WO2022250188A1

WO2022250188A1 - Fraud detection system based on low-level data analysis, and method therefor

Info

Publication number: WO2022250188A1
Application number: PCT/KR2021/006699
Authority: WO
Inventors: 김성수; 황희준; 이명훈; 김미희
Original assignee: 주식회사 유스비
Priority date: 2021-05-28
Filing date: 2021-05-28
Publication date: 2022-12-01

Abstract

Disclosed are a fraud detection system based on low-level data analysis, and a method therefor, the system using artificial intelligence to analyze, at a low level, financial-transaction-related data related to user medium environment information and financial transaction type information about a customer performing a financial transaction, thereby effectively detecting an abnormal financial transaction and automating the detection through the artificial intelligence. A fraud detection system based on low-level data analysis, according to an embodiment of the present invention, comprises: a data collection unit for collecting financial-transaction-related data related to user medium environment information and financial transaction type information about a customer; a low-level data conversion unit for converting the collected financial-transaction-related data into low-level data; a low-level data analysis unit for analyzing the low-level data by means of an artificial intelligence model; and an abnormal transaction determination unit for detecting an abnormal transaction on the basis of the low-level data analysis result of the artificial intelligence model.

Description

Abnormal financial transaction detection system and method based on low-level data analysis

The present invention analyzes financial transaction-related data related to customer media environment information, financial transaction type information, etc. of customers conducting financial transactions at a low level by artificial intelligence to effectively detect abnormal financial transactions. Abnormal finance based on low-level data analysis It relates to a Fraud Detection System (FDS) and its method.

Fraud Detection System (FDS) is a security method that collects various information from the payer to create a pattern, then catches the pattern and other abnormal payments and blocks the payment route. It is characterized by active security intervention based on big data. FDS consists of information collection function, analysis and detection function, response function, monitoring and audit function, and is attracting attention as an essential security method at a time when fintech becomes important. The conventional FDS method has a problem in that hackers, voice phishing criminals, and money laundering criminals using cryptocurrency can easily manipulate financial transaction-related data to incapacitate the FDS service.

The present invention is an abnormal financial transaction based on low-level data analysis that can effectively detect abnormal financial transactions and automate them with artificial intelligence by analyzing user media environment information, financial transaction type information, etc. of customers conducting financial transactions at a low level. It is to provide a detection system (FDS) and method thereof.

In addition, the present invention is to provide an abnormal financial transaction detection service based on low-level data analysis suitable for a customer's transaction type by determining a low-level type most suitable for detecting an abnormal financial transaction according to a customer's transaction type.

An abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention includes: a data collection unit configured to collect financial transaction-related data related to customer user media environment information and financial transaction type information; a low-level data converter configured to convert the collected data related to financial transactions into low-level data; a low-level data analysis unit configured to analyze the low-level data by an artificial intelligence model; and an abnormal transaction determining unit configured to detect an abnormal transaction based on a low-level analysis result of the artificial intelligence model.

The low-level data may include at least one of assembly language, machine language (hex code data, binary code data, etc.) ASCII data, and EBCO data.

The low-level data conversion unit includes: a customer transaction type analysis unit configured to analyze a transaction type of the customer based on the financial transaction related data; a low-level type determination unit configured to determine one of a plurality of low-level types including assembly language, hexacode, binary code, ASCII, and EBCO according to the transaction type of the customer; and a low-level conversion unit configured to convert the financial transaction-related data into low-level data corresponding to the low-level type.

The low-level data converter includes: a hexacode converter configured to convert the financial transaction-related data into hexacode data; a binary code converter configured to convert the financial transaction-related data into binary code data; an ASCII conversion unit configured to convert the financial transaction-related data into ASCII data; an EBCO conversion unit configured to convert the financial transaction-related data into EBCO data; and an assembly language conversion unit configured to convert the financial transaction related data into assembly language data.

The low-level data analysis unit includes: a hexacode-based FDS analysis unit configured to predict a first or more financial transaction probability by extracting features related to an abnormal financial transaction by a hexacode-based artificial intelligence model based on the hexacode data; a binary code-based FDS analyzer configured to predict a second abnormal financial transaction probability by extracting features related to an abnormal financial transaction by a binary code-based artificial intelligence model based on the binary code data; an ASCII-based FDS analysis unit configured to predict a third abnormal financial transaction probability by extracting features related to an abnormal financial transaction by an ASCII-based artificial intelligence model based on the ASCII data; an EBCO-based FDS analyzer configured to predict a fourth abnormal financial transaction probability by extracting features related to an abnormal financial transaction by an EBCO-based artificial intelligence model based on the EBCO data; and an assembly language-based FDS analyzer configured to predict a fifth or higher probability of financial transactions by extracting features related to abnormal financial transactions by an assembly language-based artificial intelligence model based on the assembly language data.

