RU2792580C1 - Method and system for detecting compromise of networks of pos-terminals - Google Patents

Abstract

FIELD: computer security.

SUBSTANCE: computer-implemented method for detecting compromise of POS-terminal networks contains the following steps: obtaining identifiers of compromised territories; forming a database of potentially compromised POS-terminal networks; determining compromise parameters for at least one network of POS terminals; determining the probability of compromising at least one network of POS terminals; forming a list of POS-terminal networks ranked by the probability of compromise; identifying at least one network of POS terminals from the ranked list as compromised.

EFFECT: identification of compromised networks of POS terminals.

12 cl, 3 dwg

Description

FIELD OF TECHNOLOGY

This technical solution relates to the field of computer technology, namely to devices and methods for detecting compromise of POS-terminal networks.

BACKGROUND OF THE INVENTION

POS-terminal (POS - from the English words Point Of Sale - point of sale) is an electronic device for accepting contactless payments. It can accept chip payment cards, magnetic stripe cards, contactless cards, and other contactless devices such as smartphones. In the future, for simplicity of presentation in the text of this application, devices designed for contactless pairing with a POS-terminal will be generically called a bank card, regardless of its technical design.

POS-terminals are also often referred to as the entire software and hardware complex installed at the cashier's workplace and usually representing a computing device, which includes the terminal itself.

This computing device can be compromised in one way or another by intruders. If a POS terminal is successfully compromised, attackers get the opportunity to steal (copy) bank card data that was used to make payments at this terminal. As a result, the bank card is also compromised, and the data itself, as a rule, is accumulated by attackers and subsequently put up for sale on specialized web resources of the so-called darknet (an Internet segment technically adapted for anonymous communication).

Speaking of a network of POS-terminals, they usually mean a set of such terminals located in outlets of the same organization. It is obvious that in a city or region, as a rule, there are many different, usually independent POS-terminal networks. For example, one such chain may belong to a company that owns gas stations, the second - to a chain of flower shops, the third to branches of a hotel complex, the fourth - to a chain of restaurants, etc.

It is known from the prior art that there is a method for automatically verifying the legitimacy of a transaction using the postal code that was specified by the owner of the bank card when it was issued. This check is called "Address verification system" or "AVS". The verification is based on the fact that the cardholder knows the postal code that he provided when issuing the card. When trying to make a payment or transfer, the cardholder is asked for information about this postal code. If the postal code specified by the cardholder matches the postal code of the branch that was specified when issuing the bank card, then the transaction is considered legitimate.

Based on the "Address verification system" postal code check, an automatic system for checking the legitimacy of a transaction was developed, which, upon receipt of transaction data, checks the address of the ongoing transaction with a limited list of addresses for which transactions are pre-authorized. The list of addresses for which transactions are allowed in advance is built on the principle of proximity to the home address of the bank card holder. When issuing a bank card, the owner of a bank card indicates the address and postal code of his place of residence. It is assumed that the owner of a bank card will make most of the purchases in relative proximity to the house. It is not expected that the owner of a bank card will, for example, make purchases from different parts of the world. Thus, if the attackers stole the card data and try to use the stolen card data by making a transaction somewhere at a considerable distance from the bank card owner's home, then such a transaction will be automatically blocked by the bank. Now such an automatic verification system has been implemented and is actively used by many banks. However, after the principle of operation of AVS became known to attackers, they also found ways to bypass it.

As mentioned above, on the darknet, in specialized online stores, attackers sell databases containing information about compromised bank cards. As a rule, two types of databases are offered for sale: "SS" and "DUMP". Databases of the "CC" type contain text data: card number, expiration date, CVV code, owner's name, etc. As a rule, these data were obtained by fraudsters when the user entered them for a purchase in an online store. "DUMP" type databases contain information copied from a magnetic stripe or a chip on the bank card itself. It is these databases that attackers get after compromising POS terminals. It is technically possible to write such information on a blank medium, which will make it possible to make a physical copy of a compromised card. A physical copy of the card can be used by attackers to pay in ordinary offline stores that accept payment by bank cards. In the following description, to designate databases with bank cards of the "DUMP" type, the term "bank card dump database" or simply "dump database" will be used.

As a rule, bank card dump databases for each card, in addition to the information copied from it, also indicate the place of compromise, namely the postal code of the area where the compromised POS terminal is located, through which the attacker copied information from the card. This is done so that a potential buyer can, without arousing suspicion in banking AVS systems, use the acquired bank card data. In other words, the buyer usually purchases a database of bank card dumps in which postal codes correspond to the region where it is planned to use the made copies of bank cards for offline purchases. In this way, attackers manage to bypass the control of AVS systems, since transactions each time take place in stores that are physically close to the place where the original, compromised bank card was issued.

In particular, it is known that the leak of bank card data that occurred in 2014 from the sales outlets of the Sally Beauty organization is the result of the compromise of the POS-terminal network. Investigation articles (in English) published at the time of application at the following links:

https://krebsonsecurity.com/2014/03/sally-beauty-hit-by-credit-card-breach/ and

https://krebsonsecurity.com/2014/03/zip-codes-show-extent-of-sally-beauty-breach/comment-page-1/.

