Detecting installation of an object at a terminal device

Abstract

A system for detecting installation of a skimmer at an automated teller machine receives detection data from a sensor. The system converts the detection data from a time domain to a frequency domain using a wavelet transform to generate a wavelet matrix of coefficients. The system includes a first machine learning model to identify features in the wavelet matrix. The system generates a rain alert signal based on the identified features. The system includes a long short-term memory recurrent neural network model to determine a sequence from the detection data, the sequence including (i) an idle state, (ii) a hand proximity state, and (iii) a skimmer installation state. The system determines to generate a tamper alert signal based on the sequence.

Description

TECHNICAL FIELD

[0001] The present invention relates to a computer-implemented method, a data processing system and a computer program product for detecting installation of an object, such as a card skimmer, at a terminal device, such as an automated teller machine (ATM). BACKGROUND

[0002] It is known that people try to detect card skimmers placed on a panel of an ATM by a thief. If the ATM is installed with such a card skimmer, this can enable the thief to steal card information of a customer. However, known methods for detecting card skimmers have various drawbacks, technical solutions to which are disclosed herein. SUMMARY

[0003] Certain embodiments of the present invention provide a system for more accurately detecting installation of an object, such as a card skimmer, at a terminal device, such as at a panel of an ATM. Certain embodiments of the present invention provide technical solutions that at least address the technical problem of false positive skimmer alarms, which can occur, for example, in case of an ATM exposed to rain. In particular, rain can cause technical problems with capacitive sensor signals. In addition, certain embodiments of the present invention enable faster data processing and data formatting after the original data has been obtained.

[0004] According to embodiments of the first aspect of the present invention, there is provided a computer-implemented method for detecting installation of an object at a terminal device, the method comprising the steps of: receiving detection data from one or more sensors; generating a wavelet matrix based on the detection data; and generating an environmental alert based on the wavelet matrix. In example embodiments, the terminal device can comprise an automated teller machine device. In example embodiments, the method can detect installation of an object at a bezel of the automated teller machine device. In example embodiments, the object can comprise a card skimmer device.

[0005] An environmental alert can include an environmental weather alert. The environmental weather alert can include a rain alert. By generating a rain alert signal, various embodiments of the present invention reduce the incidence of false positive skimming device alerts that would otherwise be generated in situations where an ATM encounters rain or other environmental weather conditions but no attempt is made to install a skimming device. In particular, embodiments of the present invention provide a technical solution to the technical problem of false positive skimming device alerts, such as when an ATM is exposed to rain or other environmental weather conditions that cause technical problems with signals from capacitive sensors. Thus, embodiments of the present invention can achieve the technical effects of high accuracy skimming device alerts and minimization of false positive skimming device alerts due to environmental weather events such as rain. By reducing false positive skimming device alerts, embodiments of the present invention achieve enhanced reliability and reduce unnecessary maintenance visits by technical experts. The ATM can thus remain in proper operation, and customer transactions can remain unaffected.

[0006] An environmental weather alert is not limited to a rain alert, and can also include other types of weather alerts for detecting types of weather conditions around the ATM other than rain. For example, the environmental weather alert can be a wind alert, a cold weather alert, or a hot weather alert. Wind or cold or hot weather can cause false positive readings from the sensors. In particular, rapid temperature changes can cause mechanical expansion or contraction of the faceplate or chassis of the ATM, which can cause false positive readings. In some cases, this can indicate improper construction or improper assembly of the hardware.

[0007] In example embodiments, the wavelet matrix preserves local time data in order to more accurately generate a rain alert signal. The detection data received from the sensors can be time series data. By capturing local time data, a time period during which to generate an alert can be determined. Capturing and preserving local time data also allows for running a machine learning model on data retrieved from ATMs that lack machine learning capabilities, such that those time periods during which it can be raining can be identified. This can be particularly relevant to situations within the data log where false positive skimming device alerts are suspected.

[0008] In some embodiments, a wavelet transform can be used to convert the detection data from the time domain to the frequency domain to generate the wavelet matrix. The wavelet transform can be a continuous wavelet transform, or can be a discrete wavelet transform. The wavelet transform can involve passing the detection data through a high pass filter and / or a low pass filter. For example, rain can produce high frequency signals, such that passing the detection data through a high pass filter can preserve the high frequency rain signals and discard / ignore other lower frequency signals such as noise.

