Information processing terminal, information processing method, and information processing program

Abstract

Based on behavioral information at each point in time, it is determined whether the user currently using the account is the same user as a past user. [Solution] In the system, the information processing terminal includes: a first behavior information acquisition unit that acquires behavior information indicating the user's behavior at the time of input at the first time point as first behavior information during a processing stage in which account-related processing is performed at the first time point; a second behavior information acquisition unit that acquires behavior information of the user at the second time point when using a service using the account at a stage other than account creation at a second time point later than the first time point as second behavior information; a determination unit that compares the first behavior information and the second behavior information and determines whether they are correlated to a predetermined level or higher; a verification information generation unit that generates information indicating that the user at the second time point is not the user at the first time point as verification information if the first behavior information and the second behavior information are not correlated to a predetermined level or higher; and a warning transmission unit that generates a warning based on the verification information and transmits it to an external terminal.

Description

Technical Field

[0001] The present invention relates to an information processing terminal, an information processing method, and an information processing program for analyzing the behavior of an account owner and the like.

Background Art

[0002] Conventionally, in order to open an online bank account, an account is created, and transactions with individuals, stores, etc. are conducted using the created account and the opened online bank account. By the way, in recent years, with the increase in online financial transactions, criminal activities related to the resale of online bank accounts have increased rapidly. In particular, the online bank accounts opened by account owners may be consciously sold to criminal groups, or the account information that can be used for online accounts may be stolen by others. These criminal groups use the illegally obtained accounts for illegal acts such as money laundering.

[0003] To solve the above problems, the security measures of banking institutions mainly focus on static security authentication information (e.g., passwords, passkeys, etc.), and although they can detect the illegal resale of online bank accounts to a certain extent, when an account owner consciously resells an online bank account to a criminal group, the security measures on the bank institution side may be avoided.

[0004] Therefore, in order to solve problems such as online accounts being stolen or account owners consciously reselling online bank accounts to criminal groups, it is necessary to determine whether an account user is an illegal person by a determination method other than ordinary password authentication. In Patent Document 1, it is possible to appropriately estimate the illegal act of a purchaser by considering the reliability of the behavior recognition of the purchaser. Specifically, the illegal act estimation device described in Patent Document 1 executes means for recognizing the behavior of a purchaser, means for obtaining reliability, means for detecting conditions, means for determining a threshold value, means for estimating illegal acts, etc., and estimates the illegal act of the purchaser based on the behavior of the purchaser recognized by the reliability.

[0005] Patent Document 2 discloses a means for detecting abnormal transactions when a user conducts a transaction against their will due to coercion or other reasons, based on the user's characteristic data of normal transactions and characteristic data of abnormal transactions. As a result, the identity verification system described in Patent Document 2 can prevent harm to users, minimize the harm inflicted on users, and report abnormal transactions without the coercor's knowledge. [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Japanese Patent Publication No. 2023-141730 [Patent Document 2] Japanese Patent Publication No. 2001-325434 [Overview of the Initiative] [Problems that the invention aims to solve]

[0007] The present invention aims to predict whether an account has been misused by utilizing dynamic biological behavioral analysis (e.g., behavioral analysis). [Means for solving the problem]

[0008] An information processing terminal according to one embodiment of the present invention may include: a first behavior information acquisition unit that acquires behavior information indicating the user's behavior at the time of input at the first time point as first behavior information during a processing stage in which an account-related process is performed at the first time point; a second behavior information acquisition unit that acquires behavior information of the user at the second time point when the user uses a service using the account at a stage other than account creation at a second time point later than the first time point as second behavior information; a determination unit that compares the first behavior information and the second behavior information and determines whether they are correlated to a predetermined level or higher; a verification information generation unit that generates information indicating that the user at the second time point is not the user at the first time point as verification information if the first behavior information and the second behavior information are not correlated to a predetermined level or higher; and a warning transmission unit that generates a warning based on the verification information and transmits it to an external terminal.

[0009] In one embodiment of the present invention, the information processing terminal may, when creating an account during the processing stage, have a first behavior information acquisition unit that acquires behavior information indicating the user's behavior at a first point in time as first behavior information.

[0010] In one embodiment of the present invention, the information processing terminal may have a first behavior information acquisition unit that, when using an account during the processing stage, acquires behavior information indicating the user's behavior at the time of input at a first point in time as first behavior information.

[0011] An information processing terminal according to one embodiment of the present invention includes a storage unit that stores a learning model that has learned whether or not a second user is the first user, based on the behavior information of a first user at a first time point and the behavior information of a second user at a second time point that occurred after the first time point. A determination unit inputs the second behavior information of the second user at a second time point into the learning model, uses the learning model to determine whether or not the second user is the first user, and, referring to the learning results of the learning model, determines that the first behavior information and the second behavior information are correlated to a predetermined level or higher if the determination unit determines that the second user is the first user. If, referring to the learning results of the learning model, the first behavior information and the second behavior information are not correlated to a predetermined level or higher, a verification information generation unit may generate verification information for the account.

[0012] An information processing terminal according to one embodiment of the present invention may further include a learning unit which causes a learning model to retrain using as training data the behavior information of a first time point user, the behavior information of a second time point user, and a result indicating whether or not the second time point user is the first time point user.

[0013] An information processing terminal according to one embodiment of the present invention further comprises a similarity calculation unit which calculates the similarity between first behavior information and second behavior information, and if the similarity is lower than a predetermined threshold, the verification information generation unit may generate verification information for the account.

[0014] An information processing terminal according to one embodiment of the present invention further comprises: a determination unit which includes a first vector calculation unit which obtains a first vector that serves as an indicator representing a change in the cursor trajectory due to user operation at a first time point from first behavior information obtained by a first behavior information acquisition unit, and a second vector calculation unit which obtains a second vector that serves as an indicator representing a change in the cursor trajectory due to user operation at a second time point from second behavior information obtained by a second behavior information acquisition unit, and a determination unit which calculates the distance between the first vectors based on the first vector and the second vector, and if the distance between the first vectors exceeds a predetermined threshold, a verification information generation unit which generates verification information.