These sources disclose the fact that it was possible to establish the source of the data leak by comparing the list of postal codes from the dump of bank cards published on the dark web with the list of postal codes on the territory of which the outlets of the Sally Beauty network are located, moreover, the criterion for making a decision on compromising the network POS-terminals served as a complete match of these lists.

However, these articles do not disclose a method for detecting a compromised POS-terminal network when the list of postal codes from the bank card dump does not exactly match the list of indexes for the location of outlets of any organization. Also, these articles do not disclose possible methods of automatic data analysis that would allow to identify a compromised network of POS terminals of one organization from a variety of organizations whose outlets are located in the territory corresponding to the list of postal codes from the dump of bank cards.

Solutions are also known from the prior art that make it possible to detect the fact of leakage of bank card data. In particular, patent US 11062317 B2 (Akli Adjaoute DATA BREACH DETECTION, publ. 13.07.2021. class G06Q 20/40, G06Q 30/02) is known. It describes a method for detecting data leakage by analyzing transaction records in real time. Doubtful transactions are compared with periods of regular transactions typical for the client over the course of days, weeks, months. For bank cards from which suspicious transactions were made, a single database is created. With its help, investigations are carried out on organizations with suspicious transactions. For each organization, an identifier is created for subsequent tracking and collection of information on the operations conducted by this organization. Based on the information about the transactions, the probability of fraud is calculated. If the calculated probability is greater than the specified threshold, then a warning is generated about a possible data leak and a suspected compromise location.

As can be easily seen, this method can only be implemented using detailed information about transaction statistics, and its implementation requires access to the transaction database of the card issuing bank.

The present solution is aimed at eliminating at least a number of disadvantages inherent in the solutions known from the prior art. In particular, in accordance with the described method, access to banking transaction statistics and other similar information is not required to identify a compromised network of POS terminals.

SUMMARY OF THE INVENTION

Within the scope of this description, unless otherwise specified at the place of application, the following specific terms are used with the following meanings:

A compromised POS network is a network in which at least one POS terminal has been installed with malicious hardware or software that allows copying bank card data.

area identifiers: postal codes, ZIP codes, postal codes, street names, neighborhoods, districts, cities, counties, municipalities, counties, states, provinces, regions, countries, etc.

compromised territories are territories whose identifiers are specified in the database of bank card dumps offered for sale.

identifiers of compromised territories - identifiers of territories specified in the database of bank card dumps.

Superior territorial-administrative division (VETAD) - a unit of territorial-administrative division of a particular country, which is one level higher than the given territory. So, for example, for a territory corresponding to a specific postal code or ZIP code, in Russia VETAD is a district, for the USA it is a district. In turn, for the Russian region, VETAD is a region, for a US district, VETAD is a state. It is understood that an area or state is also a BETAD for a territory corresponding to a zip code or ZIP code.

The list of potentially compromised organizations is a list of organizations that own outlets located in the compromised territory.

Bank card dump database - a database containing information copied from the magnetic stripe or chip of original bank cards. Also referred to as the dump base in the text for brevity.

The technical problem to be solved by the claimed technical solution is the creation of a computer-implemented method and system for detecting a compromise of a POS-terminal network belonging to a certain organization. The method and system for detecting compromise of the POS-terminal network are described in independent claims. Additional embodiments of the present solution are presented in dependent claims.

EFFECT: technical result consists in providing automatic detection of POS-terminals network compromise.

The technical solution proposed for patenting is a computer-implemented method for detecting compromise of POS-terminal networks. This method includes steps on which identifiers of compromised territories are obtained, a database of potentially compromised POS-terminal networks is formed, compromise parameters of at least one POS-terminal network are determined, the probability of compromise of at least one POS-terminal network is determined, and a probability-ranked compromise a list of POS terminal networks and identify at least one POS terminal network from the ranked list as compromised.

It is possible to implement the described method, in which a geographic database and a database of commercial organizations are preliminarily formed.

It is possible to implement the described method, in which, after receiving a set of identifiers of compromised territories, it is determined, by means of queries to a geographic database prepared in advance, the country to which the received identifiers of compromised territories belong.

In another possible embodiment of the described method, the compromise parameters are determined by means of queries to a pre-prepared database of commercial organizations.

In another possible implementation of the described method, the database of potentially compromised POS terminal networks includes at least identifiers of compromised territories, names of organizations whose POS terminal networks are located in compromised territories, addresses of outlets of organizations whose POS terminal networks are located in the compromised territories, as well as higher units of the territorial-administrative division (VETAD) corresponding to the compromised territories.

It is possible to implement the described method, in which the POS-terminal network compromise parameters include: the number of identifiers of compromised territories, where at least one outlet of this organization is present, the total number of identifiers of compromised territories, the number of outlets of this organization located in compromised territories, and the total number of networks of outlets of this organization located in the territories of all VETADs corresponding to the compromised territories.

It is possible to implement the described method, in which the probability of compromising at least one network of POS terminals is determined as the product of the frequency of POS terminal networks of a given organization in compromised territories by the probability of presence of POS terminal networks of this organization in compromised territories.

