An insurance online payment transaction security real-time detection method and system

Abstract

The application relates to the technical field of payment transaction security detection, and discloses an insurance online payment transaction security real-time detection method and system. The method comprises the following steps: acquiring macroscopic transaction features and microscopic dynamic data; generating user cognitive parameters through a cognitive dynamic model; fusing the macroscopic features and the cognitive parameters to construct a hybrid vector; mapping the hybrid vector to a potential field to calculate an instant risk value; calculating a risk trend based on vector changes and a potential field gradient; comprehensively detecting a security level based on the risk value and the trend index. The system comprises the following modules: a data acquisition module, a cognitive parameter generation module, a state vector construction module, a risk potential calculation module, a path trend analysis module and a risk level decision module. The application constructs a unified hybrid state vector, deeply fuses and integrally represents heterogeneous data from a macroscopic transaction environment and microscopic user behaviors, and solves the fundamental defects of the prior art in identifying complex risk patterns emerging due to cross-dimension feature coupling.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of payment transaction security detection, in particular to an insurance online payment transaction security real-time detection method and system. BACKGROUND

[0002] With the rapid development of information technology and the deep popularization of the Internet, the global financial industry is undergoing a profound transformation. Among them, the insurance industry is accelerating its digital transformation, and online insurance, electronic insurance, online claims and mobile payment premiums have become the norm. This change greatly improves business processing efficiency and provides unprecedented convenient service experience for the general insured. However, the transaction scene has shifted from offline to online, which has brought convenience, but also exposed insurance payment transactions to more complex and hidden fraud risk exposure.

[0003] The existing online payment security detection technology mainly relies on a risk assessment system centered on transaction features. In actual application, the system usually collects and analyzes a series of quantifiable data indicators. This includes macro static information directly related to the transaction itself, such as the amount of a single transaction, the type of insurance product purchased, the time period of the transaction, and historical information related to the user's account, such as the user's usual login location, historical transaction frequency and range, and device fingerprint information.

[0004] However, the existing online payment security detection technology only relies on mouse speed, click interval and other physical layer data, which has been difficult to resist the increasingly intelligent fraud scripts. These advanced scripts can completely simulate the trajectory form and operation rhythm that conforms to normal human habits, making it easy to bypass detection methods based on surface behavior characteristics, and difficult to fundamentally understand the real intention of the operator, and also difficult to distinguish between a real user with slightly abnormal behavior and a highly disguised automated program. Therefore, the present application provides an insurance online payment transaction security real-time detection method and system to solve the problems existing in the prior art. SUMMARY

[0005] In view of the deficiencies of the prior art, the present application provides an insurance online payment transaction security real-time detection method and system, which solves the problem that the existing security detection technology only relies on surface data for static and isolated risk assessment, making it difficult to deeply understand the real intention of the user and predict the risk evolution trend.

[0006] To achieve the above purpose, the present application is implemented by the following technical scheme: an insurance online payment transaction security real-time detection method, comprising the following steps:

[0007] S1, acquiring macro transaction features in a current payment session by a server and a client respectively, and micro behavior dynamics data representing physical operation of a user;

[0008] S2, inputting the micro behavior dynamics data representing physical operation of the user into a preset cognitive dynamics model describing human decision-making and motion control process for online inference, to generate cognitive parameters representing original authenticity of the physical operation of the user;

[0009] S3, constructing a hybrid state vector representing a unified state of the current payment session by taking the acquired macro transaction features and the generated cognitive parameters representing original authenticity of the physical operation of the user as inputs;

[0010] S4, mapping the hybrid state vector of the unified state into a preset transaction authenticity potential field to calculate a risk potential value representing a current instant risk;

[0011] S5, calculating a path trend index representing an evolution direction of the risk based on a change amount of the hybrid state vector of the unified state over time and a gradient of the preset transaction authenticity potential field;

[0012] S6, detecting a security risk level of the current payment session according to the calculated risk potential value of the current instant risk and the path trend index representing the evolution direction of the risk.

[0013] Preferably, in step S1, the step of acquiring macro transaction features in a current payment session by a server and a client respectively comprises:

[0014] Associating and binding the macro transaction features acquired by the server and the micro behavior dynamics data acquired by the client based on a unique session identifier allocated by the current payment session;

[0015] Generating a velocity vector sequence and an acceleration vector sequence by differential calculation based on a velocity vector calculation formula, based on pointer or touch point positions and corresponding time stamp information in the micro behavior dynamics data;

[0016] Applying a preset smoothing filter to the generated velocity vector sequence and acceleration vector sequence to eliminate sensor noise and measurement error;

[0017] The velocity vector calculation formula is:

[0018] In the formula, v k is an instantaneous velocity vector at the kth time point; p k is a position vector of the pointer or touch point at the kth time point, p k-1 is a position vector of the pointer or touch point at the (k-1)th time point; tk is a timestamp of the kth time point; t k-1 is a timestamp of the (k-1)th time point;

[0019] In the differential calculation by the velocity vector calculation formula, first, the instantaneous velocity vector at the kth time point obtained based on the velocity vector calculation formula generates a velocity vector sequence, and then the acceleration vector sequence is obtained by again performing differential calculation on the generated velocity vector sequence.

[0020] Preferably, in step S2, the step of inputting the micro-behavior dynamics data of the user's physical operation into a preset cognitive dynamics model for describing the human decision-making and motion control process for online inference comprises:

[0021] The coupled attractor network model and the stochastic differential equation model in the cognitive dynamics model are used to model the user's motion intention decision-making process and physical motion execution process, respectively;

[0022] An online filtering estimation algorithm is used to inversely solve the hidden variables in the cognitive dynamics model according to the micro-behavior dynamics data, the hidden variables including the cognitive load state of the user;

[0023] The cognitive parameters are generated based on the inversely solved cognitive load state, and the damping coefficient and noise intensity representing the motion control characteristics;

[0024] The stochastic differential equation model is:

[0025] dv(t) = [λ(M(t) - p(t)) - γ(C(t))v(t)]dt + σ(C(t))dW t ;

[0026] dv(t) represents the instantaneous change of the pointer or touch point velocity vector, λ is a scalar parameter representing the attraction intensity of the motion intention to the actual physical motion, M(t) is a hidden variable representing the time-varying motion intention vector inferred by the attractor network model, p(t) is the observable real-time position vector of the pointer or touch point, γ(C(t)) is a cognitive load-dependent damping coefficient, representing the viscous effect in motion, the higher the cognitive load, the greater the damping; v(t) is the observable real-time velocity vector of the pointer or touch point; σ(C(t)) is a control noise intensity dependent on the cognitive load, representing the precision of motion control, the higher the cognitive load, the greater the noise, the worse the fine control ability; C(t) is a core hidden variable representing the current cognitive load state of the user; dW t is a standard two-dimensional Wiener process to simulate the inherent randomness in the human nervous control system.