[0015] An information processing terminal according to one embodiment of the present invention further comprises a determination unit which includes a third vector calculation unit that obtains a third vector which is an indicator representing keystroke dynamics based on the user's operation at a first time point, from first behavior information obtained by a first behavior information acquisition unit, and a fourth vector calculation unit that obtains a fourth vector which is an indicator representing keystroke dynamics based on the user's operation at a second time point, from second behavior information obtained by a second behavior information acquisition unit, and calculates the distance between second vectors based on the third vector and the fourth vector, and if the distance between second vectors exceeds a predetermined threshold, the verification information generation unit may generate verification information.

[0016] An information processing terminal according to one embodiment of the present invention may include, in its behavior information, information indicating keystroke dynamics including typing speed, press time, release time, and key input interval; information indicating changes in the cursor trajectory on the screen based on the operation of the input tool by the user at the first time point; and information indicating changes in the cursor trajectory on the screen based on the operation of the input tool by the user at the second time point.

[0017] An information processing method according to one embodiment of the present invention may include the following steps: a first behavior information acquisition step in which a computer acquires behavior information indicating the user's behavior at the time of input at the first time point as first behavior information during a processing stage in which it performs processing related to an account at the first time point; a second behavior information acquisition step in which it acquires behavior information of a user at the second time point when the user uses a service using an account at a stage other than account creation at a second time point later than the first time point as second behavior information; a determination step in which it compares the first behavior information and the second behavior information and determines whether they are correlated to a predetermined level or higher; a verification information generation step in which, if the first behavior information and the second behavior information are not correlated to a predetermined level or higher, it generates information indicating that the user at the second time point is not the user at the first time point as verification information; and a warning transmission step in which it generates a warning based on the verification information and transmits it to an external terminal.

[0018] An information processing program according to one embodiment of the present invention may cause a computer to execute: a first behavior information acquisition function that acquires behavior information indicating the user's behavior at the time of input at the first time point in a processing stage that performs account-related processing at the first time point, as first behavior information; a second behavior information acquisition function that acquires behavior information of the user at the second time point in a second time point, after the first time point, when the user uses a service using the account at a stage other than account creation, as second behavior information; a determination function that compares the first behavior information and the second behavior information and determines whether they are correlated to a predetermined level or higher; a verification information generation function that generates information indicating that the user at the second time point is not the user at the first time point if the first behavior information and the second behavior information are not correlated to a predetermined level or higher; and a warning transmission function that generates a warning based on the verification information and transmits it to an external function terminal. [Effects of the Invention]

[0019] According to the information processing terminal, information processing method, and information processing program related to this disclosure, it is possible to infer whether the user using the account is the same person based on behavioral information at each point in time. [Brief explanation of the drawing]

[0020] [Figure 1] It is a system diagram showing a configuration example of the present disclosure. [Figure 2] It is a block diagram showing an example of the configuration of an information processing terminal according to the present disclosure. [Figure 3] It is a block diagram showing an example of the configuration of a determination unit according to the present disclosure. [Figure 4] It is a diagram showing an example of a cursor trajectory according to the present disclosure. [Figure 5] It is a flowchart showing an example of the generation of verification information according to the present disclosure. [Figure 6] It is a diagram showing examples of various types of information according to the present embodiment.

Mode for Carrying Out the Invention

[0021] <Embodiment> <Overview> Figure 1 shows an example of the system configuration according to this disclosure. As shown in Figure 1, the system according to this embodiment includes an information processing terminal 10, an external terminal 20, and a user terminal 30, and the information processing terminal 10 is communicated to the external terminal 20 and the user terminal 30 via a network NW. In addition, various information acquired by the information processing terminal 10 may be converted into a format recognizable by the external terminal 20 and output. In this embodiment, the information processing terminal 10 determines whether the user is the same person based on various information acquired by the external terminal 20 when the user exchanges information with the external terminal 20 at a first time point in time, and various information acquired by the external terminal 20 when the user exchanges information with the external terminal 20 at a second time point in time, and transmits the determination result to the external terminal 20. The first time point in this disclosure is not particularly limited and may be the time when an account is created or the time when an account is used. In this case, a user who creates an account or uses an account at the first time point in time is also referred to as the first time point user in this embodiment. In addition, the second time point in this disclosure is a time point later than the first time point, and may be the time when an account is used. In this case, a user who performs processing other than account creation at the second time point is also referred to as the second time point user in this embodiment. If the information processing terminal 10 determines that the first time point user and the second time point user are not the same person, it can be considered that the second time point user in this disclosure may not be a legitimate user, having engaged in fraudulent activities such as impersonation or reselling accounts.Furthermore, the various information acquired from the information processing terminal 10, the external terminal 20, and the user terminal 30 is stored in the database of the system of this disclosure and is not limited to the various information of this disclosure. It may also include keystroke dynamics information such as keyboard typing speed, key press time, key release time, and key input interval; mouse movement pattern information such as cursor movement trajectory and cursor movement speed; operation actions of a physical or virtual keyboard; various information acquired from device sensors mounted on the information processing terminal 10 (e.g., accelerometer, gyroscope, magnetometer, global positioning system (GPS), optical sensor, proximity sensor, microphone, camera, touchscreen, etc.); and information indicating user behavior such as the time difference between the time when the device sensor acquired the various information and the time difference when account input began (e.g., the time difference from the time the page was completed to the start of account input, the time difference required to complete account and password input, the time difference between pressing and releasing each key, etc.).

[0022] The information processing terminal 10 is configured to acquire and analyze information indicating user behavior. When a user inputs various information at the user terminal 30, the information processing terminal 10 acquires that information and stores it in a database installed in the information processing terminal 10. The information processing terminal 10 may also transmit information to the external terminal 20 as determination information to determine whether the second time point user is the first time point user.

