CN102378180A - Method and device for determining user identity - Google Patents
Method and device for determining user identity Download PDFInfo
- Publication number
- CN102378180A CN102378180A CN2011103780497A CN201110378049A CN102378180A CN 102378180 A CN102378180 A CN 102378180A CN 2011103780497 A CN2011103780497 A CN 2011103780497A CN 201110378049 A CN201110378049 A CN 201110378049A CN 102378180 A CN102378180 A CN 102378180A
- Authority
- CN
- China
- Prior art keywords
- user
- monitoring
- short message
- mortality
- duration
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Telephonic Communication Services (AREA)
Abstract
The invention discloses a method and device for determining a user identity. The method comprises the steps of: counting is the number of short message sent by a user within a ruled time length is satisfied with a flow threshold; if so, counting a failure rate of sending a short message by the user for the first time within the ruled time length; and if the failure rate is satisfied with a specific value monitoring threshold, determining that the user is a user in a blacklist. The method and device for determining the user identity disclosed by the invention solve problems that the policy for capturing doubtable user is too simple and contradictions exist between a recall ratio and precision ratio, and improve an integral performance of a short message monitoring system.
Description
Technical field
The present invention relates to the communications field, in particular to a kind of definite method and apparatus of user identity.
Background technology
At present, the message center function of communication field is grown in strength day by day: range of application is from short message service center, to the Multimedia Message center, again to the mail center; And the user is also increasing; The means that each operator, profit group and individual utilize message center to carry out sales promotion also emerge in an endless stream; That interconnects between each network is movable like a raging fire; The online size of message that flows also becomes geometric growth thereupon.Under this market environment, inevitably a large amount of rubbish messages, malicious messages, advertisement information etc. can occur, and the collective or the individual that send these message just are considered to suspicious user, or even the black list user.A large amount of rubbish messages in short time can cause the operating environment paralysis of operator; Some malicious user even utilize the delay of operator's charge system sends a large amount of short messages, and then makes operator suffer huge economic loss near arrearage the time.Moreover, frequent waste advertisements, malicious messages also can make the user tired tired very.
Given this, the junk short message supervisory control system is also just arisen at the historic moment, and its function mainly is automatically to find suspicious user according to a large amount of short messages of being monitored, and then limits the behavior that suspicious user sends SMS message.Though the junk short message supervisory control system of a lot of commercializations is arranged in the market; But with regard to its Core Feature " discovery suspicious user "; The foundation of judging is still fairly simple; Usually all be based on the size of message that the monitoring rule comes judges in the unit interval, to send and whether reached preset monitoring thresholding; If think that then this user is suspicious user (preset monitoring thresholding and the length of unit interval are all stipulated by the monitoring rule) here, and then limit the behavior that this suspicious user sends SMS message.The defective of this method for supervising is that the size of message that only simply the user is sent is counted, and judges whether the threshold value that reaches preset in the unit interval.Generally, in order to satisfy the communication requirement of normal users, can not be provided with too little usually for the violation of the flow in rule thresholding; So just make some malicious users; Utilize this specific character of system, continue to send refuse messages with lower frequency for a long time, thereby escape the monitoring of system; The recall ratio of corresponding garbage monitoring will reduce, the corresponding raising of precision ratio; Complain for the refuse messages of tackling the user simultaneously, avoid setting too big again for the violation of the flow in rule thresholding, to guarantee to monitor more suspicious user; Make some send the user of normal note like this; The user who for example sends notes such as commerce and trade contact, the number of changing, birth blessing is mistaken for suspicious user, even the black list user, thereby is closed down SMS; The recall ratio of corresponding garbage monitoring will improve, but precision ratio can corresponding reduction.
Too simple to the strategy of catching suspicious user in the correlation technique, there are the problem of contradiction in recall ratio and precision ratio, do not propose effective solution at present as yet.
Summary of the invention
Too simple to the strategy of catching suspicious user, there are the problem of contradiction in recall ratio and precision ratio, the invention provides a kind of definite method and apparatus of user identity, to address the above problem at least.
According to an aspect of the present invention, a kind of definite method of user identity is provided, has comprised: whether the short message number that the user sends in the statistical rules duration satisfies traffic threshold; If this user descends the mortality of short-message sending first in the statistical rules duration; If mortality satisfies ratio monitoring thresholding, determine that the user is the black list user.
Preferably, whether the short message number that above-mentioned user sends in the statistical rules duration satisfies before the traffic threshold, and said method also comprises: configuration issues the ratio monitoring thresholding and at least one monitoring rule of mortality first; Wherein, the monitoring rule comprises the interior traffic threshold by traffic monitoring of regular duration, time granularity and regular duration, and regular duration is the integral multiple of time granularity.
Preferably, whether the short message number that above-mentioned user sends in the statistical rules duration satisfies traffic threshold comprises: when many monitoring rules of configuration, respectively the short message that this user sends is carried out counting statistics based on each monitoring rule of configuration.
Preferably, the short message that respectively above-mentioned user is sent based on each monitoring rule of configuration carries out counting statistics and comprises: from a plurality of monitoring rules, choose a monitoring rule one by one; With the time granularity is unit, and the short message number that this user in the regular duration of the monitoring chosen rule sends is counted; If this user's counting reaches traffic threshold in the current time granularity, confirm that then this user's in the regular duration short message number satisfies traffic threshold; Continue to choose next monitoring rule and count, choose until a plurality of monitoring rules and finish.
Preferably, above-mentioned user descends the mortality of short-message sending to comprise first in the statistical rules duration: all short message numbers that this user is sent in regular duration calculate; All descend the number of times of short-message sending failure to calculate first in regular duration to this user; The number of times of short-message sending failure and the ratio of all short message numbers are descended in calculating first, ratio are descended the mortality of short-message sending first as this user in the regular duration.