It is possible to implement the described method, in which the frequency of POS-terminal networks of a given organization in compromised territories is determined as the ratio of the number of identifiers of compromised territories, where at least one outlet of this organization is present, to the total number of identifiers of compromised territories.

It is possible to implement the described method, in which the probability of the presence of POS-terminal networks of a given organization in the compromised territories is determined as the ratio of the number of outlets of this organization in the compromised territories to the total number of outlets of this organization in the territories of all VETADs corresponding to the compromised territories;

It is possible to implement the described method, in which the compromised networks of POS terminals include the network of POS terminals that has the highest value of the probability of compromise.

It is also possible to implement the described method, in which the compromised networks of POS terminals include all networks of POS terminals for which the calculated values of the probability of compromise exceed a predetermined threshold.

The claimed method is implemented in a system for detecting a compromise of a POS-terminal network, which contains at least: a processor, a long-term memory containing at least one database and machine-readable instructions, which, when executed by the processor, ensure the execution of the described method.

DESCRIPTION OF THE DRAWINGS

The implementation of the invention will be described hereinafter in accordance with the accompanying drawings, which are presented to explain the essence of the invention and in no way limit the scope of the invention. The following drawings are attached to the application:

Fig. 1A illustrates a method for detecting a POS network compromise.

Fig. 1B illustrates the POS network compromise parameter determination step, which is part of the POS network compromise detection method.

Fig. 2 illustrates an example of a general design of a computing device.

DETAILED DESCRIPTION

In the following detailed description of the implementation of the invention, numerous implementation details are provided to provide a clear understanding of the present invention. However, one skilled in the art will appreciate how the present invention can be used, both with and without these implementation details. In other cases, well-known methods, procedures and components have not been described in detail so as not to obscure the features of the present invention.

Furthermore, it will be clear from the foregoing that the invention is not limited to the present implementation. Numerous possible modifications, changes, variations and substitutions that retain the spirit and form of the present invention will be apparent to those skilled in the subject area.

The present invention is directed to providing a computer-implemented method and system for detecting compromise in a POS network. POS terminals can be compromised by attackers by installing malicious software or malicious hardware such as a so-called skimmer. Every time someone uses a bank card to pay through a compromised POS terminal, the details of the bank card used for this are copied by attackers. Attackers aggregate the received data into dump databases and put them up for sale on specialized web resources, in the so-called darknet.

In addition to data copied from magnetic stripes or bank card chips, dump databases often also contain identifiers of territories where these data were copied using compromised POS terminals. Compromised territory identifiers can be, for example, postal codes or ZIP codes. In addition to them, dump databases may additionally contain information about the city and/or country that the given identifiers correspond to.

For example, each entry in the dump base can be associated with a line of the following form:

73301, USA,

where 73301 is an American postal code (ZIP code), and USA is an indication of which country the given code belongs to.

Thus, the identifier of the compromised territory is always associated with a record of some bank card contained in the dump database and indicates the territory where the compromised POS terminal is located, from which the data of this bank card was obtained.

Identifiers of compromised territories contained in such dump databases can be used to identify compromised POS terminal networks.

As shown in FIG. 1A, the claimed method for detecting a compromise of the POS terminal network (100) can be implemented as follows.

In one possible implementation, the method may include a preliminary step in which a geographic database is generated containing information about all existing territory identifiers (eg, postal codes) and the countries to which they correspond. This base can be built in any well-known way using open Internet sources.

For example, to build a geographic database, a pre-made script that implements the functions of a crawler (search robot) and a parser can be used. First, using a pre-prepared list of countries and territories of the world, by means of a script, search queries are generated and sent to any public search engine, such as Google or Yandex. These search queries can, for example, in the case of postal codes, look like

"index list [country_name]" or

"list of postal codes of [country_name]",

where instead of [country_name], each request is substituted with the name of the next country or territory from a pre-prepared list of countries and territories. Similarly, search queries can be generated for street names, cities, and other area identifiers.

Then, using the script, they analyze the search results for each of these requests and find at least one web resource containing the searched list. After that, by means of a script, a transition is made to the found web resource, where the list is parsed and the resulting list is saved in the database, and for each element of the list in the database, the name of the country for which this list is received, as well as the name adopted in this country designation of this identifier. For example, for the USA it is a ZIP code or postal code, for the Russian Federation it is an index, etc.

Alternatively, to build a geographic database, pre-known open Internet resources containing lists of identifiers of territories categorized by country, such as www.worldpostalcodes.org, cities-russia.rf, etc., can also be used.

The lists obtained for different countries are combined. In the event that an index is found in several countries, all these countries are indicated in the combined list for it. Thus, a base is obtained, consisting of records, each of which looks, for example, like this:

'90630' - Estonia, Finland, USA,

Additionally, sets of keywords formed in the state languages of this country can be added to the geographic database for each country to designate institutions where POS-terminals can be located. As a non-limiting example, for Russia, the United States, and Finland, sets of keywords such as:

Russia: pharmacy, bank, canteen, shop, mall, casino…

USA: drugstore, bank, foods, shop, mall, casino…

Finland: apteekki, pankki, ruokala, kauppa, supermarket, kasino…

It is also possible to implement the described method, in which, at a preliminary stage, a database of commercial organizations is created for each country in advance. The database of commercial organizations is created on the basis of a country-specific list of territory identifiers (for example, a list of postal codes existing in a given country).