[0027] Preferably, in step S3, the step of constructing a hybrid state vector representing the unified state of the current payment session comprises:

[0028] The dimension values in the cognitive parameters of the macro transaction features and the user physical operation authenticity are normalized to eliminate the dimensional differences between different features;

[0029] The normalized macro transaction features and the cognitive parameters of the user physical operation authenticity are spliced into a vector to form a hybrid state vector with a unified dimension, wherein the hybrid state vector

[0030] In the formula, S t is the hybrid state vector at time point t, F macro_norm is the normalized macro transaction feature vector, P cog_norm is the normalized cognitive parameter vector, represents a splicing operation of vectors, which is used to connect two vectors end to end to form a longer vector;

[0031] A current timestamp is attached to the generated hybrid state vector to record the unified state snapshot of the payment session at a specific time.

[0032] Preferably, in step S4, the step of calculating a risk potential value representing the current instant risk comprises:

[0033] The transaction authenticity potential field is defined as a weighted superposition of the conventional risk potential field and the cognitive distortion potential field, corresponding to the macro transaction features and the cognitive parameters of the user physical operation authenticity, respectively;

[0034] The potential of the cognitive distortion potential field is quantified by calculating the deviation of the cognitive parameters of the user physical operation authenticity from a preset standard human behavior benchmark model;

[0035] Based on the risk potential value calculation formula, the potential of the conventional risk potential field and the potential of the cognitive distortion potential field are weighted and summed to obtain the final risk potential value;

[0036] The risk potential value calculation formula is:

[0037]

[0038] In the formula, E pot (S t ) is the final risk potential value determined by the hybrid state vector S t at time point t; is the normalized macro transaction feature vector a potential energy of the regular risk potential field determined, a normalized cognitive parameter vector a potential energy of the cognitive distortion potential field determined, w conv a weight coefficient of the regular risk potential field, w cog a weight coefficient of the cognitive distortion potential field.

[0039] Preferably, in step S5, the step of calculating the path tendency indicator representing the evolution direction of the risk comprises:

[0040] calculating a gradient vector of the transaction authenticity potential field at the point of the current mixed state vector based on each dimension feature constituting the mixed state vector, wherein the gradient vector is a gradient vector of the risk potential energy E with respect to the mixed state vector S t , and the partial derivative of each component constitutes a vector, wherein, is a gradient vector of the risk potential field at the state point S t , E is the risk potential energy existing as a function of the mixed state vector, S t is the mixed state vector at the time point t; s t,n is the nth dimension feature of the mixed state vector S t , n is a positive integer greater than 1;

[0041] obtaining a change amount of the current mixed state vector with respect to the previous mixed state vector to form a state change vector, wherein the state change vector is (S t -S t-1 );

[0042] obtaining a scalar value of the path tendency indicator by calculating an inner product of a negative direction of the gradient vector and the state change vector, wherein the scalar value of the path tendency indicator is:

[0043]

[0044] wherein, I trend (t) is the path tendency indicator at the time point t, is a negative direction of the gradient vector, pointing to the direction in which the risk potential energy decreases fastest; (S t -S t-1 ) is the state change vector, wherein S t-1 is the mixed state vector at the previous time point (t-1), and <·,·> represents the inner product operation of vectors.

[0045] Preferably, in step S6, the step of comprehensively detecting the security risk level of the current payment session comprises:

[0046] The risk potential value is compared with a first preset threshold, the accumulated value of the path trend index is compared with a second preset threshold, and the cognitive parameter of the user physical operation originality is compared with a preset normal range;

[0047] Based on the comprehensive risk score model, the security risk level of the current payment session is determined, wherein the security risk level includes three levels, namely low risk, medium risk and high risk, and the comprehensive risk score model is:

[0048] S CRS = w E ·f E (E pot ) + w T ·f T (I trend_acc ) + w C ·f C (P cog );

[0049] In the formula, S CRS is the final calculated comprehensive risk score, E pot is the risk potential value of the current instant risk, I trend_acc is the accumulated value of the path trend index, P cog is the cognitive parameter vector representing the originality of the user's physical operation, f E (·), f T (·) and f C (·) are scoring functions corresponding to risk potential, path trend and cognitive parameter respectively, w E , w T and w C are weight coefficients corresponding to risk potential, path trend and cognitive parameter respectively, and w E +w T +w C =1.

[0050] The comprehensive risk score S CRS obtained by calculation is compared with two-level risk division thresholds, and the security risk level of the current payment session is divided and determined, wherein the two-level risk division thresholds are set according to the security risk of different payment sessions;

[0051] According to the determined security risk level, a corresponding treatment strategy is executed on the current payment session, wherein the treatment strategy includes silent authorization, triggering multi-factor authentication and rejecting payment request, when the security risk level is low risk, the treatment strategy executed on the current payment session is silent authorization, when the security risk level is medium risk, the treatment strategy executed on the current payment session is triggering multi-factor authentication, and when the security risk level is high risk, the treatment strategy executed on the current payment session is rejecting payment request.

