A QR code payment system for analyzing QR code risks

Abstract

The present invention relates to the technical field of two-dimensional code payment, and in particular, to a two-dimensional code payment system for analyzing two-dimensional code risks. It includes a scanning analysis unit, a malicious risk unit, and an anomaly detection unit. The scoring risk module of the present invention obtains the analyzed payment merchant two-dimensional code source data from the source analysis module, obtains the identified malicious two-dimensional code data from the malicious identification module, obtains the detected abnormal behavior data from the anomaly detection unit, and analyzes the comprehensive two-dimensional code risk value. The final payment review is performed according to the analyzed comprehensive two-dimensional code risk value to review whether the merchant two-dimensional code has a two-dimensional code risk. By combining different data, the legitimacy of the two-dimensional code can be verified from multiple angles to avoid the limitations of a single data source. At the same time, through comprehensive analysis, malicious two-dimensional codes can be identified and prevented from spreading in electronic devices at the payment end earlier, and the probability of potential two-dimensional code risks and phishing website events can be accurately discovered, thereby enhancing the security of two-dimensional code payment.

Description

Technical Field

[0001] The present invention relates to the technical field of two-dimensional code payment, and in particular to a two-dimensional code payment system for analyzing two-dimensional code risks. Background Art

[0002] With the popularity of mobile payment, QR code payment has become an indispensable part of people's daily life. However, this convenient payment method is also accompanied by a series of security risks, such as malicious QR codes and phishing website fraud. Traditionally, the QR code payment system mainly relies on simple scanning and payment processes, and the security verification of the QR code is not sufficient. When the electronic device on the payment end pays by scanning the merchant's QR code, the electronic device on the payment end does not combine different data or verify the legitimacy of the QR code from multiple angles. It can only rely on trust in the merchant or, but cannot analyze whether the QR code has risks, which increases the payment risk of the QR code and leads to personal information leakage or financial loss. Due to the increased payment risk of the QR code, it is impossible to accurately identify the spread of malicious QR codes in the electronic devices on the payment end, which increases the probability of potential QR code risks and phishing website incidents, resulting in a significant reduction in the security of QR code payment. Therefore, we provide a QR code payment system for analyzing QR code risks. Summary of the invention

[0003] The purpose of the present invention is to provide a two-dimensional code payment system for analyzing two-dimensional code risks to solve the problems raised in the above-mentioned background technology.

[0004] To achieve the above-mentioned object, the present invention provides a QR code payment system for analyzing QR code risks, comprising a scanning analysis unit, a malicious risk unit and an anomaly detection unit;

[0005] The scanning and analysis unit scans the QR code data of the payment merchant through the electronic device of the payment terminal, calculates the hash value of the payment terminal for the QR code data, and analyzes whether the QR code of the payment merchant is generated from an official channel;

[0006] The malicious risk unit is used to receive a command from the scanning and analysis unit that the QR code of the payment merchant is generated through an official channel. The malicious risk unit obtains the QR code data from the scanning and analysis unit and generates a basic URL, identifies the malicious QR code according to the basic URL, and when the identified payment merchant QR code is not a malicious QR code, performs a comprehensive anomaly score evaluation according to the basic URL, and then uses the evaluated comprehensive anomaly score data to determine whether there is a phishing website in the subdomain structure;

[0007] The anomaly detection unit is used to receive a command from the malicious risk unit that there is no phishing website in the subdomain structure. The anomaly detection unit obtains the QR code data from the scanning and analysis unit to calculate the average transaction amount, calculates the standard deviation of the transaction amount based on the average transaction amount, and then calculates the maximum and minimum transaction amount thresholds. The maximum and minimum transaction amount thresholds are used to detect abnormal behavior and detect whether there is an abnormal transaction amount in the merchant's QR code;

[0008] The malicious risk unit receives a command from the anomaly detection unit that there is no abnormal transaction amount in the merchant QR code detected by the anomaly detection unit. The malicious risk unit obtains the source of the analyzed merchant QR code from the scanning analysis unit and the abnormal behavior data detected in the anomaly detection unit and performs an analysis of the comprehensive QR code risk value, and then performs a final payment review to review whether the merchant QR code has a QR code risk. When the reviewed merchant QR code does not have a QR code risk, the payee approves the electronic device to make a QR code payment for the merchant QR code.

