A payment data anomaly identification system based on behavior feature recognition

Abstract

The application discloses a payment data abnormality identification system based on behavior feature recognition, relates to the technical field of data identification, and comprises an information management module, which is used for acquiring expected verification information of a current payment transaction and generating actual verification information which has a preset difference with the expected verification information; and an interactive disturbance module, which is used for performing an implicit interactive disturbance operation when a user inputs in a password input box, so that a preset and controllable perceptual deviation is generated between characters corresponding to keys pressed by the user in the password input box and the number or form of mask characters displayed by the password input box in real time in response to key operations, and the deviation is realized through instantaneous abnormality of the number or form of mask display of the password input box; and the application can detect non-human operations which lack perceptual feedback capability for instantaneous and dynamic changes of key information of a payment interface, so that the security of payment is improved.

Description

Technical Field

[0001] This invention belongs to the field of data recognition technology, specifically a payment data anomaly recognition system based on behavioral feature recognition. Background Technology

[0002] Security protection of payment transactions is a core research direction in the field of fintech. The key to identifying payment data anomalies lies in distinguishing between legitimate users' manual operations and malicious attacks by automated programs.

[0003] Automated programs often attempt to crack payment passwords by simulating key input. Traditional anomaly detection methods rely on password complexity verification, device information comparison, or transaction frequency statistics, which can only judge from static data or macro-behavioral levels and are difficult to identify highly simulated automated programs.

[0004] In existing technologies, some solutions enhance protection by adding explicit verification steps such as CAPTCHAs and slider verification. However, these methods significantly reduce the smoothness of payment operations, increase the operational costs for legitimate users, and negatively impact the payment experience. Another approach attempts to identify users by collecting their keystroke timing features. However, automated programs can simulate human operation features by adjusting timing parameters, making single timing feature analysis easily bypassed and resulting in insufficient recognition accuracy.

[0005] Meanwhile, the micro-behavioral characteristics of legitimate users during the payment input process have not been fully explored. Existing solutions lack correlation analysis of user operation perception and interaction feedback, and cannot distinguish between manual operation and program simulation from the essential level of operation behavior. This results in a high rate of missed and false judgments in payment data anomaly identification, making it difficult to meet the dual requirements of high security and high smoothness of payment transactions. Summary of the Invention

[0006] The purpose of this invention is to provide a payment data anomaly identification system based on behavioral feature recognition, so as to solve the problems mentioned in the background art.

[0007] A payment data anomaly detection system based on behavioral feature recognition includes: The information management module is used to obtain the expected verification information of the current payment transaction and generate the actual verification information that differs from the expected verification information by a preset value. The interactive perturbation module is used to perform an implicit interactive perturbation operation when the user enters in the password input box. The interactive perturbation operation causes a preset and controllable perceptual deviation between the character corresponding to the key pressed by the user in the password input box and the number or shape of the mask characters displayed in real time in response to the key operation in the password input box. The deviation is achieved through the instantaneous abnormality of the number or shape of the mask display in the password input box. The behavior acquisition module is used to monitor and record the user's input events in the password input box during the period when the interactive disturbance operation is in effect, and generate a high-precision time-series behavior sequence; The feature extraction module is used to extract at least one micro-behavioral feature from a high-precision temporal behavior sequence that reflects the user's perception and confusion about the perceived deviation; The anomaly detection module is used to determine whether the current operator is an automated program that is not sensitive to interactive disturbances based on micro-behavioral characteristics.

[0008] This invention proactively injects a controllable perceptual bias during critical operations and collects the operator's instinctive behavioral response to this bias. This transforms the dimension of payment anomaly identification from traditional behavioral data analysis to operator perceptual ability verification, thus providing a new approach to identifying automated programs without visual feedback capabilities. It is particularly suitable for defending against advanced attacks that can bypass traditional data risk control models, such as interface tampering.

[0009] In some possible implementations, the interactive perturbation operation is specifically any of the following: Character missing perturbation refers to the situation where, when a user presses the number key 1, the number of black dots in the mask character displayed in the password input box does not increase or increases with a delay, while for other number keys, the mask increases normally. Character redundancy perturbation refers to the phenomenon where, when a user presses the number key 1, two masked black dots are momentarily displayed in the password input box, but only one input is actually recorded. Morphological abrupt change perturbation refers to the situation where, when a user presses the number key 1, the mask for this input is displayed as a special symbol that differs from the regular black dot, and this applies only to that specific key.

[0010] This invention provides a clear, reliable, and easy-to-program front-end technical solution for the core detection method of the system by specifically defining interactive disturbances as character loss, redundancy, or morphological mutation, thus ensuring the controllable generation and consistent implementation of perceptual deviations.

[0011] In some possible implementations, the interaction perturbation module activates interaction perturbation only for the first N characters input by the user within the first input window period after the actual verification information is rendered, where N is an integer from 1 to 3. The first input window period is determined by the time difference between the user's first key press timestamp and the UI rendering completion event.

[0012] This invention upgrades the system control logic from an inefficient polling mode to a precise event-driven mode by precisely binding the disturbance trigger to the UI rendering completion event and the user's first key press. This not only improves the determinism of the trigger timing and reduces the probability of erroneous actions, but also ensures that the disturbance occurs during the initial interaction phase when the user's attention is most focused, thereby maximizing the strength of the behavioral response signal.

[0013] In some possible implementations, micro-behavioral features include: Specific key hesitation characteristic refers to the measurable difference between the duration of a user pressing and releasing a specific key associated with an interactive disturbance operation and the average duration of the user pressing other unassociated keys. Input stream backtracking refers to the situation where, during input, the user triggers the delete key to delete the mask of the character that was just entered and associated with the interaction disturbance, and then re-enters the character.

[0014] It should be understood that specific key hesitation and input stream backtracking are two types of features that can be objectively and with low latency extracted directly from the underlying input event stream. They respectively capture the immediate sense of confusion and subsequent cognitive correction intention when humans encounter unexpected feedback, together forming a behavioral fingerprint that is difficult to simulate by a non-cognitive program, providing direct evidence for rapid and accurate human-machine discrimination.

