Method and device for recognizing attacks on a self-service machine
View Patent ↗The invention relates to a method for recognizing attacks on at least one interface of a computer system, particularly a self-service machine, comprising: monitoring the interface in order to detect changes to the interface; if changes occur, the probability of an impermissible attack on the interface is determined based on the nature of the change; if the probability is above a defined threshold value, defensive measures are taken.
1. A method for recognizing attacks on a self-service machine that has a series of components, comprising the steps:
Identifying all sources of information in the self-service machine and weighting the sources of information with a two-dimensional input variable that includes a variable degree of confidence value corresponding to a degree of confidence that a statement from the corresponding source is accurate and a plausibility of an event value selected from a range of probabilities with a lower bound and an upper bound;
Modeling the self-service machine with a system of rules that includes states and events of the components, based on the identified sources of information and the weighting;
Monitoring the states and events of the components by a monitoring unit;
Applying the system of rules stored on a memory system to the states and events through a processing unit that loads the system of rules from the memory system and receives the information from the monitoring unit;
Checking whether the system of rules has determined an attack through the processing unit by applying the system of rules and the states and events to each other in order to report said attack to a message system.
2. The method from claim 1 , wherein the system of rules is context modeling that maps elementary patterns and events up to and including more complex patterns.
3. The method from claim 1 , wherein input values, which are preferably shown as Boolean values, are events or information about a system state.
4. The method from claim 1 , wherein, on the basis of the events and system states and their dependencies, patterns are created that are the foundation for the pattern recognition of an anomaly recognition system.
5. The method from claim 1 , wherein the events and system states are weighted so that the plausibility of the sources identified is described.
6. The method from claim 1 , wherein the Dempster-Shafer method is used.
7. The method from claim 1 , wherein forward-linked systems, such as JRules, Jess and/or Drools, are employed as possible anomaly recognition systems.
8. The method from claim 1 wherein a fact adapter is employed that represents a uniform interface of the anomaly recognition system to the components by interposing an abstraction layer between the anomaly recognition system and a device driver layer of the components.
9. The method from claim 8 , wherein the fact adapter receives system component sensor signals from the device driver layer and provides said signals as facts, patterns for the rules system/anomaly recognition system.
10. The method from claim 8 , wherein the fact adapter is implemented through selected device drivers and image recognition mechanisms.
11. The method from claim 1 , wherein image recognition, or image processing, systems and an integration of AI (artificial intelligence) components work together, which are able to identify and classify recognized cases from consolidated sensor signals after a learning period.
12. The method from claim 1 , wherein one or more of the following devices provide information as states and events: PIN pad, card reader, cash dispensing drawer, monitor/display with soft key, touch screen, protective barrier against speech recognition, anti-skimming module, clock, proximity sensor, temperature sensor, administrative components that monitor and administer network interfaces, USB, serial interfaces.
13. A device for recognizing attacks on a self-service machine that consists of a series of components, comprising:
a monitoring unit that is configured to monitor states and events of the components,
processing unit that receives states and events transmitted by the monitoring unit and that loads a system of rules stored on a memory system in order to check the states and events by applying the system of rules and in order to determine whether the system of rules has identified an attack in order to issue said attack as a message, the system of rules being based on identified sources of information in the self-service machine and a weighting of the identified sources of information, the weighting being a two-dimensional input variable that includes a variable degree of confidence value corresponding to a degree of confidence that a statement from the corresponding source is accurate and a plausibility of an event value selected from a range of probabilities with a lower bound and an upper bound.
14. The device from claim 13 for the device, wherein the memory system stores the system of rules as correlations modeling that maps elementary patterns and events up to and including more complex patterns.
15. The device from claim 13 for the device, wherein input values are events or information about a system state that are preferably shown as Boolean values.
16. The device from claim 13 for the device, wherein an anomaly recognition system detects a pattern on the basis of the events and system states and their dependencies.
17. The device from claim 13 for the device, wherein the anomaly recognition system weights the events and system states so that the plausibility of the identified sources is described.
