WO2017107734A1 - 一种金融终端安全防护方法及系统 - Google Patents

一种金融终端安全防护方法及系统 Download PDF

Info

Publication number
WO2017107734A1
WO2017107734A1 PCT/CN2016/107046 CN2016107046W WO2017107734A1 WO 2017107734 A1 WO2017107734 A1 WO 2017107734A1 CN 2016107046 W CN2016107046 W CN 2016107046W WO 2017107734 A1 WO2017107734 A1 WO 2017107734A1
Authority
WO
WIPO (PCT)
Prior art keywords
transaction
behavior
user
processing
abnormal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/107046
Other languages
English (en)
French (fr)
Inventor
孙权
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Publication of WO2017107734A1 publication Critical patent/WO2017107734A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/20—Movements or behaviour, e.g. gesture recognition
    • G06V40/28—Recognition of hand or arm movements, e.g. recognition of deaf sign language
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F19/00—Complete banking systems; Coded card-freed arrangements adapted for dispensing or receiving monies or the like and posting such transactions to existing accounts, e.g. automatic teller machines
    • G07F19/20—Automatic teller machines [ATMs]
    • G07F19/207—Surveillance aspects at ATMs
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/22—Matching criteria, e.g. proximity measures
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G06V40/18—Eye characteristics, e.g. of the iris

