Exception Detection for ATM Transaction Status Based on a Self-Organizing Feature Mapping Model

: In order to solve these problems such as monitoring the ATM behavior of operation, exception detection for ATM transaction status and so on, in this paper we establish the detecting system of SOFM for the ATM to raise the timely alarm and reduce the false alarm rate. The results of SOFM model simulation show that the ATM transaction exceptions collected in data base can be timely and accurately detected and the false alarm rate is low. The model has high classification accuracy, which verifies its effectiveness.


Introduction
ATM (Automatic Teller Machine) is an essential device in the process of circula-ing capital, but there are some hard problems that establishing the mathematical mo-del of ATM transactional characteristic parameters and designing a network inspec-tion system to detect the conditon of ATM transactional exceptional state. According to four commo-n malfunctions of ATM (1. Branch network transmission node malfunc-tion. 2. Branch si-de parameter data change or configuration error. 3. The handling sys-tem exception in the back end of the data center. 4. The application process exception of handling system in the back end of the data center), Qing Wang [1] has established clustering analysis model to deal with the problem by the method of K-means classification. Ting Lin [2] has esta-blished transaction state anomaly detection model of multi-utility and multi-linear regre-ssion to analyze transaction success rate for getting exceptional points to make a timely alarm. However, BBO [3] is paid much attention in the clustering analysis as a new kind of intelligent algorithm. There are limitations of random selection of initial population in the traditional BBO algorithm, which makes easily algorithm to fall into the local optimu-m. Although these improved methods in [4][5] improve the optimization ability of BBO, it is hard to get a satisfied effectiveness when facing complicated data clustering tasks. As a typical representative of the method of neutral network clustering analysis, SOFM (self-organizing feature maps) which is a kind of neutral network without a tutor has a domina-ted advantage in contrast with the traditional learning neutral network with a tutor such as BP neutral network [6]. It can automatically reveal inherent laws and nature of the sam-ple, accordingly it can classify and recognize accurately the sample with approximate properties. We establish the model based on the structure and prin-ciple of SOFM [7][8], and analyze comprehensively properties of the model to provide a new thinking for detecting reasonably the anomaly condition of ATM transaction state.

SOFM Neural Network
The method of Clustering analysis is an important research way of data mining, it is the process partitioning the big data into some subsets that are different class. Moreover, data objects in the same class have a similar property, but in the different class have a conspi-cuous discrepancy [9]. SOFM that is a kind of neural network clustering method establishes a network training pattern that is not supervised and inputs automatically a large nu-mber of data into a computer and then find their inherent features by self-organizing network structure. In the space of network output nodal weight vector, Forming finally a topological distribution map that can reflect a certain regularities of distribution when data is input and that can cluster automatica-lly around the inputting pattern. While clus-tering the sample data, it has the property of maintaining topological orderliness and fea-ture extraction, and is suitable for solving various classification and identification pro-blems [10][11]. In contrast to the expected value of a known input vector based on a tutor's learning neural network, the SOFM neural network can be used to do clustering analysis without knowing the validity of the input data, so the SOFM neural network can be used to explore the nature of the problem [12].

SOFM Modeling Process [13-14]
SOFM that can learn by the offline pattern and operate by the pattern of discretization in time can divide any continuous value k x , x x x k m into p types. SOFM network searches for the optimal set of reference vectors to classify the data of re-sponse time from ATM transaction system, and each reference vector is the connection weight vector corresponding to each output unit. The connection strength between net-work input layer of m nodes and output layer of p nodes is denoted with a matrix W , where p is a category, and j w is the j th output node corresponding to the weight vector. The optimal choice for a matching unit: assume that input vector ( ) p for the neuron of SOFM net-work output j . Input vector x enter orderly one by one. when entering a vector i x , we at first search for the optimal matching unit i for its weight vector i x and j w .
The mathematical model of optimal matching unit as follow: The Self-organizing process of weight coefficient in the network, input vector , the mathematical model of weight modified in the domain of winning units as follow Where η is a study step, is a gain term, it progressively tends to 0 over time, In the self-organizing process of weight coefficient, the method getting the domain of a unit and the value of a study step have a profoundly impact on learning effectiveness. The mathematical model of the domain function The mathematical model of study step η Where 0 0 1 ≤ ≤ η , generally 0 η =0.8, T is the anticipated number of iteration which is usually two orders of magnitude or more than that of the total output unit.

Detection and Early Warning
we choose to establish SOFM model to design a set of reasonable anomaly detection scheme of transaction states and, which is composed of the following aspects.

Data Preprocessing and Analysis
We select transaction time as the feature parameter of ATM transaction status by the correlation analysis, and work out the response steady-state time of 90 millisecond by the twoorder oscillation system of ATM.

Data Preprocessing
Due to the lack of data given by commercial banks, the transaction success rate and transaction response time is empty when there is no transaction. Therefore, firstly we need to make up the data, the data for the missing time fill 0, to prepare for the subse-quent data analysis.
In order to observe whether there is a difference between the business days and the non-business days, draw the image of the trade volume between the business day and the non- x ⋯ business day to judge the difference, as shown in the figure.
As can be seen from the figure, the trading volume between working days and non-working days is ba-sically the same, with only some differences in the trading volume in the 600th to the 900th minute, but the one-day trading volumes between working days and non-working days are not significantly different. In order to facilitate the processing of data and parameter extraction, this factor is not considered in the following discussion.

