Information security detection method and system based on artificial intelligence, terminal and medium

Abstract

The invention relates to an information security detection method and system based on artificial intelligence, a terminal and a medium, and belongs to the technical field of information processing.The information security detection method comprises the steps that when a transaction event occurs, transaction key fields after data desensitization are captured; generating a behavior vector according to the transaction key field; analyzing the user portrait to obtain user information; loading a corresponding transaction rule set from a local knowledge base according to the user information; according to the behavior vector and a set transaction rule in the transaction rule set, obtaining an accumulated risk score of the transaction; judging whether the accumulated risk score is greater than a risk threshold value or not; if yes, triggering early warning, freezing the transaction, and recording an event log; and if not, releasing the transaction. The method and the device have the beneficial effect of comprehensively and objectively evaluating the risk degree of the transaction.

Description

Technical Field

[0001] This application relates to the field of information processing technology, and in particular to an information security detection method, system, terminal and medium based on artificial intelligence. Background Technology

[0002] With the rapid development of technology, payment technology has made significant progress, and online financial transactions, due to their convenience and efficiency, have gradually become the mainstream transaction method in people's daily lives. Whether it's personal daily consumption and investment management, or business dealings between enterprises, all rely heavily on online financial transactions. However, the prosperity of online financial transactions has also brought numerous security challenges, such as cyberattacks and hacking intrusions. These threats can lead to serious consequences such as the leakage of user transaction information, theft of funds, and transaction tampering, causing huge losses to users and financial institutions. Therefore, it is particularly important for financial institutions and third-party trading platforms to monitor online financial transactions and test the information security during the transaction process.

[0003] Traditional information security testing commonly employs several methods. One is manual review based on expert experience, where professional security personnel use their knowledge and experience to examine and judge transaction data one by one, looking for anomalies. This method relies on the subjective judgment of professionals, is poorly adaptable to complex and ever-changing transaction scenarios, and is inefficient, making it difficult to handle large-scale transaction data. Another method is detection based on fixed rule matching, which pre-sets some explicit rules, and judges transaction data as abnormal when it meets these rules. For example, setting upper and lower limits for transaction amounts, and exceeding these limits is considered an abnormal transaction. However, this method can only handle some common, well-defined anomalies, and often struggles to effectively identify newly emerging and complex anomaly patterns.

[0004] Neither manual review based on expert experience nor matching based on fixed rules can comprehensively and objectively assess the risk level of a transaction, which can easily lead to the overlooking of potential risky transactions, thereby causing economic losses and security threats to both parties. Summary of the Invention

[0005] In order to comprehensively and objectively assess the risk level of a transaction, this application provides an information security detection method, system, terminal, and medium based on artificial intelligence.

[0006] Firstly, this application provides an information security detection method based on artificial intelligence, employing the following technical solution: An information security detection method based on artificial intelligence includes: When a transaction event occurs, capture the key transaction fields after data anonymization; Generate a behavior vector based on the aforementioned key transaction fields; Analyze user profiles to obtain user information; Based on the user information, load the corresponding set of transaction rules from the local knowledge base; Based on the behavior vector and the set of trading rules in the trading rule set, the cumulative risk score of the transaction is obtained; Determine whether the cumulative risk score is greater than the risk threshold; If so, an alert will be triggered, the transaction will be frozen, and the event log will be recorded. If not, the transaction will be allowed.

[0007] By employing the aforementioned technical solution, capturing anonymized key transaction fields before a transaction event occurs prevents sensitive information from being exposed during the detection phase, reducing the likelihood of data leakage. By capturing these anonymized key transaction fields, discrete transaction features are transformed into multi-dimensional behavioral vectors, quantifying abnormal patterns in user behavior. Parsing user profiles and loading corresponding transaction rule sets from a local knowledge base ensures the detection method aligns with users' actual trading habits and risk characteristics. Then, combining the transaction rule set, a cumulative risk score is obtained, quantitatively assessing transaction risk and avoiding errors caused by subjective judgment in traditional methods. This allows for a comprehensive and objective evaluation of the transaction's risk level. The transaction rule set in the local knowledge base can be updated and adjusted in real-time based on actual transaction conditions and risk status, ensuring the generated risk score better reflects the true risk level of the current transaction. When the cumulative risk score exceeds a risk threshold, the system can promptly trigger an alert and freeze the transaction, preventing potentially risky transactions from continuing, reducing potential economic losses and security threats, and minimizing risk. Simultaneously, event logs are recorded, providing detailed records for subsequent risk analysis and investigation. This helps to identify potential security risks and their sources, preventing similar risk events from recurring. For transactions with a cumulative risk score less than or equal to the risk threshold, the system automatically allows them to proceed, ensuring that normal transactions can be completed smoothly. Excessive security checks do not lead to cumbersome or inefficient transaction processes, thus balancing transaction security with smoothness and efficiency.

