Method of data collection and analysis based on open source information (OSINT) for the prevention of financial accidents

Abstract

According to various embodiments, a method for collecting and analyzing data based on open source intelligence (OSINT) to prevent financial accidents may include: (a) a step of collecting source data from social media, news, the dark web, and public APIs based on keywords related to financial accidents; (b) a data preprocessing step including labeling metadata, author information, and time and location information of the collected source data; (c) a step of quantifying the probability of financial accidents by applying a natural language processing (NLP)-based risk analysis model to the labeled data; (d) a step of generating and storing event information, user information, and pattern information as a risk alert data set when the quantified probability of financial accidents is above a preset threshold; and (e) a step of providing the risk alert data set to a security monitoring system of a financial institution to enable a proactive response.

Description

Technology Field

[0001] The present invention relates to a method for collecting and analyzing data based on open source intelligence (OSINT) for the prevention of financial accidents. It concerns a technology that enables proactive response by utilizing various externally disclosed information sources, such as social media, online news, the dark web, and public APIs, to detect early signs related to financial accidents, and by linking this with the security monitoring system of a financial institution. Background Technology

[0003] With the rapid digitalization of financial transactions in recent years, various financial services such as online banking, mobile payments, and virtual asset trading are becoming widespread. However, behind this convenience and scalability lies the problem of increasing financial fraud in various forms, including phishing, smishing, illegal money laundering, and voice phishing.

[0004] Existing responses to financial incidents were primarily reactive, relying on internal transaction data, which limited the ability to proactively block threats before an incident occurred. Furthermore, despite the fact that warning signs of financial incidents often appear first in publicly available information such as social media, news, the dark web, and online communities, methods for systematically collecting and analyzing this data were limited.

[0005] Therefore, there is a need for technology that enables proactive response by early detection of signs related to financial incidents from various external channels based on Open Source Intelligence (OSINT), quantifying them, and linking them with the financial institution's security monitoring system. Prior art literature

[0007] Korean Registered Patent Publication No. 10-1916676 (2018.11.02) Korean Published Patent Publication No. 10-2428134 (2022.07.28) Korean Published Patent Publication No. 10-2757893 (2025.01.16) The problem to be solved

[0008] Accordingly, the technical problem that the present invention aims to solve is created to resolve the aforementioned problem, and aims to provide a method for collecting and analyzing data based on Open Source Intelligence (OSINT) for the prevention of financial accidents.

[0009] This invention aims to overcome the limitations of financial accident response technology. Existing financial accident response methods have been limited to reactive approaches that rely on internal transaction data within financial institutions to detect and respond after an accident occurs, making it difficult to proactively block threats before damage takes place. Furthermore, although signs of financial accidents often appear first in publicly available external information such as social media, news, the dark web, and online communities, technology for comprehensively and systematically collecting and analyzing this information has been lacking.

[0010] Therefore, the present invention aims to enable financial institutions to recognize potential threats in real time and respond proactively by collecting and preprocessing various forms of data based on external open source intelligence (OSINT) and applying artificial intelligence analysis techniques to quantitatively evaluate the possibility of financial accidents at an early stage.

[0011] The technical problems that the present invention aims to solve are not limited to those mentioned above, and other unmentioned technical problems will be clearly understood by those skilled in the art to which the present invention belongs from the description below. means of solving the problem

[0013] A method for collecting and analyzing data based on open source intelligence (OSINT) to prevent financial accidents according to the present invention, which solves the above technical problem, may include: (a) a step of collecting source data from social media, news, the dark web, and public APIs based on keywords related to financial accidents; (b) a data preprocessing step including labeling metadata, author information, and time and location information of the collected source data; (c) a step of quantifying the probability of financial accidents by applying a natural language processing (NLP)-based risk analysis model to the labeled data; (d) a step of generating and storing event information, user information, and pattern information as a risk alert data set when the quantified probability of financial accidents is greater than or equal to a preset threshold; and (e) a step of providing the risk alert data set to a security monitoring system of a financial institution to enable a preemptive response. Effects of the invention

[0015] According to the present invention, early signs of financial accidents can be detected from various publicly available external data, such as social media, news, the dark web, and financial forums, making it possible to respond preemptively before an accident occurs. Through this, the existing reactive financial security system can be transformed into a real-time, preventive system, and financial institutions can identify potential threats in advance to minimize damage.