[0052] The application further provides an insurance online payment transaction security real-time detection system, comprising:

[0053] A data acquisition module is configured to acquire macro transaction features in a current payment session and micro behavior dynamics data representing physical operation of a user through a server and a client respectively;

[0054] A cognitive parameter generation module is configured to input the micro behavior dynamics data representing physical operation of the user into a preset cognitive dynamics model for online inference, and generate cognitive parameters representing original authenticity of the physical operation of the user;

[0055] A state vector construction module is configured to construct a hybrid state vector representing a unified state of the current payment session based on the acquired macro transaction features and the generated cognitive parameters;

[0056] A risk potential calculation module is configured to map the hybrid state vector of the unified state to a preset transaction authenticity potential field, and calculate a risk potential value representing a current instant risk;

[0057] A path trend analysis module is configured to calculate a path trend index representing an evolution direction of the risk based on a change amount of the hybrid state vector of the unified state over time and a gradient of the preset transaction authenticity potential field;

[0058] A risk level decision module is configured to comprehensively detect a security risk level of the current payment session according to the calculated risk potential value of the current instant risk and the path trend index of the evolution direction of the risk.

[0059] Preferably, the cognitive parameter generation module is further configured to an attractor network model in the preset cognitive dynamics model, and a position of a local minimum of the attractor network model is dynamically set according to an interactive interface element layout of a current payment page.

[0060] Preferably, the risk level decision module is further used for applying different risk sensitivities to different business scenarios according to the transaction amount or product type in the macro transaction feature dynamically adjusted, the accumulation of the path trend indicator, the weighted calculation in a sliding time window, and the higher weight given to the path trend indicator in a more recent time for detecting sudden fraud intention.

[0061] The application provides an insurance online payment transaction security real-time detection method and system.

[0062] 1. The application introduces a cognitive dynamics model, which deeply couples an attractor network and a stochastic differential equation, and this method deeply describes the authenticity of user behavior. Compared with the prior art, which mostly stays on the simple statistics of surface behavior data such as mouse speed and click interval, the application solves the problem that the surface features are easily simulated by advanced automated scripts and lack the essential distinguishing ability of whether the operator is a real human or a machine.

[0063] 2. The application constructs a multi-dimensional transaction authenticity potential field, which can not only calculate the 'risk potential value' of the current payment state, i.e., the static risk level, but also obtain a 'path trend indicator' by analyzing the moving trajectory of the state vector and the potential field gradient. Compared with the static risk scoring mechanism commonly used in the prior art, i.e., only weighting and summing various indicators at a certain time point to obtain an isolated score, the application solves the problem that the dynamic evolution process of the risk is blind and it is difficult to distinguish between a conversation that is moving towards danger and a conversation that is recovering from a suspicious state.

[0064] 3. The application realizes deep fusion and integrated representation of heterogeneous data originating from macro transaction environment and micro user behavior by constructing a unified hybrid state vector. This method normalizes the macro features describing the transaction background and the cognitive parameters characterizing the user's inner authenticity in the same mathematical framework, thereby constructing a feature space that can perform high-dimensional and multi-perspective state description on the payment conversation. Compared with the paradigm of the prior art that processes different dimensional risk data in a fragmented manner, the application solves the fundamental defect that it is difficult to effectively identify complex risk patterns emerging from cross-dimensional feature coupling. BRIEF DESCRIPTION OF DRAWINGS

[0065] Figure 1 The method step flowchart of the application;

[0066] Figure 2 The transaction authenticity potential field and risk evolution path schematic diagram of the application;

[0067] Figure 3 The deep user behavior authenticity identification method schematic diagram of the application;

[0068] Figure 4 The system architecture diagram of the present application. DETAILED DESCRIPTION

[0069] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the specification of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0070] Please refer to the drawings in the specification of the present application Figure 1 - the drawings in the specification of the present application Figure 3 The embodiment of the present application provides an insurance online payment transaction security real-time detection method, which comprises the following steps:

[0071] S1, acquiring macro transaction features in a current payment session and micro behavior dynamics data representing physical operation of a user through a server and a client respectively;

[0072] S2, inputting the micro behavior dynamics data representing physical operation of the user into a preset cognitive dynamics model used to describe human decision-making and motion control process for online inference, to generate cognitive parameters representing original authenticity of the physical operation of the user;

[0073] S3, taking the acquired macro transaction features and the generated cognitive parameters representing original authenticity of the physical operation of the user as inputs, to construct a hybrid state vector representing a unified state of the current payment session;

[0074] S4, mapping the hybrid state vector of the unified state into a preset transaction authenticity potential field, to calculate a risk potential value representing a current instant risk;

[0075] S5, based on a change amount of the hybrid state vector of the unified state over time and a gradient of the preset transaction authenticity potential field, calculating a path trend index representing an evolution direction of the risk;

[0076] S6, according to the calculated risk potential value of the current instant risk and the path trend index representing the evolution direction of the risk, comprehensively detecting a security risk level of the current payment session.

[0077] For step S1, in the embodiment, through application logic deployed on the server and the client, two types of core data in the current payment session are cooperatively acquired: macro transaction features, and micro behavior dynamics data representing physical operation of a user.

[0078] In particular, the acquisition of the macro-transaction features covers both the static context and the dynamic content of the transaction. In some embodiments, the server side is responsible for acquiring historical information strongly related to the user account, such as the user's credit rating, historical transaction frequency and amount range, and commonly used login devices and geographic locations. At the same time, the application program or web script on the client side is responsible for collecting real-time environmental and device information, such as the type and version of the current device's operating system, browser fingerprint, whether it is running in an emulator environment, and the current network's IP address and operator information. During the payment session, the system also captures the dynamic transaction content actively filled in by the user, mainly the type of insurance product to be insured and the premium amount.

[0079] In one possible implementation, in order to ensure that the data acquired from the server and the client, which are two different sources, can accurately correspond to the same payment session, the system generates and assigns a globally unique session identifier when the session starts. This unique session identifier is marked in both the macro-transaction feature log recorded by the server and the micro-behavior dynamics data packet uploaded by the client, thereby providing a reliable association binding for subsequent data fusion and analysis.

[0080] Micro-behavior dynamics data that can finely reflect the user's operation habits and physiological characteristics are collected. This is achieved by deploying a high-frequency monitoring script on the client interface, which continuously records each physical operation of the user with millisecond-level precision. The recorded pointer or touch point data includes screen coordinate position, corresponding timestamp information, and event type of interaction, such as mouse movement, click, scroll, or finger touch, swipe, release. For scenarios that require keyboard input, the press and release times of the keys are also recorded to analyze the rhythm characteristics of keyboard input.