[0009] As a further improvement of the technical solution, the scanning analysis unit includes a scanning calculation module and a source analysis module;

[0010] The scanning and calculation module scans the QR code data of the payment merchant through the electronic device of the payment end, parses and extracts the original data, the merchant digital signature, the merchant public key and the official certificate code according to the QR code data, calculates the hash value of the payment end based on the extracted original data using the SHA-256 hash algorithm, calculates the merchant hash value based on the merchant public key and the merchant digital signature, and then calculates the official hash value based on the official certificate code;

[0011] The source analysis module is used to receive the hash value, the merchant hash value and the official hash value in the scanning calculation module and analyze the source of the QR code of the payment merchant to analyze whether the QR code of the payment merchant is generated through an official channel;

[0012] When the hash value is consistent with the merchant's hash value, and the merchant's hash value is consistent with the official hash value, the official certificate is determined to be true, and the merchant's QR code is generated through official channels;

[0013] When the hash value is inconsistent with the merchant hash value or the merchant hash value is inconsistent with the official hash value, the official certificate is judged to be false, and the merchant QR code of the payment is not generated through official channels. The command that the merchant QR code of the payment is not generated through official channels is fed back to the electronic device on the payment end, and the electronic device on the payment end does not perform QR code payment for the merchant QR code of the payment.

[0014] As a further improvement of the technical solution, the malicious risk unit includes a malicious identification module and a scoring risk module;

[0015] The malicious identification module is used to receive the command from the source analysis module that the QR code of the payment merchant is generated through an official channel. The malicious identification module obtains raw data from the scanning calculation module to generate a basic URL, and then performs URL feature analysis on the basic URL, and extracts the URL length and the number of special characters in the URL from the analyzed URL features, and uses the extracted URL length to identify malicious QR codes, and identify whether the QR code of the payment merchant is a malicious QR code;

[0016] When the length of the extracted URL exceeds the set URL length range value, the length of the extracted URL is too long, and it is determined that there is malicious code in the URL of the payment merchant's QR code, then the payment merchant's QR code is identified as a malicious QR code, and a command that there is malicious code in the URL of the payment merchant's QR code is fed back to the electronic device at the payment end, and then the electronic device at the payment end does not perform QR code payment for the payment merchant's QR code;

[0017] When the length of the extracted URL is within the set URL length range, it is determined that there is no malicious code in the URL of the payment merchant's QR code, and the payment merchant's QR code is identified as not a malicious QR code.

[0018] As a further improvement of the present technical solution, the scoring risk module is used to receive a command that the payment merchant QR code identified in the malicious identification module is not a malicious QR code. The scoring risk module obtains the basic URL from the malicious identification module and analyzes the subdomain structure, records the number of subdomains, the length of subdomain characters, the character composition of subdomains, and the subdomain pattern, and scores the number of subdomains for quantity anomalies according to the set subdomain number range value, and then scores the length anomalies of the subdomain characters according to the set subdomain character length range value, and scores the character anomalies using the subdomain character composition and the specified character rules, and then scores the subdomain pattern for pattern anomalies using the regular expression rules, and uses the comprehensive anomaly scoring algorithm to evaluate the comprehensive anomaly score based on the score quantity anomalies, score length anomalies, score character anomalies, and score pattern anomaly data, and uses the evaluated comprehensive anomaly scoring data to determine whether the subdomain structure contains a phishing website;

[0019] When the evaluated comprehensive anomaly score data is greater than the set comprehensive anomaly score, it is determined that there is a phishing website in the subdomain structure, and a command that the subdomain structure in the QR code of the payment merchant exists a phishing website is fed back to the electronic device at the payment end, and the electronic device at the payment end does not perform QR code payment for the QR code of the payment merchant;

[0020] When the evaluated comprehensive anomaly score data is less than the set comprehensive anomaly score, it is determined that there is no phishing website in the subdomain structure.

[0021] As a further improvement of the present technical solution, the anomaly detection unit is used to receive a command in the scoring risk module that there is no phishing website in the subdomain structure. The anomaly detection unit obtains raw data from the scanning calculation module, parses the raw data and extracts the transaction amount data, calculates the average transaction amount based on the extracted transaction amount data, and then calculates the standard deviation of the transaction amount based on the extracted transaction amount data and the average transaction amount. The maximum and minimum transaction amount thresholds are calculated using the average transaction amount and the standard deviation of the transaction amount, and then the extracted transaction amount data and the maximum and minimum transaction amount thresholds are used to detect abnormal behavior, and detect whether there is an abnormal transaction amount in the merchant's QR code.