[0016] Furthermore, since the present invention provides a function capable of integrated analysis of different forms of data, such as text, images, and audio, it can enhance accuracy and reliability compared to existing analysis methods that rely on a single data type. In particular, by quantitatively calculating the risk of financial fraud and presenting it in a visual format, security personnel can intuitively grasp the situation and formulate rapid response strategies. Moreover, by collecting and analyzing threat information from invisible areas such as the dark web, it is possible to detect deep-seated threats that are difficult to identify on the surface web.

[0017] The effects of the present invention are not limited to those described above, and potential effects expected from the technical features of the present invention will be clearly understood from the description below. Brief explanation of the drawing

[0019] FIG. 1 is a block diagram showing the configuration of the entire system for carrying out the present invention. FIG. 2 is a flowchart showing the overall flow of a financial accident prevention data analysis method according to one embodiment of the present invention. FIG. 3 is an example of a multimodal analysis method that analyzes text and image data in combination according to the present invention. Figure 4 is an example diagram of the process of extracting account information from an image according to the present invention. FIG. 5 is an example of a dashboard screen that provides a risk alert generated according to the present invention to a user. Specific details for implementing the invention

[0020] Hereinafter, various embodiments of this document are described with reference to the accompanying drawings. The embodiments and the terms used therein are not intended to limit the technology described in this document to specific embodiments and should be understood to include various modifications, equivalents, and / or substitutions of said embodiments. In relation to the description of the drawings, similar reference numerals may be used for similar components. A singular expression may include a plural expression unless the context clearly indicates otherwise. In this document, expressions such as "A or B" or "at least one of A and / or B" may include all possible combinations of items listed together. Expressions such as "first," "second," "first," or "second" may modify said components regardless of order or importance and are used only to distinguish one component from another and do not limit said components. When it is mentioned that a certain (e.g., 1st) component is "(functionally or telecommunicationally) connected" or "connected" to another (e.g., 2nd) component, said certain component may be directly connected to said other component or connected through another component (e.g., 3rd component).

[0021] In this document, "configured to" may be used interchangeably with, depending on the context, for example, hardware- or software-wise, "suitable for," "capable of," "modified to," "made to," "capable of," or "designed to." In some cases, the expression "device configured to" may mean that the device is "capable of" in conjunction with other devices or components. For example, the phrase "processor configured to perform A, B, and C" may mean a dedicated processor for performing the corresponding operations (e.g., an embedded processor), or a general-purpose processor capable of performing the corresponding operations by executing one or more software programs stored in a memory device (e.g., a CPU or application processor).

[0022] An electronic device according to various embodiments of the present document may include, for example, at least one of a smartphone, a tablet PC, a desktop PC, a laptop PC, a netbook computer, a workstation, and a server.

[0024] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the attached drawings. In describing the present invention, detailed descriptions of related known technologies are omitted if it is determined that such detailed descriptions may unnecessarily obscure the essence of the present invention.

[0025] FIG. 1 is a block diagram showing the configuration of an overall system for implementing the present invention. FIG. 2 is a flowchart showing the overall flow of a financial accident prevention data analysis method according to an embodiment of the present invention, and

[0026] Referring to FIG. 1, a system for implementing the present invention may be configured to include a data collection unit (100) that collects data from various OSINT sources (10), a data streaming unit (200) that transmits the collected data in real time, a real-time processing unit (300) that performs preprocessing and analysis of the data, a data storage unit (400) that stores the analyzed data, and a result providing unit (500) that transmits the analysis results to an external system. Here, OSINT (Open-Source Intelligence) may refer to all information that can be legally collected from public sources such as newspapers, broadcasts, and the internet.

[0028] Each step of the present invention performed through this system configuration is as follows with reference to FIG. 2.

