Data collection method and device and storage medium
By combining hook programs and full-screen transparent overlay layers with multi-level rule matching for data collection, the problems of high data collection costs and poor real-time performance of bank self-service terminals have been solved, enabling efficient and accurate user behavior analysis and rapid business response.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-21
- Publication Date
- 2026-03-13
AI Technical Summary
Existing data collection methods for bank self-service terminals suffer from high costs, long transformation cycles, incomplete behavioral analysis, and poor real-time performance. In particular, it is difficult to achieve efficient and low-cost data collection when multiple devices are linked together.
By capturing screen click coordinates through hook programs, combined with a full-screen transparent overlay layer and multi-level rule matching, accurate identification and recording of user operation behavior can be achieved, including sub-process, peer, and global matching. Tree-structured JSON storage rules are used and hot updates are supported, reducing terminal modification costs.
It enables low-cost and rapid data collection, improves operation recognition accuracy to 98.7%, reduces operation and maintenance costs, enhances the reliability and user experience of self-service terminals, and supports rapid response to emergency bug fixes and business function deployments.
Smart Images
Figure CN121657915A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of bank self-service terminal technology, and in particular to a data acquisition method, device and storage medium. Background Technology
[0002] With the increasing number of self-service terminals in bank branches and the growing demand for digital transformation, the need for collaboration between the banking business platform and various self-service machines is increasing. Therefore, in order to collect customer behavior data from various self-service terminals, it is often necessary to develop, modify and connect the terminal application with the business platform, or connect multiple back-end systems. Some also use log analysis tools for data collection and connection to achieve the effect of customer behavior analysis and multi-device collaboration.
[0003] However, there are many types of self-service terminals and a wide variety of applications and back-end systems, making it impossible to adopt system integration for all of them. This would lead to increased costs and longer project timelines. While log analysis is a low-cost way to upgrade and integrate, logs suffer from incomplete behavior logs and delayed uploads, which is not effective for the completeness and real-time performance of behavior analysis. It is often used for post-event analysis. Summary of the Invention
[0004] In view of the above-mentioned defects or deficiencies in the existing technology, it is desirable to provide a data acquisition method, equipment and storage medium that is low in cost, has a small impact range, can be implemented quickly, and can be connected to the middle platform to extend services without terminal modification.
[0005] In a first aspect, the present invention provides a data acquisition method, wherein the method captures screen click coordinates through a hook program and captures user operation behavior by creating a full-screen transparent overlay layer, the method comprising: For each of the first operations of the first user, the following operations are performed: Get the coordinates of the first screen click in the first operation; Determine if the first coordinate is within the first rule region corresponding to the first operation: If so, then the first operation area image of the first operation is captured; Compare the similarity between the image of the first operation region and the image of the first rule corresponding to the first operation: If they are similar, record the coordinates of the first screen click; If they are not similar, then perform a global rule match to determine if there is a rule that matches the first operation: If it exists, record the coordinates of the first screen click; If not, perform a global rule match to determine if a rule exists that matches the first operation: If it exists, record the coordinates of the first screen click.
[0006] In a second aspect, the present invention also provides an apparatus comprising one or more processors and a memory, wherein the memory contains instructions executable by the one or more processors to cause the one or more processors to perform a data acquisition method provided according to various embodiments of the present invention.
[0007] Thirdly, the present invention also provides a storage medium storing a computer program that causes a computer to execute a data acquisition method provided according to various embodiments of the present invention. Attached Figure Description
[0008] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart of a data acquisition method provided in an embodiment of the present invention.
[0009] Figure 2 This is a schematic diagram of the structure of a device provided in an embodiment of the present invention. Detailed Implementation
[0010] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.
[0011] It should be noted that the settlement method provided in this application does not limit the entity that can execute it. Optionally, the entity that can execute the data acquisition method provided in this application can be a data acquisition system. Specifically, the entity that can execute the data acquisition method provided in this application can be an acquisition unit within a data acquisition system.
[0012] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.
[0013] Figure 1 This is a flowchart illustrating a data acquisition method according to an embodiment of the present invention. Figure 1 As shown, in this embodiment, the present invention provides a data acquisition method that captures screen click coordinates through a hook program and captures user operation behavior by creating a full-screen transparent overlay layer. The method includes: For each of the first operations of the first user, the following operations are performed: S11: Obtain the coordinates of the first screen click in the first operation; S120: Determine if the first coordinate is within the first rule region corresponding to the first operation. In S121: Capture the first operation region image of the first operation; S122: Compare the similarity between the first operation region image and the first rule image corresponding to the first operation: If similar, then S1221: Record the coordinates of the first screen click; If they are not similar, then S1222: Perform global rule matching to determine if there exists a rule that matches the first operation: If it exists, then S12221: Record the coordinates of the first screen click; If not, then S123: Perform global rule matching to determine if a rule exists that matches the first operation: If it exists, then S1231: Record the coordinates of the first screen click.