[0008] Optionally, the information security detection method further includes: Get the real-time false alarm rate; Obtain the false alarm difference between the target false alarm rate and the real-time false alarm rate; The risk threshold is dynamically adjusted based on the false alarm difference.

[0009] By adopting the above technical solution, acquiring the real-time false alarm rate, calculating the difference between it and the target false alarm rate, and then dynamically adjusting the risk threshold based on this difference, the system can continuously adapt to the actual trading environment. By rapidly integrating the latest risk information into the detection mechanism, the system can promptly grasp the dynamic changes in risk, thereby improving its ability to respond to emerging risks.

[0010] Optionally, the transaction rule set includes transaction frequency rules, transaction amount rules, and transaction location rules; The steps prior to obtaining the cumulative risk score include: Obtain network latency parameters; Determine whether the network latency parameter is greater than the dynamic latency threshold; If the network latency parameter is greater than the dynamic latency threshold, a simplified mode is activated, and a risk value is generated based on the current transaction amount and the average of the user's historical transaction amounts. Determine whether the number of transactions per unit time exceeds the frequency threshold; If so, then generate a frequency compensation factor; Based on the frequency compensation factor and the risk value, output the cumulative risk score; If the network latency parameter is less than or equal to the dynamic latency threshold, then obtain the device battery percentage; Determine whether the device's battery percentage is less than a set battery threshold; If so, then activate low-power mode and read the most recent valid location coordinates from the local cache; Risk factor for obtaining the most recent valid location coordinates; Based on the risk coefficient, the risk value corresponding to the transaction frequency rule, and the risk value corresponding to the transaction amount rule, a cumulative risk score is output.

[0011] By adopting the above technical solution, when the latency exceeds the dynamic threshold, the system automatically switches to simplified mode, relying solely on comparing the real-time transaction amount with the historical average to generate a risk value. This risk value is then corrected using a frequency compensation factor to prevent risk control failure due to network latency and ensure a high interception rate for high-risk transactions. In low-power conditions, the system reads the most recent location coordinates from the local cache and overlays them with risk values ​​based on transaction frequency and amount rules to ensure that geographical location risks are still considered for interception even in offline or weak network environments.

[0012] Optionally, the step of loading the corresponding transaction rule set from the local knowledge base based on the user information includes: Obtain the number of historical transactions from the user information; Determine whether the number of historical transactions exceeds a set number; If so, a personalized transaction rule set is generated based on the user information; If not, then based on the user's place of residence and age information, retrieve the latest set of transaction rules for the same region and age group.

[0013] By adopting the above technical solution, when the number of historical transactions in the acquired user information exceeds a set limit, users with frequent transactions often have unique transaction patterns and risk characteristics. Therefore, personalized rule sets can more accurately reflect the risk profile of a user's transaction behavior. If the number of transactions is less than or equal to the set limit, the system can refer to the transaction rule sets of users in the same region and age group to comprehensively consider these common factors from a macro perspective, improving the accuracy of risk assessment for this group of users. This differentiated processing based on transaction frequency, employing different rule generation and retrieval methods for users with different transaction frequencies, allows the information security detection system to flexibly adapt to diverse user groups.

[0014] Optionally, the step of generating a personalized transaction rule set based on the user information includes: Calculate the user's current transaction security value based on the user information; From the transaction rule base, find the first set of alternative transaction rules corresponding to historical transaction security values ​​that are greater than the current transaction security value; From the first set of candidate trading rules, select a second set of candidate trading rules whose safety error is less than the error threshold. ; Obtain the average safety value of the second set of alternative transaction rules; Determine whether there exists a target historical transaction security value in the transaction rule base that is closest to the average security value; If so, a personalized transaction rule set is generated based on the transaction rule set corresponding to the target historical transaction security value; If not, a personalized set of trading rules is generated based on the second alternative set of trading rules.

[0015] By employing the aforementioned technical solution, the current transaction security value of a user can be calculated to accurately assess the security status of that user's current transactions. Based on this, transaction rules are filtered to ensure that the final personalized transaction rule set highly matches the user's actual security needs, effectively reducing transaction risks and protecting transaction funds and information security. The process involves first identifying a first set of candidate transaction rules with a security value greater than the current transaction security value, then filtering from this set to a second set of candidate rules with a security error less than a threshold, gradually narrowing the rule selection range. This layered filtering method avoids blindly searching the entire transaction rule base, improving filtering efficiency and reducing system resource consumption. The average security value of the second set of candidate transaction rules is obtained, and it is determined whether the transaction rule base contains a target historical transaction security value that is closest to it. This method comprehensively considers the security status of multiple candidate rules, avoiding the one-sidedness of a single rule and ensuring the rationality and effectiveness of the final personalized transaction rule set. Different methods are used to generate personalized transaction rule sets depending on whether a target historical transaction security value exists. This flexible processing mechanism can adapt to various situations, ensuring that appropriate transaction rules are generated in different scenarios.