18. The device from claim 13 for the device, wherein the anomaly recognition system uses the Dempster-Shafer method.
19. The device from claim 13 for the device, wherein the anomaly recognition system employs forward-linked systems such as JRules, Jess, and/or Drools.
20. The device from claim 13 wherein a fact adapter is employed that provides a uniform interface of the anomaly recognition system to the components by interposing an abstraction layer between the anomaly recognition system and a device driver layer of the components.
21. The device from claim 20 for the device, wherein the fact adapter is configured such that it receives system component sensor signals from the device driver layer and provides said signals as facts and patterns for the rules system/anomaly recognition system.
22. The device from claim 20 for the device, wherein the fact adapter is implemented through selected device drivers and image recognition mechanisms.
23. The device from claim 13 for the device, wherein image recognition, or image processing, systems and an integration of AI (artificial intelligence) components work together in such a manner that, after a learning phase, they are capable of identifying and classifying recognized incidents from consolidated sensor signals.
24. The device from claim 13 for the device, wherein one or more of the following devices provide information as states and events: PIN pad, card reader, cash dispensing drawer, monitor/display with soft key, touch screen, protective barrier against speech recognition, anti-skimming module, clock, proximity sensor, temperature sensor, administrative components that monitor and administer the self-service machine over a network, network interfaces, USB, serial interfaces.
25. A method for recognizing attacks on a self-service machine that has a series of components, comprising the steps:
Identifying all sources of information in the self-service machine and weighting the sources of information with a two-dimensional input variable that includes a variable degree of confidence value corresponding to a degree of confidence that a statement from the corresponding source is accurate and a plausibility of an event value selected from a range of probabilities with a lower bound and an upper bound;
modeling the self-service machine with a system of rules that includes states and events of the components, based on the identified sources of information and the weighting;
monitoring the states and events of the components by a monitoring unit;
applying the system of rules stored on a memory system to the states and events through a processing unit that loads the system of rules from the memory system and receives the information from the monitoring unit; and
checking whether the system of rules has determined an attack through the processing unit by applying the system of rules and the states and events to each other in order to report said attack to a message system;
wherein the system of rules is context modeling that maps elementary patterns and events up to and including more complex patterns;
wherein, on the basis of the events and system states and their dependencies, patterns are created that are the foundation for the pattern recognition of an anomaly recognition system; and
wherein a fact adapter is employed that represents a uniform interface of the anomaly recognition system to the components by interposing an abstraction layer superimposed on an operating system of the self-service machine, between the anomaly recognition system and a device driver layer of the components to allow the operating system to communicate with a plurality of applications from multiple vendors, the fact adapter being configured to receive sensor signals from the components of the device driver layer and to prepare the sensor signals as facts and patterns for the system of rules.
26. A device for recognizing attacks on a self-service machine that consists of a series of components, comprising:
a monitoring unit that is configured to monitor states and events of the components,
processing unit that receives states and events transmitted by the monitoring unit and that loads a system of rules stored on a memory system in order to check the states and events by applying the system of rules and in order to determine whether the system of rules has identified an attack in order to issue said attack as a message, the system of rules being based on identified sources of information in the self-service machine and a weighting of the identified sources of information, the weighting being a two-dimensional input variable that includes a variable degree of confidence value corresponding to a degree of confidence that a statement from the corresponding source is accurate and a plausibility of an event value selected from a range of probabilities with a lower bound and an upper bound;
wherein the memory system stores the system of rules as correlations modeling that maps elementary patterns and events up to and including more complex patterns,
the correlations modeling being based on identified sources of information in the self-service machine and a weighting of the identified sources of information;
wherein an anomaly recognition system detects a pattern on the basis of the events and system states and their dependencies;
wherein a fact adapter is employed that provides a uniform interface of the anomaly recognition system to the components by interposing an abstraction layer superimposed on an operating system of the self-service machine, between the anomaly recognition system and a device driver layer of the components to allow the operating system to communicate with a plurality of applications from multiple vendors, the fact adapter being configured to receive sensor signals from the components of the device driver layer and to prepare the sensor signals as facts and patterns for the system of rules.