[0023] The external terminal 20 is configured to first receive an access request from the user terminal 30, obtain the results of the analysis of various information on the information processing terminal 10, and then provide services using the user's account. Furthermore, the external terminal 20 in this embodiment is not limited and may include financial institution terminals, police agency terminals, corporate terminals, e-commerce terminals, etc. After obtaining the analysis results from the information processing terminal 10, the external terminal 20 may decide whether to permit or deny the user's actions based on those analysis results.

[0024] The network NW may include wireless networks and wired networks. For example, the network NW may be a wireless LAN (WLAN), a wide area network (WAN), wireless LANs, 4th generation (4G), 5th generation (5G), and 6th generation (6G) and later mobile communication systems. However, the network NW is not limited to these examples and may also be a public switched telephone network (PSTN), optical fiber, satellite communication network, etc. Furthermore, the network NW may be a combination of these.

[0025] <Structure> Figure 2 is a block diagram showing an example configuration of the information processing terminal 10. The information processing terminal 10 is a computer system equipped with RAM (Random Access Memory, not shown), ROM (Read Only Memory, not shown), and a processor, and its functions may be implemented by a PC (Personal Computer), etc. Also, as shown in Figure 2, the information processing terminal 10 includes a communication unit 100, an input unit 200, a control unit 300, a warning transmission unit 400, an output unit 500, and a storage unit 600. However, the configuration of the information processing terminal 10 is not limited to the above, and it may also be provided with a shooting unit that acquires information showing the user's appearance, a voice acquisition unit that acquires the user's voice information, etc. The mechanisms of each structure of the information processing terminal 10 according to this embodiment will be described in detail below.

[0026] The communication unit 100 is configured such that the information processing terminal 10 exchanges information with the external terminal 20 and the user terminal 30 via the network NW. For example, the communication unit 100 may be a communication module that performs communication functions, including a wireless chip. Furthermore, the communication unit 100 according to this embodiment may include a transmitter and receiver that send and receive data between the external terminal 20 and the user terminal 30.

[0027] The input unit 200 is attached to the information processing terminal 10 and is configured to receive input signals for various types of information. The input unit 200 in this embodiment may be an input tool such as a keyboard, mouse, camera, microphone, or touchpad. The input unit 200 in this embodiment also receives a signal from the user terminal 30 and processes that signal in the information processing terminal 10 to convert it into a digital signal. Furthermore, the input unit 200 of the information processing terminal 10 in this embodiment may be a device of the same input type as the input unit (not shown) of the external terminal 20.

[0028] The control unit 300 is a processor that realizes various functions according to this embodiment by utilizing various information and programs stored in the database of the information processing terminal 10. The control unit 300 according to this embodiment includes a first behavior information acquisition unit 310, a second behavior information acquisition unit 320, a determination unit 330, and a verification information generation unit 340. The first behavior information acquisition unit 310 is configured to acquire behavior information as first behavior information that indicates the behavior of a first-time user, who is a user who performs input in a processing stage related to the creation or use of an account at a first time point in time. For example, when a user creates an account on the user terminal 30, the first behavior information acquisition unit 310 may acquire behavior information that indicates the user's behavior, such as the number of times a specific key is pressed, the speed of keystrokes, the time between keystrokes of a specific key and other specific keys, and the movement of the cursor when moving the cursor using a mouse or touch panel, or it may acquire information obtained from various sensors connected to the information processing terminal 10 as behavior information that indicates the user's behavior. Furthermore, the first behavior information acquisition unit 310 may acquire behavior information from the external terminal 20 regarding the operation of the user terminal 30.

[0029] The second behavior information acquisition unit 320 is configured to acquire behavior information of a second-timepoint user, who is a user who performs input when using an account at a stage other than account creation at a second time point after the first time point, as second behavior information. The stages other than account creation in this embodiment may include stages such as stages of using a service using an account, stages of using an account using an account, and stages of entering an account name and password in order to use an account. For example, when a user makes a transfer to another account using a keyboard, the information processing terminal 10 may acquire behavior information such as the time spent on each key and the input interval between each key when entering the account password, etc. Alternatively, various information acquired by multiple sensors mounted on the information processing terminal 10 may be used as behavior information indicating the user's behavior. The acquired behavior information may be stored in the database of the information processing terminal 10.

[0030] The determination unit 330 is configured to compare the behavior information acquired by the first behavior information acquisition unit 310 and the second behavior information acquisition unit 320 to determine whether the user at the second time point is the same person as the user at the first time point. Specifically, the determination unit 330 may compare the user behavior information acquired when the account was created at the first time point with the user behavior information acquired when the account was used at a second time point later than the first time point to determine whether the user at the second time point and the user at the first time point are the same person, or it may compare the user behavior information acquired when the account was used at the first time point with the user behavior information acquired when the account was used at a second time point later than the first time point to determine whether the user at the second time point and the user at the first time point are the same person. There may be multiple pieces of user behavior information at the first time point if it can be identified that they are the behavior information of the same user. As a result, the information processing terminal 10 can determine whether the user of the account at each time point is the same person within a wider time range. Furthermore, if the first behavior information and the second behavior information are correlated to a predetermined degree or higher, the determination unit 330 determines that there is a high probability that the user at the second time point and the user at the first time point are the same person. Conversely, if the first behavior information and the second behavior information are not correlated to a predetermined degree or higher, the determination unit 330 determines that the user at the second time point and the user at the first time point are not the same person (that is, there is a high probability that the user at the second time point is a different person from the user at the first time point). Furthermore, the determination method for determining whether the behavior information is correlated to a predetermined level or not is not limited to the determination unit 330 in this embodiment. A learning model that has learned the correspondence between the first behavior information and the second behavior information may be used, and the learning model may have learned whether the second time point user who input the second behavior information is the same as the first time point user who input the first behavior information. The first behavior information and the second behavior information may be input into the learning model to determine whether the second time point user and the first time point user are the same person. Alternatively, the similarity between the first behavior information and the second behavior information may be calculated to determine whether the second time point user who uses the account and the first time point user are the same person. Alternatively, vectors representing the respective behaviors may be calculated from the first behavior information and the second behavior information to determine whether the second time point user who uses the account and the first time point user are the same person.The details are explained below.

