A self-service terminal monitoring method and system based on AI

Abstract

The present invention relates to the field of monitoring technology, specifically to a self-service terminal monitoring method and system based on AI, comprising the following steps: based on the real-time video stream obtained by the camera device, segmenting the video frame, extracting the details of facial expressions and hand movements, and analyzing the interaction mode between the user and the self-service terminal. In the present invention, through the analysis of the real-time video stream, high-precision user behavior capture is achieved, and the accuracy of self-service terminal monitoring is improved. Through the detailed analysis of facial expressions and hand movements, the interaction details between the user and the terminal can be deeply analyzed. Through the continuous analysis of dynamic data to predict intentions, the foresight of potential risk behaviors in the future is increased. The rapid identification and recording of abnormal behaviors are used to accelerate the response time, effectively reduce delays and improve management efficiency. The data processing process is optimized through the autoencoder, and the key transaction features are automatically screened out, which improves the accuracy of abnormal transaction detection.

Description

Technical Field

[0001] The present invention relates to the field of monitoring technology, and in particular to an AI-based self-service terminal monitoring method and system. Background Art

[0002] Monitoring technology covers the use of various technical means to monitor and record the environment, facilities, personnel or operations, including video surveillance systems such as closed-circuit television (CCTV) and IP surveillance. Monitoring technology involves data monitoring and analysis, using sensors, data acquisition equipment, and artificial intelligence and machine learning algorithms to process and analyze the collected data for efficiency optimization, fault prediction and resource management.

[0003] Among them, the self-service terminal monitoring method involves the monitoring and management of self-service terminals, such as ATMs, ticket machines, information inquiry stations and other equipment. Its main purpose is to ensure the safe and efficient operation of self-service terminals, prevent fraud activities, and reduce downtime. By implementing monitoring, the status of the terminal can be remotely monitored, real-time troubleshooting and preventive maintenance can be performed, and transaction activities can be monitored at the same time to identify and prevent illegal operations.

[0004] Existing technologies rely on static monitoring settings and lack adaptability to continuously changing transaction patterns, resulting in a slow response when encountering new fraud methods. Existing technologies are also insufficient in terms of data analysis depth and prediction accuracy. It is difficult to quickly extract useful information from large amounts of monitoring data, affecting the timeliness and accuracy of risk identification. For example, when new fraudulent behavior occurs, traditional technologies fail to identify it immediately due to the lack of effective behavioral analysis, resulting in security vulnerabilities and affecting the performance and security of self-service terminals. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and propose an AI-based self-service terminal monitoring method and system.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a self-service terminal monitoring method based on AI, comprising the following steps:

[0007] S1: Based on the real-time video stream obtained by the camera device, the video frames are segmented, facial expressions and hand movement details are extracted, the interaction between the user and the self-service terminal is analyzed, and the movement speed and direction between the action nodes are calculated to generate a behavior feature map;

[0008] S2: Based on the behavior feature graph, the feature time series is analyzed by a convolutional neural network, the behavior recognition pattern features are extracted, and the time dependency is processed to predict the user behavior intention and obtain the intention prediction information;

[0009] S3: Based on the intention prediction information, compare the standard behavior template with the current behavior sequence, identify the behavior deviation, determine whether there is an abnormality, and re-analyze the suspected abnormal detection behavior to generate an abnormal activity record;

[0010] S4: Based on the abnormal activity records, collect transaction records of self-service terminals, extract key transaction data, use autoencoders to perform feature compression and optimization, highlight key features of data patterns, and generate transaction feature sets;

[0011] S5: Based on the transaction feature set, apply the online learning mechanism, continuously update the detection parameters, monitor the changes in transaction behavior, identify abnormal or risky transaction behaviors by comparing the current transaction features with historical patterns, and generate risk assessment logs;

[0012] S6: Based on the risk assessment log, compare with the abnormal behavior threshold, identify high-risk transaction behaviors and potential fraud behaviors, adjust the alarm level according to the identification result, and generate an alarm identification configuration state.

[0013] As a further solution of the present invention, the behavior characteristic graph includes action accuracy, speed index, and direction vector; the intention prediction information includes behavior continuity, intention intensity, and behavior frequency; the abnormal activity record includes abnormality type, frequency index, and deviation level; the transaction feature set includes transaction volume distribution, amount fluctuation, and activity timestamp; the risk assessment log includes risk classification, influencing factors, and early warning signals; and the alarm identification configuration status includes trigger conditions, response level, and update frequency.

[0014] As a further solution of the present invention, based on the real-time video stream obtained by the camera device, the video frames are segmented, the facial expressions and hand movement details are extracted, the interaction mode between the user and the self-service terminal is analyzed, and the movement speed and direction between the action nodes are calculated. The steps of generating the behavior feature map are specifically as follows:

[0015] S101: Based on the real-time video stream obtained by the camera device, the video stream is analyzed in real time, each frame of the video is segmented, each movement detail of the user's face and hands is independently identified, and a movement detail map is generated;

[0016] S102: Based on the action detail graph, quantitatively analyze the speed and direction of multiple action nodes, record the movement trajectory of each action node, identify the interaction mode between the user and the self-service terminal, and generate interaction mode information;

[0017] S103: Based on the interaction mode information, key action data are summarized, including speed and direction data of action nodes, a list of key action data is constructed, and a behavior feature graph is obtained.

