Cross-border fraud transaction real-time blocking method and system based on multi-dimensional weak feature fusion

Abstract

This application proposes a real-time blocking method and system for cross-border fraud transactions based on multi-dimensional weak feature fusion. The client device deploys a front-end data acquisition module to asynchronously collect transaction feature data and transmits it via an encrypted channel to an edge data cleaning and fingerprint generation module to calculate device information entropy and extract device hardware fingerprints. A discrete weak feature cross-quantization engine constructs high-dimensional feature vectors from network and environmental misalignment features and human-computer interaction behavior physiological features. It calculates weak feature cross-scores and human-computer interaction behavior physiological feature quantization scores using matrix multiplication operators and dynamic weight vectors. A sliding time window memory manager counts the number of merchants and card numbers changing in the current device hardware fingerprint based on device information entropy to obtain a real-time historical risk density score. A real-time blocking state machine decision-maker calculates the final comprehensive fraud index and controls the core gateway's next step. This application improves the weak feature fraud interception rate and reduces the transaction false positive rate.

Description

Technical Field

[0001] This application relates to the fields of cross-border payment security and computer network risk control technology, specifically to a method and system for real-time blocking of cross-border fraud transactions based on multi-dimensional weak feature fusion. Background Technology

[0002] Traditional cross-border acquiring systems rely on discrete rule matching based on the "strong features" of devices. The usual practice is to collect basic publicly available device information at the front end (such as browser version number, operating system type, and single source IP address) and configure hard-coded rules in the back-end risk control engine (for example, triggering direct gateway blocking when the same IP address changes 3 credit cards for payment within 1 hour, or when the password is wrong 3 times in a row).

[0003] However, existing technologies cannot identify fraud with highly concealed, non-obvious risk characteristics. Cross-border fraud gangs currently commonly use highly anonymous dynamic proxy IPs, inject dynamic tampering of hardware features at the underlying level (such as Canvas rendering and WebGL physical hardware feature obfuscation), and use batch automated modification control terminals (group control device clusters) to commit crimes in a virtualized manner. On the surface, the network environment and card of a single transaction are completely legitimate, and the features are extremely sparse and concealed, making traditional fraud prevention based on strong feature static rule bases completely ineffective.

[0004] In addition, traditional anti-fraud solutions cannot meet the performance requirements of millisecond-level "real-time blocking" in cross-border acquiring. Although existing deep learning graph neural network models can mine multi-dimensional correlation indicators, they have a large number of model parameters and high computational latency (usually exceeding 300ms). In scenarios where global acquiring systems are extremely sensitive to transaction time, they cannot achieve "real-time blocking" in the core transaction link and often can only refuse payment afterward, resulting in cross-border merchants incurring large financial losses.

[0005] Therefore, in order to solve the above problems, this application proposes a method and system for real-time blocking of cross-border fraud transactions based on multi-dimensional weak feature fusion. Summary of the Invention

[0006] This application addresses one or more technical deficiencies in the prior art by proposing the following technical solution.

[0007] Based on the first aspect of this application, a real-time blocking system for cross-border fraud transactions based on multi-dimensional weak feature fusion is proposed, including a front-end data acquisition module, an edge data cleaning and fingerprint generation module, a discrete weak feature cross-quantization engine, a sliding time window memory manager, and a real-time blocking state machine decision maker. The client device deploys a front-end data acquisition module to asynchronously collect transaction feature data and transmit the transaction feature data to the edge data cleaning and fingerprint generation module through an encrypted channel; the transaction feature data includes hardware-level nonlinear features, network and environment misalignment features, and human-computer interaction behavior physiological features; The edge data cleaning and fingerprint generation module calculates the device information entropy based on the transaction feature data and extracts the device hardware fingerprint. The discrete weak feature cross-quantization engine is connected to the edge data cleaning and fingerprint generation module. It is used to construct a high-dimensional feature vector from the network and environment misalignment features and the human-computer interaction behavior physiological features, and to calculate the weak feature cross-score and the human-computer interaction behavior physiological feature quantization score through matrix dot multiplication operator and dynamic weight vector. The sliding time window memory manager interacts bidirectionally with the discrete weak feature cross-quantization engine, and based on the device information entropy, it counts the number of merchants and card numbers that change in the current device hardware fingerprint within the sliding time window to obtain a real-time historical risk density score. The output of the discrete weak feature cross-quantization engine is connected to the real-time blocking state machine decision-maker. The real-time blocking state machine decision-maker calculates the final comprehensive fraud index based on the real-time historical risk density score, the device information entropy, the weak feature cross-score, and the human-computer interaction behavior physiological feature quantization score, and controls the next step instruction of the core gateway based on the final comprehensive fraud index. The formula for calculating the final comprehensive fraud index is as follows: ; Risk represents the final overall fraud index. Represents the weak feature cross scores, α, β, γ and This represents the weighting coefficients, and the dynamic weight vector and weighting coefficients are adjusted according to the transaction scenario. Represents device information entropy. This represents the real-time historical risk density score. This represents a quantitative score indicating the physiological characteristics of human-computer interaction behavior.

