Detection of false data injection in point-of-sale systems during credit card transactions using tuned deep learning models and oversampling techniques

Introduction

Recently, credit card fraud increases due to the growth in digital transaction and free WIFI access at various sales counters such as malls, theatre, and hospital. Credit card fraud leads to financial losses for seller and credit card owner. The different types of credit card fraud are card-not-present (CNP) fraud, credit card application fraud (CCAF), account takeover, credit card skimming, and lost or stolen cards. In CNP fraud, scammers steal cardholder’s personal information and used for purchase. CNP fraud prevention is difficult because there is no physical card-based transaction during purchasing. CCAF fraud is undetected until the person checks his credit report because scammers use stolen credit card holders’ personal information such as name, address, birthday, and social security numbers for applying the credit cards. CCAF damages to the cardholder’s credit score. Account takeover fraud is defined as scammers directly contacts the credit card companies and changes the cardholder’s passwords and PIN numbers. Scammers handle the account until the cardholder logs for next to purchase. In credit card skimming, skimmers attach a magnetic strip to the back of the credit card and steals the credit card information. The skimmers sell the credit card information to other scammers. Lost or stolen credit card fraud is using the stolen/lost credit card.

Credit card attacks refer to unauthorized access or fraudulently using credit card information. Credit card attacks are carding, phishing, data breaches, carding bots, card testing, and bin attack. In carding (Peretti, 2008) refers to the usage of stolen credit card information for unauthorized access or purchase. Phishing attackers sends a fake message to the cardholder and gets credit card numbers and passwords. Phishing attack (Parvesh et al., 2023) is prevented through 2-step verification when the credit card number is entered for online transaction. Credit card data breach occurs due to access of card by an unauthorized person. The data are name, address, card number, expiration date, and CVV number (Agarwal & Usha, 2023). The credit card data breach is avoided through secure and frequent update of password, two-step authentication, automatic reissuing the credit card, when the card meets a lower social cost (Graves, Acquisti & Christin, 2018), and freezing the credit card due to unauthorized transactions. Carding bots are automated programs or scripts, which test bulk credit card numbers on e-commerce sites and identifies the valid credit card number and used for unauthorized purchases without manual verification (Alarfaj et al., 2022). A bank identification number (BIN) attack is an act of guessing the combination of credit card number, card verification value, and expiry date using brute force computing. Brute force computing will directly target the bank identification number.

Credit card server attack is the unauthorized access to the servers, systems, or networks, while processing or storing credit card information. There are some common types of credit card server attacks such as SQL injection attacks, distributed denial of service attacks (DDoS), man in the middle (MiTM) attacks, data interception, brute force attacks, server exploits, remote code execution, malware and rootkits, and insider threats. An SQL injection attack allows an attacker for interaction with the database, steals or deletes the information (Crespo-Martínez et al., 2023). In DDoS attack, overload the network or server with traffic and interrupt the payment processing on the server (Hasan et al., 2023). The MiTM attack attacker interrupts the communication between the client and server, accesses the credit card details during the transaction. A data interception attack indicates unauthorized access to the credit card details. There are three different methods of data interception such as direct observation, interception of data transmission, and mechanical interception. Server exploit server software programs misconfigure the unauthorized credit card data stored. An attacker executes malware code, such as keyloggers or rootkits, and provides backdoor access to attackers.

FDI is called as data tampering attack. An attacker injects false data into the system or database. FDI occurs in point-of-sale terminals, payment gateways, and databases. Attacks change the amount of the transaction and payment method, and redirect funds to their accounts. During an online transaction, the attackers interfere with the confirmation page or email receipt and redirect the payment to their account. Attackers may cause a denial of service by injecting false data into the system, which leads to financial losses. False data is injected into account balances. This attack leads to credit and permits unapproved transactions. Attackers inject false data into chargebacks, which leads to financial losses for card holders and creates problems for card holders.

People have lost billions of dollars because of fraudulent transactions. People purchase things through online, they pay their bills through online. and conduct their banking transactions online as well. Increase in online business leads to an increase in online fraud. Online rule-based systems are used for detection of online fraud. The systems detect fraud through handcrafted rules by human specialists. The rule-based system detects static, fraudulent behavior in people. However, Amazon Web Services offers an online fraud detection system via Amazon Sage Maker. Amazon Sage Maker effectively creates a dynamic, self-improving, and maintainable fraud detection system. To detect anomalies, Amazon Sage Maker employs an unsupervised Random Cut Forest (RCF) unsupervised learning algorithm. To make predictions, the model employs the XG Boost model. The RCF model gives a low score to normal transactions and a high score to fraudulent transactions. To address highly unbalanced data, a Sage maker Boost model is used, which access synthetic minority oversampling. Amazon Sage maker needs data scientist to train the model to detect fraud.