[0081] After acquiring the original micro-behavior dynamics data, preliminary data preprocessing is needed to convert it into effective input for cognitive dynamics model analysis.

[0082] First, based on the collected continuous pointer or touch point position and corresponding timestamp information, the speed vector calculation formula is used for difference calculation to generate speed vector sequence and acceleration vector sequence representing kinematic characteristics. As an option, the speed vector calculation formula, i.e., the calculation of the speed vector sequence, can be represented by the following formula:

[0083]

[0084] In the formula, v k represents the instantaneous speed vector at the kth time point; p k represents the position vector of the pointer or touch point at the kth time point; p k-1represents the position vector of the pointer or touch point at the previous, i.e., the k-1th time point; t k represents the timestamp of the kth time point; t k-1 represents the timestamp of the k-1th time point.

[0085] The acceleration vector sequence is then obtained by again differentiating the generated velocity vector sequence, which is a quantification of the rate of change of velocity.

[0086] For step S2, in this embodiment, after obtaining and preprocessing the original data capable of representing the external environment of the payment session and the internal operation of the user, the internal driving source of the user's behavior is deeply mined through the user's operation representation in the physical world, a cognitive dynamics model used to describe the human decision-making and motion control process is established and solved to generate a set of cognitive parameters capable of quantitatively representing the authenticity of the user's physical operation. This step is a key link for distinguishing real human users from automated scripts or fraudsters.

[0087] In one possible implementation, the cognitive dynamics model is a complex, coupled mathematical model system, and the preset structure and reference parameters thereof are established by offline learning and calibration on a large amount of behavior data of real human users when performing online payment tasks. The model aims to mathematically reproduce the complete closed loop of "intention generation-motion execution" of humans when facing a goal-oriented task (such as online payment).

[0088] Specifically, the cognitive dynamics model internally couples two core sub-models to model user behaviors at different levels:

[0089] One is an attractor network model used to model the high-order, internal motion intention decision-making process of the user. In this model, each interactive element on the interface (such as an input box, a button) is abstracted as an attractor in a potential function, and the decision-making process of the user is simulated as the evolution process of motion intention in the potential field composed of these attractors.

[0090] The other is a stochastic differential equation model used to model the low-order motion execution process of the user for converting motion intention into specific physical operation. This model accurately describes the motion characteristics under the coordinated control of human arm-eye-brain, such as inherent delay, jitter, and stickiness.

[0091] As an option, the stochastic differential equation model can be represented by the following formula:

[0092] dv(t) = [λ(M(t) - p(t)) - γ(C(t))v(t)]dt + σ(C(t))dW t ;

[0093] dv(t) = λM(t) - γ(C(t))v(t) - σ(C(t))dW(t) where dv(t) represents the instantaneous change of the pointer or touch point velocity vector; λ is a scalar parameter representing the attraction strength of the motion intention to the actual physical motion; M(t) is a hidden variable representing the motion intention vector inferred by the attractor network model over time; p(t) is the observable real-time position vector of the pointer or touch point; γ(C(t)) is a damping coefficient dependent on the cognitive load, which represents the viscous effect in the motion, and the higher the cognitive load, the greater the damping; v(t) is the observable real-time velocity vector of the pointer or touch point; σ(C(t)) is a control noise intensity also dependent on the cognitive load, which represents the precision of motion control, and the higher the cognitive load, the greater the noise and the worse the fine control ability; C(t) is a core hidden variable representing the current cognitive load state of the user; dW t is a standard two-dimensional Wiener process to simulate the inherent randomness in the human neural control system.

[0094] In some embodiments, since multiple core variables of the model (such as motion intention M(t), cognitive load state C(t)) and some key parameters (such as damping coefficient γ(C(t)), noise intensity σ(C(t))) are hidden variables that cannot be directly observed, an online filtering estimation algorithm is used to infer these hidden variables in real time.

[0095] The online filtering estimation algorithm can be an extended Kalman filter or a particle filter, which continuously compares the actual observed micro-behavior dynamics data (position p(t) and velocity v(t)) with the predicted values of the model, and constantly corrects the estimation of the hidden variables according to the prediction error between the two, which is the process of inverse solving.

[0096] For step S3, in this embodiment, macro transaction features are obtained from two dimensions of external environment and user's internal state, and cognitive parameters representing the original authenticity of user's physical operation are generated. By fusing and normalizing these heterogeneous multi-source data, a mathematical object - hybrid state vector is constructed, which can comprehensively and unbiasedly represent the current payment session instantaneous state in a single framework.

[0097] Generally, by inputting two sets of heterogeneous data: one set is a macro transaction feature set describing the transaction background, and the other set is a cognitive parameter set depicting the essence of user behavior, through a series of processing, they are integrated into a standardized hybrid state vector with time sequence information.

[0098] To address the dimensional difference between different features, the step needs to normalize the values of each dimension in the macro-transaction features and cognitive parameters. Without this processing, some features with a large range of values (e.g., transaction amount) will dominate the model, while the effect of key features with a small range of values (e.g., cognitive load parameters) will be drowned out, leading to biased risk assessment.

[0099] As an option, the normalization process can use the min-max normalization method to linearly map the original feature values to the [0, 1] interval. The calculation process can be described by the following formula:

[0100]

[0101] In the formula, x' represents the normalized feature value; x represents the original feature value to be normalized; x norm represents the minimum value of the dimension feature in the preset reference data set or dynamic observation window; x min represents the maximum value of the dimension feature in the preset reference data set or dynamic observation window. max

[0102] In some embodiments, different normalization strategies can be used for different features. For example, for features that approximately follow a Gaussian distribution, the Z-score standardization method can also be used to make the mean value 0 and the standard deviation 1, so as to better handle the influence of abnormal values.

[0103] After all the relevant features are normalized to a unified and comparable scale, they are spliced into a vector. Specifically, the process is to connect the normalized macro-transaction feature vector and the cognitive parameter vector in a predetermined order, thereby forming a higher-dimensional, unified mixed state vector. This vector simultaneously encapsulates the external risk clues of the transaction and the internal authenticity indicators of the user behavior in a single data structure.