[0016] Optionally, the steps prior to triggering the warning include: From the false alarm statistics database, find the number of errors corresponding to historical risk scores that match the cumulative risk score; Calculate the average number of errors based on the number of errors mentioned above; Determine whether the average error count is greater than the count threshold; If so, an alert will be triggered.

[0017] By employing the above technical solution, and by searching the historical risk scores that match the cumulative risk scores in the false alarm statistics database, the current warning situation can be analyzed using past data. Historical data reflects the false alarm patterns under similar risk scores, providing an important reference for judging whether the current warning is a false alarm, avoiding blindly triggering warnings based solely on current data, and reducing the possibility of false alarms. The average number of errors is calculated and compared with a threshold. If the average number of errors is greater than the threshold, it indicates that false alarms are more frequent under similar risk scores. In this case, triggering a warning should be more cautious, thereby reducing unnecessary warning triggers and making the warning system more accurate. Combining the current cumulative risk score with historical false alarm data allows for a comprehensive assessment of the necessity of triggering a warning; it considers both the current risk situation and historical false alarm patterns under similar or identical risk scores, making warning decisions more comprehensive and accurate, and enabling more precise identification of situations that truly require warnings.

[0018] Optionally, the step of determining whether the average error count is greater than the count threshold further includes: If not, then calculate the comprehensive risk transaction value based on the accumulated risk score and the current transaction security value; Obtain the actual difference between the comprehensive risk transaction value and the risk transaction threshold; Determine whether the actual difference is less than the difference threshold; If not, an alert will be triggered; If so, the transaction is allowed, and a risk marker is applied.

[0019] By adopting the above technical solution, when the average number of errors does not exceed the threshold, a comprehensive risk transaction value can be calculated by combining the cumulative risk score and the current transaction security value, enabling a comprehensive assessment of transaction risk from multiple dimensions. The actual difference between the comprehensive risk transaction value and the risk transaction threshold is obtained and compared with the threshold, achieving dynamic monitoring of transaction risk and flexible adjustment of early warning strategies. Different trading scenarios and environments present varying degrees of risk and changes. This dynamic judgment mechanism determines whether to trigger an early warning based on the actual risk difference, making early warnings more accurate and effectively addressing various complex transaction risks, ensuring transaction security and stability. During the judgment process, if the actual difference is not less than the threshold, an early warning is triggered; if the actual difference is less than the threshold, the transaction is allowed, avoiding unnecessary intervention due to an overly sensitive early warning mechanism. By marking allowed transactions with risk, both transaction traceability and security are ensured, while necessary management of transactions is achieved without affecting transaction efficiency. Marking allows for convenient review and verification of transactions when needed later, ensuring compliance with relevant regulations and requirements.

[0020] Secondly, this application provides an information security detection system based on artificial intelligence, which adopts the following technical solution: An information security detection system based on artificial intelligence includes: The data capture module is used to capture the anonymized key fields of a transaction when a transaction event occurs. The data processing module is used to generate behavior vectors based on the key transaction fields; The user information parsing module is used to parse user profiles and obtain user information. The data processing module is also used to load the corresponding transaction rule set from the local knowledge base according to the user information, and obtain the cumulative risk score of the transaction according to the behavior vector and the set transaction rules in the transaction rule set; The judgment module is used to determine whether the cumulative risk score is greater than the risk threshold; The early warning recording module is used to trigger an early warning, freeze the transaction, and record the event log when the judgment module determines that the transaction is true, and to allow the transaction to proceed when the judgment module determines that the transaction is false.

[0021] Thirdly, this application provides a terminal that adopts the following technical solution: A terminal, comprising: The memory contains information security detection programs based on artificial intelligence. A processor is used to execute a program stored in the memory to implement the steps of the above-described artificial intelligence-based information security detection method.

[0022] Fourthly, this application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium storing a computer program that can be loaded by a processor and executed by the aforementioned artificial intelligence-based information security detection method.