Online retailers such as Amazon use different type of techniques for credit card fraud detection. Credit card attack prevention methods are secure websites, multi-factor authentication (MFA), account monitoring, address verification, payment verification, machine learning algorithms, location tracking, seller verification, two-step verification, and phishing awareness. Amazon has secure socket layer, which ensure secure data transmission. Amazon provides a one-time passcode, password for account protection and monitors unusual user account behaviour. Amazon provides billing address verification and payment verification to credit card holders through transferring of small amount. Amazon detects fraudulent transactions and tracks their location in unfamiliar areas using a predefined machine learning algorithm. Amazon verifies transactions from third-party sellers. Amazon provides phishing awareness to customers to identify fraudulent emails or websites.

The credit card is used in different methods such as card chip insertion, tap to pay, card swipe, and manual entry. During the transaction, the cardholder details are verified through application identifiers (AID), the cardholder verification method (CVM). The card details are encrypted and sent through the payment gateway to route them to the appropriate payment processor. The payment processor checks the initial six or eight digits of the card or account range to decide the services such as the transaction details. The processor, along with the payment switch, is responsible for determining the card network, routing the transaction, and sending the right message format. Fraudulent transactions are detected through the payment gateways such as PayPal, Amazon Payment, and Google Pay. However, payment gateways provide limited fraud detection techniques which are vulnerable to attack. Normally, Attacks happen in any card reader machine (i.e.,) point-of-sale system (POS), when longer time required for processing the transaction through the payment gateway.

The client swipes the card through the POS system. The POS system is linked to Wi-Fi network. The payment gateway gathers and transmits transaction information to the merchant’s bank’s computer control system. Through credit card interchange (CCI), the bank processor forwards the verification process, such as processing, clearing, and settlement. The CCI sends the information to the credit card provider’s computer control system. Based on the available funds on the credit card, the card provider accepts or rejects the transaction and sends the transaction details back to the CCI. The CCI sends the information back to the merchant computer control system. The merchant computer control system sends transaction information to the payment gateway. The payment gateway sends transaction information to the client via the POS system. CCI transfers the required funds via merchant bank account. As a result, Fig. 1 shows the overall processing of a credit card transaction. The different hardware attacks on the microcontroller of the POS system are side channel attack (SCA), read-out protection bypass attack (RB), and control flow manipulation (CFM) attacks lead to false data injection. To avoid these problems, attacks detected earlier through deep learning and machine learning techniques. Early detection attacks need to be detected and prevents attacks in POS. The POS is vulnerable to attack due to free WIFI access to the customers in the sales counters. Attack uses the free WIFI access to steal the information during credit card transactions.

Literature survey

POS attacks are classified into three types such as keyloggers, memory dumpers, and network sniffers. Retail transactions are performed through POS systems. Attacker steals personal information from electronic payment cards, such as debit and credit cards during transaction through POS. False data injection are defined as injecting false data into the system leads to financial loss and physical infrastructure damage. FDI in POS machine is performed through hardware attack i.e., microcontroller during transaction time. FDI is performed through side channel attacks where private keys from the POS physical are stolen and false data injected into the POS machine. Readout bypass protection attack bypasses read out protection mechanism in POS machine and inject false data into the machine. Control flow manipulation attack manipulates control flow in POS, runs arbitrary code and inject false data.

Table 1 depicts the various types of attacks and their detection techniques in various hardware systems such as microcontrollers and smart grid systems using machine learning and deep learning models.

Materials and Methods

Hardware attack in PoS system is shown in Fig. 2 and proposed detection methods to detect the FDI attack are shown in the Fig. 2. Wi-Fi attacker injects false data into the microcontroller of swiping machine through free WIFI access. WIFI attacker alters the voltage, and power consumption in microcontroller of PoS through SC, RB and CFM. During false data injection, time delay occurs in payment gateway of PoS. Moreover, the time delay occurs at merchant bank/computer control system. An attacker uses time delay to steal the information from computer control system. The transaction log stores all transaction details. Hence, we proposed tuned deep learning-based model to analyse the transaction log details. To avoid unbalanced data oversampling techniques are combined with tuned deep learning models to detect FDI.

Tuned architecture for credit card fraud detection

Tuned architecture for credit card fraud detection are (i) RS-ANN (ii) BO-CNNLSTM (iii) HB-AE. Figure 3 shows the tuned deep learning architecture for credit card fraud detection. The fine-tuning models save time and resources, lower data requirements, handle data scarcity, provide superior performance, and provide access to unavailable domains. Figure 3 shows the layer tuned architecture for credit card fraud detection.