Definitions

  • the present invention relates to the field of financial technology, and in particular, to a financial terminal security protection method and system.
  • the main purpose of the embodiments of the present invention is to provide a financial terminal security protection method and system, which can distinguish between normal financial transaction users and suspicious criminals through automatic monitoring and analysis of user behavior, and provide alarm and real-time risk processing functions to protect financial Terminal transactions are secure.
  • the present invention provides a financial terminal security protection system, including: a financial terminal, a user behavior tracking unit, a user behavior analysis unit, a user behavior pattern library, and an event processing unit;
  • a user behavior pattern library for compiling a user transaction behavior pattern case from a large number of terminal transaction operation behaviors, and storing a user transaction behavior pattern case;
  • the user behavior pattern case includes normal transaction behavior and abnormal transaction behavior;
  • the user behavior tracking unit is configured to acquire transaction operation behavior information of the user on the financial terminal, generate a transaction event message, and transmit the message to the user behavior analysis unit;
  • the user behavior analysis unit is configured to match the transaction event message with a user behavior pattern case stored in the user behavior pattern library, and determine whether the transaction event message is a normal behavior transaction mode or an abnormal behavior transaction mode; and the judgment result is Sent to the event processing unit;
  • the event processing unit is configured to perform corresponding transaction behavior processing according to the determination result.
  • the present invention also provides a financial terminal security protection method, including:
  • the user transaction behavior pattern case is compiled from a large number of terminal transaction operation behaviors, and the user transaction behavior pattern case is stored; the user behavior pattern case includes normal transaction behavior and abnormal transaction behavior;
  • the technical scheme matches the normal behavior mode and abnormal behavior mode of the financial terminal operation through the iris recognition technology and the video image recognition technology, and tracks the abnormal transaction behavior to ensure the security of the financial terminal, avoids and mitigates the illegal behavior of the criminals. User money loss.
  • FIG. 1 is a block diagram of a financial terminal security protection system according to an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a system of the embodiment
  • FIG. 3 is a flowchart of a method for security protection of a financial terminal according to an embodiment of the present invention.
  • FIG. 1 a block diagram of a financial terminal security protection system proposed in this embodiment.
  • the system includes: a financial terminal 101, a user behavior tracking unit 102, a user behavior analysis unit 103, a user behavior pattern library 104, and an event processing unit 105;
  • the user behavior pattern library 104 is configured to compile a user transaction behavior pattern case from a large number of terminal transaction operation behaviors, and store the user transaction behavior pattern case; the user behavior pattern case includes a normal transaction behavior and an abnormal transaction behavior;
  • the user behavior tracking unit 102 is configured to acquire transaction operation behavior information of the user on the financial terminal 101, generate a transaction event message, and transmit the transaction event message to the user behavior analysis unit.
  • the user behavior analysis unit 103 is configured to match the transaction event message with a user behavior pattern case stored in the user behavior pattern library, and determine whether the transaction event message is a normal behavior transaction mode or an abnormal behavior transaction mode; The result is sent to the event processing unit;
  • the event processing unit 105 is configured to perform corresponding transaction behavior processing according to the determination result.
  • the system distinguishes between normal financial transaction users and suspicious criminals, and provides alarm and real-time risk processing functions to ensure financial terminal transaction security.
  • FIG. 2 it is a schematic diagram of the system of the present embodiment.
  • the system consists of financial terminals (such as ATM machines), user behavior tracking unit (including: iris focus recognition tracking module, video image recognition tracking module, machine operation tracking module, transaction processing tracking module), user behavior analysis unit, user behavior Pattern library, event processing unit, and transaction processing unit.
  • financial terminals such as ATM machines
  • user behavior tracking unit including: iris focus recognition tracking module, video image recognition tracking module, machine operation tracking module, transaction processing tracking module
  • user behavior analysis unit user behavior Pattern library
  • event processing unit and transaction processing unit.
  • Financial terminals such as ATM machines
  • Traditional financial equipment needs to be modified to support the transmission of image data and machine operation data to the background processing system.
  • the user behavior tracking unit is responsible for identifying and tracking the user's transaction operation behaviors, including:
  • Iris focus recognition tracking module Through the video camera, the user's iris focus is collected to achieve tracking of the visual focus. For normal financial terminal transactions, the user's visual focus will have a relatively fixed pattern;
  • the video image recognition and tracking module collects video image data operated by the user through a video camera, such as: a user's hand operation, a user's carrying tool, etc.;
  • the iris focus recognition tracking module and the video image recognition tracking module respectively perform real-time image and video acquisition through the camera, and perform real-time analysis and processing on the image and video, and delay only For the second level, real-time performance is guaranteed.
  • the iris focus recognition tracking performs image sampling with a certain period (for example, 0.5 seconds), and performs eyeball tracking analysis on the sampled image.
  • a certain period for example, 0.5 seconds
  • an infrared projection method can be used to actively project a beam of infrared rays and the like to the iris to extract features.
  • the specific steps include:
  • Tool operation tracking module Track user operations of financial instruments, such as card insertion, keyboard input, and banknotes. Normal financial terminal operation has its relatively fixed machine operation sequence mode;
  • Transaction processing tracking module tracking transaction processing links of the transaction processing system, such as: the amount of cash withdrawal operations, card number and other information;
  • each operation step of the user behavior triggers the iris focus recognition tracking module, the video image recognition tracking module, the implement operation tracking module, and the transaction processing tracking module to generate a transaction event message and submit it to the user.
  • Behavior analysis module analyzes the type of transaction event message, the time series of occurrence, and the transaction amount, and performs matching in the user behavior pattern library to distinguish between normal transaction behavior and abnormal transaction behavior, and correspondingly perform subsequent processing (eg, alarm, termination). transaction).
  • the user behavior pattern library is divided into a normal transaction behavior pattern library and an abnormal behavior pattern library.
  • the process of establishing a user behavior pattern library includes:
  • the initial user behavior pattern library is built. Specifically:
  • the transaction process analysis the user behavior pattern case is compiled, and the initial user behavior pattern library is formed;
  • the initial user behavior pattern library is verified by an actual user operation, and the pattern library is adjusted according to the verification result;
  • the corresponding user behavior pattern is analyzed and designed, and added to the user behavior pattern library.
  • the event processing unit it is responsible for the processing of the transaction behavior. Specifically include:
  • real-time transaction processing such as: terminating the current transaction, stopping the financial equipment service, etc.; alerting the abnormal trading behavior through alarms, short messages, etc.; at the same time, providing abnormal monitoring behavior for the system monitoring personnel.
  • Query and process logging functions such as: terminating the current transaction, stopping the financial equipment service, etc.; alerting the abnormal trading behavior through alarms, short messages, etc.; at the same time, providing abnormal monitoring behavior for the system monitoring personnel.
  • modules or steps of the embodiments of the present invention can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from The steps shown or described are performed sequentially, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. Thus, embodiments of the invention are not limited to any specific combination of hardware and software.
  • FIG. 3 a flow chart of a financial terminal security protection method proposed in this embodiment is shown.
  • Step 301) compiling a user transaction behavior pattern case from a large number of terminal transaction operation behaviors, and storing the user transaction behavior pattern case;
  • the user behavior pattern case includes a normal transaction behavior and an abnormal transaction behavior;
  • Step 304) Perform corresponding transaction behavior processing according to the judgment result.
  • Embodiments of the present invention also provide a computer readable storage medium comprising computer readable instructions, when executed, causing a processor to perform at least the following operations: compiling user transaction behavior from a plurality of terminal transaction operational behaviors a mode case, and storing a user transaction behavior pattern case; the user behavior pattern case includes a normal transaction behavior and an abnormal transaction behavior; acquiring a transaction operation behavior information of the user on the financial terminal, generating a transaction event message; The transaction event message is matched with the user behavior mode case to determine whether the transaction event message is a normal behavior transaction mode or an abnormal behavior transaction mode; and the determination result is sent to the event processing unit; and the corresponding transaction behavior is performed according to the judgment result. deal with.
  • the user arrives at the cash machine: the iris focus recognition tracking module and the video image recognition tracking module track the user entry.
  • the iris focus recognition tracking module tracks the iris focus of the user to the ATM card slot, the video image recognition tracking module tracks the user card operation, and the tool operation tracking module monitors the card operation;
  • the iris focus recognition tracking module tracks the user's iris focus to the ATM machine screen, the video image recognition tracking module tracks the user screen input operation, and the implement operation tracking module monitors the screen input operation;
  • the iris focus recognition tracking module tracks the user's iris focus to the password keyboard, the video image recognition tracking module tracks the user password keyboard operation, and the implement operation tracking module monitors the password keyboard operation;
  • Transaction sending background processing The transaction processing tracking module monitors the withdrawal of the withdrawal transaction and the system returns.
  • the machine operation tracking module monitors the machine dispensing operation
  • the iris focus recognition tracking module tracks the user's iris focus to the spit port
  • the video image recognition and tracking module tracks the user's money-collecting action
  • the tool operation tracking module monitors the tool ejection operation, the iris focus recognition tracking module tracks the user's iris focus to the ATM machine card slot, and the video image recognition tracking module tracks the user card retrieval operation;
  • the user behavior analysis unit performs a comprehensive analysis of user behavior, matches the user behavior pattern library, and recognizes the normal transaction behavior pattern without any subsequent processing.
  • an abnormal operation behavior is described, which is a criminal installation of a stolen card device in an ATM card slot.
  • the specific process is:
  • the criminals arrive at the cash machine: the iris focus recognition tracking module and the video image recognition tracking module may track the criminals to see if there are any people.
  • the criminals installed the stolen card device: the iris focus recognition and tracking module traces the iris focus of the criminals to the ATM card slot for a long time, and the video image recognition and tracking module tracks the criminals to take out the stolen card device, and the hand stays for a long time.
  • the criminals check the work of the stolen card device: the criminal inserts the test card to check whether the stolen card device is normal.
  • the iris focus recognition tracking module tracks the iris focus of criminals to the ATM card slot for a long time.
  • the video image recognition tracking module tracks the criminal card insertion operation, the implement operation tracking module monitors the card insertion port abnormality, and the transaction processing tracking module does not monitor any transaction operation;
  • the user behavior analysis unit performs a comprehensive analysis of user behavior, matches the user behavior pattern library, and identifies abnormal behavior patterns;
  • Event processing The time processing unit suspends any operation of the ATM machine where the suspicious event occurs, and alarms through alarms, short messages, etc., and the system monitoring and maintenance personnel inspect and follow up the problem machine.
  • the information collecting terminal cannot collect the iris focus and the image, and the iris focus recognition tracking module cannot normally collect the iris and the eyeball data, which is an abnormal event in itself.
  • the video image recognition tracking module can also provide an abnormal event if it can analyze abnormal behavior such as suspect masking.
  • the technical solution matches normal financial terminal operation behavior patterns and abnormal behavior patterns, and tracks abnormal transaction behaviors to ensure financial terminal security, and avoids and mitigates user capital losses caused by criminals' illegal activities.

