Insurance online payment transaction security real-time detection method and system

Abstract

The invention relates to the technical field of payment transaction security detection, and discloses an insurance online payment transaction security real-time detection method and system, and the method comprises the steps: obtaining macroscopic transaction characteristics and microdynamics data; user cognitive parameters are generated through the cognitive dynamics model; fusing the macroscopic features and the cognitive parameters to construct a hybrid vector; mapping the mixed vector to a potential field, and calculating an instant risk value; calculating a risk trend based on the vector change and the potential field gradient; the risk value and the trend index are integrated, and the safety level is detected; the system comprises a data acquisition module; a cognitive parameter generation module; a state vector construction module; a risk potential energy calculation module; a path trend analysis module; and a risk level decision module. According to the method, the unified mixed state vector is constructed, deep fusion and integrated representation are carried out on heterogeneous data from the macroscopic transaction environment and the microcosmic user behaviors, and the fundamental defect of complex risk modes emerging due to cross-dimension feature coupling in recognition in the prior art is overcome.

Description

Technical Field

[0001] The present invention relates to the technical field of payment transaction security detection, and in particular to a real-time detection method and system for insurance online payment transaction security. Background Art

[0002] With the rapid development of information technology and the widespread penetration of the internet, the global financial landscape is undergoing a profound transformation. The insurance industry, in particular, is accelerating its digital transformation, with online applications, electronic policies, online claims settlement, and mobile premium payments becoming increasingly commonplace. This shift has significantly improved business processing efficiency and provided policyholders with an unprecedentedly convenient service experience. However, while this shift from offline to online transactions brings convenience, it also exposes insurance payment transactions to more complex and hidden fraud risks.

[0003] Existing online payment security detection technologies primarily rely on a risk assessment system centered around transaction characteristics. In practice, this system typically collects and analyzes a series of quantifiable data indicators. This includes macro-static information directly related to the transaction itself, such as the transaction amount, the type of insurance product purchased, and the time period of the transaction, as well as historical information related to the user's account, such as their usual login locations, historical transaction frequency and limit range, and fingerprint information from the device used.

[0004] However, existing online payment security detection technology, which relies solely on physical data such as mouse speed and click interval, is no longer able to defend against increasingly intelligent fraud scripts. These advanced scripts can completely simulate the trajectory patterns and operation rhythms that conform to normal human habits, making detection methods based on superficial behavioral characteristics extremely easy to bypass. This makes it difficult to fundamentally understand the operator's true intentions, and it is also difficult to distinguish between a genuine user with slightly unusual behavior and a highly disguised automated program. Therefore, the present invention provides a real-time security detection method and system for insurance online payment transactions to address the shortcomings of the existing technology. Summary of the Invention

[0005] In response to the shortcomings of the existing technology, the present invention provides a real-time security detection method and system for insurance online payment transactions, which solves the problem that the existing security detection technology only relies on surface data for static and isolated risk assessment, making it difficult to deeply understand the user's true intentions and predict the risk evolution trend.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method for real-time security detection of insurance online payment transactions, comprising the following steps:

[0007] S1. Obtain macro-transaction features in the current payment session and micro-behavioral dynamics data representing the user's physical operations through the server and client respectively;

[0008] S2. Inputting the micro-behavioral dynamics data of the user's physical operation into a preset cognitive dynamics model used to describe the human decision-making and movement control process for online inference to generate cognitive parameters representing the authenticity of the user's physical operation;

[0009] S3. Using the acquired macro-transaction features and the generated cognitive parameters of the authenticity of the user's physical operation as input, construct a mixed state vector representing the unified state of the current payment session;

[0010] S4. Mapping the mixed state vector of the unified state to a preset transaction authenticity potential field, and calculating a risk potential energy value representing the current immediate risk;

[0011] S5. Calculating a path trend indicator representing the direction of risk evolution based on the change in the mixed state vector of the unified state over time and the gradient of the preset transaction authenticity potential field;

[0012] S6. Comprehensively detect the security risk level of the current payment session based on the calculated risk potential value of the current immediate risk and the path trend indicator of the risk evolution direction.

[0013] Preferably, in step S1, the step of obtaining macro transaction features in the current payment session through the server and the client respectively includes:

[0014] Associating and binding the macro-transaction features acquired by the server with the micro-behavioral dynamics data acquired by the client through a unique session identifier assigned to the current payment session;

[0015] Based on the pointer or touch point position and corresponding timestamp information in the microscopic behavior dynamics data, a velocity vector sequence and an acceleration vector sequence are generated by performing differential calculation using a velocity vector calculation formula;

[0016] Applying a preset smoothing filter to the generated velocity vector sequence and acceleration vector sequence to eliminate sensor noise and measurement errors;

[0017] The velocity vector calculation formula is:

[0018] Where, v k is the instantaneous velocity vector at the kth time point; p k is the position vector of the pointer or touch point at the kth time point, p k-1 is the position vector of the pointer or touch point at the (k-1)th time point; tk is the timestamp of the kth time point; t k-1 is the timestamp of the (k-1)th time point;

[0019] When performing differential calculation using the velocity vector calculation formula, a velocity vector sequence is first generated from the instantaneous velocity vectors of k time points obtained based on the velocity vector calculation formula, and then an acceleration vector sequence is obtained by performing differential calculation on the generated velocity vector sequence again.

[0020] Preferably, in step S2, the step of inputting the micro-behavioral dynamics data of the user's physical operation into a preset cognitive dynamics model for describing the human decision-making and movement control process for online inference includes:

[0021] The coupled attractor network model and stochastic differential equation model in the cognitive dynamics model are used to model the user's movement intention decision-making process and physical movement execution process respectively;

[0022] Using an online filtering estimation algorithm, based on micro-behavioral dynamics data, reversely solve the latent variables in the cognitive dynamics model, wherein the latent variables include the user's cognitive load state;

[0023] generating the cognitive parameters based on the cognitive load state obtained by reverse calculation, and the damping coefficient and noise intensity representing the motion control characteristics;

[0024] Wherein, the stochastic differential equation model is:

[0025] dv(t)=[λ(M(t)-p(t))-γ(C(t))v(t)]dt+σ(C(t))dW t ;

[0026] Where dv(t) represents the instantaneous change in the velocity vector of the pointer or touch point, λ is a scalar parameter that represents the attraction strength of the motion intention to the actual physical motion, M(t) is a latent variable that represents the time-varying motion intention vector inferred by the attractor network model, p(t) is the observable real-time position vector of the pointer or touch point, γ(C(t)) is the damping coefficient that depends on cognitive load and represents the viscosity effect in motion. The higher the cognitive load, the greater the damping; v(t) is the observable real-time velocity vector of the pointer or touch point; σ(C(t)) is the control noise intensity that depends on cognitive load and represents the accuracy of motion control. The higher the cognitive load, the greater the noise and the worse the fine control ability; C(t) is the core latent variable that represents the user's current cognitive load state; dW t It is a standard two-dimensional Wiener process used to simulate the randomness inherent in human neural control systems.