[0022] As a further improvement of the present technical solution, the scoring risk module receives a command of a transaction amount that does not contain an abnormality in the abnormality detection unit, and the scoring risk module obtains the analyzed payment merchant QR code source data from the source analysis module, obtains the identified malicious QR code data from the malicious identification module, and obtains the detected abnormal behavior data from the abnormality detection unit, and uses a comprehensive factor algorithm to analyze the comprehensive QR code risk value based on the analyzed payment merchant QR code source, the identified malicious QR code, the evaluated comprehensive anomaly score, and the detected abnormal behavior data, and performs a final payment review based on the analyzed comprehensive QR code risk value to review whether the merchant QR code has a QR code risk;

[0023] When the analyzed comprehensive QR code risk value is greater than the set comprehensive QR code risk value, the reviewed merchant QR code has a QR code risk, and a command that the merchant QR code has a QR code risk is fed back to the electronic device at the payment end, and the electronic device at the payment end does not perform QR code payment for the merchant QR code for payment;

[0024] When the analyzed comprehensive QR code risk value is less than the set comprehensive QR code risk value, it is verified that the merchant's QR code does not have QR code risk, and the payee approves the electronic device to perform QR code payment on the merchant's QR code.

[0025] As a further improvement of the technical solution, the implementation principle of using a comprehensive factor algorithm to analyze the comprehensive QR code risk value in the scoring risk module is:

[0026] The source of QR codes of payment merchants collected and analyzed , Identified malicious QR codes , the comprehensive abnormality score of the evaluation , abnormal behavior data detected and weight coefficient , , and Conduct comprehensive QR code risk value analysis to obtain the analyzed comprehensive QR code risk value , the specific algorithm formula is:

[0027] .

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. In the QR code payment system for analyzing QR code risks, the scoring risk module scores the number of subdomains for quantity anomalies according to a set subdomain number range value, and then scores the subdomain character length for length anomalies according to a set subdomain character length range value, scores the character anomalies using the subdomain character composition and the specified character rules, and then scores the subdomain pattern for pattern anomalies using the regular expression rules, and uses the comprehensive anomaly scoring algorithm to evaluate the comprehensive anomaly score based on the score quantity anomalies, score length anomalies, score character anomalies, and score pattern anomaly data, and uses the evaluated comprehensive anomaly scoring data to determine whether there is a phishing website in the subdomain structure, and by evaluating the comprehensive anomaly score, it is possible to quickly identify high-risk subdomain structures, avoid scanning phishing QR codes, reduce the economic losses of payers caused by fraudulent behavior, and reduce the risk of user QR code payment.

[0030] 2. In the QR code payment system for analyzing QR code risks, the scoring risk module receives a command of a transaction amount without abnormalities from the anomaly detection unit, and the scoring risk module obtains the analyzed QR code source data of the payment merchant from the source analysis module, obtains the identified malicious QR code data from the malicious identification module, obtains the detected abnormal behavior data from the anomaly detection unit and analyzes the comprehensive QR code risk value, and performs a final payment review based on the analyzed comprehensive QR code risk value to review whether the merchant QR code has a QR code risk. By combining different data, the legitimacy of the QR code can be verified from multiple angles to avoid the limitations of a single data source. At the same time, through comprehensive analysis, malicious QR codes can be identified and prevented from spreading in electronic devices at the payment end earlier, and the probability of potential QR code risks and phishing website incidents can be accurately discovered, thereby enhancing the security of QR code payment. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A unit block diagram of the present invention;

[0032] Figure 2 It is a block diagram of the module unit of the present invention.

[0033] The meaning of each number in the figure is:

[0034] 1. Scanning and analysis unit; 11. Scanning and calculation module; 12. Source analysis module;

[0035] 2. Malicious risk unit; 21. Malicious identification module; 22. Scoring risk module; 3. Anomaly detection unit. DETAILED DESCRIPTION

[0036] The following will be combined with the accompanying drawings in the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Example

[0037] The present invention provides a QR code payment system for analyzing QR code risks. Figure 1 , including a scanning and analysis unit 1, a malicious risk unit 2 and an anomaly detection unit 3;