[0018] As a further solution of the present invention, based on the behavior feature graph, the characteristic time series is analyzed by a convolutional neural network, the behavior recognition pattern features are extracted, and the time dependency is processed to predict the user behavior intention. The steps of obtaining the intention prediction information are specifically as follows:

[0019] S201: Based on the behavior feature graph, perform time series analysis through a convolutional neural network, extract key patterns in the behavior sequence, perform cluster analysis on the patterns, summarize the user's behavior recognition patterns, and generate a behavior pattern set;

[0020] S202: Based on the behavior pattern set, process the time dependency in the data, perform time correlation analysis on the behavior pattern, predict the user's future potential behavior intention, and generate intention prediction mapping data;

[0021] S203: Based on the intention prediction mapping data, the behavior pattern and prediction data are integrated, including the user's potential behavior motivation and behavior path, to obtain intention prediction information.

[0022] As a further solution of the present invention, based on the intention prediction information, the standard behavior template is compared with the current behavior sequence to identify the behavior deviation, determine whether there is an abnormality, and re-analyze the suspected abnormal detection behavior. The specific steps of generating abnormal activity records are:

[0023] S301: Based on the intention prediction information, detecting and recording the difference between the current behavior sequence and the standard behavior template, including quantifying the time and space offset of each action, and generating preliminary deviation identification information;

[0024] S302: Based on the preliminary deviation identification information, compare the behavior data marked as abnormal, determine the nature and severity of the abnormality by dynamically tracking the development of the abnormal behavior, and generate abnormal behavior analysis results;

[0025] S303: Based on the abnormal behavior analysis results, the verified abnormal behavior data, including timestamp, abnormal category and behavior description, are collated and integrated to generate abnormal activity records.

[0026] As a further solution of the present invention, based on the abnormal activity records, the transaction records of the self-service terminals are collected, key transaction data are extracted, and feature compression and optimization are performed using an autoencoder to highlight the key features of the data pattern. The steps of generating a transaction feature set are specifically as follows:

[0027] S401: Based on the abnormal activity records, collect transaction records associated with the abnormal behavior time, and filter transaction data associated with the abnormal events to generate a preliminary transaction data set;

[0028] S402: Based on the preliminary transaction data set, perform feature extraction operations on the transaction data, screen key transaction features, and use an autoencoder to perform feature compression and optimization to generate transaction feature data;

[0029] S403: Based on the transaction feature data, key transaction features are integrated, including transaction behavior patterns and abnormal characteristics, key features of the data patterns are highlighted, and a transaction feature set is generated.

[0030] As a further solution of the present invention, a feature extraction operation is performed on the transaction data to screen key transaction features according to the formula: Calculate the eigenvector , where Represents the extracted The value of the transaction feature, Representative The weight of the feature, Represents the total number of transaction features.

[0031] As a further solution of the present invention, based on the transaction feature set, an online learning mechanism is applied to continuously update detection parameters, monitor changes in transaction behavior, and identify abnormal or risky transaction behaviors by comparing current transaction features with historical patterns. The steps of generating a risk assessment log are specifically as follows:

[0032] S501: Based on the transaction feature set, using an online learning mechanism, monitoring dynamic changes in transaction features, extracting behavior parameters through real-time analysis of transaction data, and gradually updating thresholds and response parameters in combination with historical data to generate a real-time monitoring log;

[0033] S502: Based on the real-time monitoring log, match the current transaction characteristics with the historical transaction patterns, identify the transaction behaviors that are different from the normal state, mark potential abnormal or risky transactions, and generate a risk detection summary;

[0034] S503: Based on the risk detection summary, call the marked abnormal transaction behavior data, perform risk matching, determine the deviation type of the transaction behavior, record risk feature information, and generate a risk assessment log.

[0035] As a further solution of the present invention, based on the risk assessment log, the risk assessment log is compared with the abnormal behavior threshold, high-risk transaction behaviors and potential fraud behaviors are identified, and the alarm level is adjusted according to the identification result. The steps of generating the alarm identification configuration state are specifically as follows:

[0036] S601: Based on the risk assessment log, compare the risk level in the log with the abnormal threshold, detect the behavior exceeding the abnormal threshold, and determine whether it is a high-risk or potential fraud transaction, and generate a high-risk transaction mark;

[0037] S602: Based on the high-risk transaction mark, adjust the alarm level, set the corresponding response process, activate the risk notification function in combination with the alarm classification, and generate the alarm level adjustment configuration;

[0038] S603: Based on the alarm level, the configuration is adjusted, the alarm identification status and the response level are integrated, and the response efficiency when a high-risk transaction occurs is verified to generate an alarm identification configuration status.

