CN103906067B - The recognition methods of false calling number and device - Google Patents

Abstract

The invention discloses a method and device for identifying a false calling number, which are used to solve the problem that the false calling number identification technology provided by the prior art cannot identify the false calling number in the scene of over-the-network call transfer. The solution disclosed by the present invention is based on the fact that both the inter-network call and the cross-network call transfer need to be transmitted in different communication networks, and the CDRs of the calls before going out of the network and the calls after going out of the network can be recorded separately in different communication networks, and the network access The CDR of the call before and after the network can also be recorded separately. It is proposed whether the CDR of the first call initiated in the first communication network and the CDR of the second call obtained by the first communication network for the first outgoing call Matching is used as the basis for judging the false calling number.

Description

Method and device for identifying false calling numbers

technical field

The invention relates to the technical field of information security, in particular to a method and device for identifying a false calling number.

Background technique

It is one of the common illegal acts in the current communication network to forge mobile (or fixed) network phone numbers to commit fraud and information theft without authorization by using the defects in the protocol and supervision mechanism of the traditional telecommunication network. A call initiated by forging a mobile (or fixed) Internet phone number is called a false calling number, and the number that initiates the false calling is called a false calling number. There are various scenarios for false calling, but the scenarios where existing monitoring or identification technologies can take effect are very limited. The method for identifying false calling numbers in the prior art is briefly introduced below.

At the current stage, with the development of communication technology, operators have implemented the method of inquiring the status of the calling number by triggering the core network element of the intelligent network - Service Control Point (SCP) to check the number of the local network from other operators. If it is found to be a false calling number, it will be disconnected in real time. With reference to other patents and documents, the network diagram of the false calling number call monitoring system in the prior art is shown in FIG. 1 .

Based on the networking diagram shown in Figure 1, the live network has a false calling number determination process as shown in Figure 2. The process mainly includes the following steps:

First, after receiving the call from the GMSC of the other network, the Gateway of Mobile Switching Center (GMSC) of the local network judges whether the calling number of the call belongs to the operator of the local network;

Then, if it is judged as no, then the GMSC of this network releases the call; if it is judged as yes, then the GMSC of this network inquires about the status of the calling number that initiates the call to the SCP;

Afterwards, if the SCP inquires that the status of the calling number is idle, it means that the calling number that initiated the call may be a false calling number, thereby terminating the call;

And if the SCP inquires that the calling number is busy, the GMSC of this network will determine that the calling number that initiated the call is not a false calling number, so as to connect the call, and at the same time, the SCP will periodically query the calling number according to the period of N seconds status, and when the status of the calling number is found to be idle, it is determined that the call is over, thereby terminating the call.

Although the prior art has proposed the above-mentioned technology for identifying false calling numbers, and successfully realized the identification of false calling numbers in some scenarios, cases of fraudulent use of false calling numbers still occur from time to time, and it is difficult to pursue. The reason is mainly because the existing solutions can only monitor false calling numbers in limited scenarios, and in some specific scenarios, the existing solutions may fail. For example, for the case that the call is an inter-network call and is forwarded through the network, there will be problems if the process shown in FIG. 2 is adopted. Specifically, if the caller is a group switchboard, and the group switchboard has opened IMS number one number or opened services such as call forwarding when busy, the status of the caller recorded by the SCP will be "idle" for a long time. In the scenario, if it is determined arbitrarily that the caller in the "idle" state is not a false calling number based on the calling party's activation of these services, it is bound to be impossible to accurately identify the false calling number, which may lead to missed false calling and if it is judged that the calling party is a false calling number according to the calling state information provided by the HLR inquired by the SCP, it may cause the problem of falsely judging the false calling number. It can be seen from this that it is difficult to accurately identify the false calling number for the fake call forwarding through the network in the existing scheme.

In addition, some operators also propose to compare the bills after the call to realize the authenticity of the calling number after the fact, and to further strengthen the management and control of the communication network after discovering the existence of a false calling number. However, because the communication network operated by the operator is generally divided into multiple subnets according to the different coverage areas, and each subnet has its own way of HLR comparing bills, only the calling and called numbers belong to the same This method of comparing bills is only valid when the same HLR is used (as in the provincial network of the same operator). Therefore, the use scenarios of this solution are also very limited. For example, in the scenario where the calling and called numbers belong to the same HLR, the solution cannot be implemented.

