CN101702801A - Short message monitoring method and system - Google Patents
Short message monitoring method and system Download PDFInfo
- Publication number
- CN101702801A CN101702801A CN200910236995A CN200910236995A CN101702801A CN 101702801 A CN101702801 A CN 101702801A CN 200910236995 A CN200910236995 A CN 200910236995A CN 200910236995 A CN200910236995 A CN 200910236995A CN 101702801 A CN101702801 A CN 101702801A
- Authority
- CN
- China
- Prior art keywords
- user
- monitoring
- short message
- thresholding
- user class
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 226
- 238000000034 method Methods 0.000 title claims abstract description 32
- 235000019580 granularity Nutrition 0.000 description 48
- 230000008569 process Effects 0.000 description 13
- 230000000630 rising effect Effects 0.000 description 8
- 230000006399 behavior Effects 0.000 description 7
- 230000006870 function Effects 0.000 description 7
- BQCADISMDOOEFD-UHFFFAOYSA-N Silver Chemical compound [Ag] BQCADISMDOOEFD-UHFFFAOYSA-N 0.000 description 6
- 229910003460 diamond Inorganic materials 0.000 description 6
- 239000010432 diamond Substances 0.000 description 6
- PCHJSUWPFVWCPO-UHFFFAOYSA-N gold Chemical compound [Au] PCHJSUWPFVWCPO-UHFFFAOYSA-N 0.000 description 6
- 229910052737 gold Inorganic materials 0.000 description 6
- 239000010931 gold Substances 0.000 description 6
- 229910052709 silver Inorganic materials 0.000 description 6
- 239000004332 silver Substances 0.000 description 6
- 150000001875 compounds Chemical class 0.000 description 5
- 230000005540 biological transmission Effects 0.000 description 4
- 238000010586 diagram Methods 0.000 description 4
- 230000008901 benefit Effects 0.000 description 3
- 230000008878 coupling Effects 0.000 description 2
- 238000010168 coupling process Methods 0.000 description 2
- 238000005859 coupling reaction Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 230000004044 response Effects 0.000 description 2
- 206010033799 Paralysis Diseases 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000007423 decrease Effects 0.000 description 1
- 230000002950 deficient Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
- H04L51/21—Monitoring or handling of messages
- H04L51/212—Monitoring or handling of messages using filtering or selective blocking
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
- H04L51/58—Message adaptation for wireless communication
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Telephonic Communication Services (AREA)
Abstract
The invention provides a short message monitoring method comprising the following steps: counting the number of short messages sent by users; during a time granularity, recording user information of the users after the number of the short messages sent by the users reaches the threshold monitored according to the flow within regular duration and recording all short messages sent by the users within regular duration before the ending time of the time granularity is after the time granularity ends; calculating all recorded short messages and marking the users as suspicious users when the calculated value reaches a user level monitoring threshold corresponding to the user level attribute of the users; and displaying the user information of the suspicious users. The invention also provides a short message monitoring system. The invention introduces the user level monitoring based on the flow monitoring and achieves the aim for monitoring high-end users and low-end users at the same time.
Description
Technical field
The present invention relates to the SMS monitoring field, more specifically, relate to a kind of short message monitoring method and system.
Background technology
At present, the message center function of communication field is grown in strength day by day: range of application is from short message service center, to the Multimedia Message center, again to the mail center; And the user is also increasing; The means that each operator, profit group and individual utilize message center to carry out sales promotion also emerge in an endless stream; That interconnects between each network is movable like a raging fire; The online size of message that flows also becomes geometric growth thereupon.Under this market environment, inevitably a large amount of rubbish messages, malicious messages, advertisement information etc. can occur, and the collective or the individual that send these message just are considered to suspicious user, or even the black list user.A large amount of rubbish messages in short time can cause the operating environment paralysis of operator; Some malicious user even utilize the delay of operator's charge system sends a large amount of short messages, and then makes operator suffer huge economic loss near arrearage the time.Moreover, frequent waste advertisements, malicious messages also can make the user tired tired very.