[0039] An AI-based self-service terminal monitoring system, the AI-based self-service terminal monitoring system is used to execute the above-mentioned AI-based self-service terminal monitoring method, the system comprising:

[0040] The behavior acquisition module recognizes and segments the facial expressions and hand movement details in the video frames based on the real-time video stream obtained by the camera device, analyzes the interaction between the user and the self-service terminal, and calculates the movement speed and direction between the action nodes to generate a behavior feature map;

[0041] The intention analysis module analyzes the characteristic time series based on the behavior feature graph through a convolutional neural network, extracts the behavior recognition pattern features, processes the time dependency, predicts the user behavior intention, and obtains the intention prediction information;

[0042] The abnormal monitoring module compares the standard behavior template with the current behavior sequence based on the intention prediction information, identifies the behavior deviation, and re-analyzes the suspected abnormal behavior to generate an abnormal activity record;

[0043] The transaction feature module collects transaction records of the self-service terminal based on the abnormal activity records, extracts key transaction data, uses the autoencoder to perform feature compression and optimization, highlights the key features of the data pattern, and generates a transaction feature set;

[0044] Based on the transaction feature set, the risk assessment module applies an online learning mechanism, continuously updates detection parameters, monitors changes in transaction behavior, identifies abnormal or risky transaction behaviors, and compares them with abnormal behavior thresholds to identify high-risk transaction behaviors and potential fraudulent behaviors, and generates an alarm to identify the configuration status.

[0045] Compared with the prior art, the advantages and positive effects of the present invention are:

[0046] In the present invention, through the analysis of real-time video streams, high-precision user behavior capture is achieved, the accuracy of self-service terminal monitoring is improved, and through detailed analysis of facial expressions and hand movements, the interaction details between users and terminals can be deeply analyzed. Through continuous analysis of dynamic data to predict intentions, the foresight of potential risk behaviors in the future is increased. The rapid identification and recording of abnormal behaviors are utilized to accelerate the response time, effectively reduce delays and improve management efficiency. The data processing flow is optimized through the autoencoder, and key transaction features are automatically screened out to improve the accuracy of abnormal transaction detection. The online learning mechanism ensures that it can adapt to new transaction patterns, combat unknown fraud methods, and continuously maintain the sensitivity and effectiveness of the monitoring process. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0048] Figure 2 This is a detailed flow chart of S1 of the present invention;

[0049] Figure 3 This is a detailed flow chart of S2 of the present invention;

[0050] Figure 4 This is a detailed flow chart of S3 of the present invention;

[0051] Figure 5 This is a detailed flow chart of S4 of the present invention;

[0052] Figure 6 This is a detailed flow chart of S5 of the present invention;

[0053] Figure 7 This is a detailed flow chart of S6 of the present invention;

[0054] Figure 8 is a system flow chart of the present invention;

[0055] Fig. 9 It is a structural schematic diagram of the self-service terminal in the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0057] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0058] Example 1: Please refer to Figure 1 The present invention provides a technical solution: a self-service terminal monitoring method based on AI, comprising the following steps:

[0059] S1: Based on the real-time video stream obtained by the camera device, the video frames are segmented, facial expressions and hand movement details are extracted, the interaction between the user and the self-service terminal is analyzed, and the movement speed and direction between the action nodes are calculated to generate a behavior feature map;

[0060] S2: Based on the behavior feature graph, the convolutional neural network is used to analyze the feature time series, extract the behavior recognition pattern features, and process the time dependency to predict the user behavior intention and obtain the intention prediction information;

[0061] S3: Based on the intention prediction information, the standard behavior template is compared with the current behavior sequence to identify the behavior deviation, determine whether there is an abnormality, and re-analyze the suspected abnormal detection behavior to generate abnormal activity records;

[0062] S4: Based on the abnormal activity records, collect the transaction records of the self-service terminals, extract the key transaction data, use the autoencoder to compress and optimize the features, highlight the key features of the data pattern, and generate the transaction feature set;

[0063] S5: Based on the transaction feature set, apply the online learning mechanism, continuously update the detection parameters, monitor the changes in transaction behavior, identify abnormal or risky transaction behaviors by comparing the current transaction features with historical patterns, and generate risk assessment logs;

[0064] S6: Based on the risk assessment log, compare with the abnormal behavior threshold to identify high-risk transaction behaviors and potential fraud behaviors, adjust the alarm level according to the identification results, and generate the alarm identification configuration status.

[0065] The behavioral characteristic graph includes action accuracy, speed index, and direction vector. The intention prediction information includes behavior continuity, intention intensity, and behavior frequency. The abnormal activity record includes abnormal type, frequency index, and deviation level. The transaction feature set includes transaction volume distribution, amount fluctuation, and activity timestamp. The risk assessment log includes risk classification, influencing factors, and early warning signals. The alarm identification configuration status includes trigger conditions, response level, and update frequency.

