JP7189252B2 - Analysis device, analysis method and analysis program - Google Patents

Description

The present invention relates to an analysis device, an analysis method, and an analysis program.

Conventionally, financial services provided via APIs (Application Programming Interfaces) are known. In addition, in the service provided via API, a new request is generated based on the API request sent from the terminal of the service user, and the terminal is requested to perform redirection using the generated request. An API processing method may be used.

Japanese Unexamined Patent Application Publication No. 2017-33221

However, conventional techniques have the problem that it can be difficult to detect fraudulent use in financial services. For example, detailed information about credit card transactions in financial services may be protected and unavailable. As a result, it becomes difficult to detect fraudulent credit card payments.

In order to solve the above-mentioned problems and achieve the purpose, the analysis device interprets the API request sent from the terminal and converts the log of the gateway device that causes the server to provide financial services into data in a predetermined format. The present invention is characterized by comprising a conversion unit and a detection unit that detects, from the data converted by the conversion unit, an event that satisfies a predetermined condition regarding unauthorized use of the financial service.

According to the present invention, fraudulent use in financial services can be detected.

FIG. 1 is a diagram showing a configuration example of a service providing system. FIG. 2 is a diagram for explaining the analysis method by the analysis device. FIG. 3 is a diagram showing a configuration example of an analysis device. FIG. 4 is a diagram illustrating conversion into a graph. FIG. 5 is a diagram showing an example of graph data. FIG. 6 is a flow chart showing the flow of processing of the analyzer according to the first embodiment. FIG. 7 is a diagram showing an example of a computer that executes an analysis program.

EMBODIMENT OF THE INVENTION Below, embodiment of the analysis apparatus which concerns on this application, an analysis method, and an analysis program is described in detail based on drawing. In addition, this invention is not limited by embodiment described below.

[Configuration of the first embodiment]
First, using FIG. 1, the configuration of a service providing system including an analysis device will be described. FIG. 1 is a diagram showing a configuration example of a service providing system.

As shown in FIG. 1, a service providing system 1 is a system for providing various services to service users using the Internet.

In the example of FIG. 1, the service user executes the API from the terminal 10 and receives services provided by the server 30 . For example, terminal 10 is a smart phone or a personal computer.

The service providing system 1 can provide various services such as IT infrastructure services, financial services, and eating and drinking services. For example, an IT infrastructure service is a service that allows a user to use a server or the like on a network. Also, for example, the financial service is a service for online settlement of credit card payments. Also, for example, a food service is a service for ordering products in a restaurant via a network.

First, the terminal 10 transmits a request (for example, an HTTP request) according to the content of the service to be used to the Internet. Here, the request transmitted by terminal 10 is received by gateway device 20 .

The gateway device 20 extracts a query string from the URL included in the received request and decodes the extracted query string. Then, the gateway device 20 requests the terminal 10 to redirect based on the decrypted query string.

Terminal 10 executes redirection according to the request of gateway device 20 . At this time, the request generated by redirection is sent to the server 30 . The server 30 executes a predetermined application related to service provision based on the received request.

Here, the analysis device 40 acquires service usage logs from the gateway device 20 . The analysis device 40 then uses the acquired service usage log to perform analysis for detecting unauthorized use of the service.

FIG. 2 is a diagram for explaining the analysis method by the analysis device. As shown in FIG. 2, the analysis device 40 converts service usage logs acquired from the gateway device 20 into a DB (database). For example, the analysis device 40 converts the service usage log into graph data and creates a DB.

Then, the analysis device 40 detects the risk based on the DB and notifies the terminal 50 of the service operator of the detection result.

FIG. 3 is a diagram showing a configuration example of an analysis device. As shown in FIG. 3 , the analysis device 40 has a communication section 41 , a storage section 42 and a control section 43 .

The communication unit 41 performs data communication with devices such as the gateway device 20 via a network. For example, the communication unit 41 is a NIC (Network Interface Card).

The storage unit 42 is a storage device such as a HDD (Hard Disk Drive), an SSD (Solid State Drive), an optical disc, or the like. Note that the storage unit 42 may be a rewritable semiconductor memory such as a RAM (Random Access Memory), a flash memory, or an NVSRAM (Non Volatile Static Random Access Memory).

The storage unit 42 stores an OS (Operating System) and various programs executed by the analysis device 40 . The storage unit 42 stores log information 422 and detection information 423 . The log information 422 is a DBized service usage log, such as graph data. Further, the detection information 423 is the detection result of unauthorized use.

The control unit 43 controls the analysis device 40 as a whole. The control unit 43 includes, for example, electronic circuits such as CPU (Central Processing Unit), MPU (Micro Processing Unit), GPU (Graphics Processing Unit), ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array), etc. It is an integrated circuit. The control unit 43 also has an internal memory for storing programs defining various processing procedures and control data, and executes each processing using the internal memory.