[0027] Preferably, in step S3, the step of constructing a hybrid state vector representing the unified state of the current payment session includes:

[0028] Normalize the values ​​of each dimension in the cognitive parameters of macro transaction characteristics and the authenticity of the user's physical operation to eliminate the dimensional differences between different characteristics;

[0029] The normalized macro-transaction features and the cognitive parameters of the authenticity of the user's physical operation are vector-concatenated to form the mixed state vector of unified dimension, wherein the mixed state vector

[0030] Where S t is the mixed state vector at time point t, F macro_norm is the normalized macro-trading feature vector, P cog_norm is the cognitive parameter vector after normalization, Represents the vector concatenation operation, which is used to connect two vectors end to end to form a longer vector;

[0031] A current timestamp is appended to the generated mixed state vector to record a unified state snapshot of the payment session at a specific moment.

[0032] Preferably, in step S4, the step of calculating the risk potential energy value representing the current immediate risk includes:

[0033] The transaction authenticity potential field is defined as the weighted superposition of the conventional risk potential field and the cognitive distortion potential field, which correspond to the cognitive parameters of the macro transaction characteristics and the authenticity of the user's physical operation, respectively.

[0034] quantifying the potential energy of the cognitive distortion potential field by calculating the degree of deviation between the cognitive parameter of the original authenticity of the user's physical operation and a preset standard human behavior benchmark model;

[0035] Based on the risk potential energy value calculation formula, the potential energy of the conventional risk potential field and the potential energy of the cognitive distortion potential field are weighted and summed to obtain the final risk potential energy value;

[0036] The risk potential energy value calculation formula is:

[0037]

[0038] Where, E pot (S t ) is the mixed state vector S at time point t t Determine the final risk potential value; is the normalized macro transaction feature vector The potential energy of the conventional risk potential field determined by is the normalized cognitive parameter vector The potential energy of the cognitive distortion field, w conv is the weight coefficient of the conventional risk potential field, w cog is the weight coefficient of the cognitive distortion potential field.

[0039] Preferably, in step S5, the step of calculating the path trend indicator characterizing the direction of risk evolution includes:

[0040] Based on each dimensional feature of the mixed state vector, the gradient vector of the transaction authenticity potential field at the point where the current mixed state vector is located is calculated, where the gradient vector The risk potential E is the mixed state vector S t The vector of partial derivatives of each component, Where, is the risk potential field at state point S t The gradient vector of E is the risk potential energy as a function of the mixed state vector, S t is the mixed state vector at time point t; s t,n is the mixed state vector S t The nth component feature of , where n is a positive integer greater than 1;

[0041] Obtain the change of the current mixed state vector relative to the previous mixed state vector to form a state change vector, wherein the state change vector is (S t -S t-1 );

[0042] By calculating the inner product of the negative direction of the gradient vector and the state change vector, a scalar value serving as the path trend indicator is obtained, wherein the scalar value of the path trend indicator is:

[0043]

[0044] Where, I trend (t) is the path trend indicator at time point t, is the negative direction of the gradient vector, pointing to the direction where the risk potential energy decreases fastest; (S t -S t-1 ) is the state change vector, where S t-1 is the mixed state vector at the previous moment (t-1), and <·,·> represents the inner product operation of the vectors.

[0045] Preferably, in step S6, the step of comprehensively detecting the security risk level of the current payment session includes:

[0046] Comparing the risk potential value with a first preset threshold, comparing the cumulative value of the path trend indicator with a second preset threshold, and comparing the cognitive parameter of the authenticity of the user's physical operation with a preset normal range;

[0047] The security risk level of the current payment session is determined based on a comprehensive risk scoring model. The security risk level includes three levels: low risk, medium risk, and high risk. The comprehensive risk scoring model is:

[0048] S CRS =w E ·f E (E pot )+w T ·f T (I trend_acc )+w C ·f C (P cog );

[0049] Where S CRS is the final calculated comprehensive risk score, E pot is the risk potential value of the current immediate risk, I trend_acc is the cumulative value of the path trend index, P cog is the cognitive parameter vector that characterizes the authenticity of the user's physical operation, f E (·),f T (·) and f C (·) are the scoring functions corresponding to risk potential, path trend and cognitive parameters respectively, w E ,w T and w C are the weight coefficients corresponding to risk potential, path trend and cognitive parameters respectively, w E +w T +w C =1;

[0050] The calculated comprehensive risk score S CRS The security risk level of the current payment session is divided and determined by comparing with a two-level risk classification threshold, wherein the two-level risk classification threshold is set according to the security risk of different payment sessions;

[0051] Based on the determined security risk level, the corresponding handling strategy is executed for the current payment session, where the handling strategy includes silent authorization, triggering multi-factor authentication and rejecting payment requests. When the security risk level is low risk, the handling strategy executed for the current payment session is silent authorization. When the security risk level is medium risk, the handling strategy executed for the current payment session is triggering multi-factor authentication. When the security risk level is high risk, the handling strategy executed for the current payment session is rejecting payment requests.