Analyzing the Response Time Data of the Attachment
First, we obtain the total arithmetic mean value of the transaction time 100.7959508 = x and the standard deviation =121.8521422 σ from 23 January to 23 April by the software of SAS. According to the attached summary information, we obtain the arithmetic mean value of the transaction time, and then use the MATLAB software to its tracing point as shown in figure 2. The transaction response time of each day is compared with the response time of the second order oscillation system as shown in figure 3. we know that the transaction state deviation value of each day, especially between 55 and 60 days and 84-86 days indicates that the transaction state is poor and the exceptional condition are prone to occur. At the same time, it shows that the deviation value of two days of transaction response time is very large, indica-ting that the machine transaction state is poor and the probability of exception and ma-lfunction is high.

Correlation Analysis of Transaction Volume and
Transaction Response Time Where τ is the success rate, ψ is the transaction success, A trading volume. Because the success rate is related to the volume of the transaction, so we consider the impact of trading volume on the trading response time. First of all, SAS software was used to analyze the relationship between transaction volume and transaction response time, secondly Scatter plots and confidence ellipses were drawn. By Pr > r and significance level =0.05 α compared and combined correlation coefficient, to determine whether there is correlation between the two. From the SAS analysis results shown in figure 4, the value of Pr > r <0.001 and the correlation coefficient between x and y is -0.64946, 0.5 0.8 < < r is known as moderate correlation, so the original hypothesis correlation coefficient of 0 is not established and the daily transaction response time is related to the daily trading volume, indicating Trading volume and success rate can affect the transaction response time. Self-Organizing Feature Mapping Model

Applying to the Fuzzy Neural Network
Using fuzzy neural network, we entered transaction response time disposed per minute as a input vector into the neural network and then obtain the input value of date information.

Take Cluster Analysis
According to the input value of the fuzzy neural network, we employ the method of clustering analysis to estimate whether transaction response time is normal or not.

Response Module
We should take correspondently measures to make accurately and timely alarm as soon as possible in term of the results. As shown in the following picture.
We employ the neural network model of SOFM for the transaction response time of ATM system and the model can extract category features that are divided two kind of states normality or abnormality by the approach of self-organizing learning. There are a certain differences among the features per minute when we take 24 hours a day for tribal sample. As shown in figure 6, we obtain that the second-order oscillation re-sponse time is 90s, when ATM is in the steady state, and then the feasible zone of the weight vector of the optimal matching unit is available for the steady-state response time as shown in figure 7, so the result is that weight vectors constrain the class each hour.

Simulation Experiment
We establish the model of SOFM by MATLAB with which carry out the simulation experiment of abnormal state. Finally, MATLAB can detect and give an early alarm to the abnormal state of ATM transaction. The results have been shown in figure from 8 to 11. We know from picture 8 that the number of transactions is presented as distribution M that from 6:00 am to 10:00 am and from 12:00 noon to 15:00 pm in the up state, from 10:00 am to 12:00 noon and from 17:00 pm to 24:00 pm in the down state. Through the statistical analysis of four months for the number of transactions, we know that the number of transactions from 10:00 to 12:00 noon in January is a little bit of bigger than that of another.  The data missing and exceptional points belong to the exception of ATM transaction status, the moni-toring results of the system of SOFM network detection to ATM transaction state shown in figure 9 and 10. Concrete data table as follow. According to table 1, we can know that the rate of missing alarm and false alarm is relatively lower with SOFM model, which suggest that the model is feasible and effective to detect ATM exceptional status, and it has a relatively good advantage to accurately express some of characteristic patterns between normal status and abnormal status and is good extendibility.

Conclusion
Using trading information to detect abnormal trading status of ATM and analyzing data collected by the branch's aggregated statistical information to capture the entire ATM system's operation status and detect any anomalies or failures. It can quickly respond so that it plays an important part in improving system efficiency and reduce downtime and maintenance costs.
This article deals with a large amount of data and uses the Person correlation coefficient method to select the trading response time as a characteristic parameter of the ATM trading state. Besides, we plotted the transaction response time of each minute each day and found that the transaction response time was automatically clustered, resulting in some abnormalities. Therefore, the establishment of SOFM ATM transaction status monitoring in real time. After the system simulation, we obtained that the abnormal number of ATM transactions in each period from January to April and the distribution of the actual data. Finally, the SOFM simulation results showed that the false positive rate was 2.038% in January and the missed rate was 0.463‰, the false positive rate in February was 2.116% and the omission rate was 0‰. The false positive rate in March was 1.261% and the missed rate was 0.067‰. The false alarm rate in April was 2.217% and the missed rate was 0.543‰. From the above results, we can see that the SOFM network can extract the statistical characteristics of the detection data more accurately, and the detection rate of ATM abnormal state is high, and the missed reporting rate and false alarm rate are relatively low. In order to make SOFM model good generality and higher detection accuracy, we take some measures to further parameter repair of SOFM model. According to the constructed SOFM network model, the reader can make the following points from the data collection aspect: assume that we collect the date change along with the value of weight vector. We detect the status of ATM transaction system by SOFM model. The training process of ATM response time shown in figure 11.
We know that the gradient of training process is 9.2357e-06 mainly due to the number of ATM transactions and weight vectors. So we assume that weight vectors collected with the change of the number of transactions can reduce the gradient to make the optimal matched unit steadier.
1. assume that we can collect data from the load working state of ATM back-end processing system. The deviation analysis of the SOFM model for ATM detection shown in figure 12. We can know from figure 12 above that there are some deviation in ATM transaction system to information units after outputting and handling customer information. So the assumptive data can make up the processing capacity deviation of the back-end system in the case of many customers.
2. assume that we can collect the data on environmental factors that have an influence on ATM transa-ction response time such as noise temperature and humidity.
The simulation of SOFM model for ATM transaction system shown in figure 13. We can know from figure 13 that the deviation is 0.083333 compared to the optimal training state. Therefore, the early stage is unstable and is in self-organizing training mode. But we can improve the phenomenon by using the assumptive data.