[0104] In one possible implementation, the structure of the mixed state vector S t can be represented as:

[0105]

[0106] In the formula, S t represents the mixed state vector at time point t; F macro_norm represents the normalized macro-transaction feature vector, which can include transaction amount, account history, device fingerprint, and other components; P cog_norm represents the normalized cognitive parameter vector, which includes cognitive load, motion damping coefficient, control noise intensity, and other components; ​Concatenation operation of representative vectors, i.e. concatenating two vectors head to tail to form a longer vector.

[0107] Finally, in order to track and analyze the dynamic evolution of the payment session state, a current timestamp is also attached to each newly generated hybrid state vector. This timestamp precisely records the time point corresponding to the unified state snapshot.

[0108] For step S4, in this embodiment, the transaction authenticity potential field is not a single, homogeneous field, but is defined as a weighted superposition of a conventional risk potential field and a cognitive distortion potential field. This structure enables the system to assess risk from two fundamentally different dimensions.

[0109] Specifically, the conventional risk potential field mainly responds to the macro-transaction feature components in the hybrid state vector. It reflects risk assessment based on traditional business rules, for example, a large transaction occurring on an unusual device at midnight will fall into a high potential energy region in this potential field.

[0110] The cognitive distortion potential field, on the other hand, specifically responds to the cognitive parameter components in the hybrid state vector. The construction of this potential field is one of the key innovations of the present application. It aims to quantify the degree of deviation between the user's current behavior and "standard trusted human behavior".

[0111] As an option, the system presets a standard human behavior benchmark model. This model is a "normal cluster" or "trusted domain" of cognitive parameters statistically derived from a large number of real, risk-free user payment operation data collected in a controlled environment. Thus, the potential energy of the cognitive distortion potential field is quantified as the deviation of the current user's cognitive parameter point from the center of this trusted domain. The farther the deviation, the more abnormal the user's behavior pattern, and the higher the potential energy value of the cognitive distortion potential field.

[0112] In one possible implementation, the final risk potential energy value is obtained by weighted summation of the potential energies of the above two potential fields. The risk potential energy value E pot (S t ) can be calculated as follows:

[0113]

[0114] where E pot (S t ) represents the final instantaneous risk potential energy value determined by the hybrid state vector S t at time point t; represents the potential energy of the conventional risk potential field determined by the normalized macro-transaction feature vector ; it can be the output of a pre-trained risk scoring model (such as logistic regression or neural network); represent the cognitive parameter vector after normalization the potential energy of the cognitive distortion potential field determined by the cognitive parameter vector; the value is proportional to the distance (e.g. Mahalanobis distance) between the current cognitive parameter point and the center of the standard human behavior benchmark model; w conv is the weight coefficient assigned to the regular risk potential field; w cog is the weight coefficient assigned to the cognitive distortion potential field.

[0115] In some embodiments, the weight coefficients w conv and w cog sum up to 1, and their specific values can be dynamically configured according to different insurance payment scenarios. For example, in the small renewal scenario, the weight w cog of the cognitive distortion potential field can be adjusted to be higher, because the authenticity of the user's behavior is critical at this time; while in the first large premium payment scenario, the weight w conv of the regular risk potential field can be appropriately increased to strengthen the review of the transaction background.

[0116] For step S5, in the embodiment, a path trend indicator capable of representing the evolution direction of the risk is calculated by analyzing the motion trajectory of the payment state in the risk potential field, so as to realize the upgrade from "static snapshot" to "dynamic prediction".

[0117] Generally, the core idea of the present step is to analogize the multi-dimensional state space composed of the mixed state vector as a geographical terrain with "mountains" and "basins", in which the risk potential value is the altitude. By calculating the relationship between the moving direction of the state point on the terrain and the terrain slope of the point, it is determined whether the payment session is moving towards a safer "basin" or sliding towards a more dangerous "mountain".

[0118] First, in order to determine which direction the risk grows fastest near the current state point, the present step needs to calculate the gradient vector of the transaction authenticity potential field at the point where the mixed state vector is located.

[0119] In one possible implementation, the calculation of the gradient vector is based on each dimension feature constituting the mixed state vector. The gradient vector is defined as the partial derivative of the risk potential function E with respect to each component of the mixed state vector S t :

[0120]

[0121] In the formula, g represents the gradient vector of the risk potential field at the state point S t ; E is the defined risk potential function which exists as a function of the mixed state vector; S tis the mixed state vector at time point t; s t,n represents the mixed state vector S t is the n-th component feature of the mixed state vector S

[0122] In particular, the system obtains the mixed state vector at the current time point, and compares it with the mixed state vector at the previous time point. As an option, by subtracting the mixed state vector at the previous time point from the mixed state vector at the current time point, a state change vector can be obtained. This vector precisely describes the moving direction and distance of the payment session state in the multi-dimensional space within the latest time interval.

[0123] The core of this process is to judge the consistency between the actual moving direction of the state and the direction of the fastest risk reduction. The direction of the fastest risk reduction is the negative direction of the gradient vector

[0124] In some embodiments, by calculating the inner product of the negative direction of the gradient vector and the state change vector, a scalar value as the path trend indicator I trend can be obtained. The path trend indicator I

[0125]

[0126] In the formula, I trend (t) represents the path trend indicator calculated at time point t; is the negative direction of the gradient vector, pointing to the direction of the fastest risk reduction; (S t -S t-1 ) is the aforementioned state change vector, where S t-1 is the mixed state vector at the previous time point; <·,·> represents the inner product (dot product) operation of vectors.

[0127] The scalar value of the path trend indicator has a clear business meaning: if it is positive, it indicates that the angle between the state change vector and the risk reduction direction is less than 90 degrees, meaning that the current payment session is evolving towards a safer state; if it is negative, it indicates that the session state is evolving towards a higher risk direction, constituting a potential early warning signal; if its value is close to zero, it indicates that the moving direction of the session state is roughly parallel to the equipotential line of the risk potential field, and the risk level tends to be stable in the short term.

[0128] For step S6, in this embodiment, a comprehensive decision is made according to the calculated risk potential value and the path trend indicator, so as to detect the final security risk level of the current payment session, and provide clear instructions for the payment system to execute the corresponding handling strategy, thus constituting a complete closed-loop payment security protocol of "perception-analysis-decision-execution".

