EP2603905A1

EP2603905A1 - Method and device for detecting and verifying attempts to manipulate a self-service terminal

Info

Publication number: EP2603905A1
Application number: EP11741562.0A
Authority: EP
Inventors: Steffen Priesterjahn; DinhKhoi LE; Alexander Drichel
Original assignee: Wincor Nixdorf International GmbH
Current assignee: Wincor Nixdorf International GmbH
Priority date: 2010-08-12
Filing date: 2011-08-05
Publication date: 2013-06-19
Anticipated expiration: 2031-08-05
Also published as: EP2603905B1; WO2012019968A1; DE102010036961A1

Abstract

The invention relates to a method (100) for detecting and verifying attempts to manipulate a self-service terminal which has at least one operating element (for example a keyboard) for users, onto which at least one camera is directed. The generated image data (IN) are supplied to a first classifier (CF) that checks, on the basis of the image data, whether a manipulation attempt on the operating element, for example keyboard, can be detected. Moreover, simultaneously with being supplied to the first classifier (CF), the image data (IN) are also supplied to a second classifier (SC) that checks, on the basis of the image data, whether the detection of a manipulation attempt is plausible. Only when both classifiers give a positive indication, that is confirm a manipulation attempt and the plausibility thereof, is an alarm triggered. It is thus possible to prevent false alarms, which occur with conventional self-service terminals when users or customers leave personal items (for example wallets) on the control panel.

Description

Method and device for detecting and verifying manipulation attempts on a self-service terminal

The invention relates to a method for detecting and verifying manipulation attempts on a self-service terminal according to the preamble of claim 1. Furthermore, the invention relates to a device operating according to the method, in particular a Datenverarbeitungsund control unit, and a self-service terminal equipped therewith, in particular designed as an ATM self-service terminal.

At self-service terminals, hereinafter also referred to as self-service terminals, especially at ATMs, criminal acts are often carried out in the form of manipulation, which pursue the goal, sensitive data, in particular PINs (Personal Identification Numbers) and / or card numbers of users of the SB Spy on the terminals. In particular, manipulation attempts are known in which so-called skimming devices, such as keyboard superstructures and the like, are installed illegally in the operating area or control panel. Such keyboard superstructures often have their own power supply, as well as a processor, a memory and an operating program, so that an unsuspecting user is spied on entering his PIN or inserting his bank card. The spied out data is then over transmit a transmitter integrated into the keyboard superstructure to a remote receiver or are stored in a data memory located in the keyboard superstructure. Many of today's skimming devices are very difficult to distinguish with the human eye from original controls (keyboard, card reader, etc.).

To thwart such attempts at manipulation, monitoring systems are often used which have one or more cameras which are mounted in the area of the location of the self-service terminal and detect the entire control panel and often also the area of residence of the user. Such a solution is described for example in DE 201 02 477 ül. By means of the local camera surveillance, both the control panel itself and the user's area in front of it can be detected. In order to distinguish whether a person is in the occupied area, a sensor is provided.

US 2009/0057395 A1 discloses a method and a device for detecting and verifying manipulation attempts at an ATM. There, various sensors are used (see text section [0063]), such as cameras or proximity sensors ("proximity sensor"), the signals or data to a microprocessor-controlled unit ("microprocessor 32") deliver. There, data processing is then performed on the basis of a statistical model having a classifier (see paragraphs [0081] - [0085]) to infer a normal operating condition or an abnormal operating condition of the ATM, the latter could show a manipulation attempt proposed to detect a manipulation attempt on the basis of a classifier, which is fed with data from different sensors. The reliability of this principle, however, requires the use of several different sensors and the effort to tune the classifier to the various sensors.

Thus, in principle, devices and methods for detecting tampering attempts on a self-service terminal are known, wherein a camera is based on at least one operating element, such as e.g. Keyboard, cash dispenser, etc., is aligned and wherein the image data generated by the camera are evaluated by means of a classifier to detect a tampering attempt. However, the known solutions require a high amount of hardware and software to achieve the safest and error-free manipulation detection.

Another, improved and inexpensive to implement method for detecting tampering attempts on a self-service terminal and a device operating thereafter are proposed in the earlier filed by the Applicant patent application with the application number DE 2010055016.

Due to the above, it is an object of the present invention to propose a reliable, yet cost-effective solution that overcomes the disadvantages of the known methods and devices. In particular, a camera-based detection of Manlpulationsversuchen with high reliability but low hardware cost and limited software effort to be made possible. The object is achieved by a method having the features of claim 1 and by a device operating thereafter and by a self-service terminal equipped therewith.