[0008] Furthermore, the next instructions for controlling the core gateway based on the final comprehensive fraud index include: If Risk ≥ 0.85, a BLOCK instruction will be issued to directly block the transaction; If 0.5 ≤ Risk < 0.85, then issue a CHALLENGE command to trigger interactive secondary security identity verification; If Risk < 0.5, a PASS command is issued, allowing safe passage.

[0009] This application performs secondary verification on suspected fraudulent transactions with indistinct characteristics, rather than simply blocking them outright. This significantly reduces the false positive rate of normal transactions, improves merchant order conversion rates, and achieves the optimal balance between high-risk interception and low-risk release.

[0010] Furthermore, the underlying nonlinear features of the hardware include Canvas rendering hash, WebGL fingerprint, and AudioContext audio context features; The network and environment mismatch features include the WebRTC real IP, the difference between the system time zone and the IP's time zone, and the matching degree between the browser language and the country language of the billing address; The physiological characteristics of human-computer interaction behavior include the page dwell time sequence and the slider micro-shaking trajectory.

[0011] This application can effectively identify network proxies and environmental spoofing in cross-border fraud scenarios, capture the microscopic differences between human operations and machine scripts, and maintain the integrity of device hardware fingerprints.

[0012] Furthermore, the formula for calculating the device information entropy is: ; in, Represents device information entropy. This represents the Canvas rendering hash. Indicates WebGL fingerprint, This indicates the total number of fonts installed on the client.

[0013] This step helps avoid drastic changes in fingerprints caused by fluctuations in a single font library, maintaining sensitivity to the virtual machine's simplified font environment.

[0014] Furthermore, if If the value is less than 50, the device is determined to be a virtual machine or a headless browser; device information entropy. Deduct 50%; like If the device matches the preset anti-fingerprint browser blacklist, it is determined to be an environment forgery, and the device information entropy is then... Forced reset to zero.

[0015] This step can identify large-scale automated fraud environments, block repeated attacks using known device hardware fingerprints, and balance the sensitivity and determinism of identification.

[0016] Furthermore, a time-domain analysis is performed on the slider micro-jitter trajectory in the physiological characteristics of the human-computer interaction behavior, calculating the trajectory deviation and acceleration variance. If the slider micro-jitter trajectory presents a standard straight line or arc, then the quantitative score of the physiological characteristics of the human-computer interaction behavior is [value missing]. Set to 1; If the slider's micro-shaking trajectory exhibits random shaking characteristics consistent with human muscle tremors, then the physiological characteristic quantification score of human-computer interaction behavior is obtained. Set it to 0.1.

[0017] Furthermore, the system counts the number of merchants and card numbers whose hardware fingerprints change within a preset sliding time window across the global acquiring network. If the number of merchants changing within the preset sliding time window... >2 or the number of card numbers that change within a preset sliding time window. If the score is >3, it indicates a cluster of fraudulent activities involving group control devices. The real-time historical risk density score of the device's hardware fingerprint is needed. Set to 1; otherwise, the real-time historical risk density score of the device's hardware fingerprint. Set it to 0.1.

[0018] This step can detect mass attack behavior and prevent normal cross-merchant transactions from being identified as fraudulent transactions.