[0030] In operation 201, according to various embodiments, source data including text and images can be collected from social media, news, the dark web, and public APIs based on keywords related to financial fraud. Specifically, the data collection unit (100) can collect data by periodically crawling various OSINT sources (10), such as search engines like Google, specific online communities, and dark web forums, using predefined keywords or dynamically updated keywords. At this time, rich metadata such as titles, snippets, original links, author information, and writing times can be extracted together by analyzing the HTML structure of web pages. In the present invention, a high data collection success rate of 95% or more based on an HTTP 200 response rate during web crawling can be secured to minimize information omission. As an additional embodiment, the data collection unit (100) may include a 'dynamic scheduler'. This scheduler can perform an adaptive collection strategy to collect the latest threat information more quickly by automatically shortening the crawl cycle of a specific OSINT source (10) when signs of danger are frequently detected (e.g., 24 hours -> 1 hour). For example, by performing a search with keywords such as 'dummy account', 'loan scam', and 'free money', 1,336 related web pages and 635 images, such as advertising banners and verification photos included on those pages, can be collected. In particular, for social media such as Facebook and Twitter, data posted by specific hashtags or accounts can be collected in the form of a real-time stream by utilizing the provided RESTful API.

[0031] According to one embodiment, the keywords used for data collection can expand the detection scope by including not only standardized keywords for accident types such as 'eat-and-run' and 'dummy account' extracted from a database of past financial accidents, but also slang and neologisms such as 'free money' that are rapidly generated and changing online. Furthermore, rather than relying solely on predefined keywords, a machine learning model that periodically learns from accumulated data can analyze newly emerging threat patterns to dynamically recommend and update new threat keywords, thereby enabling the detection of signs of unknown new types of financial accidents.

[0032] According to one embodiment, a machine learning model that proposes keywords may use a deep learning model capable of classifying multiple types of financial incidents, such as illegal gambling, phishing, and money laundering. This model learns unique linguistic patterns and features that appear for each type of financial incident, classifies which type of financial incident is likely to be associated with specific data, and can improve the accuracy of keyword expansion by recommending the most suitable new keyword based on the classification result.

[0033] According to one embodiment, a special approach utilizing a Tor network and an authentication proxy server can be used to collect data from the dark web, which is used as a channel for the distribution of illegal information where anonymity is guaranteed. In this process, the IP address of the collection server is concealed to prevent tracking, and all logs of access to the dark web site are encrypted and stored separately, thereby ensuring the security and stability of the data collection process.

[0034] According to an additional embodiment, the data collection unit (100) may be operated by including an "Active Threat Decoy System," also known as a honeypot. Here, a honeypot refers to a system designed to lure attackers by creating a system or account that appears to have security vulnerabilities, and to identify their attack techniques, tools used, and objectives. In the present invention, fake online posts (e.g., "High-paying part-time job urgently needed, ID / bank account required") or fake social media accounts that financial fraudsters might be interested in can be created and operated. Information such as comments, messages, slang used, and account numbers presented by fraudsters who access this honeypot constitutes highly pure threat data, which can be collected and utilized as training data for an analysis model or used to discover new threat keywords. Through this, a preemptive data collection strategy can be employed to go beyond passively collecting publicly available data and actively lure hidden threat actors to the surface to obtain information.

[0036] In operation 203, according to various embodiments, a data preprocessing step including metadata, author information, time and location information labeling, and personal information anonymization can be performed on the collected source data through a real-time data streaming pipeline. Specifically, a large volume of unstructured data collected by the data collection unit (100) can be transmitted to the real-time processing unit (300) through the data streaming unit (200), and the data preprocessing module (310) within the real-time processing unit (300) can remove unnecessary particles, endings, etc., of Korean text and extract meaningful nouns and key morphemes using a natural language processing tool such as the Okt morphological analyzer of KoNLPy. Here, a TF-IDF (Term Frequency-Inverse Document Frequency) algorithm can be applied to evaluate the importance of the extracted nouns. It is a value obtained by multiplying the frequency of a word within a specific document (TF) and the inverse of the frequency of that word appearing in the entire document (IDF). This can be calculated as shown in [Formula 1] below, and the higher this value, the higher the likelihood that the word is a keyword in the document.

[0037] [Formula 1]

[0038]

[0039] (Here, is a word, is a document, The total number of documents, is a word It may mean the number of documents containing.)

[0040] In addition, information requiring personal information protection, such as resident registration numbers, phone numbers, and addresses, can be safely anonymized according to the k-anonymity principle by utilizing detection based on regular expressions (Regex) and a pre-trained NER model. For example, the original text "The one and only community for free money, Kongnara! Please contact 010-XXXX-XXXX." can be refined into core noun tokens such as ['free money', 'one', 'community', 'Kongnara'] through a preprocessing process, and the phone number can be masked as '010--'.