[0052] The present invention also provides a real-time security detection system for online insurance payment transactions, comprising:

[0053] The data acquisition module is used to obtain macro-transaction features in the current payment session and micro-behavioral dynamics data representing user physical operations through the server and client respectively;

[0054] a cognitive parameter generation module, configured to input the micro-behavioral dynamics data of the user's physical operation into a preset cognitive dynamics model for online inference, and generate cognitive parameters representing the authenticity of the original source of the user's physical operation;

[0055] a state vector construction module, configured to construct a hybrid state vector representing a unified state of a current payment session based on the acquired macro-transaction features and the generated cognitive parameters;

[0056] a risk potential energy calculation module, configured to map the mixed state vector of the unified state to a preset transaction authenticity potential field, and calculate a risk potential energy value representing the current immediate risk;

[0057] A path trend analysis module, configured to calculate a path trend indicator representing the direction of risk evolution based on the change in the mixed state vector of the unified state over time and the gradient of a preset transaction authenticity potential field;

[0058] The risk level decision module is used to comprehensively detect the security risk level of the current payment session based on the calculated risk potential value of the current immediate risk and the path trend indicator of the risk evolution direction.

[0059] Preferably, the cognitive parameter generation module is also used for an attractor network model in a preset cognitive dynamics model, and the position of the local minimum of the attractor network model is dynamically set according to the layout of the interactive interface elements of the current payment page.

[0060] Preferably, the risk level decision module is further used for applying different risk sensitivities to different business scenarios according to the transaction amount or product type in the macro transaction feature dynamically adjusted, the accumulation of the path trend indicator, the weighted calculation in a sliding time window, and the higher weight given to the path trend indicator in a more recent time for detecting sudden fraud intention.

[0061] The application provides an insurance online payment transaction security real-time detection method and system.

[0062] 1. The application introduces a cognitive dynamics model, which deeply couples an attractor network and a stochastic differential equation, and this method deeply describes the authenticity of user behavior. Compared with the prior art, which mostly stays on the simple statistics of surface behavior data such as mouse speed and click interval, the application solves the problem that the surface features are easily simulated by advanced automated scripts and lack the essential distinguishing ability of whether the operator is a real human or a machine.

[0063] 2. The application constructs a multi-dimensional transaction authenticity potential field, which can not only calculate the 'risk potential value' of the current payment state, i.e., the static risk level, but also obtain a 'path trend indicator' by analyzing the moving trajectory of the state vector and the potential field gradient. Compared with the static risk scoring mechanism commonly used in the prior art, i.e., only weighting and summing various indicators at a certain time point to obtain an isolated score, the application solves the problem that the dynamic evolution process of the risk is blind and it is difficult to distinguish between a conversation that is moving towards danger and a conversation that is recovering from a suspicious state.

[0064] 3. The application realizes deep fusion and integrated representation of heterogeneous data originating from macro transaction environment and micro user behavior by constructing a unified hybrid state vector. This method normalizes the macro features describing the transaction background and the cognitive parameters characterizing the user's inner authenticity in the same mathematical framework, thereby constructing a feature space that can perform high-dimensional and multi-perspective state description on the payment conversation. Compared with the paradigm of the prior art that processes different dimensional risk data in a fragmented manner, the application solves the fundamental defect that it is difficult to effectively identify complex risk patterns emerging from cross-dimensional feature coupling. BRIEF DESCRIPTION OF DRAWINGS

[0065] Figure 1 The method step flowchart of the application;

[0066] Figure 2 The transaction authenticity potential field and risk evolution path schematic diagram of the application;

[0067] Figure 3 The deep user behavior authenticity identification method schematic diagram of the application;

[0068] Figure 4 This is a system architecture diagram of the present invention. DETAILED DESCRIPTION

[0069] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the present specification. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0070] Please see the attached Figure 1 -Attached Figure 3 The embodiment of the present invention provides a method for real-time security detection of insurance online payment transactions, comprising the following steps:

[0071] S1. Obtain macro-transaction features in the current payment session and micro-behavioral dynamics data representing the user's physical operations through the server and client respectively;

[0072] S2. Inputting the micro-behavioral dynamics data of the user's physical operation into a preset cognitive dynamics model used to describe the human decision-making and movement control process for online inference to generate cognitive parameters representing the authenticity of the user's physical operation;

[0073] S3. Using the acquired macro-transaction features and the generated cognitive parameters of the authenticity of the user's physical operation as input, construct a mixed state vector representing the unified state of the current payment session;

[0074] S4. Mapping the mixed state vector of the unified state to a preset transaction authenticity potential field, and calculating a risk potential energy value representing the current immediate risk;

[0075] S5. Calculating a path trend indicator representing the direction of risk evolution based on the change in the mixed state vector of the unified state over time and the gradient of the preset transaction authenticity potential field;

[0076] S6. Comprehensively detect the security risk level of the current payment session based on the calculated risk potential value of the current immediate risk and the path trend indicator of the risk evolution direction.

[0077] Regarding step S1, in this embodiment, two types of core data in the current payment session are collaboratively obtained through application logic deployed on the server and the client: macro transaction features, and micro behavioral dynamics data representing the user's physical operations.

[0078] Specifically, the acquisition of macro-transaction features covers the static background and dynamic content of the transaction. In some embodiments, the server is responsible for obtaining historical information that is strongly related to the user account, such as the user's credit rating, historical transaction frequency and amount range, as well as commonly used login devices and geographic locations. At the same time, the client application or web script is responsible for collecting real-time environment and device information, such as the operating system type and version of the current device, browser fingerprint, whether it is running in a simulator environment, and the current network IP address and operator information. During the payment session, the system will also capture the dynamic transaction content actively filled in by the user in real time, mainly the type of insurance product insured and the premium amount.

[0079] In one possible implementation, to ensure that data from both the server and client accurately corresponds to a single payment session, the system generates and assigns a globally unique session identifier upon session initiation. This unique session identifier is then stamped in both the macro-transaction feature logs recorded by the server and the micro-behavioral dynamics data packets uploaded by the client, providing a reliable link for subsequent data fusion and analysis.

[0080] Collect micro-behavioral dynamics data that can precisely reflect user operating habits and physiological characteristics. This is achieved through a high-frequency monitoring script deployed on the client interface, which continuously records every user's physical operation with millisecond-level accuracy. The recorded pointer or touch point data includes screen coordinate position, corresponding timestamp information, and the type of interaction event, such as mouse movement, click, scrolling, or finger touch, slide, and release. For scenarios requiring keyboard input, the press and release times of keys are also recorded to analyze the rhythmic characteristics of keyboard input.

[0081] After obtaining the original micro-behavioral dynamics data, preliminary data preprocessing is required to convert it into effective input for cognitive dynamics model analysis.