The abnormal transaction determining unit may include: a customer transaction type analysis unit configured to analyze a transaction type of the customer based on the financial transaction related data; a weight setting unit configured to set weights of assembly language, machine language (hexadecimal code, binary code, etc.), ASCII, and EBCO according to the transaction type of the customer; and applying the weights to the first or higher financial transaction probability, the second or higher financial transaction probability, the third or higher financial transaction probability, the fourth or higher financial transaction probability, and the fifth or higher financial transaction probability to determine the abnormal transaction. An abnormal transaction determination unit configured to detect; may include.

An abnormal financial transaction detection method based on low-level data analysis according to an embodiment of the present invention includes: collecting, by a data collection unit, financial transaction-related data related to user media environment information and financial transaction type information of a customer; converting the collected financial transaction-related data into low-level data by a low-level data conversion unit; analyzing the low-level data using an artificial intelligence model by a low-level data analysis unit; and detecting, by an abnormal transaction determination unit, an abnormal transaction based on a low-level analysis result of the artificial intelligence model.

The converting the low-level data into low-level data may include: analyzing, by a customer transaction type analyzer, a transaction type of the customer based on the financial transaction related data; Determining, by the low-level type determining unit, one of a plurality of low-level types including assembly language, machine language (Hex code, binary code, etc.), ASCII, and EBCO, according to the transaction type of the customer. step; and converting the financial transaction-related data into low-level data corresponding to the low-level type by a low-level conversion unit.

The converting of the low-level data into low-level data may include: converting the financial transaction-related data into hexacode data by a hexacode converter; converting the financial transaction-related data into binary code data by a binary code conversion unit; converting the financial transaction-related data into ASCII data by an ASCII conversion unit; converting the financial transaction-related data into EBCO data by an EBCO conversion unit; and converting the financial transaction-related data into assembly language data by an assembly language conversion unit.

The step of analyzing the low-level data: extracting features related to abnormal financial transactions by a hexacode-based artificial intelligence model based on the hexacode-based FDS analysis unit based on the hexacode data to obtain a first or higher probability of financial transactions predicting; Predicting a probability of a second or more financial transaction by extracting features related to an abnormal financial transaction by a binary code-based artificial intelligence model based on the binary code data by a binary code-based FDS analysis unit; Predicting a third abnormal financial transaction probability by an ASCII-based FDS analysis unit by extracting features related to an abnormal financial transaction by an ASCII-based artificial intelligence model based on the ASCII data; predicting a fourth abnormal financial transaction probability by extracting features related to abnormal financial transactions by an EBCO-based artificial intelligence model based on the EBCO data by an EBCO-based FDS analysis unit; and extracting features related to abnormal financial transactions by an assembly language-based FDS analysis unit based on the assembly language data based on an assembly language-based artificial intelligence model and predicting a fifth or higher probability of financial transactions.

The detecting of the abnormal transaction may include: analyzing, by a customer transaction type analyzer, a transaction type of the customer based on the financial transaction related data; setting, by a weight setting unit, weights of assembly language, machine language (Hex code, binary code, etc.), ASCII, and EBCO according to the transaction type of the customer; and the abnormal transaction determination unit determines the first or higher probability of financial transaction, the second or higher probability of financial transaction, the third or higher probability of financial transaction, the fourth or higher probability of financial transaction, and the fifth or higher probability of financial transaction. It may include; detecting an abnormal transaction by applying weights.

An abnormal financial transaction detection method based on low-level data analysis according to an embodiment of the present invention further includes: analyzing the transaction type of the customer based on the financial transaction-related data by a customer transaction type analyzer; , The step of analyzing the low-level data may include: extracting a plurality of code regions from the low-level data according to the transaction type of the customer; and analyzing the low-level data by setting a weight for each code region according to the transaction type of the customer.

According to an embodiment of the present invention, a computer program recorded on a computer-readable recording medium is provided to execute the low-level data analysis-based abnormal financial transaction detection method.

According to an embodiment of the present invention, financial transaction-related data related to user media environment information and financial transaction type information of customers conducting financial transactions are analyzed at a low level using artificial intelligence to effectively detect abnormal financial transactions and to artificially detect them. An abnormal financial transaction detection system and method based on low-level data analysis that can be automated with intelligence are provided.

