Abnormality detection method for ATM device eavesdropping and related device

Abstract

The application discloses an ATM device illegal recording anomaly detection method and related equipment. Including: for any ATM device, every interval preset time length, obtain the corresponding multi-source data of the ATM device in different time windows, wherein the multi-source data includes device log data, device alarm data, transaction data and operation and maintenance data; based on the corresponding multi-source data of the ATM device in different time windows, the sparse discrete features and numerical statistical features corresponding to the multi-source data are constructed; the sparse discrete features and numerical statistical features are input into the pre-trained anomaly detection model to obtain an anomaly score; if the anomaly score is greater than a preset threshold, it is determined that the ATM device has an illegal recording anomaly risk. Thus, the anomaly detection efficiency of the ATM device illegal recording is improved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to anomaly detection methods and related equipment for ATM device theft detection. Background Technology

[0002] With the rapid popularization of the financial self-service industry, Automated Teller Machines (ATMs) have become the core service terminals for banks' offline cash deposit and withdrawal, transfer and inquiry services. Covering all areas including urban business districts, communities, transportation hubs, and rural towns, they have significantly reduced the operational pressure on bank branches and improved the convenience of financial transactions for the public. However, at the same time, financial theft and information theft targeting ATMs are showing a trend of high incidence, increasing concealment, and large-scale development. Among these, the most frequent method is for criminals to illegally steal users' bank card numbers, transaction passwords, and other core privacy information by installing miniature recording devices and pinhole cameras in the card slots and keypads of ATMs, and then using this information to create counterfeit cards and steal funds from users' accounts.

[0003] In existing technologies, the abnormal detection method for ATM device theft is a log screening method based on fixed rules. It relies on the native operation log of the ATM machine as the only risk identification data source, pre-configures static risk control filtering rules, and uses four key fields as the core filtering dimensions: device number, fault error code, original alarm text content, and fault occurrence timestamp. The operation log uploaded by the machine in real time is matched and filtered one by one. In real-world risk control scenarios, ATM card readers and card ejection modules are high-frequency locations where criminals install recording devices. The installation of these illegal peripherals directly interferes with the normal communication of the machine's native hardware, triggering fixed hardware fault error logs. The system has preset matching rules for these typical faults. When the logs match preset error keywords and error codes such as "card reader abnormal: no card (-201)," "card ejection failure," or "card reader communication interruption," the corresponding ATM is automatically marked as a risk device, and a batch of lists awaiting manual verification is generated. Subsequent verification relies entirely on risk control and maintenance personnel manually retrieving the historical operating logs of the corresponding machines and reviewing on-site monitoring videos segment by segment to manually determine if there is a risk of illegal recording device installation. Finally, offline maintenance personnel are dispatched to the site to disassemble and verify the device and address the risk. This method is time-consuming, resulting in low efficiency in detecting ATM recording anomalies. Summary of the Invention

[0004] This invention provides a method, apparatus, device, medium, and product for detecting aberrations in ATM device recording, which improves the efficiency of detecting aberrations in ATM device recording.

[0005] According to a first aspect of the present invention, an abnormal detection method for ATM device theft is provided, the method comprising: For any ATM device, at preset intervals, acquire multi-source data corresponding to the ATM device in different time windows, wherein the multi-source data includes device log data, device alarm data, transaction data, operation and maintenance data, and video reading data; Based on the multi-source data of the ATM device in different time windows, sparse discrete features and numerical statistical features corresponding to the multi-source data are constructed, wherein the numerical statistical features are used to characterize the statistical features corresponding to anomalies. The sparse discrete features and the numerical statistical features are input into a pre-trained anomaly detection model to obtain an anomaly score; If the abnormal score is greater than a preset threshold, it is determined that the ATM device has a risk of being illegally recorded.