[0014] Specifically, the self-service terminal uses hook programs (such as the TouchHook class) to monitor screen touch coordinates, capture screen click coordinates, and monitor screen operations by creating a full-screen transparent mask layer (InitTouchMaskLayer method) to capture user operation behavior; for example, user A clicks the transfer button. The self-service terminal executes step S11 to obtain the screen click coordinates (X,Y) of user A clicking the transfer button. The self-service terminal executes step S120 to determine whether (X,Y) is within the rule area corresponding to the transfer operation; In the corresponding rule area, step S121 is executed to capture the image of the operation area where user A clicked to transfer funds; and step S122 is executed to compare the similarity of the above-mentioned operation area image of the transfer with the transfer rule image: If they are similar, then execute step S1221 and record (X,Y); If they are not similar, proceed to step S1222 to perform a global rule match to determine if there is a rule that matches the transfer: If a rule matching the transfer exists, proceed to step S12221 and record (X,Y). If the transaction is not within the corresponding rule area, proceed to step S123 to perform a global rule match to determine if a rule matching the transfer exists. If a rule matching the transfer exists, proceed to step S1231 and record (X,Y). The self-service terminal triggers transfer-related services based on the transfer operation, such as redirecting to a page to read transfer precautions.
[0015] Transferring money involves many operations, such as clicking the transfer button, scrolling down to read the transfer instructions, and entering the amount. Therefore, a series of coordinates will be generated, which represent the operation path of user A. In more embodiments, a step can be configured according to actual needs where no rule matches the first operation. For example, it can be configured to save the first operation; or, save the first operation and increment the number of times the transfer operation occurs by 1 to update the number of times the transfer operation occurs. When the number of occurrences reaches a certain value, an early warning message is generated. The above early warning message is used for the administrator to determine whether a rule matching the first operation needs to be configured. The above embodiments construct an intelligent self-service terminal full-touch SDK, which realizes data collection through operating system-level monitoring, avoiding the need to modify the existing system; the two-factor authentication mechanism (coordinates + image similarity) enables the operation recognition accuracy to reach 98.7% (actual test data), which is low-cost, has a small impact range, is quick to implement, and can be connected to the middle platform to achieve service extension without terminal modification.
[0016] In one embodiment of this application, performing global rule matching to determine whether a rule matches the first operation includes: The dynamic configuration engine searches the flow of recently successful operations identical to the first operation to see if a rule matching the first operation exists: If not found, then search for a rule matching the first operation in other functions of the preceding business page: If it does not exist, then a global rule match is performed to determine if there is a rule that matches the first operation.
[0017] The above embodiments configure a three-level matching strategy for the self-service terminal's abnormal process self-healing mechanism: sub-process matching, peer matching, and global matching. Sub-process matching is used to search in the subsequent processes of the most recently successfully operated operation; peer matching is used to search in other functions of the current business page; and global matching is used to match the highest similarity among all business rules. The above embodiments enable the self-service terminal to self-heal when an abnormal process occurs, improving the reliability of the self-service terminal, reducing operational risks (such as internal fraud), reducing business interruption time, and reducing operation and maintenance costs.
[0018] In one embodiment of this application, each rule is stored in a tree-structured JSON format. The fields of each rule include coordinates, business number, and validation rule. The method further includes: Get the first update package of the first rule; When the first update package passes verification, update the first rule and its version number according to the first update package.
[0019] In the above embodiments, the verification rules for the update package can also be configured according to actual needs. For example, verifying the signature information of the update package and verifying the conflict between the first rule and the rules in the current system. When the signature information is correct and the rules do not conflict, the verification is passed. In more embodiments, the verification rules for the update package can also be configured according to actual needs, which can achieve the same technical effect.
[0020] In other embodiments, the information of the update package can be synchronized to the blockchain according to actual needs to achieve data storage.