[0023] In summary, this application has at least the following beneficial effects: Capturing anonymized key transaction fields before a transaction occurs prevents sensitive information from being exposed during the detection phase, reducing the likelihood of data leakage. By capturing these anonymized fields, discrete transaction features are transformed into multi-dimensional behavioral vectors, quantifying abnormal patterns in user behavior. Parsing user profiles and loading corresponding transaction rule sets from a local knowledge base ensures the detection method aligns with users' actual trading habits and risk profiles. The cumulative risk score is then calculated using the transaction rule set, providing a quantitative assessment of transaction risk and avoiding errors caused by subjective judgment in traditional methods. This allows for a comprehensive and objective evaluation of the transaction's risk level. The transaction rule set in the local knowledge base can be updated and adjusted in real-time based on actual transaction conditions and risk status, ensuring the generated risk score more accurately reflects the true risk level of the current transaction. When the cumulative risk score exceeds a risk threshold, the system promptly triggers an alert and freezes the transaction, preventing potentially risky transactions from continuing, reducing potential economic losses and security threats, and minimizing risk. Simultaneously, event logs are recorded, providing detailed records for subsequent risk analysis and investigation. This helps to identify potential security risks and their sources, preventing similar risk events from recurring. For transactions with a cumulative risk score less than or equal to the risk threshold, the system automatically allows them to proceed, ensuring that normal transactions can be completed smoothly. Excessive security checks do not lead to cumbersome or inefficient transaction processes, thus balancing transaction security with smoothness and efficiency. Attached Figure Description

[0024] Figure 1 This is a first flowchart of an embodiment of this application; Figure 2 This is a second flowchart of an embodiment of this application; Figure 3This is a third flowchart of an embodiment of this application; Figure 4 This is the fourth flowchart of an embodiment of this application; Figure 5 This is the fifth flowchart of an embodiment of this application; Figure 6 This is the sixth flowchart of an embodiment of this application; Figure 7 This is the seventh flowchart of an embodiment of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the appendices in the embodiments of the present invention will be described below. Figure 1 -Appendix Figure 7 The technical solutions in the embodiments of the present invention are clearly and completely described herein. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] The first embodiment of this application discloses an information security detection method based on artificial intelligence. (Refer to...) Figure 1 The information security detection method may include S110-S180: S110 captures the anonymized key fields of the transaction when a transaction event occurs; S120 generates behavior vectors based on key transaction fields; S130, analyze user profiles to obtain user information; S140, based on user information, load the corresponding set of transaction rules from the local knowledge base; S150, based on the behavioral vector and the trading rules set in the trading rule set, obtains the cumulative risk score of the transaction; S160, determine whether the cumulative risk score is greater than the risk threshold; S170, if so, trigger an alert, freeze the transaction, and record the event log; S180, if not, then proceed with the transaction.

[0027] Specifically, after the system receives a real-time transaction event, a log interceptor can be used to capture key fields in the transaction event. These key fields include the user's unique identifier, the transaction amount, GPS coordinates or IP address, and the transaction time. Then, data anonymization is performed, removing sensitive fields (such as bank card numbers) and retaining the corresponding behavioral tags for non-sensitive fields (such as transaction amounts greater than 5000 yuan). Based on the non-sensitive fields, a behavioral vector is constructed: V = [freq, amount, loc], where freq represents the number of transactions in the past 30 days, and amount represents the ratio of the current transaction amount to the historical average. The numerator represents the transaction amount, and the denominator represents the historical average. loc represents the straight-line distance between the current location and a frequently used location (such as home address or company address). The frequently used location can also be the high-frequency location of the past 30 days.

[0028] Based on pre-defined rules, the system extracts necessary user information from user profile data. This information includes user name, historical transaction addresses, number of historical transactions, place of residence, and age. For example, by querying records associated with a user's unique identifier in the transaction database, user name and age can be directly obtained. Historical transaction addresses and transaction counts can be statistically analyzed and filtered using SQL queries. Then, based on the user information, the corresponding transaction rule set is loaded from the local knowledge base. This rule set includes at least transaction frequency rules, transaction amount rules, and transaction location rules.

[0029] For the transaction frequency rule: if freq exceeds the preset threshold, a risk bonus is triggered, with a possible value of 0.4. For the transaction amount rule: if amount exceeds the preset threshold, a risk bonus is triggered, with a possible value of 0.8. For the transaction location rule: if loc exceeds the preset threshold, a risk bonus is triggered, with a possible value of 0.6. Furthermore, these values ​​can be modified in the backend settings, provided that the amount rule is greater than the location rule, which in turn is greater than the frequency rule. Then, the cumulative risk score is calculated. These are the rule weights; for example, the trading frequency rule has a weight of 0.2, the trading amount rule has a weight of 0.5, and the trading position rule has a weight of 0.3. To assign values ​​to rules; This is the rule trigger indicator function. The trigger risk score is 1, otherwise it is 0.