[0082] First, based on the collected continuous pointer or touch point positions and the corresponding timestamp information, a velocity vector calculation formula is used to perform differential calculation to generate a velocity vector sequence and an acceleration vector sequence that represent the kinematic characteristics. As an option, the velocity vector calculation formula, that is, the calculation of the velocity vector sequence, can be expressed as follows:

[0083]

[0084] Where, v k represents the instantaneous velocity vector at the kth time point; p k represents the position vector of the pointer or touch point at the kth time point; p k-1Represents the position vector of the pointer or touch point at the previous, i.e., k-1th time point; t k Represents the timestamp of the kth time point; t k-1 Represents the timestamp of the k-1th time point.

[0085] The acceleration vector sequence is obtained by performing differential calculation on the generated velocity vector sequence again. This process is the quantification of the velocity change rate.

[0086] In step S2, this embodiment acquires and preprocesses raw data representing the external environment of the payment session and the user's internal actions. The process then delves deeper into the underlying drivers of the user's actions, exploring their physical actions. By establishing and solving a cognitive dynamics model that describes human decision-making and motor control, a set of cognitive parameters is generated that quantitatively characterize the authenticity of the underlying physical actions. This step is crucial for distinguishing real human users from automated scripts or fraudsters.

[0087] In one possible implementation, the cognitive dynamics model is a complex, coupled mathematical model system whose pre-defined structure and baseline parameters are established through offline learning and calibration of a large amount of real-world human behavioral data while performing online payment tasks. The model aims to mathematically replicate the complete closed loop of "intention generation and motor execution" when humans perform a goal-oriented task, such as online payment.

[0088] Specifically, the cognitive log dynamics model is internally coupled with two core sub-models to model user behaviors at different levels:

[0089] First, an attractor network model is used to model the user's high-level, intrinsic decision-making process regarding movement intention. This model abstracts each interactive element on the interface (such as input boxes and buttons) as an attractor in a potential function. The user's decision-making process is simulated as the evolution of movement intention in the potential field formed by these attractors.

[0090] Second, a stochastic differential equation model is used to model the low-level motion execution process that converts the user's movement intention into specific physical operations. This model accurately captures the movement characteristics of human arm-eye-brain coordinated control, such as inherent delay, jitter, and stickiness.

[0091] Alternatively, the stochastic differential equation model may be represented by the following formula:

[0092] dv(t)=[λ(M(t)-p(t))-γ(C(t))v(t)]dt+σ(C(t))dW t ;

[0093] Where dv(t) represents the instantaneous change in the velocity vector of the pointer or touch point; λ is a scalar parameter representing the attraction strength of the motion intention to the actual physical motion; M(t) is a latent variable representing the time-varying motion intention vector inferred by the attractor network model; p(t) is the observable real-time position vector of the pointer or touch point; γ(C(t)) is a damping coefficient that depends on cognitive load and characterizes the viscosity effect in motion. The higher the cognitive load, the greater the damping; v(t) is the observable real-time velocity vector of the pointer or touch point; σ(C(t)) is a control noise intensity that also depends on cognitive load and characterizes the accuracy of motion control. The higher the cognitive load, the greater the noise and the worse the fine control ability; C(t) is a core latent variable representing the user's current cognitive load state; dW t It is a standard two-dimensional Wiener process used to simulate the randomness inherent in human neural control systems.

[0094] In some embodiments, since multiple core variables of the model (such as movement intention M(t), cognitive load state C(t)) and some key parameters (such as damping coefficient γ(C(t)) and noise intensity σ(C(t))) are latent variables that cannot be directly observed, this step adopts an online filtering estimation algorithm to perform real-time inference on these latent variables.

[0095] The online filtering estimation algorithm can be an extended Kalman filter or a particle filter, which continuously compares the actually observed microscopic behavior dynamics data (position p(t) and velocity v(t)) with the model's predicted values, and continuously corrects the estimation of the latent variables based on the prediction error between the two. This process is called reverse solution.

[0096] For step S3, in this embodiment, macro-transaction characteristics are obtained from the two dimensions of external environment and user internal state, and cognitive parameters representing the authenticity of the user's physical operation are generated. By fusing and regularizing these heterogeneous multi-source data, a mathematical object is constructed that can comprehensively and unbiasedly represent the instantaneous state of the current payment session under a single framework - a mixed state vector.

[0097] Generally speaking, by inputting two sets of heterogeneous data: one set is a set of macro-transaction features that describe the transaction background, and the other set is a set of cognitive parameters that characterize the essence of user behavior. Through a series of processing, they are integrated into a normalized mixed state vector with time series information.

[0098] To address the dimensional differences between different features, this step requires normalizing the values ​​of each dimension in the macro-transaction features and cognitive parameters. Without this normalization, certain features with larger numerical ranges (such as transaction amount) will dominate the model, while key features with smaller numerical ranges (such as cognitive load parameters) will be overshadowed, leading to biased risk assessments.

[0099] As an option, the normalization process can use the minimum-maximum normalization method to linearly map the original eigenvalues ​​to the [0, 1] interval. The calculation process can be described by the following formula:

[0100]

[0101] Where x′ norm represents the normalized eigenvalue; x represents the original eigenvalue to be normalized; x min Represents the minimum value of the dimension feature in the preset reference data set or dynamic observation window; x max Represents the maximum value of the dimension feature in the preset reference data set or dynamic observation window.

[0102] In some embodiments, different normalization strategies may be used for different features. For example, for features that approximately follow a Gaussian distribution, a Z-score normalization method may be used to set the mean to 0 and the standard deviation to 1 to better handle the impact of outliers.

[0103] After all relevant features are normalized to a uniform and comparable scale, they are then vector-concatenated. Specifically, this process involves concatenating the normalized macro-transaction feature vectors with the cognitive parameter vectors in a predetermined order, thereby forming a higher-dimensional, unified hybrid state vector. This vector, in a single data structure, simultaneously encapsulates external transaction risk cues and intrinsic authenticity indicators of user behavior.

[0104] In one possible implementation, the mixed state vector S t The structure can be expressed as:

[0105]

[0106] Where S t represents the mixed state vector at time point t; F macro_norm represents the normalized macro-transaction feature vector, which may contain multiple components such as transaction amount, account history, and device fingerprint; P cog_norm Represents the normalized cognitive parameter vector, which includes components such as cognitive load, motion damping coefficient, and control noise intensity; Represents the vector concatenation operation, which connects two vectors end to end to form a longer vector.

