Security early warning method and system for ATM machines

Abstract

The present invention discloses a security warning method and system for ATM machines, and relates to the field of data processing technology. The method includes: obtaining N ATM machine layout information in a target area; determining N risk coefficients; dividing the target area into risks based on the N risk coefficients and the N ATM machine positioning information, and configuring the warning module matrix based on the optimal division result; based on P warning modules and N risk coefficients, retrieving the uploaded data of the security warning submodules of N ATM machines within a preset monitoring period, generating P monitoring data sets; obtaining P abnormal identification feature sets; triggering warning instructions according to the P abnormal identification feature sets, and sending the warning instructions to the security warning platform for processing. The present invention solves the technical problems of poor data recognition reliability and low warning accuracy in the existing technology during ATM machine security warning, and achieves the technical effect of improving the reliability of security warning and increasing the warning response speed.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a safety early warning method and system for an ATM machine. Background Art

[0002] As the number of ATMs increases, the difficulty and accuracy of ATM anomaly recognition increases. At present, the data in each ATM is uploaded and analyzed. However, due to the increase in the number of machines, the amount of data to be analyzed is large, so the accuracy of anomaly recognition and the speed of early warning response are greatly reduced. In the prior art, there are technical problems such as poor data recognition reliability and low early warning accuracy during ATM security early warning. Summary of the invention

[0003] The present application provides a security warning method and system for an ATM machine, which is used to solve the technical problems in the prior art of poor data recognition reliability and low warning accuracy during security warning of an ATM machine.

[0004] In view of the above problems, the present application provides a security warning method and system for ATM machines.

[0005] In a first aspect of the present application, a security warning method for an ATM machine is provided, wherein the method is applied to a security warning platform, the security warning platform is communicatively connected to a warning module matrix, and the method comprises:

[0006] Obtaining N ATM layout information in the target area, wherein the ATM layout information includes ATM location information and ATM setting basic information;

[0007] Call the local database of N ATM machines to perform feature analysis, generate N ATM feature sets, and determine N risk factors based on the basic information of the N ATM machines, where each risk factor corresponds to one ATM machine;

[0008] Based on the N risk coefficients and the N ATM location information, the target area is divided into risk groups, and an early warning module matrix is ​​configured based on the optimal division result, wherein the early warning module matrix includes P early warning modules, each early warning module corresponds to a divided sub-area in the division result, and the early warning module has a location identifier;

[0009] Based on P warning modules and N risk factors, the uploaded data of the security warning submodules of N ATM machines within a preset monitoring period are retrieved to generate P monitoring data sets;

[0010] Performing abnormal feature recognition on the P monitoring data sets to obtain P abnormal recognition feature sets;

[0011] An early warning instruction is triggered according to the P abnormal identification feature sets, and the early warning instruction is sent to the security early warning platform for processing.

[0012] A second aspect of the present application provides a security warning system for an ATM machine, the system comprising:

[0013] A layout information acquisition module is used to acquire layout information of N ATM machines in a target area, wherein the ATM machine layout information includes ATM machine location information and ATM machine setting basic information;

[0014] The risk coefficient determination module is used to call the local database of N ATM machines for feature analysis, generate N ATM machine feature sets, and determine N risk coefficients in combination with the basic information of the N ATM machines, where each risk coefficient corresponds to one ATM machine;

[0015] A matrix configuration module, used for dividing the risk of the target area based on the N risk coefficients and the N ATM machine location information, and configuring an early warning module matrix based on the optimal division result, wherein the early warning module matrix includes P early warning modules, each early warning module corresponds to a divided sub-area in the division result, and the early warning module has a location identifier;

[0016] A monitoring data generation module is used to retrieve the uploaded data of the security warning submodules of N ATM machines within a preset monitoring period based on P warning modules and N risk factors to generate P monitoring data sets;

[0017] An identification feature acquisition module is used to perform abnormal feature recognition on the P monitoring data sets to obtain P abnormal recognition feature sets;

[0018] The early warning instruction triggering module is used to trigger the early warning instruction according to the P abnormal identification feature sets, and send the early warning instruction to the security early warning platform for processing.