[0015] In some possible implementations, the exception determination module is specifically used for: When the duration of a specific key hesitation feature is less than a first threshold and no input stream backtracking feature is detected, it is highly likely that the operator is an automated program. When the duration of a specific key hesitation feature is detected to be higher than the second threshold, or when an input stream backtracking feature is clearly detected, the operator is likely to be identified as a real person. The second threshold is greater than or equal to the first threshold.

[0016] Specifically, a decision tree model with stronger fault tolerance is constructed by adopting a decision strategy based on dual thresholds and feature combinations. By introducing input stream backtracking as a strong feature for logical OR operation, the dependence on a single hesitation duration feature is effectively reduced, which can reduce false positives for quick-reacting human users while ensuring a high detection rate for automated programs.

[0017] In some possible implementations, the actual verification information generated by the information management module includes visual or textual information prompting the user to pay attention to specific keys in the password input box. These specific keys are consistent with or logically related to the keys associated with the interactive disturbance operation.

[0018] This invention proactively guides the user's visual attention by associating specific key presses with actual verification information. This systematically improves the user's probability of perceiving subsequent disturbances from a cognitive perspective, thereby enhancing the signal amplitude and consistency of the collected behavioral features and improving the overall detection sensitivity and reliability.

[0019] In some possible implementations, when the interactive perturbation module performs character missing perturbation, character redundancy perturbation, or morphological mutation perturbation, the perturbation duration or perturbation intensity introduced is a variable randomly generated within a predetermined range.

[0020] The beneficial effect is that the randomization of perturbation parameters makes the system's detection probe behave as a random process. This effectively thwarts the attacker's attempt to conduct adaptive attacks through recording and playback or fixed-pattern simulation. In the long run, it systematically increases the statistical difference between its simulated behavior and real human reactions, thereby improving the system's robustness against reverse engineering and persistent attacks.

[0021] In some possible implementations, the feature extraction module performs the following operations when extracting micro-behavioral features: In a high-precision time-series behavior sequence, a specific key event associated with the interactive disturbance operation, and a preset number of key events adjacent to the specific key event, are extracted as an analysis segment. Calculate and analyze the average keystroke rate within the segment, and compare the average keystroke rate with the average keystroke rate of the user in other non-disturbed segments in the current payment process to generate a relative rate change feature; The relative rate change feature is used to characterize whether the user's overall input rhythm changes abnormally after being disturbed.

[0022] This invention calculates and compares the average keystroke rate of perturbed segments with that of normal segments. The resulting relative rate change feature can smooth out random fluctuations in a single event and reflect more sustained input rhythm inconsistencies. This feature, based on local sequence statistics, has stronger noise resistance and more stable discriminative power compared to single-point event features, and is particularly advantageous against advanced anthropomorphic scripts with added random delays.

[0023] In some possible implementations, the system also includes a disturbance decision module; The disturbance decision module is used to dynamically decide whether to enable disturbance and what type of disturbance operation to select based on the risk level of the current payment transaction before initiating an interactive disturbance operation.

[0024] This invention enables dynamic optimization of detection resources. Reducing or disabling disturbances for low-risk transactions directly lowers system computational overhead and interference with the vast majority of legitimate users; enabling deep disturbance detection for high-risk transactions allows analysis resources to be focused on the most suspicious sessions. This achieves an optimal balance between security strength, system efficiency, and user experience.

[0025] The technical solutions provided by the embodiments of this disclosure have at least the following beneficial effects: 1. This system represents a shift in recognition methods from behavioral simulation to perceptual verification, solving the fundamental problem of advanced automated programs' inability to distinguish between different entities. By injecting implicit interactive perturbations at the front end, the system directly verifies whether the operator possesses visual feedback capabilities. This approach, which shifts the focus of detection from the behavioral to the cognitive level, effectively distinguishes between humans with perceptual abilities and automated programs lacking cognition.

[0026] 2. A dynamic and random reverse engineering-resistant detection mechanism has been constructed, overcoming the limitations of traditional rule-based risk control that is easily bypassed. The system strictly binds the disturbance trigger to the user's initial operation stage and adopts a randomized disturbance parameter execution method. This design makes each detection process unpredictable and unreproducible, effectively preventing attacks implemented through fixed pattern learning or recorded playback.

[0027] 3. A closed-loop technology combining high-precision multi-dimensional features and intelligent decision-making has been established, significantly reducing false alarms while maintaining a high detection rate. The system extracts highly discriminative multi-dimensional features by accurately collecting subtle operational behaviors during the perturbation phase, and then makes decisions based on these features using a self-learning optimization mechanism. This method enables accurate human-machine recognition in complex application scenarios.

[0028] 4. It achieves a balance between seamless security and user experience, providing a practical solution for online transaction scenarios. The system completes all detection processes at the front end without adding extra steps or introducing perceptible delays. This design ensures smooth payment processes while providing real-time proactive security protection. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the system framework structure of the present invention. Detailed Implementation

[0030] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] Please see Figure 1 This application provides a payment data anomaly identification system based on behavioral feature recognition, comprising: The information management module is used to obtain the expected verification information of the current payment transaction and generate the actual verification information that differs from the expected verification information by a preset value. The actual verification information generated by the information management module includes visual or textual information prompting the user to pay attention to specific keys in the password input box. These specific keys are consistent with or logically related to the keys associated with the interactive disturbance operation. It should be noted that the expected verification information is the standard verification information corresponding to the current payment transaction, specifically the preset character length and character type requirements of the password. In this embodiment, the expected verification information is set to a 6-digit numeric payment password. This information is retrieved by the information management module from the user information database in the payment transaction backend, with the retrieval response time controlled within 0.5-1 second to ensure the smoothness of the payment operation.

[0032] The actual verification information consists of verification parameters that differ from the expected verification information by a preset margin. The dimensions of the difference include the password character length requirement, the standard display format of the mask characters, and visual or textual information that prompts the user to pay attention to specific keys in the password input box.

[0033] In this embodiment, the preset difference of the actual verification information is set around the mask display rules of specific number keys, which provides accurate execution parameters for subsequent interactive perturbation operations. The specific key position is consistent with the number key 1 associated with the interactive perturbation operation. This design makes the prompt information strongly associated with the perturbation operation, which can guide the user to pay attention to the perturbation key, improve the user's perception sensitivity to abnormal mask display, and at the same time, it does not affect the undifferentiated input logic of the automated program.