[0031] The verification information generation unit 340 is configured to generate verification information indicating that the second time point user and the first time point user may not be the same person if the first behavior information and the first behavior information do not correlate to a predetermined degree or higher. Specifically, if it is determined that the second time point user is not the first time point user, the verification information generation unit 340 generates verification information indicating that the second time point user using the account is not the first time point user. Conversely, if it is determined that the second time point user using the account and the first time point user are the same person, the verification information generation unit 340 does not need to generate verification information. The verification information according to this embodiment is not limited and may be represented as a 1-bit truth value or a binary number as a flag. The result of executing the process or if the condition is met may be a value such as "TRUE", "true", or "1", but if it is not met, it may be a value such as "FALSE", "false", or "0".

[0032] The warning transmission unit 400 is configured to transmit information to the external terminal 20 indicating whether the user at the second point in time may be different from the user at the first point in time, based on verification information. The warning according to this embodiment may include determination information for determining whether the accessing user is the person in question, or information indicating whether the user is the person in question. Furthermore, the external terminal 20 according to this embodiment may be a terminal such as a financial institution terminal or a Metropolitan Police Department terminal.

[0033] The output unit 500 is configured to output various information from the information processing terminal 10 to the external terminal 20. The output unit 500 may be configured for output such as a screen, interface, or display. The output unit 500 converts various information from the control unit 300 (which may include, for example, determination information for determining whether the second time point user is the first time point user, information indicating that the second time point user and the first time point user are the same person, information indicating that the second time point user and the first time point user are not the same person, etc.) into a format that can be recognized by the external terminal 20 or the information processing terminal 10 and outputs it.

[0034] The storage unit 600 is a storage medium that stores various information such as various programs required for the operation of the information processing terminal 10, first behavior information, second behavior information, and verification information, as well as a learning model (hereinafter referred to as the "learned model") which learns whether the second user is the first user based on the behavior information of the first user and the behavior information of the second user. The storage unit 600 may be implemented by, for example, an HDD (Hard Disk Drive), an SSD (Solid State Drive), or flash memory, but is not limited to these. The storage unit 600 may also be configured as ROM (Random Access Memory) or RAM (Random Access Memory) as a working area for executing programs.

[0035] <Configuration of the determination unit 330> The configuration of the determination unit 330 according to this embodiment will be described in detail below with reference to Figure 3. Figure 3 is a diagram showing an example of the configuration of the determination unit 330 according to this embodiment. The determination unit 330 according to this embodiment may further include a learning unit 331, a similarity calculation unit 332, a first vector calculation unit 333 and a second vector calculation unit 334, a third vector calculation unit 335 and a fourth vector calculation unit 336. Depending on the method for determining whether the second time point user and the first time point user are the same person, the configuration of the determination unit 330 may be partially omitted or partially added. For example, 1) If machine learning is used to determine whether the second time point user who used the account is the first time point user, the determination unit 330 may include a learning unit 331. 2) If the calculation of similarity determines whether the second time point user who used the account is the first time point user, the determination unit 330 may include a similarity calculation unit 332. 3) When calculating vectors to determine whether a second user using the account is the first user, the determination unit 330 may include a first vector calculation unit 333, a second vector calculation unit 334, a third vector calculation unit 335, and a fourth vector calculation unit 336. Furthermore, in order to improve the accuracy of determining whether a second user using the account is the first user, the determination unit 330 may be provided with a combination of the various configurations described above. However, the configuration of the determination unit 330 is not limited to the above, and the determination unit 330 may also include a photo determination unit that determines whether a second user using the account is the first user based on a photograph taken, or a voice information determination unit that determines whether a second user using the account is the first user based on acquired voice information.

[0036] The learning unit 331 is configured to train a pre-trained model using the behavior information of the first time point user, the behavior information of the second time point user, and information indicating whether or not the second time point user is the first time point user (i.e., whether or not they are the same user as the first time point user) as training data. In this embodiment, the first time point user may be a person who inputs various information to create an account, but the second time point user in this embodiment may include a person who uses the account, a person who inputs information such as a password before using the account, etc. Specifically, the pre-trained model may be retrained using the behavior information of the first time point user and the behavior information of the second time point user acquired by the control unit 300 and the determination result by the determination unit 330 as training data, or the pre-trained model may be retrained using the behavior information of the first time point user and the behavior information of the second time point user acquired by the control unit 300 and the determination result by the external terminal 20 as training data. Furthermore, if the administrator of the information processing terminal 10 is asked to determine whether the second user is the first user, the learning unit 331 may retrain the trained model using the behavior information of the first user and the second user acquired by the control unit 300, along with the determination result by the administrator of the information processing terminal 10, as training data. As a result, the training data is updated periodically, and the accuracy of the trained model can be improved.

[0037] The similarity calculation unit 332 is configured to calculate the similarity between the first behavior information and the second behavior information. The similarity according to this embodiment is not limited; for example, it may be the similarity between the time a specific key is pressed when creating an account and the time a specific key is pressed when not creating an account, or it may be the similarity between the first behavior information and the second behavior information by combining multiple items.

[0038] The first behavior information and the second behavior information in this embodiment may be information groups calculated by assigning weights to various information acquired from the first behavior information acquisition unit 310 and the second behavior information acquisition unit 320. For example, if the first behavior information acquisition unit 310 acquires the press time and release time of a specific key and the typing speed from the user's input, the similarity calculation unit 332 may assign weights to each acquired item according to its importance. For example, since a user's typing speed differs from person to person, it has the ability to identify a user for the information processing terminal 10. In this case, the determination unit 330 may assign a high weight or a low weight to the user's typing speed.