Landscapes

  • Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Health & Medical Sciences (AREA)
  • Multimedia (AREA)
  • Human Computer Interaction (AREA)
  • General Health & Medical Sciences (AREA)
  • Finance (AREA)
  • Psychiatry (AREA)
  • Social Psychology (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Data Mining & Analysis (AREA)
  • Artificial Intelligence (AREA)
  • General Engineering & Computer Science (AREA)
  • Evolutionary Computation (AREA)
  • Ophthalmology & Optometry (AREA)
  • Evolutionary Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Collating Specific Patterns (AREA)

Abstract

一种金融终端安全防护方法及系统，其中，系统包括：金融终端(101)、用户行为跟踪单元(102)、用户行为分析单元(103)、用户行为模式库(104)和事件处理单元(105)；其中，用户行为模式库(104)，用于从大量的终端交易操作行为中编制用户交易行为模式案例，并将用户交易行为模式案例进行存储；用户行为跟踪单元(102)，用于获取用户在该金融终端(101)上的交易操作行为信息，产生交易事件消息，并传输至该用户行为分析单元(103)；用户行为分析单元(103)，用于对该交易事件消息与用户行为模式库(104)存储的用户行为模式案例进行匹配，判断交易事件消息是正常行为交易模式还是异常行为交易模式；并将判断结果发送至该事件处理单元(105)；事件处理单元(105)，用于根据判断结果进行相应的交易行为处理。