Contents of the invention

Embodiments of the present invention provide a method and device for identifying a false calling number, which are used to solve the problem that the false calling number identification technology provided by the prior art cannot identify the false calling number in the scenario of over-the-network call transfer.

Embodiments of the present invention adopt the following technical solutions:

A method for identifying a false calling number, comprising:

Obtaining a first call detail record CDR of a first call in a first communication network; wherein, the calling number of the first call belongs to the first communication network, and the called number of the first call belongs to the first Two communication networks; obtaining a second CDR of a second call obtained by calling out the first call to the second communication network by the first communication network; wherein, the first CDR and the second CDR Having the same call identifier, and both the first CDR and the second CDR include a calling number and a called number; judging whether the first CDR matches the second CDR; when the judging result is no , determining that the calling number of the first call is a false calling number.

A device for identifying a false calling number, comprising: a first CDR obtaining unit, configured to obtain a first call detail record CDR of a first call in a first communication network; wherein, the calling number of the first call belongs to In the first communication network, the called number of the first call belongs to the second communication network; the second CDR obtaining unit is configured to obtain the first call from the first communication network to the The second CDR of the second call obtained by the second communication network; wherein, the first CDR and the second CDR have the same call identifier, and both the first CDR and the second CDR include the primary a calling number and a called number; a judging unit, configured to judge whether the first CDR obtained by the first CDR obtaining unit matches the second CDR obtained by the second CDR obtaining unit; a false calling number determining unit, configured to When the judging result obtained by the judging unit is negative, it is determined that the calling number of the first call is a false calling number.

The beneficial effects of the embodiments of the present invention are as follows:

The solution provided by the embodiment of the present invention is based on the fact that both the inter-network call and the cross-network call transfer need to be transmitted in different communication networks, and the CDR of the call before going out of the network and the call after going out of the network can be recorded separately in different communication networks . The CDR of the call before and after network access can also be recorded separately. It is proposed to use the CDR of the first call initiated in the first communication network and the second call obtained by calling out the first call from the first communication network Whether the CDR matches is used as the basis for judging the false calling number. Because both the calling number and the called number are the home number of the operator, and the attribute is an inter-network call forwarded through the network, or the calling number is the home number of the operator, and the called number is the home number of other operators, And the calls initiated by the calling number from the operator's network all have the characteristics of being recorded in CDR, so the solutions provided by the embodiments of the present invention can effectively realize the identification of false calling numbers in these types of calls. Therefore, the problem that the false calling number identification technology provided in the prior art cannot identify the false calling number in the scenario of over-network call forwarding is avoided.

Description of drawings

Fig. 1 is a network diagram of a false calling number call monitoring system in the prior art;

Fig. 2 is a schematic diagram of a false calling number determination process in the prior art;

FIG. 3 is a schematic flowchart of a method for identifying a false calling number provided by an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of a device for identifying a false calling number provided by an embodiment of the present invention;

5 is a schematic diagram of the internal structure of the false calling number identification system in practical applications and the relationship between the identification system and the main network elements in the communication network;

Fig. 6a is a schematic flow diagram of identifying a false calling number of a real over-the-network call using the scheme provided by the embodiment of the present invention;

Fig. 6b is a schematic diagram of an implementation scenario of the process shown in Fig. 6a.

Detailed ways

In order to solve the problem that the false calling number identification technology provided by the prior art cannot identify the false calling number in the network call forwarding scenario, the embodiment of the present invention provides a false calling number identification scheme. This solution is based on the fact that both inter-network calls and cross-network call forwarding need to be transmitted in different communication networks, and the CDRs of calls before and after going out of the network can be recorded separately in different communication networks, and the CDRs of calls before and after going out of the network can be recorded separately. The CDR of the subsequent call can also be recorded separately. It is proposed to use the CDR of the first call initiated in the first communication network and the CDR of the second call obtained by the first communication network to call out the first call. The basis for judging the false calling number.