[0006] According to another aspect of the present invention, an anomaly detection device for ATM device theft is provided, the device comprising: The acquisition module is used to acquire multi-source data of the ATM device in different time windows at preset intervals, wherein the multi-source data includes device log data, device alarm data, transaction data, operation and maintenance data and video reading data. The feature construction module is used to construct sparse discrete features and numerical statistical features corresponding to the multi-source data of the ATM device in different time windows, wherein the numerical statistical features are used to characterize the statistical features corresponding to anomalies. An anomaly score determination module is used to input the sparse discrete features and the numerical statistical features into a pre-trained anomaly detection model to obtain an anomaly score; An anomaly risk determination module is used to determine that the ATM device has a risk of theft and recording if the anomaly score is greater than a preset threshold.

[0007] According to another aspect of the present invention, an electronic device is provided, the electronic device including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the abnormal detection method for ATM device theft described in the first aspect.

[0008] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the abnormal detection method for ATM device theft as described in any embodiment of the present invention.

[0009] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the abnormal detection method for ATM device theft as described in any embodiment of the present invention.

[0010] The technical solution of this invention acquires multi-source data corresponding to ATM devices in different time windows at preset intervals. Based on the multi-source data corresponding to ATM devices in different time windows, sparse discrete features and numerical statistical features corresponding to the multi-source data are constructed. The sparse discrete features and numerical statistical features are input into a pre-trained anomaly detection model to obtain an anomaly score. If the anomaly score is greater than a preset threshold, it is determined that the ATM device has a risk of being used for unauthorized recording. Therefore, this embodiment of the application does not require manual detection, improving the efficiency of anomaly detection for unauthorized recording of ATM devices.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present invention; Figure 2 This is a flowchart of an abnormal detection method for ATM device theft provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the process for training an anomaly model according to an embodiment of the present invention; Figure 4 This is a schematic diagram of an abnormal detection device for ATM device theft provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of the present invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] Before introducing the abnormal detection method for ATM device theft provided in the embodiments of this application, the technical background of the embodiments of this application will be described in detail below for ease of understanding.

[0017] Before introducing the abnormal detection method for ATM device theft in this application, we will first introduce the application scenarios corresponding to the abnormal detection method for ATM device theft in this application. Figure 1 This is a diagram illustrating the application scenario, from Figure 1 As can be seen from the above, this application scenario includes server 110 and terminal device 120. In this embodiment, server 110 can be implemented as a physical server or as a virtual server.

[0018] In one possible embodiment, server 110 acquires multi-source data corresponding to any ATM device at preset intervals within different time windows. This multi-source data includes device log data, device alarm data, transaction data, maintenance data, and video playback data. Then, based on the multi-source data corresponding to the ATM device within different time windows, server 110 constructs sparse discrete features and numerical statistical features corresponding to the multi-source data. The numerical statistical features are used to characterize the statistical features corresponding to anomalies. Server 110 inputs the sparse discrete features and the numerical statistical features into a pre-trained anomaly detection model to obtain an anomaly score. If the anomaly score is greater than a preset threshold, it determines that the ATM device has a risk of recording theft and sends a warning to terminal device 120.

[0019] in, Figure 1 The server 110 and the terminal device 120 can exchange information via a communication network. The communication network can use either wireless or wired communication.

[0020] For example, server 110 can access the network via cellular mobile communication technology and communicate with terminal device 120, wherein the cellular mobile communication technology includes, for example, 5th generation mobile networks (5G) technology.

[0021] Optionally, server 110 can access the network and communicate with terminal device 120 via short-range wireless communication, wherein the short-range wireless communication method includes, for example, Wireless Fidelity (Wi-Fi) technology.

[0022] Furthermore, the description in this application details only a single server 110 and a single terminal device 120. However, those skilled in the art should understand that the illustrated server 110 and terminal device 120 are intended to show that the technical solution of this application involves the operation of server 110 and terminal device 120, and not to imply any limitation on the number, type, or location of server 110 and terminal device 120. It should be noted that adding additional modules to or removing individual modules from the illustrated environment will not change the underlying concept of the exemplary embodiments of this application.