[0107] Finally, to track and analyze the dynamic evolution of the payment session state, this step also adds a current timestamp to each newly generated hybrid state vector. This timestamp accurately records the time point corresponding to the unified state snapshot.

[0108] Regarding step S4, in this embodiment, the transaction authenticity potential field is not a single, homogeneous field, but is defined as a weighted superposition of the conventional risk potential field and the cognitive distortion potential field. This structure enables the system to assess risk from two fundamentally different dimensions.

[0109] Specifically, the conventional risk potential field primarily responds to the macro-transaction characteristic components of the mixed state vector. It reflects risk assessments based on traditional business rules. For example, a large transaction occurring late at night on an unused device would fall into a high-potential energy region within this potential field.

[0110] The cognitive distortion potential field specifically responds to the cognitive parameter component of the mixed state vector. The construction of this potential field is one of the key innovations of the present invention. It aims to quantify the degree of deviation between the user's current behavior and "standard credible human behavior."

[0111] As an option, the system pre-sets a standard human behavior benchmark model. This model is based on a statistical analysis of a "normal cluster" or "trusted domain" of cognitive parameters, collected from a large number of real, risk-free users in a controlled environment. The potential energy of the cognitive distortion potential field is quantified as the degree of deviation between the current user's cognitive parameter point and the center of this trusted domain. The greater the deviation, the more abnormal the user's behavior pattern, and the higher the potential energy value of the cognitive distortion potential field.

[0112] In a possible implementation, the final risk potential energy value is obtained by weighted summing the potential energies of the two potential fields. pot (S t ) can be calculated by the following formula:

[0113]

[0114] Where, E pot (S t ) represents the mixed state vector S at time point t t The final instantaneous risk potential value determined; Represents the normalized macro-trading feature vector The potential energy of the determined conventional risk potential field; which may be the output of a pre-trained risk scoring model (such as logistic regression or neural network); Represents the normalized cognitive parameter vector The potential energy of the cognitive distortion potential field determined by the algorithm; its value is proportional to the distance between the current cognitive parameter point and the center of the standard human behavior benchmark model (e.g., Mahalanobis distance); w conv is the weight coefficient assigned to the conventional risk potential field; w cog is the weight coefficient assigned to the cognitive distortion potential field.

[0115] In some embodiments, the weight coefficient w conv and w cog The sum of the two is 1, and their specific values ​​can be dynamically configured according to different insurance payment scenarios. For example, in a small renewal scenario, the weight of the cognitive distortion potential field w can be increased. cog , because the authenticity of the user's behavior is the key at this time; in the scenario of the first large insurance, the weight of the conventional risk potential field can be appropriately increased w conv , to strengthen the review of transaction background.

[0116] Regarding step S5, in this embodiment, by analyzing the movement trajectory of the payment status in the risk potential field, a path trend indicator that can characterize the direction of risk evolution is calculated, thereby realizing an upgrade from "static snapshot" to "dynamic prediction".

[0117] Generally speaking, the core idea of ​​this step is to compare the multidimensional state space composed of mixed state vectors to a geographical terrain with "mountains" and "basins," where the risk potential value is the altitude. By calculating the relationship between the movement direction of the state point on this terrain and the terrain slope at that point, it is determined whether the payment session is moving towards the safer "basin" or sliding towards the more dangerous "mountain."

[0118] First, in order to determine in which direction the risk increases fastest near the current state point, this step requires calculating the gradient vector of the transaction authenticity potential field at the point where the current mixed state vector is located.

[0119] In one possible implementation, the calculation of the gradient vector is based on each dimension feature that constitutes the mixed state vector. Defined as the risk potential function E for the mixed state vector S t The vector formed by the partial derivatives of each component:

[0120]

[0121] Where, Represents the risk potential field at state point S t The gradient vector of the mixed state vector; E is the risk potential defined as a function of the mixed state vector; S tis the mixed state vector at time point t; s t,n represents the mixed state vector S t is the n-th component feature of the mixed state vector S

[0122] In particular, the system obtains the mixed state vector at the current time point, and compares it with the mixed state vector at the previous time point. As an option, by subtracting the mixed state vector at the previous time point from the mixed state vector at the current time point, a state change vector can be obtained. This vector precisely describes the moving direction and distance of the payment session state in the multi-dimensional space within the latest time interval.

[0123] The core of this process is to judge the consistency between the actual moving direction of the state and the direction of the fastest risk reduction. The direction of the fastest risk reduction is the negative direction of the gradient vector

[0124] In some embodiments, by calculating the inner product of the negative direction of the gradient vector and the state change vector, a scalar value as the path trend indicator I trend can be obtained. The path trend indicator I

[0125]

[0126] In the formula, I trend (t) represents the path trend indicator calculated at time point t; is the negative direction of the gradient vector, pointing to the direction of the fastest risk reduction; (S t -S t-1 ) is the aforementioned state change vector, where S t-1 is the mixed state vector at the previous time point; <·,·> represents the inner product (dot product) operation of vectors.

[0127] The scalar value of the path trend indicator has a clear business meaning: if it is positive, it indicates that the angle between the state change vector and the risk reduction direction is less than 90 degrees, meaning that the current payment session is evolving towards a safer state; if it is negative, it indicates that the session state is evolving towards a higher risk direction, constituting a potential early warning signal; if its value is close to zero, it indicates that the moving direction of the session state is roughly parallel to the equipotential line of the risk potential field, and the risk level tends to be stable in the short term.

[0128] For step S6, in this embodiment, a comprehensive judgment is made based on the calculated risk potential value and path trend indicators to detect the final security risk level of the current payment session, and provide clear instructions for the payment system to execute the corresponding disposal strategy, forming a complete "perception-analysis-decision-execution" closed-loop payment security protocol.

[0129] Generally, these continuous numerical indicators are converted into discrete risk levels with clear business meanings through a multi-dimensional comparison and decision-making process.