In addition, according to an embodiment of the present invention, it is possible to provide an abnormal financial transaction detection service based on low-level data analysis suitable for the customer's transaction type by determining the most suitable low-level type for detecting abnormal financial transactions according to the customer's transaction type. have.

1 is a block diagram of an abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention.

2 is a block diagram of a low-level data converter constituting an abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention.

3 and 4 are exemplary diagrams illustrating that financial transaction-related data is converted into low-level data according to an embodiment of the present invention.

5 is a block diagram of a low-level data converter constituting an abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention.

6 is a block diagram showing a low-level data analysis unit, an artificial intelligence model, and an abnormal transaction decision unit constituting an abnormal financial transaction detection system based on low-level data analysis according to another embodiment of the present invention.

7 is a flowchart of an abnormal financial transaction detection method based on low-level data analysis according to an embodiment of the present invention.

8 is a flowchart illustrating step S130 of FIG. 7 .

9 is a flowchart illustrating steps S140 and S150 of FIG. 7 .

Advantages and features of the present invention, and methods of achieving them, will become clear with reference to the detailed description of the following embodiments taken in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in a variety of different forms.

Embodiments of the present invention are provided to complete the disclosure of the present invention and to fully inform those skilled in the art of the scope of the invention, and the present invention is governed by the scope of the claims. only to be defined Like reference numbers designate like elements throughout the specification.

In this specification, when a certain component is said to "include", it means that it may further include other components, not excluding other components unless otherwise stated.

'~ unit' used in this specification is a unit that processes at least one function or operation, and may mean, for example, software, an FPGA, or a hardware component. Functions provided by '~unit' may be performed separately by a plurality of components or may be integrated with other additional components.

'~unit' in this specification is not necessarily limited to software or hardware, and may be configured to be in an addressable storage medium or configured to reproduce one or more processors. Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

An abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention converts financial transaction-related data related to customer user media environment information and financial transaction type information into low-level data representing one-dimensional information. data), and analyze the low-level data by an artificial intelligence model to detect abnormal transactions.

1 is a block diagram of an abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention. Referring to FIG. 1 , an abnormal financial transaction detection system 100 based on low-level data analysis according to an embodiment of the present invention may include a data collection unit 200 and an abnormal financial transaction detection unit 300 .

The data collection unit 200 may be configured to collect financial transaction-related data related to customer user media environment information and financial transaction type information from a customer terminal (not shown). The customer terminal is a terminal used by a customer, and may be, for example, a terminal used by a fintech company, a blockchain exchange, a bank, a securities company, an insurance company, various other financial institutions, or individual customers.

User media environment information includes, for example, hardware-related information such as Internet/smartphone/PDA/VM banking (eg, device model name, CPU information, HDD information, MAC information, etc.), application-related information (eg, OS version information, browser information, manufacturer information, security program information, software use information, etc.), network-related information (eg, IP information, VPN information, proxy IP information, connection network information, etc.). The financial transaction type information may include, for example, transaction-related information such as a transaction pattern or transaction tendency, such as a customer's transfer amount, account, time, and access.

Data related to financial transactions of customers collected from customer terminals are, for example, application services of fintech companies, e-wallet opening of blockchain exchanges, online banking account opening of banks, securities trading app account opening of securities companies, and online information related to insurance companies. Data for various financial transaction services such as insurance application may be included.

The data collection unit 200 may include an input device and/or a receiving device receiving data from a customer terminal. The customer's financial transaction-related data collected by the data collection unit 200 may be transmitted to the abnormal financial transaction detection unit 300 .

The abnormal financial transaction detection unit 300 includes a low-level data conversion unit 310, a low-level data analysis unit 320, an artificial intelligence model 330, an abnormal transaction determination unit 340, and an artificial intelligence learning unit 350. can include

The low-level data conversion unit 310 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into low-level data. The low-level data conversion unit 310 may convert customer financial transaction-related data into low-level data by, for example, web forensics.

In an embodiment of the present invention, the customer's financial transaction-related data is converted into assembly language, machine language (hexacode data, binary code data, etc.), ASCII by the low-level data conversion unit 310 data, and low-level data including at least one of EBCO data.

2 is a block diagram of a low-level data converter constituting an abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention. 1 and 2, the low-level data conversion unit 310 includes a hexadecimal code conversion unit 312, a binary code conversion unit 314, an ASCII conversion unit 316, an EBCO conversion unit 318, and an assembly language A conversion unit 319 may be included.

The hexacode conversion unit 312 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into hexadecimal code data corresponding to a hexadecimal hexadecimal code type.

The binary code conversion unit 314 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into binary code data corresponding to a binary code type.