[0019] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0020] The present application obtains N ATM layout information of the target area, wherein the ATM layout information includes ATM location information and ATM setting basic information, then calls the local database of the N ATMs for feature analysis, generates N ATM feature sets, and determines N risk coefficients in combination with the N ATM setting basic information, wherein each risk coefficient corresponds to an ATM, and then divides the target area into risks based on the N risk coefficients and the N ATM location information, configures an early warning module matrix based on the optimal division result, wherein the early warning module matrix includes P early warning modules, each early warning module corresponds to a divided sub-area in the division result, and the early warning module has a location identifier, and then based on the P early warning modules and the N risk coefficients, retrieves the uploaded data of the security early warning submodules of the N ATMs within a preset monitoring period, generates P monitoring data sets, and obtains P abnormal identification feature sets by performing abnormal feature identification on the P monitoring data sets, and then triggers an early warning instruction according to the P abnormal identification feature sets, and sends the early warning instruction to the security early warning platform for processing. The technical effect of improving the accuracy of ATM security warnings, reducing warning delays, and increasing abnormal response speed has been achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A schematic diagram of a safety warning method for an ATM machine provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of a process for generating N risk factors in a security early warning method for an ATM provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of a process for configuring an early warning module matrix based on an optimal division result in a security early warning method for an ATM provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of the structure of a security warning system for an ATM machine provided in an embodiment of the present application.

[0026] Explanation of the reference numerals: deployment information acquisition module 11 , risk coefficient determination module 12 , matrix configuration module 13 , monitoring data generation module 14 , identification feature acquisition module 15 , early warning instruction triggering module 16 . DETAILED DESCRIPTION

[0027] The present application provides a security warning method and system for ATM machines, which are used to solve the technical problems in the prior art of poor data recognition reliability and low warning accuracy during ATM security warning.

[0028] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0029] It should be noted that the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or modules that are not explicitly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] like Figure 1 As shown, the present application provides a security warning method for an ATM machine, wherein the method is applied to a security warning platform, the security warning platform is communicatively connected with the warning module matrix, and the method comprises:

[0032] Obtaining N ATM layout information in the target area, wherein the ATM layout information includes ATM location information and ATM setting basic information;

[0033] In a possible embodiment, by using the security warning platform to issue a security warning for abnormal situations occurring in ATM machines in the target area, the abnormal situations transmitted from different warning modules in the target area are received by communicating with the warning module matrix, thereby achieving the goal of issuing a security warning for ATM machines in the target area. The target area is any area where multiple ATM machines are set up and abnormal situation identification and warning are required. N ATM machines are arranged in the target area, and the ATM machine layout data stored in the security warning platform in the target area is extracted to obtain the layout information of the N ATM machines. Among them, the ATM machine layout information includes ATM machine positioning information and ATM machine setting basic information. The ATM machine positioning information uniquely identifies the distribution positions of the ATM machines in the target area. The ATM machine setting basic information is used to describe the basic use of the ATM machine, including information such as the use time, the number of fault repairs, and the repair items.

[0034] Call the local database of N ATM machines to perform feature analysis, generate N ATM feature sets, and determine N risk factors based on the basic information of the N ATM machines, where each risk factor corresponds to one ATM machine;

[0035] Further, such as Figure 2 As shown, the embodiment of the present application also includes:

[0036] Extract data from the local databases of N ATM machines within a preset historical window to obtain N historical local data sets;

[0037] Using a transaction status indicator matrix to perform feature recognition on the N historical local data sets to obtain N ATM feature sets, wherein the transaction status indicator matrix includes an average transaction duration, an average response duration, and a transaction success ratio;

[0038] Using the usage time and maintenance record as indexes, data search is performed on the basic information of N ATM machines to obtain N usage time, N design time and N maintenance records;

[0039] Performing reliability analysis based on the N usage durations, the N design durations, and the N maintenance records to generate N first influence coefficients;

[0040] A mapping analysis is performed based on the N ATM feature sets and the N first impact coefficients to generate the N risk coefficients.

[0041] Furthermore, the embodiment of the present application also includes:

[0042] Acquire multiple historical ATM feature sets, multiple historical first impact coefficients, and multiple historical risk coefficients to construct multiple mapping points in a mapping space, and identify the multiple mapping points according to multiple sample risk coefficients;

[0043] Perform mapping positioning in the mapping space according to the N ATM feature sets and the N first influence coefficients to obtain N mapping target points;

[0044] Traverse the N mapping target points to obtain the q closest mapping points, and perform weighted calculation based on the corresponding q historical risk coefficients and risk distribution weight values ​​to obtain N risk coefficients, wherein the risk distribution weight value is a weight set according to the Euclidean distance between the mapping target point and the mapping point.

[0045] The local databases of N ATMs are retrieved respectively, and the retrieved data are analyzed for features to determine the features that distinguish different ATMs from other ATMs, and generate the N ATM feature sets. The N ATM feature sets respectively reflect the transaction performance of the N ATMs within a preset historical window. Furthermore, based on the N ATM feature sets and the basic information of the N ATM settings, the transaction risks of the N ATMs are determined, and N risk coefficients are generated. Each risk coefficient corresponds to an ATM.