Preferably; If mortality does not satisfy ratio monitoring thresholding; Said method also comprises: the related information that obtains the short message that above-mentioned user sends in the regular duration; Wherein, related information comprises one of following at least: work the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number of exhaling; Wherein, rise and exhale the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number to dispose a correlation threshold respectively; If have one to satisfy corresponding correlation threshold in the related information, determine that the user is the black list user.
According to a further aspect in the invention, a kind of definite device of user identity is provided, has comprised: the traffic statistics module is used for the short message number that the user sends in the statistical rules duration and whether satisfies traffic threshold; The mortality statistical module satisfies traffic threshold if be used for the result of traffic statistics module statistics for the short message number, and this user descends the mortality of short-message sending first in the statistical rules duration; The identity determination module is that mortality satisfies ratio monitoring thresholding if be used for the structure of mortality statistical module counts, determines that the user is the black list user.
Preferably, said apparatus also comprises: configuration module is used to dispose the ratio monitoring thresholding and at least one monitoring rule that issue mortality first; Wherein, the monitoring rule comprises the interior traffic threshold by traffic monitoring of regular duration, time granularity and regular duration, and regular duration is the integral multiple of time granularity.
Preferably, above-mentioned traffic statistics module comprises: the traffic statistics unit is used for when many monitoring rules of configuration module configures, respectively the short message that above-mentioned user sends being carried out counting statistics based on each monitoring rule of configuration.
Preferably, above-mentioned mortality statistical module comprises: short message is counted computing unit, and all short message numbers that are used for above-mentioned user is sent in regular duration calculate; Frequency of failure computing unit is used for this user all number of times that descend short-message sending to fail first in regular duration are calculated; The mortality computing unit; Be used to calculate the number of times that descends the short-message sending failure first of frequency of failure computing unit calculating and the ratio that short message is counted all short message numbers of computing unit calculating, ratio descended the mortality of short-message sending as this user in the regular duration first.
Preferably; Said apparatus also comprises: the related information acquisition module; Do not satisfy ratio monitoring thresholding if be used for the mortality of mortality statistical module counts; Obtain the related information of the short message that above-mentioned user sends in the regular duration, wherein, it is one of following that related information comprises at least: work the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number of exhaling; Wherein, rise and exhale the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number to dispose a correlation threshold respectively; Identity is reaffirmed module, has one to satisfy corresponding correlation threshold if be used for the related information that the related information acquisition module obtains, and determines that the user is the black list user.
Through the present invention, be employed in the monitoring that combines first mortality on the basis of traffic monitoring, it is too simple to have solved the strategy of catching suspicious user, and there are the problem of contradiction in recall ratio and precision ratio, and then have improved the overall performance of short message monitoring system.
Description of drawings
Accompanying drawing described herein is used to provide further understanding of the present invention, constitutes the application's a part, and illustrative examples of the present invention and explanation thereof are used to explain the present invention, do not constitute improper qualification of the present invention.In the accompanying drawings:
Fig. 1 is the definite method flow diagram according to the user identity of the embodiment of the invention;
Fig. 2 is the structured flowchart according to definite device of the user identity of the embodiment of the invention;
Fig. 3 is the structured flowchart according to definite device of the preferred, users identity of the embodiment of the invention;
Fig. 4 is the structured flowchart according to definite device of another preferred, users identity of the embodiment of the invention;
Fig. 5 is the structured flowchart according to the mortality statistical module of the embodiment of the invention;
Fig. 6 is the structured flowchart of definite device of a preferred, users identity again according to the embodiment of the invention;
Fig. 7 is the sketch map of short message monitoring system according to the preferred embodiment of the invention;
Fig. 8 is the configuration diagram of short message monitoring system according to the preferred embodiment of the invention;
Fig. 9 is the flow chart of short message monitoring method according to the preferred embodiment of the invention;
Figure 10 is the flow chart of based on many monitoring rules the short message of user's transmission being counted according to the preferred embodiment of the invention.
Embodiment
Hereinafter will and combine embodiment to specify the present invention with reference to accompanying drawing.Need to prove that under the situation of not conflicting, embodiment and the characteristic among the embodiment among the application can make up each other.
Possibly there is a part of invalid number (shutting down, do not have this number etc.) in the embodiment of the invention in the called number usually to the characteristic of refuse messages mass-sending, and the message that is dealt into these numbers all can issue failure, and a kind of definite method and apparatus of user identity is provided.Describe through specific embodiment below.
Definite method flow diagram of user identity according to the embodiment of the invention as shown in Figure 1, this method can realize in short message monitoring system, may further comprise the steps:
Whether the short message number that the user sends in the step S102, statistical rules duration satisfies traffic threshold; If, execution in step S104; If not, execution in step S108.
Step S104 adds up the mortality that interior this user of above-mentioned regular duration descends short-message sending first.
Step S106 if above-mentioned mortality satisfies ratio monitoring thresholding, determines that the user is the black list user.
Step S108 determines that the user is validated user.
Present embodiment is through combining the monitoring of first mortality on the basis of traffic monitoring; Can limit the behavior that continues to send refuse messages for a long time with lower frequency; Can avoid the appearance of mistake monitoring again, improve recall ratio and precision ratio simultaneously, it is too simple to have solved the strategy of catching suspicious user in the correlation technique; There are the problem of contradiction in recall ratio and precision ratio, have improved the overall performance of short message monitoring system.
When whether the short message number of user's transmission in the statistical rules duration satisfies above-mentioned traffic threshold; Can confirm temporarily that this user possibly be suspicious user; If above-mentioned first mortality of this suspicious user also satisfies the ratio monitoring thresholding of setting; Then can determine that the user is suspicious user, promptly this user is above-mentioned black list user.