[0038] The scanning and analysis unit 1 scans the QR code data of the payment merchant through the electronic device at the payment end, then calculates the hash value of the payment end for the QR code data, and analyzes whether the QR code of the payment merchant is generated from an official channel; the malicious risk unit 2 is used to receive the command from the scanning and analysis unit 1 that the QR code of the payment merchant is generated through an official channel, the malicious risk unit 2 obtains the QR code data from the scanning and analysis unit 1 and generates a basic URL, identifies the malicious QR code according to the basic URL, and when the identified payment merchant QR code is not a malicious QR code, an evaluation of the comprehensive anomaly score is performed according to the basic URL, and then the evaluated comprehensive anomaly score data is used to determine whether there is a phishing website in the subdomain structure; the anomaly detection unit 3 is used to receive the command from the malicious risk unit 2 that the subdomain structure does not contain a phishing website, and the anomaly detection unit 3 sends a command to the scanning and analysis unit 1 The QR code data is obtained to calculate the average transaction amount, the standard deviation of the transaction amount is calculated based on the average transaction amount, and then the maximum and minimum transaction amount thresholds are calculated. The maximum and minimum transaction amount thresholds are used to detect abnormal behavior and detect whether there is an abnormal transaction amount in the merchant QR code; the malicious risk unit 2 receives the command that there is no abnormal transaction amount in the merchant QR code detected by the abnormality detection unit 3, and the malicious risk unit 2 obtains the analyzed payment merchant QR code source and the abnormal behavior data detected by the abnormality detection unit 3 from the scanning and analysis unit 1 and performs a comprehensive QR code risk value analysis, and then performs a final payment review to review whether the merchant QR code has a QR code risk. When the reviewed merchant QR code does not have a QR code risk, the payee approves the electronic device to perform QR code payment on the payment merchant QR code.

[0039] The following is a refinement of the above units, see Figure 2 ;

[0040] The scanning analysis unit 1 includes a scanning calculation module 11 and a source analysis module 12;

[0041] The scanning and calculation module 11 scans the QR code data of the merchant through the electronic device at the payment end, analyzes the QR code data and extracts the original data and the merchant's digital signature. , Merchant public key (The merchant public key is an important part of public key encryption. It and the merchant private key together form the encryption and signature system) and the official certificate code When a QR code is generated through official channels, a private key will be used to sign the QR code content. The generated official digital signature, merchant public key and official certificate code will be embedded in the merchant QR code. The SHA-256 hash algorithm is used to calculate the hash value of the payment end for the extracted raw data. The extracted raw data is based on the merchant's public key and merchant's digital signature Calculate the merchant hash value, and then use the official certificate code Calculate the official hash value;

[0042] The original data includes the merchant ID, transaction amount, and generated timestamp data;

[0043] The source analysis module 12 is used to receive the hash value, the merchant hash value and the official hash value in the scanning and calculation module 11, and use the hash value, the merchant hash value and the official hash value to analyze the source of the QR code of the payment merchant, and analyze whether the QR code of the payment merchant is generated through an official channel. By comparing the merchant hash value and the official hash value, it can be confirmed whether the QR code is officially generated, thereby preventing criminals from forging QR codes for fraud. At the same time, the electronic device at the payment end scans the officially verified QR code for payment, which can enhance the trust in the security of the transaction;

[0044] When the hash value is consistent with the merchant's hash value, and the merchant's hash value is consistent with the official hash value, the official certificate is determined to be true, and the merchant's QR code is generated through official channels;

[0045] When the hash value is inconsistent with the merchant's hash value or the merchant's hash value is inconsistent with the official hash value, the official certificate is determined to be false, and the QR code of the merchant receiving the payment is not generated through the official channel. A command that the QR code of the merchant receiving the payment is not generated through the official channel is fed back to the electronic device at the payment end, and the electronic device at the payment end does not perform QR code payment for the QR code of the merchant receiving the payment;

[0046] The malicious risk unit 2 includes a malicious identification module 21 and a scoring risk module 22;

[0047] The malicious identification module 21 is used to receive the command that the QR code of the payment merchant is generated through the official channel in the source analysis module 12. The malicious identification module 21 obtains the original data from the scanning calculation module 11, obtains the merchant ID, the maximum transaction amount, and the generated timestamp from the original data, generates the basic URL according to the merchant ID, the maximum transaction amount, and the generated timestamp, and then performs URL feature analysis on the basic URL, and extracts the URL length (the number of characters in the URL) and the number of special characters in the URL from the analyzed URL features, and uses the extracted URL length and the set URL length range value to identify malicious QR codes, and identify whether the QR code of the payment merchant is a malicious QR code. By identifying the URL in the QR code, suspicious QR codes can be quickly excluded, and false positives caused by other identification methods (such as deep analysis) can be reduced, thereby improving the accuracy of QR code recognition;