Because both the calling number and the called number are the home number of the operator, and the attribute is an inter-network call forwarded through the network, or the calling number is the home number of the operator, and the called number is the home number of other operators, and the The calls initiated by the calling number from the operator's network all have the characteristics described above, so the scheme provided by the embodiment of the present invention can effectively realize the identification of false calling numbers in these calls, avoiding the need to The false calling number identification technology provided by the prior art cannot identify the false calling number in the network call forwarding scenario.

The solutions provided by the embodiments of the present invention are described in detail below.

First of all, the embodiment of the present invention provides a method for identifying a false calling number as shown in Figure 3, the method includes the following main steps:

Step 31, obtaining the CDR of the first call in the first communication network; wherein, the calling number of the first call belongs to the first communication network, and the called number of the first call belongs to the second communication network;

The first CDR may be provided by the SCP in the first communication network, or provided by a record providing device in the first communication network. The embodiment of the present invention is mainly described by taking the SCP as an example, in fact, other network elements can also play the same function. For example, when the first communication network is an IP Multimedia Subsystem (IP Multimedia Subsystem, IMS) network, the first CDR may be provided by a Call Session Control Function (Call Session Control Function, CSCF) network element in the IMS network. Among them, the CSCF network element is a functional entity inside the IMS network, and is the core of the entire IMS network. It is mainly responsible for handling the signaling control during the multimedia call session, managing the user authentication of the IMS network, the QoS of the IMS bearer plane, cooperating with other network entities to control the SIP session, service negotiation and resource allocation, etc.

Generally, once a user who has subscribed to a smart service initiates a call using his mobile terminal and number, that is, the first call mentioned above, the first call can be triggered to the SCP, so that the SCP can make a call to the first The CDR of the call is recorded. Generally, the first CDR recorded by the SCP may include the calling number and the called number. Optionally, the first CDR recorded by the SCP may further include information related to the call, such as the original call forwarding number, source signaling point number, and call origination time.

As far as the record providing device is concerned, it may be a GMSC, or a signaling monitoring point device preset on the signaling link connected to the GMSC, or an international gateway office.

The subject of execution of the method provided by the embodiment of the present invention may be, but not limited to, a device dedicated to identifying a false calling number (which may be referred to as a device for identifying a false calling number). The aforementioned SCP, GMSC or signaling monitoring point equipment may provide the device with the CDR recorded by itself.

Step 32, obtaining the second CDR of the second call obtained by calling out the first call to the second communication network by the first communication network; wherein, the first CDR and the second CDR have the same call identifier, and the first CDR and the Both the calling number and the called number in the second CDR;

Further, the first and second CDRs may also include information related to the call, such as the original number of the call forwarded to, the number of the source signaling point, and the time when the call was initiated.

Optionally, the second CDR may be provided by a record providing device in the first communication network. For example, assuming that the GMSC (or MSC) of the first communication network obtains the corresponding second call by calling out the first call, the record providing device can record the second call with the same call identifier as the first call The called CDR is recorded to obtain the second CDR. This situation may occur in a scenario where the first call is an inter-network call between the first communication network and the second communication network.

Optionally, the GMSC in the first communication network obtains the corresponding second call by calling out the first call to the second communication network, and the second communication network transfers the second call back to the GMSC of the first communication network. When the GMSC (or MSC), the GMSC (or MSC) can record the CDR of the second call that is transferred back, and use it as the second CDR. This situation may occur in a scenario where the first call is a call forwarded through the network.

Step 33, judging whether the first CDR and the second CDR match; if the judging result is no, go to step 34, if the judging result is yes, go to step 35;

Optionally, when both the first CDR and the second CDR include at least the calling number and the called number, the specific implementation process of step 33 may include:

judging whether the first CDR contains the same calling number as the calling number contained in the second CDR;

When the judgment result is no, determine that the first CDR does not match the second CDR;

When the judgment result is yes, respectively determine the called number in each record where the calling number identical to the calling number contained in the second CDR is contained in the first CDR; and compare the number contained in the second CDR , and whether the called number in each record where the calling number is the same as the calling number contained in the first CDR is the same as the called number determined from the first CDR;

When the comparison result is yes, determining that the first CDR and the second CDR match;

When the comparison result is negative, but the called number determined from the first CDR is a legal IP number, it is determined that the first CDR and the second CDR match;

When the comparison result is negative and the called number determined from the first CDR is not a legal IP number, it is determined that the first CDR does not match the second CDR.