For each territory identifier, a list of outlets (offices, shops, restaurants, bank branches, etc.) located in this identifier is obtained and stored in the database of commercial organizations (for example, in the USA - in the territory corresponding to this ZIP code).

To do this, the computing device can execute requests to open sources, for example, such as Google maps, GIS2, Mapsme or Yandex maps, Yellow pages, using a script prepared in advance, and the requests are formed taking into account the syntax used by the source. For example, if Google maps is used and the database of commercial organizations is built for Russia, then search queries generated for the territory identifier (index) 123098 may look like this:

Russia index 123098 pharmacy,

Russia index 123098 bank,

Russia index 123098 cafe

Russia index 123098 shop

Russia index 123098 shopping center

And so on. It is clear that in the response of the search engine, a list of names and addresses of the corresponding outlets located in the territory corresponding to this index is received. Actually keywords, such as bank, pharmacy, canteen, etc. in this case, they are chosen depending on the country for which the database is being built.

The lists of outlets obtained for each of the territory identifiers are ordered in any well-known way by the names of organizations and stored in the database of commercial organizations in association with the identifier for which this list was built.

Additionally, each of the organizations found in this way in the database of commercial organizations can be associated with the identifier of the territory where it is located, as well as all relevant VETAD. For example, organizations

Pharmacy "Floria", Moscow, 123098, Bochvara street, 10A

in the database, in any well-known way, index 123098 and VETAD can be put in correspondence: North-Western District, Moscow, Central Federal District.

Alternatively, the creation of the business database for each country can be done manually by the operator.

All of the actions listed are non-specific, well known to those skilled in the art, and can be performed in any conventional manner.

The result of the preliminary stage is a geographic database, in which each territory identifier is associated with the name of at least one country in which the territory denoted by this identifier is located, as well as a database of business organizations, in which each business organization is associated with a territory identifier, for example , index, and at least one VETAD.

Step 110 - Obtaining the Identifiers of the Compromised Territories

Method 100 begins at step 110 where the computing device obtains a set of compromised territory identifiers. As mentioned earlier, such identifiers can be, without limitation, postal codes, ZIP codes, postal codes, names and/or numbers of individual buildings, as well as streets, blocks, districts, cities, districts, counties, communes, voivodships, provinces and other units of territorial-administrative division. Below, the operation of the method will be demonstrated on the example of US postal codes (ZIP codes), however, any other, without limitation, identifiers can be used in a similar way. In the following, postal codes may be referred to simply as zip codes or ZIP codes.

At step 110, the identifiers of the compromised territories, as well as their accompanying information (for example, the name of the country), if any, are extracted from the dump database and transferred to the computing device. This can be done in any well-known way, for example, by means of a script that implements the parser functions, which allows you to automatically read all text lines from the dump database offered for sale and save them on a computing device.

In one of the embodiments of the invention, the computing device can only receive a set of compromised territory identifiers that was previously extracted from the dump database, without any accompanying information indicating which country the received identifiers belong to.

In another implementation, the computing device may receive both a set of compromised territory identifiers associated with bank cards and related information indicating which country the received identifiers belong to.

In all possible implementation options, at step 110, deduplication is performed by means of a computing device, that is, duplicate identifiers are removed from the obtained list of compromised territory identifiers. As a result, a modified list is obtained and stored in the database, in which each identifier of the compromised territory is present only once.

Below is an example of a set of compromised territory identifiers containing 951 identifiers.

In the above example, only identifiers of territories were extracted from the dump database, and there is no indication of which country they belong to. In such a case, by means of a computing device, queries are made to a geographic database prepared in advance and it is determined to which country the identifiers of the territories of this sample belong. This can be done in any well-known way, with the country to which the identifiers belong, choosing the country with which the largest number of identifiers were found to match.

For example, if for a selection of three identifiers: '72076', '92867', '90630', queries against the geographic database gave the following result:

'72076' - Germany, USA,

'92867' - USA,

'90630' - Estonia, Finland, USA,

then it will be established that these identifiers refer to the United States.

In the case when not only the identifiers of the compromised territories, but also information about the country they belong to are obtained from the dump database, queries to the geographic database are not executed.

This completes step 110 and the method proceeds to step 120.

Step 120 - Forming a Database of Potentially Compromised POS Terminal Networks

Next, the computing device that implements the method proceeds to step 120, which creates a database of potentially compromised networks of POS terminals. This database consists of the set of identifiers of compromised territories obtained at the previous step, where each of the identifiers is associated with a list of organizations whose outlets are located within the given compromised territory, and for each of the outlets its address is indicated.

It is clear that a variant is possible when, technically, one network of POS-terminals includes many outlets belonging to the same organization, but having different addresses. At the same time, the second option is also possible, when each outlet of the same organization has its own, technically separate network of POS terminals. However, the dump database does not contain information that allows to establish exactly how, according to the first or second option, the network of POS terminals was implemented, the compromise of which led to the mention of a specific identifier of the compromised territory in the dump database. Therefore, within the framework of the described method, a set of all outlets belonging to a particular organization and located in a compromised territory is taken as a network of POS terminals.