[0034] Specifically, the text prompt in the actual verification information is displayed in the prompt bar area to the left of the password input box. The text content is set to "Please pay attention to the input display status of the number 1 key", with a font size of 12px and a color of #666666, which is consistent with the visual parameters of the surrounding interface text and does not produce a visual abruptness. The visual cue is a small, solid triangle (4px on each side, color #FF6600) added to the left of the input field corresponding to the number 1 key in the password input field. This cue is only displayed after the actual verification information UI is rendered and before the user completes the password input. It has no additional interactive function and only serves as a visual guide.

[0035] Text and visual cues are displayed simultaneously to create a dual cues effect. The display duration of the cues is consistent with the first input window period (2000 milliseconds), and they are automatically hidden after the timeout to avoid prolonged display interfering with the user's subsequent input.

[0036] If a specific key is logically associated with the key associated with the interactive disturbance operation, the logical association method is the same area key association (that is, when the interactive disturbance operation is associated with the number key 1, the specific key can be set to the key in the upper left area of ​​the number key area where the number key 1 is located). The prompt message is adjusted accordingly to "Please pay attention to the input display status of the key in the upper left side of the number key area". The visual prompt mark is moved to the corresponding area at the same time. In this embodiment, the association method of consistent keys is selected. This method prompts more directly and can enable legitimate users to quickly capture the display abnormality of the disturbance key and improve the effectiveness of micro-behavioral feature extraction.

[0037] The default trigger for the difference is fixed to the number key 1. The selection of this key is based on the statistical results of over 10,000 sets of user password input behavior (the number key 1 accounts for 18.2% of the number password input). It is a high-frequency input key, and perturbing this key is more likely to trigger the user's perception response, and will not cause a significant decline in the operating experience of legitimate users due to excessive key perturbation.

[0038] After the information management module generates the actual verification information, it synchronizes this information to the interaction perturbation module via an SSL / TLS encrypted transmission protocol to prevent the verification information from being tampered with or stolen. The UI rendering of the actual verification information is implemented based on mainstream front-end rendering engines (such as Chrome V8 and Safari Nitro). After rendering is complete, a UI rendering completion event carrying a millisecond-level precision timestamp is sent to the interaction perturbation module. The listening for the UI rendering completion event is implemented through the common front-end MutationObserver API. Specifically, it is configured to listen for changes in the style or display property of the password input box DOM node. When it changes from none to visible or block, it is determined that the rendering is complete. In mobile apps, the prompt message is triggered by the onLayout or viewDidAppear callback event of the native component, and the prompt message and password input box are rendered synchronously. The response time is adapted to different scenarios: ≤80 milliseconds for mobile apps, ≤100 milliseconds for H5 apps, and ≤50 milliseconds for PC apps, ensuring that the prompt message and input box are presented to the user at the same time.

[0039] The above implementation is merely an example. Those skilled in the art can use other equivalent event listening or interface rendering mechanisms to implement the technical solution of this invention.

[0040] The design of this step in the invention provides a foundation of parameters and guiding prompts for subsequent interactive perturbation operations. By pre-setting information differences, it lays the groundwork for the generation of perceptual deviations. At the same time, it guides users to focus on specific keys by combining visual and textual prompts, improving the perception of mask anomalies by legitimate users and making micro-behavioral features easier to capture. Automated programs, however, cannot recognize such prompts and maintain fixed input logic, further widening the behavioral differences between manual and program operations. The method of fixing a single perturbation key balances the effectiveness of perceptual deviations with the smoothness of the operating experience. The synchronous rendering of the timestamp provides an accurate time reference for determining the subsequent input window period.

[0041] The interactive perturbation module is used to perform an implicit interactive perturbation operation when the user enters in the password input box. The interactive perturbation operation causes a preset and controllable perceptual deviation between the character corresponding to the key pressed by the user in the password input box and the number or shape of the mask characters displayed in real time in response to the key operation in the password input box. The deviation is achieved through the instantaneous abnormality of the number or shape of the mask characters in the password input box. The interaction perturbation module activates interaction perturbation only for the first N characters entered by the user within the first input window period after the actual verification information is rendered, where N is an integer from 1 to 3. The first input window period is determined by the time difference between the user's first key press timestamp and the UI rendering completion event. It should be understood that the determination of the first input window period is based on the timestamp of the UI rendering completion event. The time difference between the timestamp of the user's first key press and the timestamp of this benchmark is used as the basis for determining the window period. In this embodiment, the time range of the first input window period is set to 0-2000 milliseconds. That is, the first key press operation made by the user within 2000 milliseconds after the actual verification information UI rendering is completed is determined to be entering the first input window period. The first key press exceeding 2000 milliseconds is determined to be an operation outside the window period and does not activate any interactive disturbance function.

[0042] Specifically, the time range is set based on statistics of over 5,000 sets of user payment input behavior (98.5% of legitimate users will make their first key input within 2,000 milliseconds after the password input box is rendered). This not only covers the operation scenarios of the vast majority of legitimate users, but also avoids the delayed simulation operation of automated programs.

[0043] The number of active characters N for interactive perturbation is an integer from 1 to 3, which is randomly selected by the system during the initialization of each payment transaction (randomly selected as 1, 2 or 3). The value of N is fixed in the same payment transaction process and is not dynamically adjusted. If the user completes the input when the number of characters input is less than the value of N, the perturbation operation continues until the input ends.

[0044] Furthermore, the choice of N value is combined with the perturbation operation type setting. For character missing perturbation and morphological change perturbation, N=1 or 2 is preferred, and for character redundancy perturbation, N=2 or 3 is preferred. This combination design is based on user perception sensitivity testing, which can reduce user operation confusion while ensuring the effectiveness of perception bias.

[0045] Specifically, during the first input window, the selected interactive perturbation operation is performed only on the first N characters entered by the user. When the number of characters entered by the user exceeds the value of N, the interactive perturbation module immediately stops the perturbation operation, and the mask display of the password input box is restored to the standard rules. Furthermore, all input operations outside the window and after exceeding the value of N do not trigger any form of interactive perturbation, ensuring that the perturbation operation only occurs in the initial stage of user input and minimizing interference with the subsequent normal input of legitimate users.