[0039] Furthermore, when assigning a predetermined weight to each item, the similarity calculation unit 332 may calculate the similarity based on the first behavior information and the second behavior information. For example, if the similarity calculation unit 332 determines that the difference between the first behavior information and the second behavior information is higher than a predetermined threshold, the determination unit 330 may determine that the second user using the account is not the first user, and the verification information generation unit 340 may generate verification information for that account. Conversely, if the similarity calculation unit 332 determines that the difference between the first behavior information and the second behavior information is lower than a predetermined threshold, the determination unit 330 may determine that the second user using the account is the first user, and the verification information generation unit 340 may not generate any information.

[0040] Furthermore, the similarity calculation unit 332 may vectorize the various information acquired by the first behavior information acquisition unit 310 and the second behavior information acquisition unit 320 to calculate the similarity. For example, if the first behavior information acquisition unit 310 acquires the key press time (0.2 seconds), release time (0.4 seconds), and typing speed (41 wpm) of a specific key from the user's input, the similarity calculation unit 332 may vectorize the aforementioned various information to (0.2, 0.4, 41). Next, the similarity calculation unit 332 calculates the similarity based on the vector information acquired by the first behavior information acquisition unit 310 and the vector information acquired by the second behavior information acquisition unit 320, and the determination unit 330 may determine whether the second user using the account is the first user based on the similarity calculation result.

[0041] The method for calculating similarity according to this embodiment is not limited to the above, and the similarity calculation unit 332 may calculate similarity by comparing the numerical values ​​of each item without assigning weights. For example, the similarity may be calculated by comparing the behavior information obtained from the first behavior information acquisition unit 310 and the second behavior information acquisition unit 320, respectively. In this case, the similarity calculation unit 332 may divide the first behavior information by the second behavior information and obtain it as a similarity coefficient.

[0042] The first vector calculation unit 333 is configured to acquire a first vector, which serves as an indicator representing the change in the cursor's trajectory due to the user's operation at a first point in time, from the first behavior information acquired by the first behavior information acquisition unit 310. The change in the cursor's trajectory according to this embodiment may be the movement trajectory on the cursor's operation screen, or it may be the movement trajectory of an input device used for general computer operation. Specifically, the first vector calculation unit 333 may acquire information such as movement distance, movement angle, and movement direction from the trajectory information between the first button and the second button on the operation screen when the user is creating an account. The first vector calculation unit 333 vectorizes the movement trajectory from the vector information of specific points based on information such as the movement distance, movement angle, and movement direction of the mouse cursor. The method of vectorizing the movement trajectory according to this embodiment is not limited, and the first vector calculation unit 333 may extract a plurality of specific points from the movement trajectory of the mouse cursor, acquire the vector information of those specific points, calculate the vector distance between each point, and quantify the movement trajectory. Furthermore, the second vector calculation unit 334 is configured to acquire a second vector, which serves as an indicator representing the change in the cursor's trajectory due to the operation of the user at the second point in time, from the second behavior information acquired by the second behavior information acquisition unit 320. Similar to the first vector calculation unit 333, the second vector calculation unit 334 may acquire information such as the distance, angle, and method of movement of the mouse cursor at stages other than account creation. The information processing terminal 10 calculates the distance between the first vectors based on how similar the shapes (movement trajectories) between the first vector and the second vector are. The information processing terminal 10 also calculates the distance between the first vectors based on the various information acquired by the first vector calculation unit 333 and the second vector calculation unit 334, and then compares this distance with a predetermined threshold. If the distance between the first vectors exceeds the predetermined threshold, the determination unit 330 determines that the aforementioned second point in time user is not the first point in time user, and the verification information generation unit 340 may generate verification information. Conversely, if the distance between the first vectors does not exceed a predetermined threshold, the determination unit 330 determines that the second user is the first user, and the verification information generation unit 340 does not need to generate any information.

[0043] Furthermore, the third vector calculation unit 335 is configured to acquire a third vector, which serves as an indicator representing the keystroke dynamics based on the user's operation at the first time point, from the first behavior information acquired by the first behavior information acquisition unit 310. The third vector may be a multidimensional vector whose elements are the press time of each key in the keystroke dynamics based on the user's operation at the first time point, or it may be a multidimensional vector whose elements are the time between pressing one key and pressing another key, and each combination of two keys. Furthermore, the fourth vector calculation unit 336 is configured to acquire a fourth vector, which serves as an indicator representing the keystroke dynamics based on the user's operation at the second time point, from the second behavior information acquired by the second behavior information acquisition unit 320. The fourth vector may be a multidimensional vector whose elements are the press time of each key in the keystroke dynamics based on the user's operation at the first time point, or it may be a multidimensional vector whose elements are the time between pressing one key and pressing another key, and each combination of two keys. The information processing terminal 10 calculates the inter-vector distance (Euclidean distance) between the third vector and the fourth vector. Furthermore, the information processing terminal 10 calculates the distance between second vectors based on the various information acquired by the third vector calculation unit 335 and the fourth vector calculation unit 336, and then compares this distance with a predetermined threshold. If the distance between second vectors exceeds the predetermined threshold, the determination unit 330 determines that the aforementioned second time point user is not the first time point user, and the verification information generation unit 340 may generate verification information. Conversely, if the distance between second vectors does not exceed the predetermined threshold, the determination unit 330 determines that the aforementioned second time point user is the first time point user, and the verification information generation unit 340 does not need to generate any information. The information processing terminal 10 of this disclosure may improve the accuracy of determining whether the second time point user and the first time point user are the same person by incorporating the results calculated by each vector calculation unit and the time differences acquired by devices mounted on the information processing terminal 10.

[0044] Figure 4 shows an example of quantifying the cursor trajectory of the first vector calculation unit 333 and the second vector calculation unit 334. Specifically, the operation screen 40 has multiple selection buttons, and the user moves the cursor to select a task from among the multiple buttons. For example, when the user selects the "Transfer 401" button and presses the "Next Page 402" button, the first vector calculation unit 333 may acquire the first movement trajectory 403 of the mouse cursor, or the second vector calculation unit 334 may acquire the second movement trajectory 404 of the cursor. In this case, the storage unit 600 of the information processing terminal 10 calculates the first vector distance based on the first movement trajectory 403 and the second movement trajectory 404. Subsequently, the information processing terminal 10 may determine whether the second user using the account is the first user by comparing the calculated first vector distance with a predetermined threshold.