Above-mentioned regular duration refers to the monitor duration of a monitoring rule, and the regular duration of present embodiment is the multiple of time granularity, and it is unit of account with the time granularity.For example 1 time granularity, 2 time granularities etc.Therefore can include one or more time granularities in a regular duration.And time granularity was used for representing the time span set, and it is the base unit of monitor duration, as 10 minutes, 1 hour etc.The time granularity of present embodiment defined with granularity time started and granularity concluding time, and the granularity time started is the zero-time of time granularity; The granularity concluding time is that the zero-time of time granularity adds time granularity.
The short message number that the user sends in carrying out above-mentioned statistical rules duration can be configured system before whether satisfying traffic threshold as required, and for example: configuration issues the ratio monitoring thresholding and at least one monitoring rule of mortality first; Wherein, the monitoring rule comprises the interior traffic threshold by traffic monitoring of regular duration, time granularity and regular duration, and this rule duration is the integral multiple of time granularity.This configuration mode can be configured according to the actual monitored needs of system, makes the parameter of configuration more meet monitoring requirement, has increased the flexibility of system.Certainly,, also can adopt the configuration of system default to carry out, promptly not need to carry out separately above-mentioned configuration for blanket scene.
When many monitoring rules of configuration, can carry out counting statistics to the short message that the user sends respectively based on each monitoring rule of configuration.For example: from a plurality of monitoring rules, choose a monitoring rule one by one; With the time granularity is unit, and the short message number that user in the regular duration of the monitoring chosen rule sends is counted; If user's counting reaches traffic threshold in the current time granularity, confirm that then user's in the regular duration short message number satisfies traffic threshold; Continue to choose next monitoring rule and count, choose until a plurality of monitoring rules and finish.Through disposing many monitoring rules, can confirm user's identity more exactly.
The short message that present embodiment can pass through the user of short message service center's record sends situation; The user descends the mortality of short-message sending first in the statistical rules duration, and specifically adopt following process to accomplish: all short message numbers that 1) this user sent in regular duration calculate; 2) all descend the number of times of short-message sending failure to calculate first in regular duration to this user; 3) number of times of short-message sending failure and the ratio of all short message numbers are descended in calculating first, this ratio are descended the mortality of short-message sending first as user in the regular duration.This statistical adopts and takes out a monitoring rule earlier; Based on this monitoring rule the short message that the user sends is counted, then, when confirming also to exist other monitoring rules; Take out a monitoring rule once more, based on this monitoring rule the short message number that the user sends is counted again.This statistical is more orderly, is convenient to realize.
Can be known that by such scheme the traffic monitoring of present embodiment refers to the short message amount in the regular duration is monitored, it is basic as monitoring with the thresholding by traffic monitoring that is provided with in advance, is divided into simple traffic monitoring and compound traffic monitoring.Simple traffic monitoring is meant that mainly the thresholding by traffic monitoring that directly will be provided with in advance monitors as suspicious thresholding; The short message amount of promptly in regular duration, sending as the user is more than or equal to by the thresholding of traffic monitoring the time; Just think that relative users is a suspicious user, and then limit the behavior that suspicious user sends SMS message.Compound traffic monitoring is meant and on the basis of simple traffic monitoring, combines monitoring type to carry out follow-up monitoring; Promptly at first whether the judges short message amount of in regular duration, sending reaches the thresholding by traffic monitoring; Having reached on this basis, according to different monitoring type the short message that in regular duration, has monitored is carried out follow-up monitoring again by the thresholding of traffic monitoring.
Above-mentioned follow-up monitoring is by traffic monitoring with respect to real-time; Follow-up monitoring is at a time granularity before the concluding time, and all short messages that the user who violates simple traffic monitoring in this time granularity is sent in regular duration are judged further and analyzed.In the process of follow-up monitoring; Relate to the problem of monitoring type; Monitoring type is one of attribute in each bar monitoring rule; Indicate that this monitoring rule is based on which kind of type is provided with, for follow-up monitoring, it monitoring type that comprises can be for exhaling frequency monitoring, frequency monitoring according to keywords, continuity monitoring according to number etc. by rising.Based on this; If mortality does not satisfy ratio monitoring thresholding; Said method also comprises: the related information that obtains the short message that the user sends in the regular duration; Wherein, related information comprises one of following at least: work the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number of exhaling; Wherein, rise and exhale the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number to dispose a correlation threshold respectively; If have one to satisfy corresponding correlation threshold in the related information that obtains, then determine that the user is the black list user.This monitor mode has more comprehensive, can catch suspicious user exactly, and recall ratio and precision ratio all can be guaranteed.
When reality realizes; The monitoring rule can be set in the following manner: the rule that the short message number of user's transmission in the statistical rules duration among the above-mentioned steps S102 is corresponding with the relation of traffic threshold is as father's rule; The relation of mortality and ratio monitoring thresholding of this user in the above-mentioned regular duration of statistics among the above-mentioned steps S104-S106 being descended short-message sending first is as sub-rule; Wherein, Father's rule refers in the rule cluster, if regular A need carry out before regular B, claims that then regular A is father's rule of regular B.Father's rule that above-mentioned simple traffic monitoring rule is exactly follow-up monitoring.Sub-rule refers in the rule cluster, if regular A need carry out after regular B, claims that then regular A is the sub-rule of regular B.Follow-up monitoring is exactly the sub-rule of simple traffic monitoring rule.
Above-mentioned blacklist refers to surpass certain thresholding or send the user definition that keyword surpasses thresholding and be the black list user for sending number of times within a certain period of time, and this user will be closed Short Message Mobile Originated.For blacklist, also have white list in the supervisory control system, the user in this white list is not monitored user, promptly this user how to send SMS message can be not monitored.
