likelihood ratio or false acceptance rate versus a false rejection rate
- G06F18/24155—Bayesian classification
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Life Sciences & Earth Sciences (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Evolutionary Computation (AREA)
- General Engineering & Computer Science (AREA)
- Artificial Intelligence (AREA)
- Probability & Statistics with Applications (AREA)
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The invention discloses a kind of trading activity detection method and device.This method comprises: obtaining the operation information that active user operates financial self-service equipment when detecting that active user is in proximity state relative to financial self-service equipment；Current sampling feature vectors are generated according to operation information；Based on statistical-simulation spectrometry technology, more current sampling feature vectors and default template characteristic vector identify whether the corresponding behavior of current sampling feature vectors is abnormal transaction class behavior.Wherein, the default template characteristic vector includes the preset template characteristic vector for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior.By using above-mentioned technical proposal, financial self-service equipment can detecte out the abnormal transaction class behavior such as robber's card, and the perfect function of financial self-service equipment guarantees the information security and fund security of bank card user.
Description
Technical field
The present invention relates to detection technique fields, more particularly to a kind of trading activity detection method and device.
Background technique
With electronization, networking it is increasingly developed, with pass through ATM (Automated Teller
Machine, ATM) to carry out withdrawal transaction be that the finance self-help that represents trades and brings many conveniences as user.However, finance is certainly
The supervision of staff can not be obtained in real time by helping equipment in the process of running, and the abnormal trading activity based on financial self-service equipment is got over
Come more.Many hidden danger are brought safely for the information of user and fund etc..
In recent years, there is " steal and the block " event of bank card user by strange land bankcard consumption repeatedly in China various regions.Offender
Bank card information is acquired by installing hidden collector in access control system and card inserting mouth, and is replicated using duplication reader
Bank card obtains clone's card, to successfully steal card.With the increasingly diversified of card mode is stolen, general antitheft card device can not
Antitheft card protection is realized for all robber's card modes, and installation robber card detection apparatus not only can be substantially on financial self-service equipment
Increase hardware cost, and antitheft card device needs constantly to carry out upgrading improvement with the update for stealing card device, it can not
The long-term validity for keeping Anti-theft card function.Therefore, the antitheft card device of existing financial self-service equipment is due to that cannot be effectively reduced
It steals and blocks successful probability, will lead to financial self-service equipment, there are biggish fund security hidden danger when carrying out fund allocation.
In addition, in addition to stealing card behavior, there are also numerous other types of abnormal trading activities.Such as under normal circumstances, crime
Molecule is in order to hoodwink people, and after it steals bank card, the institute that can be taken out in batches in bank card is rich.Existing finance self-help
Equipment can not efficiently identify out such abnormal transaction.Therefore, in order to guarantee the information security of user's bank card and effectively know
It abnormal Chu not trade, centainly perfect need to be carried out to financial self-service equipment.
Summary of the invention
In view of this, the present invention provides a kind of trading activity detection method and device, set with realizing to based on finance self-help
Standby abnormal trading activity is detected.
In a first aspect, the embodiment of the invention provides a kind of trading activity detection methods, comprising:
When detecting that active user is in proximity state relative to financial self-service equipment, the active user is obtained to institute
State the operation information that financial self-service equipment is operated；
Current sampling feature vectors are generated according to the operation information；
Based on statistical-simulation spectrometry technology, the phase short range of more current sampling feature vectors and default template characteristic vector
Degree identifies whether the corresponding behavior of the current sampling feature vectors is abnormal transaction class behavior, wherein the default template is special
Sign vector includes the preset template characteristic vector for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior.
Further, the operation information includes operating time information and action type information；Wherein, described according to
Operation information generates current sampling feature vectors, comprising:
Obtain the active user close to the financial self-service equipment time, as initial time；
It is calculated between the operation corresponding operating time and the time of the initial time according to the operating time information
Every；
The duration of proximity state is in relative to the financial self-service equipment according to the time interval, the active user
Current sampling feature vectors are generated with action type information.
It is further, described that current sampling feature vectors are generated according to the operation information, further includes:
Count the number and/or the amount of money of the held bank card historical trading of the active user；
Current sampling feature vectors are generated according to the operation information and the number and/or the amount of money.
Further, the close degree of the current sampling feature vectors and default template characteristic vector, according to than
Relatively result identifies whether the corresponding behavior of the current sampling feature vectors is abnormal transaction class behavior, comprising:
It is determined between the current sampling feature vectors and default template characteristic vector based on statistical-simulation spectrometry technology
Distance value；
Identify that the current sampling feature vectors are corresponding according to the relationship between the distance value and pre-determined distance value
Whether behavior is abnormal transaction class behavior.
Further, before detecting that active user is in proximity state relative to financial self-service equipment, further includes:
Acquire the sampling feature vectors for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior of preset quantity；
Sampling feature vectors collected are trained based on statistical-simulation spectrometry technology, obtain corresponding to arm's length dealing
The default template characteristic vector of class behavior and/or abnormal transaction class behavior.
Further, the operation information includes action type information, the action type information include insertion bank card,
Press beating keyboard or button, point touching screen, take out bank note, be put into bank note, take out bank card, non-contact card-reading apparatus read it is non-
Contact card information inputs biological characteristic recognition information, puts paper money mouth opening, putting the closing of paper money mouth, strip discharge and read two dimension
Code information.