[0009] In some embodiments, the method can include a step of identifying one or more features in the wavelet matrix and generating an environmental alert based on the one or more identified features. An example identified feature can be an increase in real rain noise. This noise can be a higher frequency but lower amplitude signal compared to the idle signal data. Over a period of hours, moisture buildup on the card reader - for example in the case of an ATM bezel design that can cause some water to collect - can cause a change in amplitude of the signal. By focusing on the frequency change, embodiments of the invention enable other changes in the signal data to be ignored. The one or more features can be identified from the wavelet matrix using a first machine learning model. The first machine learning model can provide a highly accurate and highly efficient means of identifying features. The first machine learning model can include a convolutional neural network model. As new training data becomes available, the convolutional neural network model can be updated over time. If an upgrade or improvement becomes available, the first machine learning model can be quickly updated based on a software update, without the need for technically complex and time consuming hardware modifications.

[0010] In some embodiments, the method can include a step of determining a sequence based on the detection data, the sequence including (i) an idle state during a first time period, (ii) a proximity state during a second time period, and (iii) an object mounted state during a third time period. The second time period can be after the first time period. The third time period can be after the second time period. In some embodiments, the method can include a step of generating a tampering alert signal based on the determined sequence. Determining the sequence and then generating a tampering alert signal based thereon can enable more accurate detection of a card skimmer being mounted on an ATM. For example, by generating a tampering alert signal in response to the sequence being identified, embodiments of the invention reduce the incidence of false positive card skimmer alerts. This enhanced detection capability leads to increased customer confidence in the operation of the ATM. Reducing false positive card skimmer alerts leads to less time consuming technical maintenance of the ATM by technical experts.

[0011] In some embodiments, the detection data can have a substantially constant amplitude at a first level during the first time period. Further, the detection data can have a negative peak amplitude during the second time period, the negative peak being substantially lower than the first level. Additionally, the detection data can have a substantially constant amplitude at a third level during the third time period, the third level being substantially higher than the first level. In another embodiment, the detection data can have very high and very low peaks for short periods, for example a few seconds, during the second time period. The very high and very low peaks for short periods can indicate that a card skimmer is being mounted to the ATM.

[0012] In some embodiments, the sequence can be determined using a second machine learning model. The second machine learning model can provide a highly accurate and highly efficient means of identifying the sequence. The second machine learning model can comprise a deep learning model. The deep learning model can comprise a long short-term memory recurrent neural network model. The long short-term memory recurrent neural network model is highly effective at filtering out noise in the signal. As new training data becomes available regarding new card skimming attacks, the long short-term memory recurrent neural network model can be updated over time. If an upgrade or improvement to the long short-term memory recurrent neural network model becomes available, the second machine learning model can be quickly updated based on a software update, without requiring technically complex and time-consuming hardware modifications. In some embodiments, the second machine learning model can comprise a support vector machine.

[0013] In some embodiments, instead of sequence determination, the second machine learning model can comprise a one-dimensional (1-D) convolutional neural network model configured to identify one or more distinguishing features in the detection data. The 1-D convolutional neural network model can provide increased accuracy when analyzing 1-D data, such as time series data from an ATM.

[0014] In some embodiments, the sequence determination occurs at least partially in parallel with the wavelet matrix generation.

[0015] In some embodiments, the one or more sensors can comprise a capacitive-based sensor, a millimeter wave radar, and / or a time-of-flight sensor. In some embodiments, the capacitive-based sensor can be installed adjacent to the magnetic card reader device. In some embodiments, the capacitive-based sensor can be configured to generate the detection data when an object is placed adjacent to an outer portion of the bezel.

[0016] According to example embodiments of the present invention, a method can comprise the steps of: generating a training data set; and training at least one of a first machine learning model and a second machine learning model based on the training data set. By automatically generating the training data set, the method can avoid the otherwise time-consuming and repetitive manual process of data extraction and labeling associated activities. As a result, the method produces a faster process of creating training data from a vast raw data set. Furthermore, the cleaner training data results in improved accuracy of the overall machine learning model.

[0017] In some embodiments, a training data set can be generated by receiving a historical data set, and identifying one or more features in the historical data set, each of the one or more features representing a corresponding activity. It is not uncommon to have very large historical data sets. Manually analyzing such large historical data sets would be a very time consuming task. Embodiments of the present invention enable automatic analysis of historical data, which in turn enables automatic identification of activities, such as presence of a card skimmer at an ATM; presence of a customer’s hand at an ATM; idle state of an ATM; transaction state of an ATM; different types of transactions based on information from other devices, such as a cash refill when a panel door is open, check processing, cash cycle, contactless card touch, or screen touch for menu resolution; and so on. Certain embodiments of the present invention also enable automatic labeling of activities accordingly.