[0046] Preferably, the preset historical window is a time period for transaction status analysis pre-set by a person skilled in the art, which may be half a month, a month, etc. The local database is used to record and store data generated after the transactions of N ATM machines. The local databases of the N ATM machines are indexed with the time period corresponding to the preset historical window as the index to obtain N historical local data sets. Among them, the N historical local data sets reflect the transaction status of the N ATM machines within the preset historical window. The transaction status indicator matrix is ​​used to store indicators that can reflect the transaction performance of the ATM machines, including average transaction time, average response time, transaction success ratio, etc. The transaction status indicator matrix is ​​used to extract features from the N historical local data sets to obtain N ATM feature sets.

[0047] Preferably, the basic information of N ATM machines is searched for data respectively with the use time and maintenance record as indexes, and N use time, N design time and N maintenance records are obtained. The ratio of N use time to N design time is used as the first sub-influence coefficient. The N maintenance times in the N maintenance records are extracted respectively, and the total number of N maintenance times divided by the N maintenance times is used as the second sub-influence coefficient. The first sub-influence coefficient and the second sub-influence coefficient are weighted and calculated according to the preset influence weight set by those skilled in the art to obtain the N first influence coefficients. The N first influence coefficients respectively reflect the influence of the N ATM machines on the safety of the machine due to their own use and maintenance conditions. The larger the first influence coefficient, the greater the safety influence. Further, mapping analysis is performed based on the N ATM machine feature sets and the N first influence coefficients to determine the risk coefficients corresponding to the N ATM machines respectively. Among them, the N risk coefficients reflect the possibility of abnormal safety of the N ATM machines during use.

[0048] In one embodiment, multiple mapping points of a mapping space are constructed by retrieving multiple historical ATM feature sets, multiple historical first impact coefficients, and multiple historical risk coefficients from a security warning platform, and the multiple mapping points are identified according to multiple sample risk coefficients. The mapping space is a two-dimensional space, the horizontal axis is the historical ontology data set, and the vertical axis is the first impact coefficient. Multiple mapping points are obtained according to multiple historical ATM feature sets and multiple historical first impact coefficients, and then the multiple mapping points are data identified using the corresponding multiple sample risk coefficients to obtain multiple identified mapping points.

[0049] Preferably, mapping and positioning are performed on the horizontal axis and the vertical axis of the mapping space according to the N ATM feature sets and the N first influence coefficients, respectively, to obtain N mapping target points. Each mapping target point corresponds to an ATM. By collecting the q mapping points closest to the N mapping target points, and performing weighted calculation based on the corresponding q historical risk coefficients and the risk distribution weight value, N risk coefficients are obtained, wherein the risk distribution weight value is a weight set according to the Euclidean distance between the mapping target point and the mapping point. In other words, for any mapping target point, the q mapping points closest to the point in the mapping space are obtained. By calculating the Euclidean distance between the mapping target point and the q mapping points, the ratio of the Euclidean distance between each mapping point to the mapping target point to the Euclidean distance between all the q mapping points to the mapping target point is used as a weight, and the historical risk coefficients identified by the q mapping points are weighted calculated, thereby obtaining the risk coefficient corresponding to the mapping target point.

[0050] Based on the N risk coefficients and the N ATM location information, the target area is divided into risk groups, and an early warning module matrix is ​​configured based on the optimal division result, wherein the early warning module matrix includes P early warning modules, each early warning module corresponds to a divided sub-area in the division result, and the early warning module has a location identifier;

[0051] Further, such as Figure 3 As shown, the embodiment of the present application also includes:

[0052] Performing a transmission signal strength sampling test on the early warning module to obtain a test communication range;

[0053] Taking the area of ​​the divided sub-region as smaller than the test communication range as a first division constraint condition;

[0054] Inputting N risk factors, N ATM location information and target areas into an area division unit to obtain multiple division results;

[0055] Using the first partition constraint condition to screen the multiple partition results, to obtain multiple partition results to be optimized;

[0056] The risk dispersion balance of the multiple partition results to be optimized is evaluated to obtain an optimal partition result, and an early warning module matrix is ​​configured based on the optimal partition result.

[0057] In a possible embodiment, the target area is divided into risk groups according to the N risk coefficients and the N ATM location information, that is, the target area is divided from two dimensions: the degree of risk distribution balance and the applicable scope of the early warning module, and the early warning module matrix is ​​configured according to the division results. Optionally, the data processing performance of each early warning module in the early warning module matrix is ​​consistent. Each early warning module corresponds to a divided sub-area in the division result, and the early warning module has a location identifier. In other words, each early warning module responds to and analyzes the abnormal situation of the ATM in a divided sub-area.