Description

一种金融终端安全防护方法及系统
本申请要求2015年12月21日递交的申请号为201510966929.4、发明名称为“一种金融终端安全防护方法及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及金融技术领域，特别涉及一种金融终端安全防护方法及系统。
背景技术
目前，通过金融终端进行的犯罪活动越来越猖獗，犯罪分子在金融终端张贴误导性转账信息、安装盗卡装置及摄像头、进行洗钱等一系列金融犯罪活动，现有的ATM机等金融终端，大多配备摄像头进行24×7的录像记录，以备出现犯罪案件的事后最终检查。
现有的金融终端，主要通过以下方式进行安全防护：
1、通过摄像头进行24×7的全程录像记录，这一定程度上起到威慑作用，并为犯罪案件的事后处理提供视频证据。但是，对于银行卡犯罪案件无法做到实时识别和终止服务，减少持卡人资金损失。
2、通过不间断的语音提示，以及张贴警示说明，提醒用户注意用卡安全。但是语音提示对用户的提醒效果有限，也无法解决犯罪分子安装盗卡装置及摄像头等恶意犯罪行为。
3、通过限制单次交易额度以及每日最高交易额度，降低风险。但是限制交易额度交易次数，对于正常用卡的持卡人带来不便。
发明内容
本发明实施例的主要目的在于提出一种金融终端安全防护方法及系统，通过对用户行为的自动监控分析，区分正常金融交易用户与可疑犯罪分子，并提供报警以及实时风险处理功能，以保障金融终端交易安全。
为实现上述目的，本发明提供了一种金融终端安全防护系统，包括：金融终端，用户行为跟踪单元、用户行为分析单元、用户行为模式库和事件处理单元；其中，
用户行为模式库，用于从大量的终端交易操作行为中编制用户交易行为模式案例，并将用户交易行为模式案例进行存储；所述用户行为模式案例包括正常交易行为和异常交易行为；
所述用户行为跟踪单元，用于获取用户在所述金融终端上的交易操作行为信息，产生交易事件消息，并传输至所述用户行为分析单元；
所述用户行为分析单元，用于对所述交易事件消息与所述用户行为模式库存储的用户行为模式案例进行匹配，判断交易事件消息是正常行为交易模式还是异常行为交易模式；并将判断结果发送至所述事件处理单元；
所述事件处理单元，用于根据所述判断结果进行相应的交易行为处理。
对应地，为实现上述目的，本发明还提供了一种金融终端安全防护方法，包括：
从大量的终端交易操作行为中编制用户交易行为模式案例，并将用户交易行为模式案例进行存储；所述用户行为模式案例包括正常交易行为和异常交易行为；
获取用户在所述金融终端上的交易操作行为信息，产生交易事件消息；
对所述交易事件消息与所述用户行为模式案例进行匹配，判断交易事件消息是正常行为交易模式还是异常行为交易模式；并将判断结果发送至所述事件处理单元；
根据所述判断结果进行相应的交易行为处理。
上述技术方案具有如下有益效果：
本技术方案通过虹膜识别技术、视频图像识别技术，匹配金融终端操作的正常行为模式和异常行为模式，并对异常交易行为进行跟踪处理，确保金融终端安全，避免和减轻犯罪分子的违法行为带来的用户资金损失。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。在附图中：
图1为本实施例提出的一种金融终端安全防护系统框图；
图2为本实施例的系统示意图；
图3为本实施例提出的一种金融终端安全防护方法流程图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚明白，下面结合附图对本发明实施例做进一步详细说明。在此，本发明的示意性实施例及其说明用于解释本发明，但并不作为对本发明的限定。
如图1所示，为本实施例提出的一种金融终端安全防护系统框图。包括：金融终端101，用户行为跟踪单元102、用户行为分析单元103、用户行为模式库104和事件处理单元105；其中，
用户行为模式库104，用于从大量的终端交易操作行为中编制用户交易行为模式案例，并将用户交易行为模式案例进行存储；所述用户行为模式案例包括正常交易行为和异常交易行为；
所述用户行为跟踪单元102，用于获取用户在所述金融终端101上的交易操作行为信息，产生交易事件消息，并传输至所述用户行为分析单元；
所述用户行为分析单元103，用于对所述交易事件消息与所述用户行为模式库存储的用户行为模式案例进行匹配，判断交易事件消息是正常行为交易模式还是异常行为交易模式；并将判断结果发送至所述事件处理单元；
所述事件处理单元105，用于根据所述判断结果进行相应的交易行为处理。
本系统通过对用户行为的自动监控分析，区分正常金融交易用户与可疑犯罪分子，并提供报警以及实时风险处理功能，以保障金融终端交易安全。
如图2所示，为本实施例的系统示意图。系统组成：系统由金融终端(如ATM机)、用户行为跟踪单元(包括：虹膜焦点识别跟踪模块、视频图像识别跟踪模块、机具操作跟踪模块、交易处理跟踪模块)、用户行为分析单元、用户行为模式库、事件处理单元以及交易处理单元。
金融终端(如ATM机)：需要对传统的金融机具进行必要的改造，以支持将图像数据、机具操作数据发送到后台处理系统。
用户行为跟踪单元用于负责对用户的交易操作行为进行识别和跟踪：其中，包括：
虹膜焦点识别跟踪模块：通过视频摄像头，采集用户的虹膜焦点，实现对视觉焦点的跟踪。正常的金融终端交易，用户的视觉焦点会有相对固定的模式；
视频图像识别跟踪模块：通过视频摄像头，采集用户操作的视频图像数据，如：用户手部操作、用户的携带工具等；
对于虹膜焦点识别跟踪模块、视频图像识别跟踪模块来说，虹膜焦点识别跟踪模块和视频图像识别跟踪模块均通过摄像头进行实时图像和视频采集，并对图像和视频进行实时分析和处理，延时仅为秒级，可以保证实时性。
虹膜焦点识别跟踪以一定周期(如：0.5秒)进行图像采样，并对采样图像进行眼球追踪分析。为提高识别精度，可以采用红外线投射方式，主动投射红外线等光束到虹膜来提取特征。具体步骤包括：
采集眼部图像→图像预处理→虹膜及瞳孔检测→虹膜及瞳孔定位→虹膜角度变化及视线方向计算→触发事件消息。
机具操作跟踪模块：跟踪金融机具的用户操作，如：插卡、键盘输入、吐钞等。正常的金融终端操作，有其相对固定的机具操作次序模式；