Optionally, judging whether the first CDR contains the same calling number as the calling number contained in the second CDR, specifically includes:

It is judged whether the same calling number as that contained in the second CDR is included in each record included in the first CDR and recorded within a predetermined period of time from the generation time of the first CDR.

Optionally, when the first CDR also includes the generation time point of the first CDR, and the second CDR also includes the generation time point of the second CDR, the specific realization of judging whether the first CDR matches the second CDR Process can include:

Determine whether the calling numbers contained in the first CDR and the second CDR are consistent, determine whether the called numbers contained in the first CDR and the second CDR are consistent, and determine whether the generation time of the first CDR is different from the generation of the second CDR Whether the time length of the time point is less than a preset time length threshold;

When the judgment results are all yes, it is determined that the first CDR matches the second CDR; otherwise, it is determined that the first CDR does not match the second CDR.

Step 34, determining that the calling number of the first call is a false calling number;

After the false calling number is identified by performing step 34, the disconnection operation for the call with the above call identifier can be further performed. Or, it is also possible to only record the false calling number, and monitor the calls initiated by it, and so on.

In step 35, it is determined that the calling number of the first call is not a false calling number, and the flow ends.

The embodiment of the present invention is based on the fact that both the inter-network call and the call forwarded through the network need to be transmitted in different communication networks, and the CDRs of the calls before going out of the network and the calls after going out of the network can be recorded separately in different communication networks. The CDR of the call before and after network access can also be recorded separately, and it is proposed to use the CDR of the first call initiated in the first communication network and the CDR of the second call obtained by calling out the first call from the first communication network Whether it matches or not is used as the basis for judging the false calling number. Because both the calling number and the called number are the home number of the operator, and the attribute is an inter-network call forwarded through the network, or the calling number is the home number of the operator, and the called number is the home number of other operators, And the calls initiated by the calling number from the operator's network all have the above-mentioned characteristics, so the solutions provided by the embodiments of the present invention can effectively realize the identification of false calling numbers in these types of calls, thereby avoiding The false calling number identification technology provided by the prior art cannot identify the false calling number in the network call forwarding scenario.

Corresponding to the method provided by the embodiment of the present invention, the embodiment of the present invention also provides a false calling number identification device, the specific structural diagram of the device is shown in Figure 4, including the following functional units:

The first CDR obtaining unit 41 is configured to obtain the first CDR of the first call in the first communication network; wherein, the calling number of the first call belongs to the first communication network, and the called number of the first call belongs to the first CDR 2. communication network;

The second CDR obtaining unit 42 is configured to obtain the second CDR of the second call obtained by calling out the first call to the second communication network by the first communication network; wherein, the first CDR and the second CDR have the same call identifier , and both the first CDR and the second CDR include the calling number and the called number;

A judging unit 43, configured to judge whether the first CDR obtained by the first CDR obtaining unit 41 matches the second CDR obtained by the second CDR obtaining unit 42;

The false calling number determining unit 44 is configured to determine that the calling number of the first call is a false calling number when the judging result obtained by the judging unit 43 is negative.

Optionally, the second CDR obtaining unit 42 may be specifically configured to: obtain the first CDR record provided by the record providing device in the first communication network and recorded by the second communication network when the second call is transferred back to the first communication network. Two CDRs; wherein, the second call is obtained by the first communication network calling out the first call to the second communication network.

Wherein, the record providing device mentioned here may be: the GMSC or the signaling monitoring point device preset on the signaling link connected to the GMSC.

Optionally, the first CDR obtaining unit 41 may be specifically configured to: obtain the first CDR provided by the service control point SCP in the first communication network; or specifically to: obtain the IMS network when the first communication network is an IMS network. The first CDR provided by the CSCF network element in the network.