Also, each of the identifiers at this step will be assigned to VETAD (a higher unit of territorial-administrative division for a given country). In this example, where the identifiers of the compromised territories are US ZIP codes, the role of BETAD can be, for example, the state to which this ZIP code belongs.

To form a database, a computing device can use a pre-prepared script to execute requests to open sources, such as Google maps, GIS2, Mapsme or Yandex maps, Yellow pages, and the requests are formed taking into account the syntax used by the source. For example, if Google maps is used, then search queries generated for the compromised territory ID 90630 might look like this:

usa postal code 90630 drugstore (in response, the search engine returns a list of names and addresses of pharmacies located in the territory corresponding to ZIP code 90630),

usa postal code 90630 bank (returns a list of banks),

usa postal code 90630 foods (returns a list of catering establishments),

usa postal code 90630 shop (returns a list of stores),

usa postal code 90630 mall (returns a list of malls),

usa postal code 90630 casino (returns a list of gambling establishments), and so on.

The keywords themselves, such as bank, shop, foods, as well as the name of the country and the designation of the identifier used in the request (in this case, this is postal code, when building a request in Russian, this could be the word "index", etc.) are selected by the script from the geographic database in accordance with which country the identifiers of the compromised territory belong to.

The lists of POS-terminal networks (sales outlets) obtained for each of the identifiers of the compromised territories are sorted by the names of organizations and stored in the database of potentially compromised POS-terminal networks in association with the identifier for which this list was built. For example, a fragment of such a list for ID 90630 might look like this:

Marshalls, 9801 Walker St, Cypress, CA 90630.

…

McDonald's, 10011 Valley View St, Cypress, CA 90630,

McDonald's, 4125 Ball Rd, Cypress, CA 90630,

An alternative implementation of the described method is possible, in which queries are not made to open sources, such as Google maps, but queries are made to a pre-prepared database of commercial organizations. At the same time, having selected a database of commercial organizations corresponding to the country to which the received identifiers of compromised territories belong, queries are built to this database in any well-known way, each of which contains the next identifier of the compromised territory, taken from the list of identifiers obtained at step 110.

In response to each request, a list of all outlets (POS terminal networks) related to this identifier is obtained from the database of commercial organizations.

From the list of POS-terminal networks constructed in any way described for the given identifier, the names of organizations that own the POS-terminal network data are additionally extracted and the list of POS-terminal networks and the list of organization names are stored in the database of potentially compromised POS-terminal networks.

As an example, the following is a list of the names of organizations defined in this way, whose outlets have addresses related to the identifier 90630:

marshalls,

Nothing Bundt Cakes,

Five Guys, AT&T,

Verizon Wireless,

McDonald's.

Further, at least one VETAD is assigned to each identifier of the compromised territory. To do this, a query is made to the search engine through a script, for example, for the aforementioned ZIP code 90630, the query may look like this:

usa postal code 90630

in response to such a request, the search engine will return information about the VETAD corresponding to this ZIP code; in this case

Orange County, CA, USA (Orange County, California, USA).

In the role of BETAD, in accordance with the described method, both the county and the state can be used. In the following, the use of a state as a BETAD will be shown as a non-limiting example.

In an alternative implementation of the described method, a request is made to a pre-prepared database of commercial organizations, and the identifier of the compromised territory is used as a keyword in the request. In response, a list of outlets located in the given territory is received from the database of commercial organizations, and each of them is assigned to VETAD (obviously, the same ones are the same for each of the organizations). In any well-known way, the required VETAD is extracted from the resulting list.

The BETAD obtained by any of the mentioned methods for each identifier of the compromised territory is stored in the database of potentially compromised POS-terminal networks.

For example, as a result of performing this step for the above identifiers of compromised territories, the following list of higher units of territorial-administrative division (states) of the United States was obtained and stored in the database: ['AL', 'PA', 'OK', 'VA', ' OH', 'MG, 'NM', 'MA', 'AZ', 'CA', 'LA', 'II/, 'NE', 'NV, 'TN', 'ID', 'NH', ' TX', 'CT', 'MS', 'ME', 'CO', 'NY', 'WV', 'FL', 'NJ', 'MD', 'KS', 'VT', 'KY' , 'MO', 'NC, 'UT', 'IN', 'RI', 'GA', 'WY', 'AR', 'SC']. This BETAD list includes all states that have at least one ZIP code from the original set of compromised territory identifiers.

Then, a numerical value is obtained and stored in the database for each of the potentially compromised organizations, corresponding to the total number of outlets (offices, shops, restaurants, bank branches, etc.) owned by this organization and located in such a VETAD where at least one identifier of the compromised territory. To do this, through the script, a query is made to a search engine, for example, Google. Specifically, for the state of California (CA) and the McDonald's organization, the query might look like:

usa california mcdonald's

In response to this request, the search engine returns a list of outlets (in this case, restaurants) of the specified organization located in the territory of the specified state. The length of this list, that is, the number of restaurants included in it, is the desired numerical value.