Second aspect, the embodiment of the invention provides a kind of trading activity detection devices, comprising:
Operation information acquisition module, for detecting that active user is in proximity state relative to financial self-service equipment
When, obtain the operation information that the active user operates the financial self-service equipment；
Sampling feature vectors generation module, for generating current sampling feature vectors according to the operation information；
Feature vector comparison module is close with default template characteristic vector for the current sampling feature vectors
Degree identifies whether the corresponding behavior of the current sampling feature vectors is to steal card class behavior according to comparison result, wherein described
Default template characteristic vector include it is preset corresponding to the template characteristic of arm's length dealing class behavior and/or abnormal transaction class behavior to
Amount.
Further, the sampling feature vectors generation module includes:
Initial time acquiring unit, the time for obtaining the active user close to the financial self-service equipment, as
Initial time；
Time interval computing unit, for according to the operating time information calculate the operation corresponding operating time with
The time interval of the initial time；
First generation unit is used for according to the time interval, the active user relative to the financial self-service equipment
Duration and action type information in proximity state generate current sampling feature vectors.
Further, the sampling feature vectors generation module further include:
Statistic unit, for counting the number and/or the amount of money of the held bank card historical trading of the active user；
Second generation unit, it is special for generating current sample according to the operation information and the number and/or the amount of money
Levy vector.
Further, described eigenvector comparison module includes:
Distance determining unit, for determining the distance between the current sampling feature vectors and default template characteristic vector
Value；
Activity recognition unit, for identifying the current sample according to the relationship between the distance value and pre-determined distance value
Whether the corresponding behavior of eigen vector is abnormal transaction class behavior.
Further, the device further include:
Sampling feature vectors acquisition module, for detecting that active user is in relative to financial self-service equipment close to shape
Before state, the sampling feature vectors for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior of preset quantity are acquired；
Template characteristic vector determining module, for based on statistical-simulation spectrometry technology to sampling feature vectors collected into
Row training obtains the default template characteristic vector for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior.
Further, the operation information includes action type information, the action type information include insertion bank card,
Press beating keyboard or button, point touching screen, take out bank note, be put into bank note, take out bank card, non-contact card-reading apparatus read it is non-
Contact card information inputs biological characteristic recognition information, puts paper money mouth opening, putting the closing of paper money mouth, strip discharge and read two dimension
Code information.
A kind of trading activity detection scheme provided in an embodiment of the present invention, is detecting active user relative to finance self-help
When equipment is in proximity state, the operation information that active user operates financial self-service equipment is obtained, then according to operation
Information generates current sampling feature vectors, after current sampling feature vectors are compared with default template vector, according to comparing
As a result identify whether behavior corresponding to current sampling feature vectors is abnormal transaction class behavior.By using above-mentioned technical side
Case, financial self-service equipment can detecte out the abnormal transaction class behavior such as robber's card, and the perfect function of financial self-service equipment guarantees silver
The information security and fund security of row card user.
Detailed description of the invention
By reading a detailed description of non-restrictive embodiments in the light of the attached drawings below, of the invention other
Feature, objects and advantages will become more apparent upon:
Fig. 1 is a kind of flow chart for trading activity detection method that the embodiment of the present invention one provides；
Fig. 2 is a kind of flow chart of trading activity detection method provided by Embodiment 2 of the present invention；
Fig. 3 is a kind of flow chart for trading activity detection method that the embodiment of the present invention three provides；
Fig. 4 is a kind of structural block diagram for trading activity detection device that the embodiment of the present invention four provides.
Specific embodiment
The present invention is described in further detail with reference to the accompanying drawings and examples.It is understood that this place is retouched
The specific embodiment stated is used only for explaining the present invention rather than limiting the invention.It also should be noted that in order to just
In description, only some but not all contents related to the present invention are shown in the drawings.
It also should be noted that only the parts related to the present invention are shown for ease of description, in attached drawing rather than
Full content.It should be mentioned that some exemplary embodiments are described before exemplary embodiment is discussed in greater detail
At the processing or method described as flow chart.Although operations (or step) are described as the processing of sequence by flow chart,
It is that many of these operations can be implemented concurrently, concomitantly or simultaneously.In addition, the sequence of operations can be by again
It arranges.The processing can be terminated when its operations are completed, it is also possible to have the additional step being not included in attached drawing.
The processing can correspond to method, function, regulation, subroutine, subprogram etc..
Embodiment one
Fig. 1 is a kind of flow chart for trading activity detection method that the embodiment of the present invention one provides.The method of the present embodiment
It can be executed by trading activity detection device, wherein the device can be implemented by software and/or hardware, and can generally be integrated in finance certainly
It helps in equipment.As shown in Figure 1, trading activity detection method provided in this embodiment specifically comprises the following steps:
Step 110, when detecting that active user is in proximity state relative to financial self-service equipment, obtain active user
The operation information that financial self-service equipment is operated.
Wherein, financial self-service equipment can be the self-service devices such as ATM, automatic cash dispenser or access integral machine.
Preferably, it can use whether infrared sensor (the also known as nearly sensor of people) detection user sets close to finance self-help
It is standby.Specifically, when user is close to financial self-service equipment, certain a part of user's body can in infrared detection region,
The infrared ray that infrared emission tube in infrared sensor issues is blocked due to user can be reflected into infrared receiver tube, when infrared
After line reception pipe receives the infrared signal by user's reflection, that is, detect user close to the financial self-service equipment.It is hot
When outside line reception pipe does not receive the infrared signal reflected by user, that is, show that user leaves financial self-service equipment.User
Close in financial self-service equipment to the period left between financial self-service equipment, it can be considered that user sets relative to finance self-help
It is standby to be in proximity state.In addition, for detecting whether the sensor for having user close to financial self-service equipment is also possible to ultrasonic wave
Sensor.Its detection method is similar with infrared sensor, and details are not described herein again.