[0030] When the accumulated risk score exceeds the risk threshold, Python's logging module can be used to record event logs, simultaneously simulating the triggering of alerts and freezing of transactions. Conversely, if the score is below the threshold, the transaction is allowed to proceed, and a success message is returned.

[0031] Furthermore, referring to Figure 2The steps prior to obtaining the cumulative risk score include S210-S280: S210, obtain network latency parameters; S220, determine whether the network latency parameter is greater than the dynamic latency threshold; S230, if so, then activate the simplified mode and generate a risk value based on the current transaction amount and the average of the user's historical transaction amounts; S240, determine whether the number of transactions per unit time exceeds the frequency threshold; S250, if so, then generate the frequency compensation factor; S260 outputs the cumulative risk score based on the frequency compensation factor and risk value; S270, if not, the cumulative risk score is the risk value corresponding to the transaction amount rule.

[0032] Specifically, for example, the ping command in Python can be used to measure network latency and obtain network latency parameters; the psutil library can be used to obtain battery percentage information. After obtaining the network latency parameters and device battery percentage, it is first determined whether the network latency parameters are greater than a dynamic latency threshold. The dynamic latency threshold is generated from a preset threshold library based on the current network connection type. For example, when the network connection type is 5G cellular network, the dynamic latency threshold is set to 100ms; when the network connection type is 4G cellular network, the dynamic latency threshold is set to 300ms; and when the network connection type is Wi-Fi, the dynamic latency threshold is set to 500ms.

[0033] If so, the simplified mode is entered, the mean and standard deviation of historical transaction amounts are calculated, and then the difference between the current transaction amount and the mean of historical transaction amounts is divided by the standard deviation to obtain the risk value.

[0034] Further determine whether the number of transactions within a unit of time exceeds the frequency threshold. If so, generate a frequency compensation factor, and then add the risk value to the frequency compensation factor to obtain the cumulative risk score. If not, the cumulative risk score is the risk value corresponding to the transaction amount rule, and the weight of the transaction amount rule is increased.

[0035] Reference Figure 3 The steps following determining whether the network latency parameter is greater than the dynamic latency threshold also include S310-S350: S310, obtain the device's battery percentage; S320, determines whether the device's battery percentage is less than a set battery threshold; If it is S330, then start the low-power mode and read the most recent valid position coordinates from the local cache; S340, obtain the risk coefficient of the most recent valid location coordinates; S350 outputs a cumulative risk score based on the risk coefficient, the risk value corresponding to the trading frequency rule, and the risk value corresponding to the trading amount rule.

[0036] Specifically, the historical fraud transaction ratio within each geographic grid is periodically collected. A normalized risk coefficient of 0.1 to 1.0 is assigned to each geographic grid based on the fraud ratio. The data is then updated and compressed into the device's local cache every 6 hours. Upon entering low-power mode, the real-time GPS positioning module is turned off. The most recent valid location coordinates are read from the local cache, and a risk coefficient is matched based on these coordinates. Then, the risk values ​​corresponding to the transaction frequency rule, the transaction amount rule, and the risk coefficient are weighted and summed to obtain a cumulative risk score. At this point, the calculation of the transaction location rule is skipped. If not, the process ends, and the cumulative risk score is the sum of all set rule risk values.

[0037] Reference Figure 4 The steps for loading the corresponding transaction rule set from the local knowledge base based on user information include S410-S440: S410 retrieves the number of historical transactions from the user's information; S420, determines whether the number of historical transactions exceeds the set number; S430, if so, then generate a personalized set of transaction rules based on the user information; S440, if not, then retrieve the latest set of transaction rules for the same age group in the same region based on the user's place of residence and age information.

[0038] Specifically, after obtaining a user's historical transaction count, it can be determined whether the historical transaction count exceeds a set limit. If so, a personalized transaction rule set is generated based on the user information; otherwise, the latest transaction rule set for the same age group in the same region is retrieved based on the user's place of residence and age information. A local knowledge base stores a transaction rule library containing transaction rules corresponding to different regions and age groups. The user's age group can be determined based on pre-defined age group classification standards, and then the user's region can be determined based on their place of residence (such as home address or company). After filtering out transaction rule sets that match the age group and place of residence, the latest transaction rule set is retrieved based on the creation or update time associated with the filtered transaction rule sets.