[0018] In some embodiments, the one or more features can be identified by determining one or more peaks in the historical data set, and generating one or more data subsets based on the one or more determined peaks. In some embodiments, each data subset contains padding data on either side of a peak. The padding data can make it easier to visualize the features. The padding data can provide context information for an activity, such as a “skimmer” state before or after a previous ‘idle’ state, and the peak can provide information about a ‘hand activity’.

[0019] In some embodiments, the one or more peaks can be determined by applying a moving average and a standard deviation to the historical data set. The training data set can be generated by receiving a labeled data set, and augmenting the one or more identified features with the labeled data set. The labeled data can be automatically created based on transaction activity data from other devices, such as a cash refill when a panel door is open, cash out, and so on.

[0020] In some embodiments, the above-described method includes performing the following steps (1)-(5). In step (1), a plurality of peaks in a historical data set is identified. In step (2), a subset of the historical data set is identified based on the identified plurality of peaks. In step (3), a set of features is identified from the subset of the historical data. In step (4), the identified set of features is augmented using a labeled data set to obtain a training data set. In step (5), at least one of a first machine learning model or a second machine learning model is trained based on the training data set to perform environmental weather detection or tampering detection, respectively.

[0021] According to a second aspect, the present application also provides a data processing system for detecting installation of an object at a terminal device, the system comprising a processor configured to access a memory or other computer-readable medium storing machine-executable instructions and to execute the instructions to: receive detection data from one or more sensors, generate a wavelet matrix based on the detection data, and generate an environmental alert based on the wavelet matrix.

[0022] In a third aspect of the present application, a computer program product is provided that includes instructions that, when executed on a computer system, cause the computer system to perform the method of the present application. The computer program product can be embodied on a recording medium, a carrier wave, or a read-only memory.

[0023] According to a fourth aspect, the present application provides a computer program product that includes a non-transitory computer-readable medium storing machine- executable instructions executable by a processor to perform a method comprising performing steps (1)-(6). In step (1), first detection data is received from one or more sensors over a first time period. In step (2), a wavelet matrix is generated based on the first detection data. In step (3), an environmental alert signal is generated based on the wavelet matrix. In step (4), second detection data is received from the one or more sensors over a second time period. In step (5), a sequence is determined from the second detection data. In step (6), a tampering alert signal is generated in response to determining the sequence.

[0024] According to a fifth aspect, the present application provides a computer-implemented method for detecting installation of an object at a terminal device, the method comprising performing steps (1)-(3). In step (1), detection data is received from one or more sensors. In step (2), a wavelet matrix is generated based on the detection data. In step (3), an environmental alert is generated based on the wavelet matrix.

[0025] According to the fifth aspect described above, the method performs any one of the following steps (1)-(6). In step (1), the environmental alert comprises an environmental weather alert. Step (2) comprises the following in addition to step (1) described above: the environmental weather alert comprises a rain alert. In step (3), the detection data is converted from time domain to frequency domain using a wavelet transform to obtain converted detection data, and the wavelet matrix is generated based on the converted detection data. In step (4), the terminal device comprises an automated teller machine device. In step (5), the object comprises a skimming device. Step (6) comprises the following steps (6-1)-(6-5). In step (6-1), a plurality of peaks in the historical data set are identified. In step (6-2), a subset of the historical data set is identified based on the identified plurality of peaks. In step (6-3), a feature set is identified from the subset of the historical data. In step (6-4), the identified feature set is augmented using a labeled data set to obtain a training data set. In step (6-5), at least one of the first machine learning model or the second machine learning model is trained based on the training data set to perform environmental weather detection or tampering detection, respectively.

[0026] According to the fifth aspect described above, the method further comprises identifying one or more features in the wavelet matrix. Generating the environmental alert comprises generating the environmental alert based on the one or more identified features.

[0027] According to the fifth aspect described above, in the method described above, identifying the one or more features in the wavelet matrix comprises identifying the one or more features using a first machine learning model.

[0028] According to the fifth aspect described above, in the method described above, the first machine learning model comprises a convolutional neural network model.

[0029] According to the fifth aspect described above, the method further comprises determining a sequence based on the detection data, the sequence comprising (i) an idle state during a first time period, (ii) a proximity state during a second time period, and (iii) an object installation state during a third time period.