交易处理跟踪模块：跟踪交易处理系统的交易处理环节，如：取现操作的金额、卡号等信息；
对于用户行为分析单元来说，根据用户行为跟踪单元提供的数据，进行用户行为的综合分析，匹配正常行为交易模式和异常行为交易模式，并提交事件处理模块进行后续处理。具体为：用户行为(如：取款)每一操作步骤，都相应会触发虹膜焦点识别跟踪模块、视频图像识别跟踪模块、机具操作跟踪模块、交易处理跟踪模块，产生交易事件消息，并提交给用户行为分析模块。用户行为分析模块针对交易事件消息的类型、发生时间序列以及交易金额等进行分析，在用户行为模式库中进行匹配，区分正常交易行为和异常交易行为，并相应进行后续处理(如：报警、终止交易)。
对于本实施例来说，用户行为模式库分为正常交易行为模式库和异常行为模式库。用户行为模式库的建立过程包括：
首先，初始用户行为模式库建立。具体为：
根据对常见的正常交易行为(如：取款)、常见的异常交易行为(如：非法安装盗卡装置)进行交易流程分析，编制用户行为模式案例，形成初始用户行为模式库；
其次，用户行为模式验证。具体为：
通过实际的用户操作，对初始用户行为模式库进行验证，并根据验证结果调整模式库；
最后，用户行为模式扩充。具体为：
根据实际发生的新型正常或异常交易，对应分析和设计新的用户行为模式，补充到用户行为模式库。
对于事件处理单元来说，用于负责交易行为的处理。具体包括：
当交易事件消息是正常行为交易模式时，支持金融交易终端发起的金融交易的后台处理；
否则，对于高风险异常行为，进行实时的交易处理，如：终止当前交易、停止金融机具服务等；对异常交易行为通过警报、短信等途径进行报警；同时，为系统监控人员提供异常交易行为的查询以及处理记录功能。
显然，本领域的技术人员应该明白，上述的本发明实施例的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明实施例不限制于任何特定的硬件和软件结合。
如图3所示，为本实施例提出的一种金融终端安全防护方法流程图。包括：
步骤301)：从大量的终端交易操作行为中编制用户交易行为模式案例，并将用户交易行为模式案例进行存储；所述用户行为模式案例包括正常交易行为和异常交易行为；
步骤302)：获取用户在所述金融终端上的交易操作行为信息，产生交易事件消息；
步骤303)：对所述交易事件消息与所述用户行为模式案例进行匹配，判断交易事件消息是正常行为交易模式还是异常行为交易模式；并将判断结果发送至所述事件处理单元；
步骤304)：根据所述判断结果进行相应的交易行为处理。
本发明实施例还提供了一种包括计算机可读指令的计算机可读存储介质，该计算机可读指令在被执行时使处理器至少执行以下操作：从大量的终端交易操作行为中编制用户交易行为模式案例，并将用户交易行为模式案例进行存储；所述用户行为模式案例包括正常交易行为和异常交易行为；获取用户在所述金融终端上的交易操作行为信息，产生交易事件消息；对所述交易事件消息与所述用户行为模式案例进行匹配，判断交易事件消息是正常行为交易模式还是异常行为交易模式；并将判断结果发送至所述事件处理单元；根据所述判断结果进行相应的交易行为处理。
根据上述金融终端安全防护方法流程，以下基于图2的系统描述正常的银行卡取款交易流程如下：
1、用户到达取款机：虹膜焦点识别跟踪模块、视频图像识别跟踪模块跟踪到用户进入。
2、插卡：虹膜焦点识别跟踪模块跟踪到用户的虹膜焦点集中到ATM机插卡槽，视频图像识别跟踪模块跟踪到用户插卡操作，机具操作跟踪模块监控到插卡操作；
3、屏幕输入：虹膜焦点识别跟踪模块跟踪到用户的虹膜焦点集中到ATM机屏幕，视频图像识别跟踪模块跟踪到用户屏幕输入操作，机具操作跟踪模块监控到屏幕输入操作；
4、密码键盘输入：虹膜焦点识别跟踪模块跟踪到用户的虹膜焦点集中到密码键盘，视频图像识别跟踪模块跟踪到用户密码键盘操作，机具操作跟踪模块监控到密码键盘操作；
5、交易发送后台处理：交易处理跟踪模块监控到取款交易提交和系统返回。
6、吐钞：机具操作跟踪模块监控到机具吐钞操作，虹膜焦点识别跟踪模块跟踪到用户的虹膜焦点集中到吐钞口，视频图像识别跟踪模块跟踪到用户取钞动作；
7、取卡：机具操作跟踪模块监控到机具吐卡操作，虹膜焦点识别跟踪模块跟踪到用户的虹膜焦点集中到ATM机插卡槽，视频图像识别跟踪模块跟踪到用户取卡操作；
8、离开取款机：虹膜焦点识别跟踪模块、视频图像识别跟踪模块跟踪到用户离开。
9、行为分析：用户行为分析单元进行用户行为的综合分析，匹配用户行为模式库，识别出正常交易行为模式，无需任何后续处理。
下面，基于图2所示的系统框图，描述异常操作行为，该操作行为是犯罪分子在ATM机插卡槽安装盗卡装置。具体流程为：
1、犯罪分子到达取款机：虹膜焦点识别跟踪模块、视频图像识别跟踪模块可能会跟踪到犯罪分子左右查看是否有人员。
2、犯罪分子安装盗卡装置：虹膜焦点识别跟踪模块跟踪到犯罪分子的虹膜焦点长时间集中到ATM机插卡槽，视频图像识别跟踪模块跟踪到犯罪分子取出盗卡装置、手部长时间停留在ATM机插卡槽，同时机具操作跟踪模块未监控到任何插卡操作、交易处理跟踪模块未监控到任何交易操作；
3、犯罪分子检查盗卡装置工作情况：犯罪分子插入测试用卡，检查盗卡装置是否正常。虹膜焦点识别跟踪模块跟踪到犯罪分子的虹膜焦点长时间集中到ATM机插卡槽， 视频图像识别跟踪模块跟踪到犯罪分子插卡操作，机具操作跟踪模块监控到插卡口异常、交易处理跟踪模块未监控到任何交易操作；
4、行为分析：用户行为分析单元进行用户行为的综合分析，匹配用户行为模式库，识别出异常行为模式；
5、事件处理：时间处理单元暂停发生可疑事件的ATM机任何操作，通过警报、短信等途径进行报警，系统监控和维护人员对问题机具进行检查和跟进处理。
进一步地，当嫌疑人带上鸭舌帽等，信息采集终端无法采集到虹膜焦点以及图像，虹膜焦点识别跟踪模块无法正常采集到虹膜及眼球数据，这本身就是一个异常事件。视频图像识别跟踪模块如果可以分析到嫌疑人蒙面等异常行为，也可以提供异常事件。
本技术方案匹配正常的金融终端操作行为模式和异常行为模式，并对异常交易行为进行跟踪处理，确保金融终端安全，避免和减轻犯罪分子的违法行为带来的用户资金损失。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (8)

