TW201901553A - Transaction identity warning system and transaction identity warning method - Google Patents

Abstract

A transaction identity warning system and transaction identity warning method is provided. The transaction identity warning method comprises following steps: analyzing a transaction behavior pattern according to a past behavior record; determining whether a variation of a current transaction behavior and the corresponding transaction behavior pattern larger than a transaction threshold. If the variation of current transaction behavior and the corresponding transaction behavior pattern larger than the transaction threshold, a notification is transmitted.

Description

 Trading identity warning system and transaction identity warning method  

The invention relates to a transaction identity warning system and a transaction identity warning method, in particular to a transaction identity warning system and a transaction identity warning method capable of analyzing a consumer behavior pattern.

With the increasing development of payment in multiple ways, many consumers will use the mobile device to pay for the purchase of goods. However, when the mobile device of the consumer is obtained by a malicious third party, the malicious third person can easily use this. The mobile device is stolen.

Therefore, how to improve the identification of identity between mobile devices and consumers is one of the current problems to be solved.

One aspect of the present invention is a transaction identity alert system comprising: a transaction alert server. The transaction alert server includes: a behavior analysis module and an identity warning module. The behavior analysis module is used to analyze a transaction behavior pattern based on a past behavior record. Among them, the past behavior record contains community behavior data and at least one user data. The identity alert module is configured to determine whether a difference between a current transaction behavior and a corresponding transaction behavior pattern is greater than a transaction threshold. Wherein, when the difference between the current transaction behavior and the corresponding transaction behavior pattern is greater than the transaction behavior threshold, the identity warning module transmits a warning notification.

Another aspect of the present invention is a transaction identity warning method, comprising the steps of: analyzing a transaction behavior pattern according to a past behavior record; wherein the past behavior record includes the community behavior data and at least one user profile; Whether the difference between the current transaction behavior and the corresponding transaction behavior pattern is greater than a transaction threshold; wherein, if the difference between the current transaction behavior and the corresponding transaction behavior pattern is greater than a transaction behavior threshold, a warning notification is transmitted.

In summary, the transaction identity warning system and the transaction identity warning method of the present invention can more accurately determine whether the user is a user by using community behavior data, user data, location of the mobile device, and event behavior. I have a mobile device for consumption; when the user's mobile device is obtained by another third party, the transaction identity warning system and the transaction identity alert method can be used to immediately determine the user's identity and the bound mobile device at the time of the transaction. Inconsistent, and when the judgment is inconsistent, the warning signal is transmitted to notify the payment provider that the transaction may have an implied problem, thereby improving the security of the user's payment by using the mobile device.

100‧‧‧Transaction identity warning system

10‧‧‧Mobile devices

20‧‧‧Transaction Alert Server

30‧‧‧Payment system

40‧‧‧Sales system

21‧‧‧ Behavior Analysis Module

23‧‧‧ Identity Alert Module

11‧‧‧Transactional Behavior Collection Module

13‧‧‧ Position Detection Module

25‧‧‧Analysis Results Storage Module

27‧‧‧Community Behavior Collection Module

29‧‧‧ Behavior Storage Module

300‧‧‧Transaction identity warning method

310~330‧‧‧Steps

400, 500‧‧‧ analysis tree

401~407, 501~507‧‧‧ event behavior

1 is a block diagram of a transaction alerting system according to an embodiment of the present invention; FIG. 2 is a block diagram of a transaction alerting server according to an embodiment of the present invention; and FIG. 3 is a block diagram of a transaction alerting server according to an embodiment of the present invention; A flowchart of a transaction identity warning method of an embodiment; FIG. 4 is a schematic diagram of a behavior analysis tree diagram according to an embodiment of the present invention; and FIG. 5 is a schematic diagram of a behavior analysis tree diagram according to an embodiment of the present invention.

The spirit and scope of the present disclosure will be apparent from the following description of the embodiments of the present disclosure, which may be modified and modified by the teachings of the present disclosure. It does not depart from the spirit and scope of the disclosure.

"Electrical connection" as used herein may mean that two or more elements are in direct physical or electrical contact with each other, or indirectly in physical or electrical contact with each other, and "electrical connection" may also mean two or A plurality of component elements operate or operate with each other.

The terms "including", "including", "having", "containing", etc., as used in this document are all open terms, meaning, but not limited to.