[0058] In one embodiment, the test communication range is obtained by performing a sampling test on the transmission signal strength of the early warning module in the target area. Optionally, by setting different transmission distances, the transmission signal strength of the early warning module is determined, and the transmission distance corresponding to the minimum allowed transmission signal strength is obtained. Then, a circle is drawn with the test position as the center and the transmission distance as the radius, and the area of ​​the circle is calculated to obtain the test communication range. Furthermore, the area of ​​the divided sub-area is smaller than the test communication range as the first division constraint condition. By constraining the size of the divided sub-area, it is avoided that the abnormal situation of the ATM machine cannot be identified due to the transmission signal strength not meeting the standard, thereby achieving the technical effect of improving the reliability of security warnings.

[0059] In one embodiment, the region division unit is an intelligent division unit constructed based on a convolutional neural network, with risk coefficient, ATM location information and target area as input data, and multiple division results as output data. By obtaining multiple sample risk coefficients, multiple sample ATM location information and multiple sample target areas as training data, supervised training is performed on the convolutional neural network until the output reaches convergence, and the region division unit is obtained. Then, N risk coefficients, N ATM location information and target areas are input into the region division unit to obtain multiple division results. The multiple division results are screened using the first division constraint condition to obtain multiple division results to be optimized. In other words, if the area of ​​the sub-area in any division result does not meet the first division constraint condition, the corresponding division result is eliminated. The variance of the multiple risk coefficients corresponding to each sub-region in the multiple division results to be optimized is calculated respectively to obtain multiple variance sets, and then the average of the multiple variance sets is calculated, and the average is used as the risk dispersion balance evaluation result, and the division result corresponding to the minimum value of the average is used as the optimal division result. Based on the sub-regions divided in the optimal division result, an early warning module is configured for each sub-region, and the early warning modules are connected in sequence according to their positions to obtain the early warning module matrix.

[0060] Based on P warning modules and N risk factors, the uploaded data of the security warning submodules of N ATM machines within a preset monitoring period are retrieved to generate P monitoring data sets;

[0061] Furthermore, the embodiment of the present application also includes:

[0062] Obtaining a set of P ATM sub-areas according to the divided sub-areas corresponding to the P warning modules and the location information of the N ATMs;

[0063] Based on P ATM machine sub-area sets, N risk coefficients are matched respectively to obtain P data upload coefficient sets;

[0064] P monitoring data sets are generated, wherein the P monitoring data sets are obtained by extracting data from a local database of the security warning submodules of N ATM machines within a preset monitoring period according to the P data upload coefficient sets.

[0065] In a possible embodiment, after obtaining the warning module matrix, the uploaded data of the security warning submodules of N ATM machines in a preset monitoring period are differentially retrieved according to the P warning modules and N risk coefficients in the matrix to obtain P monitoring data sets. The P monitoring data sets correspond to the operation conditions of the ATM machines in the P sub-areas of the target area. The preset monitoring period is a time period for monitoring pre-set by a person skilled in the art.

[0066] Preferably, the ATMs in the divided sub-areas are matched according to the divided sub-areas corresponding to the P warning modules and the location information of the N ATMs, and P ATM sub-area sets are obtained. The number of ATMs in the P ATM sub-area sets may be inconsistent. Then, based on the P ATM sub-area sets, the N risk coefficients are matched respectively to obtain P data upload coefficient sets. Optionally, the ratio of the risk coefficient in the P ATM sub-areas to the total value of all risk coefficients in the upper sub-areas is calculated respectively as the P data upload coefficient sets. The larger the ratio, the higher the security risk of the corresponding ATM, the higher the frequency of monitoring, and the larger the corresponding data upload coefficient. Among them, the data upload coefficient is the data volume coefficient uploaded by the ATM from the local database to the security warning sub-module. The data upload coefficient is multiplied by the preset upload data volume to obtain the actual upload data volume. According to the P data upload coefficient sets, the data in the local database of the security warning sub-modules of the N ATMs within the preset monitoring period is extracted to generate the P monitoring data sets. The goal of performing differentiated data extraction is achieved, and the technical effect of reducing the redundancy of monitoring data and improving the response speed is achieved.

[0067] Performing abnormal feature recognition on the P monitoring data sets to obtain P abnormal recognition feature sets;

[0068] An early warning instruction is triggered according to the P abnormal identification feature sets, and the early warning instruction is sent to the security early warning platform for processing.