  1. 一种金融终端安全防护系统，包括：金融终端，其特征在于，还包括：
    用户行为跟踪单元、用户行为分析单元、用户行为模式库和事件处理单元；其中，
    用户行为模式库，用于从大量的终端交易操作行为中编制用户交易行为模式案例，并将用户交易行为模式案例进行存储；所述用户行为模式案例包括正常交易行为和异常交易行为；
    所述用户行为跟踪单元，用于获取用户在所述金融终端上的交易操作行为信息，产生交易事件消息，并传输至所述用户行为分析单元；
    所述用户行为分析单元，用于对所述交易事件消息与所述用户行为模式库存储的用户行为模式案例进行匹配，判断交易事件消息是正常行为交易模式还是异常行为交易模式；并将判断结果发送至所述事件处理单元；
    所述事件处理单元，用于根据所述判断结果进行相应的交易行为处理。
  2. 如权利要求1所述的系统，其特征在于，所述用户行为跟踪单元包括虹膜焦点识别跟踪模块、视频图像识别跟踪模块、机具操作跟踪模块和交易处理跟踪模块；其中，
    所述虹膜焦点识别跟踪模块，用于通过视频摄像头，采集用户的虹膜焦点，实现对视觉焦点的跟踪；
    所述视频图像识别跟踪模块，用于通过视频摄像头，采集用户操作的视频图像数据；
    所述机具操作跟踪模块，用于跟踪金融终端的用户操作；
    所述交易处理跟踪模块，用于跟踪交易处理系统的交易处理环节。
  3. 如权利要求2所述的系统，其特征在于，所述用户行为分析单元对所述交易事件消息、发送时间序列以及交易金额进行分析，在所述用户行为模式库中进行匹配，区分正常交易行为和异常交易行为。
  4. 如权利要求1～3任一权利要求所述的系统，其特征在于，所述事件处理单元包括正常交易行为处理模块和异常交易行为处理模块；其中，
    所述正常交易行为处理模块，用于支持金融交易终端发起的金融交易的后台处理；
    所述异常交易行为处理模块，用于对异常交易行为进行终止处理，并进行系统报警；同时，提供异常交易行为的查询以及处理记录。
  5. 一种金融终端安全防护方法，其特征在于，包括：
    从大量的终端交易操作行为中编制用户交易行为模式案例，并将用户交易行为模式案例进行存储；所述用户行为模式案例包括正常交易行为和异常交易行为；
    获取用户在所述金融终端上的交易操作行为信息，产生交易事件消息；
    对所述交易事件消息与所述用户行为模式案例进行匹配，判断交易事件消息是正常行为交易模式还是异常行为交易模式；并将判断结果发送至所述事件处理单元；
    根据所述判断结果进行相应的交易行为处理。
  6. 如权利要求5所述的方法，其特征在于，所述获取用户在所述金融终端上的交易操作行为信息的步骤包括：
    通过视频摄像头，采集用户的虹膜焦点，实现对视觉焦点的跟踪；
    通过视频摄像头，采集用户操作的视频图像数据；
    跟踪金融终端的用户操作；
    跟踪交易处理系统的交易处理环节。
  7. 如权利要求6所述的方法，其特征在于，所述判断交易事件消息是正常行为交易模式还是异常行为交易模式的步骤包括：
    对所述交易事件消息、发送时间序列以及交易金额进行分析，利用分析结果与存储的所述用户行为模式案例进行匹配，区分正常交易行为和异常交易行为。
  8. 如权利要求5～7任一权利要求所述的方法，其特征在于，所述根据所述判断结果进行相应的交易行为处理的步骤包括：
    当交易事件消息是正常行为交易模式时，支持金融交易终端发起的金融交易的后台处理；
    否则，对异常交易行为进行终止处理，并进行系统报警；同时，提供异常交易行为的查询以及处理记录。
PCT/CN2016/107046 2015-12-21 2016-11-24 一种金融终端安全防护方法及系统 Ceased WO2017107734A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510966929.4A CN105957271B (zh) 2015-12-21 2015-12-21 一种金融终端安全防护方法及系统
CN201510966929.4 2015-12-21