[0048] When the length of the extracted URL exceeds the set URL length range value, the length of the extracted URL is too long, and it is determined that there is malicious code in the URL of the payment merchant's QR code, then the payment merchant's QR code is identified as a malicious QR code, and a command that there is malicious code in the URL of the payment merchant's QR code is fed back to the electronic device at the payment end, and then the electronic device at the payment end does not perform QR code payment for the payment merchant's QR code;

[0049] When the length of the extracted URL is within the set URL length range, it is determined that there is no malicious code in the URL of the payment merchant's QR code, and the payment merchant's QR code is identified as not a malicious QR code;

[0050] The scoring risk module 22 is used to receive the command that the payment merchant QR code identified by the malicious identification module 21 is not a malicious QR code. The scoring risk module 22 obtains the base URL from the malicious identification module 21, analyzes the subdomain structure of the base URL, and records the number of subdomains. , subdomain character length , subdomain character composition , Subdomain Mode , according to the set subdomain quantity range value, the number of subdomains is scored for quantity anomalies, and the number of scored anomalies is obtained Then, the subdomain character length is scored according to the set subdomain character length range value, and the length abnormality data of the score is obtained. , use the subdomain character composition and the specified character rules to score character anomalies and obtain the scored character anomaly data , and then use the regular expression rules to score the subdomain pattern for pattern anomalies, and obtain the character anomaly data of the score , the data of abnormal number of ratings, abnormal length of ratings, abnormal characters of ratings and abnormal patterns of ratings are input into the logistic regression model, and the logistic regression model learns according to the input data and outputs the corresponding weight coefficients , , and , using the comprehensive anomaly scoring algorithm based on the number of rating anomalies, rating length anomalies, rating character anomalies, rating pattern anomaly data and weight coefficients , , and Conduct an evaluation of the comprehensive anomaly score. By evaluating the comprehensive anomaly score, high-risk subdomain structures can be quickly identified, helping users avoid scanning phishing QR codes, reducing economic losses caused by fraudulent behavior, and reducing the risk of user QR code payment. The evaluated comprehensive anomaly score data and the set comprehensive anomaly score are then used to determine whether there is a phishing website in the subdomain structure. When the evaluated comprehensive anomaly score data is greater than the set comprehensive anomaly score, it is determined that there is a phishing website in the subdomain structure, and a command that the subdomain structure in the QR code of the payment merchant contains a phishing website is fed back to the electronic device at the payment end, and the electronic device at the payment end does not perform QR code payment for the QR code of the payment merchant. When the evaluated comprehensive anomaly score data is less than the set comprehensive anomaly score, it is determined that there is no phishing website in the subdomain structure.

[0051] The algorithm formula for scoring abnormal number of subdomains:

[0052] ;

[0053] Among them, 0, 3, 6, and 10 refer to the corresponding anomaly scores;

[0054] The algorithm formula for scoring subdomains with abnormal character length is:

[0055] ;

[0056] Among them, 0, 2, 4, and 6 refer to the corresponding anomaly scores;

[0057] in, Refers to the character length of all subdomains , Refers to the existence of a subdomain character length ;

[0058] The algorithm formula for scoring subdomains with abnormal character composition is as follows:

[0059] ;

[0060] Among them, 0 and 5 refer to the corresponding anomaly scores;

[0061] in, Refers to the character length of all subdomains , Refers to the existence of a subdomain character length ;

[0062] The algorithm formula for scoring abnormal subdomain patterns:

[0063] ;

[0064] Among them, 0 and 5 refer to the corresponding anomaly scores;

[0065] The implementation principle of calculating the comprehensive anomaly score using the comprehensive anomaly score algorithm:

[0066] Collect data on the number of rating anomalies, rating length anomalies, rating character anomalies, rating pattern anomalies, and weight coefficients , , and Calculate the comprehensive anomaly score to obtain the comprehensive anomaly score of the assessment , the specific algorithm formula is:

[0067] ;

[0068] Among them, the abnormality score range of the subdomain structure is (0,100). This formula is used to calculate the comprehensive abnormality score. Combining multiple abnormal indicators can more comprehensively evaluate the risk of the subdomain structure, reduce the misjudgment that may be caused by a single indicator, and improve the reliability of the evaluation.