Illustratively, when sensor has detected that user is toward or away from financial self-service equipment, which can be logical
The user that financial self-service equipment carries out arm's length dealing is crossed, the user to be traded extremely by financial self-service equipment is also possible to,
Want taking out money in bank card as wanted to steal the criminal of bank card information or stolen bank card information
Offender etc..Different types of user is due to demand difference, so the operation carried out to financial self-service equipment is also different.Behaviour
It may include operating time information and action type information as information, wherein action type information may include financial self-service equipment institute energy
The operation enough detected.Illustratively, action type information can include: insertion bank card presses beating keyboard or button, point touching
Shield, take out bank note, be put into bank note, take out bank card, non-contact card-reading apparatus reads contactless card information, input biology is special
Sign identification information puts the operations such as paper money mouth is opened, puts the closing of paper money mouth, strip spues and reads two-dimensional barcode information.For example, if with
Family carries out withdrawal operation, the operation that user is carried out include: insertion bank card, by beating keyboard (input bank card password), by hitting
Button or point touching screen (selection type of transaction) press beating keyboard or button (selection withdrawal amount), take out bank note, press and hit button
Or the operation such as point touching screen (card is moved back in selection) and taking-up bank card.User to financial self-service equipment carry out aforesaid operations when,
Financial self-service equipment generally will receive corresponding instruction or information.For example, financial self-service equipment may be read into after insertion bank card
The operation that user has carried out insertion bank card then can be detected in bank card information；Or it is detected whether by infrared sensor
Card insertion, if so, then detecting that user has carried out the operation of insertion bank card.For another example, user presses beating keyboard or button
When, financial self-service equipment will receive accordingly by information is hit, then the behaviour that user press beating keyboard or button can be detected
Make.For example, criminal is when installing false keyboard on original keyboard of financial self-service equipment, if touching original keyboard, this
When, financial self-service equipment can also be detected by this operation of beating keyboard.For example, if offender wants to take out in bank card
Money, withdrawal mode may be performed in multiple times and the amount of money withdrawn cash every time is not very greatly that financial self-service equipment can detect that
Current bank, which was stuck within one day, carried out multiple withdrawal transaction.
Illustratively, when operating time information is corresponding when to may include active user carry out each operation to financial self-service equipment
Between point, can refer to the system time of Beijing time or financial self-service equipment to determine.
Step 120 generates current sampling feature vectors according to operation information.
Illustratively, active user is in the duration of proximity state as current sample characteristics relative to financial self-service equipment
An element in vector, determines the other elements in current sampling feature vectors according to operating time information.For example, can will work as
Time interval between the every two adjacent operation of preceding user is as the element in current sampling feature vectors；One can also be chosen
A reference time point (such as user close to financial self-service equipment at the time of), calculates each operation and the reference time point of active user
Between time interval, as the element in current sampling feature vectors.The present embodiment does not limit putting in order for each element
It is fixed, but should be consistent with putting in order for each element in default template characteristic vector described below, in order to be compared.
Under normal circumstances, when criminal carries out stealing card operation, criminal is seldom to the key of financial self-service equipment
Disk is operated, financial self-service equipment can be detected by sensors such as infrared rays criminal close to financial self-service equipment and from
The time of financial self-service equipment is opened, and calculates duration, an element in current sampling feature vectors is obtained, if being not detected
Any operation, then current sampling feature vectors can be generated according to the duration, the element of other positions can pass through certain way
Processing is configured, such as is supplied with default value (such as 0).Criminal sets to obtain bank card password in finance self-help
When installing false keyboard on standby original keyboard, if touching original keyboard, at this point, financial self-service equipment can also be detected by hitting
This operation of keyboard, can determine two elements in current sampling feature vectors, the element of other positions is according to above-mentioned side at this time
Formula is handled.
Step 130 identifies whether the corresponding behavior of current sampling feature vectors is abnormal based on statistical-simulation spectrometry technology
Transaction class behavior.
Wherein, the default template characteristic vector includes preset corresponding to arm's length dealing class behavior and/or abnormal transaction
The template characteristic vector of class behavior.
Illustratively, it can identify that current sampling feature vectors specifically can refer to based on above-mentioned based on statistical-simulation spectrometry technology
Current sampling feature vectors are carried out identification and classification by identification technology, can be found according to current sampling feature vectors and its approximate row
For classification, and the corresponding behavior classification of current sampling feature vectors is included into wherein.Illustratively, statistical model can also be based on
Identification technology determines the distance between the current sampling feature vectors and default template characteristic vector value, then according to it is described away from
Judge whether the corresponding behavior of the current sampling feature vectors is abnormal transaction from the relationship between value and pre-determined distance value
Class behavior.Wherein, the basic principle of statistical-simulation spectrometry (statistic pattern recognition) is: having similitude
Sample it is close to each other in model space, and form " group ", i.e., " things of a kind come together, people of a mind fall into the same group ".Its analysis method is surveyed according to mode
The feature vector, X obtainedi=(xi1,xi2,...,xid) a given mode is included into C class ω by T (i=1,2 ... N)1,
ω2,...ωcIn, then according to the distance between mode function come identification and classification.Wherein, T indicates transposition；N is sample points；d
For sample characteristics number.Specifically, can use the methods of Euclidean distance or mahalanobis distance comes judgement sample feature vector and mould
The close degree of plate features vector.Specifically, in the present embodiment, the behavior of user can be divided into two classes, i.e. arm's length dealing
Class and abnormal transaction class.By judging the corresponding feature vector of current behavior and arm's length dealing class behavior and/or abnormal transaction class
The corresponding feature vector of behavior apart from size, current behavior is sorted out.