Given this, the junk short message supervisory control system is also just arisen at the historic moment, and its function mainly is automatically to find suspicious user according to a large amount of short messages of being monitored, and then limits the behavior that suspicious user sends SMS message.Though the junk short message supervisory control system of a lot of commercializations is arranged in the market, but with regard to its Core Feature " discovery suspicious user ", the foundation of judging is still fairly simple, usually all be based on the regular size of message of judging that the user sends in the unit interval of monitoring and whether reached default monitoring thresholding, if, think that then this user is suspicious user (Yu She monitoring thresholding and the length of unit interval are all stipulated by the monitoring rule) here, and then limit the behavior that this suspicious user sends SMS message.The defective of this method for supervising is that it is suspicious user that high-end user also will be mistaken as, and its behavior that sends SMS message also will be restricted.Promptly, existing systems can't satisfy the demand that high-end user and malicious user are monitored simultaneously, if will avoid high-end user erroneous judgement is suspicious user, just high-end user can only be added that white list is not monitored or at high-end user special rules is set evades the monitoring that it is carried out.But along with the increase of white list number of users, the monitoring threshold of junk short message supervisory control system also decreases, and a lot of users are had an opportunity to take advantage of.And the increase of special rules had both influenced the overall performance of junk short message supervisory control system, also made the junk short message supervisory control system become complicated.
Summary of the invention
In view of this, main purpose of the present invention is to provide a kind of short message monitoring method and system, too simple to solve in the current short message monitoring system for the strategy of catching suspicious user, can't satisfy the problem of the monitoring demand of high-end user and malicious user simultaneously.
For achieving the above object, technical scheme of the present invention is achieved in that
A kind of short message monitoring method comprises:
The short message number that the user sends is counted, when in a time granularity, after the short message number that the user sends reaches the interior thresholding by traffic monitoring of regular duration, after described time granularity finishes, write down all short messages that described user sends in the regular duration before of described granularity concluding time;
Described all short messages being calculated, prescribe a time limit when the value that calculates reaches the user class control door corresponding with described user's user class attribute, is suspicious user with described user ID.
The described short message number that the user is sent also comprises before counting:
Configuration is monitored thresholding corresponding to the user class of user class attribute and is disposed at least one monitoring rule;
Wherein, described monitoring rule comprises: by thresholding, regular duration and the time granularity of traffic monitoring, described regular duration is the integral multiple of described time granularity in the regular duration.
When disposing many monitoring rules, the described short message number that the user is sent is counted, and comprising:
Each monitoring rule based on configuration is counted the short message that the user sends respectively.
Described each monitoring rule based on configuration is counted the short message that the user sends respectively, comprising:
Take out a monitoring rule, the short message that the user sends is counted, when determining to exist other monitoring rules, take out a monitoring rule once more, the short message number that the user sends is counted based on this monitoring rule based on this monitoring rule.
Described all short messages are calculated, comprising:
All short messages that described user is sent in a regular duration calculate;
Inquire about described user's user class attribute;
User class monitoring thresholding according to the described user class attributes match correspondence that inquires;
Described value that calculates and described user class monitoring thresholding are compared.
A kind of short message monitoring system comprises:
The initial analysis module, be used for the short message number that the user sends is counted, when in a time granularity, after the short message number that the user sends reaches the interior thresholding by traffic monitoring of regular duration, after described time granularity finishes, write down all short messages that described user sends in the regular duration before of described granularity concluding time;
The subsequent analysis module is used for described all short messages are calculated, when reaching the user class control door corresponding with described user's user class attribute, the value that calculates prescribes a time limit, and be suspicious user with described user ID.
Described system also comprises:
Configuration module is used to dispose corresponding to the user class of user class attribute and monitors thresholding and dispose at least one monitoring rule;
Wherein, described monitoring rule comprises: by thresholding, regular duration and the time granularity of traffic monitoring, described regular duration is the integral multiple of described time granularity in the regular duration.
During many monitoring rules of described configuration module configuration, described initial analysis module specifically is used for:
Each monitoring rule based on configuration is counted the short message that the user sends respectively.
Described subsequent analysis module comprises:
Computing unit is used for all short messages that described user sends in a regular duration are calculated;
Query unit is used to inquire about described user's user class attribute; And
Matching unit is used for the user class monitoring thresholding according to the described user class attributes match correspondence that inquires;
Comparing unit is used for described value that calculates and described user class monitoring thresholding are compared, when reaching the user class control door corresponding with described user's user class attribute, the value that calculates prescribes a time limit, and be suspicious user with described user ID.
Described system further comprises:
Display module is used to show the user profile of described suspicious user.
Beneficial effect of the present invention:
By introducing the user class attribute, can treat with a certain discrimination according to the user class attribute at all users, the user of different stage will be provided with different user class monitoring thresholdings, so both can monitor effectively the high-end user that needs send a large amount of short messages, can reach low end subscriber of restriction or malicious user again and distribute the purpose of junk short message indiscriminately, and then avoid because the situation that the not monitored certain customers that cause of white list user have an opportunity to take advantage of.In a word, the user of different stage corresponding to different user class monitoring thresholdings, has so just reached the monitoring effect of more fully catching suspicious user, has also improved the overall performance of short message monitoring system simultaneously.