[0066] See also Figure 2 Based on the real-time video stream obtained by the camera device, the video frames are segmented, the facial expressions and hand movement details are extracted, the interaction between the user and the self-service terminal is analyzed, and the movement speed and direction between the action nodes are calculated. The specific steps for generating the behavior feature map are as follows:

[0067] S101: Based on the real-time video stream obtained by the camera device, the video stream is analyzed in real time, each frame of the video is segmented, each movement detail of the user's face and hands is independently identified, and a movement detail map is generated;

[0068] Based on the real-time video stream obtained by the camera device, regional segmentation is performed, the hands and faces in the video are calibrated, and each frame of the image is analyzed using a deep learning model. During this process, the deep learning model distinguishes the movement details of the hands and faces from the background by identifying pixel changes and color differences in the image. Then, the convolutional neural network is used to deeply learn the characteristics of the area, and the starting point, end point and movement trajectory of each hand and facial movement are marked. This marking depends on the movement speed and direction of the hands and faces. The data is analyzed and recorded in real time through an algorithm to generate a detailed action map.

[0069] S102: Based on the action detail graph, quantitatively analyze the speed and direction of multiple action nodes, record the movement trajectory of each action node, identify the interaction mode between the user and the self-service terminal, and generate interaction mode information;

[0070] Based on the action detail graph, the speed and direction of multiple action nodes are quantitatively analyzed, the movement speed and direction of each action node are calculated through image processing technology, and each hand and facial movement captured in the video is tracked in detail. The optical flow estimation method is used to track the position changes of each node between consecutive frames, including determining the position coordinates of each action node and its corresponding velocity vector. The speed and direction data are captured and recorded in real time, and the data is then analyzed through a pattern recognition algorithm to identify the typical interaction mode between the user and the self-service terminal, help analyze the user's behavioral intentions and interaction methods, and generate interaction mode information.

[0071] S103: Based on the interaction mode information, summarize the key action data, including the speed and direction data of the action nodes, construct a list of the key action data, and obtain a behavior feature graph;

[0072] Key action data are aggregated based on the interaction pattern information, and the aggregated data is further processed and analyzed, including statistical analysis and pattern discovery of speed and direction data. Statistical methods are used to cluster speed and direction data to identify repeated or significant action patterns. The patterns reflect the key behavioral characteristics of the user's interaction with the terminal. Subsequently, the key action data are organized into a list that records the speed and direction of an action node. The list is used to construct a user's behavioral feature map to facilitate further analysis and optimization of the interactive experience.

[0073] See also Figure 3 Based on the behavior feature graph, the convolutional neural network is used to analyze the feature time series, extract the behavior recognition pattern features, and process the time dependency to predict the user behavior intention. The specific steps to obtain the intention prediction information are as follows:

[0074] S201: Based on the behavior feature graph, a time series analysis is performed through a convolutional neural network to extract key patterns in the behavior sequence, cluster the patterns, summarize the user's behavior recognition patterns, and generate a behavior pattern set;

[0075] Based on the behavior feature graph, a convolutional neural network is used for time series analysis. The analysis relies on the ability of the convolutional layer to identify and extract features in time series data. The network automatically learns the repetitive patterns and anomalies of the behavior sequence through filters. The patterns are captured by the transformation of the time dimension. Subsequently, the features are clustered. Clustering algorithms such as K-means are used to classify similar behavior patterns into the same category. The Euclidean distance from each data point to the cluster center is calculated to determine its classification. In this way, each category in the behavior pattern represents a behavior feature. The clusters are then labeled to summarize the user's behavior recognition patterns. In this way, a set of behavior patterns is generated.

[0076] S202: Based on the behavior pattern set, process the time dependency in the data, perform time correlation analysis on the behavior pattern, predict the user's future potential behavior intention, and generate intention prediction mapping data;

[0077] Based on the set of behavioral patterns, the time dependency in the data is processed in detail. First, the relationship between each behavioral pattern and time is determined through an autoregressive model. The temporal characteristics of the pattern are analyzed by calculating the correlation between behavioral events and time labels. Next, time association analysis techniques, such as sliding window technology, are used to analyze the temporal association between behavioral patterns and previous and subsequent events. The analysis helps reveal the trend and periodicity of behavioral patterns over time. Based on the analysis of time association, the system can predict the user's future potential behavioral intentions and obtain intention prediction mapping data.

[0078] S203: Based on the intention prediction mapping data, the behavior pattern and prediction data are integrated, including the user's potential behavior motivation and behavior path, to obtain intention prediction information;

[0079] Based on the intention prediction mapping data, the behavior patterns and prediction data are integrated. Through the data integration process, the user's behavior motivations and potential behavior paths are mapped into a unified framework. In this process, decision trees and probability models are used to evaluate the probabilities of different behavior patterns and associate the probabilities with the user's potential motivations. In this way, each behavior pattern is matched with a specific behavior path, which indicates the user's action direction and goal. Finally, through this comprehensive analysis, intention prediction information is obtained.

