JP6860156B1 - Fraud detection systems, fraud detection methods, and programs - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a fraud detection system, a fraud detection method and a program for more accurately detecting whether or not unauthorized access is performed by flexibly setting parameters used for detecting unauthorized access according to a terminal device or an application to be used. I will provide a. In a fraud detection system that detects unauthorized access to a predetermined website by a third party who is not permitted to access the predetermined website, the identification server device 100 is a user's device via a network. Acquiring unit 102 for acquiring device information related to the device, and parameter specifying unit 106 for specifying the first parameter related to the browser type based on the browser information about the browser included in the device information used by the user using the device. , An identification unit 108 that identifies the device based on the first parameter. [Selection diagram] Fig. 2

Description

The present invention relates to fraud detection systems, fraud detection methods, and programs.

Conventionally, a user accesses a website that provides various services on the Internet by using an ID and a password. However, there is a problem that a third party uses an unauthorized means to use another person's ID and password to gain unauthorized access. To deal with such a problem, Patent Document 1 describes that unauthorized access is detected based on the information of the user's operation.

JP-A-2018-63728

The system described in Patent Document 1 records the actions of a user who accesses a website and constructs a white list database. Here, the "user operation" includes a page transition, a browser used by the user, an IP address, a terminal type, an OS, and the like. That is, the system creates a database of "user-likeness" by recording user actions. The system described in Patent Document 1 may deny access to a website by a user who accesses the website when it is determined by referring to the database that the access is not permitted. it can.

In the system described in Patent Document 1, access is permitted to the website based on specific parameters that can be obtained from an arbitrary terminal device, such as information on the user's operation and information on the type of browser used by the user. It is detecting whether or not the user is a user. Originally, the types of parameters that can be acquired differ depending on the terminal device and application software (hereinafter also referred to as "applications"), and the probability of identifying the user's legitimacy also differs for each parameter. In the system described in Document 1, unauthorized access is determined based on uniform parameters that can be acquired regardless of the difference between the terminal device and the application to be used.

Therefore, in view of the above problems, the present invention flexibly sets the parameters used for detecting unauthorized access according to the terminal device and the application to be used, thereby detecting whether or not the unauthorized access is performed more accurately. The purpose is to do.

The fraud detection system according to one aspect of the present invention is a fraud detection system that detects unauthorized access to the predetermined website by a third party who is not permitted to access the predetermined website, and is a fraud detection system via a network. The first parameter related to the browser type is set based on the acquisition unit for acquiring the device information about the user's device and the browser information about the browser included in the device information used by the user using the device. A parameter specifying unit for specifying and an identifying unit for identifying the device based on the first parameter are provided.

The fraud detection method according to one aspect of the present invention includes a computer acquiring device information about a user's device via a network and the device information used by the user using the device. The first parameter according to the type of browser is specified based on the browser information about the browser, and the device is identified based on the first parameter.

The program according to one aspect of the present invention relates to a computer to acquire device information about a user's device via a network, and a browser included in the device information used by the user using the device. The first parameter according to the type of browser is specified based on the browser information, and the device is identified based on the first parameter.

According to the present invention, by flexibly setting the parameters used for detecting unauthorized access according to the terminal device and the application to be used, it is possible to more accurately detect whether or not the unauthorized access is performed.

It is a figure which shows the structure of the fraud detection system. It is a figure which shows the structure of the identification server apparatus. A configuration example of the combination information table is shown. A configuration example of the terminal device identification table is shown. It is a figure which shows the structure of the enterprise server apparatus. It is a figure which showed the processing procedure of a fraud detection system. It is a figure which shows an example of a device system parameter. It is a figure which shows an example of an operation system parameter. It is a figure which shows an example of the hardware configuration of a computer.

Hereinafter, the fraud detection system 10 according to the embodiment of the present invention will be described in detail with reference to the drawings. However, the embodiments described below are merely examples, and there is no intention of excluding the application of various modifications and techniques not specified below. That is, the present invention can be implemented in various ways without departing from the spirit of the present invention, or by combining the examples. Further, in the description of the following drawings, the same or similar parts are represented by the same or similar reference numerals.
=== Configuration of fraud detection system 10 ===

The configuration of the fraud detection system 10 will be described with reference to FIG. FIG. 1 is a diagram showing a configuration of a fraud detection system 10.