[0019] Based on a second aspect of this application, a method for real-time blocking of fraudulent transactions according to the system described above is also proposed, comprising: S1: The client device deploys a front-end data acquisition module to asynchronously collect transaction feature data and transmit the transaction feature data to the edge data cleaning and fingerprint generation module through an encrypted channel; the transaction feature data includes hardware-level nonlinear features, network and environment misalignment features, and human-computer interaction behavior physiological features; S2: The edge data cleaning and fingerprint generation module calculates the device information entropy based on the transaction feature data and extracts the device hardware fingerprint; S3: The discrete weak feature cross-quantization engine constructs the network and environment misalignment features and the human-computer interaction behavior physiological features into a high-dimensional feature vector, and calculates the weak feature cross score and the human-computer interaction behavior physiological feature quantization score through matrix dot multiplication operator and dynamic weight vector. S4: The sliding time window memory manager and the discrete weak feature cross-quantization engine perform bidirectional data interaction, and based on the device information entropy, count the number of merchants and card numbers that change in the current device hardware fingerprint within the sliding time window to obtain the real-time historical risk density score. S5: The real-time blocking state machine decision-maker calculates the final comprehensive fraud index based on the real-time historical risk density score, the device information entropy, the weak feature cross score, and the physiological feature quantification score of human-computer interaction behavior, and controls the next step instruction of the core gateway based on the final comprehensive fraud index.

[0020] Furthermore, the formula for calculating the final comprehensive fraud index is as follows: ; Risk represents the final overall fraud index. Represents the weak feature cross scores, α, β, γ and This represents the weighting coefficients, and the dynamic weight vector and weighting coefficients are adjusted according to the transaction scenario. Represents device information entropy. This represents the real-time historical risk density score. This represents a quantitative score indicating the physiological characteristics of human-computer interaction behavior.

[0021] Based on a third aspect of this application, a computer program product is also proposed, on which one or more computer programs are stored, which, when executed by a computer processor, implement the method described above.

[0022] The technical advantages of this application are as follows: This application bypasses the easily forged IP and Cookie on the surface, and constructs an unalterable unique device identity by comprehensively using Canvas, audio context, and time zone / language misalignment. It abandons the high-latency deep neural network and uses lightweight matrix multiplication for discrete feature cross-aggregation, ensuring millisecond-level computation under high concurrency. It tracks the behavior of group control devices that frequently change cards and merchants in real time in memory, transforming static features into dynamic behavior density, which can improve the interception rate of covert fraud, significantly reduce the false judgment rate of normal transactions while ensuring security, and improve the merchant order conversion rate. The overall execution time is controlled within 15ms, which perfectly meets the throughput requirements of the global acquiring core link. Attached Figure Description

[0023] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings.

[0024] Figure 1 This is a schematic diagram of the framework of a real-time fraud transaction blocking system based on weak cross-border features, provided according to an embodiment of this application.

[0025] Figure 2 This is a flowchart of a real-time blocking method for cross-border weak-feature fraud transactions provided according to an embodiment of this application.

[0026] Figure 3 This is a schematic diagram of the structure of a computer system suitable for implementing the electronic devices of the present application embodiments. Detailed Implementation

[0027] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0028] It is understood that the specific embodiments described herein are merely for explaining the relevant invention and not for limiting the invention.

[0029] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0030] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0031] The present application will now be described in detail with reference to the accompanying drawings and embodiments.

[0032] Figure 1 The present application illustrates a real-time blocking system for cross-border fraud transactions based on multi-dimensional weak feature fusion, including a front-end data acquisition module 101, an edge data cleaning and fingerprint generation module 102, a discrete weak feature cross-quantization engine 103, a sliding time window memory manager 104, and a real-time blocking state machine decision 105. The client device deploys a front-end data acquisition module 101, which asynchronously collects transaction feature data and transmits the transaction feature data to the edge data cleaning and fingerprint generation module through an encrypted channel; the transaction feature data includes hardware-level nonlinear features, network and environment misalignment features, and human-computer interaction behavior physiological features; The edge data cleaning and fingerprint generation module 102 calculates the device information entropy based on the transaction feature data and extracts the device hardware fingerprint; The discrete weak feature cross-quantization engine 103 is connected to the edge data cleaning and fingerprint generation module 102. It is used to construct the network and environment misalignment features and the human-computer interaction behavior physiological features into a high-dimensional feature vector, and calculate the weak feature cross score and the human-computer interaction behavior physiological feature quantization score through matrix dot multiplication operator and dynamic weight vector. The sliding time window memory manager 104 interacts bidirectionally with the discrete weak feature cross-quantization engine 103, and based on the device information entropy, it counts the number of merchants and card numbers that change in the current device hardware fingerprint within the sliding time window to obtain the real-time historical risk density score. The output of the discrete weak feature cross-quantization engine 103 is connected to the real-time blocking state machine decision-maker 105. The real-time blocking state machine decision-maker 105 calculates the final comprehensive fraud index based on the real-time historical risk density score, the device information entropy, the weak feature cross-score, and the human-computer interaction behavior physiological feature quantization score, and controls the next step instruction of the core gateway based on the final comprehensive fraud index. The formula for calculating the final comprehensive fraud index is as follows: ; Risk represents the final overall fraud index. Represents the weak feature cross scores, α, β, γ and This represents the weighting coefficients, and the dynamic weight vector and weighting coefficients are adjusted according to the transaction scenario. Represents device information entropy. This represents the real-time historical risk density score. This represents a quantitative score indicating the physiological characteristics of human-computer interaction behavior.

