Early warning method and device for illegal mobile banking invasion behavior

Abstract

The invention provides an illegal mobile banking behavior early warning method and device which can be used in the technical field of information security and financial science and technology, and the method comprises the steps: collecting historical operation behavior data of a user on a screen of a mobile banking client; performing clustering calculation on the historical operation behavior data, and determining an operation behavior data range conforming to the user characteristics and historical operation behavior data not conforming to the user characteristics; according to the historical operation behavior data which do not conform to the user features, determining operation behavior feature vectors which do not conform to the user features; acquiring operation behavior data on a screen of the mobile banking client, and determining abnormal operation behavior feature vectors which do not fall into an operation behavior data range conforming to user features; and determining the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector which does not conform to the user feature, and if the cosine similarity is greater than or equal to a preset threshold, determining that the abnormal operation behavior is an illegal mobile phone bank intrusion behavior, and sending an early warning message to the user himself / herself.

Description

Technical Field

[0001] The present invention relates to the field of information security and financial technology, and in particular to a method and device for early warning of illegal intrusion into mobile banking. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] With the rapid development of digital technology, illegal activities have frequently occurred. In mobile banking clients, illegal activities refer to illegal intrusions into mobile banking by criminals using developer tools, remote control tools, etc., illegally obtaining and misappropriating user information, and stealing user property. Therefore, the security challenges faced by banking financial services are becoming increasingly severe. Due to the lack of professional supervision during the transaction process, users are prone to illegal intrusions into mobile banking during the transaction process, resulting in reduced transaction security and easy loss of user property. Summary of the invention

[0004] The embodiment of the present invention proposes a warning method for illegal intrusion into mobile banking, which is used to warn of illegal intrusion into mobile banking, improve the security of user transactions, and protect the property safety of users, including:

[0005] Collect historical operation behavior data of users on the mobile banking client screen;

[0006] Perform cluster calculation on historical operation behavior data to determine the range of operation behavior data that meets user characteristics and historical operation behavior data that does not meet user characteristics;

[0007] Determine an operation behavior feature vector that does not conform to the user characteristics based on historical operation behavior data that does not conform to the user characteristics;

[0008] When a user operation behavior occurs on the mobile banking client screen, the operation behavior data on the mobile banking client screen is obtained, and the operation behavior data on the mobile banking client screen is compared with the operation behavior data range that meets the user characteristics, and abnormal operation behavior data that does not fall within the operation behavior data range that meets the user characteristics is determined;

[0009] Determine the abnormal operation behavior feature vector according to the abnormal operation behavior data;

[0010] Determine the cosine similarity between the feature vector of the abnormal operation behavior and the feature vector of the operation behavior that does not conform to the user characteristics. If the cosine similarity is greater than or equal to a preset threshold, determine that the abnormal operation behavior is an illegal intrusion into the mobile banking behavior, and send an illegal intrusion into the mobile banking warning message to the user.

[0011] The embodiment of the present invention proposes an illegal intrusion mobile banking behavior warning device, which is used to warn of illegal intrusion mobile banking behavior, improve the security of user transactions, and protect the property safety of users, including:

[0012] The data collection module is used to collect the historical operation behavior data of users on the mobile banking client screen;

[0013] A clustering calculation module is used to perform clustering calculation on the historical operation behavior data to determine the range of operation behavior data that meets the user characteristics and the historical operation behavior data that does not meet the user characteristics;

[0014] A first conversion module is used to determine an operation behavior feature vector that does not meet the user characteristics based on the historical operation behavior data that does not meet the user characteristics;

[0015] The abnormality determination module is used to obtain the operation behavior data on the mobile banking client screen when the user operation behavior appears on the mobile banking client screen, compare the operation behavior data on the mobile banking client screen with the operation behavior data range that meets the user characteristics, and determine the abnormal operation behavior data that does not fall into the operation behavior data range that meets the user characteristics;

[0016] A second conversion module is used to determine an abnormal operation behavior feature vector according to the abnormal operation behavior data;

[0017] The intrusion warning module is used to determine the cosine similarity between the feature vector of abnormal operation behavior and the feature vector of operation behavior that does not conform to the user characteristics. If the cosine similarity is greater than or equal to the preset threshold, the abnormal operation behavior is determined to be an illegal intrusion into the mobile banking behavior, and an illegal intrusion warning message of the mobile banking is sent to the user.