[0030] According to the fifth aspect above, the method above further includes performing any of the following steps (1)-(5). In step (1), generating a tampering alert based on the determined sequence. In step (2), during the idle state, the detection data includes a signal having a substantially constant amplitude at a first level. In step (3), during the object mounted state, the detection data includes a signal having a substantially constant amplitude at a third level higher than the first level. In step (4), determining the sequence includes determining the sequence using a second machine learning model. In step (5), the sequence determining occurs at least partially in parallel with the wavelet matrix generating.

[0031] According to the fifth aspect above, the method above further includes performing any of the following steps (1)-(2). Step (1) includes the following steps (1-1) and (1-2). In step (1-1), during the idle state, the detection data includes a signal having a substantially constant amplitude at a first level. In step (1-2), during the proximity state, the detection data includes a signal having a negative peak amplitude lower than the first level. Step (2) includes the following steps (2-1) and (2-2). In step (2-1), determining the sequence includes determining the sequence using a second machine learning model. In step (2-2), the second machine learning model includes a long short-term memory recurrent neural network model. BRIEF DESCRIPTION OF DRAWINGS

[0032] Embodiments of the application will now be described, by way of example only, with reference to the accompanying drawings in which:

[0033] Figure 1 is a hybrid system and flowchart for detecting installation of an object at a terminal device according to example embodiments of the disclosed technology,

[0034] Figure 2 is a plot showing detection data captured according to example embodiments of the disclosed technology,

[0035] Figure 3 is a plot showing detection data captured according to example embodiments of the disclosed technology,

[0036] Figure 3a is a plot showing detection data captured according to example embodiments of the disclosed technology,

[0037] Figure 4 is an extraction of instruction code for a wavelet transform according to example embodiments of the disclosed technology,

[0038] Figure 5 is a wavelet matrix according to example embodiments of the disclosed technology,

[0039] Figure 6 and 7 is a scalar plot image according to example embodiments of the disclosed technology,

[0040] Figure 8 is a graph showing an environmental alert according to example embodiments of the disclosed technology,

[0041] Figure 9 is a flowchart of a method for training a machine learning model according to example embodiments of the disclosed technology,

[0042] Figure 9a is a graph showing historical data for the method of Figure 9 ,

[0043] Figure 9a' is a graph showing a portion of the historical data for the method of Figure 9a ,

[0044] Figure 9b is a graph showing a subset of data for the method of Figure 9 ,

[0045] Figure 9c is an image showing a feature for the method of Figure 9 ,

[0046] Figure 10 is a graph showing a peak for the method of Figure 9 , and

[0047] Figure 11 is a graph showing labeled data for the method of Figure 9 .

[0048] In the drawings, like reference numerals refer to like parts throughout the various views. DETAILED DESCRIPTION

[0049] Referring to the drawings, and initially to Figure 1 to 8 , there is shown a computer-implemented data processing system 1 configured to detect installation of an object at a self-service terminal device according to example embodiments of the disclosed technology. In embodiments, the system 1 can be provided in the form of a skimmer protection solution (SPS). In certain scenarios, criminals can attempt to steal credit card details by utilizing a card skimmer device that records the magnetic stripe present on a card. For example, the system 1 can detect the presence of a card skimmer device placed on an automated teller machine (ATM) panel. More specifically, for example, the system 1 can be used to detect installation of a card skimmer device at an ATM bezel.

[0050] In embodiments, the system 1 can include a microcontroller configured to manage the functions of the system 1, collect data from the sensors / output to the actuators used by the system 1, and report to an ATM PC core, e.g., via USB 2.0. In example embodiments, the system 1 can perform the following functions: detect abnormal objects placed near the card reader entry / exit slot; report the presence of abnormal objects placed near the card reader entry / exit slot; report a failure of the function to deactivate or suppress detection of abnormal objects placed near the card reader entry / exit slot (e.g., electromagnetic disruption of abnormal objects, those with magnetic read heads, etc.); and the like.

[0051] As Figure 1 The system 1 receives detection data 3 from a plurality of sensors 2, as shown in FIG. 1. In some embodiments, the sensors 2 can be distinct from the system 1, while in other embodiments, the system 1 can include the sensors 2. In example embodiments, the sensors 2 are provided in the form of capacitive-based sensors. The capacitive-based sensors 2 can be installed adjacent to a magnetic card reader device. The capacitive-based sensors 2 can generate detection data 3 in response to placement of the card skimmer device adjacent to the exterior portion of the ATM bezel. For example, the detection data 3 can be captured from a series of capacitive sensors 2 around the card (magnetic stripe) reader of the ATM. The capacitive sensors 2 can detect the presence of abnormal objects with magnetic read heads near the card reader entry / exit slot. The system 1 can include an analog-to-digital converter (ADC) that receives a continuous analog signal at its input channels from the transmitter-receiver electrode pairs. The system core driver can select channels to scan. As an example, the selected channels can be sampled once every 180 ms, and events along with 32-bit readings can be returned to the system core driver. In one embodiment, the ADC converts the readings of the selected sensors 2 into unsigned 32-bit digital values that can be sent to the processor at a rate of 180 ms per channel.