[0033] It should be noted that the next instructions for controlling the core gateway based on the final comprehensive fraud index include: If Risk ≥ 0.85, a BLOCK instruction will be issued to directly block the transaction; If 0.5 ≤ Risk < 0.85, then issue a CHALLENGE command to trigger interactive secondary security identity verification; If Risk < 0.5, a PASS command is issued, allowing safe passage.

[0034] It should be noted that this application performs secondary verification on suspected fraudulent transactions with indistinct characteristics, rather than blocking them outright. This significantly reduces the false positive rate of normal transactions, improves the order conversion rate of merchants, and achieves the optimal balance between high-risk interception and low-risk release.

[0035] It should be noted that the underlying nonlinear features of the hardware include Canvas rendering hash, WebGL fingerprint, and AudioContext audio context features; The network and environment mismatch features include the WebRTC real IP, the difference between the system time zone and the IP's time zone, and the matching degree between the browser language and the country language of the billing address; The physiological characteristics of human-computer interaction behavior include the page dwell time sequence and the slider micro-shaking trajectory.

[0036] It should be noted that this application can effectively identify network proxies and environmental spoofing in cross-border fraud scenarios, capture the microscopic differences between human operations and machine scripts, and maintain the integrity of device hardware fingerprints.

[0037] It should be noted that the formula for calculating the device information entropy is: ; in, Represents device information entropy. This represents the Canvas rendering hash. Indicates WebGL fingerprint, This indicates the total number of fonts installed on the client.

[0038] It should be noted that this step can avoid drastic changes in fingerprints caused by fluctuations in a single font library, and maintain sensitivity to the virtual machine's simplified font environment.

[0039] It should be noted that, if If the value is less than 50, the device is determined to be a virtual machine or a headless browser; device information entropy. Deduct 50%; like If the device matches the preset anti-fingerprint browser blacklist, it is determined to be an environment forgery, and the device information entropy is then... Forced reset to zero.

[0040] It should be noted that this step can identify large-scale automated fraud environments, block repeated attacks using known device hardware fingerprints, and balance the sensitivity and determinism of identification.

[0041] It should be noted that time-domain analysis is performed on the slider micro-jitter trajectory in the physiological characteristics of human-computer interaction behavior, and the trajectory deviation and acceleration variance are calculated. If the slider micro-jitter trajectory presents a standard straight line or arc, then the quantitative score of the physiological characteristics of human-computer interaction behavior is [value missing]. Set to 1; If the slider's micro-shaking trajectory exhibits random shaking characteristics consistent with human muscle tremors, then the physiological characteristic quantification score of human-computer interaction behavior is obtained. Set it to 0.1.

[0042] It should be noted that the count includes the number of merchants and card numbers that change within a preset sliding time window of the global acquiring network for the current device's hardware fingerprint. If the number of merchants that change within the preset sliding time window... >2 or the number of card numbers that change within a preset sliding time window. If the score is >3, it indicates a cluster of fraudulent activities involving group control devices. The real-time historical risk density score of the device's hardware fingerprint is needed. Set to 1; otherwise, the real-time historical risk density score of the device's hardware fingerprint. Set it to 0.1.

[0043] It should be noted that this step can detect mass attack behavior and prevent normal cross-merchant transactions from being judged as fraudulent transactions.

[0044] It should be noted that this application bypasses the easily forged IP and Cookie layers, and constructs an unalterable unique device identity by comprehensively utilizing Canvas, audio context, and time zone / language misalignment. It abandons high-latency deep neural networks and uses lightweight matrix multiplication for discrete feature cross-aggregation, ensuring millisecond-level computation under high concurrency. It tracks the behavior of group control devices that frequently switch cards and merchants in real time in memory, transforming static features into dynamic behavior density, which can improve the interception rate of covert fraud, significantly reduce the false judgment rate of normal transactions while ensuring security, and improve the merchant order conversion rate. The overall execution time is controlled within 15ms, perfectly meeting the throughput requirements of the global acquiring core link.