[0045] <Example of operation> Hereinafter, an embodiment of the information processing terminal 10 according to this embodiment will be described with reference to Figure 5. Figure 5 is a flowchart showing an embodiment of generating verification information according to this embodiment. First, the first behavior information acquisition unit 310 acquires behavior information when a user creates an account (step S501). The behavior information acquired by the first behavior information acquisition unit 310 is not limited and may include information on what the user types on the keyboard, information on cursor movement, etc.

[0046] Next, the second behavior information acquisition unit 320 acquires second behavior information of the user at a second point in time when the user uses the aforementioned account, other than at the stage of account creation (step S502). In this embodiment, the definition may be comprehensive, and may include information when the user uses the account (for example, information when the user themselves uses the account, and information when someone other than the user uses the account). In this case, the items of the second behavior information acquired by the second behavior information acquisition unit 320 may be the same as the items of the first behavior information acquired by the first behavior information acquisition unit 310. For example, if the first behavior information acquisition unit 310 acquires item 1) typing speed and item 2) key press time as first behavior information, the second behavior information acquisition unit 320 may acquire item 1) typing speed and item 2) specific key press time as second behavior information, similar to the first behavior information acquisition unit 310.

[0047] Then, the determination unit 330 compares the first behavior information and the second behavior information acquired by the first behavior information acquisition unit 310 and the second behavior information acquisition unit 320 according to predetermined rules (step S503), and determines whether the first behavior information and the second behavior information are correlated to a predetermined level or higher (step S504). The predetermined rules in this embodiment are not limited, and the similarity between the first behavior information and the second behavior information may be calculated and compared with a predetermined threshold, or machine learning may be used to determine whether the first behavior information and the second behavior information are correlated to a predetermined level or higher based on the results of the machine learning, or vector information based on cursor movement information may be used to determine whether the first behavior information and the second behavior information are correlated to a predetermined level or higher.

[0048] If the first behavior information and the second behavior information are correlated to a predetermined degree or higher (YES in step S504), the verification information generation unit 340 does not need to generate any information. Conversely, if the first behavior information and the second behavior information are not correlated to a predetermined degree or higher (NO in step S504), the verification information generation unit 340 generates verification information for the account used by that user (step S505). In this case, the warning transmission unit 400 sends a warning to the external terminal 20 based on the verification information (step S506).

[0049] <Data> Figure 6 shows an example of the information stored in the database of the information processing terminal 10. As shown in Figure 6, the information processing terminal 10 may store various information such as typing speed 501, key press time 502, key release time 503, key input interval 504, first vector 505, and others 506 as information related to behavior information 507. The type of behavior information is not limited, and any information that indicates the user's behavior may be processed by the information processing terminal 10 as behavior information. Behavior information 1, behavior information 2, and behavior information 3 shown in Figure 6 may each be behavior information of different users, and behavior information 507 may also be associated with information indicating the user's account.

[0050] Furthermore, various information according to this embodiment will be described. Typing speed 501 is the speed at which a user types on the keyboard within a unit of time, and may be the value obtained by dividing it by the number of times typed within a unit of time. Generally, a user's typing speed varies depending on their skill level. For example, the typing speed of someone who does not use the keyboard often is currently slower than the typing speed of someone who uses the keyboard frequently. As shown in Figure 5, if the typing speed in behavior information 1 is 41 wpm (words per minute) and the typing speed in behavior information 2 is 29 wpm, the information processing terminal 10 may determine that behavior information 1 and behavior information 2 are not correlated to a predetermined degree or higher.

[0051] The key press time 502 is the duration that a key on the keyboard is held down. The press time for each key on the keyboard varies depending on the user's habits. For example, the press time when a user lightly presses a key on the keyboard differs from the press time when a user presses a key heavily, with the light press time being shorter than the heavy press time. The information processing terminal 10 may determine whether the user is the person they claim to be based on the difference in the key press time as a type of behavioral information. The key press time 502 may also be subdivided and registered as the press time for each individual key.

[0052] The key release time 503 is the time during which the keyboard key is free from stress on the finger. Similar to the key press time 502, the release time 503 for each key on the keyboard differs depending on the user's individual habits. The information processing terminal 10 may determine whether the user is the person in question based on the difference in the release time 503. Since the key press time 502 and key release time 503 according to this embodiment are stored as behavioral information indicating the user's typing habits, the information processing terminal 10 may determine whether the user at the second point in time is the person in question based on the key press time 502 and release time 503 as a set. The key release time 503 may also be subdivided and registered as the release time after pressing a certain key, that is, the release time for each key.

[0053] The key input interval 504 is information indicating the time interval between pressing each key on the keyboard. Specifically, when a second-time user is typing, the time interval between pressing each key differs depending on the typing speed. Depending on the user's typing speed, those who type quickly have shorter time intervals between pressing each key. Conversely, those who type slowly have longer time intervals between pressing each key. Therefore, the information processing terminal 10 according to this embodiment may determine whether the second-time user is the first-time user based on the key input interval. The key input interval 504 may be subdivided and registered into time intervals between a certain key and a combination of that key or another key. That is, a value (for example, a difference value or an average value) indicating the time between pressing a certain key and pressing another key (or the same key) may be registered for each key combination.

[0054] The first vector 505 is vector information indicating the change in the cursor's movement trajectory, calculated by the first vector calculation unit 333. For example, the information processing terminal 10 may acquire multiple vector information from one button to another on the operation screen, calculate the distance between vectors based on these multiple vectors, and use this as behavior information. The first vector 505 is the movement trajectory when the cursor is moved when pressing one button and then another button on the service screen using the cursor, and may be subdivided and registered for each combination of buttons.