As shown in FIG. 1, the fraud detection system 10 includes, for example, an identification server device 100 and a business operator server device 200. The identification server device 100 is a device that identifies the terminal device 300 of the user who accesses the operator server device 200 via the network 400. The business operator server device 200 is a business operator server device that provides a predetermined website. The business server device may have, for example, a function of transmitting various information of the terminal device 300 to be accessed from the terminal device 300 to the identification server device 100. The fraud detection system 10 may be composed of, for example, only the identification server device 100.

The identification server device 100 acquires device information about the terminal device 300 that logs in to the website of the business server device 200 from the business server device 200 or the user's terminal device 300. The identification server device 100 identifies whether or not the terminal device 300 is a terminal device that is permitted to access the website based on the acquired device information.

Here, the "device information" includes, for example, device type information related to the device type of the terminal device 300, browser information related to the browser of the terminal device 300, device system parameters (first parameter) related to the browser type, and in the website. It includes an operation system parameter (second parameter) related to the operation of the terminal device 300 by the user.

Further, "identifying the terminal device 300" includes uniquely identifying the terminal device 300 and specifying the terminal device 300 in a state close to unique. The "specification in a state close to unique" may include, for example, calculating the probability of the terminal device 300 being permitted to access and determining that the probability is equal to or higher than a predetermined value.

That is, whether or not the identification server device 100 is a legitimate terminal device capable of logging in to a website by appropriately combining different device system parameters and operation system parameters for each terminal device and accessing the business server device 200. Can be determined.

In other words, the identification server device 100 can analyze the characteristics of the terminal device and the behavior of the user with respect to the terminal device, and detect spoofing to another person or unauthorized login by the robot in real time.
<< Identification Server Device 100 >>

FIG. 2 is a diagram showing the configuration of the identification server device 100. The configuration of the identification server device 100 will be described with reference to FIG.

As shown in FIG. 2, the identification server device 100 includes, for example, a storage unit 101, an acquisition unit 102, a transmission unit 103, a type identification unit 104, a browser identification unit 105, a parameter identification unit 106, an identification code generation unit 107, and an identification unit. 108, including the examination judgment unit 109.

The storage unit 101 includes, for example, a combination information table 101a and a terminal device identification table 101b.

FIG. 3 shows a configuration example of the combination information table 101a. As shown in FIG. 3, the combination information table 101a associates the device system parameters that can be acquired from the browser information with each of the browser types. The combination information table 101a includes, for example, variables, items such as the first browser to the nth browser. The variables indicate, for example, the characteristics of the device system parameters. The first browser to the nth browser indicate, for example, the type of browser used in the terminal device 300 when the user accesses the website. Here, the type of browser is, for example, a difference in browsing software for browsing a website. Specifically, it refers to the type of browser such as "Internet Explorer" or "Chrome". Note that the browser types may be different for each of the plurality of different versions of the browser. In addition, information related to various settings in the browsing software, such as information indicating the language setting of the browser, is not included in the browser type. "○" shown in the items in the first browser to the nth browser indicates, for example, a combination of variables used when the identification server device 100 generates an identification code for identifying the terminal device 300 in each browser. is there. Specifically, for example, the identification code corresponding to the "second browser" is generated by the combination of the device system parameters corresponding to "language", "Timezone Offset", and "fonts". Thereby, among the device system parameters that can be acquired for each browser, the optimum combination of the device system parameters for identifying the terminal device 300 can be set. The variables shown in FIG. 3 are examples, and are not limited thereto. For example, the device system parameters may include parameters related to software for displaying graphics on a browser. Further, the contents of the combination information table 101a are changed, for example, by the operation of the administrator of the fraud detection system 10, such as the combination of variables and the addition / deletion of the browser.