[0052] In example embodiments, the system 1 includes a second machine learning model 4. The second machine learning model 4 can be a deep learning model, such as a long short-term memory recurrent neural network (LSTM-RNN) model. While the machine learning model 4 can be referred to herein as an LSTM-RNN model for explanatory purposes, it should be appreciated that the model 4 is not limited to an LSTM-RNN model and can be any suitable machine learning model that includes any suitable type of neural network. The LSTM-RNN model 4 can determine a sequence 5 based on the detection data 3.

[0053] As Figure 2As shown in the middle, in example embodiments, sequence 5 can include (i) an idle state during a first time period 'a', (ii) a hand approach state during a second time period 'b' after the first time period 'a', and (iii) a skimmer installed state during a third time period 'c' after the second time period 'b'. In Figure 2 In the example, detection data 3 has a substantially constant amplitude at a first level 12 during the first time period 'a'. Additionally, detection data 3 has a negative peak amplitude 13 during the second time period 'b'. The negative peak 13 is lower than the first level 12 Figure 2 ). Detection data 3 has a substantially constant amplitude at a third level 14 during the third time period 'c'. The third level 14 is higher than the first level 12 Figure 2 The skimmer installed state indicates that a skimmer device is still installed to the bezel of the ATM. In example embodiments, when the skimmer is placed on the bezel during time period 'b', the hand approach causes the signal spike to occur, followed by an increase in signal amplitude from amplitude 12 during time period 'a' to amplitude 14 during time period 'c'. The increased amplitude 14 can remain for the duration that the skimmer remains on the bezel.

[0054] Referring again to Figure 1 In example embodiments, system 1 generates a tamper alert signal 6 based on sequence determination 5. The tamper alert signal 6 can indicate that a card skimmer has been installed to the bezel of the ATM. In example embodiments, the deep learning model 4 enhances the accuracy of the card skimmer detection accuracy of system 1. System 1 can be configured to collect data related to different states / situations / events, such as idle state, skimmer installed state, hand approach state, transactions, and weather events such as rain. The data related to these situations / events can be classified accordingly, and fed through the LSTM-RNN model 4 to detect sequence 5. In some embodiments, the LSTM-RNN model 4 can detect sequence 5 as including the following, as observed: a first amplitude 12 corresponding to the idle state during the first time period 'a', a signal spike during the second time period 'b', and an increased amplitude 14 during the last third time period 'c'. Optionally, sequence 5 can be detected as further including the negative peak amplitude 13 observed during the initial portion of the second time period 'b'. Model 4, which can be trained using historical sensor data, can be configured to generate a classification result indicating whether a card skimmer is present based on input sensor data. In some embodiments, the LSTM-RNN model 4 can be particularly suitable for detecting sequence data and learning from the context of situations.

[0055] The LSTM-RNN model 4 can be trained to detect the sequence 5 and generate a skimmer alert 6 in response to detection of the sequence 5. In some embodiments, the model 4 can be based on its training to ignore other signal sequences representing individual hand approaches, legitimate transactions, legitimate activities such as environmental weather such as rain, and avoid generating a skimmer alert 6 in such contexts. In this way, the model 4 helps to reduce false positive skimmer alerts caused by other factors such as environmental weather conditions (e.g., rain). Rain can cause noisy and unpredictable signals. Such signals can otherwise cause false positive skimmer alerts if not for the enhanced reliability provided by the model 4, which in example embodiments is trained to detect the particular sequence 5 and generate an alert 6 in response to detection of the sequence 5 and not in response to other signal amplitude change sequences that can reflect legitimate, non-skimmer related events.

[0056] As shown in Figure 1 In example embodiments, the system 1 uses a wavelet transform 7 to convert the detection data 3 from the time domain to the frequency domain to generate a wavelet matrix 8 of coefficients. Figure 3a An example of the detection data 3 is shown in Figure 4 An example of the wavelet transform 7 is shown in Figure 5 An example of the wavelet matrix 8 is shown in Figure 5 The wavelet matrix 8 is generated using Figure 3a the detection data 3 and Figure 4 the wavelet transform 7.