Definite method of above-mentioned user identity can be applied in the short message monitoring method; At first; Based on the monitoring rule short message number that the user sends is counted, in a time granularity, after the short message number that the user sends reaches the interior thresholding by traffic monitoring of regular duration; In this time granularity finishes, write down all short messages that the user sends in this granularity concluding time regular duration before; Secondly; Every short message of this user; To exhaling the frequency of failure/all short message numbers (being equivalent to the mortality that above-mentioned user descends short-message sending first) to calculate eventually first, when reaching, the ratio that calculates issues the mortality control door first in limited time, and be suspicious user with this ID.And then limit the transmission behavior of this suspicious user.
Through introducing judgement to user's short message first dispatching failure scenarios; Can be to mass-sending; Possibly exist the characteristic of a part of invalid number (shutting down, do not have this number etc.) to monitor effectively in the called number, if exhale the failure ratio higher eventually, then thinking has the suspicion of sending rubbish short message.Because issuing the mortality monitoring first is on the basis of traffic monitoring screening, to carry out; When therefore configuration is than the low discharge thresholding; Both can limit the behavior that continues to send refuse messages for a long time with lower frequency, can avoid the appearance of mistake monitoring again, improve recall ratio and precision ratio simultaneously.In a word,, so just reached the monitoring effect of more comprehensively catching suspicious user, also improved the overall performance of short message monitoring system simultaneously through issuing the judgement of failure scenarios first.
Corresponding to definite method of above-mentioned user identity, present embodiment also provides a kind of definite device of user identity.The structured flowchart of definite device of user identity according to the embodiment of the invention as shown in Figure 2, this device can be arranged in the short message monitoring system, and this device comprises: traffic statistics module 22, mortality statistical module 24, identity determination module 26.Following mask body is introduced the structure of above-mentioned module:
Traffic statistics module 22 is used for the short message number that the user sends in the statistical rules duration and whether satisfies traffic threshold; Mortality statistical module 24 links to each other with traffic statistics module 22, satisfies traffic threshold if be used for the result of traffic statistics module 22 statistics for the short message number, and the user descends the mortality of short-message sending first in the statistical rules duration; Identity determination module 26 links to each other with mortality statistical module 24, is that mortality satisfies ratio monitoring thresholding if be used for the structure of mortality statistical module 24 statistics, confirms that the user is the black list user.
The device of present embodiment is through combining the monitoring of 24 pairs of first mortalitys of mortality statistical module on the basis of carrying out traffic monitoring in traffic statistics module 22; Can limit the behavior that continues to send refuse messages for a long time with lower frequency; Can avoid the appearance of mistake monitoring again, improve recall ratio and precision ratio simultaneously, it is too simple to have solved the strategy of catching suspicious user in the correlation technique; There are the problem of contradiction in recall ratio and precision ratio, have improved the overall performance of short message monitoring system.
The structured flowchart of definite device of preferred, users identity according to the embodiment of the invention as shown in Figure 3; Said apparatus can also comprise: configuration module 32; Link to each other with identity determination module 26 with traffic statistics module 22, be used to dispose the ratio monitoring thresholding and at least one monitoring rule that issue mortality first; Wherein, the monitoring rule comprises the interior traffic threshold by traffic monitoring of regular duration, time granularity and regular duration, and regular duration is the integral multiple of time granularity.
The structured flowchart of definite device of another preferred, users identity according to the embodiment of the invention as shown in Figure 4; Traffic statistics module 22 can comprise: traffic statistics unit 222; Link to each other with configuration module 32; Be used for when many monitoring rules of configuration module 32 configurations, respectively the short message that the user sends being carried out counting statistics based on each monitoring rule of configuration.
The structured flowchart of mortality statistical module 24 according to the embodiment of the invention as shown in Figure 5, mortality statistical module 24 can comprise:
Short message is counted computing unit 242, and all short message numbers that are used for the user is sent in regular duration calculate;
Frequency of failure computing unit 244 is used for user's all number of times that descend short-message sending to fail first in regular duration are calculated;
Mortality computing unit 246; Counting computing unit 242 with short message links to each other with frequency of failure computing unit 244; Be used to calculate the number of times that descends the short-message sending failure first of frequency of failure computing unit 244 calculating and the ratio that short message is counted all short message numbers of computing unit 242 calculating, ratio descended the mortality of short-message sending as user in the regular duration first.
The structured flowchart of definite device of a preferred, users identity again according to the embodiment of the invention as shown in Figure 6, said apparatus can also comprise:
Related information acquisition module 62; Link to each other with mortality statistical module 24; Do not satisfy ratio monitoring thresholding if be used for the mortality of mortality statistical module 24 statistics; Obtain the related information of the short message that the user sends in the regular duration, wherein, it is one of following that related information comprises at least: work the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number of exhaling; Wherein, rise and exhale the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number to dispose a correlation threshold respectively;
Identity is reaffirmed module 64, links to each other with related information acquisition module 62, has one to satisfy corresponding correlation threshold if be used for the related information that related information acquisition module 62 obtains, and confirms that the user is the black list user.
To combine a preferred embodiment to be elaborated below, the preferred embodiment has combined the foregoing description and preferred implementation.