[0041] According to one embodiment, data preprocessing can be performed on a real-time streaming pipeline composed of large-scale distributed data processing technologies such as Apache Kafka and Spark Streaming. This enables the processing of large-scale data of more than 10,000 transactions per second (TPS 10K) without delay. In particular, through precise language processing using the KoNLPy morphological analyzer and a Named Entity Recognition (NER) model with high accuracy of F1 Score 0.90 or higher, key information such as slang related to financial fraud and account numbers hidden within text can be effectively detected and structured.

[0043] In operation 205, according to various embodiments, the possibility of financial accidents can be quantified by applying a risk analysis model based on natural language processing (NLP) and machine vision to preprocessed data. Specifically, the risk analysis engine (320) within the real-time processing unit (300) can calculate the risk level by analyzing text and image data in combination. Referring to FIG. 3, the text data (1a) and image data (1b) included in a single post (1) can be analyzed by the text analysis module (20) and the image analysis module (30), respectively. As an additional embodiment, the present invention may utilize an 'Author Reputation Score' in the analysis. This is a history of managing and scoring the risk level of content created in the past by a specific author ID or nickname. For example, if an author who has a history of posting illegal advertisements five or more times creates a new post, a weight is assigned to the basic risk level of that post. Final risk level ( ) can be expressed as the weighted sum of each element as shown in [Equation 2] below.

[0044] [Equation 2]

[0045]

[0046] (Here, , , These are the text, image, and author reputation scores, respectively, and , , can refer to a weight indicating the importance of each score.)

[0047] For example, text risk ( ) is 70 points, image risk ( Even if ) was calculated as 60 points, the author's reputation score of the post ( If ) is very high at 90 points, the weight( , , The final risk score with ) applied can be calculated as (0.4 x 70)+(0.4 x 60)+(0.2 x 90) = 28 + 24 + 18 = 70 points. As such, combining multimodal and reputation analysis enables much more sophisticated threat detection than a single analysis.

[0048] According to one embodiment, image data analysis can precisely identify gambling site advertising banners or images of forged official documents by using an object detection model that exhibits high performance with a mean average precision (mAP) of 92% or higher. In addition, the value of the data can be maximized by applying the latest AI technology, such as a GPT multimodal model, to the analysis of account transfer history images like (50) in FIG. 4, thereby going beyond simply extracting text within the image to understanding the context and extracting semantically structured financial information such as 'sender,' 'recipient,' and 'transfer amount.' As an additional embodiment, the image analysis function may include a steganography detection function. Here, steganography may refer to a technique for secretly hiding other information within general digital media, such as images or audio files. Financial fraudsters may hide and distribute dummy account numbers, contact information, or URLs for malware distribution sites invisibly within seemingly normal landscape photos or profile pictures. The risk analysis engine (320) of the present invention includes a deep learning-based steganography detection model and can detect whether hidden data exists by analyzing the pixel value distribution or noise pattern of an image. If hidden data is detected, the image can be immediately classified as a high-risk group and designated as a target for detailed analysis.

[0049] According to an additional embodiment, the risk analysis engine (320) may include a 'graph-based relationship analysis' function. Financial fraud, particularly organized crimes such as voice phishing or money laundering, is characterized by the formation of a complex network involving multiple dummy accounts, contacts, and money couriers. In the present invention, entities extracted from data (e.g., account number, account holder, author ID, contact information, IP address, etc.) are defined as individual nodes, and relationships between them (e.g., account number and contact information being mentioned together in a specific post) are connected as edges to construct a massive social network graph. Subsequently, a graph analysis algorithm such as PageRank or Betweenness Centrality can be applied to identify key accounts or actors acting as hubs at the center of the network. For example, a top account that receives money from multiple subordinate financiers appears as a node where multiple edges converge on the graph, so it can be identified as the main account for money laundering by a criminal organization and designated as a target for intensive surveillance.

[0050] According to an additional embodiment, the risk analysis engine (320) can perform the function of 'Threat Actor Profiling and Behavior Pattern Analysis'. This may mean a function that measures the level of threat by analyzing activity patterns over time based on a specific 'Author ID', going beyond simply determining the risk level of individual posts. For example, it can analyze in a time series patterns such as a specific author posting normal posts at the beginning of their activity and gradually increasing the proportion of illegal advertisements, a pattern of posting advertisements with the same content simultaneously in multiple communities using multiple IDs, or a pattern of being active intensively during specific times (e.g., late night hours). Additionally, a unique profile of the author can be generated by combining subtle changes in the language used, types of slang frequently used, and sentence length. Based on the profile generated in this way, new authors whose past activity patterns match the high-risk profile, even if they have not yet written risky posts, can be classified as 'potential threat actors' and monitored preemptively.