In an alternative implementation of the described method, a query is made to a pre-prepared database of commercial organizations of a given country, and the BETAD identifier and the name of the organization are used as keywords in the query. In response, a list of outlets of this organization located in a given VETAD is received from the database of commercial organizations and the length (number of lines) of this list is calculated in any well-known way, which is interpreted as the desired number.

This value is stored in the database by associating this value with the state and organization in any well-known way, for example, as a string

McDonald's, CA, 1221

Similarly, numerical values are obtained and stored for all other potentially compromised organizations and for all other BETADs (in this case, states).

Thus, a database of potentially compromised POS terminal networks is obtained. This database itself can be built in any well-known way.

It is worth noting that it will be obvious to a person skilled in the art that the listed methods of extracting information from open Internet sources to form a database of potentially compromised POS terminal networks are not exhaustive and serve only as an example.

This completes step 120 and the method proceeds to step 130.

Step 130 - Determining the parameters for compromising POS networks

In step 130, compromise parameters are determined for each POS terminal network from the database of potentially compromised POS terminal networks. Step 130 is illustrated in detail in FIG. 1B.

To calculate the probability that at least one POS terminal network belonging to a particular organization is compromised, in accordance with the described method, the following parameters must be calculated:

- frequency of POS-terminal networks of this organization in compromised territories, zip_kf; is defined as the ratio of the number of compromised territories, where there is at least one network of POS-terminals of this organization Z_1, to the total number of compromised territories Z;

- the probability of the presence of networks of POS-terminals (sales outlets of this organization) in all compromised territories cmp_kf; is defined as the ratio of the number of POS-terminal networks (points of sale) of this organization in the compromised territories, B_Z, to the total number of POS-terminal networks of this organization in the territories of all VETADs corresponding to the compromised territories, B_S.

In accordance with the above, step 130, as shown in FIG. 1A starts at step 131.

Step 131 - Determination of the number of compromised territories in which this organization is represented, as well as the total number of outlets of the organization in all compromised territories

In the first step 131 of step 130, the number of identifiers of compromised territories in which a particular organization is represented, Z_1, is determined. To do this, for each of the organizations from the list of organizations compiled in step 120, a search query is performed against the database of potentially compromised POS terminal networks for a keyword denoting a particular organization. In response to this query, all lines containing the name of this organization are found. As described above in relation to step 120, each outlet of this organization is associated with the identifier of the compromised territory (in this case, the ZIP code) where this outlet is located.

According to this list, in any well-known way, the number of found unique identifiers of the compromised territory is counted (i.e., each found identifier is counted only once) and the number of identifiers of the compromised territories for which POS-terminal networks of a particular organization Z_1 were found was obtained.

Then, having calculated the length (number of lines) of the received list of outlets of this organization, they find the value B_Z, that is, the number of POS-terminal networks (points of sale) of this organization in all compromised territories.

For example, a database query might look like

McDonald's

In response to such a request, a list of all McDonald's restaurants found in step 120 will be received. Next, the number of different compromised territory identifiers (ZIP codes) in the received list of restaurants is counted. For example, as a result of counting, it was determined that there are 311 such identifiers. The described actions can be performed in any well-known way.

Having determined the total length (number of lines) of the resulting list of McDonald's restaurants, they find the B_Z value, that is, their total number in all compromised territories; for example, it turns out to be 408.

The named parameters are calculated in a similar way for all other organizations. The results are stored in the database, obtaining, for example, the following values (record format "organization name", Z_1, B_Z):

Marshalls 61, 79

Nothing Bundt Cakes, 61, 61

Five Guys, 119, 124

AT&T 121, 131

Verizon Wireless, 129, 146

McDonald's, 311, 408

Also, at step 131, the total number of compromised territories Z is determined. Since this number is numerically equal to the number of different indicators of compromised territories obtained at step 110, it is determined by counting in any well-known way how many unique indicators of compromised territories are contained in the database of potentially compromised POS terminal networks . The resulting value is stored, for example, in a separate field Z of the database. In this example Z=951.

At this point, step 131 ends and the method proceeds to step 132.

Step 132 - Determination of the total number of outlets of this organization in the territory of all VETADs corresponding to the compromised territories

Next, at step 132, the total number of outlets of a particular organization in the territory of all VETADs that are associated with the compromised territories is determined. A list of all VETADs corresponding to the compromised territories was obtained in step 120 and stored in the database. Also, at step 120, information about the number of outlets of each organization on each VETAD was also stored in the database of potentially compromised POS terminal networks.

To determine the number of outlets of a particular organization in the territory of all VETADs associated with identifiers of compromised territories, a query can be made to the database of potentially compromised POS terminals. The request may include BETAD and the name of the organization.

The request might look like this, for example

MacDonald's, CA

In response to such a request, the number of outlets of a particular organization in a given VETAD is received.

So, in response to this request, the numerical value 1221 found at step 120 will be received, corresponding to the number of Macdonald's outlets in California.

Queries are made for all BETADs determined in step 120 and the results are summarized. Thus, for each organization, the value B_S is obtained, and the total number of outlets of a particular organization in all compromised BETADs, in this example equal to 3129. The results are stored in a database.