[0021] In other embodiments, hot updates can be configured to be batch updates by region according to actual needs. For example, the first update package of the self-service terminal in the current region is also configured with a time of 10:00:00, and the first update package of the self-service terminal in other regions is also configured with a time of 10:05:00. The first rule will be hot-updated only when the pre-configured time is reached, so as to reduce the systemic risks caused by the first rule.
[0022] In the above embodiments, the self-service terminal is also equipped with a rule hot update mechanism. This mechanism can significantly reduce deployment time. For the deployment of new business functions, the time is shortened from 2 weeks to 2 hours, which greatly improves the working efficiency of the self-service terminal. For the repair of urgent bugs, the version can be switched in seconds, and the ultra-short repair time improves the user experience.
[0023] In one embodiment of this application, after recording the first screen click coordinates, the above method further includes: storing the first screen click coordinates into a time-series database.
[0024] Furthermore, after recording the coordinates of the first screen click, the above method also includes: Calculate the DTW distance between the first operation path and each reference path to obtain the minimum DTW distance; A warning message is generated when the minimum DTW distance is greater than the threshold. The first operation path is formed by the first screen click coordinates corresponding to each recorded first operation; the reference path is generated based on the set of normal operation paths for the same business operation as the first operation.
[0025] Specifically, assuming a normal DTW distance of 0.2~0.5 for a transfer operation; User A's operation path is "(X1,Y1,0), (X2,Y2,2), (X3,Y3,3),# undo changes, (X4,Y4,5), # re-enter, (X5,Y5,7), # undo again, (X6,Y6,9)". The reference path is: "(X11,Y11,0),#Click the transfer button,(X12,Y12,2),#Enter the amount,(X13,Y13,4)#Click confirm"; The self-service terminal calculates the DTW distance between user A's operation path and the reference path: distance = dtw(normal_path, abnormal_path; DTW distance = 1.8, significantly higher than the normal threshold of 0.5; return True; The self-service terminal generates a warning message indicating that User A may be engaging in abnormal behavior by repeatedly modifying amounts.
[0026] In the above embodiments, when the DTW distance between the user's operation path and the reference normal path is high, abnormal behavior exists. Abnormal behavior is used to help the self-service terminal analyze the user's behavior: if it is malicious behavior, the above embodiments improve the bank's risk resistance; if it is non-malicious behavior, similar non-malicious behaviors can be clustered and corresponding optimizations can be made to improve the user experience (for example, if the self-service terminal identifies that the user's path abnormality is due to the user being elderly, it will pop up a digital human to provide guidance on system operation buttons, input content format guidance, etc., or enable voice recognition mode, and achieve the effect of automatic operation of voice interaction by recognizing and controlling simulated touch click operations to improve the user experience).
[0027] Furthermore, the above method also includes: Cluster the second operation paths of each user over a certain period of time to generate several groups; Cluster the first operation path and each of the second operation paths to determine whether the first user has changed their group: Yes, then the corresponding marketing strategy will be triggered based on the changed group dynamics; No, then the current service will remain in effect.
[0028] Specifically, it is assumed that users who used the self-service terminal in the past hour are automatically grouped in real time according to their operation path: quick transfer group, elderly user group, and abnormal behavior group; the default group is the quick transfer group. The operation path of user A and the operation paths of users who used the self-service terminal in the past hour are clustered to determine whether it is necessary to change the group to which user A belongs; Because User A's operation path is abnormal, User A's group is changed to an abnormal behavior group, and because he repeatedly modified the transfer amount, the "anti-money laundering check" strategy is triggered.
[0029] The above embodiments are used for precise marketing, anomaly detection, or process optimization of self-service terminals.
[0030] In one embodiment of this application, the above method further includes: Upon receiving the administrator's access signal, an input window will pop up for the administrator to enter their password. Receive and verify the entered administrator password: Once verification is successful, grant administrator configuration permissions.
[0031] In other embodiments, the operation when verification fails can also be configured according to actual needs, for example, by locking the operation for 30 seconds, which can achieve the same technical effect.
[0032] In one embodiment of this application, the above method further includes: Once it is determined that the required screenshot is a text block screenshot, obtain the coordinates of the text block mentioned above; A screenshot is generated based on the coordinates of the text block and the configured fill length.
[0033] The extraction of the above screenshots consumes few resources and can improve operating efficiency.
[0034] Figure 2 This is a schematic diagram of the structure of a device provided in an embodiment of the present invention.