[0080] See also Figure 4 Based on the intention prediction information, the standard behavior template is compared with the current behavior sequence to identify the behavior deviation, determine whether there is an abnormality, and re-analyze the suspected abnormal detection behavior. The specific steps for generating abnormal activity records are:

[0081] S301: Based on the intention prediction information, detect and record the difference between the current behavior sequence and the standard behavior template, including quantifying the time and space offset of each action, and generating preliminary deviation identification information;

[0082] Based on the intention prediction information, the difference between the current user behavior and the preset standard behavior template is automatically detected, and the time and space coordinates of each captured action are analyzed. The difference between the actual occurrence time and the expected time of the action, as well as the position offset of the action in the video frame, is quantified. The time deviation and space deviation are calculated using the Euclidean distance formula. The quantified results are compared with the behavior template, and the actions that deviate from the standard behavior are identified. The deviations are recorded and classified as preliminary deviation identification information.

[0083] S302: Based on the preliminary deviation identification information, compare the behavior data marked as abnormal, determine the nature and severity of the abnormality by dynamically tracking the development of the abnormal behavior, and generate abnormal behavior analysis results;

[0084] Based on the preliminary deviation identification information, the behavior data marked as abnormal is further analyzed, the abnormal behavior data is compared with the normal behavior data, and the development trend of abnormal behavior is continuously monitored through dynamic tracking technology. The development speed and change pattern of abnormal behavior are evaluated using time series analysis tools to determine its abnormal nature, such as whether it is an occasional error or a continuous deviation. At the same time, the severity of the abnormal behavior is evaluated, such as the impact on user interaction. The analysis results are comprehensively considered to generate abnormal behavior analysis results.

[0085] S303: Based on the abnormal behavior analysis results, organize and integrate the verified abnormal behavior data, including timestamps, abnormal categories and behavior descriptions, to generate abnormal activity records;

[0086] Based on the abnormal behavior analysis results, the verified abnormal behavior data is sorted and integrated, and detailed information of various abnormal behaviors is automatically collected, including the timestamp of the abnormality, the abnormality category and the specific behavior description. The data is stored in the database and classified and marked through the data management system. Each abnormal event is recorded in detail to facilitate subsequent analysis and report production, and a record of abnormal activities is generated.

[0087] See also Figure 5 ,Based on the abnormal activity records, we collect the transaction records of the self-service terminals, extract the key transaction data, use the autoencoder to compress and optimize the features, highlight the key features of the data pattern, and generate the transaction feature set in the following steps:

[0088] S401: Based on the abnormal activity records, collect transaction records associated with the abnormal behavior time, and filter the transaction data associated with the abnormal event to generate a preliminary transaction data set;

[0089] Based on the records of abnormal activities, the transaction data collection process is automatically triggered to retrieve all transaction records that occurred in the same time period as the abnormal behavior from the database, including the transaction timestamp, amount, location and participant information. The transaction records are then screened with the goal of identifying specific transaction data that has a high temporal correlation with the abnormal behavior, such as records that are close in time or at the same location. In this way, transaction data related to abnormal behavior can be accurately extracted from a large amount of data, classified and a preliminary transaction data set can be generated.

[0090] S402: Based on the preliminary transaction data set, perform feature extraction operations on the transaction data, screen key transaction features, and use an autoencoder to perform feature compression and optimization to generate transaction feature data;

[0091] Perform feature extraction on transaction data to filter key transaction features according to the formula: Calculate the eigenvector , where Represents the extracted The value of the transaction feature, Representative The weight of the feature, Represents the total number of transaction features.

[0092] When performing feature extraction on transaction data, key features to consider include transaction amount , transaction frequency , and trading hours For each feature, a weight is set to indicate its importance in the overall feature vector. After data analysis, the weight is determined. , and , to reflect that transaction amount is of highest importance and time is of lowest importance.

[0093] For example, if a set of transaction data shows: (Transaction amount) = 200, (Transaction frequency) = 5 times / month, (Trading time) = 15 days, then the eigenvector The calculation is:

[0094] The result shows that after comprehensive consideration of the weights, the comprehensive characteristic value of the transaction data is 104.5, which reflects the comprehensive characteristics of the transaction. Higher values ​​indicate that the transaction behavior is more important or has a higher risk level, which is further used to screen and compress features.

[0095] S403: Based on the transaction feature data, integrate key transaction features, including transaction behavior patterns and abnormal characteristics, highlight key features of the data pattern, and generate a transaction feature set;

[0096] Based on transaction feature data, key transaction features are integrated. In this process, key features of each transaction are gathered, such as the size of the transaction amount, the frequency and its time distribution pattern. Through cluster analysis and association rule learning, patterns and abnormal characteristics in the transaction data are identified and highlighted, such as frequent high-value transactions or specific transaction patterns associated with abnormal behavior time. The identified features are integrated together to form a set of transaction feature sets, which describe the transaction behavior patterns and their abnormal characteristics.