In this preferred embodiment; The another kind of dividing mode of definite device of above-mentioned user identity is provided; The sketch map of short message monitoring system according to the preferred embodiment of the invention as shown in Figure 7, this system comprises: configuration module 70, initial analysis module 72, subsequent analysis module 74, display module 76.Wherein, Configuration module 70; Be used for configuration and issue mortality monitoring thresholding first and dispose at least one monitoring rule, wherein, the monitoring rule comprises: in the regular duration by thresholding, regular duration and the time granularity of traffic monitoring; And regular duration is the integral multiple of time granularity, and the monitoring rule that will configure sends to initial analysis module 72 and the user class monitoring thresholding that configures is sent to subsequent analysis module 76; Initial analysis module 72; Link to each other with configuration module 70, be used for the short message number that the user sends is counted, when in a time granularity; After the short message number that the user sends reaches the interior thresholding by traffic monitoring of regular duration; The user profile of recording user, and in this time granularity finished, all short messages that the user sends in the regular duration before the record granularity concluding time also sent to subsequent analysis module 74; Subsequent analysis module 74; Link to each other with initial analysis module 72 with configuration module 70; Be used for all short messages and eventually exhale the frequency of failure to calculate first, exhale the frequency of failure/all short message numbers to reach eventually first to issue the mortality control door first in limited time, be suspicious user ID when calculating; Display module 76 links to each other with subsequent analysis module 74, is used to show the user profile of suspicious user.
The preferred embodiment has increased subsequent analysis module 74; Promptly having introduced the follow-up mortality that issues first monitors; When therefore configuration is than the low discharge thresholding, both can limit the behavior that continues to send refuse messages for a long time with lower frequency, can avoid the appearance of mistake monitoring again; Improve recall ratio and precision ratio simultaneously, so just realized improving the purpose of supervisory control system reliability.
When configuration module 70 has disposed many monitoring rules; Initial analysis module 72 specifically is used for respectively the short message that the user sends being counted based on each monitoring rule of configuration, more specifically, takes out a monitoring rule; Respectively the short message that the user sends is counted based on this monitoring rule; When confirming to exist other monitoring rules, take out a monitoring rule once more, the short message number that the user sends is counted based on this monitoring rule.
Subsequent analysis module 76 specifically comprises: computing unit, all short message numbers that are used for the user is sent in a regular duration and eventually exhale the frequency of failure to calculate first; Comparing unit is used for issuing the mortality control door first in limited time with exhaling the frequency of failure/all short message numbers to compare with issuing mortality monitoring thresholding first first eventually when the value that calculates reaches, and is suspicious user with this ID.
Corresponding to above-mentioned short message monitoring system, this preferred embodiment also provides a kind of framework of short message monitoring system.The configuration diagram of short message monitoring system according to the preferred embodiment of the invention as shown in Figure 8, this system comprises:
Control desk (human-computer interaction interface) 80; Be used for the configuration of data and the demonstration of user profile; Promptly this control desk has combined configuration module 70 and the function of display module 76 in the short message monitoring system as shown in Figure 7, on this control desk, both can carry out the configuration of data; As monitor rule, issue the configuration of mortality monitoring thresholding first, can the user profile of the suspicious user that supervisory control system monitored be shown again.The data configuration of control desk will be given analysis module and database management operation module after accomplishing synchronously.
Database management operation module 86; The function of the subsequent analysis module 74 in the function of this module and the short message monitoring system as shown in Figure 7 is basic identical; Insert database 86 operations after being mainly used in the data that receive analysis module 82; And carry out subsequent analysis; Subsequent analysis comprises that calling storing process takes out the short message of the transmission of this user in a regular duration in the database 86 and exhale the frequency of failure to calculate eventually first, and judges that exhaling the frequency of failure/all short message numbers whether to reach eventually first issues mortality monitoring thresholding first.
Based on above-mentioned short message monitoring system and framework thereof, this preferred embodiment also provides a kind of short message monitoring method.The flow chart of short message monitoring method according to the preferred embodiment of the invention as shown in Figure 9, this method comprises:
Step S900; Configuration issues mortality monitoring thresholding first and disposes at least one monitoring rule; Wherein, the monitoring rule comprises: press thresholding, regular duration and the time granularity of traffic monitoring in the regular duration, and regular duration is the integral multiple of time granularity.
For issuing mortality monitoring thresholding first,,, be different by at least one item in three of the thresholdings of traffic monitoring, regular duration, time granularity for different monitoring rules if the monitoring of configuration rule be many.For example, dispose two different monitoring rules, wherein the parameter of monitoring rule configuration is: the thresholding by traffic monitoring is 100 short messages, and regular duration is 10 minutes; The parameter of another monitoring rule configuration is: the thresholding by traffic monitoring is 200 short messages, and regular duration is 15 minutes.
Step S902 takes out a monitoring rule from least one monitoring rule of above-mentioned configuration.This monitoring rule of taking out will provide foundation for following counting process.
Step S904 counts the short message number that the user sends, and whether the real-time judge short message number that the user sends in a time granularity reach in the regular duration thresholding by traffic monitoring, if, execution in step S906 then; If, then do not finish.
Step S906 writes down this user's user profile, and in time granularity finishes, writes down all short messages that the user sends in the granularity concluding time regular duration before.
Particularly, can accomplish the record of user profile through the mode of user profile being utilized database management module insert database; Can accomplish the record of short message equally through the mode of all short messages being utilized database management module insert database.
This process can be thought the simple traffic monitoring in the aforementioned compound traffic monitoring, and promptly just whether the short message number that in regular duration, sends of judges has reached the thresholding by traffic monitoring.In this process, all users' counting process is all carried out in flow counting memory bank, promptly preserves user's counting record in the flow memory bank; So; Before counting, carry out the initialization setting to user's counting record, if there is not this user's counting record in the flow counting memory bank; Before the initialization setting, also need in this flow counting memory bank, generate this user's counting record, the short message number that after being used for this user is sent is counted.
Step S908 exhales the frequency of failure/all short message numbers to calculate to the whole first of record, when reaching with issuing the mortality control door first, the value that calculates prescribes a time limit, and be suspicious user with this ID.
This process can be thought follow-up monitoring, promptly on the basis of simple traffic monitoring, again the short message that in regular duration, has monitored is issued the mortality monitoring first.