Optionally, the judging unit 43 may specifically include the following functional subunits:

A judging subunit, configured to judge whether the first CDR contains the same calling number as that contained in the second CDR;

The first determining subunit is used to determine that the first CDR does not match the second CDR when the judgment result obtained by the judging subunit is No;

The called number determination subunit is used to determine each record where the calling number contained in the first CDR is the same as the calling number contained in the second CDR when the judgment result obtained by the judging subunit is Yes The called number in

The comparison subunit is used to compare whether the called number in each record where the calling number contained in the second CDR is the same as the calling number contained in the first CDR is the same as that determined by the called number determining subunit. The called number is the same;

The second determination subunit is used to determine that the first CDR and the second CDR match when the comparison result obtained by the comparison subunit is Yes; the comparison result obtained by the comparison subunit is No, but the determined from the first CDR is When the called number is a legal IP number, it is determined that the first CDR and the second CDR match; the comparison result obtained by the comparison subunit is no, and when the called number determined from the first CDR is not a legal IP number, it is determined The first CDR and the second CDR do not match.

Optionally, the judging subunit can specifically be used to: judge whether each record contained in the first CDR and recorded within a specified time period from the time when the first CDR is generated contains the same record as that contained in the second CDR. The calling number with the same calling number.

Optionally, when the first CDR also includes the generation time point of the first CDR, and the second CDR also includes the generation time point of the second CDR, the judging unit 42 can specifically be divided into the following functional subunits:

The judging subunit is used to judge whether the calling numbers contained in the first CDR and the second CDR are consistent, whether the called numbers contained in the first CDR and the second CDR are consistent, and judge the generation time point of the first CDR Whether the time length from the generation time point of the second CDR is less than a preset time length threshold;

The determining subunit is configured to determine that the first CDR and the second CDR match when the judgment results obtained by the judging subunit are all yes; otherwise, determine that the first CDR and the second CDR do not match.

Optionally, the device provided in this embodiment of the present invention may further include: a call handling unit. It is used for disconnecting the call with the above-mentioned call identifier after the false calling number determining unit 44 determines that the calling number of the first call is a false calling number.

The implementation manner of the above solutions provided by the embodiments of the present invention in practical applications is introduced below.

Generally, the implementation of this solution can have the following basic prerequisites:

1. The inter-network calls between mobile operators and other telecom operators need to be routed through the mobile operator's GMSC. This premise is determined by the interconnection and interoperability agreement between telecom operators and the No. 7 signaling agreement, and it is already naturally available.

2. All users of each local operator have subscribed to the intelligent network service by default, and the calls initiated by the users are forwarded by the MSC/VLR they access to the SCP corresponding to the home location register HLR according to the subscription information. In order to provide enterprise network (micro-grid) services and carry out arrears control, this condition has been fully or partially met in some provincial networks of some mobile operators. Since the contract to the intelligent network service is beneficial for the operator to provide customized services for the users of the network, the basic environment for this premise is satisfied.

Note: For the mobile network that uses IMS to replace the intelligent network, for the embodiment of the present invention, the IMS can completely replace the mobile intelligent network in terms of function, and will not be described in detail later.

Under the above preconditions, in practical applications, a CDR-based false calling number identification system can be set based on the protocol mechanism for interconnection among communication operators and mobile intelligent network services. By introducing new technical methods, the false calling number identification system can monitor not only the scenarios covered by the existing system, but also the scenarios that cannot be covered by the existing system, such as:

The calling number and called number are both the home number of the operator, and the attribute is an inter-network call forwarded through the network;

The calling number is the home number of the operator, and the called number is the home number of other operators. The call is initiated from the network of the operator by the calling number.

Specifically, the internal structure of the false calling number identification system (hereinafter referred to as the identification system) and the relationship between the identification system and the main network elements in the communication network are shown in FIG. 5 .

The relationship between the identification system shown in Figure 5 and other network elements is specifically described as follows:

1. Relationship with SCP: When a user on this network initiates a call, the call will be forwarded to SCP by MSC/VLR, and SCP is responsible for providing the detailed call record of this call, that is, the CDR of this call, to the identification system.

2. Relationship with GMSC/signaling monitoring point: between GMSC and signaling monitoring point, there is a relationship between GMSC and signaling monitoring point, but the signaling monitoring point in the embodiment of the present invention refers specifically to the signaling associated with GMSC Signaling monitoring point on the link. The GMSC/signaling monitoring point is responsible for submitting the CDR of the call initiated from the local network, or the CDR of the incoming call from the local network user to the identification system.