[0069] Furthermore, the embodiment of the present application also includes:

[0070] Acquire multiple sample monitoring data sets and multiple sample abnormality identification feature sets as construction data;

[0071] Randomly selecting a sample monitoring data from the multiple sample monitoring data without replacement and storing it as the first sample monitoring data to the first internal node, performing similarity matching on the multiple sample monitoring data, storing the sample monitoring data that meets the preset similarity in the first child node of the first internal node, and transmitting the sample monitoring data that does not meet the preset similarity as the first transmission data to the second internal node;

[0072] Randomly selecting a sample monitoring data from the multiple sample monitoring data without replacement and storing it as the second sample monitoring data to the second internal node, performing similarity matching on the first transmission data, storing the sample monitoring data that meets the preset similarity in the second child node of the second internal node, and transmitting the sample monitoring data that does not meet the preset similarity as the second transmission data to the third internal node;

[0073] Randomly selecting a sample monitoring data from the multiple sample monitoring data without replacement as the N-1th sample monitoring data and storing it in the N-1th internal node, performing similarity matching on the N-2th transmission data, storing the sample monitoring data that meets the preset similarity in the N-1th child node of the N-1th internal node, and transmitting the sample monitoring data that does not meet the preset similarity as the N-1th transmission data to the Nth child node of the Nth internal node;

[0074] The intersection of multiple sample abnormality identification features corresponding to multiple sample monitoring data stored in the first child node, the second child node, the N-1th child node and the Nth child node is respectively obtained, and the first child node, the second child node, the N-1th child node and the Nth child node are identified according to the obtained results to obtain an identification result.

[0075] Furthermore, after obtaining the identification result, the embodiment of the present application further includes:

[0076] An abnormal feature recognition network layer is constructed according to the identification result, the first internal node, the second internal node, the N-1th internal node and the Nth internal node, wherein the abnormal feature recognition network layer is embedded in each early warning module of the early warning module matrix, and is used to perform abnormal feature recognition on the monitoring data obtained by each early warning module;

[0077] P monitoring data sets are respectively input into the abnormal feature recognition network layer for feature recognition to obtain P abnormal recognition feature sets.

[0078] In a possible embodiment, after obtaining the P monitoring data sets, abnormal feature recognition is performed on the data to obtain abnormal features of the ATM machines in the P sub-areas, that is, the P abnormal recognition feature sets. According to the position of the abnormal recognition features in the P abnormal recognition feature sets, an early warning instruction is triggered. The early warning instruction is a command to alarm the abnormal situation of the ATM machine. After the early warning instruction is sent to the security early warning platform, the abnormal ATM is processed.

[0079] Preferably, multiple sample monitoring data sets and multiple sample abnormality identification feature sets are obtained as construction data, and then one sample monitoring data is randomly selected from the multiple sample monitoring data without replacement and stored as the first sample monitoring data to a first internal node, similarity matching is performed on the multiple sample monitoring data, and the sample monitoring data that meets the preset similarity is stored in a first child node of the first internal node, and the sample monitoring data that does not meet the preset similarity is transmitted to a second internal node as the first transmission data, and then a sample monitoring data is randomly selected from the multiple sample monitoring data without replacement and stored as the second sample monitoring data to a second internal node, and similarity matching is performed on the first transmission data, and the sample monitoring data that meets the preset similarity is stored in a second child node of the second internal node, and the sample monitoring data that does not meet the preset similarity is transmitted to a second internal node. The sample monitoring data is used as the second transmission data and transmitted to the third internal node. A sample monitoring data is randomly selected from the multiple sample monitoring data without replacement and stored as the N-1th sample monitoring data in the N-1th internal node. The N-2th transmission data is matched for similarity, and the sample monitoring data that meets the preset similarity is stored in the N-1th child node of the N-1th internal node. The sample monitoring data that does not meet the preset similarity is used as the N-1th transmission data and transmitted to the Nth child node of the Nth internal node. The intersection of the multiple sample abnormality identification features corresponding to the multiple sample monitoring data stored in the first child node, the second child node, the N-1th child node and the Nth child node is respectively obtained. The first child node, the second child node, the N-1th child node and the Nth child node are identified according to the obtained results to obtain the identification result. Wherein, the identification result reflects the abnormal identification features corresponding to the monitoring data under different clustering results.

[0080] Then, the framework of the abnormal feature recognition network layer is constructed according to the first internal node, the second internal node, the N-1 internal node and the N internal node, and the P monitoring data sets are respectively input into the abnormal feature recognition network layer for feature recognition according to the identification result as the feature matching result after recognition, so as to obtain P abnormal recognition feature sets. The technical effect of intelligently recognizing the data of the ATM machine and improving the reliability and efficiency of recognition is achieved.