"and/or" as used herein, includes any and all combinations of the recited.

The terms used in this document, unless otherwise specified, generally have the usual meaning of each term used in the art, in the context of the disclosure, and in the particular content. Certain terms used to describe the disclosure are discussed below or elsewhere in this specification to provide additional guidance to those skilled in the art in the description of the disclosure.

Please refer to FIG. 1 to FIG. 2 . FIG. 1 is a block diagram of a transaction identity warning system 100 according to an embodiment of the present invention. FIG. 2 is a block diagram of the transaction alert server 20 according to an embodiment of the present invention. In this embodiment, the transaction identity warning system 100 includes a transaction alert server 20, and the transaction alert server 20 includes a behavior analysis module 21 and an identity alert module 23. In an embodiment, as shown in FIG. 2, the transaction alert server 20 further includes an analysis result storage module 25, a community behavior collection module 27, and a behavior storage module 29. In an embodiment, the transaction alert server 20 can be implemented by a server, a computer or other device having computing and/or storage functions, the behavior analysis module 21, the identity warning module 23, and the community behavior collection. The module 27 can be formed by an integrated circuit such as a micro controller, a microprocessor, a digital signal processor, an application specific integrated circuit (ASIC) or a logic. The circuit is implemented, and the analysis result storage module 25 and the behavior storage module 29 can be implemented by a hard disk, a memory or a flash drive.

In an embodiment, as shown in FIG. 1, the transaction identity warning system 100 further includes a mobile device 10, and the mobile device 10 includes a transaction behavior collection module 11 and a position detection module 13. In one embodiment, the mobile device, such as a smart phone, a tablet, and/or other portable electronic products having communication functions, the transaction behavior collection module 11 and the position detection module 13 may be separately or collectively integrated. The circuit is implemented as a micro control unit, a microprocessor, a digital signal processor, a special application integrated circuit, or a logic circuit.

In an embodiment, as shown in FIG. 1, the transaction identity warning system 100 further includes a sales system 40 and a payment system 30. In one embodiment, the sales system 40 and the payment system 30 can be implemented separately or together with a computer, a tablet, a smart phone, and/or other electronic products having communication, computing, and storage functions.

In one embodiment, as shown in FIG. 1, the sales system 40 may be a point-of-sale (POS) system of the store, and the payment system 30 may be an application provider server, a banker server, and / or other kind of server that provides payment function providers.

Traditionally, an application can be downloaded from the user's mobile device 10, through which the user can perform functions such as purchasing, collecting points, obtaining purchase details, and/or performing tasks (for example, punching a letter on a Facebook book in exchange for points). These functions can be implemented by known techniques, so they are not described here. For example, when the user wants to purchase a product, the mobile device 10 can be communicatively coupled with the store's sales system 40, so that the sales system 10 can read the payment information (such as the credit card number) on the mobile device 10, and The information is transmitted to the payment system 30, and the payment system 30 can confirm whether the payment information is correct. If correct, the amount corresponding to the product is paid to the sales system 40, so that the store obtains the transaction amount and then delivers the product to the user to complete the pen. transaction.

However, when the user's mobile device 10 is obtained by another third party, the third person can easily perform other transaction behaviors by the mobile device 10, or steal the user's financial related account number and password. Therefore, the following provides A transaction identity warning system 100 and a transaction identity warning method 300 cooperate with the original transaction method to further determine whether the user's identity is consistent with the mobile device 10 during the transaction.

Please refer to FIG. 1 and FIG. 2 and FIG. 3 simultaneously. FIG. 3 is a flowchart of a transaction identity warning method 300 according to an embodiment of the invention. The transaction identity warning system 100 and the transaction alert server 20 of the first and second figures described above will be described below, and more specific details of the case will be provided. However, this case is not limited to the following examples.

In step 310, the behavior analysis module 21 is configured to analyze a transaction behavior pattern based on a past behavior record. Among them, the past behavior record contains community behavior data and at least one user data.