[0055] Other information 506 is behavioral information other than the information described above. For example, the information processing terminal 10 may acquire the second vector, third vector, fourth vector, etc., and store them in the database. However, it is not limited to these, and all information when the user operates the keyboard and mouse may be included in the behavioral information according to this embodiment.

[0056] The above describes the configuration and operation examples of the information processing terminal 10 according to this embodiment. In addition, the same reference numerals are used for identical or equivalent components, processes, and signals shown in each drawing, and redundant explanations are omitted as appropriate. Furthermore, some components that are not important for explanation are omitted from each drawing.

[0057] <Supplementary explanation> Although the information processing terminal 10 according to the above embodiment has been described, it goes without saying that the present invention is not limited to the above embodiment. Various modifications will be described below.

[0058] (1) In the above embodiment, the information processing terminal 10 according to this embodiment may further include a camera unit that acquires information on the user's hand movements. Specifically, the camera unit may, after obtaining permission from the user, photograph the hands operating the keyboard and mouse to acquire operation information. The determination unit 330 may then compare the hand operation information acquired when creating the account with the hand operation information while using the account to determine whether the second user using the account is the first user.

[0059] (2) In the above embodiment, the information processing terminal 10 according to this embodiment may further include an authentication unit that presents additional authentication to the user based on the verification information generated by the verification information generation unit 340. Specifically, if the information processing terminal 10 detects that the user's behavior information at a second point in time while using the account deviates significantly from the previously recorded user behavior information stored in the storage unit 600, after the verification information generation unit 340 has generated the verification information but before the warning transmission unit 400 sends a warning to the external terminal 20, the information processing terminal 10 may verify the user's identity via facial recognition, fingerprint recognition, voice recognition, etc. Conversely, if the first behavior information when the user creates an account and the second behavior information when the user is using the account are closely correlated to a predetermined extent or more, the information processing terminal 10 may incorporate this behavior information into a profile and store it as information to improve accuracy.

[0060] (3) In the above embodiment, the information processing terminal 10 according to this embodiment may be provided with a configuration that ensures compliance with the privacy and data protection of the account owner. Specifically, after the information processing terminal 10 obtains confidential information such as passwords and personal information of the user from the user terminal 30, it is not necessary to store the information in the storage unit 600, but rather to encrypt each piece of information and convert it into a string for analysis. However, it is not limited to this, and the information processing terminal 10 may store the information as a known text string such as an account ID or number, or as biometric authentication behavioral data such as the keyboard dynamics of the password. In this case, the user's confidential information is not stored in the information processing terminal 10, and privacy protection can be improved.

[0061] (4) In the above embodiment, the information processing terminal 10 may provide a Software Development Kit (SDK). Specifically, the SDK is embedded in the mobile application or website of the external terminal 20, enabling the collection and analysis of various types of information in real time without disrupting the user experience or requiring significant changes to the IT infrastructure of the external terminal 20.

[0062] (5) In the above embodiment, the information processing terminal 10 may determine whether the second-time user using the account is the first-time user based on various information when the user uses the account. Specifically, the information processing terminal 10 may calculate a similarity based on the typing information when creating the account and the typing information when using the account as described above, and determine whether the account holder is the person in question based on that similarity. In addition, based on the determination result of the information processing terminal 10, it may send information to the financial institution indicating whether the account creator and the account user are the same person, or it may send information to the financial institution to determine whether the account creator and the account user are the same person.

[0063] (6) In the above embodiment, the information processing terminal 10 may determine whether a second-point-in-time user using the account is committing fraud based on various information obtained when creating an account and various information obtained when using the account. For example, the information processing terminal 10 may detect abnormal values ​​from the behavior information when creating an account and the behavior information when using the account, and determine whether or not fraud has occurred. The abnormal values ​​in this disclosure may be high values ​​that are the difference between the behavior information when creating an account and the behavior information when using the account.

[0064] (7) In each of the above embodiments, the information processing program according to this embodiment may implement, for example, an object-oriented programming language such as ActionScript, JavaScript®, Python®, C language, C++, C#, Java®, etc.

[0065] (8) In the above embodiments, the information processing method, information processing program, control procedure, and especially the processing procedure described using the follow and block diagrams according to the embodiments, the processing method and procedure may be partially omitted, new parts may be added, or the steps may be replaced or their order changed. Such omissions, additions, or changes in order of processing procedures are also included in the scope of this disclosure as long as they do not deviate from the purpose of this exhibit.

[0066] (9) In one embodiment of the information processing method, the computer performs the following steps: first behavior information acquisition step, in a processing stage at a first time point in which it performs processing related to an account, to acquire behavior information indicating the user's behavior at the time of input at the first time point as first behavior information; second behavior information acquisition step, in which it acquires behavior information of the user at a second time point in a second time point later than the first time point in which it uses a service using an account at a stage other than account creation as second behavior information; determination step, in which it compares the first behavior information and the second behavior information to determine whether they are correlated to a predetermined level or higher; if the first behavior information and the second behavior information are not correlated to a predetermined level or higher, to generate verification information generation step, in which it generates information indicating that the user at the second time point is not the user at the first time point as verification information; and warning transmission step, in which it generates a warning based on the verification information and transmits it to an external terminal. As a result, the information processing method can achieve the same effect as the information processing apparatus of the one embodiment described above.