[0097] See also Figure 6 ,Based on the transaction feature set, we apply the online learning mechanism, continuously update the detection parameters, monitor the changes in transaction behavior, and identify abnormal or risky transaction behaviors by comparing the current transaction features with historical patterns. The specific steps for generating risk assessment logs are as follows:

[0098] S501: Based on the transaction feature set, the online learning mechanism is used to monitor the dynamic changes of transaction features, extract behavior parameters through real-time analysis of transaction data, and gradually update thresholds and response parameters in combination with historical data to generate real-time monitoring logs;

[0099] By analyzing transaction data in real time, behavioral parameters are extracted according to the formula: Calculate updated behavior parameters , where Representative Behavioral parameters of a transaction, Representative The historical data corresponding to the parameters of the transaction, Represents the total number of transactions;

[0100] Set transaction behavior parameters Including amount, frequency, etc., combined with corresponding historical data parameters For example, the transaction amount and frequency in the same period of history, taking three transactions as an example, its behavior parameters The corresponding historical data parameters are 100, 150 and 200 90, 140 and 195, the total number of transactions is 3.

[0101] Calculating behavior parameters The process is as follows: The result shows that after combining the current transaction data with the corresponding historical data, the average behavioral parameter of each transaction is 23,000. The result reflects the correlation between transaction behavior and historical data, and serves as the basis for dynamically updating thresholds and response parameters to improve the accuracy and efficiency of real-time monitoring logs.

[0102] S502: Based on the real-time monitoring log, match the current transaction characteristics with the historical transaction patterns, identify the transaction behaviors that are different from the normal state, mark potential abnormal or risky transactions, and generate a risk detection summary;

[0103] Based on real-time monitoring logs, current transaction features are matched with historical transaction patterns. By comparing and analyzing the differences between current transaction data and past patterns, transaction behaviors that are significantly different from the norm are identified. Behaviors indicate potential anomalies or risks. By marking transactions with potential risks, such as frequent large transactions or transaction patterns similar to known fraudulent behaviors, a risk detection summary is generated. The summary describes in detail all identified risky transaction features, providing clear visual and data guidance for users and risk managers.

[0104] S503: Based on the risk detection summary, call the marked abnormal transaction behavior data, perform risk matching, determine the deviation type of the transaction behavior, record the risk feature information, and generate a risk assessment log;

[0105] Based on the risk detection summary, call the marked abnormal transaction behavior data to perform risk matching analysis, determine the specific deviation type of each abnormal transaction, such as fraud or other illegal activities, record the specific characteristics of each deviation type, such as transaction time, amount involved and participating accounts, and generate a risk assessment log. The log brings together all important risk feature information.

[0106] See also Figure 7Based on the risk assessment log, the abnormal behavior threshold is compared to identify high-risk transaction behaviors and potential fraud behaviors, and the alarm level is adjusted according to the identification results. The steps to generate the alarm identification configuration status are as follows:

[0107] S601: Based on the risk assessment log, compare the risk level in the log with the abnormal threshold, detect the behavior exceeding the abnormal threshold, and determine whether it is a high-risk or potential fraud transaction, and generate a high-risk transaction mark;

[0108] Based on the risk assessment log, the risk level of each transaction recorded in the log is automatically compared with the set abnormal threshold. Through specific algorithms, such as threshold comparison algorithm, transaction behaviors that exceed the abnormal threshold are detected and identified, and the data is analyzed in real time to determine whether it is a high-risk or potential fraud transaction. For example, through anomaly point analysis, including evaluation of transaction amount, frequency and similarity with known fraudulent behaviors, a high-risk transaction mark is generated in this way, which clearly indicates transactions that are considered to exceed normal transaction behavior parameters.

[0109] S602: Based on the high-risk transaction mark, adjust the alarm level, set the corresponding response process, activate the risk notification function in combination with the alarm classification, and generate the alarm level adjustment configuration;

[0110] Based on high-risk transaction markings, adjust the alarm level and set the corresponding response process, including configuring the alarm priority and response procedure according to the risk level of the transaction. For example, high-risk transactions trigger immediate notifications, while medium-risk transactions are recorded for later review. Through this graded response, combined with the alarm graded activation of the risk notification function, it is ensured that each alarm level can trigger an appropriate system response and generate an alarm level adjustment configuration.

[0111] S603: Adjust the configuration based on the alarm level, integrate the alarm identification status and the response level, and verify the response efficiency when high-risk transactions occur, and generate the alarm identification configuration status;

[0112] Adjust the configuration based on the alarm level, integrate the alarm recognition status and response level, verify the response efficiency when high-risk transactions occur through real-time monitoring and feedback mechanism, and record the response time and processing results of each alarm. This process involves continuous adjustment and optimization of response parameters to ensure that high-risk transactions can be quickly and accurately identified and responded to at critical moments. The generated alarm recognition configuration status provides an overview, showing the efficiency and timeliness of the identification and processing of alarms at all levels.