[0035] like Figure 2 As shown, in another aspect, this application also provides a device 200, including one or more central processing units (CPUs) 201, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 202 or a program loaded from a storage portion 208 into a random access memory (RAM) 203. The RAM 203 also stores various programs and data required for the operation of the device 200. The CPU 201, ROM 202, and RAM 203 are interconnected via a bus 204. An input / output (I / O) interface 205 is also connected to the bus 204.
[0036] The following components are connected to I / O interface 205: an input section 206 including a keyboard, mouse, etc.; an output section 207 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 208 including a hard disk, etc.; and a communication section 209 including a network interface card such as a LAN card, modem, etc. The communication section 209 performs communication processing via a network such as the Internet. Drive 210 is also connected to I / O interface 205 as needed. Removable media 211, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 210 as needed so that computer programs read from them can be installed into storage section 208 as needed.
[0037] In particular, according to embodiments of this disclosure, the methods described in any of the above embodiments can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing program code for performing the methods. In such embodiments, the computer program can be downloaded and installed from a network via communication section 209, and / or installed from removable medium 211.
[0038] In another aspect, this application also provides a computer-readable storage medium, which may be a computer-readable storage medium included in the apparatus of the above embodiments; or it may be a standalone computer-readable storage medium not assembled into a device. The computer-readable storage medium stores one or more programs that are used by one or more processors to perform the methods described in this application.
[0039] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or operation, or by a combination of dedicated hardware and computer instructions.
[0040] The units or modules described in the embodiments of this application can be implemented in software or hardware. The described units or modules can also be located in a processor; for example, each unit can be a software program located in a computer or mobile smart device, or a separately configured hardware device. The names of these units or modules do not, in some cases, constitute a limitation on the unit or module itself.
[0041] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the concept of this application. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.
Claims
1. A data acquisition method, characterized in that, The method includes capturing screen click coordinates via hooks and capturing user actions by creating a full-screen transparent overlay layer. For each of the first operations of the first user, the following operations are performed: Obtain the first screen click coordinates of the first operation; Determine whether the first coordinate is within the first rule region corresponding to the first operation: If so, then capture the image of the first operation area of the first operation; The image of the first operation region is compared with the first rule image corresponding to the first operation. If similar, record the click coordinates of the first screen; If they are not similar, then perform a global rule matching to determine if there is a rule that matches the first operation: If it exists, record the coordinates of the click on the first screen; If not, perform a global rule match to determine if a rule exists that matches the first operation: If it exists, record the coordinates of the first screen click.
2. The method according to claim 1, characterized in that, If no rule matches the first operation, save the first operation; The recorded coordinates of the first screen click include: Record the coordinates of the clicks on the first screen; The first operation triggers a business linkage.
3. The method according to claim 1, characterized in that, The step of performing global rule matching to determine whether there is a rule that matches the first operation includes: Search the flow of recently successful operations that are identical to the first operation for a rule that matches the first operation: If not found, then search for a rule matching the first operation in other functions of the preceding business page: If no rule exists, a global rule match is performed to determine if a rule that matches the first operation exists.
4. The method according to claim 1, characterized in that, Each rule is stored in a tree-structured JSON format. The fields of each rule include coordinates, business number, and validation rule. The method also includes: Get the first update package of the first rule; When the first update package passes verification, the first rule and its version number are updated according to the first update package.
5. The method according to claim 1, characterized in that, After recording the first screen click coordinates, the method further includes: storing the first screen click coordinates into a time-series database.
6. The method according to claim 5, characterized in that, After recording the coordinates of the first screen click, the method further includes: Calculate the DTW distance between the first operation path and each reference path to obtain the minimum DTW distance; When the minimum DTW distance is greater than the threshold, an early warning message is generated; Wherein, the first operation path is an operation path formed by the recorded first screen click coordinates corresponding to each of the first operations; the reference path is generated based on a set of normal operation paths for the same business operations as the first operation.
7. The method according to claim 6, characterized in that, Also includes: Cluster the second operation paths of each user over a certain period of time to generate several groups; The first operation path and each of the second operation paths are clustered to determine whether the first user has changed their group: Yes, then the corresponding marketing strategy will be triggered based on the changed group dynamics; No, then the current service will remain in effect.
8. The method according to claim 6, characterized in that, Also includes: Upon receiving the administrator's access signal, an input window will pop up for the administrator to enter their password. Receive and verify the entered administrator password: Once verification is successful, grant administrator configuration permissions.
9. A data acquisition device, characterized in that, The device includes: One or more processors; Memory, used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors perform the method as described in any one of claims 1-8.
10. A storage medium storing a computer program, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-8.