In an embodiment, the mobile device 10 can log in to the application by using a community account (such as a Facebook account). At this time, the transaction behavior collection module 11 can obtain the community behavior data of the user through the application and/or Or at least one user profile. In an embodiment, the community behavior data is, for example, a circle of friends of the user and/or a Facebook community that is added, and the user profile is, for example, a user's various punching locations, residences, living circles, birthdays, and/or Or gender and other information. The transaction behavior collection module 11 transmits the community behavior data and/or the at least one user profile to the community behavior collection module 27 of the transaction alert server 20, and the community behavior collection module 27 collects the community behavior. The data and/or at least one user profile is stored in the behavior storage module 29 and the community behavior data and/or the at least one user profile.

In one embodiment, the location detecting module 13 of the mobile device 10 is configured to detect the location of the mobile device 10 and transmit the location of the mobile device 10 to the transaction alert server 20. For example, when a beacon device or other communication function device is installed in a shopping mall, when the mobile device 10 is located within a range in which the beacon device can transmit a signal, the application of the mobile device 10 can sense the beacon device. The signal is used to know the current location of the mobile device 10. Next, the mobile device 10 transmits the current location to the transaction alert server 20.

In one embodiment, the past behavior record may include the location of the user's previous mobile device 10 (eg, the location of the consumer) and the event behavior (eg, consumer information) performed by the user at the location, community behavior data, and the user. For the data, the following describes the detailed method by which the behavior analysis module 21 analyzes the behavior pattern of the transaction based on the past behavior record.

Please refer to FIG. 4, which is a schematic diagram of a behavior analysis tree 400 in accordance with an embodiment of the present invention. In one embodiment, the behavior analysis module 21 establishes a behavior analysis tree 400 based on past behavior records. The behavior analysis tree 400 includes the probability P of each past event behavior 401-407 in the past behavior record. The behavior analysis tree 400 is used to establish a trading behavior pattern.

In an embodiment, in FIG. 4, the root node of the behavior analysis tree 400 is the store task of the event behavior 401, that is, the behavior analysis module 21 starts counting or after the user enters a store. Analysis of the user's past behavior record, through continuous records or statistics, can be seen that some behavior patterns occur more often, so it can be judged that the probability of occurrence of this behavior pattern is higher. For example, after the user enters a store, the user has a 70% probability that P will perform the first scan task of the event behavior 402 (for example, searching for the first Quick Response (QR) code and scanning the task. ), there is a 30% chance that P will consume more than 100 yuan of event behavior 403; in addition, after the user performs event behavior 402, there is an 80% chance that P will perform the second scan task of event behavior 405 (for example, looking for the first 2 QR code and scan task), and there is a 20% chance that P will perform event behavior 404 to leave the store directly; in addition, after the user performs event behavior 405, there is a 10% chance that P will spend more than 300 yuan. Act 407, and there is a 90% chance that P will spend more than 100 yuan on event behavior 406.

However, the present invention is not limited to this example, and the case may also refer to the location of the user's previous mobile device 10 (such as the location of the consumer) and the event behavior (such as consumer information) and social behavior data of the user at the location. And user information and other information to analyze user behavior and establish a behavior analysis tree 400.

In one embodiment, the behavior analysis module 21 may apply a Hidden Markov Model algorithm to describe the probability distribution of transitions between states, thereby analyzing or counting the probability of occurrence of each of the aforementioned event behaviors.

Thereby, the behavior analysis module 21 can extract a series of behaviors performed by the user after entering the store according to the past behavior record of the user (such as entering a store, punching a card, purchasing a product, a product type, The behavior at the time of purchase and/or the amount of consumption), and the probability that each of the series of behaviors may follow up may be analyzed to establish a behavior analysis tree 400, and when the behavior analysis tree 400 is established, The behavior analysis tree 400 learns the transaction behavior patterns of the user (such as the amount of consumption, the consumption process, and/or the frequency of consumption).

In one embodiment, the analysis result storage module 25 is configured to store the transaction behavior pattern (eg, the behavior analysis tree 400).

In one embodiment, the behavior analysis module 21 divides a plurality of event behaviors into the same group according to the analysis tree 400, thereby converging the behavior analysis tree 400. In some examples, the behavior analysis module 21 may treat the behavior pattern of performing one task and performing two tasks as similar event behaviors according to the analysis tree diagram 400, and performing a behavioral mode of performing one task and two tasks. The points are divided into the same group.