Step S910 shows the user profile of above-mentioned suspicious user.For suspicious user, its behavior that sends SMS message will be restricted, and the user profile of this suspicious user can be revealed.
The preferred embodiment is being pressed on the basis of traffic monitoring; Having introduced the follow-up mortality that issues first monitors; When therefore configuration is than the low discharge thresholding, both can limit the behavior that continues to send refuse messages for a long time with lower frequency, can avoid the appearance of mistake monitoring again; Improve recall ratio and precision ratio simultaneously, and then can more comprehensively catch suspicious user.
Can find out that from the step S900 of above-mentioned short message monitoring method the monitoring rule of configuration can be many.When having disposed many monitoring rules, will count the short message that the user sends respectively based on each monitoring rule.For the situation that has many monitoring rules, this short message monitoring method will done further description to the process that certain user carries out the flow counting below in conjunction with Figure 10.
Shown in figure 10 monitors the flow charts that rule is counted the short messages of user's transmission based on many according to the preferred embodiment of the invention, and when having many monitoring rules, the process that the short message of user's transmission is counted comprises:
Step S1002 obtains short message controlled structures body from short message service center, has parsed according to this short message controlled structures body and has exhaled Subscriber Number;
Step S1004, analysis module take out a monitoring rule from many monitoring rules;
Step S1006 works the short message of exhaling the user to send based on the monitoring rule to this and counts, and promptly adds one (counter does not overflow under the normal condition) in this count value that works this monitoring rule of exhaling this time granularity of user;
Step S1008 judges whether the short message count value reaches the thresholding by traffic monitoring, if reach, then continues execution in step S1010, if do not reach, then continues execution in step S1012;
Step S1010; Write down this and work the Subscriber Number of exhaling the user; And in this time granularity finishes; All short messages that the user sends in the regular duration of record before the granularity concluding time can be taked that specifically this Subscriber Number and all short messages are sent to the database management operation module and accomplish mode of inserting database manipulation by it and realize;
Step S1012 judges whether to exist other monitoring rules, if then turn back to step S1004.
Through the preferred embodiment, realized in process by traffic monitoring, can dispose many monitoring rules the short message that the user sends is monitored, so just improved the dynamics of monitoring effectively.
Can know that from the description of front the monitoring type that follow-up monitoring comprises has multiple, can be for pressing the monitoring of content-length consistency, frequency monitoring according to keywords, continuity monitoring according to number etc.So, will do further description to short message monitoring method with monitoring type for being example below by issuing the mortality monitoring first, this method comprises:
Step 1 at first, is monitored the configuration of rule on the human-computer interaction interface of SMS monitoring, comprise configuration father rule-by the thresholding of traffic monitoring, promptly after short message that a certain number sends reaches this value, just carries out follow-up monitoring in regular duration; Then dispose sub-rule-issue first mortality monitoring thresholding.After configuration is accomplished, give analysis module and database management operation module synchronously with the above-mentioned parameter that configures.
Step 2; Counting record to user in the flow counting memory bank carries out the initialization setting; If there is different monitoring rules, the counting record of counting based on each rule all will carry out the initialization setting, certainly; If there is not this user's counting record in the flow counting memory bank, then to before initialization, in flow counting memory bank, generate this user's counting record.
Step 3 is obtained note controlled structures body to be monitored, in this structure, must comprise to exhale Subscriber Number, message body, exhale user profile such as whether fail eventually first.
Step 4, the note controlled structures body according to obtaining has parsed and has exhaled Subscriber Number, and in time granularity internal liquidity counting memory bank, exhales Subscriber Number to count based on each monitoring rule to this.
Step 5; When in a time granularity; After count value in the flow counting memory bank reaches the thresholding of father's rule of sub-rule-issue first mortality monitoring thresholding-by traffic monitoring; Promptly send to the database management operation module to this user's user profile and carry out the physical database warehouse-in, purpose is to write down this user's user profile.
Step 6; When arriving the above-mentioned granularity of step 5 in the concluding time; All short messages that user in the regular duration before this granularity concluding time is sent carry out record; Be about to all short message notification database management operation modules that this user promptly sends in regular duration in falling back the time range of a regular duration forward in this granularity concluding time and this granularity concluding time, the database management operation module can be inserted database with all short messages.
Step 7; Database management operation module invokes storing process takes out all short messages that this user sends in the physical database and calculates in a regular duration; For issuing the mortality monitoring first; Need sue for peace, exhale the frequency of failure to carry out anded eventually first all short messages respectively here, and judge that exhaling value that the frequency of failure/all short message numbers obtain whether to reach first eventually issues mortality monitoring thresholding first, if reach then be suspicious user this ID; And the user profile of this suspicious user is sent to display module show that its behavior that sends SMS message will be restricted.If do not reach, show that then relative users is not a suspicious user, can not limit its behavior that sends SMS message.
It is related in the preferred embodiment that to issue the mortality monitoring first be the follow-up monitoring in the compound traffic monitoring; It is not only applicable to monitoring type for issuing the monitoring of mortality first; Being equally applicable to monitoring type is that we describe no longer one by one at this by other compound traffic monitorings such as the monitoring of content-length consistency, frequency monitoring according to keywords, continuity monitoring according to number.
From above description, can find out; The present invention has realized following technique effect: introduce the judgement to user's short message first dispatching failure scenarios; Can be to mass-sending; Possibly exist the characteristic of a part of invalid number (shutting down, do not have this number etc.) to monitor effectively in the called number, if exhale the failure ratio higher eventually, then thinking has the suspicion of sending rubbish short message.Because issuing the mortality monitoring first is on the basis of traffic monitoring screening, to carry out; When therefore configuration is than the low discharge thresholding; Both can limit the behavior that continues to send refuse messages for a long time with lower frequency; Can avoid the appearance of mistake monitoring again, improve recall ratio and precision ratio simultaneously, and then improve the reliability of system.