Description of drawings
Fig. 1 is the flow chart according to the short message monitoring method of exemplary embodiment of the present invention;
The flow charts of Fig. 2 for counting according to the short messages that the user sent based on many monitoring rules of exemplary embodiment of the present invention;
Fig. 3 is the schematic diagram according to the short message monitoring system of exemplary embodiment of the present invention;
Fig. 4 is the configuration diagram according to the short message monitoring system of exemplary embodiment of the present invention;
Fig. 5 is according to exemplary embodiment of the present invention, the flow chart that the short message that the user is sent carries out the user class monitoring.
Embodiment
For convenience of description, at first define several nouns:
1. time granularity: be used for representing the time span set, it was the base unit of monitor duration, as 10 minutes, 1 hour etc.
2. granularity time started: the zero-time of time granularity.
3. granularity concluding time: the zero-time of time granularity adds time granularity.
4. regular duration: the monitor duration of a monitoring rule must be the multiple of time granularity, and it is unit of account with the time granularity.For example 1 time granularity, 2 time granularities etc.Therefore can include one or more time granularities in a regular duration.
5. by traffic monitoring: promptly the short message amount in the regular duration is monitored, it is basic as monitoring with the thresholding by traffic monitoring that sets in advance, and is divided into simple traffic monitoring and compound traffic monitoring.Simple traffic monitoring is meant that mainly the thresholding by traffic monitoring that directly will set in advance monitors as suspicious thresholding, promptly the short message amount that sends in regular duration as the user is more than or equal to by the thresholding of traffic monitoring the time, just think that relative users is a suspicious user, and then limit the behavior that suspicious user sends SMS message.Compound traffic monitoring is meant on the basis of simple traffic monitoring carries out follow-up monitoring in conjunction with monitoring type, judge at first promptly whether short message amount that the user sends reaches the thresholding by traffic monitoring in regular duration, reaching on this basis by the thresholding of traffic monitoring, according to different monitoring type the short message that has monitored is carried out follow-up monitoring again in regular duration, in the process of follow-up monitoring, relate to the problem of monitoring type, monitoring type is one of necessary attribute in each bar monitoring rule, indicate that this monitoring rule is based on which kind of type is provided with, for follow-up monitoring, it monitoring type that comprises can be for exhaling frequency monitoring by rising, frequency monitoring according to keywords, continuity monitoring according to number etc.
6. follow-up monitoring: by traffic monitoring, follow-up monitoring is after a time granularity finishes with respect to real-time, and all short messages that the user who violates simple traffic monitoring in this time granularity is sent in regular duration are judged further and analyzed.
7. father's rule: in the rule cluster,, claim that then regular A is father's rule of regular B before regular B if regular A need carry out.Simple traffic monitoring rule is exactly father's rule of follow-up monitoring.
8. sub-rule: in the rule cluster,, claim that then regular A is the sub-rule of regular B after regular B if regular A need carry out.Follow-up monitoring is exactly the sub-rule of simple traffic monitoring rule.
9. blacklist: surpass certain thresholding or send the user definition that keyword surpasses thresholding and be the black list user for sending number of times within a certain period of time, this user will be closed Short Message Mobile Originated.
10. white list: not monitored user, promptly this user how to send SMS message can be not monitored.
Basic thought of the present invention is: at first, based on the monitoring rule short message number that the user sends is counted, in a time granularity, when the short message number that the user sends reaches in the regular duration by the thresholding of traffic monitoring, after this time granularity finishes, write down all short messages that the user sends in this granularity concluding time regular duration before; Secondly, all short messages that write down being calculated, prescribe a time limit when the value that calculates reaches the user class control door corresponding with user's user class attribute, is suspicious user with this user ID.
Below with reference to the accompanying drawings and in conjunction with exemplary embodiment, describe the present invention in detail.
Fig. 1 shows the flow chart according to the short message monitoring method of exemplary embodiment of the present invention, comprising:
S100, configuration is monitored thresholding corresponding to the user class of user class attribute and is disposed at least one monitoring rule, wherein, the monitoring rule comprises: press thresholding, regular duration and the time granularity of traffic monitoring in the regular duration, and regular duration is the integral multiple of time granularity.
For user class monitoring thresholding, because the user class attribute can comprise: diamond card user, gold card user, silver card user and generic card user, correspondingly, user class monitoring thresholding can comprise: diamond card user thresholding, gold card user thresholding, silver card user thresholding and generic card user thresholding, and above four kinds of user classs monitoring thresholding reduces successively.If the monitoring rule of configuration be many,, be different by at least one item in three of the thresholdings of traffic monitoring, regular duration, time granularity for different monitoring rules.For example, dispose two different monitoring rules, wherein the parameter of monitoring rule configuration is: the thresholding by traffic monitoring is 100 short messages, and regular duration is 10 minutes; The parameter of another monitoring rule configuration is: the thresholding by traffic monitoring is 200 short messages, and regular duration is 15 minutes.