[0018] In an embodiment of the present invention, a computer device is proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a method for early warning of illegal intrusion into mobile banking behavior is implemented.

[0019] In an embodiment of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, a method for early warning of illegal intrusion into mobile banking is implemented.

[0020] The illegal intrusion mobile banking behavior warning method and device proposed in the embodiment of the present invention can solve the problem that the transaction process is easily attacked by illegal intrusion mobile banking in the prior art, resulting in reduced transaction security and easy loss of user property. The embodiment of the present invention collects the historical operation behavior data of the user on the mobile banking client screen; clusters the historical operation behavior data to determine the operation behavior data range that meets the user characteristics and the historical operation behavior data that does not meet the user characteristics; determines the operation behavior feature vector that does not meet the user characteristics based on the historical operation behavior data that does not meet the user characteristics; when the user operation behavior appears on the mobile banking client screen, obtains the operation behavior data on the mobile banking client screen, compares the operation behavior data on the mobile banking client screen with the operation behavior data range that meets the user characteristics, and determines the abnormal operation behavior data that does not fall into the operation behavior data range that meets the user characteristics; determines the abnormal operation behavior feature vector based on the abnormal operation behavior data; determines the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that does not meet the user characteristics, and if the cosine similarity is greater than or equal to a preset threshold, determines that the abnormal operation behavior is an illegal intrusion mobile banking behavior, and sends an illegal intrusion mobile banking warning message to the user. The embodiment of the present invention can determine whether the abnormal operation behavior is an illegal intrusion into mobile banking, issue an early warning for the illegal intrusion into mobile banking, improve the security of user transactions, and protect the property safety of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 It is a flow chart of the method for early warning of illegal intrusion into mobile banking in an embodiment of the present invention;

[0023] Figure 2 This is a specific example diagram of the method for early warning of illegal intrusion into mobile banking in an embodiment of the present invention;

[0024] Figure 3 This is a specific example diagram of the method for early warning of illegal intrusion into mobile banking in an embodiment of the present invention;

[0025] Figure 4 Schematic diagram of an illegal intrusion behavior warning device for mobile banking according to an embodiment of the present invention;

[0026] Figure 5 Schematic diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0028] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0029] In the description of this specification, the terms "include", "including", "have", "contain", etc. are all open terms, which mean including but not limited to. The descriptions with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", etc. mean that the specific features, structures or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. The order of steps involved in each embodiment is used to schematically illustrate the implementation of the present application, and the order of steps is not limited and can be appropriately adjusted as needed.

[0030] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0031] Figure 1 FIG. 1 is a flow chart of an illegal intrusion behavior warning method for mobile banking according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0032] Step 101, collecting historical operation behavior data of the user on the mobile banking client screen;

[0033] Step 102, performing cluster calculation on the historical operation behavior data to determine the range of operation behavior data that meets the user characteristics and the historical operation behavior data that does not meet the user characteristics;

[0034] Step 103, determining an operation behavior feature vector that does not conform to the user characteristics based on the historical operation behavior data that does not conform to the user characteristics;

[0035] Step 104, when a user operation behavior appears on the mobile banking client screen, the operation behavior data on the mobile banking client screen is obtained, and the operation behavior data on the mobile banking client screen is compared with the operation behavior data range that meets the user characteristics, and abnormal operation behavior data that does not fall into the operation behavior data range that meets the user characteristics is determined;

[0036] Step 105, determining an abnormal operation behavior feature vector according to the abnormal operation behavior data;

[0037] Step 106, determining the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that does not conform to the user characteristics. If the cosine similarity is greater than or equal to a preset threshold, determining that the abnormal operation behavior is an illegal intrusion into mobile banking behavior, and sending an illegal intrusion into mobile banking warning message to the user.

[0038] Depend on Figure 1 It can be known from the process shown that the embodiment of the present invention collects the historical operation behavior data of the user on the mobile banking client screen; clusters the historical operation behavior data to determine the range of operation behavior data that meets the user characteristics and the historical operation behavior data that does not meet the user characteristics; determines the operation behavior feature vector that does not meet the user characteristics based on the historical operation behavior data that does not meet the user characteristics; when the user operation behavior appears on the mobile banking client screen, obtains the operation behavior data on the mobile banking client screen, compares the operation behavior data on the mobile banking client screen with the range of operation behavior data that meets the user characteristics, and determines the abnormal operation behavior data that does not fall into the range of operation behavior data that meets the user characteristics; determines the abnormal operation behavior feature vector based on the abnormal operation behavior data; determines the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that does not meet the user characteristics, and if the cosine similarity is greater than or equal to the preset threshold, determines that the abnormal operation behavior is an illegal intrusion into the mobile banking behavior, and sends an illegal intrusion warning message to the user himself. The embodiment of the present invention can determine whether the abnormal operation behavior is an illegal intrusion into the mobile banking behavior, warn of the illegal intrusion into the mobile banking behavior, improve the security of user transactions, and protect the property safety of users.