The ASCII conversion unit 316 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into ASCII data corresponding to an ASCII code type.

The EBCO conversion unit 318 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into EBCO data corresponding to an EBCO code type.

The assembly language conversion unit 319 may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into assembly language data corresponding to an assembly language code type.

3 and 4 are exemplary diagrams illustrating that financial transaction-related data is converted into low-level data according to an embodiment of the present invention. 3 shows an example of hexacode data, and FIG. 4 shows an example of binary code data.

The artificial intelligence model 330 extracts patterns (10, 20, 30) (40, 50, 60) of a specific area from low-level data, and extracts the extracted patterns (10, 20, 30) (40, 50, 60) can be learned to detect abnormal financial transactions by analyzing the rules.

The low-level data analysis unit 320 will be configured to analyze the low-level data converted by the low-level data conversion unit 310 using the artificial intelligence model 330 learned by the artificial intelligence learning unit 350. can

The artificial intelligence learning unit 350 may learn an artificial intelligence model by converting generally collected customer transaction data into low-level data and extracting features corresponding to patterns of the low-level data.

The features learned by the artificial intelligence learning unit 350 include transaction type information such as internet/smart phone/PDA/VM banking related to the transaction data requested by the customer, IP address of the customer terminal, VPN information, proxy IP information, connection network Network information such as information, device information of the customer terminal (device model name, CPU information, HDD information, device type such as MAC information), OS version, browser, manufacturer, security program, application information such as software use, location of the customer terminal Information (Korea, North Korea, China, Russia, etc.), Internet access protocol (TCPIP, UDP, etc.), transaction time, connection maintenance time, transfer amount, transaction pattern/tendency information such as account information, etc. may be included.

The abnormal transaction determination unit 340 may be configured to detect abnormal transactions based on the low-level analysis result of the low-level data analysis unit 320 using the artificial intelligence model 330 .

Low-level data is not easy to manipulate to avoid FDS even for hackers with high hacking ability, and when manipulated by a hacker, its inherent characteristics are changed, so it is possible to determine whether or not it has been manipulated.

Therefore, according to an embodiment of the present invention, even if hackers, voice phishing criminals, money laundering criminals using cryptocurrency, etc. attempt to manipulate data to avoid FDS, the data manipulation can be easily identified, and behaviors that are out of statistics can be detected and Abnormal financial transactions can be accurately detected.

According to the embodiment of the present invention as described above, abnormal financial transactions are effectively detected by analyzing user media environment information, financial transaction type information, etc. of customers conducting financial transactions at a low level, and it can be automated with artificial intelligence. .

If there is manipulation of financial transaction-related data or it is detected that the data corresponds to an abnormal financial transaction, an alarm may be generated to a person in charge of a task related to preventing an abnormal financial transaction.

5 is a block diagram of a low-level data converter constituting an abnormal financial transaction detection system based on low-level data analysis according to an embodiment of the present invention. Referring to FIGS. 1 and 5 , the low-level data conversion unit 310 may include a customer transaction type analysis unit 310a, a low-level type determination unit 310b, and a low-level conversion unit 310c.

The customer transaction type analysis unit 310a may be configured to analyze the transaction type of the corresponding customer based on the customer's financial transaction-related data collected by the data collection unit 200 .

The customer's transaction type is the transaction request amount, transaction target, type of customer terminal, region (country), and institution to which the customer belongs (fintech company, blockchain exchange, bank, securities company, insurance company, other financial institutions or individual customers) , Internet access protocol type, transaction time type, connection maintenance time type, etc. can be set and classified in various ways.

The low-level type determination unit 310b determines a plurality of rows including assembly language, machine language (hexacode, binary code, etc.), ASCII and EBCO according to the customer's specific transaction type analyzed by the customer transaction type analysis unit 310a. It can be configured to determine the low level type of any one of the level types.

The low-level type determining unit 310b may learn a low-level type showing the best FDS performance for each transaction type of the customer, and then determine a low-level type that is most suitable for the FDS according to the transaction type of the customer.

The low-level conversion unit 310c may be configured to convert the customer's financial transaction-related data collected by the data collection unit 200 into low-level data corresponding to the low-level type determined by the low-level type determination unit 310b. can

According to the embodiment of FIG. 5, the FDS service suitable for the customer's transaction type can be provided by determining the low-level type most suitable for the FDS according to the customer's transaction type and converting the customer's financial transaction-related data into the corresponding low-level type. can

1, 2 and 6, the low-level data analysis unit 320 includes a hexacode-based FDS analysis unit 322, a binary code-based FDS analysis unit 324, an ASCII-based FDS analysis unit 326, A BCO-based FDS analysis unit 328 and an assembly language-based FDS analysis unit 329 may be included.