[0130] In one possible implementation, the integrated detection process first performs a series of parallel comparison operations. Specifically, the system compares the currently calculated risk potential value with a first preset threshold, which defines an acceptable static level of risk. Simultaneously, the system compares the cumulative value of the path trend indicator within a sliding time window with a second preset threshold to assess whether the overall evolution of risk over time is moving toward safety or danger.

[0131] Alternatively, the cumulative value of the path trend indicator can be a weighted cumulative value, assigning higher weights to more recent indicators, thereby being more sensitive to recent risk trends. Furthermore, the system compares the generated cognitive parameters for the authenticity of the user's physical actions with a preset normal range to determine whether there are cognitive anomalies in the user's behavior. This normal range is a multidimensional space calculated based on a large amount of real user data.

[0132] After completing the above multi-dimensional comparison, these discrete comparison results are integrated into a final risk level through a preset decision rule combination.

[0133] In some embodiments, the decision rule can be embodied as the calculation of a comprehensive risk score model. CRS Calculate using the following formula:

[0134] S CRS =w E ·f E (E pot )+w T ·f T (I trend_acc )+w C ·f C (P cog );

[0135] Where S CRS represents the final calculated comprehensive risk score; E pot is the risk potential value of the current immediate risk; I trend_accis the cumulative value of the path trend indicator; P cog is the cognitive parameter vector that characterizes the authenticity of the user's physical operation; f E (·),f T (·),f C (·) are scoring functions corresponding to risk potential, path trend, and cognitive parameters, respectively; these functions compare their respective input values ​​with the corresponding preset thresholds or normal ranges and output a standardized score; for example, when the input value exceeds the threshold or deviates from the normal range, a higher score is output; w E ,w T ,w C They are weight coefficients corresponding to the three risk dimensions, and their sum is 1. These weights can be dynamically configured according to the payment scenarios of different insurance products to adjust the importance of different risk factors in the final decision.

[0136] The calculated comprehensive risk score S CRS The security risk level of the current payment session is compared with the two-level risk classification threshold and is determined to be one of the three levels: low risk, medium risk or high risk.

[0137] Based on the determined security risk level, this step will trigger the payment system to implement corresponding handling strategies. These strategies are designed to strike a balance between risk level and user experience.

[0138] For payment sessions judged to be "low risk", the system will implement a silent authorization strategy, and the payment process will be carried out seamlessly without disturbing the user, ensuring a smooth payment experience.

[0139] For sessions identified as "medium risk," the system will enforce policies that trigger multi-factor authentication. This may include requiring the user to enter a dynamic verification code received via SMS, perform fingerprint or facial recognition, or confirm the transaction on another trusted device as additional verification of the user's identity.

[0140] For sessions judged to be "high risk", the system will implement the most stringent handling strategy, which is to directly reject the payment request and optionally perform additional security operations, such as temporarily freezing the account payment function, recording fraud events for subsequent audits, and sending risk warning notifications to real users through reserved secure channels.

[0141] The real-time security detection system for online insurance payment transactions described below and the real-time security detection method for online insurance payment transactions described above may refer to each other.

[0142] Please see the attached Figure 4 The present invention also provides a real-time security detection system for online insurance payment transactions, comprising:

[0143] a data acquisition module configured to acquire, by a server and a client respectively, macro transaction features in a current payment session and micro behavior dynamics data representing physical operations of a user;

[0144] a cognitive parameter generation module configured to input the micro behavior dynamics data representing the physical operations of the user into a preset cognitive dynamics model for online inference to generate cognitive parameters representing original authenticity of the physical operations of the user;

[0145] a state vector construction module configured to construct a hybrid state vector representing a unified state of the current payment session based on the acquired macro transaction features and the generated cognitive parameters;

[0146] a risk potential calculation module configured to map the hybrid state vector of the unified state to a preset transaction authenticity potential field to calculate a risk potential value representing a current instant risk;

[0147] a path trend analysis module configured to calculate a path trend index representing an evolution direction of the risk based on a change amount of the hybrid state vector of the unified state over time and a gradient of the preset transaction authenticity potential field;

[0148] a risk level decision module configured to comprehensively detect a security risk level of the current payment session according to the calculated risk potential value of the current instant risk and the path trend index of the evolution direction of the risk.

[0149] Specifically, the data acquisition module is a data inlet of the entire system. It captures two types of key information in the current payment session in parallel and in real time through probes or interfaces deployed on the client side (such as a webpage or a mobile application) and the server side: one is macro transaction features that can reflect transaction background and attributes, such as transaction amount, insurance product category, user historical behavior, device fingerprint, and IP address; the other is micro behavior dynamics data that can finely depict the actual operation process of the user, such as the moving track, speed, acceleration of the mouse or finger, and the input rhythm of the keyboard.

[0150] The cognitive parameter generation module is one of the core analysis units of the system, responsible for extracting deep cognitive states from original user behavior data. It receives the micro behavior dynamics data from the data acquisition module and inputs it into a preset cognitive dynamics model that can describe the process of human decision-making and motion control. Through online inference and reverse solving, the module can generate a set of cognitive parameters representing the original authenticity of the physical operations of the user, such as the cognitive load of the user, the damping coefficient of motion control, and the noise intensity.

[0151] In some preferred embodiments, the cognitive dynamics model adopted by the module is highly adaptable. The cognitive parameter generation module is also used for an attractor network model in the preset cognitive dynamics model, and a position of a local minimum of the attractor network model is dynamically set according to a layout of the interactive interface elements of the current payment page.

[0152] Specifically, the position of the local minimum of the attractor network model in the model is dynamically set according to the real-time layout of the interactive interface elements (such as input boxes, buttons) of the current payment page. This enables the model to accurately adapt to payment pages of different structures, even dynamic changes, ensuring the accuracy of intent inference.

[0153] The state vector construction module is used for data fusion and standardization. It receives the macro transaction features from the data acquisition module and the cognitive parameters generated by the cognitive parameter generation module. After normalization processing of the two types of data with different sources and dimensions, the mixed state vector that can uniformly represent the overall picture of the current payment session is constructed by vector splicing, and a timestamp is attached to the vector.

[0154] The risk potential calculation module is used for static quantification of the current risk. It maps the mixed state vector generated by the state vector construction module to a preset multi-dimensional transaction authenticity potential field. By calculating the potential of the position of the vector in the potential field, a risk potential value that can represent the current instant risk is obtained.