The credit card dataset is imbalanced, with only 0.2% of transactions being fraudulent. This imbalance leads to reduced accuracy and increases the risk of overfitting. To address this issue, oversampling techniques are applied to balance the dataset. Attackers frequently change their tactics for credit card fraud, making real-time detection challenging. Therefore, optimized deep learning models, such as RS-ANN, BO-CNN, LSTM, and HB-AE, are used for credit card fraud detection. Table 3 presents the tuned parameters of the optimized deep learning model and their impact on false data injection through PoS hardware.

Table 3:

Tuned Hyperparameters and its interpretation in optimized deep learning model.

RS-ANN	BO-CNNLSTM	HB-AE
Hyperparameters i. Number of neurons = 32 ii. Dropout rate = 0.5	Hyperparameters i. Number of filters = 64 ii. Hidden LSTM units = 32	Hyperparameters i. Encoder Filter = 16 ii. Decoder Filter = 32
Layers i. Input layer ii. Dense Layer iii. Dropout Layer iv. Dense Layer-Output	Layers i. Input Layer ii. Conv 1D iii. LSTM Layer iv. Dense Layer-Output	Layers i. Input Layer ii. Encoder unit iii. Decoder unit iv. Output Layer
Interpretations 1. Shallow network 2. Random search 3. No feature extraction	Interpretations 1. Hybrid model 2. Sequential and temporal features extraction 3. Scalable depends on feature length	Interpretations 1. Unsupervised model 2. Limited feature extraction 3. Complex and overfit

DOI: 10.7717/peerj-cs.3279/table-3

Results

The dataset variables such as running duration, power consumption, memory access, voltage glitching, kind of fraud, distance from home, distance from the last transaction, ratio of the median purchase retailer, repeat retailer, used chip, used pin number, and online order.

Analysis of unbalanced data with and without tuned deep learning architecture

Performance analysis of unbalanced data without tuned layers of deep learning architectures such as ANN, CNN-LSTM and Auto encoder are shown in Fig. 4 which detects the false data injection in PoS during credit card transaction. Credit card fraud detection dataset is divided into 70% training and 30% testing set. The layers are not tuned in deep learning architecture such as ANN, CNN-LSTM and AE. Hence, the above existing models have overfit during the training data. Training data achieves high accuracy, precision, recall value compared to testing data. From Fig. 5, the proposed BO-CNN-LSTM achieves better accuracy, precision, recall value compared to existing models, which captures long term dependencies of data and captures spatial and temporal features. Figure 5 shows the confusion matrix of unbalanced dataset through tuned deep learning model.

Discussion

The performance metrics for BO-CNN LSTM, RS-ANN, and HB-AE models under false data injection attacks are shown in Table 11. In comparison to the other models, BO- CNN LSTM shows slightly greater robustness to perturbations in both the original and false injected data. When compared to the other models, the BO-CNN LSTM shows the highest FDIDR (perfect detection rate) and lower FAR, which indicates the superior detection performance. BO-CNN LSTM model reduces 0.2% detection accuracy after injecting false data into the PoS machine. BO-CNNLSM requires 15 min to detect the false data injection attack.

Conclusions

POS hardware attack increases of false data injection attacks (FDIA) in credit card transactions. A rise in data breach vulnerabilities leads to financial losses, business interruptions, and reputational damage to companies. These attacks manipulate transaction data through taking advantage of hardware defects such as side-channel, readout bypass, and control flow weaknesses to change transaction amounts or steal personal data. To detect the attack, we propose hybrid artificial intelligence techniques such as machine learning and deep learning models into the POS machine dataset analysis. The innovative proposed models are BO-CNN-LSTM RS-ANN and HB-AE, which detects FDI in POS machine during transaction. The proposed models perform better than traditional models. BO-CNN-LSTM model performs well when combined with SMOTE, quickly and precisely identify fraudulent transactions and FID. However, the proposed tuned deep learning models with oversampling techniques achieved high accuracy of about 98%, precision of about 94%, recall of about 96%, and F1-score of about 96%. In the future, we will extend our model to detect FDI attacks in POS systems. We will utilize characteristics inspired by the Stuxnet worm, a modular malware that targeted industrial control systems. Stuxnet employed zero-day exploits and altered system behavior without detection. Therefore, we have developed a method to detect hidden and complex FDI threats similar to those used by Stuxnet in side channels and RAM memory.

Supplemental Information