Can find out in sum; Present embodiment is through combining the monitoring of first mortality on the basis of traffic monitoring; It is too simple to have solved the strategy of catching suspicious user in the correlation technique, and there are the problem of contradiction in recall ratio and precision ratio, has improved the overall performance of short message monitoring system.
Obviously, it is apparent to those skilled in the art that above-mentioned each module of the present invention or each step can realize with the general calculation device; They can concentrate on the single calculation element; Perhaps be distributed on the network that a plurality of calculation element forms, alternatively, they can be realized with the executable program code of calculation element; Thereby; Can they be stored in the storage device and carry out, and in some cases, can carry out step shown or that describe with the order that is different from here by calculation element; Perhaps they are made into each integrated circuit modules respectively, perhaps a plurality of modules in them or step are made into the single integrated circuit module and realize.Like this, the present invention is not restricted to any specific hardware and software combination.
The above is merely the preferred embodiments of the present invention, is not limited to the present invention, and for a person skilled in the art, the present invention can have various changes and variation.All within spirit of the present invention and principle, any modification of being done, be equal to replacement, improvement etc., all should be included within protection scope of the present invention.
Claims (11)
1. definite method of a user identity is characterized in that, comprising:
Whether the short message number that the user sends in the statistical rules duration satisfies traffic threshold;
If add up the mortality that said user in the said regular duration descends short-message sending first;
If said mortality satisfies ratio monitoring thresholding, confirm that said user is the black list user.
2. method according to claim 1 is characterized in that, whether the short message number that the user sends in the statistical rules duration satisfies before the traffic threshold, and said method also comprises:
Configuration issues the ratio monitoring thresholding and at least one monitoring rule of mortality first; Wherein, said monitoring rule comprises the interior traffic threshold by traffic monitoring of regular duration, time granularity and said regular duration, and said regular duration is the integral multiple of said time granularity.
3. method according to claim 2 is characterized in that, whether the short message number that the user sends in the statistical rules duration satisfies traffic threshold comprises:
When many monitoring rules of configuration, respectively the short message that the user sends is carried out counting statistics based on each monitoring rule of configuration.
4. method according to claim 3 is characterized in that, carries out counting statistics based on the regular short message that respectively user is sent of each monitoring that disposes and comprises:
From said a plurality of monitoring rules, choose a monitoring rule one by one;
With the time granularity is unit, and the said short message number of choosing of monitoring user's transmission in the regular regular duration is counted;
If said user's counting reaches said traffic threshold in the current time granularity, confirm that then said user's in the said regular duration short message number satisfies traffic threshold;
Continue to choose next monitoring rule and count, choose until said a plurality of monitoring rules and finish.
5. method according to claim 1 is characterized in that, adds up that said user descends the mortality of short-message sending to comprise first in the said regular duration:
All short message numbers that said user is sent in said regular duration calculate;
All descend the number of times of short-message sending failure to calculate first in said regular duration to said user;
Calculate the said number of times of short-message sending failure and the ratio of said all short message numbers of descending first, said ratio is descended the mortality of short-message sending as said user in the said regular duration first.
6. according to each described method of claim 1-5, it is characterized in that if said mortality does not satisfy ratio monitoring thresholding, said method also comprises:
Obtain the related information of the short message that said user sends in the said regular duration, wherein, it is one of following that said related information comprises at least: work the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number of exhaling; Wherein, exhale the frequency, said content-length concordance rate, the said keyword frequency of occurrences and the continuous rate of said destination Mobile Station International ISDN Number to dispose a correlation threshold respectively for said;
If have one to satisfy corresponding correlation threshold in the said related information, confirm that said user is the black list user.
7. definite device of a user identity is characterized in that, comprising:
The traffic statistics module is used for the short message number that the user sends in the statistical rules duration and whether satisfies traffic threshold;
The mortality statistical module satisfies said traffic threshold if be used for the result of said traffic statistics module statistics for said short message number, adds up the mortality that said user in the said regular duration descends short-message sending first;
The identity determination module is that said mortality satisfies said ratio monitoring thresholding if be used for the structure of said mortality statistical module counts, confirms that said user is the black list user.
8. device according to claim 7 is characterized in that, said device also comprises:
Configuration module is used to dispose the ratio monitoring thresholding and at least one monitoring rule that issue mortality first; Wherein, said monitoring rule comprises the interior traffic threshold by traffic monitoring of regular duration, time granularity and said regular duration, and said regular duration is the integral multiple of said time granularity.
9. device according to claim 8 is characterized in that, said traffic statistics module comprises:
The traffic statistics unit is used for when many monitoring rules of said configuration module configures, respectively the short message that the user sends being carried out counting statistics based on each monitoring rule of configuration.
10. device according to claim 7 is characterized in that, said mortality statistical module comprises:
Short message is counted computing unit, and all short message numbers that are used for said user is sent in said regular duration calculate;
Frequency of failure computing unit is used for said user all number of times that descend short-message sending to fail first in said regular duration are calculated;
The mortality computing unit; Be used to calculate the said number of times of short-message sending failure and the ratio that said short message is counted said all short message numbers of computing unit calculating of descending first that said frequency of failure computing unit calculates, said ratio descended the mortality of short-message sending as said user in the said regular duration first.