[0039] In order to explain the above illegal intrusion mobile banking behavior warning method more clearly, each step is explained in detail below.

[0040] In one embodiment of the present invention, the operation behavior data includes one or more of the following: the sliding distance of the user on the screen, the time interval between clicking the screen, the pressure of clicking the screen, and the finger temperature.

[0041] In one embodiment of the present invention, user operation behavior data is collected from mobile banking apps, bank self-service financial equipment, bank counter operations and other devices with screen interactive operations, the user's sliding distance on the screen, the time interval between screen clicks, the pressure of screen clicks, and the finger temperature are obtained, and a data set is formed for each operation behavior data.

[0042] In the specific implementation, four data sets are initialized, including: the sliding distance data set swipeDistances, which is used to store the sliding distance data of the user on the screen; the screen click time interval data set clickIntervals, which is used to store the screen click time interval data; the screen click pressure data set touchPressures, which is used to store the user's touch pressure data; the finger temperature data set fingerTemperatures, which is used to store the user's finger temperature data; when the user's sliding screen gesture is received, the user's sliding distance on the screen distance is obtained, and the sliding distance distance is added to the sliding distance data set swipeDistances; when the user's click action on the screen is received, the user's click screen time interval interval is obtained, and the user's click screen time interval interval data is added to the click screen time interval data set clickI ntervals; when receiving the user's click action on the screen, obtain the pressure of the user's click on the screen, and add the pressure of the user's click on the screen to the touchPressures data set; when the built-in sensor of the mobile phone receives the temperature of the user's finger, obtain the user's finger temperature temperature, record the finger temperature, and add the user's finger temperature temperature to the finger temperature data set fingerTemperatures; perform clustering calculation based on the obtained sliding distance data set swipeDistances, screen click time interval data set clickIntervals, screen click pressure data set touchPressures, and finger temperature data set fingerTemperatures to determine the range of operation behavior data that meets the user characteristics and the historical operation behavior data that does not meet the user characteristics.

[0043] In one embodiment of the present invention, with respect to step 102, clustering calculation is performed on the historical operation behavior data, including: clustering calculation is performed on the historical operation behavior data using a DBSCAN algorithm according to a preset neighborhood radius and a preset minimum number of samples.

[0044] In the specific implementation, four types of historical operation behavior data are collected, including: the user's sliding distance on the screen, the time interval between screen clicks, the pressure of screen clicks, and the finger temperature; in order to cluster different historical operation behavior data at the same time and to be able to separate the abnormal operation behavior data outside the clustering results, the DBSCAN algorithm is used for clustering calculation. First, the algorithm can automatically identify noise points in historical operation behavior data without marking or setting thresholds; second, the DBSCAN algorithm can identify and adapt to clusters of different shapes and densities, and is suitable for the characteristics of orderly and easy-to-change operation behaviors; third, the parameters of the DBSCAN algorithm can be flexibly adjusted according to the actual clustering situation to maintain the flexible adaptability of the algorithm model. The DBSCAN algorithm is adjusted by preset neighborhood radius (eps) and preset minimum number of samples (min_samples) parameters. The preset neighborhood radius is determined by observing the distribution of data points and the neighborhood conditions in the scatter plot formed by the data, and is gradually fine-tuned. Considering that the amount of data in the initial stage of the present invention is small, the initial minimum number of samples is selected to be 2 or 3 to ensure that at least 2 or 3 data samples constitute a cluster. The clustering results of the user's sliding distance on the screen, the time interval between clicking the screen, the pressure of clicking the screen, and the finger temperature are obtained through clustering calculation. The clustering results are highly clustered by the DBSCAN algorithm and can be defined as the range of operation behavior data that meets the user's characteristics. At the same time, the noise points of the user's sliding distance on the screen, the time interval between clicking the screen, the pressure of clicking the screen, and the finger temperature data are obtained through clustering, that is, the historical operation behavior data that does not meet the user's characteristics are defined as non-personal operation actions.