[0081] In summary, the embodiments of the present application have at least the following technical effects:

[0082] This application collects the ATM settings in the target area, analyzes the ATM's own characteristics in combination with the local database, determines the risk factor, and then divides the target area into risk balance according to N risk factors and N ATM location information, improves the balance of risk identification and processing, configures the early warning module matrix, and then differentially retrieves the uploaded data of N ATMs within the preset monitoring period, reduces the redundancy of analysis data, obtains P monitoring data sets, obtains P abnormal identification feature sets after abnormal feature identification, triggers the early warning instruction, and sends it to the security early warning platform for processing. The technical effect of improving the reliability of security early warning and increasing the early warning response speed is achieved.

[0083] Embodiment 2

[0084] Based on the same inventive concept as the security warning method for ATM machines in the aforementioned embodiment, Figure 4 As shown, the present application provides a security warning system for ATM machines, and the system and method embodiments in the present application embodiments are based on the same inventive concept. The system includes:

[0085] The layout information acquisition module 11 is used to obtain the layout information of N ATM machines in the target area, wherein the ATM machine layout information includes ATM machine location information and ATM machine setting basic information;

[0086] The risk coefficient determination module 12 is used to call the local database of N ATM machines to perform feature analysis, generate N ATM machine feature sets, and determine N risk coefficients in combination with the basic information of the N ATM machines, wherein each risk coefficient corresponds to one ATM machine;

[0087] A matrix configuration module 13 is used to divide the target area into risk groups based on the N risk coefficients and the N ATM location information, and configure an early warning module matrix based on the optimal division result, wherein the early warning module matrix includes P early warning modules, each early warning module corresponds to a divided sub-area in the division result, and the early warning module has a location identifier;

[0088] A monitoring data generating module 14 is used to retrieve the uploaded data of the security warning submodules of N ATM machines within a preset monitoring period based on P warning modules and N risk factors to generate P monitoring data sets;

[0089] An identification feature acquisition module 15 is used to perform abnormal feature recognition on the P monitoring data sets to obtain P abnormal recognition feature sets;

[0090] The warning instruction triggering module 16 is used to trigger the warning instruction according to the P abnormal identification feature sets, and send the warning instruction to the security warning platform for processing.

[0091] Furthermore, the risk coefficient determination module 12 is used to perform the following method:

[0092] Extract data from the local databases of N ATM machines within a preset historical window to obtain N historical local data sets;

[0093] Using a transaction status indicator matrix to perform feature recognition on the N historical local data sets to obtain N ATM feature sets, wherein the transaction status indicator matrix includes an average transaction duration, an average response duration, and a transaction success ratio;

[0094] Using the usage time and maintenance record as indexes, data search is performed on the basic information of N ATM machines to obtain N usage time, N design time and N maintenance records;

[0095] Performing reliability analysis based on the N usage durations, the N design durations, and the N maintenance records to generate N first influence coefficients;

[0096] A mapping analysis is performed based on the N ATM feature sets and the N first impact coefficients to generate the N risk coefficients.

[0097] Furthermore, the risk coefficient determination module 12 is used to perform the following method:

[0098] Acquire multiple historical ATM feature sets, multiple historical first impact coefficients, and multiple historical risk coefficients to construct multiple mapping points in a mapping space, and identify the multiple mapping points according to multiple sample risk coefficients;

[0099] Perform mapping positioning in the mapping space according to the N ATM feature sets and the N first influence coefficients to obtain N mapping target points;

[0100] Traverse the N mapping target points to obtain the q closest mapping points, and perform weighted calculation based on the corresponding q historical risk coefficients and risk distribution weight values ​​to obtain N risk coefficients, wherein the risk distribution weight value is a weight set according to the Euclidean distance between the mapping target point and the mapping point.

[0101] Furthermore, the matrix configuration module 13 is used to execute the following method:

[0102] Performing a transmission signal strength sampling test on the early warning module to obtain a test communication range;

[0103] Taking the area of ​​the divided sub-region as smaller than the test communication range as a first division constraint condition;

[0104] Inputting N risk factors, N ATM location information and target areas into an area division unit to obtain multiple division results;

[0105] Using the first partition constraint condition to screen the multiple partition results, to obtain multiple partition results to be optimized;

[0106] The risk dispersion balance of the multiple partition results to be optimized is evaluated to obtain an optimal partition result, and an early warning module matrix is ​​configured based on the optimal partition result.

[0107] Furthermore, the monitoring data generating module 14 is used to execute the following method:

[0108] Obtaining a set of P ATM sub-areas according to the divided sub-areas corresponding to the P warning modules and the location information of the N ATMs;

[0109] Based on P ATM machine sub-area sets, N risk coefficients are matched respectively to obtain P data upload coefficient sets;

[0110] P monitoring data sets are generated, wherein the P monitoring data sets are obtained by extracting data from a local database of the security warning submodules of N ATM machines within a preset monitoring period according to the P data upload coefficient sets.