S102 takes out a monitoring rule from least one monitoring rule of above-mentioned configuration.This monitoring rule of taking out will provide foundation for following counting process.
S104 counts the short message number that the user sends, and whether the real-time judge short message number that the user sends in a time granularity reach in the regular duration thresholding by traffic monitoring, if then carry out S106; If not, then finish.
S106 writes down this user's user profile, and after time granularity finishes, writes down all short messages that the user sends in the granularity concluding time regular duration before.
Particularly, can finish the record of user profile by the mode of user profile being utilized database management module insert database; Can finish the record of short message equally by the mode of all short messages being utilized database management module insert database.
This process can be thought the simple traffic monitoring in the aforementioned compound traffic monitoring, judges just promptly whether short message number that the user sends in regular duration has reached the thresholding by traffic monitoring.In this process, all users' counting process is all carried out in flow counting memory bank, it is the counting record of preserving the user in the flow memory bank, so, before counting, carry out the initialization setting to user's counting record, if there is not this user's counting record in the flow counting memory bank, also need generate this user's counting record before initialization is provided with in this flow counting memory bank, the short message number that after being used for this user is sent is counted.
S108 calculates all short messages that write down, when reaching the user class control door corresponding with this user's user class attribute, the value that calculates prescribes a time limit, and be suspicious user with this user ID.
This process can be thought follow-up monitoring, promptly on the basis of simple traffic monitoring, again the short message that has monitored is carried out the user class monitoring in regular duration.In this step, need inquire about in real time user's user class attribute, and the user class attribute that inquires and user class monitoring thresholding to be mated, mate as diamond card user coupling diamond card user thresholding, gold card user that gold card user thresholding, silver card user mate silver card user thresholding, generic card user is mated generic card user thresholding.And the process of inquiring user level attribute is to realize by the socket interface that business operation support system (BOSS) provides.
S110 shows the user profile of described suspicious user.For suspicious user, its behavior that sends SMS message will be restricted, and the user profile of this suspicious user can be revealed.
The preferred embodiment is being pressed on the basis of traffic monitoring, introduced follow-up user class monitoring, for the user of different stage is provided with different user class monitoring thresholdings, for high level user, its user class is monitored the higher relatively of threshold setting, promptly allows the short message of transmission also more in corresponding control and monitoring; And for low-level user, its user class is monitored the also lower of threshold setting, so in control and monitoring, allow the short message of transmission also corresponding less, so just the demand of simultaneously short message that high-end user and malicious user sent being monitored can be satisfied, and then suspicious user can be more fully caught.
From the S100 of above-mentioned short message monitoring method as can be seen, the monitoring rule of configuration can be many.When having disposed many monitoring rules, will count the short message that the user sends respectively based on each monitoring rule.For the situation that has many monitoring rules, this short message monitoring method will be further described below in conjunction with Fig. 2 the process that certain user carries out the flow counting.As shown in Figure 2, when having many monitoring rules, the process that the short message of user's transmission is counted comprises:
S204-2 obtains short message controlled structures body from short message service center, has parsed according to this short message controlled structures body and has exhaled Subscriber Number;
S204-4, analysis module take out a monitoring rule from many monitoring rules;
S204-6 works the short message of exhaling the user to send based on the monitoring rule to this and counts, and promptly this exhales the user to add one (counter does not overflow under the normal condition) in the count value of this monitoring rule of this time granularity;
S204-8 judges whether this count value reaches the thresholding by traffic monitoring, if reach, then continues to carry out S204-10, if do not reach, then continues to carry out S204-12;
S204-10, write down this and work the Subscriber Number of exhaling the user, and after this time granularity finishes, all short messages that the user sends in the regular duration of record before the granularity concluding time can be taked that specifically this Subscriber Number and all short messages are sent to the database management operation module and finish mode of inserting database manipulation by it and realize;
S204-12 judges whether to exist other monitoring rules, if then turn back to S204-4.
By the preferred embodiment, realized in process by traffic monitoring, can dispose many monitoring rules the short message that the user sends is monitored, so just improved the dynamics of monitoring effectively.