[0045] Figure 2 It is a specific example diagram of the illegal intrusion mobile banking behavior warning method according to an embodiment of the present invention.

[0046] In one embodiment of the present invention, for step 103, refer to Figure 2 , according to the historical operation behavior data that does not conform to the user characteristics, the operation behavior feature vector that does not conform to the user characteristics is determined. The detailed process is:

[0047] Step 201, concatenate historical operation behavior data that do not conform to user characteristics to obtain an operation behavior character string that does not conform to user characteristics;

[0048] Step 202: Convert the operation behavior character string that does not conform to the user characteristics into an operation behavior feature vector that does not conform to the user characteristics.

[0049] Specifically, historical operation behavior data that does not conform to user characteristics, namely the user's sliding distance on the screen, the time interval between screen clicks, the pressure of screen clicks, and the noise of finger temperature data, are combined into a behavior pattern group behaviorPatterns, and the behavior pattern group is defined as a virtual user behavior feature of illegal intrusion, which is used to simulate the illegal intrusion of mobile banking by real users. The virtual user behavior feature of illegal intrusion of mobile banking is defined according to the following process:

[0050] (1) Import the hashlib module;

[0051] (2) Define virtual user behavior information, named "virtualUser", and create a behaviorPatterns list, which contains the behavior pattern group of the virtual user (i.e., historical operation behavior data that does not conform to the user characteristics);

[0052] (3) Combine the name of the virtual user and the historical operation behavior data that does not conform to the user characteristics to generate a string: combinedData = virtualUser + ":" + ":".join(behaviorPatterns);

[0053] (4) Use the SHA-256 hash algorithm to encrypt the combined string: first convert the combined string into a byte type, and then use the hashlib.sha256() function to convert it into a hash value;

[0054] (5) The encrypted hash value is converted into a hexadecimal string so that it can be stored in the database, thereby protecting the confidentiality of historical operation behavior data that does not conform to user characteristics.

[0055] In one embodiment of the present invention, after historical operation behavior data that does not conform to user characteristics are spliced ​​to obtain an operation behavior string that does not conform to user characteristics, the operation behavior string that does not conform to user characteristics is hashed and stored in a database.

[0056] In one embodiment of the present invention, an operation behavior string that does not conform to user characteristics is converted into an operation behavior feature vector that does not conform to user characteristics. Specifically, a hash vectorizer is used to convert the operation behavior string that does not conform to user characteristics into an operation behavior feature vector that does not conform to user characteristics.

[0057] In one embodiment of the present invention, before determining the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that does not conform to the user characteristics, the abnormal operation behavior feature vector and the operation behavior feature vector that does not conform to the user characteristics are mapped to the same preset feature dimension, for example: the preset feature dimension is set to 100.

[0058] In specific implementation, based on historical operation behavior data that do not conform to user characteristics, an operation behavior feature vector that does not conform to user characteristics is determined; historical operation behavior data that do not conform to user characteristics are spliced ​​to obtain an operation behavior string that does not conform to user characteristics, and a hash vectorizer is used to convert the operation behavior string that does not conform to user characteristics into an operation behavior feature vector that does not conform to user characteristics, and the operation behavior data on the mobile banking client screen is obtained to determine the user's abnormal operation behavior data; based on the abnormal operation behavior data, an abnormal operation behavior feature vector is determined; the abnormal operation behavior feature vector and the operation behavior feature vector that do not conform to user characteristics are mapped to the same preset feature dimension, and the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that do not conform to user characteristics is determined. If the cosine similarity is greater than or equal to a preset threshold, it is determined that the abnormal operation behavior is an illegal intrusion into mobile banking behavior, and an illegal intrusion into mobile banking warning message is sent to the user himself. The specific process is as follows:

[0059] (1) Import the required modules: Import the HashingVectorizer module to transform feature vectors, and import the cosine_similarity module to calculate cosine similarity;

[0060] (2) defining a virtual user behavior group list virtualPersonBehaviors, which includes virtual users and their corresponding virtual user behavior groups (i.e., operation behavior data that does not conform to user characteristics);

[0061] (3) Create a HashingVectorizer object vectorizer and specify the preset feature dimension as 100;

[0062] (4) Convert the virtual user behavior group (i.e., the operation behavior data that does not conform to the user characteristics) into a string form, and use the vectorizer.transform() function to convert it into an operation behavior feature vector that does not conform to the user characteristics. The obtained operation behavior feature vector that does not conform to the user characteristics is stored in hashedFeatures. Use the same method to convert the abnormal operation behavior data into an abnormal operation behavior feature vector.