Further, the control unit 43 functions as various processing units by running various programs. For example, the control unit 43 has a conversion unit 431 , a detection unit 432 , an addition unit 433 and a notification unit 434 .

The conversion unit 431 converts the service usage log of the gateway device 20 that causes the server 30 to provide financial services based on the result of interpreting the API request sent from the terminal 10 into data in a predetermined format.

It can be said that the gateway device 20 interprets the API request by decoding the query string extracted from the URL.

FIG. 4 is a diagram illustrating conversion into a graph. The conversion unit 431 converts the service usage log into graph data having three types of nodes: "IP address", "credit card", and "affiliated store".

The "IP address" corresponds to the IP address of the terminal 10 used by the user who makes the credit card payment. "Credit card" corresponds to the credit card used by the user and is identified by the credit card number or the like. A "member store" is an object to which payment is made by credit card settlement. Each processing related to credit card settlement is performed by the server 30 executing an API. Also, an edge between nodes means that there was a transaction. Transactions include requests for settlement, deposits, and the like.

Also, when there are multiple transactions from one node to another node, multiple edges are arranged between the nodes as shown in FIG.

FIG. 5 is a diagram showing an example of graph data. As an example, the conversion unit 431 converts the service usage log into graph data as shown in FIG.

The detection unit 432 detects, from the data converted by the conversion unit 431, an event that satisfies a predetermined condition regarding fraudulent use of financial services.

The detection unit 432 can detect that payment has been made from an IP address that does not have a history of using a credit card. This corresponds to the generation of a new edge between the "IP address" node and the "credit card" node in the graph of FIG. 5, for example.

The detection unit 432 detects that multiple credit card payments have been made from one IP address. For example, FIG. 5 shows that payments have been made from “IP Address” node 712 to “Credit Card” nodes 722 and 723 .

The detection unit 432 detects that payment has been made using a credit card with a history of refunds. As a result, the detection unit 432 detects fraud such as repeated refunds.

The detection unit 432 detects that a predetermined condition regarding the member store where the payment has been made is satisfied. For example, if one credit card is used at a number of affiliated stores within a certain period of time, there is a possibility that it has been used fraudulently.

For example, the detection unit 432 detects that the distance between locations of member stores corresponding to the "member store" nodes 734 and 735 having an edge with the "credit card" node 722 in FIG. .

Also, the detection unit 432 detects the occurrence of a transaction that is not recorded by the member store. For example, an edge exists between the "Credit Card" node 724 and the "Merchant" node 736 in FIG. 5, but an edge does not exist between the "Credit Card" node 724 and the "IP Address" node. The detection unit 432 detects such an event as the occurrence of a transaction that is not recorded by the member store.

In addition, the detection unit 432 determines that the payment amount between the "IP address" node and the "credit card" node does not match the payment amount between the corresponding "credit card" node and the "merchant" node. detect that

The adder 433 regards the event detected by the detector 432 as a risk and adds points to the associated nodes. The higher the number of points, the higher the possibility of fraudulent use.

The notification unit 434 notifies the operator of the detection result. For example, information about a node whose points added by the adder 433 have exceeded a certain value is notified.

[Processing of the first embodiment]
FIG. 6 is a flow chart showing the flow of processing of the analyzer according to the first embodiment. As shown in FIG. 6, the analysis device 40 first converts the service usage log of the gateway device 20 into graph data (step S101).

Next, analysis device 40 detects risk from the graph data (step S102). Then, the analysis device 40 adds points to the nodes of the graph data according to the risk (step S103).

The analysis device 40 then notifies the operator of the detection result (step S104).

[Effects of the first embodiment]
As described above, the conversion unit 431 converts the log of the gateway device 20, which causes the server to provide financial services based on the result of interpreting the API request sent from the terminal 10, into data in a predetermined format. The detection unit 432 detects, from the data converted by the conversion unit 431, an event that satisfies a predetermined condition regarding fraudulent use of financial services.

By referring to the log of the gateway device 20, the analysis device 40 can obtain information on the difficult-to-obtain credit card settlement. Therefore, according to this embodiment, fraudulent use of financial services can be detected.

The conversion unit 431 converts the log into a graph in which the IP address of the payment source, the credit card, and the member store are set as nodes, and the transactions between the nodes are set as edges. As a result, detection can be performed using existing graph analysis methods such as counting the number of edges.

The detection unit 432 detects that payment has been made from an IP address that does not have a history of using a credit card. This makes it possible to detect fraudulent payment by forged credit cards or the like.