[0057] In example embodiments, the system 1 includes a first machine learning model 9. In some embodiments, the first machine learning model 9 is provided in the form of a convolutional neural network (CNN) model. The CNN model 9 can be configured to identify features 10 in the wavelet matrix 8. The system 1 can then generate an environmental alert signal 11 based on the identified features 10. The environmental alert signal 11 can include an environmental weather alert signal. The environmental weather alert signal can include a rain alert signal 11 Figure 8

[0058] The system 1 addresses the technical problem of rain causing signals 3 from the capacitive sensor 2 to become noisy. In particular, rain can cause the amplitude to gradually increase over time. Such noise or amplitude build-up can otherwise potentially lead to false positive skimmer alerts. When the system 1 is exposed to rain, the signals 3 from the sensor 2 can become noisy. Over time, this can cause the signal amplitude to gradually increase. Figure 3 The detection data 3 is shown, where the amplitude of the signals from the sensor 2 build up over time due to rain. When this happens, it can be difficult to distinguish between the signal amplitude increase caused by rain and the amplitude increase caused by an actual skimmer being installed to the ATM.

[0059] ​In an example embodiment, to solve this technical problem, the system 1 uses a wavelet transform 7 to analyze the changes in frequency without losing the local time information of the signal 3. The wavelet transform 7 preserves information about the frequency and time for enhanced signal analysis. The wavelet transform 7 can be a mathematical function that divides a continuous-time signal into separate scale components. The wavelet transform 7 can be discrete or continuous. In particular, the wavelet matrix 8 can provide an indication of the spectrum and when these frequencies occur.

[0060] Alternatively, the system 1 can generate a scalar plot based on the wavelet matrix 8. Figure 6 An example of a scalar plot 15 is shown in Figure 7 An example of another type of scalar plot 16 is shown in. The scalar plot is a visual representation of the information in the wavelet matrix 8 of coefficients. The CNN model 9 can identify features 10 in the scalar plot.

[0061] In more detail, the scalar plot can provide a means of viewing information about the scale components. The scalar plot can be a plot containing different patterns depending on the wavelet used. The amount of information shown in each scalar plot depends on the window size used to analyze the signal data 3. Figure 6 An example of a scalar plot image 15 resulting from a Mexican hat wavelet transform is shown in Figure 7 An example of a scalar plot image 16 resulting from a Morlet wavelet transform is shown in. The CNN model 9 can be configured to identify distinguishing features 10 in the scalar plot image with high accuracy. Thus, the system 1 can identify when it is raining based on these distinguishing features 10, and any false positive skimmer alerts during rain can be removed.

[0062] In use, in an example embodiment, the system 1 receives detection data 3 from the capacitive-based sensor 2( Figure 1 ) in response to a card skimmer device placement adjacent to an outer portion of the bezel. Based on the detection data 3, the LSTM-RNN model 4 determines a sequence 5 containing (i) an idle state during a first time period ‘a’, (ii) a proximity state during a second time period ‘b’, and (iii) a card skimmer installed state during a third time period ‘c’. The system 1 then generates a tampering alert signal 6 based on the sequence determination. In parallel, in an example embodiment, the system 1 uses a wavelet transform 7 to convert the detection data 3 from the time domain to the frequency domain to generate a wavelet matrix 8. The CNN model 9 identifies features 10 in the wavelet matrix. The system 1 then generates a rain alert signal 11 based on the identified features 10.

[0063] Referring now to Figure 9 to 11 , a computer-implemented data processing system 20 for training the LSTM-RNN model 4 and the CNN model 9 is shown. The system 20 can receive a large historical dataset 21( Figure 9a). The historical data 21 can include previous detection data from the capacitive-based sensor 2 installed adjacent to the magnetic card reader device. The capacitive-based sensor 2 can have generated previous detection data during normal operation of the ATM and also possibly after a card skimmer device was placed adjacent to the outer portion of the ATM bezel. Figure 9a' A portion 40 of the historical data 21 is shown. Figure 9a The historical data portion 40 represents raw sensor data for a time period during which card skimmers were being continuously installed onto and removed from the ATM.

[0064] In an example embodiment, the system 20 applies a moving average 22 and a standard deviation 23 to the historical data set 21 based on a predefined threshold to identify a plurality of peaks 24 in the set of historical data 21. The system 20 can then generate a data subset 25 based on each identified peak 24 Figure 9b The data subset 25 can include a predefined number of surrounding padding data points on either side of the identified peak 24. In this example, the peak 24 is set to '1' and the surrounding padding data points on either side of the peak 24 are set to '0'. The system 20 can be configured to use the subset 25 to identify a set of features 26 in the historical data set 21 Figure 9c Each of the features 26 can represent an activity, such as a customer hand approaching the ATM or a card skimmer device being installed to the ATM.