[0063] (5) Use the cosine_similarity function to calculate the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that does not conform to the user characteristics;

[0064] (6) A similarity threshold similarityThreshold is defined. If the cosine similarity is greater than or equal to the similarity threshold similarityThreshold, the abnormal operation behavior is determined to be an illegal intrusion into the mobile banking, and an illegal intrusion into the mobile banking warning message is sent to the user.

[0065] The embodiment of the present invention converts historical operation behavior data that does not conform to user characteristics and abnormal operation behavior data into feature vectors through a hash vectorizer, and uses a cosine similarity function (cosine_similarity) to calculate the cosine similarity of the abnormal operation behavior feature vector and the operation behavior feature vector that does not conform to user characteristics. Then, according to a preset similarity threshold, it is determined whether the abnormal operation behavior is an illegal intrusion into mobile banking behavior, and an early warning message of illegal intrusion into mobile banking is sent to the user himself, and the illegal intrusion into mobile banking behavior is added to the black industry prevention and control blacklist. The time series analysis method is used to analyze the change trend of the list over time, and the seasonality, trend, residual items and the comparative changes of the original data are obtained through graphical display, and the change trend is used to study the development trend of the black industry. When the change trend shows a high-frequency and highly similar change trend, it is used to mark the new trend of the development of the black industry to resist the influence of black industry behavior.

[0066] In one embodiment of the present invention, the cosine similarity of the abnormal operation behavior feature vector and the operation behavior feature vector that does not meet the user's characteristics is calculated. If the cosine similarity is greater than or equal to the preset threshold, the abnormal operation behavior is determined to be an illegal intrusion into mobile banking, and an early warning message of illegal intrusion into mobile banking is sent to the user himself; if the cosine similarity is less than the preset threshold, the abnormal operation behavior is determined to be a misoperation of the user himself. The present invention does not need to calculate the cosine similarity of the feature vector of each type of abnormal operation behavior data (the user's sliding distance on the screen, the time interval of clicking the screen, the pressure of clicking the screen, and the finger temperature data) with each type of operation behavior feature vector that does not meet the user's characteristics, but instead concatenates the abnormal operation behavior data into a character string and converts it into a feature vector, and uses the cosine similarity function (cosine_similarity) to calculate the abnormal operation behavior feature vector as a whole and the operation behavior feature vector that does not meet the user's characteristics, which can simplify the calculation process and improve the efficiency of judging illegal intrusion into mobile banking.

[0067] Figure 3 It is a specific example diagram of the illegal intrusion mobile banking behavior warning method according to an embodiment of the present invention.

[0068] In one embodiment of the present invention, reference Figure 3, obtain the user's operation behavior data on the mobile banking client screen; the operation behavior data includes: the user's sliding distance on the screen, the time interval between clicking the screen, the pressure of clicking the screen, and the finger temperature data; compare the operation behavior data on the mobile banking client screen with the operation behavior data range that meets the user characteristics, and determine the abnormal operation behavior data that does not fall into the operation behavior data range that meets the user characteristics; characterize the historical operation behavior data that does not meet the user characteristics as the operation behavior characteristics of the virtual user, and determine the operation behavior feature vector of the virtual user; determine the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector of the virtual user, and determine whether the abnormal operation behavior is an illegal intrusion into the mobile banking behavior based on the cosine similarity and the preset threshold, and define the illegal intrusion into the mobile banking behavior as a black industry behavior, and send an illegal intrusion into the mobile banking warning message to the user himself.