Here, the variables shown in FIG. 3 will be described. The variable "language" indicates, for example, a language (Japanese, English, etc.) set in the browser by the user. The variable "Timezone Offset" indicates, for example, the difference between the local time zone and UTC (Coordinated Universal Time). The variable "fonts" indicates, for example, the result of investigating whether or not a specific font exists. The variable "Canvas Fingerprint" indicates, for example, the drawing result of a 2D image. The variable "Canvas Fingerprint" is required to have at least one of "a mixture of 1-byte and 2-byte characters", "including all alphabets and numbers (0 to 9)", and "including Chinese characters having a complicated shape". It is desirable to use a character string that satisfies. Further, not only the 2D image but also a variable indicating the drawing result of a predetermined image may be used. The variable "Device Pixel Ratio" indicates, for example, the ratio of the CSS resolution to the physical resolution in the display.

FIG. 4 shows a configuration example of the terminal device identification table 101b. As shown in FIG. 4, the terminal device identification table 101b includes an identification code or the like with the terminal device ID as the primary key. The terminal device ID is, for example, a code uniquely assigned to each user's terminal device 300. The identification code is a code for uniquely identifying the terminal device 300. The identification server device 100 can determine whether or not the terminal device 300 is valid or not based on the identification code by referring to the terminal device identification table 101b.

The acquisition unit 102 acquires device information from another device via the network 400.

The transmission unit 103 transmits various information to another device.

The type specifying unit 104 specifies the type of the device of the terminal device 300 such as a personal computer or a mobile terminal. Specifically, the type identification unit 104 refers to, for example, "device.platform" in the device information, and is an OS (Operating System) installed in a personal computer such as "Win32", "Win64", or "MacIntel". If it contains a string indicating, it is identified as a personal computer. Further, the type identification unit 104 refers to, for example, "device.platform" in the device information, and refers to an OS (Operating) mounted on a mobile terminal such as "iPhone (registered trademark)", "Android", or "Windows Phone". When a character string indicating System) is included, it is specified as a mobile terminal. As a result, the uniqueness of the identification code can be enhanced by utilizing the fact that the device system parameters that can be acquired differ depending on the type of device.

The browser identification unit 105 specifies the type of browser used in the terminal device 300 based on the browser information. Specifically, the browser identification unit 105 identifies the browser by, for example, referring to "device.useragent" in the device information and specifying a character string corresponding to any of the browsers. As a result, the uniqueness of the identification code can be enhanced by utilizing the fact that the device parameters that can be acquired differ depending on the type of browser.

The parameter specifying unit 106 specifies, for example, the device system parameter corresponding to the specified browser in the device information. Specifically, when the specified browser is the "third browser", the parameter specifying unit 106 refers to the combination information table 101a and refers to the variables "language" and "Timezone Offset" corresponding to the "third browser". To identify. Then, the parameter specifying unit 106 specifies the device system parameter corresponding to the variable in the device information. As a result, the identification server device 100 can extract appropriate device system parameters in order to generate a highly unique identification code according to the browser.

Further, the parameter specifying unit 106 may specify the device system parameters based on, for example, the specified device type and the specified browser type. As a result, the identification server device 100 can extract appropriate device system parameters in order to generate a more unique identification code according to the type of device and the type of browser.

Further, the parameter specifying unit 106 may specify the operation system parameter in the device information, for example. Specifically, the parameter specifying unit 106 specifies a predetermined operation system parameter based on the type specified by the type specifying unit 104. As a result, the identification server device 100 can extract appropriate operation system parameters in order to generate a highly unique identification code according to the type.

Here, an example of the specified "operation system parameter" will be described. The variable "Mouse index" indicates the order of mouse operations in the website. The variable "Key index" indicates the order of keyboard input in the website. The variable "Dom Id" is a character string in which "id", "name", and "class" of the text field in which the keyboard input is generated are combined. The variable "Mouse Down Time" indicates the date and time when the click was started in the website. The variable "Mouse Up Time" indicates the date and time when the click was completed in the website.

The identification code generation unit 107 calculates the identification code by inputting the specified device system parameters into a predetermined function, for example. Specifically, the identification code generation unit 107 combines character strings of the device system parameters indicated by each of the plurality of variables corresponding to the specified browser and hashes them. The identification code generation unit 107 uses the hashed value as the identification code. As a result, it is possible to generate a highly unique identification code while ensuring security. The identification code generation unit 107 may calculate the identification code based on one or more device system parameters. Further, the identification code generation unit 107 may generate an identification code by hashing a character string concatenation of a combination of device system parameters and operation system parameters.