11., it is characterized in that said device also comprises according to each described device of claim 7-10:
The related information acquisition module; Do not satisfy ratio monitoring thresholding if be used for the said mortality of said mortality statistical module counts; Obtain the related information of the short message that said user sends in the said regular duration; Wherein, said related information comprises one of following at least: work the frequency, content-length concordance rate, the keyword frequency of occurrences and the continuous rate of destination Mobile Station International ISDN Number of exhaling; Wherein, exhale the frequency, said content-length concordance rate, the said keyword frequency of occurrences and the continuous rate of said destination Mobile Station International ISDN Number to dispose a correlation threshold respectively for said;
Identity is reaffirmed module, has one to satisfy corresponding correlation threshold if be used for the said related information that said related information acquisition module obtains, and confirms that said user is the black list user.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2011103780497A CN102378180A (en) | 2011-11-24 | 2011-11-24 | Method and device for determining user identity |
| PCT/CN2012/074640 WO2013075462A1 (en) | 2011-11-24 | 2012-04-25 | User identity determination method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2011103780497A CN102378180A (en) | 2011-11-24 | 2011-11-24 | Method and device for determining user identity |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN102378180A true CN102378180A (en) | 2012-03-14 |
Family
ID=45796002
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2011103780497A Pending CN102378180A (en) | 2011-11-24 | 2011-11-24 | Method and device for determining user identity |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN102378180A (en) |
| WO (1) | WO2013075462A1 (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2013075462A1 (en) * | 2011-11-24 | 2013-05-30 | 中兴通讯股份有限公司 | User identity determination method and device |
| CN103634797A (en) * | 2013-12-06 | 2014-03-12 | 中国联合网络通信集团有限公司 | Method and device for recognizing spam short messages |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105512094B (en) * | 2015-12-04 | 2019-07-02 | 小米科技有限责任公司 | Abnormal message template determines method and device |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070140117A1 (en) * | 2005-12-15 | 2007-06-21 | Yahoo! Inc. | Tracking and blocking of spam directed to clipping services |
| CN101043656A (en) * | 2007-04-29 | 2007-09-26 | 中兴通讯股份有限公司 | Method and system for monitoring suspicious user of rubbish SMS |
| CN101321070A (en) * | 2008-07-16 | 2008-12-10 | 中兴通讯股份有限公司 | Monitoring system and method for suspicious user |
| CN101702801A (en) * | 2009-10-30 | 2010-05-05 | 中兴通讯股份有限公司 | Short message monitoring method and system |
| CN102231888A (en) * | 2011-06-24 | 2011-11-02 | 中兴通讯股份有限公司 | Monitoring method and device |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102378180A (en) * | 2011-11-24 | 2012-03-14 | 中兴通讯股份有限公司 | Method and device for determining user identity |
-
2011
- 2011-11-24 CN CN2011103780497A patent/CN102378180A/en active Pending
-
2012
- 2012-04-25 WO PCT/CN2012/074640 patent/WO2013075462A1/en active Application Filing
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070140117A1 (en) * | 2005-12-15 | 2007-06-21 | Yahoo! Inc. | Tracking and blocking of spam directed to clipping services |
| CN101043656A (en) * | 2007-04-29 | 2007-09-26 | 中兴通讯股份有限公司 | Method and system for monitoring suspicious user of rubbish SMS |
| CN101321070A (en) * | 2008-07-16 | 2008-12-10 | 中兴通讯股份有限公司 | Monitoring system and method for suspicious user |
| CN101702801A (en) * | 2009-10-30 | 2010-05-05 | 中兴通讯股份有限公司 | Short message monitoring method and system |
| CN102231888A (en) * | 2011-06-24 | 2011-11-02 | 中兴通讯股份有限公司 | Monitoring method and device |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2013075462A1 (en) * | 2011-11-24 | 2013-05-30 | 中兴通讯股份有限公司 | User identity determination method and device |
| CN103634797A (en) * | 2013-12-06 | 2014-03-12 | 中国联合网络通信集团有限公司 | Method and device for recognizing spam short messages |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2013075462A1 (en) | 2013-05-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN100479572C (en) | Method and system for monitoring suspicious user of rubbish SMS | |
| CN101321070B (en) | Monitoring system and method for suspicious user | |
| CN109660380A (en) | Monitoring method, platform, system and the readable storage medium storing program for executing of operation condition of server | |
| CN104301136B (en) | Fault information reporting and the method and apparatus of processing | |
| EP2339872A1 (en) | De-massing method of position advertising service based on regional strategy and system thereof | |
| CN106470149A (en) | Message method and device | |
| CN105991408B (en) | A kind of message treatment method, device and processing server | |
| CN107040863A (en) | Real time business recommends method and system | |
| CN101621816B (en) | System and method for monitoring background server of mobile terminal | |
| CN101335968B (en) | Method and system for rubbish short message monitoring post processing | |
| CN102231888A (en) | Monitoring method and device | |
| CN103081403A (en) | Method and apparatus for analysis of the operation of a communication system using events | |
| CN109656574A (en) | Transaction time delay measure, device, computer equipment and storage medium | |
| CN109672582A (en) | Complete trails monitoring method, equipment, storage medium and device | |
| CN101702801A (en) | Short message monitoring method and system | |
| CN104348974A (en) | Keyword-verification-based specific message prompting method for communication group | |
| CN108737622A (en) | Monitoring method of conversing and device | |
| CN108989084A (en) | Abnormal data monitoring method, apparatus and system | |
| CN110072251B (en) | Method and device for analyzing user communication behavior and managing user | |
| CN106682813A (en) | User working state determining method and terminal | |
| CN102378180A (en) | Method and device for determining user identity | |
| CN102905236B (en) | A kind of junk short message monitoring method, Apparatus and system | |
| CN101827328A (en) | Device and method for monitoring short-message | |
| CN102572746B (en) | A kind of method sending behavioural characteristic identification junk short message source based on the frequency and user | |
| CN101340693B (en) | System and implementing method for monitoring rubbish short message based on content length |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20120314 |
|
| WD01 | Invention patent application deemed withdrawn after publication |