Accordingly, it is proposed that the image data generated by the camera be supplied to a first classifier, by means of which the image data is used to check whether a manipulation attempt is recognizable on the operating element, and that the image data are also fed to a second classifier in parallel with the first classifier, by means of which it is checked on the basis of the image data whether the detection of a manipulation attempt is plausible.

Thus, there is proposed a parallel structure of two or more classifiers applied to the same image data or data derived therefrom, wherein the first classifier is arranged to detect a manipulation attempt, but the second classifier is arranged to use the image data check the situation detected by the camera (s) for plausibility of a tampering event. Only when both classifiers indicate positive, i. If a tampering attempt and plausibility are affirmative, an alarm is triggered.

The invention is based on the recognition that the conventional devices not infrequently operate faulty and even then skimming show, if no attempt at

Manipulation of the self-service terminal is present. Applicant has observed that users on the control panel b2w. the control panel of self-service terminals, such as ATMs, personal belongings, especially purses, wallets, notes, etc., and this can then lead to a false skimming alarm.

According to the invention, by using a further classifier working in parallel, which checks for plausibility of the image data, it is ensured that an alarm is generated only when, based on the situation detected by the camera, a genuine manipulation attempt has to be reasonably assumed. For example, Although the first classifier may recognize an abnormal situation and want to display a manipulation attempt in the case of a purse left on the keyboard, the second classifier would be the purse, in particular its contour and / or position rather than untypical of a keyboard superstructure (manipulation or skimming -Over) and thus prevent the triggering of a false alarm.

Preferably, the image data in the classifiers are processed independently of each other. The classifiers thus come independently of each other's results, with the first result (output value of the first classifier) being verified by the second result (output value of the second classifier) or not. In this way, meaningful events that are not meaningful (manipulation attempts) can be reliably separated. According to the invention, a parallel-operating structure of two or more classifiers is proposed for this purpose.

It can be provided that the first classifier evaluates the image data on the basis of first features in order to obtain a first output value which determines the probability of the presence of a change in the visual appearance of the image Indicates control. These first features relate, for example, to the edge lengths of a keyboard whose photo is subjected to edge image detection.

The second classifier, on the other hand, evaluates the image data based on second features to obtain a second output value indicative of the likelihood of a manipulation-typical change in the visual appearance of the control. These second features relate for example to the relative position or position of the edges to each other. In a keyboard as well as in a skimming superstructure, most of the edges are aligned parallel or perpendicular to each other, with an object left lying, e.g. Purses, edges also occur that are neither parallel nor perpendicular to the other edges (the keyboard). Therefore, a plausibility test leads to the result that most likely no manipulation attempt is present. Also the feature "ambient lighting" leads to very reliable results.

The output values of the classifiers are preferably between 0 and 1. In order to obtain unambiguous yes / no statements, preferably the first output value is compared with a first threshold value or the second output value with a second threshold value, whereby a first or second binary value can be obtained, which in turn can be logically processed. The binary values can be supplied to an AND link, for example, in order to obtain a reliable statement as to whether manipulation has been carried out at the SB terminal or not. If a tampering attempt is detected, in addition to or as an alternative to triggering an alert, self-service terminal and / or trigger an additional camera (portrait camera) to take photos of suspicious persons who may have done the manipulation. It may also be provided to deactivate the tamper detection or the camera (s) during the maintenance of the self-service terminal to avoid false alarms.

These and other particularly advantageous embodiments will become apparent from the dependent claims.

Preferably, an alarm is triggered only if, by means of the first classifier, a manipulation attempt. the control element is detected and if the recognition of the manipulation attempt is assessed as plausible by means of the second classifier.

Otherwise, a display, in particular notification, for an operator and / or users of the self-service terminal is generated, and then if by means of the first classifier a manipulation attempt is detected on the control element and if by means of the second classifier, the detection of the manipulation attempt as not is valued plausibly. The notification is preferably sent to the operator and / or user of the self-service terminal via a communication service, in particular email or SMS.

Also proposed is a device for detecting and verifying manipulation attempts on a self-service terminal, which has at least one operating element for users, to which at least one camera is aligned, the device being connected to the at least one camera and generated by the camera Receiving image data, and wherein the device comprises a data processing unit with a first classifier, which checks on the image data, if a manipulation attempt is to be recognized on the operating element, wherein the data processing unit of the device has a second classifier, which processes the image data parallel to the first classifier and checks whether the detection of a manipulation attempt is plausible.

In addition, a self-service terminal is proposed that has such a device. The device may preferably be provided by means of a computer b2w present in the self-service terminal. PC be realized.