[0046] The interactive perturbation operation is specifically any of the following: character missing perturbation, which means that when the user presses the number key 1, the number of black dots of the mask character displayed in the password input box does not increase or increases with a delay, while for other number keys, the mask increases normally; Character redundancy perturbation refers to the instantaneous display of two mask characters (black dots) in the password input box when the user presses the number key 1, but only one input is actually recorded; morphological abrupt change perturbation refers to the mask display of the input as a special symbol that is different from the regular black dots when the user presses the number key 1, and this only applies to that specific key. When the interactive perturbation module performs character missing perturbation, character redundancy perturbation, or morphological abrupt change perturbation, the perturbation duration or perturbation intensity introduced is a variable that is randomly generated within a predetermined range. In this embodiment, the random generation of the perturbation duration is based on the Xorshift128+ pseudo-random number algorithm. The random number seed is formed by concatenating the unique identifier of the current payment transaction with the UI rendering completion timestamp. The random number seed is generated by concatenating the transaction order number (e.g., '202501220001') and the UI rendering completion timestamp (e.g., '1737561234567') as a string (e.g., '2025012200011737561234567'), and then generating a fixed-length byte sequence using the SHA-256 hash algorithm as the initial seed of the Xorshift128+ algorithm. This ensures that the perturbation parameters of each payment transaction are independent random values ​​with no repeating patterns, effectively avoiding the simulation and adaptation of fixed perturbation parameters by automated programs. The perturbation intensity is quantified according to different perturbation operation types. The perturbation intensity of character missing perturbation and character redundancy perturbation is reflected in the duration fluctuation of mask abnormal display. The perturbation intensity of morphological change perturbation is reflected in the visual difference fluctuation between special symbols and regular black dots. All random values ​​of perturbation duration and intensity are limited to preset ranges to ensure the effectiveness of perturbation effect and avoid users judging it as a system failure due to excessively large parameters or users not being able to perceive mask abnormalities due to excessively small parameters.

[0047] It should be noted that for the character missing perturbation, the preset random range of the perturbation duration is 200-400 milliseconds (the duration of the mask delay increase after the number key 1 is pressed). The specific delay duration is randomly generated within this range by the Xorshift128+ algorithm. The duration parameter is not fixed each time the character missing perturbation is executed. The execution form without mask increase has no duration parameter and is classified as a fixed strength perturbation. The strength of this perturbation is positively correlated with the delay duration. The closer the delay duration is to 400 milliseconds, the higher the perturbation strength and the more obvious the user's perception. The closer the delay duration is to 200 milliseconds, the lower the perturbation strength and the gentler the perception.

[0048] It should also be noted that, for character redundancy perturbation, the preset random range of the perturbation duration is 150-250 milliseconds (the duration range of the instantaneous display of double black dots). The specific display duration is randomly generated within this range by the Xorshift128+ algorithm. The front end uses the native JS DOM API (such as document.getElementById().style) to dynamically add, delete and restore DOM nodes. The strength of this perturbation is positively correlated with the display duration. The closer the display duration is to 250 milliseconds, the longer the duration of the double black dots is displayed, and the more obvious it is to the user. The closer the display duration is to 150 milliseconds, the shorter the duration of the display, and the softer it is to the user. Moreover, the front end response under all random durations is ≤50 milliseconds to ensure the instantaneity of the abnormal mask display.

[0049] To further clarify, for morphological mutation perturbation, there is no perturbation duration parameter. The perturbation intensity is reflected in the visual difference. The preset random range is from low difference to medium difference. Low difference means that the visual parameters of the special symbol and the regular black dot are only different in shape (the font size, color, and size are completely the same). Medium difference means that the special symbol adds a 1px stroke effect (stroke color #999999) while maintaining visual coordination with the regular black dot. The perturbation intensity level is randomly selected within this range by the Xorshift128+ algorithm. The visual effect of each morphological mutation perturbation is not fixed. Regardless of the intensity level selected, the special symbol is only displayed for the single input of the number key 1, and then immediately reverts to the regular black dot (the special symbol is an asterisk, font size 14px, color #333333, consistent with the basic visual parameters of the regular black dot mask).

[0050] It should be understood that the random parameters for the three perturbation operations are generated once when the interactive perturbation module is started. The specific perturbation duration or intensity parameters of the selected perturbation operation in the same payment transaction process are fixed and are not subject to secondary random adjustments. This ensures that the perturbation effect within a single transaction is stable and avoids confusion for legitimate users due to frequent parameter changes. At the same time, the generation and execution of random parameters are completed entirely on the front end without any additional data interaction with the back end, ensuring the execution efficiency and implicit characteristics of the perturbation operation.

[0051] All three interactive perturbation operations uniquely target the number key 1. This single-key perturbation design reduces the probability of automated programs recognizing and adapting to perturbation rules, and avoids causing operational confusion for legitimate users. During system initialization, one of the three perturbation operations is randomly selected and executed using a random number algorithm (the random number ranges from 1 to 3, corresponding to character missing perturbation, character redundancy perturbation, and morphological mutation perturbation, respectively). The perturbation type remains fixed throughout the entire payment transaction process, without secondary switching, thus preventing multiple perturbations from overlapping and affecting normal user input.

[0052] Among them, the execution trigger for character missing perturbation without adding a mask is immediate, with a response time of ≤50 milliseconds; the background of character redundancy perturbation only records the input data of the number key 1 once, without affecting the actual password input collection; the basic special symbol used for morphological change perturbation is the asterisk, with a font size of 14px and a color of #333333, which is consistent with the basic visual parameters of the regular black dot mask.

[0053] Specifically, the trigger condition for the interactive disturbance operation is that the user clicks the password input box and performs the first key press, and this first key press is within the first input window period. After detecting the trigger condition, the interactive disturbance module starts the operation within 100-300 milliseconds. The design consideration of this time interval is to avoid the user's initial input attention, ensure the implicit characteristics of the operation, and avoid being noticed by the user in advance.

[0054] All three interactive perturbation operations mentioned above are executed only for the number key 1, and are only effective during the first N character input phase within the first input window. When the user presses other number keys 0, 2-9, or after the number of characters entered exceeds N, the mask characters in the password input box are displayed according to standard rules (a black solid dot mask is displayed immediately after pressing a number key, without any abnormal changes in quantity or shape), ensuring the perturbation operation is targeted, phased, and controllable.