It, can be working as specifically, in the close degree of more current sampling feature vectors and default template characteristic vector
Preceding sampling feature vectors are compared with the template characteristic vector of arm's length dealing class behavior, if gained distance and pre-determined distance are poor
Not smaller, then current behavior is arm's length dealing class behavior；If gained is larger apart from difference, current behavior is abnormal transaction class
Behavior.Specifically, also current sampling feature vectors are handed over the template characteristic vector sum of arm's length dealing class behavior can extremely respectively
The template characteristic vector of easy class behavior is compared, if be less than with the distance value of the template characteristic vector of arm's length dealing class behavior
With the distance value of abnormal transaction class template feature vector, then current behavior is arm's length dealing class behavior, otherwise is abnormal transaction class
Behavior.
Further, arm's length dealing class can be divided into withdrawal class, deposit class and remittance class etc. again.Current sample can be determined respectively
Feature vector is worth with withdrawal class, deposit class and the distance between corresponding default template characteristic vectors such as class of remitting money, if with any
A kind of the distance between the corresponding default template characteristic vector of arm's length dealing class value meets the requirements (such as less than a certain distance value),
It is regarded as arm's length dealing class behavior；If distance value is undesirable, it is believed that be abnormal transaction class behavior.
Further, abnormal transaction class behavior can be divided into again steals card class behavior and non-robber's card class exception trading activity.When logical
When crossing the comparison of distance and identifying that the behavior of active user belongs to abnormal transaction class behavior, can respectively with steal card class behavior and non-
The template characteristic vector for stealing the exception trading activity of card class is compared.By comparing after, if recognition result and steal card class behavior away from
Close from relatively, then otherwise it is non-robber's card class exception trading activity that the behavior of active user, which can be determined as stealing card class behavior,.
The trading activity detection method that the embodiment of the present invention one provides is detecting that active user sets relative to finance self-help
When for being in proximity state, the operation information that active user operates financial self-service equipment is obtained, is then believed according to operation
Breath generates current sampling feature vectors.After current sampling feature vectors are compared with default template vector, according to than
Relatively result identifies whether behavior corresponding to current sampling feature vectors is abnormal transaction class behavior.By using above-mentioned technology
Scheme, financial self-service equipment can detecte out the abnormal transaction class behavior such as robber's card, and the perfect function of financial self-service equipment guarantees
The information security and fund security of bank card user.
On the basis of the above embodiments, current sampling feature vectors pair are judged according to comparison result if may also include that
The behavior answered is abnormal transaction class behavior, then carries out warning processing.Alert process may include to corresponding with financial self-service equipment
Background server, which is sent, detects the information warning of abnormal trading activity, so as to staff and alarm arrest criminal or
Person removes robber's card relevant apparatus on financial self-service equipment etc. in time, ensures safety when normal users use financial self-service equipment
Property.
Embodiment two
Fig. 2 is a kind of flow chart of trading activity detection method provided by Embodiment 2 of the present invention.The present embodiment is to implementation
Step " generating current sampling feature vectors according to operation information " in example one is optimized.With reference to Fig. 2, the embodiment of the present invention
Specifically comprise the following steps:
Step 210, when detecting that active user is in proximity state relative to financial self-service equipment, obtain active user
The operation information that financial self-service equipment is operated.
Step 220, obtain active user close to financial self-service equipment time, as initial time.
Step 230, according to the time interval of operation information calculating operation corresponding operating time and initial time.
When sensor detects user close to financial self-service equipment, associated components (such as controller) in financial self-service equipment
Current time be will record as initial time, i.e., 0 point of subsequent timing.When user carries out arm's length dealing, financial self-service equipment
It often detects that user operates it, will record the time of lower current operation, and calculate between the time with initial time
Every.Specifically, the infrared sensor of financial self-service equipment card inserting mouth can detect plug-in card, and this is dynamic when user is inserted into bank card
Make, then infrared sensor can pass to the signal detected related controller, will record current card action in controller
At the time of, then calculate the time interval of the card action Yu at 0 point.The time of other movements and initial time that user withdraws the money
The record at interval is similar with plug-in card This move.
In the present embodiment, operation includes the set that may be operated all to financial self-service equipment, so not necessarily only
It is confined to withdraw the money.I.e. if do not had in the operation being currently able to detect that comprising a certain step or the operation of a few steps in operation,
The time interval of that step or a few steps for then corresponding to operation can be denoted as 0.For example, it is put into bank note this operation in operation, but
It is not need to carry out this single stepping during withdrawal, then the time interval for being put into bank note this operation and initial time
It is denoted as 0.
Step 240, duration and the behaviour for being in proximity state relative to financial self-service equipment according to time interval, active user
Make type information and generates current sampling feature vectors.