In a preferred application, the self-service terminal is designed as an ATM. In this case, the at least one operating element is a manipulation-suitable element, in particular a keyboard or a PIN pad, a cash dispenser and / or a card input funnel. To facilitate the manipulation detection, the at least one control element detected by the camera should have optically clearly recognizable features, in particular have edges delimiting homogeneous surfaces. As a result, the image data generated by the camera (s) can be processed by means of edge detection, for example by creating at least one edge image and comparing its characteristic data with the pattern data of a reference edge image. The use of an edge detection not only causes a significant data reduction, but also increases the speed and reliability of the image analysis. The use of several parallel classifiers in particular increases the reliability of the final result. In particular, the detection of superstructures on individual or several operating elements can be significantly improved by the invention. This is especially true with regard to the reliability of the generation of skimming alarms. Preferably, the camera detects the elements that are particularly suitable for manipulation and / or the elements arranged in particularly manipulation-suitable areas of the control panel, such as cash dispenser, keyboard, card slot and / or screen. The elements are therefore preferably control elements in the strict sense, but may also be other elements, such as shelf space in the control area or the like. In addition, the lying of objects is reliably detected. In addition, it is proposed here to notify the user and / or the operator of the self-service terminal when based on the image capture on the control (eg keyboard) a foreign object has been detected, which does not have the typical properties of a manipulation device (keyboard superstructure, dummy, etc.) and thus most likely an item that the last user of the self-service terminal left there. Accordingly, an automatic notification service can be realized, which in particular indicates to users or customers that personal items have been left at the self-service terminal.

The invention and the advantages arising therefrom are described below by means of exemplary embodiments and with reference to the attached schematic drawings, which show the following: Flg. 1 shows in the form of a block diagram the construction of a self-service terminal according to the invention, referred to as

ATM is configured;

Fig. 2 shows a schematic flow diagram for a

inventive method;

3 is a decision matrix for illustrating the

Result generation from the output values of the parallel classifiers.

The ATM terminal illustrated in FIG. 1 is embodied as an ATM ATM and has a control panel with a plurality of elements or operating elements, of which a keyboard KBD, a cash dispensing shaft SHT and a card input hopper CSL are shown by way of example in the form of individual functional blocks. Each control element is monitored by a camera CAM, CAM 'or CAM ", which in turn is connected to a control device CTR, which processes and evaluates the image signals or data generated by the camera.

The control device CTR forms a device for detecting and verifying manipulation attempts on the said operating elements KBD, SHT or CSL and is realized by means of a computer-aided hardware, here for example by means of the hardware of a PC integrated in the ATM. The image data coming from the cameras (see also IN in Fig. 2) are processed in an image processing unit IPRC, for example by being subjected to edge detection. As a result, the amount of data can be significantly reduced without significant information about the properties of the lose the photographed object or operating element. The edge images or edge image data obtained from the edge detection thus represent essential properties on the basis of which a change or manipulation of the object (eg keyboard KDB) can be detected.

For the reliable detection of manipulation attempts, the device CTR has for each picture element a manipulation recognition module M100, M100 'or M100 ", which essentially contains a data processing instance which performs a parallel structured two-fold classification of the corresponding image data - Detection module M100, M100 'or Μ100 "two parallel classifiers are used (see 110 and 120 in Fig. 2). For monitoring the keyboard KBD, for example, the first manipulation detection module M100 is used, the function of which will be described in more detail below with reference to FIGS. 2 and 3. The device CTR also includes an alarm unit ALRT, which triggers an alarm when a tampering attempt is reliably detected. If the presence of a foreign object is detected, but a manipulation attempt is classified as not plausible, via the unit ALRT a notification to the operator of the ATM ATM and / or the last user to inform him that an item was left at the ATM , In order to notify the user, user data can be used which can be queried by a central office (user administration) in the context of the already required usage authentication at the ATM (user ID). An example of a method for detecting and verifying manipulation attempts will now be described with reference to FIGS. 2 and 3. FIG.

FIG. 2 shows a schematic sequence diagram for the method 100, which relates to the mode of operation of the manipulation detection module M100 and essentially comprises the steps 101 to 130 described below.

In a first step 101, the data generated by the camera CAM and preprocessed in the image processing unit IPRC (see Fig. 1) to edge image data are provided as input data IN for the subsequent classifications. Features or properties A, B, C, D are extracted from the input data or processed image data, also referred to below as image data IN, which represent characteristic recognition features for the monitored object (here: control element KDB). These include, for example, the following features: edge length (top, bottom, left, right), distance of the edges of reference points or reference lines, angles of edges to each other, angles of edges compared to reference lines, histogram, lighting conditions, and the like.