[0023] For example, terminal device 120 includes, but is not limited to: large visual screens, tablet computers, laptops, handheld computers, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminal devices in industrial control, wireless terminal devices in autonomous driving, wireless terminal devices in smart grids, wireless terminal devices in transportation safety, wireless terminal devices in smart cities, or wireless terminal devices in smart homes, etc.; the terminal device may have a related client installed, which may be software (e.g., browsers, short video software, etc.), or web pages, mini-programs, etc.

[0024] The following describes an exemplary embodiment of the ATM device theft detection method of this application, in conjunction with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the methods and principles of this application, and the implementation of this application is not limited in any way in this respect.

[0025] Combination Figure 1 In the application scenarios described below, the abnormal detection method for ATM device theft in the embodiments of this application will be described in detail. Figure 2 This is a flowchart of an abnormal detection method for ATM device theft provided in an embodiment of the present invention. Figure 2 As can be seen from this, it may specifically include the following steps: S210: For any ATM device, at preset intervals, acquire multi-source data corresponding to the ATM device in different time windows, wherein the multi-source data includes device log data, device alarm data, transaction data and operation and maintenance data; The device log data in this embodiment includes at least the device number, 8-digit date, 6-digit time, serial number, and error message. Device alarm data includes at least the device number, time, and alarm type. Transaction data includes at least the device number, transaction timestamp, transaction region, transaction medium, transaction type, and transaction result. Maintenance data includes at least the maintenance time and maintenance actions.

[0026] It should be noted that the preset duration in this application embodiment can be set according to the specific actual situation, and this application embodiment does not limit the preset duration.

[0027] In one possible implementation, the multi-source data is standardized in this embodiment of the application.

[0028] In one possible implementation, S210 can be specifically implemented as follows: constructing a short time window, a medium time window, and a long time window based on the current time; and acquiring multi-source data corresponding to the short time window, the medium time window, and the long time window of the ATM device, respectively.

[0029] Wherein, the start time of the short time window is the difference between the current time and the first specified duration, the start time of the medium time window is the difference between the current time and the second specified duration, and the start time of the long time window is the difference between the current time and the third specified duration. The first specified duration is less than the second specified duration, the second specified duration is less than the third specified duration, and the end time of the short time window, the medium time window, and the long time window is the current time.

[0030] For example, with the current time as τ, the first specified duration is 5 minutes, the second specified duration is 30 minutes, and the third specified duration is 24 hours. Then, the short time window [τ-5min, τ] in this embodiment of the application is determined, the medium time window is determined to be [τ-30min, τ], and the long time window is determined to be [τ-24h, τ].

[0031] It should be noted that the preset duration, first specified duration, second specified duration and third specified duration in the embodiments of this application can be set according to the specific actual situation. The embodiments of this application do not limit the preset duration, first specified duration, second specified duration and third specified duration.

[0032] S220: Based on the multi-source data corresponding to the ATM device in different time windows, construct sparse discrete features and numerical statistical features corresponding to the multi-source data, wherein the numerical statistical features are used to characterize the statistical features corresponding to anomalies; The sparse discrete features in this application embodiment include device number, region, branch number, ATM model, date, whether it is a holiday, current primary alarm code, current secondary alarm code, error code combination token, transaction type token, transaction result token, maintenance status token, device historical status token, card reader model, hourly bucket, and sequence token of the most recent 2-4 abnormal events.

[0033] The numerical statistical features in this application embodiment include the number of card blockage anomalies, the number of card-free anomalies, the number of card ejection failures, the number of repeated error reports in a short period of time, the time interval between the first and last occurrences of the same type of anomaly, the number of successful transactions before the anomaly, the number of failed transactions after the anomaly, whether the same anomaly is triggered in two stages on the same day, the device's anomaly baseline for the past week, the difference between the number of times the device has occurred in the same time interval in the past M days and the number of times it has occurred in the same time interval in the current day, and the anomaly recovery time.

[0034] The sparse discrete features and numerical statistical features in the embodiments of this application can be directly obtained with their corresponding values.