Can know that from the description of front the monitoring type that follow-up monitoring comprises has multiple, can be for exhaling frequency monitoring, frequency monitoring according to keywords, continuity monitoring according to number etc. by rising.So, will short message monitoring method being further described with monitoring type for to exhale frequency monitoring be example by rising below, this method comprises:
S300 at first, monitors the configuration of rule on the human-computer interaction interface of SMS monitoring, comprise configuration father rule-by the thresholding of traffic monitoring, promptly just carries out follow-up monitoring in regular duration after short message that a certain number sends reaches this value; Then dispose sub-rule-user class and monitor thresholding, certainly, in this embodiment, the monitoring type of sub-rule is for exhaling frequency monitoring by rising, that is, it is a user class monitoring thresholding of exhaling frequency monitoring by rising that other user of each grade will dispose a monitoring type.After configuration is finished, give analysis module and database management operation module synchronously with the above-mentioned parameter that configures.
S302, counting record to user in the flow counting memory bank carries out the initialization setting, if there is different monitoring rules, the counting record of counting based on each rule all will carry out the initialization setting, certainly, if there is not this user's counting record in the flow counting memory bank, then will be at the counting record that in flow counting memory bank, generates this user before the initialization.
S304 obtains note controlled structures body to be monitored, must comprise user profile such as exhaling Subscriber Number, message body in this structure.
S306, the note controlled structures body according to obtaining has parsed and has exhaled Subscriber Number, and exhales Subscriber Number to count based on regular the rising at this of each monitoring in time granularity internal liquidity counting memory bank.
S308, when in a time granularity, count value in the flow counting memory bank reaches father's rule of sub-rule-user class monitoring thresholding (monitoring type is for exhaling frequency monitoring by rising in this specific embodiment)-by behind the thresholding of traffic monitoring, promptly this user's user profile is sent to the database management operation module and carry out the physical database warehouse-in, purpose is to write down this user's user profile.
S310, when arriving the described granularity of S308 after the concluding time, all short messages that user in the regular duration before this granularity concluding time is sent carry out record, be about to all short message notification database management operation modules that this user promptly sends in regular duration in falling back the time range of a regular duration forward in this granularity concluding time and this granularity concluding time, the database management operation module can be inserted database with all short messages.
S312, the socket interface that the database management operation module provides by business operation support system (BOSS), inquire about this user's user class attribute in real time, after waiting for the BOSS response, and, mate as diamond card user coupling diamond card user thresholding, gold card user that gold card user thresholding, silver card user mate silver card user thresholding, generic card user is mated generic card user thresholding according to the user class of the user class attributes match correspondence that inquires monitoring thresholding.
S314, database management operation module invokes storing process takes out all short messages that this user sends in the physical database and calculates in a regular duration, for exhale for the frequency monitoring by rising, need all short messages are carried out read group total herein, and whether the value that judging sues for peace obtains has reached this user's the pairing user class monitoring of user class attribute thresholding, if reach then be suspicious user with this user ID, and the user profile of this suspicious user is sent to display module show that its behavior that sends SMS message will be restricted.If do not reach, show that then relative users is not a suspicious user, can not limit its behavior that sends SMS message.
Related user class monitoring is the follow-up monitoring in the compound traffic monitoring in the preferred embodiment, it is not only applicable to monitoring type has been the monitoring of exhaling the frequency, be equally applicable to monitoring type and be other compound traffic monitorings such as frequency monitoring according to keywords, continuity monitoring according to number, we are described no longer one by one at this.
Fig. 3 shows the schematic diagram according to the short message monitoring system of exemplary embodiment of the present invention.As shown in Figure 3, this system comprises: configuration module 300, be used to dispose corresponding to the user class of user class attribute and monitor thresholding and dispose at least one monitoring rule, wherein, the monitoring rule comprises: thresholding, regular duration and the time granularity of pressing traffic monitoring in the regular duration, and regular duration is the integral multiple of time granularity, and the monitoring rule that will configure sends to initial analysis module 304 and the user class monitoring thresholding that configures is sent to subsequent analysis module 308; Initial analysis module 304, be used for the short message number that the user sends is counted, when in a time granularity, after the short message number that the user sends reaches the interior thresholding by traffic monitoring of regular duration, the user profile of recording user, and after this time granularity finished, all short messages that the user sends in the regular duration before the record granularity concluding time also sent to subsequent analysis module 308; Subsequent analysis module 308 is used for all short messages are calculated, when reaching the user class control door corresponding with user's user class attribute, the value that calculates prescribes a time limit, and be suspicious user with user ID; Display module 310 is used to show the user profile of suspicious user.