Further, for example, when the terminal device 300 is identified as a mobile terminal, the identification code generation unit 107 uses an extraction of a predetermined area in the UA (User Agent) program included in the device information as a device system parameter as an identification code. May be generated. The UA program frequently includes the model name and version information of the model of the terminal device 300. However, this information changes over time. Therefore, the identification code generation unit 107 extracts "from the beginning to the closing parenthesis that appears at the end", which is difficult to change with time, in the UA program, and generates the identification code. Specifically, when the UA program is "AA BB (CC, DD) EE FF (GG HH) II JJ KKK", the identification code generation unit 107 will perform "AA BB (CC, DD) EE FF (GG HH)". ) ”Is extracted to generate an identification code. As a result, the identification server device 100 can generate an identification code having high uniqueness.

The identification unit 108 identifies whether or not the terminal device 300 is a terminal device that is permitted to access a predetermined website based on the identification code. The identification unit 108 refers to, for example, the terminal device identification table 101b, and determines whether or not there is a terminal device ID corresponding to the generated identification code. Specifically, when the identification code of the terminal device 300 is generated as "ABCD" by the identification code generation unit 107, the identification unit 108 specifies the terminal device ID "0000001" with reference to the terminal device identification table 101b. To do. In this case, the identification unit 108 identifies the terminal device 300 as a terminal device that is allowed access to the operator server device 200.

Further, the identification unit 108 may identify the terminal device by using at least one of the device system parameter and the operation system parameter as the identification code instead of the identification code, for example. As a result, the identification unit 108 can easily identify the terminal device.

Further, the identification unit 108 may identify the terminal device based on, for example, the identification code generated by the device system parameters and the operation system parameters. Specifically, the identification unit 108 refers to the terminal device identification table 101b and confirms that there is a terminal device ID corresponding to the identification code. Then, the identification unit 108 operates only the key operation of the keyboard or an equivalent input device (variable "key_stroke") based on the operation system parameters acquired from the terminal device 300, and the text field in which the key input occurs. There are multiple character strings (variable "domid") that combine the ID, name, and class of, and the Tab key and Enter key (variable "tab / enterkey") are not used, and candidates are candidates based on the input information stored in the past. Confirm that it is not determined to be auto-complete. Further, the identification unit 108 can add a login time indicating the time until the login phase is completed to the determination according to the type of the device of the terminal device 300 specified by the type identification unit 104. As a result, the identification unit 108 can improve the accuracy of identifying the terminal device by combining the highly unique identification code with the behavior of the user who has a certain tendency. Further, the identification unit 108 can appropriately identify whether or not the access is by a robot by combining the operation system parameters.

The examination determination unit 109, for example, performs predetermined processing on the terminal device 300 based on the result of the identification unit 108 determining whether or not the terminal device 300 allows access to the website of the business server device 200. To execute. Specifically, when the examination determination unit 109 determines that the terminal device 300 is not permitted to be accessed by the identification unit 108, for example, the examination determination unit 109 denies the access of the terminal device 300 to the business server device 200. At the same time, the examination determination unit 109 may register the terminal device 300 in a database that aggregates the terminal devices 300 suspected of being unauthorized access. As a result, unauthorized access can be appropriately eliminated.

Further, in this case, the examination determination unit 109 may request the terminal device 300 to perform processing related to additional authentication. As a result, when the terminal device 300 that should be originally permitted to access is excluded, unnecessary access refusal can be suppressed by requesting an appropriate authentication procedure from the terminal device 300.