[0065] Each activity can be identified based on different patterns observed for the peaks 24 in the capacitive sensor signal 21. For example, in the case of a card skimmer event, a peak can be identified due to hand approach, followed by an increase in the average amplitude of the signal. The increase in the average signal amplitude can vary depending on the size of the card skimmer device. In the case of a card skimmer being removed, another peak can be identified, followed by the signal amplitude returning to the same level as in the idle state. In the case of a peak being identified but the average amplitude of the signal not increasing from its amplitude in the idle state, the system 20 can determine that only a hand approach or other normal user activity has occurred. In the case of a transaction being performed at the ATM, the system 20 can identify a plurality of consecutive peaks.

[0066] In example embodiments, system 20 reduces noise present within data 21 by applying a moving window average 22 to calculate the mean of all data points within data 21. Then, a signal can be detected for any new data point that is a certain predefined number of standard deviations away from moving average 22. In some embodiments, the signal can be a‘0’ or a‘1’, with the latter indicating an identified peak 24 within data set 21. In example embodiments, the signal (‘0’ or‘1’) within subset array 25 represents an index within data set 21 where a feature 26, e.g., of a transaction, begins and ends. Feature 26 can be extracted with additional padding data from before and after feature 26. Figure 10 An example extracted feature 26 with peaks 24 is plotted in the graph shown in FIG. 3.

[0067] In example embodiments, system 20 can receive a user predefined labeled data set 27 Figure 11 and system 20 can augment identified features 26 with labeled data set 27 to generate a training data set 28. Labeled data set 27 can contain information about the class of hand proximity type, e.g., customer hand proximity or skimmer hand proximity. Then, system 20 can train LSTM-RNN model 4 and CNN model 9 based on training data set 28. The process of data extraction and labeling is generally time consuming. System 20 speeds up this process by extracting key features 26 from the vast skimmer data set 21. System 20 identifies features within, e.g., the vast data set 21 that represent hand activity, transactions, and skimmer activity. As a result, the entire data pre-processing stage is faster and produces a clearer training data set 28. As a result, the resulting card skimmer detection is more accurate.

[0068] In example embodiments, in use, system 20 receives a historical data set 21 Figure 9 System 20 applies moving average 22 and standard deviation 23 to historical data set 21 to identify a plurality of peaks 24 in historical data set 21. System 20 generates a data subset 25 based on each identified peak 24. System 20 identifies a feature set 26 using subset 25. System 20 receives a labeled data set 27 and augments identified features 26 with labeled data set 27 to generate a training data set 28. Then, system 20 trains LSTM-RNN model 4 and CNN model 9 based on training data set 28.

[0069] Embodiments of the application previously described with reference to the drawings include computer systems and processes performed by computer systems. However, the application also extends to computer programs, particularly computer programs on or in a carrier, adapted to put the application into practice. The program can be in the form of a source code, an object code, a code intermediate source and an object code such as a partially compiled form, or in any other form suitable for use in the implementation of the method according to the application. The carrier can be any entity or medium capable of carrying the program. The program can be carried by a carrier such as a ROM, or a magnetic recording means, or a floppy disk, or a hard disk. The carrier can be a signal that is transmittable through an electrical or a metallic line, a waveguide, a cable, a fiber-optics, or a radio or an infrared channel, or any other device suitable for transmitting signals.

[0070] In the description and claims of the application, the words "comprise" and "contain" and variations thereof are not meant to - and do not - exclude the presence of other elements or materials. When describing the application, the articles "a", "an" and "the" are intended to mean one or more unless otherwise indicated by context. The terms "including", "containing" and "comprising" are used herein to mean including without limitation, that is unless the context demands otherwise.

[0071] Features, integers, characteristics or groups described in conjunction with a particular aspect, embodiment or example of the application are to be understood to be applicable to any other aspect, embodiment or example described herein unless incompatible therewith. All of the features disclosed in this specification (including any accompanying claims, abstract and drawings) and / or all of the steps of any method or process so disclosed can be combined in any combination, except combinations where at least some of such features and / or steps are mutually exclusive. The application is not restricted to the details of any foregoing embodiments. The application extends to any novel one, or any novel combination, of the features disclosed in this specification (including any accompanying claims, abstract and drawings), or to any novel one, or any novel combination, of the steps of any method or process so disclosed.