[0111] Furthermore, the identification feature acquisition module 15 is used to perform the following method:

[0112] Acquire multiple sample monitoring data sets and multiple sample abnormality identification feature sets as construction data;

[0113] Randomly selecting a sample monitoring data from the multiple sample monitoring data without replacement and storing it as the first sample monitoring data to the first internal node, performing similarity matching on the multiple sample monitoring data, storing the sample monitoring data that meets the preset similarity in the first child node of the first internal node, and transmitting the sample monitoring data that does not meet the preset similarity as the first transmission data to the second internal node;

[0114] Randomly selecting a sample monitoring data from the multiple sample monitoring data without replacement and storing it as the second sample monitoring data to the second internal node, performing similarity matching on the first transmission data, storing the sample monitoring data that meets the preset similarity in the second child node of the second internal node, and transmitting the sample monitoring data that does not meet the preset similarity as the second transmission data to the third internal node;

[0115] Randomly selecting a sample monitoring data from the multiple sample monitoring data without replacement as the N-1th sample monitoring data and storing it in the N-1th internal node, performing similarity matching on the N-2th transmission data, storing the sample monitoring data that meets the preset similarity in the N-1th child node of the N-1th internal node, and transmitting the sample monitoring data that does not meet the preset similarity as the N-1th transmission data to the Nth child node of the Nth internal node;

[0116] The intersection of multiple sample abnormality identification features corresponding to multiple sample monitoring data stored in the first child node, the second child node, the N-1th child node and the Nth child node is respectively obtained, and the first child node, the second child node, the N-1th child node and the Nth child node are identified according to the obtained results to obtain an identification result.

[0117] Furthermore, the identification feature acquisition module 15 is used to perform the following method:

[0118] An abnormal feature recognition network layer is constructed according to the identification result, the first internal node, the second internal node, the N-1th internal node and the Nth internal node, wherein the abnormal feature recognition network layer is embedded in each early warning module of the early warning module matrix, and is used to perform abnormal feature recognition on the monitoring data obtained by each early warning module;

[0119] P monitoring data sets are respectively input into the abnormal feature recognition network layer for feature recognition to obtain P abnormal recognition feature sets.

[0120] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0121] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0122] This specification and the drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.

Claims

1. A security early warning method for an ATM machine, characterized in that: Applied to a security early warning platform, the security early warning platform is connected to the early warning module matrix for communication, the method comprises: Obtaining N ATM layout information in the target area, wherein the ATM layout information includes ATM location information and ATM setting basic information; Call the local database of N ATM machines to perform feature analysis, generate N ATM feature sets, and determine N risk factors based on the basic information of the N ATM machines, where each risk factor corresponds to one ATM machine; Based on the N risk coefficients and the N ATM location information, the target area is divided into risk groups, and an early warning module matrix is ​​configured based on the optimal division result, wherein the early warning module matrix includes P early warning modules, each early warning module corresponds to a divided sub-area in the division result, and the early warning module has a location identifier; Based on P warning modules and N risk factors, the uploaded data of the security warning submodules of N ATM machines within a preset monitoring period are retrieved to generate P monitoring data sets; Performing abnormal feature recognition on the P monitoring data sets to obtain P abnormal recognition feature sets; Trigger an early warning instruction according to the P abnormal identification feature sets, and send the early warning instruction to the security early warning platform for processing; Wherein, the method comprises: Performing a transmission signal strength sampling test on the early warning module to obtain a test communication range; Taking the area of ​​the divided sub-region as smaller than the test communication range as a first division constraint condition; Inputting N risk factors, N ATM location information and target areas into an area division unit to obtain multiple division results; Using the first partition constraint condition to screen the multiple partition results, to obtain multiple partition results to be optimized; The risk dispersion balance of the multiple partition results to be optimized is evaluated to obtain an optimal partition result, and an early warning module matrix is ​​configured based on the optimal partition result.

2. The method according to claim 1, characterized in that The method comprises: Extract data from the local databases of N ATM machines within a preset historical window to obtain N historical local data sets; Using a transaction status indicator matrix to perform feature recognition on the N historical local data sets to obtain N ATM feature sets, wherein the transaction status indicator matrix includes an average transaction duration, an average response duration, and a transaction success ratio; Using the usage time and maintenance record as indexes, data search is performed on the basic information of N ATM machines to obtain N usage time, N design time and N maintenance records; Performing reliability analysis based on the N usage durations, the N design durations, and the N maintenance records to generate N first influence coefficients; A mapping analysis is performed based on the N ATM feature sets and the N first impact coefficients to generate the N risk coefficients.