The preferred embodiment has increased subsequent analysis module 308, promptly introduced follow-up user class monitoring, for the user of different stage is provided with different user class monitoring thresholdings, so both can monitor effectively the high-end user that needs send a large amount of short messages, can reach low end subscriber of restriction or malicious user again and distribute the purpose of junk short message indiscriminately, so just realized improving the purpose of supervisory control system reliability, it is disconnected also to have reduced erroneous judgement simultaneously.
When configuration module 300 has disposed many monitoring rules, initial analysis module 304 specifically is used for respectively the short message that the user sends being counted based on each monitoring rule of configuration, more specifically, take out a monitoring rule, respectively the short message that the user sends is counted based on this monitoring rule, when determining to exist other monitoring rules, take out a monitoring rule once more, the short message number that the user sends is counted based on this monitoring rule.
Computing unit is used for all short messages that the user sends in a regular duration are calculated;
Query unit is used for the user class attribute of inquiring user; And
Matching unit is used for the user class monitoring thresholding according to the user class attributes match correspondence that inquires;
Comparing unit, the value and the user class monitoring thresholding that are used for calculating compare, when reaching the user class control door corresponding with this user's user class attribute, the value that calculates prescribes a time limit, and be suspicious user with this user ID.
Fig. 4 shows the configuration diagram according to the short message monitoring system of exemplary embodiment of the present invention.In conjunction with Fig. 4 as can be seen this system comprise:
Control desk (human-computer interaction interface) 400, be used for the configuration of data and the demonstration of user profile, promptly this control desk combines the configuration module 300 in as shown in Figure 3 the short message monitoring system and the function of display module 310, on this control desk, both can carry out the configuration of data, as monitor the configuration of rule, user class monitoring thresholding, the user profile of the suspicious user that supervisory control system monitored can be shown again.After the data configuration of control desk is finished, will give analysis module and database management operation module synchronously.
Database management operation module 408, the function of the subsequent analysis module 308 in the function of this module and the short message monitoring system as shown in Figure 3 is basic identical, insert database 412 operations after being mainly used in the data that receive analysis module 404, and carry out subsequent analysis, the socket interface that provides by BOSS 414 is provided subsequent analysis, inquire about this user's user class attribute in real time, after waiting for BOSS 414 responses, and the user class monitoring thresholding different according to the user class attributes match that inquires, and call the short message that storing process takes out the transmission of this user in a regular duration in the database 412 and calculate, and judge whether the value that calculates reaches the user class monitoring thresholding of this user's correspondence.
Fig. 5 shows according to exemplary embodiment of the present invention, and based on monitoring by the frequency, the flow chart that the short message that the user is sent carries out the user class monitoring comprises:
S500, taking out one from database needs the calling user information analyzed, if not then withdraw from;
S502 inquires about this user's user class attribute by BOSS;
S504 mates corresponding user class monitoring thresholding r according to the user class attribute for this user;
S506 takes out this calling subscriber all short messages in regular duration from database;
S508 calculates all short messages, for by frequency monitoring, will carry out read group total and obtain m;
S510 judges whether the m that calculates monitors thresholding r more than or equal to this user's user class, if greater than, then continue to carry out S512, if be not more than, then finish this flow process;
S512 is a suspicious user with this user ID, and the user profile of this suspicious user is sent to display module.
As can be seen from the above description, the present invention has realized following technique effect: owing to introduced user class, user to different stage is provided with different user class monitoring thresholdings, so both can monitor effectively the high-end user that needs send a large amount of short messages, can reach low end subscriber of restriction or malicious user again and distribute the purpose of junk short message indiscriminately, to avoid simultaneously because the not monitored certain customers that cause of the white list user situation of having an opportunity to take advantage of, and then can improve the reliability of system.
The above is preferred embodiment of the present invention only, is not to be used to limit protection scope of the present invention, all any modifications of being done within the spirit and principles in the present invention, is equal to and replaces and improvement etc., all should be included within protection scope of the present invention.
Claims (10)
1. a short message monitoring method is characterized in that, comprising:
The short message number that the user sends is counted, when in a time granularity, after the short message number that the user sends reaches the interior thresholding by traffic monitoring of regular duration, after described time granularity finishes, write down all short messages that described user sends in the regular duration before of described granularity concluding time;
Described all short messages being calculated, prescribe a time limit when the value that calculates reaches the user class control door corresponding with described user's user class attribute, is suspicious user with described user ID.
2. method according to claim 1 is characterized in that, the described short message number that the user is sent also comprises before counting:
Configuration is monitored thresholding corresponding to the user class of user class attribute and is disposed at least one monitoring rule;
Wherein, described monitoring rule comprises: by thresholding, regular duration and the time granularity of traffic monitoring, described regular duration is the integral multiple of described time granularity in the regular duration.