[0069] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0070] The implementation of the illegal intrusion mobile banking behavior warning device can refer to the implementation of the above method, and the repeated parts will not be repeated. The terms "module" or "unit" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0071] Based on the same inventive concept, the present invention also proposes an illegal intrusion mobile banking behavior warning device, such as Figure 4 As shown, the device comprises:

[0072] Data collection module 401, used to collect historical operation behavior data of users on the mobile banking client screen;

[0073] A clustering calculation module 402 is used to perform clustering calculation on the historical operation behavior data to determine the range of operation behavior data that meets the user characteristics and the historical operation behavior data that does not meet the user characteristics;

[0074] The first conversion module 403 is used to determine the operation behavior feature vector that does not meet the user characteristics based on the historical operation behavior data that does not meet the user characteristics;

[0075] The abnormality determination module 404 is used to obtain the operation behavior data on the mobile banking client screen when the user operation behavior appears on the mobile banking client screen, compare the operation behavior data on the mobile banking client screen with the operation behavior data range that meets the user characteristics, and determine the abnormal operation behavior data that does not fall into the operation behavior data range that meets the user characteristics;

[0076] The second conversion module 405 is used to determine the abnormal operation behavior feature vector according to the abnormal operation behavior data;

[0077] The intrusion warning module 406 is used to determine the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that does not meet the user characteristics. If the cosine similarity is greater than or equal to a preset threshold, the abnormal operation behavior is determined to be an illegal intrusion into the mobile banking behavior, and a warning message of illegal intrusion into the mobile banking is sent to the user.

[0078] In one embodiment of the present invention, the clustering calculation module 402 is specifically used for:

[0079] According to the preset neighborhood radius and the preset minimum number of samples, the DBSCAN algorithm is used to perform clustering calculations on the historical operation behavior data.

[0080] In one embodiment of the present invention, the first conversion module 403 is specifically used for:

[0081] splicing the historical operation behavior data that do not conform to the user characteristics to obtain an operation behavior string that does not conform to the user characteristics;

[0082] The operation behavior character string that does not conform to the user characteristics is converted into an operation behavior feature vector that does not conform to the user characteristics.

[0083] In one embodiment of the present invention, it further includes:

[0084] The encryption module is used to concatenate historical operation behavior data that does not conform to user characteristics to obtain an operation behavior string that does not conform to user characteristics, and then perform hash encryption on the operation behavior string that does not conform to user characteristics and store it in a database.

[0085] In one embodiment of the present invention, the first conversion module 403 is specifically used for:

[0086] A hash vectorizer is used to convert the operation behavior string that does not conform to the user characteristics into an operation behavior feature vector that does not conform to the user characteristics.

[0087] In one embodiment of the present invention, it further includes:

[0088] The dimension mapping module is used to map the abnormal operation behavior feature vector and the operation behavior feature vector that does not conform to the user characteristics to the same preset feature dimension before determining the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that does not conform to the user characteristics.

[0089] In one embodiment of the present invention, the operation behavior data includes one or more of the following: the sliding distance of the user on the screen, the time interval between clicking the screen, the pressure of clicking the screen, and the finger temperature.

[0090] It should be noted that although several modules of the illegal intrusion mobile banking behavior early warning device are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for concretization.

[0091] Based on the above invention concept, Figure 5 As shown, the present invention also proposes a computer device 500, including a memory 501, a processor 502, and a computer program 503 stored in the memory 501 and executable on the processor 502, wherein the processor 502 implements the aforementioned illegal intrusion mobile banking behavior warning method when executing the computer program 503.

[0092] Based on the aforementioned inventive concept, the present invention proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the aforementioned illegal intrusion mobile banking behavior warning method is implemented.

[0093] The illegal intrusion mobile banking behavior warning method and device proposed in the embodiment of the present invention can solve the problem that the transaction process is easily attacked by illegal intrusion mobile banking in the prior art, resulting in reduced transaction security and easy loss of user property. The embodiment of the present invention collects the historical operation behavior data of the user on the mobile banking client screen; clusters the historical operation behavior data to determine the operation behavior data range that meets the user characteristics and the historical operation behavior data that does not meet the user characteristics; determines the operation behavior feature vector that does not meet the user characteristics based on the historical operation behavior data that does not meet the user characteristics; when the user operation behavior appears on the mobile banking client screen, obtains the operation behavior data on the mobile banking client screen, compares the operation behavior data on the mobile banking client screen with the operation behavior data range that meets the user characteristics, and determines the abnormal operation behavior data that does not fall into the operation behavior data range that meets the user characteristics; determines the abnormal operation behavior feature vector based on the abnormal operation behavior data; determines the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that does not meet the user characteristics, and if the cosine similarity is greater than or equal to a preset threshold, determines that the abnormal operation behavior is an illegal intrusion mobile banking behavior, and sends an illegal intrusion mobile banking warning message to the user. The embodiments of the present invention can determine whether abnormal operation behavior is illegal intrusion into mobile banking, issue early warning for illegal intrusion into mobile banking, improve the security of user transactions, protect the property safety of users, and resist the influence of black market behavior.