Note: A GMSC is technically superior to a signaling monitoring point as it can suspend the call (ie relay the signaling) and wait for further instructions from the identification system of an embodiment of the present invention. The signaling monitoring point can only record the signaling (that is, copy the signaling), so the call process will continue until the service terminates naturally or the network decides that the connection needs to be disconnected.

3. Relationship with the false call handling system: In the embodiment of the present invention, the false call handling system is an optional system. If the false call handling system exists, there will be an opportunity to deal with the calls initiated by the found false calling numbers (hereinafter referred to as false calls) in a timely manner, such as notifying GMSC to perform disconnection processing on the false calling number, or Monitor it further, etc.

In the embodiment of the present invention, the CDR acquisition module in the identification system includes three sub-modules, which are respectively the SCP calling CDR acquisition sub-module, the GSMC's outgoing network CDR acquisition sub-module and the GSMC's network incoming CDR acquisition sub-module, and their functions are successively respectively It is responsible for collecting the CDR of the call initiated by the user of the local network, the CDR of the outgoing call from the GMSC (that is, the CDR of the outgoing call) and the CDR of the call that is transferred back to the local network from other networks (that is, the CDR of the incoming call). Another module in the identification system, namely the false caller identification module package, mainly includes two sub-modules, namely the CDR recording sub-module and the comparison identification sub-module, wherein the former is responsible for recording the CDR collected by the CDR acquisition module, The comparison and identification sub-module is used for real-time identification of false calling based on the CDR recorded by the CDR acquisition module and notification of the identification result.

Taking a certain operator as an example, if a number belonging to the operator initiates a real call, the MSC/VLR connected to the terminal using the number will automatically trigger the CDR of the call to be sent to the operator according to the user's subscription information. The SCP of the home network of the number, that is, the SCP sent to the operator's network. The SCP node will further send the CDR of the call to the above identification system described in the embodiment of the present invention in real time. For ease of description, this CDR may be referred to as record 1.

At the same time, when the call signaling generated from this number is called out by the operator's GMSC, the corresponding CDR will also be sent to the identification system of the embodiment of the present invention in real time, and the CDR may be called record 2. If the information in record 1 and record 2 can match, it proves that the call initiated by this number is legal; if the information in record 1 and record 2 cannot match, it can be judged that the call is initiated by a false calling number , so that the call can be followed up immediately according to the supervisory requirements.

Specifically, for a false calling number identification process for a real over-the-network call, reference may be made to the steps shown in FIG. 6a. Please refer to Figure 6b for the implementation scenario of this process. In Figure 6b, both user A and user B are users of the same operator (hereinafter referred to as the operator), and belong to different HLRs; user C is a user of another operator. The steps shown in Figure 6a are described in detail below:

Step 61, assuming that the call is initiated by user A, since user A has subscribed to the intelligent network service, according to its service flow, the call of user A will be triggered to the SCP and forwarded to the above identification system provided in the embodiment of the present invention.

In step 62, the identification system records the CDR of the call initiated by user A, and the CDR is record 1.

Generally, record 1 may include information such as calling number, called number, original number for call forwarding, source signaling point number, and call origination time.

Step 63, when the user C corresponding to the called number is in the network of other operators, the call initiated by user A will be dialed out by the GMSC of the operator and then enter the GMSC of the other operator; the GMSC of the operator (or its surrounding signaling nodes The signaling monitoring point set in ) can transmit the CDR collected when it calls out the call initiated by user A, that is, record 2, to the above identification described in the embodiment of the present invention by means of forwarding or relaying system.

In step 64, the identification system matches record 1 and record 2. If record 1 and record 2 do not match, it determines that the call initiated by user A is a false call, and subsequent processing is required.

Through the above steps, it can be known that using the false calling number identification scheme provided by the embodiment of the present invention, the calling number is a number belonging to the operator, and the called number is a number belonging to other operators, and the call is made by the number belonging to the operator. In the scenario where the operator’s number is initiated, it is possible to determine whether the calling number is a false caller by comparing the record 1 provided by the SCP to the identification system and the record 2 of the call provided by the operator’s GMSC to the identification system. number, so compared with the way of comparing the bills after the call provided by the prior art, the solution provided by the embodiment of the present invention can successfully complete the pairing even if the calling and called numbers belong to the same HLR. Identification of false calling numbers.