[0055] All perturbation operations are implemented by the interactive perturbation module by modifying the front-end display logic of the password input box. This only changes the visual display effect and does not affect the collection of character data from the user's actual keystrokes or the background recording, ensuring the concealment and controllability of the operation. The basic response time of the front-end modification operation is controlled within 50 milliseconds to ensure the instantaneous display of abnormal masking.

[0056] It should be further clarified that the "implicit interactive disturbance" implemented by this system is essentially to construct a "cognitive trap" for automated programs that lack visual feedback capabilities, rather than an explicit interference with the legitimate user's operation process.

[0057] Specifically, the terms "implicit" and "unobtrusive" refer to explicit verification methods that require active user response, such as CAPTCHAs and slider puzzles. The "perceptual deviation" manifests as a brief (e.g., 200-400 milliseconds), slight (e.g., a change in the shape or number of a single mask) interface display anomaly, which occurs during the initial stage of password input when the user's attention is highly focused.

[0058] For real users with visual cognitive abilities, such anomalies may be subconsciously perceived and trigger brief confusion, hesitation, or intention to correct (i.e., "micro-behavioral characteristics"). However, because the disturbance is short in duration, low in intensity, and does not interrupt the input process, users usually do not develop a clear conscious awareness of it, nor do they cancel or significantly delay payment operations as a result.

[0059] For automated programs that lack visual feedback and cognitive abilities, they will mechanically execute preset key simulation sequences regardless of how the interface changes, thus avoiding any micro-behavioral characteristics caused by perceptual bias.

[0060] Therefore, by combining implicit perturbations at the front end with detection and cognitive feedback at the back end, the system achieves efficient identification of automated programs while maximizing the smoothness of the payment experience for real users.

[0061] This invention can create controllable perceptual bias through imperceptible interactive perturbations. By setting the first input window period and the perturbation activation rules for the first N characters, the perturbation operation only occurs in the initial stage of user input. Combined with the design of randomized perturbation duration and intensity parameters, it further increases the difficulty for automated programs to identify and adapt to the perturbation rules. The three specific perturbation forms are all designed around a single numeric key. Combined with the prompts and guidance from the information management module, it further enhances the perceptual response of legitimate users to the perturbations. While increasing the difficulty for automated programs to identify the perturbations, it minimizes interference with the normal operation of legitimate users, providing the core basis for subsequent behavior recognition to distinguish between manual operation and automated programs.

[0062] The behavior acquisition module is used to monitor and record the user's input events in the password input box during the period when the interactive disturbance operation is in effect, and generate a high-precision time-series behavior sequence; Understandably, the effective period of the interactive disturbance operation is within the first input window period and the time range during which the number of characters entered by the user does not exceed the value of N. The operation terminates when the number of characters entered by the user exceeds the value of N, the user completes all password input operations, the user cancels password input, or the first input window period ends. During the effective period, the monitoring is continuous and uninterrupted. Operations on the numeric key 1 and the input of the first N characters are the key monitoring targets, and the collection accuracy is higher than that of other operations.

[0063] User input events include key press, key release, mouse cursor movement, focus switching in the password input box, and repeated key press. The behavior collection module collects these events through the input interface of the terminal device. In the Web environment, it is achieved by listening to native events such as keydown, keyup, mousemove, focus, and blur. The sampling rate is controlled by requestAnimationFrame or setTimeout. In mobile apps, high-precision data acquisition is achieved through system input event callbacks (such as UITextFieldDelegate in iOS and OnKeyListener in Android). The overall sampling rate is set to 100Hz, while the sampling rate for operations related to the number key 1 and the first N characters is increased to 200Hz to ensure that more subtle changes in the timing of operations are captured.

[0064] A high-precision temporal behavior sequence is a dataset of behavioral events arranged in chronological order. Its data structure includes event type identifier, event trigger timestamp (millisecond precision), event execution coordinates (pixel precision), associated key identifier (used to distinguish whether it is an operation of the number key 1), and input character sequence number (used to distinguish whether it is an input operation of the first N characters).

[0065] The sequence is stored as structured data in a temporary buffer (with a storage time of 5 minutes). Data is automatically cleared after subsequent anomaly detection. If communication is interrupted, the buffered data is used for detection if it passes verification after communication is restored; otherwise, it is re-acquired. Operation data related to the numeric key 1 and the input operation data for the first N characters are separately marked and stored for quick retrieval during subsequent feature extraction.

[0066] This enables high-precision, multi-dimensional collection of user behavior. The design improves collection accuracy for operations during the disturbance phase, effectively capturing subtle changes in user behavior caused by perceptual deviations. Combined with the enhanced perceptual sensitivity brought by prompts and the diversity of behavioral differences brought by random disturbance parameters, the collection of micro-behavioral features is more comprehensive and accurate, providing complete and accurate raw data for subsequent extraction of micro-behavioral features.

[0067] The feature extraction module is used to extract at least one micro-behavioral feature from a high-precision temporal behavior sequence that reflects the user's perception and confusion about the perceived deviation; When extracting micro-behavioral features, the feature extraction module performs the following operations: It extracts a segment from a high-precision temporal behavior sequence, including specific key events associated with interactive disturbances and a preset number of adjacent key events before and after the specific key event; it calculates the average keystroke rate within the segment and compares this average keystroke rate with the average keystroke rate of the user in other non-disturbed segments of the current payment process to generate a relative rate change feature; this relative rate change feature characterizes whether the user's overall input rhythm changes abnormally after being disturbed. In this embodiment, the specific key event associated with the interactive perturbation operation specifically refers to the number key 1 key event in the first N character input phase within the first input window period of the high-precision timing behavior sequence. The preset number is set to 2 key events before and after the number key 1 key event. That is, the truncation range of the analysis segment is the 2 key events before the number key 1 key event, the number key 1 key event itself, and the 2 key events after the number key 1 key event. A single analysis segment contains a total of 5 consecutive key events.

[0068] The preset number in this application is based on the statistics of more than 800 sets of user operation behavior after disturbance. The interception range of 2 key events before and after can fully cover the input rhythm change range after the user is disturbed. It will not cause incomplete rhythm feature extraction due to the range being too small, nor will it introduce irrelevant operation data and affect the accuracy of the features due to the range being too large.