[0045] The following is for reference. Figure 2 It illustrates a method for real-time blocking of fraudulent transactions based on the system described above, comprising: S1: The client device deploys a front-end data acquisition module to asynchronously collect transaction feature data and transmit the transaction feature data to the edge data cleaning and fingerprint generation module through an encrypted channel; the transaction feature data includes hardware-level nonlinear features, network and environment misalignment features, and human-computer interaction behavior physiological features; S2: The edge data cleaning and fingerprint generation module calculates the device information entropy based on the transaction feature data and extracts the device hardware fingerprint; S3: The discrete weak feature cross-quantization engine constructs the network and environment misalignment features and the human-computer interaction behavior physiological features into a high-dimensional feature vector, and calculates the weak feature cross score and the human-computer interaction behavior physiological feature quantization score through matrix dot multiplication operator and dynamic weight vector. S4: The sliding time window memory manager and the discrete weak feature cross-quantization engine perform bidirectional data interaction, and based on the device information entropy, count the number of merchants and card numbers that change in the current device hardware fingerprint within the sliding time window to obtain the real-time historical risk density score. S5: The output of the discrete weak feature cross-quantization engine is connected to the real-time blocking state machine decision-maker. The real-time blocking state machine decision-maker calculates the final comprehensive fraud index based on the real-time historical risk density score, the device information entropy, the weak feature cross-score, and the human-computer interaction behavior physiological feature quantization score, and controls the next step instruction of the core gateway based on the final comprehensive fraud index.

[0046] It should be noted that the formula for calculating the final comprehensive fraud index is as follows: ; Risk represents the final overall fraud index. Represents the weak feature cross scores, α, β, γ and This represents the weighting coefficients, and the dynamic weight vector and weighting coefficients are adjusted according to the transaction scenario. Represents device information entropy. This represents the real-time historical risk density score. This represents a quantitative score indicating the physiological characteristics of human-computer interaction behavior.

[0047] It should be noted that this application dynamically extracts the underlying nonlinear features of hardware, network and environment misalignment features, and physiological features of human-computer interaction behavior within limited computing resources and millisecond-level response time limits, and converts them into a fraud index with high location confidence. This enables millisecond-level real-time accurate interception or secondary dynamic verification on the core acquiring link, thereby protecting the security of cross-border transaction funds.

[0048] It should be noted that the discrete weak feature cross-quantization engine constructs the network-environment misalignment features into a high-dimensional feature vector V=[v1,v2,v3], including time zone misalignment, language mismatch, and suspected proxy IP features. It then calculates the weak feature cross-score using matrix dot multiplication and a dynamic weight vector W. Calculate the physiological characteristics quantitative score of human-computer interaction behavior B socre Then, this is incorporated as an independent dimension into the feature vector, updating the high-dimensional feature vector V=[v1,v2,v3, B]. socre ].

[0049] In a specific implementation, the system adjusts the dynamic weight vector W and its coefficients based on the context tags of the current transaction (e.g., transaction amount, cardholder country of origin, merchant MCC category). and ; In high-risk scenarios, if the transaction involves a high incidence of cross-border payments or a single transaction amount >1,000 USD, the historical density weight γ=0.6 is increased and the entropy weight β=0.1 is decreased to strengthen the interception of group control devices. In scenarios with low false positives, if the transaction comes from a whitelisted high-quality merchant and is a small payment, the environmental entropy weight β=0.4 is increased and the historical density weight γ=0.1 is decreased to reduce disturbance to normal users.

[0050] It should be noted that the system described in this application establishes an asynchronous feedback monitoring link. If a chargeback notification or customer fraud flag is received from the issuing bank within the T-time window (default 24 hours) after the transaction is released, the device hardware fingerprint hash of the transaction is added to the real-time interception blacklist, and the historical risk density score of the device hardware fingerprint is calculated. The system is forced to update to version 1.0, and triggers the sliding time window memory manager to retrieve other related transactions of the fingerprint within the sliding window, and performs batch status verification on the related transactions.