Further, in this case, the examination determination unit 109 may calculate the probability that the terminal device 300 is permitted to access, and if the probability is equal to or greater than a predetermined threshold value, the access to the terminal device 300 may be excluded. .. As a result, it is possible to suppress the risk that the terminal device 300, which should be originally permitted to access, is excluded.
<< Business Server Device 200 >>

FIG. 5 is a diagram showing the configuration of the operator server device 200. The configuration of the operator server device 200 will be described with reference to FIG. As shown in FIG. 5, the operator server device 200 includes, for example, a storage unit 201, an acquisition unit 202, a transmission unit 203, and an information request unit 204. The storage unit 201 stores various types of information. The acquisition unit 202 acquires various information from another device. The transmission unit 203 transmits various information to another device. The information requesting unit 204 requests the terminal device 300 to acquire various information from the user's terminal device 300, or to request the terminal device 300 to transmit various information from the terminal device 300 to the identification server device 100, for example. Function.
=== Processing procedure of fraud detection system 10 ===

An example of the processing procedure of the fraud detection system 10 will be described with reference to FIG. FIG. 6 is a diagram showing a processing procedure of the fraud detection system 10. In FIG. 6, it is assumed that time elapses from the top to the bottom of the paper.

For convenience of explanation, in FIG. 6, the device information includes the “device system parameter” shown in FIG. 7 and the “operation system parameter” shown in FIG. Further, it is assumed that the terminal device 300 uses the "first browser" shown in FIG.

In S101, the terminal device 300 accesses the login screen of the website of the operator server device 200. When the terminal device 300 accesses the website, the terminal device 300 requests the business operator server device 200 for an information collection program for collecting information. Here, the information collection program is, for example, a program described in Javascript, and is a program that collects various information from the terminal device 300 and transmits it to the server device 200 by being executed on the terminal device 300. .. The timing of requesting the information collection program by the terminal device 300 is not limited.

In S102, the business operator server device 200 transmits an information collection program for collecting information to the terminal device 300 in the information requesting unit 204.

In S103, the terminal device 300 collects its own device information. The terminal device 300 transmits the collected device information to the identification server device 100. The terminal device 300 may transmit device information to the operator server device 200. In this case, the operator server device 200 transmits the device information to the identification server device 100.

In S104, the identification server device 100 specifies the type of the terminal device 300 based on the device information in the type identification unit 104. Specifically, the identification server device 100 identifies whether the terminal device 300 is a personal computer or a mobile terminal. As a result, the identification server device 100 can enhance the uniqueness of the identification code in response to the fact that the device information that can be acquired differs depending on the type.

In S105, the identification server device 100 identifies the "first browser" used in the terminal device 300 based on the device information in the browser identification unit 105. Specifically, the identification server device 100 identifies browsers such as "Chrome", "Safari", and "IE11". As a result, the identification server device 100 can enhance the uniqueness of the identification code corresponding to the device parameters that can be acquired by each browser.

In S106, the identification server device 100 identifies the variable corresponding to the "first browser" in the parameter specifying unit 106 with reference to the combination information table 101a. Then, the parameter specifying unit 106 specifies the device system parameters (for example, "AAAA" to "EEEE") corresponding to the specified variables. Further, the identification server device 100 may specify the operation system parameters (for example, "HHHH" to "LLLL") based on the device type information. Thereby, the identification server device 100 can specify the parameters for generating the highly unique identification code.

In S107, the identification server device 100 hashes at least one of the device system parameters and the operation system parameters in the identification code generation unit 107 to generate the identification code. As a result, the identification server device 100 can generate an identification code having high uniqueness.

In S108, the identification server device 100 identifies the terminal device 300 based on the identification code in the identification unit 108 with reference to the terminal device identification table 101b. The identification server device 100 may identify the terminal device based on the identification code generated based on the device system parameters and the operation system parameters.

In S109, the identification server device 100 determines in the examination determination unit 109 whether or not the terminal device 300 is a terminal device for which access is permitted, based on the identification result in the identification unit 108.

In S110, when the identification server device 100 is determined by the examination determination unit 109 to be the terminal device 300 for which access is not permitted, the identification server device 100 refuses to log in by the terminal device 300, or additionally authenticates the terminal device 300. Execute processing such as requesting. On the other hand, when the identification server device 100 determines that the terminal device 300 is permitted to be accessed by the examination determination unit 109, the identification server device 100 accepts a login by the terminal device 300. As a result, unauthorized access can be eliminated.
== Hardware configuration ==

With reference to FIG. 9, an example of the hardware configuration in the case where the identification server device 100 and the operator server device 200 are realized by the computer 1000 will be described. The function of each device can be realized by dividing it into a plurality of devices.