[0069] The anomaly detection unit 3 is used to receive the command from the scoring risk module 22 that there is no phishing website in the subdomain structure. The anomaly detection unit 3 obtains the original data from the scanning calculation module 11, and then parses and extracts the transaction amount data based on the original data, and records the number of transactions between the payment terminal and the merchant. , based on the extracted transaction amount data The number of transactions between the payment terminal and the merchant Calculate the average transaction amount ,in, Refers to the extracted Transaction amount data, and then based on the extracted transaction amount data , the number of transactions between the payment terminal and the merchant and average transaction amount Calculate the standard deviation of transaction amounts , using the average transaction amount and the standard deviation of transaction amount Calculate the maximum and minimum transaction amount thresholds, and then use the extracted transaction amount data Detect abnormal behavior with the maximum and minimum transaction amount thresholds to detect whether there are abnormal transaction amounts in the merchant's QR code. By detecting abnormal amount behavior, you can quickly find transaction amounts that are significantly higher or lower than the normal range, involving fraud or misconduct. At the same time, early detection of abnormal transactions helps to take timely measures to prevent further economic losses. Specific detection situations include:

[0070] Case 1: When extracting transaction amount data Transaction amount data that is less than the minimum transaction amount threshold or extracted When the transaction amount is greater than the maximum transaction amount threshold, an abnormal transaction amount is detected in the merchant's QR code, and a command indicating the abnormal transaction amount in the QR code of the receiving merchant is fed back to the electronic device at the payment end, and the electronic device at the payment end does not perform QR code payment for the QR code of the receiving merchant;

[0071] Case ②: When extracting transaction amount data Greater than or equal to the minimum transaction amount threshold, and the extracted transaction amount data When the transaction amount is less than or equal to the maximum transaction amount threshold, it is detected that there is no abnormal transaction amount in the merchant's QR code;

[0072] The implementation principle of calculating the maximum and minimum transaction amount thresholds:

[0073] Collect average transaction amount and the standard deviation of transaction amount Calculate the minimum transaction amount threshold and maximum transaction amount threshold , algorithm formula:

[0074] ;

[0075] ;

[0076] in, Refers to a set constant, usually between 2-3, indicating that an amount exceeding 2-3 standard deviations from the mean is considered abnormal. This formula is used to calculate the minimum and maximum transaction amount thresholds. By calculating the minimum and maximum transaction amount thresholds, abnormal transactions can be identified more accurately, avoiding unnecessary interception or restriction of normal transactions, thereby improving user experience;

[0077] The scoring risk module 22 receives the command of the abnormal transaction amount in the abnormal detection unit 3, and the scoring risk module 22 obtains the analyzed payment merchant QR code source data from the source analysis module 12. , the malicious identification module 21 obtains the identified malicious QR code data , abnormal behavior data detected in abnormal detection unit 3 , analyze the QR code source data of the payment merchant , Identified malicious QR code data , Comprehensive anomaly score data for evaluation and abnormal behavior data detected Input the logistic regression model, the logistic regression model learns and outputs the corresponding weight coefficient based on the input analysis of the merchant QR code source, the identified malicious QR code, the evaluated comprehensive anomaly score and the detected abnormal behavior data , , and , and uses a comprehensive factor algorithm based on the analyzed merchant QR code source, identified malicious QR code, evaluated comprehensive anomaly score, detected abnormal behavior data and weight coefficient , , and By analyzing the comprehensive QR code risk value, by combining different data, the legitimacy of the QR code can be verified from multiple angles, avoiding the limitations of a single data source. At the same time, through comprehensive analysis, malicious QR codes can be identified and prevented from spreading in the electronic devices at the payment end earlier, and the probability of potential QR code risks and phishing website events can be accurately discovered, thereby enhancing the security of QR code payment. The final payment review is then conducted based on the analyzed comprehensive QR code risk value and the set comprehensive QR code risk value to review whether the merchant's QR code has a QR code risk. When the analyzed comprehensive QR code risk value is greater than the set comprehensive QR code risk value, it is reviewed that the merchant's QR code has a QR code risk, and a command that the merchant's QR code has a QR code risk is fed back to the electronic device at the payment end. Then, the electronic device at the payment end does not perform QR code payment for the QR code of the payment recipient. When the analyzed comprehensive QR code risk value is less than the set comprehensive QR code risk value, it is reviewed that the merchant's QR code does not have a QR code risk, and the payer approves the electronic device to perform QR code payment for the payment recipient's QR code.