[0129] Generally, through a multi-dimensional comparison and decision process, the continuous numerical indicators are converted into discrete risk levels with clear business meanings.

[0130] In a possible implementation, the comprehensive detection process first performs a series of parallel comparison operations. Specifically, the system compares the currently calculated risk potential value with a preset first preset threshold, which defines the static level of acceptable risk. At the same time, the system compares the cumulative value of the path trend indicator within a sliding time window with a second preset threshold, to evaluate whether the overall evolution direction of the risk in a period of time is towards safety or danger.

[0131] As an option, the cumulative value of the path trend indicator can be a weighted cumulative value, giving higher weight to indicators that are more recent in time, so as to be more sensitive to the recent risk change trend. In addition, the system also compares the generated cognitive parameter of the physical operation source authenticity of the user with its preset normal range, to determine whether the user behavior is abnormal at the cognitive level. The normal range is a multi-dimensional space based on a large amount of real user data statistics.

[0132] After the above multi-dimensional comparison is completed, the discrete comparison results are fused into a final risk level through a preset decision rule combination.

[0133] In some embodiments, the decision rule can be embodied as the calculation of a comprehensive risk score model. The comprehensive risk score S CRS is calculated by the following formula:

[0134] S CRS = w E · f E (E pot ) + w T · f T (I trend_acc ) + w C · f C (P cog );

[0135] In the formula, S CRS represents the finally calculated comprehensive risk score; E pot is the risk potential value of the current instant risk; I trend_accis the cumulative value of the path trend indicator; P cog is the cognitive parameter vector representing the user's physical operation source authenticity; f E (·), f T (·), f C (·) are the scoring functions corresponding to risk potential, path trend and cognitive parameter respectively; these functions compare the input values with the corresponding preset threshold or normal range and output a normalized score; for example, when the input value exceeds the threshold or deviates from the normal range, a higher score is output; w E ,w T ,w C are the weight coefficients corresponding to the three risk dimensions, the sum of which is 1, and these weights can be dynamically configured according to the payment scenarios of different insurance products to adjust the importance of different risk factors in the final decision.

[0136] The calculated comprehensive risk score S CRS is compared with the two-level risk classification threshold, and the security risk level of the current payment session is determined as one of low risk, medium risk or high risk.

[0137] According to the determined security risk level, this step will trigger the payment system to execute the corresponding disposal strategy. The design of these strategies aims to balance the risk level and user experience.

[0138] For payment sessions determined to be "low risk", the system will execute a silent authorization strategy, and the payment process will pass through without disturbing the user, ensuring a smooth payment experience.

[0139] For sessions determined to be "medium risk", the system will execute a strategy that triggers multi-factor authentication. This may include requiring the user to enter a dynamic verification code received through SMS, perform fingerprint or facial recognition, or confirm the transaction on another trusted device as additional verification of the user's identity.

[0140] For sessions determined to be "high risk", the system will execute the most stringent disposal strategy, i.e. directly rejecting this payment request, and may optionally perform additional security operations such as temporarily freezing account payment functions, recording fraud events for subsequent audit, and sending risk alert notifications to real users through reserved security channels.

[0141] The insurance online payment transaction security real-time detection system described below can be correspondingly referred to the insurance online payment transaction security real-time detection method described above.

[0142] Please refer to the accompanying Figure 4 , the present application also provides an insurance online payment transaction security real-time detection system, comprising:

[0143] a data acquisition module configured to acquire, by a server and a client respectively, macro transaction features in a current payment session and micro behavior dynamics data representing physical operations of a user;

[0144] a cognitive parameter generation module configured to input the micro behavior dynamics data representing the physical operations of the user into a preset cognitive dynamics model for online inference to generate cognitive parameters representing original authenticity of the physical operations of the user;

[0145] a state vector construction module configured to construct a hybrid state vector representing a unified state of the current payment session based on the acquired macro transaction features and the generated cognitive parameters;

[0146] a risk potential calculation module configured to map the hybrid state vector of the unified state to a preset transaction authenticity potential field to calculate a risk potential value representing a current instant risk;

[0147] a path trend analysis module configured to calculate a path trend index representing an evolution direction of the risk based on a change amount of the hybrid state vector of the unified state over time and a gradient of the preset transaction authenticity potential field;

[0148] a risk level decision module configured to comprehensively detect a security risk level of the current payment session according to the calculated risk potential value of the current instant risk and the path trend index of the evolution direction of the risk.

[0149] Specifically, the data acquisition module is a data inlet of the entire system. It captures two types of key information in the current payment session in parallel and in real time through probes or interfaces deployed on the client side (such as a webpage or a mobile application) and the server side: one is macro transaction features that can reflect transaction background and attributes, such as transaction amount, insurance product category, user historical behavior, device fingerprint, and IP address; the other is micro behavior dynamics data that can finely depict the actual operation process of the user, such as the moving track, speed, acceleration of the mouse or finger, and the input rhythm of the keyboard.

[0150] The cognitive parameter generation module is one of the core analysis units of the system, responsible for extracting deep cognitive states from original user behavior data. It receives the micro behavior dynamics data from the data acquisition module and inputs it into a preset cognitive dynamics model that can describe the process of human decision-making and motion control. Through online inference and reverse solving, the module can generate a set of cognitive parameters representing the original authenticity of the physical operations of the user, such as the cognitive load of the user, the damping coefficient of motion control, and the noise intensity.

[0151] In some preferred embodiments, the cognitive dynamics model adopted by the module is highly adaptable. The cognitive parameter generation module is also used for an attractor network model in the preset cognitive dynamics model, and a position of a local minimum of the attractor network model is dynamically set according to a layout of the interactive interface elements of the current payment page.

[0152] Specifically, the position of the local minimum of the attractor network model in the model is dynamically set according to the real-time layout of the interactive interface elements (such as input boxes, buttons) of the current payment page. This enables the model to accurately adapt to payment pages of different structures, even dynamic changes, ensuring the accuracy of intent inference.

[0153] The state vector construction module is used for data fusion and standardization. It receives the macro transaction features from the data acquisition module and the cognitive parameters generated by the cognitive parameter generation module. After normalization processing of the two types of data with different sources and dimensions, the mixed state vector that can uniformly represent the overall picture of the current payment session is constructed by vector splicing, and a timestamp is attached to the vector.