[0052] In operation 207, according to various embodiments, if the quantified probability of financial accident exceeds a preset threshold, the event information, user information, and pattern information can be generated and stored as a risk alert data set. Specifically, if the risk score calculated by the risk analysis engine (320) exceeds a threshold set by the administrator (e.g., 80 points), the event may be classified as a risk alert. Subsequently, the system packages all information related to the event into a structured 'risk alert data set' and stores it in the data storage (400). This data set may include links to the collected original data, analyzed text and images, extracted key keywords, risk score, detection time, source information, etc. For example, referring to FIG. 4, if an image analysis engine (60) successfully recognizes the extracted data (70) (bank information (71), account number (72), account holder (73)) from an image (50) of an account transfer history uploaded by a financial fraudster, and if it is confirmed to be a valid account through an account status verification module (80), all of this information can be included in and stored in a risk alert data set.

[0053] According to one embodiment, the generated risk alert dataset may include specific financial account identification information (bank name, account number, account holder) directly extracted from images through a multimodal model such as GPT, going beyond simple text information. Here, a multimodal model may refer to an artificial intelligence model capable of simultaneously understanding and processing two or more different forms of data, such as text and images. Furthermore, by providing status information including whether the extracted account is a virtual account frequently used as a dummy account and whether it is an active account capable of current transactions, it can provide decisive information for security personnel to determine the urgency and importance of the threat.

[0054] According to one embodiment, the prediction function of a risk alert dataset can be implemented by applying an anomaly detection algorithm that first learns normal patterns of data, such as Isolation Forest or One-Class SVM, and detects outliers that deviate from those patterns. By comparing and analyzing data patterns of numerous financial accidents that occurred in the past with currently detected risk indicator patterns, this algorithm probabilistically predicts and provides the expected timing of future accidents, key actors likely to be involved in the crime (account holders, community IDs, etc.), and the expected scale of damage, thereby contributing to the establishment of preemptive defense strategies to minimize damage. As an additional embodiment, the function of predicting the probability of financial accident occurrence can be enhanced by utilizing a time-series forecasting model. For example, the detection frequency of keywords related to a specific type of financial fraud (e.g., smishing impersonating holiday gift delivery) can be constructed as time-series data, and future occurrence frequency can be predicted by applying an ARIMA (Autoregressive Integrated Moving Average) model or a recurrent neural network (RNN)-based LSTM (Long Short-Term Memory) model. By generating preventive alerts such as "threats related to smishing are expected to surge within the next 2 to 3 days," this can support financial institutions in establishing preemptive and extensive defense strategies, such as issuing public advisories in advance or increasing the deployment of relevant monitoring personnel.

[0056] In operation 209, according to various embodiments, a generated risk alert data set can be provided in real time to a financial institution's security monitoring system to enable proactive response. Specifically, the risk alert data set stored in the data repository (400) can be transmitted in real time to the financial institution system (20) via a RESTful API endpoint (e.g., POST / api / v1 / alerts) of the result providing unit (500). As an additional embodiment, the present invention may include an 'automated sanction request module'. This module can block the spread of the threat early by automatically sending a standardized form of email or API call requesting the deletion of the post or account suspension to the Abuse department of the online community or social media platform where the post was uploaded, when the risk level exceeds a specific threshold (e.g., 95 points) and the type of threat is determined to be obvious illegal gambling or phishing. For example, as shown in the full screen of the dashboard (90) of FIG. 5, a security officer can recognize a new high-risk alert in the alert list panel (91), and after comprehensively reviewing evidence (92a), analysis results (92b), and past history (92c) in the detailed information panel (92), establish an immediate response strategy.

[0057] According to one embodiment, a risk alert data set can be directly linked with an internal Fraud Detection System (FDS) and a real-time monitoring dashboard of a financial institution through a standardized Application Programming Interface (API). Through this linkage, complex analysis combining external OSINT information and internal transaction data of the financial institution becomes possible, and an automated response system can be established that goes beyond simple alert delivery to automatically update detection rules of the FDS or trigger immediate transaction blocking measures for specific accounts.