[0078] The implementation principle of using the comprehensive factor algorithm to analyze the comprehensive QR code risk value in the scoring risk module 22 is:

[0079] The source of QR codes of payment merchants collected and analyzed , Identified malicious QR codes , the comprehensive abnormality score of the evaluation , abnormal behavior data detected and weight coefficient , , and Conduct comprehensive QR code risk value analysis to obtain the analyzed comprehensive QR code risk value , the specific algorithm formula is:

[0080] ;

[0081] Among them, this formula is used to analyze the comprehensive QR code risk value. By combining data from different dimensions such as QR code source, malicious QR code identification, abnormal behavior detection, etc., it can verify the legitimacy and security of the QR code from multiple angles and avoid the limitations of a single data source.

[0082] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A QR code payment system for analyzing QR code risks, characterized by: It includes a scanning and analysis unit (1), a malicious risk unit (2) and an anomaly detection unit (3); The scanning and analysis unit (1) scans the QR code data of the payment merchant through the electronic device of the payment end, calculates the hash value of the payment end for the QR code data, and analyzes whether the QR code of the payment merchant is generated from an official channel; The malicious risk unit (2) is used to receive a command from the scanning and analysis unit (1) that the QR code of the payment merchant is generated through an official channel. The malicious risk unit (2) obtains the QR code data from the scanning and analysis unit (1) and generates a basic URL, identifies the malicious QR code according to the basic URL, and when the identified payment merchant QR code is not a malicious QR code, performs a comprehensive anomaly score evaluation according to the basic URL, and then uses the evaluated comprehensive anomaly score data to determine whether there is a phishing website in the subdomain structure; The malicious risk unit (2) comprises a malicious identification module (21) and a risk scoring module (22); The malicious identification module (21) is used to receive a command from the source analysis module (12) indicating that the QR code of the payment merchant is generated through an official channel. The malicious identification module (21) obtains raw data from the scanning calculation module (11) to generate a basic URL, and then performs a URL feature analysis on the basic URL, and extracts the URL length and the number of special characters in the URL from the analyzed URL features, and uses the extracted URL length to identify malicious QR codes, and identify whether the QR code of the payment merchant is a malicious QR code; When the length of the extracted URL exceeds the set URL length range value, the length of the extracted URL is too long, and it is determined that there is malicious code in the URL of the payment merchant's QR code, then the payment merchant's QR code is identified as a malicious QR code, and a command that there is malicious code in the URL of the payment merchant's QR code is fed back to the electronic device at the payment end, and then the electronic device at the payment end does not perform QR code payment for the payment merchant's QR code; When the length of the extracted URL is within the set URL length range, it is determined that there is no malicious code in the URL of the payment merchant's QR code, and the payment merchant's QR code is identified as not a malicious QR code; The scoring risk module (22) is used to receive a command that the payment merchant QR code identified in the malicious identification module (21) is not a malicious QR code. The scoring risk module (22) obtains the basic URL from the malicious identification module (21) and analyzes the subdomain structure, records the number of subdomains, the length of subdomain characters, the character composition of subdomains, and the subdomain pattern, and scores the number of subdomains for number anomalies according to a set subdomain number range value, and then scores the length anomalies of the subdomain characters according to a set subdomain character length range value, scores the character anomalies according to the subdomain character composition and the prescribed character rules, and then scores the pattern anomalies of the subdomain pattern using the regular expression rule, and uses the comprehensive anomaly scoring algorithm to evaluate the comprehensive anomaly score based on the number anomalies of the scores, the length anomalies of the scores, the character anomalies of the scores, and the pattern anomalies of the scores, and uses the evaluated comprehensive anomaly scoring data to determine whether the subdomain structure contains a phishing website; When the evaluated comprehensive anomaly score data is greater than the set comprehensive anomaly score, it is determined that there is a phishing website in the subdomain structure, and a command that the subdomain structure in the QR code of the payment merchant exists a phishing website is fed back to the electronic device at the payment end, and the electronic device at the payment end does not perform QR code payment for the QR code of the payment merchant; When the evaluated comprehensive anomaly score data is less than the set comprehensive anomaly score, it is determined that there is no phishing website in the subdomain structure; The anomaly detection unit (3) is used to receive a command from the malicious risk unit (2) that there is no phishing website in the subdomain name structure. The anomaly detection unit (3) obtains the QR code data from the scanning analysis unit (1) to calculate the average transaction amount, calculates the standard deviation of the transaction amount based on the average transaction amount, and then calculates the maximum and minimum transaction amount thresholds. The maximum and minimum transaction amount thresholds are used to detect abnormal behavior and detect whether there is an abnormal transaction amount in the merchant's QR code; The malicious risk unit (2) receives a command from the abnormality detection unit (3) that there is no abnormal transaction amount in the merchant's QR code. The malicious risk unit (2) obtains the source of the QR code of the payment collection merchant analyzed in the scanning analysis unit (1) and the abnormal behavior data detected in the abnormality detection unit (3) and performs a comprehensive QR code risk value analysis, and then performs a final payment review to review whether the merchant's QR code has a QR code risk. When the reviewed merchant's QR code does not have a QR code risk, the payer approves the electronic device to perform QR code payment on the payment collection merchant's QR code; The scoring risk module (22) receives a command from the anomaly detection unit (3) indicating that there is no abnormal transaction amount. The scoring risk module (22) obtains the analyzed QR code source data of the payment merchant from the source analysis module (12), the identified malicious QR code data from the malicious identification module (21), and the detected abnormal behavior data from the anomaly detection unit (3). The comprehensive factor algorithm is used to analyze the comprehensive QR code risk value based on the analyzed QR code source of the payment merchant, the identified malicious QR code, the evaluated comprehensive anomaly score, and the detected abnormal behavior data. The final payment review is performed based on the analyzed comprehensive QR code risk value to review whether the merchant QR code has a QR code risk. When the analyzed comprehensive QR code risk value is greater than the set comprehensive QR code risk value, the reviewed merchant QR code has a QR code risk, and a command that the merchant QR code has a QR code risk is fed back to the electronic device at the payment end, and the electronic device at the payment end does not perform QR code payment for the merchant QR code for payment; When the analyzed comprehensive QR code risk value is less than the set comprehensive QR code risk value, it is verified that the merchant's QR code does not have QR code risk, and the payee approves the electronic device to perform QR code payment on the merchant's QR code.