[0154] The risk potential calculation module is used for static quantification of the current risk. It maps the mixed state vector generated by the state vector construction module to a preset multi-dimensional transaction authenticity potential field. By calculating the potential of the position of the vector in the potential field, a risk potential value that can represent the current instant risk is obtained.

[0155] The path trend analysis module is responsible for evaluating the dynamic evolution direction of the risk. It calculates a scalar form of the path trend index based on the change amount of the mixed state vector over time and the gradient of the transaction authenticity potential field at the current state point. The index can indicate whether the current payment session is developing in a safer direction or sliding into a more dangerous state.

[0156] The risk level decision module is also used for dynamically adjusting the risk sensitivity for different business scenarios according to the transaction amount or product type in the macro transaction features, and applying differentiated risk sensitivity for different business scenarios. The accumulation of the path trend index is calculated by weighting in a sliding time window, and the path trend index closer in time is given a higher weight for detection of sudden fraud intent.

[0157] The risk level decision module, as the final decision outlet of the system, makes a comprehensive decision according to the "static" risk value output by the risk potential calculation module and the "dynamic" trend index output by the path trend analysis module, determines the security risk level (such as low, medium, and high risk) of the current payment session, and triggers the corresponding disposal strategy. In a specific embodiment, the decision logic of the module is dynamic and has business scenario adaptability. On the one hand, the sensitivity of its risk determination will be dynamically adjusted according to the transaction amount or product type in the macro transaction characteristics, so as to apply differentiated risk control strategies for different business scenarios. On the other hand, in order to be able to sensitively capture the sudden fraud intention, the module does not simply sum up the path trend indexes, but performs a weighted calculation through a sliding time window, in which the path trend indexes that are more recent in time are given higher weights, so that the system is particularly sensitive to the recent risk evolution trend.

[0158] The system of the embodiment can be used to execute the method embodiments described above, and has similar principles and technical effects, which will not be described here again.

[0159] Although the embodiments of the present application have been shown and described, it can be understood by those skilled in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for real-time security detection of online insurance payment transactions, characterized in that, Includes the following steps: S1. Obtain macro-level transaction characteristics and micro-level behavioral dynamics data representing the user's physical operations in the current payment session through the server and client respectively; S2. Input the micro-behavioral dynamics data of the user's physical operation into a preset cognitive dynamics model used to describe the human decision-making and motion control process for online inference, and generate cognitive parameters that characterize the original authenticity of the user's physical operation. S3. Using the obtained macro transaction characteristics and the generated cognitive parameters of the authenticity of the user's physical operation as input, construct a hybrid state vector representing the unified state of the current payment session; S4. Map the hybrid state vector of the unified state to the preset transaction authenticity potential field, and calculate the risk potential value that represents the current real-time risk. S5. Based on the change of the hybrid state vector of the unified state over time and the gradient of the preset transaction authenticity potential field, calculate the path trend index that characterizes the direction of risk evolution. S6. Based on the calculated risk potential value of the current real-time risk and the path trend index of the risk evolution direction, comprehensively detect the security risk level of the current payment session; In step S2, the step of inputting the microscopic behavioral dynamics data of the user's physical operations into a preset cognitive dynamics model used to describe the human decision-making and motion control process for online inference includes: By utilizing the coupled attractor network model and stochastic differential equation model in the cognitive dynamics model, the user's motion intention decision-making process and physical motion execution process are modeled respectively. An online filtering estimation algorithm is used to solve the latent variables in the cognitive dynamics model in reverse based on micro-behavioral dynamics data. The latent variables include the user's cognitive load state. The cognitive parameters are generated based on the cognitive load state obtained by inverse solving, as well as the damping coefficient and noise intensity characterizing motion control. The stochastic differential equation model is as follows: ； In the formula, Characterizes the instantaneous change in the velocity vector of the pointer or touch point. A scalar parameter characterizing the strength of the attraction of the intended motion on the actual physical motion. These are latent variables that characterize the time-varying motion intention vector inferred from the attractor network model. It is the real-time position vector of an observable pointer or touch point. It is a damping coefficient that depends on cognitive load and characterizes the viscous effect in motion; the higher the cognitive load, the greater the damping. It is the real-time velocity vector of an observable pointer or touch point; The intensity of control noise depends on cognitive load, which characterizes the accuracy of motion control. The higher the cognitive load, the greater the noise and the worse the fine control capability. The core latent variable characterizing the user's current cognitive load state; It is a standard two-dimensional Wiener process used to simulate the inherent randomness in the human neural control system.

2. The real-time detection method for online insurance payment transaction security according to claim 1, characterized in that, In step S1, the step of obtaining the macro transaction characteristics of the current payment session through the server and client respectively includes: By using the unique session identifier assigned in the current payment session, the macroscopic transaction characteristics obtained by the server are associated and bound with the microscopic behavioral dynamics data obtained by the client; Based on the pointer or touch point position and corresponding timestamp information in the micro-behavioral dynamics data, a velocity vector sequence and an acceleration vector sequence are generated by differential calculation using the velocity vector calculation formula. A preset smoothing filter is applied to the generated velocity vector sequence and acceleration vector sequence to eliminate sensor noise and measurement error; The formula for calculating the velocity vector is as follows: ; In the formula, For the first The instantaneous velocity vector at each time point; For the first The position vector of the pointer or touch point at each time point For the first The position vector of the pointer or touch point at each time point; For the first A timestamp at a specific point in time; For the first A timestamp at a specific point in time; When performing differential calculations using the velocity vector calculation formula, the first step is to obtain the result based on the velocity vector calculation formula. The instantaneous velocity vectors at each time point are used to generate a velocity vector sequence, and then the acceleration vector sequence is obtained by performing differential calculations on the generated velocity vector sequence again.