[0035] S230: Input the sparse discrete features and the numerical statistical features into the pre-trained anomaly detection model to obtain anomaly scores; The following describes the method for training the anomaly detection model in the embodiments of this application. Figure 3 This is a flowchart illustrating the process of training an anomaly model, which may include the following steps: S310: Obtain training samples, wherein the training samples include sparse discrete features and numerical statistical features constructed based on multi-source data corresponding to ATM devices in different historical time windows; In the embodiments of this application, the sparse discrete features and numerical statistical features in the training samples have corresponding sample labels, including the presence of recording theft anomalies and the absence of recording theft anomalies.

[0036] Training samples with suspected theft can also include contextual features, such as: whether the same ATM device experiences "successful transaction followed by card ejection, then 'no card error' and 'card ejection failure' within a time window"; whether repeated card ejection failures occur within a short window; whether two clusters of similar problems occur on the same day that are far apart; whether there is a lack of normal card reading completion links before and after the anomaly occurs; and the degree of deviation of the anomaly pattern from the device's own historical baseline.

[0037] S320: After performing end-to-end training on the interaction layer and the embedding layer using the training samples, the initial weight parameters of the embedding layer and the initial weight parameters of the interaction layer are obtained. S330: Lock the initial weight parameters of the interaction layer; In one possible implementation, S320 can be specifically implemented as follows: inputting training samples into the interaction layer to obtain anomaly scores, obtaining corresponding loss values ​​based on the anomaly scores, and if the loss value is greater than a preset threshold, adjusting the weights of the interaction layer until the loss value is not greater than the preset threshold, then ending the training of the interaction layer. The loss value can be determined using formula (1): ...(1); in, This is the loss value. The outlier score corresponding to the sample. As training samples, and This represents the unbalanced weighting of categories.

[0038] In this embodiment of the application, the initial weight parameters of the interaction layer module are locked, that is... and The value will no longer be adjusted.

[0039] The interaction layer in this application embodiment can adopt an MLP (Multilayer Perceptron), DCN-v2, or FM+MLP structure, preferably a two-layer or three-layer MLP. However, this application embodiment does not limit the structure of the interaction layer and can set it according to the specific actual situation.

[0040] S340: Initialize the initial weight parameters of the embedding layer, and use the training samples to perform multiple rounds of re-tuning training on the embedding layer to obtain multiple sets of re-tuned embedding layer weight parameters; wherein, any round of re-tuning training yields a corresponding set of re-tuned embedding layer weight parameters. The sparse discrete feature in this embodiment is: Based on the sparse discrete features and the embedding layer weight parameters, the embedding vector is obtained. ,1 The embedding vector is concatenated with the normalized numerical statistical features to obtain the feature z. The interaction layer gW performs a non-linear output on the feature z to obtain the anomaly score. .

[0041] In this embodiment, the training of the embedding layer is based on the loss function in formula (1) to adjust the weight parameters of the embedding layer in order to obtain a smaller loss value. The number of re-tuning operations in this embodiment can be set according to the actual situation.

[0042] S350: An embedded weight average fusion strategy is adopted to fuse the multiple sets of re-tuned embedded layer weight parameters element by element to generate a fused and optimized embedded layer. In one possible implementation, S350 can be specifically implemented as follows: The fusion-optimized embedding layer is obtained by performing an arithmetic average operation on the embedding layer weight parameters located in the same position among the multiple sets of re-tuned embedding layer weight parameters; or the fusion-optimized embedding layer is obtained by weighted summation of the embedding layers located in the same position among the multiple sets of re-tuned embedding layer weight parameters.

[0043] S360: Combine the fused and optimized embedding layer and the interaction layer to obtain the pre-trained anomaly detection model.

[0044] Therefore, in this embodiment of the application, multiple re-optimization results are integrated into a single model in the offline stage, while the online stage remains a single model with single-path inference, which facilitates large-scale deployment on the risk control platform of the head office and branches.