[0059] According to an additional embodiment, the result providing unit (500) may be linked with a 'Blockchain-based Evidence Preservation and Sharing System'. For legal response in the event of a financial accident, the integrity of threat information and prevention of tampering are very important. In the present invention, when a risk alert data set is generated, the hash value of the data can be recorded as a transaction on a blockchain network. Here, a hash is a value similar to a unique fingerprint of data, characterized by the fact that if the original data is changed even slightly, the hash value changes completely. Since information recorded on the blockchain in this way is virtually impossible to tamper with, it can be utilized as strong and reliable digital evidence regarding the fact that the threat information existed at a specific time. Furthermore, it can be utilized to establish a system in which multiple institutions safely share threat information and respond jointly through a private blockchain accessible only to authorized financial institutions or investigative agencies.

[0061] According to additional embodiments, the present invention can enhance risk analysis models by applying 'Federated Learning' technology. Due to issues regarding personal information protection and regulatory compliance, it is difficult for various financial institutions to directly share their internal transaction data or customer information externally. Federated Learning is a method in which models are trained individually on the local servers of each financial institution without sending such data to a central server, and then only the parameters (such as weights) of the trained models are sent to the central server for aggregation. Based on the aggregated parameters, the central server can create a global model with improved performance and redistribute it to each institution. In the present invention, internal Fraud Detection System (FDS) data held by each financial institution and external OSINT data detected by the present system are trained together in each institution's local environment. Through this, an analysis model with powerful performance—as if trained on much more extensive and diverse data—can be built without the transfer of sensitive information, thereby dramatically improving the detection accuracy of the entire system.

[0063] According to various embodiments, a method for collecting and analyzing data based on open source intelligence (OSINT) to prevent financial accidents may include: (a) a step of collecting source data from social media, news, the dark web, and public APIs based on keywords related to financial accidents; (b) a data preprocessing step including labeling metadata, author information, and time and location information of the collected source data; (c) a step of quantifying the probability of financial accidents by applying a natural language processing (NLP)-based risk analysis model to the labeled data; (d) a step of generating and storing event information, user information, and pattern information as a risk alert data set when the quantified probability of financial accidents is greater than or equal to a preset threshold; and (e) a step of providing the risk alert data set to a security monitoring system of a financial institution to enable a preemptive response.

[0064] According to various embodiments, the keywords of step (a) may include keywords, slang, and neologisms by accident type extracted from a past financial accident database, and may be characterized by dynamically updating new threat keywords proposed by a machine learning model.

[0065] According to various embodiments, the preprocessing of step (b) is performed through a real-time data streaming pipeline and may include stop word removal and noun extraction using a morphological analyzer, detection of slang and financial information using a named entity recognition (NER) model, removal of duplicate data, structuring of unstructured data, and de-identification of personal information.

[0066] According to various embodiments, the machine learning model may be characterized by using a multi-classification deep learning model trained for each type of financial accident.

[0067] According to various embodiments, the risk alert data set may be characterized by including an accident probability score, associated account information, geographical occurrence location information, and correlation analysis results with past similar events, as well as financial account-related identification information extracted from an image and status information of the account.

[0068] According to various embodiments, the above step (e) may be characterized by being linked with an abnormal transaction detection system (FDS) and a real-time monitoring dashboard within the financial institution.

[0069] According to various embodiments, the collected source data may include image data, and may be characterized by identifying illegal advertisements within the image through an object detection model or extracting financial information such as account transfer details through a model that recognizes text within the image.

[0070] According to various embodiments, the dark web data collection may be characterized by using an authentication proxy and a Tor network, and storing access logs in encryption.

[0071] According to various embodiments, the risk alert data set may be characterized by predicting the possible timing of financial accident occurrence, key actors, and expected scale of damage by applying an anomaly detection algorithm within the data and comparing it with past data patterns.