[0072] The reader's attention is directed to all papers and documents submitted herewith or concurrently with or previous to this application in connection with this application and patents or publications known to the applicant at the time of the application which are cited by reference in this patent application.

Claims

1. A computer-implemented method for detecting installation of an object at a terminal device, the method comprising the steps of: receiving detection data from one or more sensors; generating a wavelet matrix based on the detection data; generating an environmental alert based on the wavelet matrix; determining, based on the detection data, a sequence of a proximity state over a first predetermined time period and an object installation state over a second subsequent predetermined time period; and generating a tampering alert based on determining the sequence.

2. The method of claim 1, wherein the method performs any one of the following steps (1)-(6): (1) the environmental alert comprises an environmental weather alert; (2) the environmental alert comprises an environmental weather alert, and the environmental weather alert comprises a rain alert; (3) the detection data is converted from a time domain to a frequency domain using a wavelet transform to obtain converted detection data, and the wavelet matrix is generated based on the converted detection data; (4) the terminal device comprises an automated teller machine device; (5) the object comprises a skimmer device; and (6) identifying a plurality of peaks in a historical data set, identifying a subset of the historical data set based on the identified plurality of peaks, identifying a feature set from the subset of the historical data, augmenting the identified feature set using a labeled data set to obtain a training data set, and training at least one of a first machine learning model or a second machine learning model based on the training data set to perform environmental weather detection or tampering detection, respectively.

3. The method of claim 1, further comprising: identifying one or more features in the wavelet matrix, wherein generating the environmental alert comprises generating the environmental alert based on the one or more identified features.

4. The method of claim 3, wherein identifying the one or more features in the wavelet matrix comprises identifying the one or more features using a first machine learning model.

5. The method of claim 4, wherein the first machine learning model comprises a convolutional neural network model.

6. The method of claim 1, further comprising: determining, based on the detection data, a sequence comprising (i) an idle state during a first time period, (ii) a proximity state during a second time period, and (iii) an object installation state during a third time period.

7. The method of claim 6, further comprising performing any one of the following steps (1)-(5): (1) during the idle state, the detection data comprises a signal having a substantially constant amplitude at a first level; (2) during the object installation state, the detection data comprises a signal having a substantially constant amplitude at a third level that is higher than the first level; (3) determining the sequence comprises determining the sequence using a second machine learning model; and (4) the sequence determination occurs at least partially in parallel with the wavelet matrix generation.

8. The method of claim 6, further comprising performing any one of the following steps (1)-(2): (1) the sequence determination comprises determining a first time period during which the detection data comprises a signal having a substantially constant amplitude at a first level, a second time period during which the detection data comprises a signal having a substantially constant amplitude at a second level that is higher than the first level, and a third time period during which the detection data comprises a signal having a substantially constant amplitude at a third level that is higher than the second level; and (2) the sequence determination comprises determining a first time period during which the detection data comprises a signal having a substantially constant amplitude at a first level, a second time period during which the detection data comprises a signal having a substantially constant amplitude at a second level that is higher than the first level, and a third time period during which the detection data comprises a signal having a substantially constant amplitude at a third level that is higher than the second level. (1) during the idle state, the detection data includes a signal having a substantially constant amplitude at a first level, and during the proximity state, the detection data includes a signal having a negative peak amplitude that is lower than the first level; and (2) determining the sequence includes using a second machine learning model to determine the sequence, and wherein the second machine learning model includes a long short-term memory recurrent neural network model.

9. A data processing system for detecting installation of an object at a terminal device, the system comprising a processor and a memory storing machine executable instructions, the processor configured to access the memory and execute the machine executable instructions to: receive detection data from one or more sensors; generate a wavelet matrix based on the detection data; generate an environmental alert based on the wavelet matrix; determine, based on the detection data, a sequence of a proximity state for one predetermined time period and an object installation state for a subsequent predetermined time period; and generate a tampering alert based on determining the sequence.

10. A computer program product comprising a non-transitory computer readable medium storing machine executable instructions executable by a processor to perform a method comprising: receiving first detection data from one or more sensors for a first time period, generating a wavelet matrix based on the first detection data, generating an environmental alert signal based on the wavelet matrix, receiving second detection data from the one or more sensors for a second time period, determining, from the second detection data, a sequence of a proximity state for one predetermined time period and an object installation state for a subsequent predetermined time period, and generating a tampering alert signal in response to determining the sequence.

Images