The detection unit 432 detects that multiple credit card payments have been made from one IP address. This makes it possible to detect fraudulent payments due to theft of credit cards or the like.

The detection unit 432 detects that payment has been made using a credit card with a history of refunds. This makes it possible to detect fraudulent refunds.

The detection unit 432 detects that a predetermined condition regarding the member store where the payment has been made is satisfied. This makes it possible to detect fraudulent processing by member stores.

[System configuration, etc.]
Also, each component of each device illustrated is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution and integration of each device is not limited to the illustrated one, and all or part of them can be functionally or physically distributed or Can be integrated and configured. Furthermore, all or any part of each processing function performed by each device can be implemented by a CPU and a program analyzed and executed by the CPU, or implemented as hardware based on wired logic. Note that the program may be executed not only by the CPU but also by other processors such as a GPU.

Further, among the processes described in the present embodiment, all or part of the processes described as being automatically performed can be performed manually, or the processes described as being performed manually can be performed manually. All or part of this can also be done automatically by known methods. In addition, information including processing procedures, control procedures, specific names, and various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified.

[program]
As one embodiment, the analysis device 40 can be implemented by installing an analysis program that executes the above analysis processing as package software or online software on a desired computer. For example, the information processing device can function as the analysis device 40 by causing the information processing device to execute the above analysis program. The information processing apparatus referred to here includes a desktop or notebook personal computer. In addition, information processing devices include mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone Systems), and slate terminals such as PDAs (Personal Digital Assistants).

FIG. 7 is a diagram showing an example of a computer that executes an analysis program. The computer 1000 has a memory 1010 and a CPU 1020, for example. Computer 1000 also has hard disk drive interface 1030 , disk drive interface 1040 , serial port interface 1050 , video adapter 1060 and network interface 1070 . These units are connected by a bus 1080 .

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012 . The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). Hard disk drive interface 1030 is connected to hard disk drive 1090 . A disk drive interface 1040 is connected to the disk drive 1100 . A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100 . Serial port interface 1050 is connected to mouse 1110 and keyboard 1120, for example. Video adapter 1060 is connected to display 1130, for example.

The hard disk drive 1090 stores an OS 1091, application programs 1092, program modules 1093, and program data 1094, for example. That is, a program that defines each process of the analysis device 40 is implemented as a program module 1093 in which computer-executable code is described. Program modules 1093 are stored, for example, on hard disk drive 1090 . For example, the hard disk drive 1090 stores a program module 1093 for executing processing similar to the functional configuration of the analysis device 40 . The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

Also, setting data used in the processing of the above-described embodiment is stored as program data 1094 in the memory 1010 or the hard disk drive 1090, for example. Then, the CPU 1020 reads the program modules 1093 and program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 as necessary, and executes the processes of the above-described embodiments.

The program modules 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, program modules 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Program modules 1093 and program data 1094 may then be read by CPU 1020 through network interface 1070 from other computers.

1 service providing system 10, 50 terminal 20 gateway device 30 server 40 analysis device 41 communication unit 42 storage unit 43 control unit 422 log information 423 detection information 431 conversion unit 432 detection unit 433 addition unit 434 notification unit

Claims (8)

By decoding the query string extracted from the URL included in the HTTP request sent from the terminal, the log of the HTTP request of the gateway device that causes the server to provide financial services based on the result of interpreting the HTTP request is stored in a predetermined manner. a conversion unit that converts data into format data;
a detection unit that detects an event that satisfies a predetermined condition regarding unauthorized use of the financial service from the data converted by the conversion unit;
An analysis device characterized by having 2. The analysis apparatus according to claim 1, wherein the conversion unit converts the log into a graph having the IP address of the payment source, the credit card, and the affiliated store as nodes and the transactions between the nodes as edges. 3. The analysis apparatus according to claim 1, wherein the detection unit detects that payment has been made from an IP address that does not have a history of using a credit card. 3. The analyzer according to claim 1, wherein the detection unit detects that a plurality of credit card payments have been made from one IP address. 3. The analysis apparatus according to claim 1, wherein the detection unit detects that payment has been made with a credit card that has a history of refunds. 3. The analysis device according to claim 1, wherein the detection unit detects that a predetermined condition regarding a member store where payment has been made is satisfied. An analysis method performed by an analysis device, comprising:
By decoding the query string extracted from the URL included in the HTTP request sent from the terminal, the log of the HTTP request of the gateway device that causes the server to provide financial services based on the result of interpreting the HTTP request is stored in a predetermined manner. a conversion step of converting data into a format;
a detection step of detecting an event that satisfies a predetermined condition regarding fraudulent use of the financial service from the data converted by the conversion step;
A method of analysis characterized by comprising An analysis program for causing a computer to function as the analysis device according to any one of claims 1 to 6.

Images