[0155] The path trend analysis module is responsible for evaluating the dynamic evolution direction of the risk. It calculates a scalar form of the path trend index based on the change amount of the mixed state vector over time and the gradient of the transaction authenticity potential field at the current state point. The index can indicate whether the current payment session is developing in a safer direction or sliding into a more dangerous state.

[0156] The risk level decision module is also used for dynamically adjusting the risk sensitivity for different business scenarios according to the transaction amount or product type in the macro transaction features, and applying differentiated risk sensitivity for different business scenarios. The accumulation of the path trend index is calculated by weighting in a sliding time window, and the path trend index closer in time is given a higher weight for detection of sudden fraud intent.

[0157] The risk level decision module, as the final decision outlet of the system, makes a comprehensive judgment based on the "static" risk value output by the risk potential calculation module and the "dynamic" trend indicator output by the path trend analysis module, determines the security risk level of the current payment session (such as low, medium, and high risk), and triggers the corresponding disposal strategy. In a specific embodiment, the decision logic of this module is dynamic and adaptable to business scenarios. On the one hand, the sensitivity of its risk judgment will be dynamically adjusted according to the transaction amount or product type in the macro transaction characteristics, so as to apply differentiated risk control strategies to different business scenarios. On the other hand, in order to keenly capture sudden fraudulent intentions, the module's accumulation of path trend indicators is not a simple summation, but a weighted calculation through a sliding time window, in which path trend indicators that are closer in time will be given higher weights, making the system particularly sensitive to recent risk evolution trends.

[0158] The system of this embodiment can be used to execute the above method embodiments, and its principles and technical effects are similar, so they will not be repeated here.

[0159] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A real-time security detection method for insurance online payment transactions, characterized in that: The following steps are involved: S1. Obtain macro-transaction features in the current payment session and micro-behavioral dynamics data representing the user's physical operations through the server and client respectively; S2. Inputting the micro-behavioral dynamics data of the user's physical operation into a preset cognitive dynamics model used to describe the human decision-making and movement control process for online inference to generate cognitive parameters representing the authenticity of the user's physical operation; S3. Using the acquired macro-transaction features and the generated cognitive parameters of the authenticity of the user's physical operation as input, construct a mixed state vector representing the unified state of the current payment session; S4. Mapping the mixed state vector of the unified state to a preset transaction authenticity potential field, and calculating a risk potential energy value representing the current immediate risk; S5. Calculating a path trend indicator representing the direction of risk evolution based on the change in the mixed state vector of the unified state over time and the gradient of the preset transaction authenticity potential field; S6. Comprehensively detect the security risk level of the current payment session based on the calculated risk potential value of the current immediate risk and the path trend indicator of the risk evolution direction.

2. A method for real-time security detection of insurance online payment transactions according to claim 1, characterized in that: In step S1, the steps of obtaining macro transaction features in the current payment session through the server and the client respectively include: Associating and binding the macro-transaction features acquired by the server with the micro-behavioral dynamics data acquired by the client through a unique session identifier assigned to the current payment session; Based on the pointer or touch point position and corresponding timestamp information in the microscopic behavior dynamics data, a velocity vector sequence and an acceleration vector sequence are generated by performing differential calculation using a velocity vector calculation formula; Applying a preset smoothing filter to the generated velocity vector sequence and acceleration vector sequence to eliminate sensor noise and measurement errors; The velocity vector calculation formula is: Where, v k is the instantaneous velocity vector at the kth time point; p k is the position vector of the pointer or touch point at the kth time point, p k-1 is the position vector of the pointer or touch point at the (k-1)th time point; t k is the timestamp of the kth time point; t k-1 is the timestamp of the (k-1)th time point; When performing differential calculation using the velocity vector calculation formula, a velocity vector sequence is first generated from the instantaneous velocity vectors of k time points obtained based on the velocity vector calculation formula, and then an acceleration vector sequence is obtained by performing differential calculation on the generated velocity vector sequence again.

3. A method for real-time security detection of insurance online payment transactions according to claim 1, characterized in that: In step S2, the step of inputting the micro-behavioral dynamics data of the user's physical operation into a preset cognitive dynamics model for describing the human decision-making and motion control process for online inference includes: The coupled attractor network model and stochastic differential equation model in the cognitive dynamics model are used to model the user's movement intention decision-making process and physical movement execution process respectively; Using an online filtering estimation algorithm, based on micro-behavioral dynamics data, reversely solve the latent variables in the cognitive dynamics model, wherein the latent variables include the user's cognitive load state; generating the cognitive parameters based on the cognitive load state obtained by reverse calculation, and the damping coefficient and noise intensity representing the motion control characteristics; Wherein, the stochastic differential equation model is: dv(t)=[λ(M(t)-p(t))-γ(C(t))v(t)]dt+σ(C(t))dW t ; Where dv(t) represents the instantaneous change in the velocity vector of the pointer or touch point, λ is a scalar parameter that represents the attraction strength of the motion intention to the actual physical motion, M(t) is a latent variable that represents the time-varying motion intention vector inferred by the attractor network model, p(t) is the observable real-time position vector of the pointer or touch point, γ(C(t)) is the damping coefficient that depends on cognitive load and represents the viscosity effect in motion. The higher the cognitive load, the greater the damping; v(t) is the observable real-time velocity vector of the pointer or touch point; σ(C(t)) is the control noise intensity that depends on cognitive load and represents the accuracy of motion control. The higher the cognitive load, the greater the noise and the worse the fine control ability; C(t) is the core latent variable that represents the user's current cognitive load state; dW t It is a standard two-dimensional Wiener process used to simulate the randomness inherent in human neural control systems.

4. A method for real-time security detection of insurance online payment transactions according to claim 1, characterized in that: In step S3, the step of constructing a hybrid state vector representing the unified state of the current payment session includes: Normalize the values ​​of each dimension in the cognitive parameters of macro transaction characteristics and the authenticity of the user's physical operation to eliminate the dimensional differences between different characteristics; The normalized macro-transaction features and the cognitive parameters of the authenticity of the user's physical operation are vector-concatenated to form the mixed state vector of unified dimension, wherein the mixed state vector S t =[F macro_norm ⊕P cog_norm ]; Where S t is the mixed state vector at time point t, F macro_norm is the normalized macro-trading feature vector, P cog_norm is the normalized cognitive parameter vector, ⊕ represents the vector concatenation operation, which is used to connect two vectors end to end to form a longer vector; A current timestamp is appended to the generated mixed state vector to record a unified state snapshot of the payment session at a specific moment.