3. method according to claim 2 is characterized in that, when disposing many monitoring rules,
The described short message number that the user is sent is counted, and comprising: each the monitoring rule based on configuration is counted the short message that the user sends respectively.
4. method according to claim 3 is characterized in that, described each monitoring rule based on configuration is counted the short message that the user sends respectively, comprising:
Take out a monitoring rule, the short message that the user sends is counted, when determining to exist other monitoring rules, take out a monitoring rule once more, the short message number that the user sends is counted based on this monitoring rule based on this monitoring rule.
5. according to the arbitrary described method of claim 1 to 4, it is characterized in that, described all short messages calculated, comprising:
All short messages that described user is sent in a regular duration calculate;
Inquire about described user's user class attribute;
User class monitoring thresholding according to the described user class attributes match correspondence that inquires;
Described value that calculates and described user class monitoring thresholding are compared.
6. a short message monitoring system is characterized in that, comprising:
The initial analysis module, be used for the short message number that the user sends is counted, when in a time granularity, after the short message number that the user sends reaches the interior thresholding by traffic monitoring of regular duration, after described time granularity finishes, write down all short messages that described user sends in the regular duration before of described granularity concluding time;
The subsequent analysis module is used for described all short messages are calculated, when reaching the user class control door corresponding with described user's user class attribute, the value that calculates prescribes a time limit, and be suspicious user with described user ID.
7. system according to claim 6 is characterized in that, described system also comprises:
Configuration module is used to dispose corresponding to the user class of user class attribute and monitors thresholding and dispose at least one monitoring rule;
Wherein, described monitoring rule comprises: by thresholding, regular duration and the time granularity of traffic monitoring, described regular duration is the integral multiple of described time granularity in the regular duration.
8. system according to claim 7 is characterized in that, during many monitoring rules of described configuration module configuration,
Described initial analysis module specifically is used for: each the monitoring rule based on configuration is counted the short message that the user sends respectively.
9. system according to claim 6 is characterized in that, described subsequent analysis module comprises:
Computing unit is used for all short messages that described user sends in a regular duration are calculated;
Query unit is used to inquire about described user's user class attribute; And
Matching unit is used for the user class monitoring thresholding according to the described user class attributes match correspondence that inquires;
Comparing unit is used for described value that calculates and described user class monitoring thresholding are compared, when reaching the user class control door corresponding with described user's user class attribute, the value that calculates prescribes a time limit, and be suspicious user with described user ID.
10. according to the arbitrary described system of claim 6 to 9, it is characterized in that described system further comprises:
Display module is used to show the user profile of described suspicious user.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200910236995A CN101702801A (en) | 2009-10-30 | 2009-10-30 | Short message monitoring method and system |
| PCT/CN2009/076212 WO2010145182A1 (en) | 2009-10-30 | 2009-12-29 | Short message monitoring method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN200910236995A CN101702801A (en) | 2009-10-30 | 2009-10-30 | Short message monitoring method and system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN101702801A true CN101702801A (en) | 2010-05-05 |
Family
ID=42157687
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN200910236995A Pending CN101702801A (en) | 2009-10-30 | 2009-10-30 | Short message monitoring method and system |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN101702801A (en) |
| WO (1) | WO2010145182A1 (en) |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102075883A (en) * | 2011-03-10 | 2011-05-25 | 成都四方信息技术有限公司 | Junk multimedia message monitoring method based on model combination |
| CN102088697A (en) * | 2010-12-17 | 2011-06-08 | 北京华中融合科技有限公司 | Method and system for processing spam |
| CN102104847A (en) * | 2011-02-24 | 2011-06-22 | 中兴通讯股份有限公司 | Short message monitoring method based on flow and call-initiating areas |
| CN102231888A (en) * | 2011-06-24 | 2011-11-02 | 中兴通讯股份有限公司 | Monitoring method and device |
| CN102378180A (en) * | 2011-11-24 | 2012-03-14 | 中兴通讯股份有限公司 | Method and device for determining user identity |