[0113] See also Figure 8 and Fig. 9 , an AI-based self-service terminal monitoring system, the system includes:

[0114] The behavior acquisition module recognizes and segments the facial expressions and hand movement details in the video frames based on the real-time video stream obtained by the camera device, analyzes the interaction between the user and the self-service terminal, and calculates the movement speed and direction between the action nodes to generate a behavior feature map;

[0115] The intention analysis module is based on the behavior feature graph. It uses a convolutional neural network to analyze the feature time series, extract the behavior recognition pattern features, and process the time dependency to predict the user's behavior intention and obtain the intention prediction information.

[0116] The anomaly monitoring module compares the standard behavior template with the current behavior sequence based on the intention prediction information, identifies the behavior deviation, and re-analyzes the suspected abnormal behavior to generate abnormal activity records;

[0117] The transaction feature module collects transaction records from self-service terminals based on abnormal activity records, extracts key transaction data, uses autoencoders to compress and optimize features, highlights key features of data patterns, and generates transaction feature sets;

[0118] The risk assessment module is based on the transaction feature set and applies an online learning mechanism to continuously update detection parameters, monitor changes in transaction behavior, identify abnormal or risky transaction behaviors, and compare them with abnormal behavior thresholds to identify high-risk transaction behaviors and potential fraudulent behaviors, and generate alarms to identify configuration status.

[0119] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A self-service terminal monitoring method based on AI, characterized in that: The following steps are involved: Based on the real-time video stream obtained by the camera device, the video frames are segmented, facial expressions and hand movement details are extracted, the interaction between the user and the self-service terminal is analyzed, and the movement speed and direction between the action nodes are calculated to generate a behavior feature map; Based on the behavior feature graph, the feature time series is analyzed by a convolutional neural network, the behavior recognition pattern features are extracted, and the time dependency is processed to predict the user behavior intention and obtain the intention prediction information; Based on the intention prediction information, the standard behavior template is compared with the current behavior sequence to identify the behavior deviation, determine whether there is an abnormality, and re-analyze the suspected abnormal detection behavior to generate an abnormal activity record; Based on the abnormal activity records, collect transaction records of self-service terminals, extract key transaction data, use autoencoders to perform feature compression and optimization, highlight key features of data patterns, and generate transaction feature sets; Based on the transaction feature set, an online learning mechanism is applied to continuously update detection parameters, monitor changes in transaction behavior, identify abnormal or risky transaction behaviors by comparing current transaction features with historical patterns, and generate risk assessment logs; Based on the risk assessment log, compare with the abnormal behavior threshold, identify high-risk transaction behaviors and potential fraud behaviors, adjust the alarm level according to the identification results, and generate an alarm identification configuration state; Based on the real-time video stream obtained by the camera device, the video frames are segmented, the facial expressions and hand movement details are extracted, the interaction between the user and the self-service terminal is analyzed, and the movement speed and direction between the action nodes are calculated. The specific steps to generate the behavior feature map are as follows: Based on the real-time video stream obtained by the camera device, the video stream is analyzed in real time, each frame of video is segmented, and each movement detail of the user's face and hands is independently identified to generate a movement detail map; Based on the action detail graph, quantitative analysis of speed and direction of multiple action nodes is performed, the movement trajectory of each action node is recorded, the interaction mode between the user and the self-service terminal is identified, and interaction mode information is generated; Based on the interaction mode information, key action data are summarized, including speed and direction data of action nodes, a list of key action data is constructed, and a behavior feature graph is obtained.

2. The AI-based self-service terminal monitoring method according to claim 1, characterized in that: The behavior characteristic graph includes action accuracy, speed index, and direction vector; the intention prediction information includes behavior continuity, intention intensity, and behavior frequency; the abnormal activity record includes abnormal type, frequency index, and deviation level; the transaction feature set includes transaction volume distribution, amount fluctuation, and activity timestamp; the risk assessment log includes risk classification, influencing factors, and early warning signals; the alarm identification configuration status includes trigger conditions, response level, and update frequency.

3. The AI-based self-service terminal monitoring method according to claim 1, characterized in that: Based on the behavior feature graph, the characteristic time series is analyzed by a convolutional neural network, the behavior recognition pattern features are extracted, and the time dependency is processed to predict the user behavior intention. The specific steps of obtaining the intention prediction information are as follows: Based on the behavior feature graph, a time series analysis is performed through a convolutional neural network to extract key patterns in the behavior sequence, cluster the patterns, summarize the user's behavior recognition patterns, and generate a behavior pattern set; Based on the behavior pattern set, the time dependency in the data is processed, the behavior pattern is analyzed for time correlation, the user's future potential behavior intention is predicted, and intention prediction mapping data is generated; Based on the intention prediction mapping data, the behavior pattern and prediction data are integrated, including the user's potential behavior motivation and behavior path, to obtain intention prediction information.