The hexacode-based FDS analysis unit 322 extracts features related to abnormal financial transactions by the hexacode-based artificial intelligence model 332 based on the hexacode data converted by the hexacode conversion unit 312 to obtain the first or higher It can be configured to predict the probability of a financial transaction.

The binary code-based FDS analysis unit 324 extracts features related to the abnormal financial transaction by the binary code-based artificial intelligence model 334 based on the binary code data converted by the binary code conversion unit 314, and second or higher It can be configured to predict the probability of a financial transaction.

The ASCII-based FDS analysis unit 326 extracts features related to the abnormal financial transaction by the ASCII-based artificial intelligence model 336 based on the ASCII data converted by the ASCII conversion unit 316 to determine the probability of the third abnormal financial transaction. It can be configured to predict.

The EBCO-based FDS analysis unit 328 extracts features related to abnormal financial transactions by the EBCO-based artificial intelligence model 338 based on the EBCO data converted by the EBCO conversion unit 318 to determine the fourth or higher probability of financial transactions It can be configured to predict.

The assembly language-based FDS analysis unit 329 extracts features related to abnormal financial transactions by the assembly language-based artificial intelligence model 339 based on the assembly language data converted by the assembly language conversion unit 319, and calculates a fifth or higher probability of financial transactions. It can be configured to predict.

In an embodiment of the present invention, the abnormal transaction determining unit 340 may include a customer transaction type analyzing unit 342 , a weight setting unit 344 , and an abnormal transaction determining unit 346 .

Similar to the customer transaction type analyzer 310a described above, the customer transaction type analyzer 342 analyzes the customer's transaction type based on the customer's financial transaction-related data collected by the data collection unit 200. can be configured to

The weight setting unit 344 may be configured to set weights of assembly language, hexacode, binary code, ASCII, and EBCO according to the transaction type of the customer analyzed by the customer transaction type analysis unit 342 .

The abnormal transaction determination unit 346 may be configured to detect abnormal transactions by applying the weights set by the weight setting unit 344 to the probability of a plurality of abnormal financial transactions predicted for each of various low-level types.

In the embodiment, the abnormal transaction determination unit 346 determines the probability of the first abnormal financial transaction predicted by the hexacode-based FDS analysis unit 322 and the second abnormal financial transaction predicted by the binary code-based FDS analysis unit 324 probability, the third or higher financial transaction probability predicted by the ASCII-based FDS analysis unit 326, the fourth or higher financial transaction probability predicted by the EBCO-based FDS analysis unit 328, and the assembly language-based FDS analysis unit 329 Abnormal transactions may be detected by applying the weights set by the weight setting unit 344 to the probability of the fifth abnormal financial transaction predicted by the above.

According to the embodiment of FIG. 6, FDS services suitable for the customer's transaction type can be provided by combining FDS analysis results of various low-level types by setting and applying weights of various low-level types according to the customer's transaction type. have.

In another embodiment of the present invention, the low-level data analysis unit 320 extracts a plurality of code areas from each low-level data for each of various low-level types, and the customer's transaction type analysis unit 342 analyzes An abnormal financial transaction may be detected by setting a weight for each code area according to the transaction type by a weight setting unit.

A plurality of code regions extracted from each low-level data (code regions corresponding to feature parts that change during financial transactions) may be different for each low-level type. A plurality of code areas extracted from each low-level data and a weight (relationship with ideal financial transaction) of each code area may be determined or set by a learned artificial intelligence model, or may be selected or input by an expert.

The hexacode-based FDS analysis unit 322 extracts first code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the hexacode data, and assigns a weight set to each of the first code areas. It can be applied to detect abnormal financial transactions. In this case, the first code areas selected from the hexacode data may be changed according to the customer's transaction type, and the weights of the first code areas may also be set differently according to the customer's transaction type.

The binary code-based FDS analysis unit 324 extracts second code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the binary code data, and assigns a weight set to each of the second code areas. It can be applied to detect abnormal financial transactions. In this case, the second code areas selected from the binary code data may be changed according to the customer's transaction type, and the weights of the second code areas may also be set differently according to the customer's transaction type.

The ASCII-based FDS analysis unit 326 extracts third code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the ASCII data, and applies a weight set to each of the third code areas. Abnormal financial transactions can be detected. In this case, the third code regions selected from the ASCII data may be changed according to the customer's transaction type, and the weights of the third code regions may also be set differently according to the customer's transaction type.