[0069] The segment extraction module is responsible for the extraction of the analysis fragment based on the associated key identifiers and input character numbers in the high-precision temporal behavior sequence. By accurately matching the timestamp and sequence index of the number key 1 key event, the module can quickly locate and extract the analysis fragment with an extraction response time of ≤50 milliseconds, ensuring the efficiency of feature extraction.

[0070] The average keystroke rate is calculated based on the timestamp of the key press operation. The formula is V=K / T (where V is the average keystroke rate, in seconds; K is the number of valid key events in the analysis segment, which is fixed at 5 in this embodiment; and T is the timestamp difference between the first and last key events in the analysis segment, in seconds). The timestamp difference is calculated with millisecond precision to ensure the accuracy of the average keystroke rate calculation.

[0071] In the current payment process, other non-disturbance segments refer to segments consisting of all key events in the high-precision time-series behavior sequence, excluding the first N character input phase within the first input window. The average keystroke rate of non-disturbance segments is calculated using the same formula (V=K / T), and the selection of non-disturbance segments follows the principle of continuous key events. The number of key events in a single non-disturbance segment is not less than 10. If the number of non-disturbance key events in the current payment process is less than 10, all non-disturbance key events are used for calculation to ensure the effectiveness of the comparison benchmark.

[0072] The relative rate change feature is generated using the ratio method, and the calculation formula is R=(V0-V1) / V0×100% (where R is the relative rate change feature, presented as a percentage; V0 is the average keystroke rate of the non-disturbance segment in the user's current payment process). V1 represents the average keystroke rate within the analyzed segment. When R is positive, it indicates that the average keystroke rate after the user is disturbed is lower than that in the undisturbed stage, and the input rhythm slows down. When R is negative, it indicates that the average keystroke rate of the user after being disturbed is higher than that in the undisturbed stage, and the input rhythm speeds up. The closer the absolute value of R is to 100%, the greater the variation in the user's input rhythm and the higher the degree of abnormality; when the absolute value of R approaches 0, it indicates that the user's input rhythm does not change significantly after being disturbed and there are no abnormal characteristics.

[0073] To ensure the reliability of the relative rate change characteristic (R) calculation, the system has explicit processing rules for cases where non-perturbation segment data is insufficient: If the user input process is extremely short, resulting in fewer than 10 extractable non-perturbation segment valid key events, the relative rate change characteristic R will not be calculated. In this case, the system will adopt one of the following two alternative strategies: Strategy A: Enable user history benchmark. With user authorization, retrieve the user's historical payment behavior model on this device and use their historical average keystroke rate as the benchmark V0' for calculation.

[0074] Strategy B: Enable global benchmark and absolute rate analysis. If no historical data is available, the system-preset global average keystroke rate, derived from statistics of massive amounts of real user data, is used as the benchmark V0''. Simultaneously, the average keystroke rate V1 of the perturbation segment itself is directly analyzed to determine whether it falls within the preset "reasonable human operation rate range".

[0075] Regardless of the strategy employed, the resulting judgment in this situation will carry a low confidence weight, prompting the subsequent risk control system to conduct a comprehensive assessment.

[0076] In this embodiment, the calculation accuracy of the relative rate change feature is 0.01%, and it is included in the micro-behavior feature set together with the specific key position hesitation feature, input stream backtracking feature, key repetition operation feature, and input box focus switching feature. The feature set includes quantitative indicators such as feature type, feature duration, feature trigger count, associated key identifier, input stage identifier, analysis segment range, average keystroke rate, and relative rate change value, providing multi-dimensional feature support for anomaly judgment.

[0077] The extraction parameters and judgment criteria for each micro-behavioral feature are as follows: The specific key position hesitation feature is defined as follows: when a user presses the number key 1 and inputs the first N characters within the first input window, if the time interval between two adjacent key operations is greater than twice or more than the normal input interval (300-800 milliseconds), it is judged as a pause or hesitation behavior. The feature duration is the time interval between two adjacent key operations. When other number keys are pressed or input values ​​exceeding N are entered, if the interval between two consecutive key presses is three times or more than the normal input interval, it is considered a pause. The pause duration is extracted with millisecond-level precision. The input stream backtracking feature is defined as follows: when a user presses the number key 1 within the first input window and enters the first N characters, if the mouse cursor moves to the position of the already entered masked character and clicks it, and the cursor stays there for more than 200 milliseconds, this behavior is considered to exist. This feature is a typical verification behavior after the user perceives an anomaly in the mask.

[0078] The key repetition operation feature is defined as follows: when a user presses the number key 1 continuously for the first N characters ≥ 2 times within the first input window period, and the time interval between the two key presses is less than 100 milliseconds, the behavior is determined to exist. If other number keys are pressed continuously or an input value exceeding N is entered, and the number of times is ≥3 and the interval is less than 100 milliseconds, it is judged as a repeated operation. This feature is a typical supplementary operation behavior after the user perceives that the mask is not displayed normally.

[0079] The input box focus switching feature is defined as follows: when a user presses the number key 1 and enters the first N characters within the first input window, the password input box loses focus and then regains focus, and the focus loss time is greater than 100 milliseconds. This behavior is a typical confirmation behavior after the user perceives an abnormal operation.

[0080] It should be noted that the determination rules for micro-behavioral features in this invention reflect the principle of targeted design of target key positions.

[0081] Because the interactive perturbation operation is specifically targeted at a particular key (such as the number key "1"), the system sets differentiated sensitivity thresholds for actions occurring on that specific key and actions occurring on other keys. For example, the threshold for determining the "repeated key operation feature" is "2 consecutive times" for the number key "1", while the threshold for determining other number keys is "3 consecutive times". This is because: The number key "1" is used as a perturbation target. Users are more likely to press it repeatedly to confirm or correct it after it displays an abnormality. This behavior is directly related to "perceptual bias". Therefore, a more sensitive threshold is used to capture this signal.

[0082] Repeated operation of other buttons is more likely to be due to habitual accidental pressing, which is unrelated to the core detection target. Therefore, a more lenient threshold is used to avoid false alarms.