In an alternative implementation of the method, if information about the number of outlets of organizations on each BETAD was not stored at step 120, the number of outlets for each organization on BETAD can be determined at this step in real time. This is done in exactly the same way as described above with respect to step 120.

The following is an example of the result of step 132 of step 130 in the format "organization name", Z_1, B_Z, B_S:

Marshalls, 61, 79, 202

Nothing Bundt Cakes, 61, 61, 311

Five Guys, 119, 124, 573

AT&T 121, 131, 2982

Verizon Wireless, 129, 146, 933

McDonald's, 311, 408, 3129

At this point, step 132 of step 130 ends, step 130 also ends, and the method proceeds to step 140.

Step 140 - determining the probability of compromising the next network of POS terminals

At this step, the probability of compromising the next network of POS terminals of a certain organization is determined. This value, sort_kf, is calculated as the product

sort_kf=zip_kf*cmp_kf,

where zip_kf is the frequency of POS-terminal networks of this organization in compromised territories; a cmp_kf - probability of presence of POS-terminal networks (sales outlets of the given organization) in the compromised territories.

As noted earlier, in turn, zip_kf is calculated as a private number of compromised territories where there is at least one network of POS terminals of this organization Z_1 and the total number of compromised territories Z:

zip kf=Z_1/Z,

a cmp_kf is calculated as the quotient of B_Z, the number of POS-terminal networks (points of sale) of this organization in the compromised territories, and B_S, the total number of POS-terminal networks of this organization in the territories of all VETADs corresponding to the compromised territories, B_S.

cmp_kf=B_Z_1/B_S.

In one of the possible implementations of the described method, the desired sort_kf value can be calculated as

sort_kf=zip_kf*cmp_kf ^∧ 2

In another possible implementation, sort_kf could also be computed as

sort_kf=zip_kf ^∧ 3*cmp_kf,

where zip_kf and cmp_kf are calculated in the same way as described above.

The values Z_1, Z, B_S, and B_Z were previously determined as described in steps 120 and 130 and stored in a database of potentially compromised POS terminal networks. At this stage, in any well-known way, the name of the next organization is selected from the previously obtained list of organizations and using this name, a query is made to the named database, obtaining the values Z_1, B_S and B_Z for this organization.

After that, in any well-known way, the sort_kf value for this organization is calculated in accordance with the above dependencies and stored in the database of potentially compromised POS-terminal networks.

So, in the framework of the above example, for a query containing the name of McDonald's, the values Z1=311, B_Z=408 and B_S=3129 will be obtained from the database. The value of Z, the total number of indicators of compromised territories, is the same for all organizations and in this example is Z=951.

In the given example of calculating the value of sort_kf, the probability of compromising the network of McDonald's POS terminals, the value sort_kf=0.0426417 will be obtained and stored in the database.

This completes step 140.

It is worth noting that steps 130 and 140 each time are performed in relation to one specific network of POS terminals. Moreover, steps 130 and 140 are iterative and are repeated until they are completed for all organizations whose names obtained during step 120 are contained in the database of potentially compromised POS terminal networks.

In this case, it is possible to implement the described method, in which steps 130 and 140 are performed in parallel, in multi-threaded mode, simultaneously for many organizations from the list of organizations.

In any case, at the end of the next iteration of step 140, the method proceeds to the verification carried out at step 150.

Step 150 - Is there at least one POS network that has no probability of compromise?

At step 150, it is checked whether there are organizations left in the list, either returns to step 130, or proceeds to step 160. The method returns to step 130 if there are still networks of POS terminals in the list of POS terminal networks for which the value of the probability of compromise has not been calculated . If the probability of compromise value has been calculated for the entire list of POS terminal networks, then the method proceeds to step 160.

Step 160 - formation of a list of POS-terminal networks ranked by the probability of compromise

At step 160, a ranked list of probabilities of compromising POS terminal networks is generated. To do this, POS-terminal networks sort in descending order of the probability of compromise sort_kf calculated in step 140 in any well-known way. For this, a pre-prepared script can be launched.

As a result of the script execution, a ranked list of potentially compromised POS terminal networks is obtained, in which the networks are located in descending order of the sort_kf compromise probability value. The ranked list is stored in a database.

In the example above, such a ranked list of probabilities might look like this:

McDonald's, 0.042641696,

Five Guys, 0.027079055,

Marshalls, 0.025085632,

Verizon Wireless, 0.021226599,

Nothing Bundt Cakes, 0.012581104,

AT&T, 0.005589443.

This completes step 160 and the method proceeds to step 170.

Step 170 - consider compromised at least one POS terminal network with the highest value of the probability of compromise

At step 170, in any well-known way, the POS terminal network in the ranked list is selected, which has the highest value of the probability of compromise. This network of POS terminals is considered compromised.

In one of the alternative implementations of this method, not one, but several POS terminal networks from a probability-ranked list can be determined as compromised, for example, all POS terminal networks having probability values that exceed a predetermined relative threshold. For example, a relative threshold may be set to 0.97 of the highest value obtained for the probability of compromise. In this case, all networks of POS terminals for which the values of the probability of compromise exceed 0.97 of the highest obtained value of the probability of compromise are referred to as compromised.

The results are saved.