Illustratively, if criminal has touched original key of financial self-service equipment during installing false keyboard
Disk, and when other operations are not detected in financial self-service equipment, then the element in current sampling feature vectors includes criminal's touching
When encountering keyboard and the time interval of initial time and criminal and financial self-service equipment are in the duration of proximity state.
Illustratively, when offender steals money in bank card by financial self-service equipment, the offender's
Withdrawal mode may be performed in multiple times, and withdrawing the money every time may not be using same bank card.Therefore, finance self-help is set
Standby current sampling feature vectors generated may also comprise the total degree traded in same bank card one day and total amount or same
The total degree that one user trades within a preset period of time.
Step 250 identifies whether the corresponding behavior of current sampling feature vectors is abnormal based on statistical-simulation spectrometry technology
Transaction class behavior.
Wherein, the default template characteristic vector include it is preset correspond to arm's length dealing class behavior and/or steal card class row
For template characteristic vector.
The embodiment of the present invention two on the basis of the above embodiments, will " according to operation information generate current sample characteristics to
The process of amount " is refined, and calculates operation corresponding operating time and starting according to the temporal information of user's current operation
The time interval at moment, then generates sampling feature vectors, can further improve the accuracy of the abnormal transaction class behavior of detection, mentions
Safety of the high user in financial transaction.
Further, generating current sampling feature vectors also according to the temporal information may include: that statistics is described current
The number and/or the amount of money of the held bank card historical trading of user；It is raw according to the operation information and the number and/or the amount of money
At current sampling feature vectors.
Illustratively, if the held bank card of active user intraday transaction count more than once, finance self-help is set
It is standby to add up to the bank card business dealing number, and record total degree and total amount conduct that the bank card is traded in one day
Two elements in current sampling feature vectors.
Further, generating current sampling feature vectors also according to the operation information may include: to active user's
Identity is identified, and obtains the quantity that active user uses bank card within a preset period of time；Believed according to the operating time
Breath, the active user are in the duration of proximity state and the quantity life of the bank card relative to the financial self-service equipment
At current sampling feature vectors.
Illustratively, financial self-service equipment can by the information of the held bank card of active user to the identity of active user into
Row identification, or the face identification device by being mounted on financial self-service equipment identify active user.When finance self-help is set
It is standby when counting active user and being more than preset quantity threshold value using the quantity of bank card (in such as one day) within a preset period of time, then
The transaction of active user can also be used as one kind of abnormal transaction class behavior.Wherein, preset time period can be arbitrarily arranged.Present count
Amount threshold value can specifically be embodied in the corresponding default template characteristic vector of arm's length dealing class behavior.
Embodiment three
Fig. 3 is a kind of flow chart for trading activity detection method that the embodiment of the present invention three provides.The present embodiment is to above-mentioned
In embodiment " detecting that active user is in proximity state relative to financial self-service equipment " before process be optimized.
With reference to Fig. 3, the embodiment of the present invention specifically comprises the following steps:
The sample spy for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior of step 310, acquisition preset quantity
Levy vector.
Step 320 is trained sampling feature vectors collected based on statistical-simulation spectrometry technology, is corresponded to
The default template characteristic vector of arm's length dealing class behavior and/or abnormal transaction class behavior.
Illustratively, presetting template characteristic vector can be the sampling feature vectors that user carries out arm's length dealing class behavior,
It is also possible to the sampling feature vectors that criminal carries out abnormal transactional operation, or the sample of arm's length dealing class behavior is special
The sampling feature vectors of vector sum transaction class behavior extremely are levied simultaneously as default template characteristic vector.Specifically, acquisition is certain
The sampling feature vectors of the arm's length dealing class behavior of quantity, such as withdrawal, deposit or the remittance of the people of different age group can be acquired
Money movement, and consider that in movement collection process, some pictures such as forget Password at the emergency cases.Collect arm's length dealing behavior
After movement, financial self-service equipment, which is acted, is converted into sampling feature vectors, is then located in advance to these sampling feature vectors
Reason, such as some feature vectors very big with the time interval difference of other arm's length dealing classes movement can be abandoned, and then extract
Some conventional sampling feature vectors of arm's length dealing class behavior out.After the pre-treatment, can sample to arm's length dealing class behavior it is special
Sign vector set is trained, and trained method can be trained by Bayes classifier in statistical-simulation spectrometry, can also
To be trained by other modes such as neural network filters.By training, optimal arm's length dealing class behavior is selected
Default template characteristic vector of the sampling feature vectors as arm's length dealing class behavior.Illustratively, abnormal transaction class behavior is pre-
If the generating mode of template characteristic vector is similar with the default template characteristic vector of arm's length dealing class behavior.It is worth noting that,
During default template characteristic vector generates, also statistics available the held bank card of each user of financial self-service equipment is in one day
Transaction count and the amount of money, and determine according to the transaction count of most users and the amount of money the default mould of arm's length dealing class behavior
The value of corresponding two elements in plate features vector determines abnormal transaction class according to the transaction count of only a few user and the amount of money
The value of corresponding two elements in the default template characteristic vector of behavior.The selection of default template characteristic vector is to a certain extent
The probability for detecting abnormal trading activity can be improved.
Step 330, when detecting that active user is in proximity state relative to financial self-service equipment, obtain active user
The operating time information that financial self-service equipment is operated.
Step 340, obtain active user close to financial self-service equipment time, as initial time.
Step 350, according to the time interval of operating time information calculating operation corresponding operating time and initial time.