[0045] Furthermore, since the device number, error code combination, time window, and event sequence token in ATM theft anomaly detection are usually high-dimensional sparse discrete entries, the embedding vectors of rare entries are more susceptible to the influence of sample sparsity during end-to-end training, resulting in a large estimation variance. The embodiments of this application reduce the variance-type generalization error of such long-tailed sparse entries by performing multiple rounds of embedding retuning under the condition of locking the interaction layer and fusing the weight parameters of multiple retuned embedding layers, thereby improving the adaptability of the anomaly detection model to new devices, new time windows, and new anomaly clusters.

[0046] S240: If the abnormal score is greater than a preset threshold, it is determined that the ATM device has a risk of being illegally recorded.

[0047] In one possible implementation, after executing S240, a target risk level corresponding to the abnormal score of the ATM device is determined by using a pre-set correspondence between each abnormal score and each risk level; and a target risk handling strategy corresponding to the target risk level is determined by using a pre-set correspondence between each risk level and each risk handling strategy.

[0048] For example, abnormal scores It is classified as a Level 1 risk level. It is classified as a level 2 risk. It is classified as a Level 3 risk level.

[0049] It should be noted that the preset threshold in this application embodiment can be set according to the specific actual situation, and this application embodiment does not limit the preset threshold.

[0050] For example, if the abnormal score exceeds a preset threshold, an early warning message is automatically pushed to the branch business department, and a video retrieval index is generated based on the device number and trigger window, for example, the monitoring segment corresponding to [τ-10min, τ+10min] is retrieved by default. After manual confirmation, the result is written back to the tag library for subsequent periodic incremental training. If it exceeds a higher threshold, a key verification process, on-site inspection notification, or temporary equipment control policy is directly triggered.

[0051] Based on the same inventive concept, this application also provides an anomaly detection device for ATM device theft. Figure 4 This is a schematic diagram of the anomaly detection device used to steal data from this ATM. Figure 4 As shown, the device 400 includes: The acquisition module 410 is used to acquire multi-source data corresponding to the ATM device in different time windows at preset intervals, wherein the multi-source data includes device log data, device alarm data, transaction data and operation and maintenance data; The feature construction module 420 is used to construct sparse discrete features and numerical statistical features corresponding to the multi-source data based on the multi-source data corresponding to the ATM device in different time windows, wherein the numerical statistical features are used to characterize the statistical features corresponding to anomalies. Anomaly score determination module 430 is used to input the sparse discrete features and the numerical statistical features into a pre-trained anomaly detection model to obtain anomaly scores; The abnormal risk determination module 440 is used to determine that the ATM device has a risk of theft if the abnormal score is greater than a preset threshold.

[0052] In one possible embodiment, the anomaly detection model includes an embedding layer and an interaction layer; the device further includes: Training module 450 is used to train the anomaly detection model in the following manner: Obtain training samples, wherein the training samples include sparse discrete features and numerical statistical features constructed based on multi-source data corresponding to ATM devices in different historical time windows; After performing end-to-end training on the interaction layer and the embedding layer using the training samples, the initial weight parameters of the embedding layer and the initial weight parameters of the interaction layer are obtained. The initial weight parameters of the interaction layer are locked; The initial weight parameters of the embedding layer are initialized, and the embedding layer is re-tuned and trained multiple times using the training samples to obtain multiple sets of re-tuned embedding layer weight parameters; wherein, any one set of re-tuned embedding layer weight parameters is obtained in any one round of re-tuning training. An embedding weight average fusion strategy is adopted to fuse the multiple sets of re-tuned embedding layer weight parameters element by element to generate a fused and optimized embedding layer. The pre-trained anomaly detection model is obtained by combining the fused and optimized embedding layer and the interaction layer.

[0053] In one possible embodiment, the training module 450 is further configured to: The arithmetic average of the embedding layer weight parameters located in the same position among the multiple sets of re-tuned embedding layer weight parameters is performed to obtain the fused and optimized embedding layer; or, The embedded layers with the same position in the multiple sets of re-tuned embedded layer weight parameters are weighted and summed to obtain the fused and optimized embedded layer.