Based on the implementation scenario shown in Figure 6b, if it is assumed that user A still initiates a call to user C, and user C sets up the call forwarding service, and assumes that the call forwarding service can realize the call forwarding from user A to user C To user B with the number of the operator, that is, assuming that user A initiates a call transfer through the network. Then, in this case, the call will first be dialed out from the GMSC of the operator to the GMSC of the operator to which user C belongs, and then the call will be dialed out to the GMSC of the operator by the GMSC of the operator to which user C belongs. In this way, when a call is made to the GMSC of the operator, the GMSC of the operator (or the signaling monitoring point set in the surrounding signaling nodes) can make a CDR call to the GMSC of the operator to which user C belongs. , that is, the record 3 is recorded, and the record 3 is transmitted to the identification system described in the embodiment of the present invention by means of forwarding or relaying. Wherein, record 3 may include: calling number, called number, original number for call forwarding, call origination time, connection time, source signaling point number and destination signaling point number, etc. On the other hand, since user A has subscribed to the intelligent network service, according to its service flow, when user A initially initiates a call, the call will be triggered to the SCP and forwarded to the above-mentioned identification system provided in the embodiment of the present invention, thus The identification system can record the CDR of the call initiated by user A, so as to obtain record 1 . Wherein, record 1 may generally include: the calling number, the called number, the original number to which the call was transferred, and the call origination time. The identification system can determine whether the calling number is a false calling number by judging whether the record 1 and the record 3 match. Specifically, if it is judged that the calling number, called number, original number for call transfer, and call origination time contained in record 1 are respectively different from the calling number, called number, original call transfer number, and call origination time contained in record 3 If the correspondence is consistent, it is judged that record 1 and record 3 match; and if it is judged that any one of the information contained in record 1, including the calling number, called number, original number for call forwarding, and call origination time, is the same as that in record 3 If the corresponding information included is inconsistent, it is judged that record 1 and record 3 do not match, thereby judging that the calling number is a false calling number.

According to the solution provided by the embodiment of the present invention in the implementation process of the above scenario, it can be seen that for inter-network calls, as long as the calling number belongs to the operator to which the incoming GMSC belongs, no matter whether the called user belongs to the same Regardless of whether the called number and the calling number belong to the same operator in the network served by an HLR, the identification system provided by the embodiment of the present invention can realize the judgment and identification of false calling numbers. That is to say, the recognition system provided by the embodiment of the present invention can monitor the following scenarios that cannot be covered by the existing system in addition to the scenarios covered by the existing system:

1. Both the calling and called numbers belong to the operator to which the GMSC belongs, and the attribute of the call is an inter-network call forwarded through the network;

2. The calling number is the number belonging to the operator to which the incoming GMSC belongs, the called number is the number belonging to other operators, and the call is initiated by the calling number from the operator's network.

In the embodiment of the present invention, according to the above scenario, the definitions of three time points t ₁ , t ₂ and t ₃ are introduced, where:

t ₁ is the generation time point of record 1, which may be consistent with the origination time contained in the CDR;

_t2 is the generation time point of record 2, and _t2 may be the time point when record 2 is forwarded or relayed by the operator's GMSC or signaling monitoring point;

t ₃ is the generation time point of record 3, t ₃ can be the time point when record 3 is forwarded or relayed by the operator's GMSC or signaling monitoring point, or the call related to the record 3 is sent by the operator's GMSC the point in time of the continuation;

According to the above definition, there are two formulas as follows:

Δt ₂₁ =t ₂ -t ₁

Δt ₃₁ =t ₃ -t ₁

If it is assumed that records 1 and 2 at least include: calling number, called number and other information. And when the call is an inter-network transfer call, records 1 and 3 at least include: calling number, called number, original number for call forwarding, forwarding port number and other information. Then, the specific matching rules of record 1 and record 2, and record 1 and record 3 are described as follows.

For a call where the calling number is the home number of the operator and the called number is the home number of another operator, records that can be matched are record 1 and record 2. Specifically, the matching rules for record 1 and record 2 are:

According to the called number and calling number contained in record 2, find out whether the calling number in record 2 is included in all the information recorded in record 1 within the time length of Δt ₂₁ from the time when record 1 is generated The number and the called number match the same information respectively. If it is judged as yes, it is determined that the call is a real call, otherwise it is determined that the call is a false call.