[0051] It should be noted that this application bypasses the easily forged IP and Cookie on the surface and constructs an unalterable unique device identity by combining Canvas, audio context, and time zone / language misalignment; it abandons the high-latency deep neural network and uses lightweight matrix multiplication to cross-aggregate discrete transaction features, ensuring millisecond-level computation under high concurrency; it tracks the behavior of group control devices that frequently change cards and merchants in real time in memory, transforming static features into dynamic behavior density; Compared to traditional static rule-based risk control, the interception rate of covert fraudulent transactions using high-anonymity VPNs and modified browsers with anti-fingerprinting features has been improved by more than 35%. The overall execution time of the core blocking algorithm is controlled within 15ms, perfectly meeting the throughput requirements of the global acquiring core link. By introducing a "dynamic secondary security identity verification" buffer branch, interactive verification is performed on transactions that are suspected of being fraudulent but whose characteristics are not obvious, rather than making a one-size-fits-all misjudgment, thereby improving the order conversion rate of merchants.

[0052] In a specific embodiment, the system receives a cross-border transaction. The Canvas rendering hash reported by its front-end data acquisition module has been frequently changed to four different international credit cards for payment within the 10-minute sliding window of the sliding time memory manager. Moreover, its WebRTC real IP type is seriously inconsistent with the surface-claimed environment. The system calculates the fraud index Risk=0.92, and the real-time state machine decision-maker issues a BLOCK command within 12ms, and the gateway physically blocks the transaction.

[0053] In a specific embodiment, when a legitimate cardholder makes a payment while traveling internationally, the system detects that their browser language is Chinese, but the current system timezone is inconsistent with the network IP's timezone (UK), resulting in a non-obvious anomaly. However, their multi-dimensional device hardware fingerprint has no history of card replacement or group control in memory. The system calculates their Risk=0.61, and the real-time state machine decision-maker triggers the CHALLENGE instruction, popping up a strong authentication interaction page for the user. The user successfully passes the identity verification, the transaction is successful, and misjudgment is effectively avoided.

[0054] In a specific embodiment, for a standard cross-border e-commerce purchase transaction, the system time zone, language and card issuing country are highly aligned, there is no abnormal aggregation in the memory sliding window, the system calculates Risk=0.12, executes the PASS command, and the gateway completes risk control and release within 8ms.

[0055] In a specific embodiment, a transaction is allowed by the system due to Risk=0.48, but a chargeback notification is received from the issuing bank two hours later. The system triggers an asynchronous feedback monitoring link, which then retrieves the device's hardware fingerprint. The fingerprint was forcibly modified to version 1.0 and added to the blacklist. The system discovered that the fingerprint had also attempted another transaction during the time window (which was in the CHALLENGE state at the time). The system then automatically upgraded the associated transaction to the BLOCK state, successfully preventing the chain of fraud.

[0056] The following is for reference. Figure 3 It shows a schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application.

[0057] Figure 3 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0058] like Figure 3 As shown, the computer system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage section 308 into a random access memory (RAM) 303.

[0059] RAM 303 also stores various programs and data required for system operation.

[0060] CPU 301, ROM 302 and RAM 303 are interconnected via bus 304.

[0061] Input / output (I / O) interface 305 is also connected to bus 304.

[0062] The following components are connected to the I / O interface 305: an input section 306 including a keyboard, mouse, etc.; an output section 307 including a liquid crystal display (LCD) and a speaker, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN card and a modem, etc.

[0063] The communication unit 309 performs communication processing via a network such as the Internet.

[0064] The driver 310 is also connected to the I / O interface 305 as needed.

[0065] Removable media 311, such as disks, optical discs, magneto-optical discs, semiconductor memories, etc., are installed on drive 310 as needed so that computer programs read from them can be installed into storage section 308 as needed.

[0066] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs.

[0067] For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowchart.

[0068] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 309, and / or installed from the removable medium 311.

[0069] When the computer program is executed by the central processing unit (CPU) 301, it performs the functions defined in the method of this application.

[0070] It should be noted that the computer-readable storage medium of this application may be a computer-readable signal medium or a computer-readable storage medium or any combination thereof.

[0071] Computer-readable storage media may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof.

[0072] More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0073] In this application, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0074] In this application, the computer-readable signal medium may include data signals propagated in baseband or as part of a carrier wave, wherein computer-readable program code is carried.

[0075] The transmitted data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0076] The computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium that can send, propagate or transmit a program for use by or in connection with an instruction execution system, apparatus or device.