Step 360, duration and the behaviour for being in proximity state relative to financial self-service equipment according to time interval, active user
Make type information and generates current sampling feature vectors.
Step 370 identifies whether the corresponding behavior of current sampling feature vectors is abnormal based on statistical-simulation spectrometry technology
Transaction class behavior.
Wherein, the default template characteristic vector includes preset corresponding to arm's length dealing class behavior and/or abnormal transaction
The template characteristic vector of class behavior.
The present embodiment three on the basis of the above embodiments, at detecting active user relative to financial self-service equipment
Process before proximity state is optimized, by acquiring the feature vector of a certain number of arm's length dealing class behaviors and different
Often after the feature vector of transaction class behavior, default template characteristic vector is obtained by training.Then compare user's current behavior pair
The close degree between sampling feature vectors and default template characteristic vector answered, so identify user's current operation whether be
Abnormal transaction class behavior.By using above-mentioned technical proposal, it may be determined that go out accurately default template characteristic vector, improve subsequent inspection
The accuracy of the abnormal transaction class behavior of survey, it is successful several that reduction criminal robber blocks or steal the transaction extremely such as money in bank card
Rate improves safety of the user in financial transaction.
Example IV
Fig. 4 is a kind of structural block diagram for trading activity detection device that the embodiment of the present invention four provides, which can be by soft
Part and/or hardware realization are typically integrated in finance self-help system.As shown in figure 4, the system includes: operation information acquisition mould
Block 401, sampling feature vectors generation module 402 and feature vector comparison module 403.
Wherein, operation information acquisition module 401, for detect active user relative to financial self-service equipment be in connect
When nearly state, the operation information that the active user operates the financial self-service equipment is obtained.
Sampling feature vectors generation module 402, for generating current sampling feature vectors according to the operation information.
Feature vector comparison module 403, it is corresponding based on the statistical-simulation spectrometry technology identification current sampling feature vectors
Behavior whether be abnormal transaction class behavior, wherein the default template characteristic vector includes preset corresponding to arm's length dealing
The template characteristic vector of class behavior and/or abnormal transaction class behavior.
The trading activity detection device that the embodiment of the present invention four provides is detecting that active user sets relative to finance self-help
When for being in proximity state, the operation that active user operates financial self-service equipment is obtained by operation information acquisition module
Then information generates current sampling feature vectors according to operation information.By feature vector comparison module current sample characteristics
After vector is compared with default template vector, according to comparison result identify current sampling feature vectors corresponding to behavior be
No is abnormal trading activity.By using above-mentioned technical proposal, financial self-service equipment can detecte out the abnormal transaction class such as robber's card
Behavior, the perfect function of financial self-service equipment, guarantees the information security and fund security of bank card user.
On the basis of the above embodiments, sampling feature vectors generation module includes: initial time acquiring unit, for obtaining
Take the active user close to the time of the financial self-service equipment, as initial time；Time interval computing unit is used for root
The time interval of the operation corresponding operating time and the initial time are calculated according to the operating time information；First generates
Unit, for according to the time interval, the active user relative to the financial self-service equipment be in proximity state when
Long-living and action type information is at current sampling feature vectors.
On the basis of the above embodiments, sampling feature vectors generation module further include: statistic unit, it is described for counting
The number and/or the amount of money of the held bank card historical trading of active user；
Second generation unit, it is special for generating current sample according to the operation information and the number and/or the amount of money
Levy vector.
On the basis of the above embodiments, feature vector comparison module includes: distance determining unit, for working as described in determination
The distance between preceding sampling feature vectors and default template characteristic vector value；Activity recognition unit, for according to the distance value
Relationship between pre-determined distance value is come whether identify the corresponding behavior of the current sampling feature vectors be abnormal transaction class row
For.
It on the basis of the above embodiments, further include sampling feature vectors acquisition module, for detecting active user
Before being in proximity state relative to financial self-service equipment, acquire preset quantity corresponds to arm's length dealing class behavior and/or different
The often sampling feature vectors of transaction class behavior；
Template characteristic vector determining module, for based on statistical-simulation spectrometry technology to sampling feature vectors collected into
Row training obtains the default template characteristic vector for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior.
On the basis of the above embodiments, the operation information includes action type information, the action type packet
Insertion bank card is included, beating keyboard or button, point touching screen is pressed, takes out bank note, be put into bank note, take out bank card, non-contact reading
Card apparatus reads contactless card information, inputs biological characteristic recognition information, puts paper money mouth and open, put that paper money mouth is closed, strip spits
Out and read two-dimensional barcode information.
Transaction provided by any embodiment of the invention can be performed in the trading activity detection device provided in above-described embodiment
Behavioral value method has the corresponding functional module of execution method and beneficial effect.Not detailed description in the above-described embodiments
Technical detail, reference can be made to trading activity detection method provided by any embodiment of the invention.
Note that the above is only a better embodiment of the present invention and the applied technical principle.It will be appreciated by those skilled in the art that
The invention is not limited to the specific embodiments described herein, be able to carry out for a person skilled in the art it is various it is apparent variation,
It readjusts and substitutes without departing from protection scope of the present invention.Therefore, although being carried out by above embodiments to the present invention
It is described in further detail, but the present invention is not limited to the above embodiments only, without departing from the inventive concept, also
It may include more other equivalent embodiments, and the scope of the invention is determined by the scope of the appended claims.