These features, of which four features A, B, C and D are exemplified herein, are then classified in a parallel structure in two different ways. For this purpose, a first subset of the features (eg features A and B) is supplied to a first classifier CF in a step 110 and one, preferably another, second subset (eg features C and D) is fed in a parallel step 120 to a second classifier SC. The first classifier CF takes the function of a. Main classifier or a tamper evidence collector, which checks whether tampering is likely or not. This is done, for example, by checking the features A (edge lengths at different positions) and B (distances between different edges) by comparing them with corresponding reference values. The output value OUT1 is the number or frequency with which characteristics (one or more of them) do not match the reference values. The output value is between 0 and 1. An output value of 0.7 and more indicates that (very) many deviations have been detected, so that (very) probably there is a manipulation of the object (in this case keyboard KBD or PIN pad). Whether the detected manipulation is a real manipulation, eg a keyboard superstructure, can not be predicted with certainty.

The second (parallel) classifier SC therefore assumes the function of a subclassifier or a verifier and checks whether the image data IN reproduces a typical situation for a manipulation at all. This check is done, for example, by checking the characteristics C (angle of edges among each other) and D {ambient light conditions). The output value OUT2 is the number or frequency with which the detected characteristics (one or more of them) do not deviate from the typical reference values. An output value of 0.3 and less indicates that the plausibility of a manipulation is low. This means that (very) a few typical angles and / or ambient lighting conditions are detected so that it is (very) likely that there is a foreign object in the area of the monitored object (here keyboard KBD), but this can not correspond to a manipulation object (eg keyboard superstructure). Therefore, for example, an output value OUT2 of 0.3 would result, indicating that (rather) there is no manipulation.

In order to arrive at a meaningful, unambiguous final result, in further parallel steps 111 and 112 the output values OUT1 and OÜT2 are weighted and / or compared with threshold values TH1 and TH2, respectively, so that logically connectable values OUT1 * and OUT2 *, respectively, result show either a YES or a NO. If the value OUT1 * corresponds to the logical value "1", this means that the classification CF has detected tampering, which is symbolized here by a "Y" (for English "Yes"), otherwise an "N" results. If the value OUT2 * also corresponds to a "Y", this means that the manipulation is plausible. The thresholds TH1 and TH2 are set in the middle value range, e.g. is set at about 0.5, so that output values greater than 0.5 mean a clear "Y * (statement" Yes "or" Yes ").

By a logical AND operation carried out in step 130, which is also illustrated by means of FIG. 3, the final result is obtained. As the decision matrix shown in FIG. 3 shows, a manipulation attempt is only clearly recognized and verified if both classifiers each yield a positive result "Y", ie if the first classifier recognizes CF for manipulation and the second independently recognizes a plausible manipulation situation. The second classifier SC ensures a reasonable decision and could therefore also be called a "sanity checker." The strict separation of the two classifiers or their tasks (detection of changes or checking for plausibility) makes the manipulation detection proposed here very robust against wrong decisions ,

As described above, for example, the camera signals (raw image data) are first subjected to image processing (edge detection) (see block IPRC in Fig. 1). From this, features are extracted (A to D in Fig. 2), e.g. the edge lengths, distances, angles, ambient lighting conditions, etc. concern. These features are then classified. In the first classifier CF, e.g. classifies the features "edge length" and "angle" to detect tampering; in the second classifier CF, the other characteristics "angle" and / or "ambient light" are classified in order to check the plausibility (sanity check). The invention can also be carried out in such a way that quantities are classified, for example with the first classifier, and qualities with the second classifier.

In addition, the plausibility check makes it possible to deduce the presence of a foreign object, which is not a skimming device, but merely a personal object of a user in the event of a detected change to the monitored object. In the decision matrix of Fig. 3, this corresponds to the case that OUT1 * »Y and 0UT2 * = N. In this case, the system can initiate an automatic notification of the user or customer, for example via email or SMS. These Possibility offers a new customer service. The operator of the self-service terminal will in this case also be notified immediately in order to keep the forgotten item for the customer for later collection. So if objects are left on the SS terminal, an automatic

Generating and sending out email / SMS by accessing customer database. In addition, e.g. a silent alarm to the personnel of the self-service terminal for the purpose of securing the forgotten object. Also photos / movies can be created as well as warnings on the

Screen to thwart a theft.

The present invention has been described using the example of an ATM, but is not limited thereto, but can be applied to any type of self-service terminals.