FIG. 9 is a diagram showing an example of the hardware configuration of the computer. As shown in FIG. 9, the computer 1000 includes a processor 1001, a memory 1002, a storage device 1003, an input I / F unit 1004, a data I / F unit 1005, a communication I / F unit 1006, and a display device. Includes 1007.

The processor 1001 is a control unit that controls various processes in the computer 1000 by executing a program stored in the memory 1002.

The memory 1002 is a storage medium such as a RAM (Random Access Memory) or the like. The memory 1002 temporarily stores the program code of the program executed by the processor 1001 and the data required when the program is executed.

The storage device 1003 is a non-volatile storage medium such as a hard disk drive (HDD) or a flash memory. The storage device 1003 stores an operating system and various programs for realizing each of the above configurations.

The input I / F unit 1004 is a device for receiving input from the user. Specific examples of the input I / F unit 1004 include a keyboard, a mouse, a touch panel, various sensors, a wearable device, and the like. The input I / F unit 1004 may be connected to the computer 1000 via an interface such as USB (Universal Serial Bus).

The data I / F unit 1005 is a device for inputting data from the outside of the computer 1000. Specific examples of the data I / F unit 1005 include a drive device for reading data stored in various storage media. It is also conceivable that the data I / F unit 1005 is provided outside the computer 1000. In that case, the data I / F unit 1005 is connected to the computer 1000 via an interface such as USB.

The communication I / F unit 1006 is a device for performing data communication via the Internet N by wire or wirelessly with an external device of the computer 1000. It is also conceivable that the communication I / F unit 1006 is provided outside the computer 1000. In that case, the communication I / F unit 1006 is connected to the computer 1000 via an interface such as USB.

The display device 1007 is a device for displaying various information. Specific examples of the display device 1007 include a liquid crystal display, an organic EL (Electro-Lumisensence) display, a display of a wearable device, and the like. The display device 1007 may be provided outside the computer 1000. In that case, the display device 1007 is connected to the computer 1000 via, for example, a display cable or the like. Further, when the touch panel is adopted as the input I / F unit 1004, the display device 1007 can be integrally configured with the input I / F unit 1004.
=== Summary ===

The fraud detection system 10 according to the present embodiment is a fraud detection system 10 that detects unauthorized access to a predetermined website by a user (third party) who is not permitted to access the predetermined website, and is a network. Based on the acquisition unit 102 that acquires device information about the user's terminal device 300 (device) and the browser information about the browser that is included in the device information used by the user using the terminal device 300, the browser It includes a parameter specifying unit 106 that identifies the device system parameter (first parameter) according to the type, and an identification unit 108 that identifies the terminal device 300 based on the device system parameter (first parameter). As a result, the user's terminal device 300 can be identified based on the highly unique device system parameters included in the browser information.

Further, in the fraud detection system 10 according to the present embodiment, the device information includes at least the device type information regarding the device type of the terminal device 300 of the personal computer or the mobile terminal, and the parameter specifying unit 106 includes the browser information and the device. The device system parameter (first parameter) is specified based on the type information. As a result, the uniqueness of the identification code can be enhanced by utilizing the fact that the device parameters that can be acquired differ depending on the browser and the type.

Further, the fraud detection system 10 according to the present embodiment further includes an identification code generation unit 107 for inputting at least one device system parameter (first parameter) into a predetermined function to generate an identification code, and further includes an identification code generation unit 108. Identifyes the terminal device based on the identification code. As a result, it is possible to generate a highly unique identification code while ensuring security.

Further, in the fraud detection system 10 according to the present embodiment, the device information includes an operation system parameter (second parameter) related to the operation of the user to the terminal device 300, and the identification unit 108 is a device system parameter (first parameter). And the operation system parameter (second parameter), the terminal device is identified. As a result, the uniqueness of the identification code can be enhanced, and whether or not the access is made by a robot can be appropriately identified.

