Monitoring and predicting physical force attacks on transaction terminals
Factors associated with past brute force attacks on terminals within a given area are derived. The factors include a total number of the past brute force attacks, a severity, a time of day, a calendar date, a day of week, and weather experienced in the given area for each past brute force attack. Visual features are extracted from past video captured of the past brute force attacks. The visual features are associated with individuals, vehicles, orientations of vehicles relative to corresponding terminals, and objects held by or in proximity to the individuals. A machine learning model is trained to predict in real time a future brute force attack when provided the factors and the visual features as input. Current factors and visual features are provided as input for a given terminal, and a real-time alert is sent when a confidence value returned by the model indicates an in-progress attack.
1 . A method, comprising:
deriving factors associated with past brute force attacks on terminals within a given area over a given period of time, wherein the factors comprise a total number of the past brute force attacks, a severity of each past brute force attack, a time of day of each past brute force attack, a calendar date for each past brute force attack, a day of week for each past brute force attack, and weather experienced in the given area for each past brute force attack;
extracting visual features from past video captured of the past brute force attacks, wherein the visual features are associated with individuals of the past brute force attacks, vehicles of the past brute force attacks, orientations of the vehicles relative to corresponding terminals of the past brute force attacks, and objects held by or in proximity to the individuals during the past brute force attacks;
training a machine learning model (model) to predict in real time a future brute force attack when provided the factors and the visual features as input;
providing current factors and current visual factors as input for a given terminal located within the given area; and
sending a real-time alert when a confidence value returned by the model as output indicates an in-progress brute force attack at the given terminal.
2 . The method of claim 1 , wherein deriving further includes obtaining past incident records for the terminals within the given area.
3 . The method of claim 2 , wherein deriving further includes obtaining the past video based on past incident reports.
4 . The method of claim 1 , wherein deriving further includes identifying the visual features as features associated with individuals and vehicles involved in the past brute force attacks.
5 . The method of claim 1 , wherein sending further includes adjusting the confidence value based on additional information obtained from at least one external system.
6 . The method of claim 1 , wherein sending further includes processing a workflow of actions based on a comparison of the confidence value to a threshold or a range of thresholds.
7 . A system, comprising:
a processor;
a memory coupled to the processor; and
the processor configured to perform operations comprising:
deriving factors associated with past brute force attacks on terminals within a given area over a given period of time, wherein the factors comprise a total number of the past brute force attacks, a severity of each past brute force attack, a time of day of each past brute force attack, a calendar date for each past brute force attack, a day of week for each past brute force attack, and weather experienced in the given area for each past brute force attack;
extracting visual features from past video captured of the past brute force attacks, wherein the visual features are associated with individuals of the past brute force attacks, vehicles of the past brute force attacks, orientations of the vehicles relative to corresponding terminals of the past brute force attacks, and objects held by or in proximity to the individuals during the past brute force attacks;
training a machine learning model (model) to predict in real time a future brute force attack when provided the factors and the visual features as input;
providing current factors and current visual features as input for a given terminal located within the given area; and
sending a real-time alert when a confidence value returned by the model as output indicates an in-progress brute force attack at the given terminal.
8 . The system of claim 7 , wherein the terminals are one or more of automated teller machines, self-service terminals, or point-of-sale terminals.
9 . The system of claim 7 , wherein deriving further includes obtaining past incident records for the terminals within the given area from an external crime reporting system and obtaining a severity level associated with each past brute force attack.
10 . The system of claim 7 , wherein deriving further includes identifying the visual features as a size of a vehicle, a color of the vehicle, a make of the vehicle, a model of the vehicle, a position and direction of the vehicle relative to the given terminal, and a calculated distance between the vehicle and the given terminal.
11 . The system of claim 7 , wherein sending further includes modifying the confidence value based on information obtained from a vehicle registration system and a crime reporting system for a vehicle and any individuals detected at the given terminal.
12 . The system of claim 7 , wherein sending further includes assembling and logging a packet of information comprising a video clip, the factors, the confidence value, and audio captured from a microphone at the given terminal.
13 . A method, comprising:
obtaining factors associated with past physical attacks on terminals within a given area over a given period of time, wherein the factors comprise a total number of the past physical attacks, a severity of each past physical attack, a time of day of each past physical attack, a calendar date for each past physical attack, a day of week for each past physical attack, and weather experienced in the given area for each past physical attack;
extracting visual features from video captured of the past physical attacks, wherein the visual features are associated with individuals of the past physical attacks, vehicles of the past physical attacks, orientations of the vehicles relative to corresponding terminals of the past physical attacks, and objects held by or in proximity to the individuals during the past physical attacks;
training a machine learning model to predict a future physical attack when provided the factors and the visual features as input;
extracting current visual features from current video for a given terminal located within the given area; and
sending a real-time alert when a confidence value returned by the machine learning model indicates a potential physical attack at the given terminal.
14 . The method of claim 13 , wherein obtaining further includes acquiring the factors as a total number of the past physical attacks and severity levels assigned to each past physical attack from an external crime reporting system.
15 . The method of claim 13 , wherein extracting the visual features further includes identifying a vehicle in the video captured of the past physical attacks and identifying identifying vehicle attributes comprising vehicle size, vehicle color, vehicle make, vehicle model, and vehicle position relative to corresponding terminals involved in the past physical attacks.
16 . The method of claim 13 , wherein extracting further includes identifying individual attributes comprising height, complexion, clothing, and any objects being held or in proximity to individuals involved in the past physical attacks.
17 . The method of claim 13 , wherein training further includes generating training records comprising the factors and the visual features as input and labeling training records with expected outputs indicating that corresponding past physical attacks occurred.
18 . The method of claim 13 , wherein extracting the current visual features further includes identifying a current vehicle and at least one current individual in the current video and capturing current visual features comprising current vehicle attributes and current individual attributes from the current video.
19 . The method of claim 13 , wherein sending further includes assembling a packet of information comprising video clips, the visual features, the factors, and the confidence value.
20 . The method of claim 13 , wherein sending further includes activating dye packs within media cassettes of the given terminal when the confidence value exceeds a threshold value.