In one embodiment, the behavior analysis module 21 applies machine learning, such as Co-Clustering with Augmented Data Matrix, depending on the type of event behavior (eg, to shop tasks, scan tasks, consumer tasks, etc.) And the time of occurrence is two dimensions for grouping, and the result of grouping can be automatically determined, for example: the user usually performs the shop task at 5 pm (Location Taipei), performs all scanning tasks, and purchases food of about 100 yuan. Information on products (about 30 minutes in total). However, the present invention is only an example of the present invention, and the present invention is not limited thereto. Thereby, in the case of some huge amounts of data, the normal behavior pattern of the user can be analyzed and the behavior analysis tree 400 can be simplified or converged.

In step 320, the identity alert module 23 determines whether a difference between a current transaction behavior and a corresponding transaction behavior pattern is greater than a transaction threshold. If the difference between the current transaction behavior and the corresponding transaction behavior pattern is greater than the transaction behavior threshold, proceed to step 330. If the difference between the current transaction behavior and the corresponding transaction behavior pattern is not greater than the transaction behavior threshold, then step 310 is entered to incorporate the current transaction behavior into the analysis.

In step 330, the identity alert module 23 transmits an alert notification.

Please refer to FIG. 5. FIG. 5 is a schematic diagram of a behavior analysis tree 500 according to an embodiment of the present invention. In one embodiment, the behavior analysis module 23 assigns a plurality of behavior weights W to the corresponding event behaviors 501-507, respectively.

In FIG. 5, since the importance degree of each event behavior 501 to 507 is different, for example, for the store, the user's transaction behavior of the mobile device 10 is more important than the user's direct departure behavior. Therefore, the behavior analysis module 23 assigns a plurality of behavior weights W to the corresponding event behaviors 501 to 507, respectively. For example, the behavior weight W of the event behavior 503 is more than 50%, and the behavior weight W of the event behavior 502 is 20%. The rest of the event behavior is similar, and will not be described here. The behavior weights W may be set by the identity warning module 23 when the transaction identity alert system 100 is initialized, for example, according to the importance level of each behavior event, the degree of influence on the store, the amount of consumption, and/or the promotion effect, and the weight W may be determined. Adjust according to various usage scenarios.

In an embodiment, when the current transaction behavior of the user is in order to the store task, the first scan task, the consumption is over 100, and the identity warning module 23 presets the transaction behavior threshold to 70%, The identity warning module 23 searches for the path most similar to the current transaction behavior in the analysis tree 500 and regards it as a transaction behavior pattern corresponding to the current transaction behavior, for example, the corresponding transaction behavior pattern is sequentially the event behavior 501 to the store. The first scan task of the task, the event behavior 502, the second scan task of the event behavior 505, the transaction behavior mode of the event behavior 506, and the current transaction behavior (to the store task, the first scan task, the full consumption) 100 or more) The difference between this transaction behavior mode (the first scan task of event behavior 501, the first scan task of event behavior 502, the second scan task of event behavior 505, and the event behavior 506 of more than 100) is analyzed by The tree diagram 500 shows that the difference between the two is that the current transaction behavior does not perform the second scan task of the event behavior 505 (its weight is 30%), and the calculation of the difference degree Therefore, the weight of the difference point is divided by the total weight of the corresponding transaction behavior pattern. Therefore, the degree of difference is calculated as 30%/(20%+30%+50%)=30%, due to the difference (30%) Below the trading threshold (70%).

In an embodiment, when the difference between the current transaction behavior and the corresponding transaction behavior pattern (assumed to be 80%) is greater than the transaction threshold (assuming 70%), the transaction behavior is abnormal and may be acted upon. The device 10 is not used by the user himself (maybe the action of the mobile device 10 being stolen by a third party), so the identity alert module 23 transmits an alert notification to the mobile device 10 or the payment system 30. For example, the payment system 30 that receives the alert notification can send an email to the user to confirm whether the transaction is true. If true, the payment system 30 can notify the identity warning module 23 to lower the trading behavior threshold according to the user feedback. The value, if not true, the payment system 30 temporarily does not provide a grant service.

In some embodiments, the identity alert module 23 can also compare the current transaction behavior with the user's previous consumption location and previous event behavior (eg, consumer information), community behavior data, and user profile information, if current Trading behavior is too different from this information (for example, this user has a 90% chance of purchasing daily necessities, and the current transaction is to buy a high unit price computer product, or this user has a 95% chance of being in a store in Taipei. The shopping alert, while the current transaction is shopping at a store in Turkey, the identity alert module 23 transmits an alert notification to the mobile device 10 or payment system 30.