Publications (1)

Publication Number Publication Date
WO2017107734A1 true WO2017107734A1 (zh) 2017-06-29

Family

ID=56917156

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/107046 Ceased WO2017107734A1 (zh) 2015-12-21 2016-11-24 一种金融终端安全防护方法及系统

Country Status (3)

Country Link
CN (1) CN105957271B (zh)
TW (1) TWI776796B (zh)
WO (1) WO2017107734A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113283600A (zh) * 2021-05-13 2021-08-20 江苏南工科技集团有限公司 一种基于hook技术的安全事件状态分析方法

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105957271B (zh) * 2015-12-21 2018-12-28 中国银联股份有限公司 一种金融终端安全防护方法及系统
CN106682985B (zh) * 2016-12-26 2020-03-27 深圳先进技术研究院 一种金融诈骗识别方法和系统
CN106803168B (zh) * 2016-12-30 2021-04-16 中国银联股份有限公司 一种异常转账侦测方法和装置
CN108875761B (zh) * 2017-05-11 2022-06-28 华为技术有限公司 一种拓展潜在用户的方法及装置
CN107170148A (zh) * 2017-05-17 2017-09-15 北京声迅电子股份有限公司 一种atm机的防加装盗卡装置预警系统及方法
CN108985482A (zh) * 2017-05-31 2018-12-11 北京京东尚科信息技术有限公司 监测异常查询的方法和系统
KR101879416B1 (ko) * 2017-06-12 2018-07-18 고려대학교 산학협력단 이상 금융거래 탐지 방법 및 그 전자 장치
TWI662483B (zh) * 2017-10-11 2019-06-11 Ctbc Bank Co., Ltd. 影像分析裝置及系統
CN107844787A (zh) * 2017-12-11 2018-03-27 广东工业大学 一种监控设备及管理系统
CN108564459A (zh) * 2018-01-09 2018-09-21 平安科技（深圳）有限公司 异常交易类型的判断方法、装置、设备及可读存储介质
CN108364078A (zh) * 2018-03-07 2018-08-03 广州图普网络科技有限公司 异样行为判断系统及方法
CN109509093B (zh) * 2018-10-18 2020-10-02 中信网络科技股份有限公司 一种基于主体画像的交易安全控制方法及系统
CN109299135B (zh) * 2018-11-26 2024-05-14 平安科技（深圳）有限公司 基于识别模型的异常查询识别方法、识别设备及介质
TWI705407B (zh) * 2019-01-11 2020-09-21 玉山商業銀行股份有限公司 異常帳戶自動化偵測方法及系統
TWI745070B (zh) * 2020-09-03 2021-11-01 中國信託商業銀行股份有限公司 非正常交易判斷方法及系統