[0094] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0095] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0098] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A warning method for illegal intrusion into mobile banking, characterized in that: include: Collect historical operation behavior data of users on the mobile banking client screen; Perform cluster calculation on historical operation behavior data to determine the range of operation behavior data that meets user characteristics and historical operation behavior data that does not meet user characteristics; Determine an operation behavior feature vector that does not conform to the user characteristics based on historical operation behavior data that does not conform to the user characteristics; When a user operation behavior occurs on the mobile banking client screen, the operation behavior data on the mobile banking client screen is obtained, and the operation behavior data on the mobile banking client screen is compared with the operation behavior data range that meets the user characteristics, and abnormal operation behavior data that does not fall within the operation behavior data range that meets the user characteristics is determined; Determine the abnormal operation behavior feature vector according to the abnormal operation behavior data; Determine the cosine similarity between the feature vector of the abnormal operation behavior and the feature vector of the operation behavior that does not conform to the user characteristics. If the cosine similarity is greater than or equal to a preset threshold, determine that the abnormal operation behavior is an illegal intrusion into the mobile banking behavior, and send an illegal intrusion into the mobile banking warning message to the user.

2. The method according to claim 1, characterized in that Perform clustering calculations on historical operation behavior data, including: According to the preset neighborhood radius and the preset minimum number of samples, the DBSCAN algorithm is used to perform clustering calculations on the historical operation behavior data.

3. The method according to claim 1, characterized in that Based on the historical operation behavior data that does not conform to the user characteristics, the operation behavior feature vector that does not conform to the user characteristics is determined, including: splicing the historical operation behavior data that do not conform to the user characteristics to obtain an operation behavior string that does not conform to the user characteristics; The operation behavior character string that does not conform to the user characteristics is converted into an operation behavior feature vector that does not conform to the user characteristics.

4. The method according to claim 3, characterized in that After the historical operation behavior data that does not conform to the user characteristics is spliced ​​to obtain the operation behavior string that does not conform to the user characteristics, it also includes: The operation behavior character string that does not conform to the user characteristics is hashed and stored in the database.

5. The method according to claim 3, characterized in that: Convert the operation behavior character string that does not conform to the user characteristics into an operation behavior feature vector that does not conform to the user characteristics, including: A hash vectorizer is used to convert the operation behavior string that does not conform to the user characteristics into an operation behavior feature vector that does not conform to the user characteristics.

6. The method according to claim 1, characterized in that Before determining the cosine similarity between the abnormal operation behavior feature vector and the operation behavior feature vector that does not conform to the user characteristics, it also includes: The abnormal operation behavior feature vector and the operation behavior feature vector that does not conform to the user characteristics are mapped to the same preset feature dimension.

7. The method according to claim 1, characterized in that The operation behavior data includes one or more of the following: the sliding distance of the user on the screen, the time interval between clicking the screen, the pressure of clicking the screen, and the finger temperature.

8. An illegal intrusion mobile banking behavior warning device, characterized in that: include: The data collection module is used to collect the historical operation behavior data of users on the mobile banking client screen; A clustering calculation module is used to perform clustering calculation on the historical operation behavior data to determine the range of operation behavior data that meets the user characteristics and the historical operation behavior data that does not meet the user characteristics; A first conversion module is used to determine an operation behavior feature vector that does not meet the user characteristics based on the historical operation behavior data that does not meet the user characteristics; The abnormality determination module is used to obtain the operation behavior data on the mobile banking client screen when the user operation behavior appears on the mobile banking client screen, compare the operation behavior data on the mobile banking client screen with the operation behavior data range that meets the user characteristics, and determine the abnormal operation behavior data that does not fall into the operation behavior data range that meets the user characteristics; A second conversion module is used to determine an abnormal operation behavior feature vector according to the abnormal operation behavior data; The intrusion warning module is used to determine the cosine similarity between the feature vector of abnormal operation behavior and the feature vector of operation behavior that does not conform to the user characteristics. If the cosine similarity is greater than or equal to the preset threshold, the abnormal operation behavior is determined to be an illegal intrusion into the mobile banking behavior, and an illegal intrusion warning message of the mobile banking is sent to the user.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images