In summary, the transaction identity warning system and the transaction identity warning method of the present invention can more accurately determine whether the user is a user by using community behavior data, user data, location of the mobile device, and event behavior. I have a mobile device for consumption; when the user's mobile device is obtained by another third party, the transaction identity warning system and the transaction identity alert method can be used to immediately determine the user's identity and the bound mobile device at the time of the transaction. Inconsistent, and when the judgment is inconsistent, the warning signal is transmitted to notify the payment provider that the transaction may have an implied problem, thereby improving the security of the user's payment by using the mobile device.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention, and the present invention can be modified and retouched without departing from the spirit and scope of the present invention. The scope is subject to the definition of the scope of the patent application attached.

Claims (14)

 A transaction identity warning system includes: a transaction alert server, comprising: a behavior analysis module for analyzing a transaction behavior pattern according to a past behavior record; wherein the past behavior record includes the community behavior data and at least a user data; and an identity warning module for determining whether a difference between a current transaction behavior and a corresponding transaction behavior pattern is greater than a transaction threshold; wherein, when the current transaction behavior and the corresponding transaction behavior When the degree of difference of the mode is greater than the threshold value of the transaction behavior, the identity warning module transmits an alert notification.    The transaction identity warning system of claim 1, wherein the transaction alert server further comprises: a community behavior collection module for collecting the community behavior data; and a behavior storage module for storing The community behavior data and the at least one user data; an analysis result storage module for storing the transaction behavior pattern.    The transaction identity warning system of claim 2, further comprising: a mobile device, comprising: a transaction behavior collection module, configured to collect the at least one user profile, and transmit the at least one user profile And the transaction alerting server; and a position detecting module for detecting the location of the mobile device and transmitting the location of the mobile device to the transaction alerting server.    For example, in the transaction identity warning system described in claim 1, wherein the behavior analysis module establishes a behavior analysis tree according to the past behavior record, and the behavior analysis tree diagram includes each past in the past behavior record. The probability of occurrence of an event behavior, by which the behavior analysis tree is established to establish the behavior pattern of the transaction.    The transaction identity warning system of claim 4, wherein the behavior analysis module divides the plurality of event behaviors into the same group according to the analysis tree, thereby converging the behavior analysis tree.    For example, the transaction identity warning system described in claim 5, wherein the behavior analysis module assigns a plurality of behavior weights to the corresponding event behaviors.    The transaction identity warning system of claim 1, wherein the identity warning module transmits the alert notification to the difference between the current transaction behavior and the corresponding transaction behavior mode. A mobile device or a payment system.    A transaction identity warning method includes: analyzing a transaction behavior pattern according to a past behavior record; wherein the past behavior record includes the community behavior data and at least one user profile; determining a current transaction behavior and the corresponding transaction behavior Whether the degree of difference of the mode is greater than a transaction threshold; wherein, if the difference between the current transaction behavior and the corresponding transaction behavior pattern is greater than a transaction behavior threshold, an alert notification is transmitted.    For example, the transaction identity warning method described in claim 8 further includes: collecting the community behavior data; storing the community behavior data and the at least one user data; and storing the transaction behavior pattern.    The transaction identity warning method of claim 9, further comprising: collecting and transmitting the at least one user profile; and detecting and transmitting the location of the mobile device.    For example, the transaction identity warning method described in claim 8 further includes: establishing a behavior analysis tree according to the past behavior record, the behavior analysis tree diagram containing each past event behavior in the past behavior record The probability of occurrence, through the behavior analysis tree to establish the trading behavior pattern.    For example, the transaction identity warning method described in claim 11 further includes: according to the analysis tree, classifying a plurality of similar event behaviors into the same group, thereby converging the behavior analysis tree.    For example, the transaction identity warning method described in claim 12 of the patent application further includes: assigning a plurality of behavior weights to the corresponding event behaviors respectively.    The transaction identity warning method of claim 8 further includes: transmitting the warning notification to a mobile device when the current transaction behavior and the corresponding transaction behavior pattern are greater than the transaction behavior threshold Or a payment system.