[0083] It should be understood that, unless otherwise specified, all references to "specific key," "associated key," or similar expressions in the specification and claims refer to the specific key selected as the target by the current interactive disturbance operation. This targeted and differentiated design is key to the system's ability to accurately capture biological cognitive responses directly caused by perceptual biases while effectively filtering out irrelevant operational noise.

[0084] The feature extraction module traverses the high-precision temporal behavior sequence, prioritizes retrieving the numeric key 1 related operation data of the first N character input stages within the first input window, completes the accurate extraction and quantification of the analysis segment and each micro-behavioral feature, and generates a complete micro-behavioral feature set.

[0085] The innovation of this invention lies in its ability to accurately extract multi-dimensional micro-behavioral features related to perceptual deviations from massive amounts of temporal behavioral data. It sets differentiated extraction thresholds for operations during the disturbance phase, combines the enhanced perceptual sensitivity brought by prompt information with the diversity of behavioral differences brought by random disturbance parameters, and achieves accurate characterization of abnormal changes in the user's input rhythm after being disturbed by extracting and analyzing segments and calculating relative rate change features. This makes the extraction of micro-behavioral features more comprehensive and accurate, improves the targeting and accuracy of feature extraction, eliminates irrelevant normal operating behaviors, and provides multi-dimensional and highly reliable feature support for subsequent anomaly judgment.

[0086] The anomaly detection module is used to determine whether the current operator is an automated program that is not sensitive to interactive disturbances based on micro-behavioral characteristics. It should be noted that the system's decision logic covers two scenarios regarding whether the perturbation was successfully triggered: Scenario 1 (Successful Perturbation Trigger): The user presses the number key "1" during the first N inputs within the first input window, successfully activating and executing the interactive perturbation operation. At this point, the system will make a core decision based on the micro-behavioral features and thresholds described below.

[0087] Scenario 2 (No Disturbance Triggered): The user does not press the number key "1" during the stated phase, resulting in the interactive disturbance operation not being executed. In this case, the system will not misjudge due to the lack of core features, but will instead mark this session as "no perceptual verification implemented" and automatically switch to the payment system's original auxiliary risk control process, which is based on device fingerprints, transaction behavior patterns, network characteristics, and other multi-dimensional factors, for a comprehensive risk assessment. This ensures the applicability and stability of the system under various user input habits.

[0088] The time thresholds or frequency thresholds involved in the above-mentioned micro-behavioral features are preferred implementations. Those skilled in the art can make equivalent adjustments according to specific application scenarios. As long as the distinction between manual operation and automated program operation can be achieved, it will not affect the implementation of the present invention.

[0089] The anomaly detection module is specifically used to: when the duration of a specific key hesitation feature is lower than the first threshold and no input stream backtracking feature is detected, it is highly likely that the operator is an automated program; when the duration of a specific key hesitation feature is higher than the second threshold, or when an input stream backtracking feature is clearly detected, it tends to determine that the operator is a real person; wherein, the second threshold is greater than or equal to the first threshold. In this embodiment, the first threshold is set to 200 milliseconds and the second threshold is set to 500 milliseconds (the second threshold is greater than the first threshold). This threshold setting is based on the statistical analysis of ≥1000 user and automated program operation samples (the average duration of specific key hesitation characteristics generated by legitimate users after perceiving mask anomalies is 650 milliseconds, while the key hesitation duration of automated programs is generally less than 150 milliseconds). This threshold range can achieve accurate differentiation between manual operation and program operation.

[0090] The specific key hesitation feature refers to the duration of the key pause after the user presses the number key 1 during the first N character input phase within the first input window; the input stream backtracking feature refers to the cursor backtracking behavior after the user presses the number key 1 during the first N character input phase within the first input window.

[0091] Specifically, when executing a judgment, the anomaly judgment module prioritizes extracting specific key position hesitation features and input stream backtracking features related to the numeric key 1, the first N characters, and the first input window period from the feature set. At the same time, it uses relative rate change features as the main auxiliary judgment dimension, and combines key repetition operation features and input box focus switching features for comprehensive verification.

[0092] It is foreseeable that the specific implementation of the judgment logic is as follows: if the duration of the hesitation feature of a specific key position is less than 200 milliseconds (the first threshold) and no input stream backtracking feature is detected, then the probability that the operator is an automated program is higher than 95%, and the current payment transaction is immediately marked as a high-risk abnormal transaction. If the absolute value of the relative rate change feature is ≤10%, the confidence level will be increased to 99% to further confirm the automated program operation feature. If the duration of a specific key hesitation feature is greater than 500 milliseconds (second threshold), or at least one input stream backtracking feature is detected and the cursor stays for ≥200 milliseconds, the operator is likely to be a real person, the confidence level is ≥90%, and the current payment transaction is marked as a normal transaction. If the absolute value of the relative rate change characteristic is ≥30% at this time, it is determined to be a normal input rhythm change caused by perceptual disturbance of a real person, and is not included in the abnormal judgment range.

[0093] If the duration of a specific key hesitation feature is between 200 milliseconds (first threshold) and 500 milliseconds (second threshold), and no input stream backtracking feature is detected, it is judged as a suspected abnormal transaction, triggering lightweight security verification (such as SMS verification code verification), without directly blocking the payment process, balancing security and payment experience; if the absolute value of the relative rate change feature is ≥50%, the abnormal judgment level is upgraded, triggering intermediate security verification (such as facial recognition verification). If the absolute value of the relative rate change characteristic is ≤20%, the anomaly judgment level will be downgraded, and only SMS verification code verification will be triggered.

[0094] It should be noted that if the core dimensions (specific key position hesitation features, input stream backtracking features) are determined to be automated programs, but the auxiliary features (such as multiple focus switching, absolute value of relative rate change features ≥40%) show obvious human operation features, the anomaly judgment level will be downgraded, triggering secondary verification instead of direct blocking, to avoid misjudgment.

[0095] The response time of the anomaly judgment module is controlled within 1-2 seconds to ensure that anomaly identification is completed without affecting the payment process. If the judgment is not completed within 2 seconds, it is judged by default that the operation is normal (preferably judged as a real person), so as to avoid the operation of legitimate users being blocked due to judgment delay.

[0096] In addition, the anomaly detection module has a self-learning function, which can include new legitimate user operation samples and automated program attack samples in the statistical scope. It focuses on collecting specific key hesitation duration and input stream backtracking feature data under different N values, different perturbation operations, different random perturbation durations or intensities, and different relative rate change characteristics.