[0039] Reference Figure 5 The steps for generating a personalized transaction rule set based on user information include S510-S570: S510 calculates the user's current transaction security value based on user information; S520: From the transaction rule base, find the first alternative transaction rule set corresponding to the historical transaction security value that is greater than the current transaction security value; S530: From the first set of candidate trading rules, select a second set of candidate trading rules with a safety error less than the error threshold. ; S540, obtain the average safety value of the second alternative transaction rule set; S550 determines whether there is a target historical transaction safety value in the transaction rule base that is closest to the average safety value; S560, if so, then generate a personalized transaction rule set based on the transaction rule set corresponding to the target historical transaction security value; S570, if not, then generate a personalized trading rule set based on the second alternative trading rule set.

[0040] Specifically, different weights can be assigned to different information dimensions in user information, such as transaction history, credit rating, and account activity. For example, transaction history can be weighted at 0.4, credit rating at 0.3, and account activity at 0.3. Transaction history can be scored based on factors such as transaction frequency and transaction amount stability; credit rating can directly reference the rating results from professional institutions and convert them into corresponding scores; account activity can be scored based on login frequency and operation frequency. The quantitative scores of each information dimension are multiplied by their corresponding weights, and then summed to obtain the current transaction security value. Assuming a transaction history score of 80, a credit rating score of 70, and an account activity score of 60, then the current transaction security value = 80 × 0.4 + 70 × 0.3 + 60 × 0.3 = 71.

[0041] Each transaction rule set in the transaction rule base is associated with a historical transaction security value. SQL queries can be used to filter out transaction rule sets whose historical transaction security values ​​are greater than the current transaction security value. The set of these transaction rule sets constitutes the first candidate rule set. Based on business needs and experience, a suitable error threshold is set. For each transaction rule set in the first candidate rule set, the absolute value of its security error is calculated. The first candidate transaction rule sets whose security errors are less than the error threshold are selected to form the second candidate rule set. Then, the historical transaction security values ​​in the second candidate rule set are summed and averaged. Next, the absolute value of the difference between each historical transaction security value and the average security value in the transaction rule base is calculated. The second candidate transaction rule set with the smallest absolute value is the target transaction rule set. If there are multiple second candidate transaction rule sets with the smallest absolute value, the latest second candidate transaction rule set is the target transaction rule set. It should be noted that the number of transaction rules in different transaction rule sets can be different or the same. When the number of transaction rules is the same, the corresponding thresholds for the transaction rules are different.

[0042] The personalized transaction rule set is generated based on the target transaction rule set as follows: After determining the target transaction rule set, the threshold corresponding to the transaction rule is updated according to the user's current transaction security value, thereby generating the personalized transaction rule set. For example, when the transaction security value is high, the threshold of the transaction rule can be appropriately increased; when the transaction security value is low, the threshold of the transaction rule can be decreased to strengthen risk control. After determining the current transaction security value, the change value mapping table is retrieved, and the change value corresponding to the transaction security value is found in the change value mapping table. Then, the new threshold is obtained by adding the change value to the threshold. Each change value corresponds to a transaction security value range.

[0043] The method for generating personalized transaction rules based on the second set of alternative transaction rules is as follows: First, select a second set of alternative transaction rules with an equal number of rules. Then, further search within this set for second sets of alternative transaction rules with similar thresholds for the same type of transaction rule. Similar thresholds for the same type of transaction rule mean that the difference in thresholds for the same type of transaction rule is less than a set difference. If there are multiple similar sets of alternative transaction rules, the latest set is used as the target rule set, and the thresholds corresponding to the transaction rules in the target rule set are updated based on the user's current transaction security value. If there is only one similar set of alternative transaction rules, the thresholds corresponding to the transaction rules in the similar set are updated based on the user's current transaction security value.

[0044] Furthermore, refer to Figure 6 and Figure 7 The steps prior to triggering the warning may include S610-S690: S610, from the false alarm statistics database, find the number of errors corresponding to the historical risk scores that match the cumulative risk scores; S620, calculate the average number of errors based on the number of errors; S630, determine whether the average error count is greater than the count threshold; If S640 is the case, then a warning will be triggered; S650, if not, calculate the comprehensive risk transaction value based on the cumulative risk score and the current transaction security value; S660, obtain the actual difference between the comprehensive risk transaction value and the risk transaction threshold; S670, determine whether the actual difference is less than the difference threshold; S680, if not, trigger a warning; If S690 is the case, then the transaction is allowed and a risk marker is applied.

[0045] Specifically, the false alarm statistics database can use a relational database (such as MySQL) to store the data. The database contains two fields: historical risk score and the corresponding number of errors. Once the cumulative risk score exceeds the risk threshold, an SQL query can be used, using the cumulative risk score as the query condition, to retrieve the number of errors corresponding to the matching historical risk score from the database. Then, the summation and average of these errors are calculated, and the calculated average number of errors is compared with the threshold.