[0054] In one possible embodiment, the device further includes: The risk level determination module 460 is used to determine the target risk level corresponding to the abnormal score of the ATM device after determining that the ATM device has an abnormal risk of theft and recording. The risk management strategy determination module 470 is used to determine the target risk management strategy corresponding to the target risk level by utilizing the pre-set correspondence between each risk level and each risk management strategy.

[0055] In one possible embodiment, the acquisition module 410 is specifically used for: Based on the current time, a short time window, a medium time window, and a long time window are constructed; wherein, the start time of the short time window is the difference between the current time and a first specified duration, the start time of the medium time window is the difference between the current time and a second specified duration, and the start time of the long time window is the difference between the current time and a third specified duration, wherein the first specified duration is less than the second specified duration, the second specified duration is less than the third specified duration, and the end time of the short time window, the medium time window, and the long time window is the current time. The multi-source data corresponding to the short time window, the medium time window, and the long time window of the ATM device are acquired respectively.

[0056] In one possible embodiment, the sparse discrete features include device number, region, branch number, ATM model, date, whether it is a holiday, current primary alarm code, current secondary alarm code, error code combination token, transaction type token, transaction result token, maintenance status token, device historical status token, card reader model, hourly bucket, and a sequence token of multiple abnormal events most recent to the current time. The numerical statistical features include the number of card blockage anomalies, the number of card-free anomalies, the number of card ejection failures, the number of repeated error reports in a short period of time, the time interval between the first and last occurrences of the same type of anomaly, the number of successful transactions before the anomaly, the number of failed transactions after the anomaly, whether the same anomaly is triggered in two stages on the same day, the anomaly recovery time, the device's anomaly baseline for the past week, and the difference between the number of times the device experienced anomalies in the same time interval over the past M days and the number of times it experienced anomalies in the same time interval on the current day.

[0057] The ATM device theft detection device provided in this embodiment of the invention can execute the ATM device theft detection method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0058] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0059] The information collected is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation portals are provided for users to choose to authorize or refuse.

[0060] Provide users with corresponding operation entry points, allowing them to choose to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0061] Figure 5 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0062] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0063] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0064] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as anomaly detection methods for ATM device theft.

[0065] In some embodiments, the method for detecting ATM device theft can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded into and / or installed on an electronic device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by a processor, one or more steps of the method for detecting ATM device theft can be performed. Alternatively, in other embodiments, the processor can be configured to perform the method for detecting ATM device theft by any other suitable means (e.g., by means of firmware).

[0066] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0067] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0068] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0069] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0070] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0071] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0072] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and no limitation is imposed herein.

[0073] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting aberrations in ATM device recording, characterized in that, The method includes: For any ATM device, at preset intervals, acquire multi-source data corresponding to the ATM device in different time windows, wherein the multi-source data includes device log data, device alarm data, transaction data and operation and maintenance data; Based on the multi-source data of the ATM device in different time windows, sparse discrete features and numerical statistical features corresponding to the multi-source data are constructed, wherein the numerical statistical features are used to characterize the statistical features corresponding to anomalies. The sparse discrete features and the numerical statistical features are input into a pre-trained anomaly detection model to obtain an anomaly score; If the abnormal score is greater than a preset threshold, it is determined that the ATM device has a risk of being illegally recorded.

2. The method according to claim 1, characterized in that, The anomaly detection model includes an embedding layer and an interaction layer; The anomaly detection model is trained using the following method: Obtain training samples, wherein the training samples include sparse discrete features and numerical statistical features constructed based on multi-source data corresponding to ATM devices in different historical time windows; After performing end-to-end training on the interaction layer and the embedding layer using the training samples, the initial weight parameters of the embedding layer and the initial weight parameters of the interaction layer are obtained. The initial weight parameters of the interaction layer are locked; The initial weight parameters of the embedding layer are initialized, and the embedding layer is re-tuned and trained multiple times using the training samples to obtain multiple sets of re-tuned embedding layer weight parameters; wherein, any one set of re-tuned embedding layer weight parameters is obtained in any one round of re-tuning training. An embedding weight average fusion strategy is adopted to fuse the multiple sets of re-tuned embedding layer weight parameters element by element to generate a fused and optimized embedding layer. The pre-trained anomaly detection model is obtained by combining the fused and optimized embedding layer and the interaction layer.