| CN102572746A (en) * | 2010-12-28 | 2012-07-11 | 上海粱江通信系统股份有限公司 | Method for identifying spam message source based on frequency and user sending behavior characteristics |
| CN103516586A (en) * | 2012-06-30 | 2014-01-15 | 北京神州泰岳软件股份有限公司 | Online user behavior analysis system of instant messaging system |
| CN106941440A (en) * | 2016-01-04 | 2017-07-11 | 五八同城信息技术有限公司 | A kind of session anti-clutter method and device |
| CN107509190A (en) * | 2016-06-14 | 2017-12-22 | 中兴通讯股份有限公司 | A short message monitoring method, device and monitoring center |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN100479572C (en) * | 2007-04-29 | 2009-04-15 | 中兴通讯股份有限公司 | Method and system for monitoring suspicious user of rubbish SMS |
| CN101540758A (en) * | 2008-03-19 | 2009-09-23 | 华为技术有限公司 | Method, device and system for inhibiting waste service |
| CN101321070B (en) * | 2008-07-16 | 2011-08-24 | 中兴通讯股份有限公司 | Monitoring system and method for suspicious user |
-
2009
- 2009-10-30 CN CN200910236995A patent/CN101702801A/en active Pending
- 2009-12-29 WO PCT/CN2009/076212 patent/WO2010145182A1/en active Application Filing
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102088697A (en) * | 2010-12-17 | 2011-06-08 | 北京华中融合科技有限公司 | Method and system for processing spam |
| CN102572746A (en) * | 2010-12-28 | 2012-07-11 | 上海粱江通信系统股份有限公司 | Method for identifying spam message source based on frequency and user sending behavior characteristics |
| CN102572746B (en) * | 2010-12-28 | 2016-03-30 | 上海粱江通信系统股份有限公司 | A kind of method sending behavioural characteristic identification junk short message source based on the frequency and user |
| CN102104847A (en) * | 2011-02-24 | 2011-06-22 | 中兴通讯股份有限公司 | Short message monitoring method based on flow and call-initiating areas |
| WO2012113191A1 (en) * | 2011-02-24 | 2012-08-30 | 中兴通讯股份有限公司 | Method and device for monitoring short messages |
| CN102075883A (en) * | 2011-03-10 | 2011-05-25 | 成都四方信息技术有限公司 | Junk multimedia message monitoring method based on model combination |
| CN102231888A (en) * | 2011-06-24 | 2011-11-02 | 中兴通讯股份有限公司 | Monitoring method and device |
| CN102378180A (en) * | 2011-11-24 | 2012-03-14 | 中兴通讯股份有限公司 | Method and device for determining user identity |
| CN103516586A (en) * | 2012-06-30 | 2014-01-15 | 北京神州泰岳软件股份有限公司 | Online user behavior analysis system of instant messaging system |
| CN106941440A (en) * | 2016-01-04 | 2017-07-11 | 五八同城信息技术有限公司 | A kind of session anti-clutter method and device |
| CN106941440B (en) * | 2016-01-04 | 2020-09-01 | 五八同城信息技术有限公司 | Session anti-harassment method and device |
| CN107509190A (en) * | 2016-06-14 | 2017-12-22 | 中兴通讯股份有限公司 | A short message monitoring method, device and monitoring center |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2010145182A1 (en) | 2010-12-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101702801A (en) | Short message monitoring method and system | |
| CN100479572C (en) | Method and system for monitoring suspicious user of rubbish SMS | |
| CN101335968B (en) | Method and system for rubbish short message monitoring post processing | |
| US5987108A (en) | Telephone billing with customer-defined budgeting | |
| US20130007151A1 (en) | Determination of a spammer through social network characterization | |
| CN101321070B (en) | Monitoring system and method for suspicious user | |
| JP2003018219A (en) | Mail transmission system, mail server, mail transfer system, mail transfer method, mail transmission method, mail delivery method, and program | |
| EP2339872A1 (en) | De-massing method of position advertising service based on regional strategy and system thereof | |
| CN103778225B (en) | Processing method, identification device and the system of advertisement marketing speech like sound information | |
| EP1956778A2 (en) | Method and system for reducing the proliferation of electronic messages | |
| CN102412998A (en) | Operation service system and maintenance method and device thereof | |
| CN101789145A (en) | Method for monitoring health status of self-service channel business system and system therefor | |
| CN102231888A (en) | Monitoring method and device | |
| CN109495378A (en) | Detect method, apparatus, server and the storage medium of abnormal account number | |
| CN105426045A (en) | Notification window displaying method and device | |
| CN103888919A (en) | Short message monitoring method and device thereof | |
| CN106682813A (en) | User working state determining method and terminal | |
| CN101656927A (en) | System and method for monitoring multimedia message content based on content recognition technology | |
| CN101478500A (en) | Instant messaging method, server, IM customer terminal and system | |
| WO2007000633B1 (en) | Quality assessment for telecommunications network | |
| CN100384161C (en) | Method and system for processing service behaviour abnormal | |
| CN105472586A (en) | Spam message monitoring system and method | |
| CN100456751C (en) | A kind of instant communication method and system | |
| CN101827328A (en) | Device and method for monitoring short-message | |
| CN103796184A (en) | Spam short message recognition method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C12 | Rejection of a patent application after its publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20100505 |