Remuneration LIST

100 procedures with the following steps:

101 Input of image data IN

as well as specification of characteristics (A ... D)

110 Data processing by means of first classifier CF 120 (parallel to it) Data processing by means of

second classifier CF

111 Threshold decision for OUT1

112 Threshold decision for OUT2

130 Alerting and / or notification

ATM self-service terminal, designed as an ATM, with the following controls:

KBD Keyboard, SHT Cash Dispenser,

CSL card entry funnel

CAM, CAM ', CAM "cameras, each aligned to a control

CTR device, here control device for ATM with:

IPRC image processing unit

M100, M100 ', M100 "Manipulation detection modules with different classification

ALRT alarm / notification unit

Claims

Claims 1. A method (100) for recognizing and verifying

Manipulation attempts on one

Self-service terminal (ATM), which is at least one for users of the self-service terminal (ATM)

provided control element (KBD), is aligned with the at least one camera (CAM), wherein the image data (IN) generated by the camera (CAM) are fed to a first classifier (CF), by means of which the image data is used to check whether a

Manipulation attempt on the control element (KDB) can be seen,

characterized in that

the image data (IN) are also supplied to a second classifier (SC) parallel to the first classifier (CF), by means of which it is checked on the basis of the image data whether the detection of a manipulation attempt is plausible. 2. Method (100) according to claim 1, characterized

characterized in that the image data (IN) in the

Classifiers (CF, SC) are processed in parallel and independently of each other. 3. The method (100) according to claim 1 or 2, characterized

characterized in that the first classifier (CF) evaluates the image data (IN) on the basis of first features (A, B) in order to obtain a first output value (OUT1) which determines the probability of a change in the visual appearance of the operating element (KDB). indicates.

4. Method (100) according to claim 1, 2 or 3, characterized in that the second © classifier (SC) determines the image data (IN) on the basis of second features (C, D)

to obtain a second output value (0UT2) indicative of the likelihood of a manipulation typical change in the visual appearance of the control element (KDB). 5. Method (100) according to one of claims 3 or 4,

characterized in that the first output value (OUT1) is compared with a first threshold value (TH1) or the second output value (OUT2) with a second threshold value (TH2) in order to obtain a first or second binary value. 6. Method (100) according to one of the preceding

Claims, characterized in that the first and / or second classifier (CF, SC)

supplied image data (IN) an edge detection

is applied. 7. Method (100) according to one of the preceding

Claims, characterized in that an alarm is triggered when by means of the first classifier (CF) a manipulation attempt on the operating element (KDB) is detected and if by means of the second

Classifier (SC) recognizing the

Manipulation attempt is considered plausible. 8. Method (100) according to one of the preceding

Claims, characterized in that an advertisement, in particular notification, for an operator and / or users of the self-service terminal is generated if by means of the first classifier (CF) a manipulation attempt on the operating element (KDB) is detected and if by means of the second classifier (SC) the recognition of the manipulation attempt is assessed as not plausible. Method (100) according to claim 8, characterized

characterized in that the notification for the

Operator and / or users of the self-service terminal via a communication service, especially email or SMS, is sent. Device (CTR) for detecting and verifying manipulation attempts on a

provided control element (KBD), on which at least one camera (CAM) is aligned, wherein the device (CTR) is connected to the at least one camera (CAM) and receives from the camera (CAM) generated image data (IN), and wherein the device (CTR) has a data processing unit with a first classifier (CF), which checks on the basis of the image data (IN) whether a manipulation attempt on the

Control element (KDB) can be recognized,

characterized in that

the data processing unit of the device (CTR) has a second classifier (SC) which processes the image data (IN) in parallel to the first classifier (CF) and checks whether the recognition of a

Manipulation attempt is plausible.

11. Self-service terminal (ATM) providing at least one self-service terminal (ATM) for users

provided control element (KBD), on which at least one camera (CAM) is aligned, and which comprises a device (CTR) for detecting and verifying manipulation attempts on the self-service terminal (ATM), wherein the device (CTR) with the at least one camera (CAM) and receives image data (IN) generated by the camera (CAM), and wherein the device (CTR) has a

Data processing unit with a first

Classifier (CF), which checks based on the image data (IN), whether a manipulation attempt on the

Control element (KDB) can be recognized,

characterized in that

Manipulation attempt is plausible. 12. Self-service terminal (ATM) according to claim 11,

characterized in that the

Self-service terminal represents an ATM (ATM). 13. Self-service terminal (ATM) according to claim 11 or 12, characterized in that the at least one operating element is a manipulation-suitable element, in particular a keyboard (KBD), a cash dispenser (SHT) and / or a card input funnel (CSL).

14. Self-service terminal (ATM) according to one of claims 11 to 13, characterized in that the at least one of the camera (CAM) detected operating element (KBD) has optically clearly recognizable features, in particular has boundaries delimiting homogeneous surfaces.