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0652540B1 (en) * 1993-11-08 2000-09-20 NCR International, Inc. Self-service business system
CN101266704A (zh) * 2008-04-24 2008-09-17 张宏志 基于人脸识别的atm安全认证与预警方法
CN102176266A (zh) * 2011-01-24 2011-09-07 武汉大学 Atm银行卡视觉行为预警提示方法及系统
CN102289898A (zh) * 2011-09-08 2011-12-21 广州广电运通金融电子股份有限公司 自助交易自动紧急避险系统
CN105005901A (zh) * 2015-07-09 2015-10-28 厦门快商通信息技术有限公司 一种面向金融领域的交易欺诈检测系统与方法
CN105957271A (zh) * 2015-12-21 2016-09-21 中国银联股份有限公司 一种金融终端安全防护方法及系统

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1132797A3 (en) * 2000-03-08 2005-11-23 Aurora Wireless Technologies, Ltd. Method for securing user identification in on-line transaction systems
CN1627317A (zh) * 2003-12-12 2005-06-15 北京阳光奥森科技有限公司 利用主动光源获取人脸图像的方法
US7634114B2 (en) * 2006-09-01 2009-12-15 Sarnoff Corporation Method and apparatus for iris biometric systems for use in an entryway
CN100555348C (zh) * 2007-06-01 2009-10-28 北京汇大通业科技有限公司 银行自助设备智能视频监控系统
CN101609581A (zh) * 2008-06-16 2009-12-23 云南正卓信息技术有限公司 Atm机的异常视频预警装置
CN101794481A (zh) * 2009-02-04 2010-08-04 深圳市先进智能技术研究所 Atm自助银行监控系统和方法
CN202217340U (zh) * 2010-05-14 2012-05-09 北京海鑫智圣技术有限公司 应用于pos机的智能监控设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0652540B1 (en) * 1993-11-08 2000-09-20 NCR International, Inc. Self-service business system
CN101266704A (zh) * 2008-04-24 2008-09-17 张宏志 基于人脸识别的atm安全认证与预警方法
CN102176266A (zh) * 2011-01-24 2011-09-07 武汉大学 Atm银行卡视觉行为预警提示方法及系统
CN102289898A (zh) * 2011-09-08 2011-12-21 广州广电运通金融电子股份有限公司 自助交易自动紧急避险系统
CN105005901A (zh) * 2015-07-09 2015-10-28 厦门快商通信息技术有限公司 一种面向金融领域的交易欺诈检测系统与方法
CN105957271A (zh) * 2015-12-21 2016-09-21 中国银联股份有限公司 一种金融终端安全防护方法及系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113283600A (zh) * 2021-05-13 2021-08-20 江苏南工科技集团有限公司 一种基于hook技术的安全事件状态分析方法
CN113283600B (zh) * 2021-05-13 2023-10-03 江苏南工科技集团有限公司 一种基于hook技术的安全事件状态分析方法

Also Published As

Publication number Publication date
CN105957271A (zh) 2016-09-21
CN105957271B (zh) 2018-12-28
TWI776796B (zh) 2022-09-11
TW201723967A (zh) 2017-07-01

Similar Documents

Publication Publication Date Title
WO2017107734A1 (zh) 一种金融终端安全防护方法及系统
US10629036B2 (en) Surveillance device
US9069997B2 (en) Biometric matching system using input biometric sample
US11501301B2 (en) Transaction terminal fraud processing
US20240119809A1 (en) Hand action tracking for card slot tampering
TWM565361U (zh) 金融交易詐騙偵測防範系統
US20240331390A1 (en) Frictionless Authentication and Monitoring
CN105427480B (zh) 一种基于图像分析的柜员机
US11798285B2 (en) Frictionless and autonomous activity and behavioral monitoring
WO2020093757A1 (zh) 一种基于背景协同的风险检测方法、装置及系统
Hossain et al. Utilizing the internet of things, monitoring and protecting system for automated teller machines
Akinola Kayode et al. Multi-factor authentication model for integrating iris recognition into an automated teller machine
CN114255417A (zh) 清点现场合规检测方法、装置、设备及存储介质
TWI662483B (zh) 影像分析裝置及系統
HK1226537A1 (zh) 一种金融终端安全防护方法及系统
HK1226537B (zh) 一种金融终端安全防护方法及系统
TWM590739U (zh) 非常態交易輔助識別系統
US12499682B2 (en) Systems and methods for video-based fraud detection
CN111145456A (zh) 一种基于背景协同的风险检测方法、装置及系统
EP3828805A1 (en) Frictionless fraud identification and tracking
TWM681677U (zh) 自動櫃員機詐騙車手偵測系統
CN121504466A (zh) 基于多模态感知的公共资源交易ai智能见证终端及方法
CN115019250A (zh) 银行网点的异常行为检测方法及装置
TWM681609U (zh) 自動提款機阻詐自動通知系統
CN121580081A (zh) 数据处理方法、装置、设备、存储介质及程序产品

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16877545

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16877545

Country of ref document: EP

Kind code of ref document: A1