2. A two-dimensional code payment system for analyzing two-dimensional code risks according to claim 1, characterized in that: The scanning analysis unit (1) comprises a scanning calculation module (11) and a source analysis module (12); The scanning and calculating module (11) scans the QR code data of the payment merchant through the electronic device of the payment end, parses and extracts the original data, the merchant digital signature, the merchant public key and the official certificate code according to the QR code data, calculates the hash value of the payment end based on the extracted original data using the SHA-256 hash algorithm, calculates the merchant hash value based on the merchant public key and the merchant digital signature, and then calculates the official hash value based on the official certificate code; The source analysis module (12) is used to receive the hash value, the merchant hash value and the official hash value in the scanning calculation module (11) and analyze the source of the payment merchant's QR code to analyze whether the payment merchant's QR code is generated through an official channel; When the hash value is consistent with the merchant's hash value, and the merchant's hash value is consistent with the official hash value, the official certificate is determined to be true, and the merchant's QR code is generated through official channels; When the hash value is inconsistent with the merchant hash value or the merchant hash value is inconsistent with the official hash value, the official certificate is judged to be false, and the merchant QR code of the payment is not generated through official channels. The command that the merchant QR code of the payment is not generated through official channels is fed back to the electronic device on the payment end, and the electronic device on the payment end does not perform QR code payment for the merchant QR code of the payment.

3. A two-dimensional code payment system for analyzing two-dimensional code risks according to claim 1, characterized in that: The anomaly detection unit (3) is used to receive a command from the scoring risk module (22) that a phishing website does not exist in the subdomain name structure. The anomaly detection unit (3) obtains raw data from the scanning calculation module (11), parses the raw data and extracts transaction amount data, calculates an average transaction amount based on the extracted transaction amount data, calculates a standard deviation of the transaction amount based on the extracted transaction amount data and the average transaction amount, calculates maximum and minimum transaction amount thresholds using the average transaction amount and the standard deviation of the transaction amount, and detects abnormal behavior using the extracted transaction amount data and the maximum and minimum transaction amount thresholds to detect whether there is an abnormal transaction amount in the merchant's QR code.

4. A two-dimensional code payment system for analyzing two-dimensional code risks according to claim 1, characterized in that: The implementation principle of using a comprehensive factor algorithm to analyze the comprehensive QR code risk value in the scoring risk module (22) is: The source of QR codes of payment merchants collected and analyzed , Identified malicious QR codes , the comprehensive abnormality score of the evaluation , abnormal behavior data detected and weight coefficient , , and Conduct comprehensive QR code risk value analysis to obtain the analyzed comprehensive QR code risk value , the specific algorithm formula is: 。

Images