5. A method for real-time security detection of insurance online payment transactions according to claim 1, characterized in that: In step S4, the step of calculating the risk potential energy value representing the current immediate risk includes: The transaction authenticity potential field is defined as the weighted superposition of the conventional risk potential field and the cognitive distortion potential field, which correspond to the cognitive parameters of the macro transaction characteristics and the authenticity of the user's physical operation, respectively. quantifying the potential energy of the cognitive distortion potential field by calculating the degree of deviation between the cognitive parameter of the original authenticity of the user's physical operation and a preset standard human behavior benchmark model; Based on the risk potential energy value calculation formula, the potential energy of the conventional risk potential field and the potential energy of the cognitive distortion potential field are weighted and summed to obtain the final risk potential energy value; The risk potential energy value calculation formula is: Where, E pot (S t ) is the mixed state vector S at time point t t Determine the final risk potential value; is the normalized macro transaction feature vector The potential energy of the conventional risk potential field determined by is the normalized cognitive parameter vector The potential energy of the cognitive distortion field, w conv is the weight coefficient of the conventional risk potential field, w cog is the weight coefficient of the cognitive distortion potential field.

6. A method for real-time security detection of insurance online payment transactions according to claim 1, characterized in that: In step S5, the step of calculating the path trend indicator representing the direction of risk evolution includes: Based on each dimensional feature of the mixed state vector, the gradient vector of the transaction authenticity potential field at the point where the current mixed state vector is located is calculated, where the gradient vector The risk potential E is the mixed state vector S t The vector of partial derivatives of each component, Where, is the risk potential field at state point S t The gradient vector of E is the risk potential energy as a function of the mixed state vector, S t is the mixed state vector at time point t; s t,n is the mixed state vector S t The nth component feature of , where n is a positive integer greater than 1; Obtain the change of the current mixed state vector relative to the previous mixed state vector to form a state change vector, wherein the state change vector is (S t -S t-1 ); By calculating the inner product of the negative direction of the gradient vector and the state change vector, a scalar value serving as the path trend indicator is obtained, wherein the scalar value of the path trend indicator is: Where, I trend (t) is the path trend indicator at time point t, is the negative direction of the gradient vector, pointing to the direction where the risk potential energy decreases fastest; (S t -S t-1 ) is the state change vector, where S t-1 is the mixed state vector at the previous moment (t-1), and <·,·> represents the inner product operation of the vectors.

7. A method for real-time security detection of insurance online payment transactions according to claim 1, characterized in that: In step S6, the step of comprehensively detecting the security risk level of the current payment session includes: Comparing the risk potential value with a first preset threshold, comparing the cumulative value of the path trend indicator with a second preset threshold, and comparing the cognitive parameter of the authenticity of the user's physical operation with a preset normal range; The security risk level of the current payment session is determined based on a comprehensive risk scoring model. The security risk level includes three levels: low risk, medium risk, and high risk. The comprehensive risk scoring model is: S CRS =w E ·f E (E pot )+w T ·f T (I trend_acc )+w C ·f C (P cog ); Where S CRS is the final calculated comprehensive risk score, E pot is the risk potential value of the current immediate risk, I trend_acc is the cumulative value of the path trend index, P cog is the cognitive parameter vector that characterizes the authenticity of the user's physical operation, f E (·),f T (·) and f C (·) are the scoring functions corresponding to risk potential, path trend and cognitive parameters respectively, w E ,w T and w C are the weight coefficients corresponding to risk potential, path trend and cognitive parameters respectively, w E +w T +w C =1; The calculated comprehensive risk score S CRS The security risk level of the current payment session is divided and determined by comparing with a two-level risk classification threshold, wherein the two-level risk classification threshold is set according to the security risk of different payment sessions; Based on the determined security risk level, the corresponding handling strategy is executed for the current payment session, wherein the handling strategy includes silent authorization, triggering multi-factor authentication, and rejecting the payment request. When the security risk level is low, the handling strategy executed for the current payment session is silent authorization. When the security risk level is medium, the handling strategy executed for the current payment session is triggering multi-factor authentication. When the security risk level is high, the handling strategy executed for the current payment session is rejecting the payment request.

8. A real-time security detection system for online insurance payment transactions, applied to a real-time security detection method for online insurance payment transactions according to any one of claims 1 to 7, characterized in that: include: The data acquisition module is used to obtain macro-transaction features in the current payment session and micro-behavioral dynamics data representing user physical operations through the server and client respectively; a cognitive parameter generation module, configured to input the micro-behavioral dynamics data of the user's physical operation into a preset cognitive dynamics model for online inference, and generate cognitive parameters representing the authenticity of the original source of the user's physical operation; a state vector construction module, configured to construct a hybrid state vector representing a unified state of a current payment session based on the acquired macro-transaction features and the generated cognitive parameters; a risk potential energy calculation module, configured to map the mixed state vector of the unified state to a preset transaction authenticity potential field, and calculate a risk potential energy value representing the current immediate risk; A path trend analysis module, configured to calculate a path trend indicator representing the direction of risk evolution based on the change in the mixed state vector of the unified state over time and the gradient of a preset transaction authenticity potential field; The risk level decision module is used to comprehensively detect the security risk level of the current payment session based on the calculated risk potential value of the current immediate risk and the path trend indicator of the risk evolution direction.

9. A real-time security detection system for online insurance payment transactions according to claim 8, characterized in that: The cognitive parameter generation module is also used for the attractor network model in the preset cognitive dynamics model, and the position of the local minimum of the attractor network model is dynamically set according to the layout of the interactive interface elements of the current payment page.

10. The real-time security detection system for online insurance payment transactions according to claim 8, characterized in that: The risk level decision module is also used to dynamically adjust the transaction amount or product type in the macro transaction characteristics, and apply differentiated risk sensitivity to different business scenarios. The accumulation of the path trend indicators is weighted calculated within a sliding time window, and the path trend indicators that are closer in time are given higher weights, which is used to detect sudden fraudulent intentions.

Images