[0097] Specifically, every 500 new samples are accumulated, the first and second thresholds are optimized and adjusted once. The adjustment formula is: Threshold = Current Threshold × (1 + Δ) (where Δ is the deviation rate between the new sample mean and the historical mean, |Δ|≤10%). Δ is calculated as follows: ,in The arithmetic mean of newly collected samples (e.g., the duration of hesitation at a specific key). This is the arithmetic mean of historical samples. The samples are only sourced from labeled data that has been manually verified as belonging to legitimate users or known automated programs. The system updates the sample library every 24 hours. After adjustment, the requirement that the second threshold is greater than or equal to the first threshold is still maintained. At the same time, the auxiliary judgment weights of the relative rate change feature under different judgment scenarios are optimized to improve the accuracy and adaptability of the judgment.

[0098] When an anomaly is detected (i.e., there is a high probability that the operator is an automated program), the anomaly detection module will immediately send an anomaly warning signal to the payment transaction backend and trigger the payment transaction security protection mechanism. The protection measures include suspending the current password input operation, requiring the user to perform secondary verification, and locking the payment account for 10 minutes. The specific protection measures can be adjusted according to the security level of the payment scenario.

[0099] The ingenuity of this invention lies in its ability to accurately distinguish between manual operations and automated program operations based on the quantification threshold of core micro-behavioral features. By setting a tiered decision logic and threshold range, combined with multi-dimensional auxiliary judgment based on relative rate change features, and by combining the improved effectiveness of micro-behavioral features brought by prompt information with the diversity of behavioral differences brought by random perturbation parameters, it not only ensures the accurate identification of high-risk automated programs, but also avoids misjudgment of legitimate users, thus balancing the security and smoothness of payment transactions.

[0100] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A payment data anomaly identification system based on behavioral feature recognition, characterized in that, include: The information management module is used to obtain the expected verification information of the current payment transaction and generate the actual verification information that differs from the expected verification information by a preset value. The interactive perturbation module is used to perform an implicit interactive perturbation operation when the user enters in the password input box. The interactive perturbation operation causes a preset and controllable perceptual deviation between the character corresponding to the key pressed by the user in the password input box and the number or shape of the mask characters displayed in real time in response to the key operation in the password input box. The deviation is achieved through the instantaneous abnormality of the number or shape of the mask display in the password input box. The behavior acquisition module is used to monitor and record the user's input events in the password input box during the period when the interactive disturbance operation is in effect, and generate a high-precision time-series behavior sequence; The feature extraction module is used to extract at least one micro-behavioral feature from a high-precision temporal behavior sequence that reflects the user's perception and confusion about the perceived deviation; The anomaly detection module is used to determine whether the current operator is an automated program that is not sensitive to interactive disturbances based on micro-behavioral characteristics.

2. The payment data anomaly identification system based on behavioral feature recognition according to claim 1, characterized in that, The interactive perturbation operation is specifically any of the following: Character missing perturbation refers to the situation where, when a user presses the number key 1, the number of black dots in the mask character displayed in the password input box does not increase or increases with a delay, while for other number keys, the mask increases normally. Character redundancy perturbation refers to the phenomenon where, when a user presses the number key 1, two masked black dots are momentarily displayed in the password input box, but only one input is actually recorded. Morphological abrupt change perturbation refers to the situation where, when a user presses the number key 1, the mask for this input is displayed as a special symbol that differs from the regular black dot, and this applies only to that specific key.

3. The payment data anomaly identification system based on behavioral feature recognition according to claim 2, characterized in that, The interaction perturbation module activates interaction perturbation only for the first N characters entered by the user within the first input window period after the actual verification information is rendered, where N is an integer from 1 to 3. The first input window period is determined by the time difference between the user's first key press timestamp and the UI rendering completion event.

4. The payment data anomaly identification system based on behavioral feature recognition according to claim 1, characterized in that, Micro-behavioral characteristics include: Specific key hesitation characteristic refers to the measurable difference between the duration of a user pressing and releasing a specific key associated with an interactive disturbance operation and the average duration of the user pressing other unassociated keys. Input stream backtracking refers to the situation where, during input, the user triggers the delete key to delete the mask of the character that was just entered and associated with the interaction disturbance, and then re-enters the character.

5. The payment data anomaly identification system based on behavioral feature recognition according to claim 4, characterized in that, The exception judgment module is specifically used for: When the duration of a specific key hesitation feature is less than a first threshold and no input stream backtracking feature is detected, it is highly likely that the operator is an automated program. When the duration of a specific key hesitation feature is detected to be higher than the second threshold, or when an input stream backtracking feature is clearly detected, the operator is likely to be identified as a real person. The second threshold is greater than or equal to the first threshold.

6. The payment data anomaly identification system based on behavioral feature recognition according to claim 1, characterized in that, The actual verification information generated by the information management module includes visual or textual information prompting the user to pay attention to specific keys in the password input box. These specific keys are consistent with or logically related to the keys associated with the interactive disturbance operation.

7. A payment data anomaly identification system based on behavioral feature recognition according to claim 2, characterized in that, When the interactive perturbation module performs character missing perturbation, character redundancy perturbation, or morphological mutation perturbation, the perturbation duration or perturbation intensity introduced is a variable that is randomly generated within a predetermined range.

8. The payment data anomaly identification system based on behavioral feature recognition according to claim 1, characterized in that, When extracting micro-behavioral features, the feature extraction module performs the following operations: In a high-precision time-series behavior sequence, a specific key event associated with the interactive disturbance operation, and a preset number of key events adjacent to the specific key event, are extracted as an analysis segment. Calculate and analyze the average keystroke rate within the segment, and compare the average keystroke rate with the average keystroke rate of the user in other non-disturbed segments in the current payment process to generate a relative rate change feature; The relative rate change feature is used to characterize whether the user's overall input rhythm changes abnormally after being disturbed.

9. A payment data anomaly identification system based on behavioral feature recognition according to claim 1, characterized in that, The system also includes a disturbance decision module; The disturbance decision module is used to dynamically decide whether to enable disturbance and what type of disturbance operation to select based on the risk level of the current payment transaction before initiating an interactive disturbance operation.

Images