[0046] The overall risk transaction value equals the accumulated risk score multiplied by a weighting coefficient, plus the current transaction safety value multiplied by another weighting coefficient. The overall risk transaction value is then subtracted from a set risk transaction threshold constant to obtain the actual difference. This actual difference is then compared to a set difference threshold constant. If the actual difference is less than the difference threshold, the transaction is approved, and a risk marker is added to the transaction for subsequent manual verification.

[0047] It should also be noted that after the transactions are completed on the same day, the real-time false alarm rate can be obtained, and then the difference between the target false alarm rate (set false alarm rate) and the real-time false alarm rate can be obtained; then, the risk threshold for the next day can be dynamically adjusted based on the difference in false alarm rate.

[0048] Specifically, the risk threshold is dynamically adjusted based on the false alarm difference as follows: New risk threshold , The original risk threshold, For learning rate, For the target false alarm rate, This is the real-time false alarm rate. Real-time false alarm rate = number of false alarm events / total number of blocked events.

[0049] One implementation scenario of this embodiment is as follows: When a transaction event occurs, the system captures the anonymized key transaction fields, generates a behavior vector based on these fields, and then parses the user profile to obtain user information. It then checks if the number of historical transactions in the user information exceeds a set limit. If so, it calculates the user's current transaction security value based on the user information. Next, it searches the transaction rule base for the first set of alternative transaction rules corresponding to historical transaction security values ​​greater than the current security value. From the first set of alternative rules, it selects a second set of alternative rules with a security error less than a threshold. It then obtains the average security value of the second set of alternative rules. Finally, it checks if a target historical transaction security value closest to the average security value exists in the transaction rule base. If so, it generates a personalized transaction rule set based on the transaction rule set corresponding to the target security value. Finally, based on the behavior vector and the set transaction rules in the personalized transaction rule set, it obtains the cumulative risk score of the transaction. It then checks if the cumulative risk score exceeds a risk threshold. If so, it triggers an alert, freezes the transaction, and records the event log. After the day's transactions are completed, the real-time false alarm rate can be obtained, and then the difference between the target false alarm rate and the real-time false alarm rate can be obtained; then, the risk threshold for the next day can be dynamically adjusted based on the false alarm difference.

[0050] Based on the above method embodiments, the second embodiment of this application discloses an artificial intelligence-based information security detection system. The artificial intelligence-based information security detection system of this application embodiment can implement any of the above-described artificial intelligence-based information security detection methods, and the specific working process of each module in the artificial intelligence-based information security detection system can be referred to the corresponding process in the above method embodiments.

[0051] For ease of understanding, an example is as follows: An information security detection system based on artificial intelligence includes: The data capture module is used to capture the anonymized key fields of a transaction when a transaction event occurs. The data processing module is used to generate behavior vectors based on key transaction fields; The user information parsing module is used to parse user profiles and obtain user information. The data processing module is also used to load the corresponding set of transaction rules from the local knowledge base based on user information, and obtain the cumulative risk score of the transaction based on the behavior vector and the set of transaction rules in the transaction rule set. The judgment module is used to determine whether the cumulative risk score is greater than the risk threshold; The early warning recording module is used to trigger an early warning, freeze the transaction, and record the event log when the judgment module determines that the transaction is true. It is also used to allow the transaction to proceed when the judgment module determines that the transaction is false.

[0052] A third embodiment of this application provides a terminal. As one implementation of this terminal, the terminal may include: a memory and a processor; wherein... The memory is used to store AI-based information security detection programs; The processor is used to execute the program stored in the memory to implement the steps of the above-described artificial intelligence-based information security detection method.

[0053] The memory can communicate with the processor via a communication bus, which can be an address bus, a data bus, a control bus, etc.

[0054] Additionally, the memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device.

[0055] Furthermore, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0056] The fourth embodiment of this application provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed by the above-described artificial intelligence-based information security detection method.

[0057] Computer-readable storage media can be any usable medium that a computer can access, or a data storage device such as a server or data center that integrates one or more usable media. Usable media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives).

[0058] The above are all preferred embodiments of this application and are not intended to limit the scope of protection of this application. Any feature disclosed in this specification (including the abstract and drawings) may be replaced by other equivalent or similar features unless specifically stated otherwise. That is, unless specifically stated otherwise, each feature is only one example of a series of equivalent or similar features.

Claims

1. An information security detection method based on artificial intelligence, characterized in that, include: When a transaction event occurs, capture the key transaction fields after data anonymization; Generate a behavior vector based on the aforementioned key transaction fields; Analyze user profiles to obtain user information; Based on the user information, load the corresponding set of transaction rules from the local knowledge base; Based on the behavior vector and the set of trading rules in the trading rule set, the cumulative risk score of the transaction is obtained; Determine whether the cumulative risk score is greater than the risk threshold; If so, an alert will be triggered, the transaction will be frozen, and the event log will be recorded. If not, the transaction will be allowed.