4. The AI-based self-service terminal monitoring method according to claim 1, characterized in that: Based on the intention prediction information, the standard behavior template is compared with the current behavior sequence to identify the behavior deviation, determine whether there is an abnormality, and re-analyze the suspected abnormal detection behavior. The specific steps of generating abnormal activity records are as follows: Based on the intention prediction information, detecting and recording the difference between the current behavior sequence and the standard behavior template, including quantifying the time and space offset of each action, and generating preliminary deviation identification information; Based on the preliminary deviation identification information, compare the behavior data marked as abnormal, determine the nature and severity of the abnormality by dynamically tracking the development of the abnormal behavior, and generate abnormal behavior analysis results; Based on the abnormal behavior analysis results, the verified abnormal behavior data, including timestamps, abnormal categories and behavior descriptions, are collated and integrated to generate abnormal activity records.

5. The AI-based self-service terminal monitoring method according to claim 1, characterized in that: Based on the abnormal activity records, the transaction records of the self-service terminals are collected, key transaction data are extracted, and feature compression and optimization are performed using the autoencoder to highlight the key features of the data pattern. The specific steps of generating the transaction feature set are as follows: Based on the abnormal activity records, collect transaction records associated with the abnormal behavior time, and filter transaction data associated with the abnormal events to generate a preliminary transaction data set; Based on the preliminary transaction data set, perform feature extraction operations on the transaction data, screen key transaction features, and use an autoencoder to perform feature compression and optimization to generate transaction feature data; Based on the transaction feature data, key transaction features are integrated, including transaction behavior patterns and abnormal characteristics, key features of the data patterns are highlighted, and a transaction feature set is generated.

6. The AI-based self-service terminal monitoring method according to claim 5, characterized in that: Perform feature extraction on the transaction data to filter key transaction features according to the formula: ； Calculate the eigenvector , where represents the value of the extracted i-th transaction feature, represents the weight of the i-th feature, Represents the total number of transaction features.

7. The AI-based self-service terminal monitoring method according to claim 1, characterized in that: Based on the transaction feature set, an online learning mechanism is applied to continuously update detection parameters, monitor changes in transaction behavior, and identify abnormal or risky transaction behaviors by comparing current transaction features with historical patterns. The specific steps for generating risk assessment logs are as follows: Based on the transaction feature set, using online learning mechanism, monitoring the dynamic changes of transaction features, extracting behavior parameters through real-time analysis of transaction data, and gradually updating thresholds and response parameters in combination with historical data to generate real-time monitoring logs; Based on the real-time monitoring log, current transaction characteristics are matched with historical transaction patterns, transaction behaviors that differ from the norm are identified, potential abnormal or risky transactions are marked, and a risk detection summary is generated; Based on the risk detection summary, the marked abnormal transaction behavior data is called to perform risk matching, determine the deviation type of the transaction behavior, record the risk feature information, and generate a risk assessment log.

8. The AI-based self-service terminal monitoring method according to claim 1, characterized in that: Based on the risk assessment log, the abnormal behavior threshold is compared to identify high-risk transaction behaviors and potential fraud behaviors, and the alarm level is adjusted according to the identification results. The steps of generating the alarm identification configuration state are as follows: Based on the risk assessment log, compare the risk level in the log with the abnormal threshold, detect the behavior exceeding the abnormal threshold, and determine whether it is a high-risk or potential fraud transaction, and generate a high-risk transaction mark; Based on the high-risk transaction mark, adjust the alarm level, set the corresponding response process, activate the risk notification function in combination with the alarm classification, and generate the alarm level adjustment configuration; Based on the alarm level, the configuration is adjusted, the alarm identification status and the response level are integrated, and the response efficiency when high-risk transactions occur is verified to generate the alarm identification configuration status.

9. An AI-based self-service terminal monitoring system, characterized in that: According to the AI-based self-service terminal monitoring method according to any one of claims 1 to 8, the system comprises: The behavior acquisition module recognizes and segments the facial expressions and hand movement details in the video frames based on the real-time video stream obtained by the camera device, analyzes the interaction between the user and the self-service terminal, and calculates the movement speed and direction between the action nodes to generate a behavior feature map; The intention analysis module analyzes the characteristic time series based on the behavior feature graph through a convolutional neural network, extracts the behavior recognition pattern features, processes the time dependency, predicts the user behavior intention, and obtains the intention prediction information; The abnormal monitoring module compares the standard behavior template with the current behavior sequence based on the intention prediction information, identifies the behavior deviation, and re-analyzes the suspected abnormal behavior to generate an abnormal activity record; The transaction feature module collects transaction records of the self-service terminal based on the abnormal activity records, extracts key transaction data, uses the autoencoder to perform feature compression and optimization, highlights the key features of the data pattern, and generates a transaction feature set; Based on the transaction feature set, the risk assessment module applies an online learning mechanism, continuously updates detection parameters, monitors changes in transaction behavior, identifies abnormal or risky transaction behaviors, and compares them with abnormal behavior thresholds to identify high-risk transaction behaviors and potential fraudulent behaviors, and generates an alarm to identify the configuration status.

Images