[0073] As used in this document, the terms “module” or “part” include a unit composed of hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit, for example. “Module” or “part” may be a component formed integrally or a minimum unit or part thereof that performs one or more functions. “Module” or “part” may be implemented mechanically or electronically and may include, for example, an application-specific integrated circuit (ASIC) chip, field-programmable gate arrays (FPGAs), or programmable logic device known or to be developed that performs certain operations, and may be executed by a processor (120). At least part of the device (e.g., modules or functions thereof) or method (e.g., operations) according to various embodiments may be implemented as instructions stored in a computer-readable storage medium (e.g., memory (130)) in the form of a program module. When the above instruction is executed by a processor (e.g., processor (120)), the processor may perform a function corresponding to the above instruction. Computer-readable recording media may include a hard disk, a floppy disk, a magnetic medium (e.g., magnetic tape), an optical recording medium (e.g., CD-ROM, DVD, magneto-optical medium (e.g., floptical disk), built-in memory, etc. Instructions may include code generated by a compiler or code that can be executed by an interpreter. A module or program module according to various embodiments may include at least one of the aforementioned components, some of which may be omitted, or additionally include other components. Operations performed by a module, program module, or other component according to various embodiments may be executed sequentially, in parallel, iteratively, or heuristically, or at least some operations may be executed in a different order, omitted, or other operations may be added.

[0074] Furthermore, the embodiments disclosed in this document are presented for the purpose of explaining and understanding the disclosed technical content and are not intended to limit the scope of this disclosure. Accordingly, the scope of this disclosure should be interpreted to include all modifications or various other embodiments based on the technical concept of this disclosure.

Claims

Claim 1 A method for collecting and analyzing data based on open source intelligence (OSINT) to prevent financial accidents, comprising: (a) a step of collecting source data from social media, news, the dark web, and public APIs based on keywords related to financial accidents by a data collection unit; (b) a data preprocessing step including metadata, author information, and time and location information labeling of the collected source data by a data preprocessing module; (c) a step of quantifying the probability of financial accidents by applying a natural language processing (NLP)-based risk analysis model to the labeled data by a risk analysis engine; (d) a step of generating and storing event information, user information, and pattern information as a risk alert data set by a data repository when the quantified probability of financial accidents is above a preset threshold; and (e) a step of providing the risk alert data set to a security monitoring system of a financial institution by a result providing unit to enable a preemptive response. Claim 2 A method for collecting and analyzing data based on open source information for the prevention of financial accidents, wherein, in claim 1, the keywords of step (a) include keywords, slang, and neologisms by accident type extracted from a past financial accident database, and dynamically update new threat keywords proposed by a machine learning model. Claim 3 A method for collecting and analyzing data based on open source information for preventing financial fraud, wherein the preprocessing of step (b) is performed through a real-time data streaming pipeline and includes stop word removal and noun extraction using a morphological analyzer, detection of slang and financial information through a named entity recognition (NER) model, removal of duplicate data, structuring of unstructured data, and anonymization of personal information. Claim 4 A method for collecting and analyzing data based on open source information for the prevention of financial accidents, wherein, in paragraph 2, the machine learning model utilizes a multi-classification deep learning model trained for each type of financial accident. Claim 5 A method for collecting and analyzing data based on open source information for preventing financial accidents, wherein, in claim 1, the risk alert data set comprises, along with an accident probability score, associated account information, geographical occurrence location information, and correlation analysis results with past similar events, identification information related to financial accounts extracted from images and status information of the said accounts. Claim 6 A method for collecting and analyzing data based on open source information for the prevention of financial accidents, wherein, in claim 1, the above step (e) is linked with an abnormal transaction detection system (FDS) and a real-time monitoring dashboard within the financial institution. Claim 7 A method for collecting and analyzing data based on open source information for preventing financial accidents, characterized in that, in claim 1, the collected source data includes image data, and the method identifies illegal advertisements within the image through an object detection model or extracts financial information such as account transfer details through a model that recognizes text within the image. Claim 8 A method for collecting and analyzing data based on open source information for preventing financial fraud, wherein, in claim 1, the collection of dark web data utilizes an authentication proxy and a Tor network, and the access logs are stored in an encrypted format. Claim 9 A method for collecting and analyzing data based on open source information for the prevention of financial accidents, wherein, in claim 1, the risk alert data set predicts the possible timing of financial accident occurrence, key actors, and expected scale of damage by applying an anomaly detection algorithm within the data and comparing it with past data patterns. Claim 10 An open source information-based data collection and analysis application stored on a computer-readable medium to execute any one of the methods of paragraphs 1 through 9.

Images