3. The method according to claim 2, characterized in that The method comprises: Acquire multiple historical ATM feature sets, multiple historical first impact coefficients, and multiple historical risk coefficients to construct multiple mapping points in a mapping space, and identify the multiple mapping points according to multiple sample risk coefficients; Perform mapping positioning in the mapping space according to the N ATM feature sets and the N first influence coefficients to obtain N mapping target points; Traverse the N mapping target points to obtain the q closest mapping points, and perform weighted calculation based on the corresponding q historical risk coefficients and risk distribution weight values ​​to obtain N risk coefficients, wherein the risk distribution weight value is a weight set according to the Euclidean distance between the mapping target point and the mapping point.

4. The method according to claim 1, characterized in that The method comprises: Obtaining a set of P ATM sub-areas according to the divided sub-areas corresponding to the P warning modules and the location information of the N ATMs; Based on P ATM machine sub-area sets, N risk coefficients are matched respectively to obtain P data upload coefficient sets; P monitoring data sets are generated, wherein the P monitoring data sets are obtained by extracting data from a local database of the security warning submodules of N ATM machines within a preset monitoring period according to the P data upload coefficient sets.

5. The method according to claim 1, characterized in that The method comprises: Acquire multiple sample monitoring data sets and multiple sample abnormality identification feature sets as construction data; Randomly selecting a sample monitoring data from the multiple sample monitoring data without replacement and storing it as the first sample monitoring data to the first internal node, performing similarity matching on the multiple sample monitoring data, storing the sample monitoring data that meets the preset similarity in the first child node of the first internal node, and transmitting the sample monitoring data that does not meet the preset similarity as the first transmission data to the second internal node; Randomly selecting a sample monitoring data from the multiple sample monitoring data without replacement and storing it as the second sample monitoring data to the second internal node, performing similarity matching on the first transmission data, storing the sample monitoring data that meets the preset similarity in the second child node of the second internal node, and transmitting the sample monitoring data that does not meet the preset similarity as the second transmission data to the third internal node; Randomly selecting a sample monitoring data from the multiple sample monitoring data without replacement as the N-1th sample monitoring data and storing it in the N-1th internal node, performing similarity matching on the N-2th transmission data, storing the sample monitoring data that meets the preset similarity in the N-1th child node of the N-1th internal node, and transmitting the sample monitoring data that does not meet the preset similarity as the N-1th transmission data to the Nth child node of the Nth internal node; The intersection of multiple sample abnormality identification features corresponding to multiple sample monitoring data stored in the first child node, the second child node, the N-1th child node and the Nth child node is respectively obtained, and the first child node, the second child node, the N-1th child node and the Nth child node are identified according to the obtained results to obtain an identification result.

6. The method according to claim 5, characterized in that After obtaining the identification result, the method further includes: An abnormal feature recognition network layer is constructed according to the identification result, the first internal node, the second internal node, the N-1th internal node and the Nth internal node, wherein the abnormal feature recognition network layer is embedded in each early warning module of the early warning module matrix, and is used to perform abnormal feature recognition on the monitoring data obtained by each early warning module; P monitoring data sets are respectively input into the abnormal feature recognition network layer for feature recognition to obtain P abnormal recognition feature sets.

7. A security warning system for ATM machines, characterized in that: The system is used to execute the security warning method for an ATM machine according to any one of claims 1 to 6, comprising: A layout information acquisition module is used to acquire layout information of N ATM machines in a target area, wherein the ATM machine layout information includes ATM machine location information and ATM machine setting basic information; The risk coefficient determination module is used to call the local database of N ATM machines for feature analysis, generate N ATM machine feature sets, and determine N risk coefficients in combination with the basic information of the N ATM machines, where each risk coefficient corresponds to one ATM machine; A matrix configuration module, used for dividing the risk of the target area based on the N risk coefficients and the N ATM machine location information, and configuring an early warning module matrix based on the optimal division result, wherein the early warning module matrix includes P early warning modules, each early warning module corresponds to a divided sub-area in the division result, and the early warning module has a location identifier; A monitoring data generation module is used to retrieve the uploaded data of the security warning submodules of N ATM machines within a preset monitoring period based on P warning modules and N risk factors to generate P monitoring data sets; An identification feature acquisition module is used to perform abnormal feature recognition on the P monitoring data sets to obtain P abnormal recognition feature sets; The early warning instruction triggering module is used to trigger the early warning instruction according to the P abnormal identification feature sets, and send the early warning instruction to the security early warning platform for processing.

Images