2. The information security detection method based on artificial intelligence according to claim 1, characterized in that, The information security detection method also includes: Get the real-time false alarm rate; Obtain the false alarm difference between the target false alarm rate and the real-time false alarm rate; The risk threshold is dynamically adjusted based on the false alarm difference.

3. The information security detection method based on artificial intelligence according to claim 1, characterized in that, The transaction rule set includes transaction frequency rules, transaction amount rules, and transaction location rules; The steps prior to obtaining the cumulative risk score include: Obtain network latency parameters; Determine whether the network latency parameter is greater than the dynamic latency threshold; If the network latency parameter is greater than the dynamic latency threshold, a simplified mode is activated, and a risk value is generated based on the current transaction amount and the average of the user's historical transaction amounts. Determine whether the number of transactions per unit time exceeds the frequency threshold; If so, then generate a frequency compensation factor; Based on the frequency compensation factor and the risk value, output the cumulative risk score; If the network latency parameter is less than or equal to the dynamic latency threshold, then obtain the device battery percentage; Determine whether the device's battery percentage is less than a set battery threshold; If so, then activate low-power mode and read the most recent valid location coordinates from the local cache; Risk factor for obtaining the most recent valid location coordinates; Based on the risk coefficient, the risk value corresponding to the transaction frequency rule, and the risk value corresponding to the transaction amount rule, a cumulative risk score is output.

4. The information security detection method based on artificial intelligence according to claim 1, characterized in that, The step of loading the corresponding transaction rule set from the local knowledge base based on the user information includes: Obtain the number of historical transactions from the user information; Determine whether the number of historical transactions exceeds a set number; If so, a personalized transaction rule set is generated based on the user information; If not, then based on the user's place of residence and age information, retrieve the latest set of transaction rules for the same region and age group.

5. The information security detection method based on artificial intelligence according to claim 4, characterized in that, The step of generating a personalized transaction rule set based on the user information includes: Calculate the user's current transaction security value based on the user information; From the transaction rule base, find the first set of alternative transaction rules corresponding to historical transaction security values ​​that are greater than the current transaction security value; From the first set of candidate trading rules, select a second set of candidate trading rules whose safety error is less than the error threshold. ; Obtain the average safety value of the second set of alternative transaction rules; Determine whether there exists a target historical transaction security value in the transaction rule base that is closest to the average security value; If so, a personalized transaction rule set is generated based on the transaction rule set corresponding to the target historical transaction security value; If not, a personalized set of trading rules is generated based on the second alternative set of trading rules.

6. The information security detection method based on artificial intelligence according to claim 5, characterized in that, The steps prior to triggering the warning include: From the false alarm statistics database, find the number of errors corresponding to historical risk scores that match the cumulative risk score; Calculate the average number of errors based on the number of errors mentioned above; Determine whether the average error count is greater than the count threshold; If so, an alert will be triggered.

7. The information security detection method based on artificial intelligence according to claim 6, characterized in that, The step following the determination of whether the average error count is greater than the count threshold further includes: If not, then calculate the comprehensive risk transaction value based on the accumulated risk score and the current transaction security value; Obtain the actual difference between the comprehensive risk transaction value and the risk transaction threshold; Determine whether the actual difference is less than the difference threshold; If not, an alert will be triggered; If so, the transaction is allowed, and a risk marker is applied.

8. An information security detection system based on artificial intelligence, characterized in that, Performing the information security detection method based on artificial intelligence as described in any one of claims 1-7 includes: The data capture module is used to capture the anonymized key fields of a transaction when a transaction event occurs. The data processing module is used to generate behavior vectors based on the key transaction fields; The user information parsing module is used to parse user profiles and obtain user information. The data processing module is also used to load the corresponding transaction rule set from the local knowledge base according to the user information, and obtain the cumulative risk score of the transaction according to the behavior vector and the set transaction rules in the transaction rule set; The judgment module is used to determine whether the cumulative risk score is greater than the risk threshold; The early warning recording module is used to trigger an early warning, freeze the transaction, and record the event log when the judgment module determines that the transaction is true, and to allow the transaction to proceed when the judgment module determines that the transaction is false.

9. A terminal, characterized in that, include: The memory contains information security detection programs based on artificial intelligence. A processor is configured to execute a program stored in the memory to implement the steps of the artificial intelligence-based information security detection method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer program is stored and can be loaded by a processor and executed as described in any one of claims 1-7.

Images