3. The method according to claim 2, characterized in that, The method employs an embedded weight averaging fusion strategy to fuse the multiple sets of re-tuned embedded layer weight parameters element-by-element to generate a fused and optimized embedded layer, including: The arithmetic average of the embedding layer weight parameters located in the same position among the multiple sets of re-tuned embedding layer weight parameters is performed to obtain the fused and optimized embedding layer; or, The embedded layers with the same position in the multiple sets of re-tuned embedded layer weight parameters are weighted and summed to obtain the fused and optimized embedded layer.

4. The method according to claim 1, characterized in that, After determining that the ATM device has a risk of unauthorized recording, the method further includes: By using the pre-set correspondence between each abnormal score and each risk level, the target risk level corresponding to the abnormal score of the ATM device is determined; By utilizing the pre-set correspondence between each risk level and each risk management strategy, the target risk management strategy corresponding to the target risk level is determined.

5. The method according to claim 1, characterized in that, The acquisition of multi-source data corresponding to the ATM device in different time windows includes: Based on the current time, a short time window, a medium time window, and a long time window are constructed; wherein, the start time of the short time window is the difference between the current time and a first specified duration, the start time of the medium time window is the difference between the current time and a second specified duration, and the start time of the long time window is the difference between the current time and a third specified duration, wherein the first specified duration is less than the second specified duration, the second specified duration is less than the third specified duration, and the end time of the short time window, the medium time window, and the long time window is the current time. The multi-source data corresponding to the short time window, the medium time window, and the long time window of the ATM device are acquired respectively.

6. The method according to claim 1 or 2, characterized in that, The sparse discrete features include device number, region, branch number, ATM model, date, whether it is a holiday, current primary alarm code, current secondary alarm code, error code combination token, transaction type token, transaction result token, maintenance status token, device historical status token, card reader model, hourly bucket, and sequence tokens of multiple abnormal events most recent to the current time; The numerical statistical features include the number of card blockage anomalies, the number of card-free anomalies, the number of card ejection failures, the number of repeated error reports in a short period of time, the time interval between the first and last occurrences of the same type of anomaly, the number of successful transactions before the anomaly, the number of failed transactions after the anomaly, whether the same anomaly is triggered in two stages on the same day, the anomaly recovery time, the device's anomaly baseline for the past week, and the difference between the number of times the device experienced anomalies in the same time interval over the past M days and the number of times it experienced anomalies in the same time interval on the current day.

7. An abnormal detection device for ATM device theft, characterized in that, The device includes: The acquisition module is used to acquire multi-source data of the ATM device in different time windows at preset intervals, wherein the multi-source data includes device log data, device alarm data, transaction data and operation and maintenance data; The feature construction module is used to construct sparse discrete features and numerical statistical features corresponding to the multi-source data of the ATM device in different time windows, wherein the numerical statistical features are used to characterize the statistical features corresponding to anomalies. An anomaly score determination module is used to input the sparse discrete features and the numerical statistical features into a pre-trained anomaly detection model to obtain an anomaly score; An anomaly risk determination module is used to determine that the ATM device has a risk of theft and recording if the anomaly score is greater than a preset threshold.

8. An electronic device, characterized in that, The electronic device includes at least one processor; and a memory communicatively connected to the at least one processor; wherein... The memory stores a computer program that is executed by the at least one processor to cause the at least one processor to perform the abnormal detection method for ATM device theft as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the abnormal detection method for ATM device theft as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the abnormal detection method for ATM device theft according to any one of claims 1-6.

Images