The EBCO-based FDS analysis unit 328 extracts fourth code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the EBCO data, and applies a set weight to each of the fourth code areas to obtain Abnormal financial transactions can be detected. In this case, the fourth code areas selected from the EBCO data may be changed according to the customer's transaction type, and the weights of the fourth code areas may also be set differently according to the customer's transaction type.

The assembly language-based FDS analysis unit 329 extracts fifth code areas according to the customer transaction type analyzed by the customer transaction type analysis unit 342 from the assembly language data, and applies a set weight to each of the fifth code areas. Abnormal financial transactions can be detected. In this case, the fifth code regions selected from the assembly language data may be changed according to the customer's transaction type, and the weights of the fifth code regions may also be set differently according to the customer's transaction type.

According to this embodiment, after extracting specific code areas according to the customer's transaction type from the vast amount of low-level data, and then applying weights determined according to the customer's transaction type to the extracted code areas, efficient and effective financial transaction can be detected.

7 is a flowchart of an abnormal financial transaction detection method based on low-level data analysis according to an embodiment of the present invention. Referring to Figures 1 and 7, first, the FDS artificial intelligence model can be learned using general transaction data (learning data) (S110).

The data collection unit 200 provides financial transaction-related data requested by the customer from the customer terminal (eg, fintech company app service, blockchain exchange e-wallet opening, bank online banking account opening, securities company stock trading app account). data) may be collected (S120).

The low-level data conversion unit 310 may convert the customer's financial transaction-related data collected by the data collection unit 200 into low-level data (S130). The low-level data conversion unit 310 may convert customer financial transaction-related data into low-level data by, for example, web forensics.

In an embodiment of the present invention, the customer's financial transaction-related data by the low-level data conversion unit 310 includes at least one of assembly language, machine language (hexadecimal code data, binary code data, etc.), ASCII data, and EBCO data. It can be converted into low-level data.

The low-level data analysis unit 320 may analyze the low-level data converted by the low-level data conversion unit 310 using the artificial intelligence model 330 learned by the artificial intelligence learning unit 350. (S140).

The abnormal transaction determination unit 340 may detect an abnormal transaction based on the low-level analysis result analyzed by the low-level data analysis unit 320 using the artificial intelligence model 330 (S150).

8 is a flowchart illustrating step S130 of FIG. 7 . Referring to FIGS. 1, 5, 7, and 8 , the customer transaction type analyzer 310a analyzes the customer's transaction type based on the customer's financial transaction-related data collected by the data collection unit 200. It can (S132).

In the embodiment, the customer's transaction type is the transaction request amount, transaction target, type of customer terminal, region (country), customer's institution (fintech companies, blockchain exchanges, banks, securities companies, insurance companies, etc. Customer), Internet access protocol type, transaction time type, connection maintenance time type, etc.

The low-level type determination unit 310b determines the customer's transaction type analyzed by the customer transaction type analysis unit 310a, assembly language, machine language (Hex code, binary code, etc.), a plurality of low-level including ASCII and EBCO. One of the low-level types may be determined (S134).

The low-level conversion unit 310c may convert the customer's financial transaction-related data collected by the data collection unit 200 into low-level data corresponding to the low-level type determined by the low-level type determination unit 310b. (S136).

According to the embodiment of FIG. 8 , an FDS service suitable for the customer's transaction type can be provided by determining the low-level type most suitable for the FDS according to the customer's transaction type and converting the customer's financial transaction-related data into the corresponding low-level type. can

9 is a flowchart illustrating steps S140 and S150 of FIG. 7 . Referring to FIGS. 1, 6, 7, and 9 , the low-level data analyzer 320 may analyze low-level data according to various low-level types (S142).

In the embodiment, the hexacode-based FDS analysis unit 322 extracts features related to abnormal financial transactions by the hexacode-based artificial intelligence model 332 based on the hexacode data converted by the hexacode converter 312 Thus, the first or higher financial transaction probability may be predicted.

In an embodiment, the binary code-based FDS analysis unit 324 extracts features related to abnormal financial transactions by the binary code-based artificial intelligence model 334 based on the binary code data converted by the binary code conversion unit 314. Thus, the probability of the second or higher financial transaction may be predicted.

In the embodiment, the ASCII-based FDS analysis unit 326 extracts features related to the abnormal financial transaction by the ASCII-based artificial intelligence model 336 based on the ASCII data converted by the ASCII conversion unit 316, and third or higher You can predict the probability of a financial transaction.

In an embodiment, the EBCO-based FDS analysis unit 328 extracts features related to abnormal financial transactions by the EBCO-based artificial intelligence model 338 based on the EBCO data converted by the EBCO conversion unit 318 to obtain a fourth or higher You can predict the probability of a financial transaction.