3. The real-time detection method for online insurance payment transaction security according to claim 1, characterized in that, In step S3, the step of constructing a hybrid state vector representing the unified state of the current payment session includes: Normalize the values ​​of each dimension in the cognitive parameters of macro trading characteristics and the authenticity of the user's physical operation to eliminate the differences in the units of measurement between different characteristics. The normalized macro-transaction characteristics are concatenated with the cognitive parameters of the user's physical operation authenticity to form a unified-dimensional hybrid state vector. ; In the formula, For time points The mixed state vector, This is the normalized macroeconomic transaction feature vector. This is the normalized cognitive parameter vector. The vector concatenation operation is used to join two vectors end-to-end to form a longer vector. A current timestamp is appended to the generated hybrid state vector to record a unified state snapshot of the payment session at a specific moment.

4. The real-time detection method for online insurance payment transaction security according to claim 1, characterized in that, In step S4, the step of calculating the risk potential energy value characterizing the current immediate risk includes: The transaction authenticity potential field is defined as a weighted superposition of the conventional risk potential field and the cognitive distortion potential field, which respectively correspond to the cognitive parameters of the macro transaction characteristics and the original authenticity of the user's physical operation. The potential energy of the cognitive distortion potential field is quantified by calculating the degree of deviation between the cognitive parameters of the authenticity of the user's physical operation and the preset standard human behavior benchmark model. Based on the risk potential energy calculation formula, the potential energy of the conventional risk potential field and the potential energy of the cognitive distortion potential field are weighted and summed to obtain the final risk potential energy value. The formula for calculating the risk potential energy value is as follows: ； In the formula, For at a certain point in time From the mixed state vector The final risk potential value determined; The normalized macroeconomic trading feature vector The potential energy of the determined conventional risk potential field. For the normalized cognitive parameter vector The potential energy of the cognitive distortion potential field that determines the outcome. These are the weighting coefficients for the conventional risk potential field. The weighting coefficients are for the cognitive distortion potential field.

5. The real-time detection method for online insurance payment transaction security according to claim 1, characterized in that, Step S5, the step of calculating the path trend index characterizing the direction of risk evolution, includes: Based on the features of each dimension constituting the mixed state vector, the gradient vector of the transaction authenticity potential field at the current point of the mixed state vector is calculated, where the gradient vector... Risk potential energy For the mixed state vector The vector formed by the partial derivatives of each component. In the formula, For the risk potential energy field at state point gradient vector, It is the risk potential energy that exists as a hybrid state vector function. For at a certain point in time The mixed state vector; The mixed state vector The Each component feature, It is a positive integer greater than 1; Obtain the change in the current mixed state vector relative to the mixed state vector at the previous time step to form a state change vector, wherein the state change vector is... ; By calculating the dot product of the negative direction of the gradient vector and the state change vector, a scalar value is obtained as the path trend indicator, wherein the scalar value of the path trend indicator is: ； In the formula, For at a certain point in time Path trend indicators The negative direction of the gradient vector points in the direction where the risk potential energy decreases the fastest; Let be the state change vector, where It was the previous moment The mixed state vector, This represents the inner product operation of vectors.

6. The real-time detection method for online insurance payment transaction security according to claim 1, characterized in that, In step S6, the step of comprehensively detecting the security risk level of the current payment session includes: The risk potential value is compared with the first preset threshold, the cumulative value of the path trend indicator is compared with the second preset threshold, and the cognitive parameter of the authenticity of the user's physical operation is compared with the preset normal range. Based on a comprehensive risk scoring model, the security risk level of the current payment session is determined. This security risk level includes three levels: low risk, medium risk, and high risk. The comprehensive risk scoring model is as follows: ； In the formula, The final calculated comprehensive risk score, This represents the current risk potential value. This is the cumulative value of the path trend indicator. A cognitive parameter vector characterizing the original authenticity of the user's physical operations. , and These are the scoring functions corresponding to risk potential, path trend, and cognitive parameters, respectively. , and These are the weighting coefficients corresponding to risk potential, path trend, and cognitive parameters, respectively. ; The calculated comprehensive risk score The security risk level of the current payment session is determined by comparing it with the two-level risk classification threshold, wherein the two-level risk classification threshold is set according to the security risk of different payment sessions. Based on the determined security risk level, a corresponding handling strategy is executed for the current payment session. This strategy includes silent authorization, triggering multi-factor authentication, and rejecting the payment request. When the security risk level is low, the handling strategy for the current payment session is silent authorization; when the security risk level is medium, the handling strategy for the current payment session is to trigger multi-factor authentication; and when the security risk level is high, the handling strategy for the current payment session is to reject the payment request.

7. A real-time security detection system for online insurance payment transactions, applied to the real-time security detection method for online insurance payment transactions as described in any one of claims 1-6, characterized in that, include: The data acquisition module is used to acquire macro-level transaction characteristics and micro-level behavioral dynamics data representing the user's physical operations in the current payment session through the server and client, respectively. The cognitive parameter generation module is used to input the micro-behavioral dynamics data of the user's physical operation into a preset cognitive dynamics model for online inference, and generate cognitive parameters that characterize the original authenticity of the user's physical operation. The state vector construction module is used to construct a hybrid state vector representing the unified state of the current payment session based on the acquired macro transaction features and the generated cognitive parameters. The risk potential energy calculation module is used to map the mixed state vector of the unified state to a preset transaction authenticity potential field and calculate the risk potential energy value that represents the current real-time risk. The path trend analysis module is used to calculate a path trend indicator that characterizes the direction of risk evolution based on the change of the mixed state vector of the unified state over time and the gradient of the preset transaction authenticity potential field. The risk level decision module is used to comprehensively detect the security risk level of the current payment session based on the calculated risk potential value of the current real-time risk and the path trend index of the risk evolution direction.

8. The real-time detection system for online insurance payment transaction security according to claim 7, characterized in that, The cognitive parameter generation module is also used in the attractor network model in the preset cognitive dynamics model. The location of the local minimum value of the attractor network model is dynamically set according to the layout of the interactive interface elements of the current payment page.

9. The real-time detection system for online insurance payment transaction security according to claim 7, characterized in that, The risk level decision module is also used to dynamically adjust the risk sensitivity for different business scenarios based on the transaction amount or product type in the macro transaction characteristics. The cumulative path trend indicators are calculated by weighting within a sliding time window, and path trend indicators that are more recent in time are given higher weights, which is used to detect sudden fraudulent intentions.

Images