Additionally, at step 170, a message can be generated informing about the detected compromised at least one network of POS terminals. This message may be sent by e-mail or any other known means of data transmission, or displayed on the screen through the graphical interface of the computing device.

In the above example, the POS network of the McDonald's organization will be identified as compromised.

This completes step 170 and described method 100.

On FIG. 2, the general scheme of the computing device (200) will be presented below, providing the data processing necessary for the implementation of the claimed solution.

In general, the device (200) contains components such as: one or more processors (201), at least one memory (202), data storage (203), input/output interfaces (204), I/O ( 205), networking tools (206).

The processor (201) of the device performs the basic computing operations necessary for the operation of the device (200) or the functionality of one or more of its components. The processor (201) executes the necessary machine-readable instructions contained in the main memory (202).

The memory (202) is typically in the form of RAM and contains the necessary software logic to provide the desired functionality.

The data storage means (203) can be in the form of HDD, SSD disks, raid array, network storage, flash memory, optical information storage devices (CD, DVD, MD, Blue-Ray disks), etc. The means (203) allows long-term storage of various kinds of information, such as the aforementioned files, intermediate data, lists, databases, and the like.

Interfaces (204) are standard means for connection and operation, such as USB, RS232, RJ45, LPT, COM, HDMI, PS/2, Lightning, Fire Wire, etc.

The choice of interfaces (204) depends on the specific implementation of the computing device (200), which may be a personal computer, mainframe, server, server cluster, thin client, smartphone, laptop, and the like. A keyboard may be used as data I/O (205). In addition to the keyboard, the following I/O devices can also be used: joystick, display (touchscreen), projector, touchpad, mouse, trackball, light pen, speakers, microphone, etc.

Means of network interaction (206) are selected from devices that provide network reception and transmission of data, for example, an Ethernet card, WLAN/Wi-Fi module, Bluetooth module, BLE module, NFC module, IrDa, RFID module, GSM modem, etc. With the help of means (206) the organization of data exchange over a wired or wireless data transmission channel, for example, WAN, PAN, LAN (LAN), Intranet, Internet, WLAN, WMAN or GSM, is provided.

The components of the device (200) are connected via a common data bus (210).

In these application materials, options for the preferred disclosure of the implementation of the claimed technical solution were presented, which should not be used as limiting other, private embodiments of its implementation, which do not go beyond the requested scope of legal protection and are obvious to specialists in the relevant field of technology.

Claims (30)

1. A computer-implemented method for detecting a compromise in POS-terminal networks, which includes the following steps: - receive identifiers of compromised territories; - form a database of potentially compromised networks of POS terminals; - determine the compromise parameters of at least one network of POS terminals; - determine the probability of compromising at least one network of POS terminals; - form a list of POS-terminal networks ranked by the probability of compromise; - identify at least one network of POS terminals from the ranked list as compromised. 2. The method according to claim 1, characterized in that a geographic database and a database of commercial organizations are preliminarily formed. 3. The method according to claim 2, characterized in that after receiving a set of identifiers of compromised territories, it is determined, by means of queries to a previously prepared geographic database, the country to which the received identifiers of compromised territories belong. 4. The method according to claim 2, characterized in that the compromise parameters are determined by means of queries to a pre-prepared database of commercial organizations. 5. The method according to claim 1, characterized in that the database of potentially compromised POS terminal networks includes at least: - identifiers of compromised territories; - names of organizations whose POS-terminal networks are located in the compromised territories; - addresses of retail outlets of organizations whose POS-terminal networks are located in compromised territories; - superior units of territorial-administrative division (VETAD), corresponding to the compromised territories. 6. The method according to claim 1, where the POS-terminal network compromise parameters include: - the number of identifiers of compromised territories, where at least one outlet of this organization is present, - total number of identifiers of compromised territories, - the number of outlets of this organization located in the compromised territories, - the total number of networks of outlets of this organization located in the territories of all VETADs corresponding to the compromised territories. 7. The method according to claim 1, where the probability of compromising at least one POS terminal network is determined as the product of the frequency of POS terminal networks of a given organization in compromised territories and the probability of presence of POS terminal networks of this organization in compromised territories. 8. The method according to claim 6, where the frequency of POS-terminal networks of a given organization in compromised territories is determined as the ratio of the number of identifiers of compromised territories, where at least one outlet of this organization is present, to the total number of identifiers of compromised territories. 9. The method according to claim 6, where the probability of the presence of networks of POS terminals of this organization in the compromised territories is determined as the ratio of the number of outlets of this organization in the compromised territories to the total number of outlets of this organization in the territories of all VETADs corresponding to the compromised territories. 10. The method according to claim. 1, characterized in that the network of POS terminals that has the highest value of the probability of compromise is referred to the compromised networks of POS terminals. 11. The method according to claim 1, characterized in that the compromised networks of POS terminals include all networks of POS terminals for which the calculated values of the probability of compromise exceed a predetermined threshold. 12. A system for detecting a compromise of a POS-terminal network, containing at least: - processor, - long-term memory containing: - at least one database, - machine-readable instructions, which, when executed by their processor, ensure the execution of the method according to paragraphs. 1-11.

Images