Claims (10)
1. a kind of trading activity detection method characterized by comprising
When detecting that active user is in proximity state relative to financial self-service equipment, the active user is obtained to the gold
Melt the operation information that self-service device is operated；
Current sampling feature vectors are generated according to the operation information；
Based on statistical-simulation spectrometry technology, the close degree of more current sampling feature vectors and default template characteristic vector is known
Whether the corresponding behavior of not described current sampling feature vectors is abnormal transaction class behavior, wherein the default template characteristic to
Amount includes the preset template characteristic vector for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior；
Wherein, the operation information includes operating time information and action type information；
Current sampling feature vectors are generated according to the operation information, comprising:
Obtain the active user close to the financial self-service equipment time, as initial time；
The time interval of the operation corresponding operating time and the initial time are calculated according to the operating time information；
Duration and the behaviour of proximity state are in relative to the financial self-service equipment according to the time interval, the active user
Make type information and generates current sampling feature vectors.
2. the method according to claim 1, wherein described generate current sample characteristics according to the operation information
Vector, further includes: count the number and/or the amount of money of the held bank card historical trading of the active user；
Current sampling feature vectors are generated according to the operation information and the number and/or the amount of money.
3. the method according to claim 1, wherein identifying the current sample based on statistical-simulation spectrometry technology
Whether the corresponding behavior of feature vector is abnormal transaction class behavior, comprising:
Determine the distance between the current sampling feature vectors and default template characteristic vector value；
The corresponding behavior of the current sampling feature vectors is identified according to the relationship between the distance value and pre-determined distance value
It whether is abnormal transaction class behavior.
4. the method according to claim 1, wherein at detecting active user relative to financial self-service equipment
Before proximity state, further includes:
Acquire the sampling feature vectors for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior of preset quantity；
Sampling feature vectors collected are trained based on statistical-simulation spectrometry technology, obtain corresponding to arm's length dealing class row
For and/or abnormal transaction class behavior default template characteristic vector.
5. the method according to claim 1, wherein the operation information includes action type information, the behaviour
Make type information to include insertion bank card, press beating keyboard or button, point touching screen, take out bank note, be put into bank note, take out bank
Card, non-contact card-reading apparatus read contactless card information, input biological characteristic recognition information, put paper money mouth opening, put paper money mouth
It closes, strip spues and read two-dimensional barcode information.
6. a kind of trading activity detection device characterized by comprising
Operation information acquisition module, for obtaining when detecting that active user is in proximity state relative to financial self-service equipment
The operation information for taking the active user to operate the financial self-service equipment；
Sampling feature vectors generation module, for generating current sampling feature vectors according to the operation information；
Feature vector comparison module, for being based on statistical-simulation spectrometry technology, more current sampling feature vectors and default template
The close degree of feature vector identifies whether the corresponding behavior of the current sampling feature vectors is abnormal transaction class behavior,
In, the default template characteristic vector includes the preset mould for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior
Plate features vector；
Wherein, the operation information includes operating time information and action type information；
Wherein, the sampling feature vectors generation module includes:
Initial time acquiring unit, the time for obtaining the active user close to the financial self-service equipment, as starting
Moment；
Time interval computing unit, for according to the operating time information calculate the operation corresponding operating time with it is described
The time interval of initial time；
First generation unit, for being according to the time interval, the active user relative to the financial self-service equipment
The duration and action type information of proximity state generate current sampling feature vectors.
7. device according to claim 6, which is characterized in that the sampling feature vectors generation module further include:
Statistic unit, for counting the number and/or the amount of money of the held bank card historical trading of the active user；
Second generation unit, for according to the operation information and the number and/or the amount of money generate current sample characteristics to
Amount.
8. device according to claim 6, which is characterized in that described eigenvector comparison module includes:
Distance determining unit, for determining the distance between the current sampling feature vectors and default template characteristic vector value；
Activity recognition unit, for identifying that the current sample is special according to the relationship between the distance value and pre-determined distance value
Whether the corresponding behavior of sign vector is abnormal transaction class behavior.
9. device according to claim 6, which is characterized in that further include:
Sampling feature vectors acquisition module, for detect active user relative to financial self-service equipment be in proximity state it
Before, acquire the sampling feature vectors for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior of preset quantity；
Template characteristic vector determining module, for being instructed based on statistical-simulation spectrometry technology to sampling feature vectors collected
Practice, obtains the default template characteristic vector for corresponding to arm's length dealing class behavior and/or abnormal transaction class behavior.