In an embodiment, the assembly language-based FDS analysis unit 329 extracts features related to abnormal financial transactions by the assembly language-based artificial intelligence model 339 based on the assembly language data converted by the assembly language conversion unit 319, You can predict the probability of a financial transaction.

The customer transaction type analysis unit 342 may analyze the transaction type of the customer requesting the financial transaction based on the customer's financial transaction-related data collected by the data collection unit 200 (S144).

The weight setting unit 344 may set the weights of assembly language, machine language (Hex code, binary code, etc.), ASCII, and EBCO according to the transaction type of the customer analyzed by the customer transaction type analysis unit 342 (S152).

The abnormal transaction determination unit 346 determines the probability of the first or more financial transactions predicted by the hexacode-based FDS analysis unit 322, the probability of the second or more financial transactions predicted by the binary code-based FDS analysis unit 324, and the ASCII-based The third or more financial transaction probability predicted by the FDS analysis unit 326, the fourth or more financial transaction probability predicted by the EBCO-based FDS analysis unit 328, and the second prediction by the assembly language-based FDS analysis unit 329 Abnormal transactions may be detected by applying the weights set by the weight setting unit 344 to the probability of 5 or more financial transactions (S154).

According to the embodiment of FIG. 9, FDS services suitable for the customer's transaction type can be provided by combining FDS analysis results of various low-level types by setting and applying weights of various low-level types according to the customer's transaction type. have.

The embodiments described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, the devices, methods and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate (FPGA) array), programmable logic units (PLUs), microprocessors, or any other device capable of executing and responding to instructions.

A processing device may run an operating system and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art know that a processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It will be understood that it can include

For example, a processing device may include a plurality of processors or a processor and a controller. Also, other processing configurations are possible, such as a parallel processor. Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. You can command the device.

Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. Computer readable media may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CDROMs and DVDs, and ROMs, RAMs, and flash memories. hardware devices specially configured to store and execute program instructions, such as; Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with limited examples and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved. Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

Claims

a data collection unit configured to collect financial transaction-related data related to customer user media environment information and financial transaction type information;

a low-level data converter configured to convert the collected data related to financial transactions into low-level data;

a low-level data analysis unit configured to analyze the low-level data by an artificial intelligence model; and

An abnormal financial transaction detection system based on low-level data analysis comprising: an abnormal transaction determining unit configured to detect an abnormal transaction based on a low-level analysis result of the artificial intelligence model.
According to claim 1,

The low-level data includes at least one of assembly language, hexacode data, binary code data, ASCII data, and EBCO data, and the abnormal financial transaction detection system based on low-level data analysis.
According to claim 1,

The low-level data conversion unit:

a customer transaction type analyzer configured to analyze a transaction type of the customer based on the financial transaction related data;

a low-level type determination unit configured to determine one of a plurality of low-level types including assembly language, hexacode, binary code, ASCII, and EBCO according to the transaction type of the customer; and

A low-level data analysis-based abnormal financial transaction detection system comprising: a low-level conversion unit configured to convert the financial transaction-related data into low-level data corresponding to the low-level type.
According to claim 1,

The low-level data conversion unit:

a hexacode converter configured to convert the financial transaction-related data into hexacode data;

a binary code converter configured to convert the financial transaction-related data into binary code data;

an ASCII conversion unit configured to convert the financial transaction-related data into ASCII data;

an EBCO conversion unit configured to convert the financial transaction-related data into EBCO data; and

An abnormal financial transaction detection system based on low-level data analysis comprising: an assembly language conversion unit configured to convert the financial transaction related data into assembly language data.
According to claim 4,

The low-level data analysis unit:

a hexacode-based FDS analyzer configured to predict a first or more financial transaction probability by extracting features related to an abnormal financial transaction by a hexacode-based artificial intelligence model based on the hexacode data;

a binary code-based FDS analyzer configured to predict a second abnormal financial transaction probability by extracting features related to an abnormal financial transaction by a binary code-based artificial intelligence model based on the binary code data;

an ASCII-based FDS analysis unit configured to predict a third abnormal financial transaction probability by extracting features related to an abnormal financial transaction by an ASCII-based artificial intelligence model based on the ASCII data;

an EBCO-based FDS analyzer configured to predict a fourth abnormal financial transaction probability by extracting features related to an abnormal financial transaction by an EBCO-based artificial intelligence model based on the EBCO data; and

An assembly language-based FDS analysis unit configured to extract features related to abnormal financial transactions by an assembly language-based artificial intelligence model based on the assembly language data and predict a fifth or higher probability of financial transactions; Abnormal finance based on low-level data analysis including transaction detection system.
According to claim 5,