[0067] (10) In one embodiment of an information processing program, the computer is made to execute: a first behavior information acquisition function that acquires behavior information indicating the user's behavior at the time of input at the first time point in a processing stage that performs account-related processing at the first time point; a second behavior information acquisition function that acquires behavior information of the user at the second time point in a second time point, after the first time point, when the user uses a service using the account at a stage other than account creation; a determination function that compares the first behavior information and the second behavior information and determines whether they are correlated to a predetermined level or higher; a verification information generation function that generates information indicating that the user at the second time point is not the user at the first time point if the first behavior information and the second behavior information are not correlated to a predetermined level or higher; and a warning transmission function that generates a warning based on the verification information and transmits it to an external function terminal. As a result, the information processing program can achieve the same effect as the information processing device of the one embodiment described above. [Explanation of Symbols]

[0068] 10 Information Processing Terminals 20 External terminals 30 User terminals 40 Operation screen 100 Communications Department 200 Input section 300 Control Unit 310 First behavior information acquisition unit 320 Second Behavior Information Acquisition Unit 330 Judgment section 331 Learning Department 332 Similarity calculation unit 333 First Vector Calculation Unit 334 Second Vector Calculation Unit 340 Verification Information Generation Unit 400 Warning transmission unit 401 First Button 402 Second button 500 Output section 600 Storage section

Claims

1. In a processing stage that performs account-related processing at the first point in time, a first behavior information acquisition unit acquires behavior information indicating the user's behavior at the time of input at the first point in time as first behavior information. A second behavior information acquisition unit acquires second behavior information as second behavior information when the user uses the service using the account at a stage other than the creation of the account at a second time point, which is after the first time point. A determination unit that compares the first behavior information and the second behavior information to determine whether they are correlated to a predetermined level or higher, If the first behavior information and the second behavior information do not correlate to a predetermined degree or higher, a verification information generation unit generates information indicating that the second time point user is not the first time point user as verification information, The system includes a warning transmission unit that generates a warning based on the aforementioned verification information and transmits it to an external terminal. Information processing terminal.

2. The first behavior information acquisition unit is: When creating the account in the processing step, behavioral information indicating the user's behavior at the time of input at the first point in time is acquired as the first behavioral information. The information processing terminal according to feature 1.

3. The first behavior information acquisition unit is: When using the account in the processing step, behavioral information indicating the user's behavior at the time of input at the first point in time is acquired as the first behavioral information. The information processing terminal according to feature 1.

4. The aforementioned information processing terminal is The system includes a storage unit that stores a learning model that learns whether or not the user at the second time point is the same user as the user at the first time point, based on the user's behavior information at the first time point and the user's behavior information at the second time point that is later than the first time point. The determination unit, The second behavior information of the second time point user is input to the learning model, and the learning model is used to determine whether the second time point user is the first time point user. If the first behavior information and the second behavior information are correlated to a predetermined level or higher by referring to the learning results of the learning model, the determination unit determines that the second time point user is the first time point user. If the first behavior information and the second behavior information are not correlated to a predetermined level or higher by referring to the learning results of the learning model, the verification information generation unit generates the verification information for the account. The information processing terminal according to feature 1.

5. The determination unit, The system further comprises a learning unit that retrains the learning model using the behavior information of the user at the first time point, the behavior information of the user at the second time point, and a result indicating whether or not the user at the second time point is the user at the first time point as training data. The information processing terminal according to feature 4.

6. The determination unit, The system further comprises a similarity calculation unit that calculates the similarity between the first behavior information and the second behavior information, If the similarity is lower than a predetermined threshold, the verification information generation unit generates the verification information for the account. The information processing terminal according to feature 1.

7. The determination unit, A first vector calculation unit obtains a first vector from the first behavior information acquired by the first behavior information acquisition unit, which serves as an indicator representing the change in the cursor trajectory due to the user's operation at the first time point. The system further comprises a second vector calculation unit that obtains a second vector from the second behavior information acquired by the second behavior information unit, which serves as an indicator representing the change in the cursor's trajectory due to the user's operation at a second point in time, Based on the first vector and the second vector, the first vector distance is calculated, and if the first vector distance exceeds a predetermined threshold, the verification information generation unit generates the verification information. The information processing terminal according to feature 1.

8. The determination unit, A third vector calculation unit obtains a third vector from the first behavior information acquired by the first behavior information acquisition unit, which is an indicator representing keystroke dynamics based on the user's operation at the first time point. The system further includes a fourth vector calculation unit that obtains a fourth vector, which is an indicator representing the keystroke dynamics based on the user's operation at a second point in time, from the second behavior information acquired by the second behavior information acquisition unit, The second vector distance is calculated based on the third vector and the fourth vector, and if the second vector distance exceeds a predetermined threshold, the verification information generation unit generates the verification information. The information processing terminal according to feature 1.

9. The aforementioned behavioral information is, Information indicating keystroke dynamics, including typing speed, press time, release time, and key input interval; information indicating changes in the cursor trajectory on the screen based on the user's operation of the input tool at the first time point; and information indicating changes in the cursor trajectory on the screen based on the user's operation of the input tool at the second time point. An information processing terminal according to any one of claims 1 to 7.

10. Computers In a processing stage where account-related processing is performed at the first point in time, a first behavior information acquisition step is performed to acquire behavior information indicating the user's behavior at the time of input at the first point in time, as first behavior information. A second behavior information acquisition step, which acquires second behavior information as second behavior information, when the user uses the service using the account at a second time point, which is after the first time point, in a stage other than the creation of the account. A determination step of comparing the first behavior information and the second behavior information to determine whether they are correlated to a predetermined level or higher, If the first behavior information and the second behavior information do not correlate to a predetermined degree, a verification information generation step is performed to generate information indicating that the second time point user is not the first time point user. The process includes: executing a warning transmission step which generates a warning based on the aforementioned verification information and sends it to an external step terminal; and Information processing methods.

11. On the computer, In the processing stage where account-related processing is performed at the first point in time, a first behavior information acquisition function acquires behavior information indicating the user's behavior at the time of input at the first point in time as first behavior information. A second behavior information acquisition function that acquires second behavior information when the user uses the service using the account at a stage other than the creation of the account at a second time point, which is after the first time point, and A determination function that compares the first behavior information and the second behavior information to determine whether they are correlated to a predetermined level or higher, If the first behavior information and the second behavior information do not correlate to a predetermined degree or higher, a verification information generation function generates information indicating that the user at the second time point is not the user at the first time point, as verification information. A warning transmission function is executed, which generates a warning based on the aforementioned verification information and sends it to an external function terminal. Information processing program.

Images