10. device according to claim 6, which is characterized in that the operation information includes action type information, the behaviour
Make type information to include insertion bank card, press beating keyboard or button, point touching screen, take out bank note, be put into bank note, take out bank
Card, non-contact card-reading apparatus read contactless card information, input biological characteristic recognition information, put paper money mouth opening, put paper money mouth
It closes, strip spues and read two-dimensional barcode information.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610705443.XA CN106340138B (en) | 2016-08-23 | 2016-08-23 | A kind of trading activity detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610705443.XA CN106340138B (en) | 2016-08-23 | 2016-08-23 | A kind of trading activity detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106340138A CN106340138A (en) | 2017-01-18 |
| CN106340138B true CN106340138B (en) | 2019-08-27 |
Family
ID=57825434
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610705443.XA Expired - Fee Related CN106340138B (en) | 2016-08-23 | 2016-08-23 | A kind of trading activity detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106340138B (en) |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106997635A (en) * | 2017-03-03 | 2017-08-01 | 深圳怡化电脑股份有限公司 | The detection method and its device of a kind of note surface foreign matter |
| CN109214224B (en) * | 2017-06-30 | 2022-05-27 | 阿里巴巴集团控股有限公司 | Risk identification method and device for information coding |
| CN107609772B (en) * | 2017-09-08 | 2021-07-27 | 新智云数据服务有限公司 | Data processing method and device for gas filling of user |
| CN108053214B (en) * | 2017-12-12 | 2021-11-23 | 创新先进技术有限公司 | False transaction identification method and device |
| CN108682088A (en) * | 2018-05-14 | 2018-10-19 | 平安科技（深圳）有限公司 | Based on the cross-border determination method and device merchandised extremely of ATM |
| CN108960833B (en) * | 2018-08-10 | 2022-03-11 | 哈尔滨工业大学（威海） | Abnormal transaction identification method, equipment and storage medium based on heterogeneous financial characteristics |
| CN113705493A (en) * | 2021-09-01 | 2021-11-26 | 浙江大华技术股份有限公司 | Method and device for detecting financial transaction abnormal behavior and readable storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101299285A (en) * | 2007-12-11 | 2008-11-05 | 北京印刷学院 | Bank abnormity draw money detector and method thereof |
| CN103544429A (en) * | 2012-07-12 | 2014-01-29 | 中国银联股份有限公司 | Anomaly detection device and method for security information interaction |
| CN103699823A (en) * | 2014-01-08 | 2014-04-02 | 同济大学 | Identity authentication system based on user behavior pattern and method thereof |
| CN104794484A (en) * | 2015-04-07 | 2015-07-22 | 浙江大学 | Time series data nearest-neighbor classifying method based on subsection orthogonal polynomial decomposition |
| CN105005901A (en) * | 2015-07-09 | 2015-10-28 | 厦门快商通信息技术有限公司 | Financial field oriented transaction fraud detection system and method |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101561866B (en) * | 2009-05-27 | 2011-04-20 | 上海交通大学 | Character recognition method based on SIFT feature and gray scale difference value histogram feature |
| CN101944174B (en) * | 2009-07-08 | 2012-06-27 | 西安电子科技大学 | Identification method of characters of licence plate |
| CN104545890B (en) * | 2014-12-30 | 2017-08-25 | 深圳先进技术研究院 | A kind of personal identification method and device based on electrocardiosignal |
-
2016
- 2016-08-23 CN CN201610705443.XA patent/CN106340138B/en not_active Expired - Fee Related
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101299285A (en) * | 2007-12-11 | 2008-11-05 | 北京印刷学院 | Bank abnormity draw money detector and method thereof |
| CN103544429A (en) * | 2012-07-12 | 2014-01-29 | 中国银联股份有限公司 | Anomaly detection device and method for security information interaction |
| CN103699823A (en) * | 2014-01-08 | 2014-04-02 | 同济大学 | Identity authentication system based on user behavior pattern and method thereof |
| CN104794484A (en) * | 2015-04-07 | 2015-07-22 | 浙江大学 | Time series data nearest-neighbor classifying method based on subsection orthogonal polynomial decomposition |
| CN105005901A (en) * | 2015-07-09 | 2015-10-28 | 厦门快商通信息技术有限公司 | Financial field oriented transaction fraud detection system and method |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106340138A (en) | 2017-01-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106340138B (en) | A kind of trading activity detection method and device | |
| US10629036B2 (en) | Surveillance device | |
| TWI689942B (en) | Man-machine recognition method and device, and method and device for collecting behavior characteristic data | |
| US10878430B1 (en) | Anti-skimming card reader computing device | |
| US20170140138A1 (en) | Behavior based authentication for touch screen devices | |
| CN108140123A (en) | Face living body detection method, electronic device and computer program product | |
| CN113366487A (en) | Operation determination method and device based on expression group and electronic equipment | |
| US20140347479A1 (en) | Methods, Systems, Apparatuses, Circuits and Associated Computer Executable Code for Video Based Subject Characterization, Categorization, Identification, Tracking, Monitoring and/or Presence Response | |
| CN109462691B (en) | Implicit protection method and system based on multi-sensor data fusion | |
| CN105957271A (en) | Financial terminal safety protection method and system | |
| CN105224849A (en) | A kind of multi-biological characteristic merges authentication identifying method and device | |
| CN101558431A (en) | Face authentication device | |
| Li | Eye blink detection based on multiple Gabor response waves | |
| Soltani et al. | A new user-based model for credit card fraud detection based on artificial immune system | |
| CN102855496A (en) | Method and system for authenticating shielded face | |
| Sikandar et al. | ATM crime detection using image processing integrated video surveillance: a systematic review | |
| CN103324912A (en) | Face recognition system and method for ATM | |
| CN109345375A (en) | A kind of suspicious money laundering Activity recognition method and device | |
| CN111539740A (en) | Payment method, device and equipment | |
| CN104424721B (en) | Recognition methods is blocked in a kind of face of combination ATM | |
| CN103049736A (en) | Face identification method based on maximum stable extremum area | |
| US11501303B2 (en) | Utilizing card movement data to identify fraudulent transactions | |
| CN106055948B (en) | User's identification system and the method for recognizing user | |
| CN105335630B (en) | Personal identification method and identity recognition device | |
| Himaga et al. | Finger vein authentication technology and financial applications |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20190827 Termination date: 20210823 |