[0077] Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0078] Computer program code for performing the operations of this application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages.

[0079] The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server.

[0080] In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0081] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application.

[0082] In this respect, each box in a flowchart or block diagram can represent a module, segment, or part of code that contains one or more executable instructions for implementing the specified logical function.

[0083] It should also be noted that in some alternative implementations, the functions marked in the box may occur in a different order than those marked in the attached figures.

[0084] For example, two consecutively represented boxes can actually be executed in essentially parallel order, or sometimes in reverse order, depending on the functionality involved.

[0085] It should also be noted that each block in a block diagram and / or flowchart, as well as combinations of blocks in a block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0086] The modules described in the embodiments of this application can be implemented in software or in hardware.

[0087] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device.

[0088] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by the electronic device, the electronic device causes the following: a client device deploys a front-end data acquisition module to asynchronously acquire transaction feature data and transmit the transaction feature data to the edge data cleaning and fingerprint generation module via an encrypted channel; the transaction feature data includes hardware-level nonlinear features, network and environment misalignment features, and human-computer interaction behavior physiological features; the edge data cleaning and fingerprint generation module calculates device information entropy based on the transaction feature data and extracts the device hardware fingerprint; the discrete weak feature cross-quantization engine constructs the network and environment misalignment features and the human-computer interaction behavior physiological features... The system constructs a high-dimensional feature vector and calculates weak feature cross-scores and physiological feature quantization scores for human-computer interaction behavior using matrix multiplication operators and dynamic weight vectors. The sliding time window memory manager interacts bidirectionally with the discrete weak feature cross-quantization engine and, based on the device information entropy, counts the number of merchants and card numbers that change within the sliding time window to obtain a real-time historical risk density score. The real-time blocking state machine decision-maker calculates the final comprehensive fraud index based on the real-time historical risk density score, the device information entropy, the weak feature cross-scores, and the physiological feature quantization scores for human-computer interaction behavior, and controls the next step instruction of the core gateway based on the final comprehensive fraud index.

[0089] Finally, it should be noted that the above description is only a preferred embodiment of this application and an explanation of the technical principles used.

[0090] Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept.

[0091] For example, technical solutions formed by replacing the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A real-time blocking system for cross-border fraud transactions based on multi-dimensional weak feature fusion, characterized in that: It includes a front-end data acquisition module, an edge data cleaning and fingerprint generation module, a discrete weak feature cross-quantization engine, a sliding time window memory manager, and a real-time blocking state machine decision-maker; The client device deploys a front-end data acquisition module to asynchronously collect transaction feature data and transmit the transaction feature data to the edge data cleaning and fingerprint generation module through an encrypted channel; the transaction feature data includes hardware-level nonlinear features, network and environment misalignment features, and human-computer interaction behavior physiological features; The edge data cleaning and fingerprint generation module calculates the device information entropy based on the transaction feature data and extracts the device hardware fingerprint. The discrete weak feature cross-quantization engine is connected to the edge data cleaning and fingerprint generation module. It is used to construct a high-dimensional feature vector from the network and environment misalignment features and the human-computer interaction behavior physiological features, and to calculate the weak feature cross-score and the human-computer interaction behavior physiological feature quantization score through matrix dot multiplication operator and dynamic weight vector. The sliding time window memory manager interacts bidirectionally with the discrete weak feature cross-quantization engine, and based on the device information entropy, it counts the number of merchants and card numbers that change in the current device hardware fingerprint within the sliding time window to obtain a real-time historical risk density score. The output of the discrete weak feature cross-quantization engine is connected to the real-time blocking state machine decision-maker. The real-time blocking state machine decision-maker calculates the final comprehensive fraud index based on the real-time historical risk density score, the device information entropy, the weak feature cross-score, and the human-computer interaction behavior physiological feature quantization score, and controls the next step instruction of the core gateway based on the final comprehensive fraud index. The formula for calculating the final comprehensive fraud index is as follows: ； Risk represents the final overall fraud index. Represents the weak feature cross-scores, α, β, γ, and This represents the weighting coefficients, and the dynamic weight vector and weighting coefficients are adjusted according to the transaction scenario. Represents device information entropy. This represents the real-time historical risk density score. This represents a quantitative score indicating the physiological characteristics of human-computer interaction behavior.