Further, the fraud detection system 10 according to the present embodiment inputs at least one device system parameter (first parameter) and at least one operation system parameter (second parameter) into a predetermined function to obtain an identification code. The identification code generation unit 107 to be generated is further provided, and the identification unit 108 identifies the terminal device based on the identification code. As a result, the uniqueness of the identification code can be enhanced, and whether or not the access is made by a robot can be appropriately identified.

Further, the fraud detection system 10 according to the present embodiment further includes an identification code generation unit 107 for inputting at least one device system parameter (first parameter) into a predetermined function to generate an identification code, and further includes an identification code generation unit 108. Identifyes the terminal device based on the identification code and at least one operation system parameter (second parameter). As a result, the uniqueness of the identification code can be enhanced, and whether or not the access is made by a robot can be appropriately identified.

Further, in the fraud detection system 10 according to the present embodiment, the device system parameter (first parameter) is at least one of information on fonts used in the user's terminal device 300 and information on drawing in the user's terminal device 300. Including. As a result, a highly unique identification code can be generated.

Further, in the fraud detection system 10 according to the present embodiment, the device system parameter (first parameter) is obtained by extracting a character string in a predetermined area from the information about the user agent of the user's terminal device 300. As a result, a highly unique identification code can be generated.

10 ... Fraud detection system, 100 ... Identification server device, 200 ... Business server device, 300 ... Terminal device, 101 ... Storage unit, 102 ... Acquisition unit, 103 ... Transmission unit, 104 ... Type identification unit, 105 ... Browser identification unit , 106 ... Parameter identification unit, 107 ... Identification code generation unit, 108 ... Identification unit, 109 ... Examination judgment unit.

Claims (10)

A fraud detection system that detects unauthorized access to the specified website by a third party who is not permitted to access the specified website.
An acquisition unit that acquires device information about the user's device via the network,
The first parameter according to the type of browser is specified based on the browser information about the browser included in the device information used by the user using the device, and the device by the user included in the device information is specified . The parameter specification part that specifies the second parameter that indicates the operation of
An identification unit that identifies the device based on the first parameter and the second parameter.
Fraud detection system equipped with. The device information includes at least device type information regarding the type of the device, whether it is a personal computer or a mobile terminal.
The parameter specifying unit specifies the first parameter based on the browser information and the device type information.
The fraud detection system according to claim 1. An identification code generator that generates an identification code by inputting at least one of the first parameters into a predetermined function.
With more
The identification unit identifies the device based on the identification code.
The fraud detection system according to claim 1 or 2. The second parameter includes information indicating the order of mouse operations within the website by the user, information indicating the order of keyboard input within the website, information regarding the text field in which keyboard input occurs, and clicking within the website. Includes at least one of the date and time information that started, or the date and time that the click ended on the website.
The fraud detection system according to any one of claims 1 to 3. An identification code generator that generates an identification code by inputting at least one of the first parameters and at least one of the second parameters into a predetermined function.
With more
The identification unit identifies the device based on the identification code.
The fraud detection system according to claim 4. An identification code generator that generates an identification code by inputting at least one of the first parameters into a predetermined function.
With more
The identification unit identifies the device based on the identification code and at least one of the second parameters.
The fraud detection system according to claim 4. The first parameter includes at least one of information about fonts used on the user's device and information about drawing on the user's device.
The fraud detection system according to any one of claims 1 to 6. The first parameter is obtained by extracting the model name and version information of the user's device from the information regarding the user agent of the user's device.
The fraud detection system according to any one of claims 1 to 7. The computer
To get device information about a user's device over the network,
The first parameter according to the type of browser is specified based on the browser information about the browser included in the device information used by the user using the device, and the device by the user included in the device information is specified . To identify the second parameter that indicates the operation of
Identifying the device based on the first parameter and the second parameter.
Fraud detection method to execute. On the computer
To get device information about a user's device over the network,
The first parameter according to the type of browser is specified based on the browser information about the browser included in the device information used by the user using the device, and the device by the user included in the device information is specified . To identify the second parameter that indicates the operation of
Identifying the device based on the first parameter and the second parameter.
A program to execute.

Images