The abnormal transaction determining unit:

a customer transaction type analyzer configured to analyze a transaction type of the customer based on the financial transaction related data;

a weight setting unit configured to set weights of assembly language, hexacode, binary code, ASCII, and EBCO according to the transaction type of the customer; and

An abnormal transaction is detected by applying the weights to the first or higher financial transaction probability, the second or higher financial transaction probability, the third or higher financial transaction probability, the fourth or higher financial transaction probability, and the fifth or higher financial transaction probability. An abnormal financial transaction detection system based on low-level data analysis comprising: an abnormal transaction determination unit configured to:
collecting, by a data collection unit, financial transaction-related data related to user media environment information and financial transaction type information of a customer;

converting the collected financial transaction-related data into low-level data by a low-level data conversion unit;

analyzing the low-level data using an artificial intelligence model by a low-level data analysis unit; and

A method for detecting an abnormal financial transaction based on low-level data analysis, comprising: detecting an abnormal transaction based on a low-level analysis result of the artificial intelligence model by an abnormal transaction determining unit.
According to claim 7,

The method of detecting abnormal financial transactions based on low-level data analysis, wherein the low-level data includes at least one of assembly language data, hexacode data, binary code data, ASCII data, and EBCO data.
According to claim 7,

The step of converting to the low-level data is:

analyzing the transaction type of the customer based on the financial transaction related data by a customer transaction type analysis unit;

determining, by a low-level type determining unit, one low-level type among a plurality of low-level types including assembly language, hexacode, binary code, ASCII, and EBCO, according to the transaction type of the customer; and

A low-level data analysis-based abnormal financial transaction detection method comprising: converting the financial transaction-related data into low-level data corresponding to the low-level type by a low-level conversion unit.
According to claim 7,

The step of converting to the low-level data is:

converting the financial transaction-related data into hexa-code data by a hexa-code converter;

converting the financial transaction-related data into binary code data by a binary code conversion unit;

converting the financial transaction-related data into ASCII data by an ASCII conversion unit;

converting the financial transaction-related data into EBCO data by an EBCO conversion unit; and

An abnormal financial transaction detection method based on low-level data analysis, comprising: converting the financial transaction-related data into assembly language data by an assembly language conversion unit.
According to claim 10,

The step of analyzing the low-level data is:

Predicting a first or more financial transaction probability by extracting features related to an abnormal financial transaction by a hexacode-based artificial intelligence model based on the hexacode data by a hexacode-based FDS analysis unit;

Predicting a probability of a second or more financial transaction by extracting features related to an abnormal financial transaction by a binary code-based artificial intelligence model based on the binary code data by a binary code-based FDS analysis unit;

Predicting a third abnormal financial transaction probability by an ASCII-based FDS analysis unit by extracting features related to an abnormal financial transaction by an ASCII-based artificial intelligence model based on the ASCII data;

predicting a fourth abnormal financial transaction probability by extracting features related to abnormal financial transactions by an EBCO-based artificial intelligence model based on the EBCO data by an EBCO-based FDS analysis unit; and

Extracting features related to abnormal financial transactions by an assembly language-based FDS analysis unit based on the assembly language data based on the assembly language-based artificial intelligence model and predicting a fifth or higher probability of financial transactions; based on low-level data analysis including A method for detecting abnormal financial transactions.
According to claim 11,

The step of detecting the abnormal transaction is:

analyzing the transaction type of the customer based on the financial transaction related data by a customer transaction type analysis unit;

setting, by a weight setting unit, weights of assembly language, hexacode, binary code, ASCII and EBCO according to the transaction type of the customer; and

The weighted value of the first or higher probability of financial transaction, the second or higher probability of financial transaction, the third or higher probability of financial transaction, the fourth or higher probability of financial transaction, and the fifth or higher probability of financial transaction by the abnormal transaction determination unit A method for detecting abnormal financial transactions based on low-level data analysis, comprising: detecting abnormal transactions by applying .
According to claim 7,

Analyzing, by a customer transaction type analysis unit, the transaction type of the customer based on the financial transaction related data; further comprising;

The step of analyzing the low-level data is:

extracting a plurality of code regions from the low-level data according to the transaction type of the customer; and

Analyzing the low-level data by setting a weight for each code area according to the customer's transaction type; a method for detecting abnormal financial transactions based on low-level data analysis.
A computer program recorded on a computer-readable recording medium to execute the abnormal financial transaction detection method based on any one of claims 7 to 13, based on low-level data analysis.