2. The system according to claim 1, characterized in that, Based on the final comprehensive fraud index, the next instructions for the control core gateway include: If Risk ≥ 0.85, a BLOCK instruction will be issued to directly block the transaction; If 0.5 ≤ Risk < 0.85, then issue a CHALLENGE command to trigger interactive secondary security identity verification; If Risk < 0.5, a PASS command is issued, allowing safe passage.

3. The system according to claim 1, characterized in that, The underlying nonlinear features of the hardware include Canvas rendering hash, WebGL fingerprint, and AudioContext audio context features; The network and environment mismatch features include the WebRTC real IP, the difference between the system time zone and the IP's time zone, and the matching degree between the browser language and the country language of the billing address; The physiological characteristics of human-computer interaction behavior include the page dwell time sequence and the slider micro-shaking trajectory.

4. The system according to claim 1, characterized in that, The formula for calculating the device information entropy is: ； in, Represents device information entropy. This represents the Canvas rendering hash. Indicates WebGL fingerprint, This indicates the total number of fonts installed on the client.

5. The system according to claim 4, characterized in that, like If the value is less than 50, the device is determined to be a virtual machine or a headless browser; device information entropy. Deduct 50%; like If the browser matches the pre-defined anti-fingerprinting blacklist, it is determined to be an environment forgery, and the device information entropy is reduced. Forced reset to zero.

6. The system according to claim 1, characterized in that, A time-domain analysis was performed on the slider micro-jitter trajectory, one of the physiological characteristics of human-computer interaction behavior, to calculate the trajectory deviation and acceleration variance. If the slider micro-jitter trajectory exhibits a standard straight line or arc, then the quantitative score of the physiological characteristic of human-computer interaction behavior is determined. Set to 1; If the slider's micro-shaking trajectory exhibits random tremors consistent with human muscle tremors, then the physiological characteristic quantification score of human-computer interaction behavior is obtained. Set it to 0.

1.

7. The system according to claim 1, characterized in that, Count the number of merchants and card numbers whose hardware fingerprints change within a preset sliding time window in the global acquiring network. If the number of merchants changing within the preset sliding time window... >2 or the number of card numbers that change within a preset sliding time window. A score greater than 3 indicates the presence of mass fraudulent activities by a group control device cluster. The real-time historical risk density score of the device's hardware fingerprint is needed. Set to 1; otherwise, the real-time historical risk density score of the device's hardware fingerprint. Set it to 0.

1.

8. A method for real-time blocking of fraudulent transactions according to the system as described in any one of claims 1-7, characterized in that, include: S1: The client device deploys a front-end data acquisition module to asynchronously collect transaction feature data and transmit the transaction feature data to the edge data cleaning and fingerprint generation module through an encrypted channel; the transaction feature data includes hardware-level nonlinear features, network and environment misalignment features, and human-computer interaction behavior physiological features; S2: The edge data cleaning and fingerprint generation module calculates the device information entropy based on the transaction feature data and extracts the device hardware fingerprint; S3: The discrete weak feature cross-quantization engine constructs the network and environment misalignment features and the human-computer interaction behavior physiological features into a high-dimensional feature vector, and calculates the weak feature cross score and the human-computer interaction behavior physiological feature quantization score through matrix dot multiplication operator and dynamic weight vector. S4: The sliding time window memory manager and the discrete weak feature cross-quantization engine perform bidirectional data interaction, and based on the device information entropy, count the number of merchants and card numbers that change in the current device hardware fingerprint within the sliding time window to obtain the real-time historical risk density score. S5: The output of the discrete weak feature cross-quantization engine is connected to the real-time blocking state machine decision-maker. The real-time blocking state machine decision-maker calculates the final comprehensive fraud index based on the real-time historical risk density score, the device information entropy, the weak feature cross-score, and the human-computer interaction behavior physiological feature quantization score, and controls the next step instruction of the core gateway based on the final comprehensive fraud index.

9. The method according to claim 8, characterized in that, The formula for calculating the final comprehensive fraud index is as follows: ； Risk represents the final overall fraud index. Represents the weak feature cross-scores, α, β, γ, and This represents the weighting coefficients, and the dynamic weight vector and weighting coefficients are adjusted according to the transaction scenario. Represents device information entropy. This represents the real-time historical risk density score. This represents a quantitative score indicating the physiological characteristics of human-computer interaction behavior.

10. A computer program product having one or more computer programs stored thereon, characterized in that, When the computer program is executed by a computer processor, the method described in any one of claims 8-9 is performed.

Images