However, for a call whose calling number is the home number of the operator, and the call initiated by it is an inter-network call transferred back to the home number of the operator, the records that can be matched are record 1 and record 3. Specifically, the matching rules for record 1 and record 3 are:

According to the calling number, called number and original call forwarding number contained in record 3, find out whether all the information recorded in record 1 within the time length of Δt ₃₁ from the generation time of record 1 is included and recorded In 3, the calling number, called number, and original number for forwarding the call completely match the calling number, called number, and original number for forwarding the call. If it is judged as yes, it is determined that the call is a real call, otherwise the following operations can be further performed:

Find out whether the calling number in record 3 is consistent with the calling number in record 3 in all the information recorded in record 1 within the length of time Δt ₃₁ from the moment when record 1 is generated, and the corresponding called number is the same as The called number in record 3 is inconsistent, but it is information about a legal IP number (eg: 17991). If the search result is such information as above, it is determined that the call is a suspected real call, otherwise it is determined that the call is a false call.

In the embodiment of the present invention, if it is assumed that record 1 includes at least: calling number, called number and t ₁ ; record 2 includes at least calling number, called number and t ₂ ; record 3 includes at least calling number, called number and t ₃ . Then, the specific matching rules for record 1 and record 2, and record 1 and record 3 can be as follows:

Prioritize the comparison of record 1 and record 3, when it is determined by comparison that record 1 and record 3 satisfy: the calling numbers contained in them are consistent, the called numbers contained in them are consistent, and Δt ₃₁ =t ₃ -t ₁ satisfies Δt ₃₁ When it is less than the preset time length threshold, it is determined that the calling number is a non-false calling number, otherwise, it is determined that the calling number is a false calling number.

Generally speaking, by comparing record 1 and record 3, it is possible to accurately identify whether the calling number is a false calling number, so comparing record 1 and record 2 is an optional operation in the embodiment of the present invention. For example, by comparing record 1 and record 3, it is determined that record 1 and record 3 satisfy: the calling numbers contained in them are consistent, the called numbers contained in them are consistent, and Δt ₃₁ =t ₃ -t ₁ satisfies Δt ₃₁ When it is not less than the preset time length threshold a, it can be determined that the calling number is a suspected false calling number at this time, so as to further perform the operation of comparing record 1 and record 2. If record 1 and record 2 are further compared, it is determined that record 1 and record 2 meet: the calling numbers contained in them are consistent, the called numbers contained in them are consistent, and Δt ₂₁ =t ₂ -t ₁ satisfies that Δt ₂₁ does not If it is less than the preset time length threshold b, then it can be determined that the calling number is a non-false calling number at this time, otherwise, it can be determined that the calling number is a false calling number.

In the embodiment of the present invention, the identification system can send the identification result to the false caller handling system in real time, and the false caller handling system decides how to deal with the call according to supervision needs, such as disconnection or further signaling tracking.

In the existing technology, the biggest problem in the management of false calls is that the scenarios that can be effectively monitored are very limited. However, the identification system designed by the embodiment of the present invention can reliably realize real-time identification of false inter-network calls in the scenario where the calling number of the call is the own operator, thereby expanding the scope of identification or monitoring.

The solution provided by the embodiment of the present invention can be developed on the basis of the operator's existing signaling monitoring points and the mobile intelligent network, so that the solution is highly realizable and the cost is low.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and combinations of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable resource processing devices to produce a machine such that the instructions executed by the processor of the computer or other programmable resource processing device produce a machine Means for realizing the functions specified in one or more steps of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable resource processing device to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded into a computer or other programmable resource processing device, so that a series of operational steps are performed on the computer or other programmable device to produce a computer-implemented process, so that the process executed on the computer or other programmable device The instructions provide steps for implementing the functions specified in the flow chart flow or flows and/or block diagram block or blocks.

While preferred embodiments of the invention have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, it is intended that the appended claims be construed to cover the preferred embodiment as well as all changes and modifications which fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (10)

1. A method for identifying a false calling number, characterized in that it comprises: Obtaining a first call detail record CDR of a first call in a first communication network; wherein, the calling number of the first call belongs to the first communication network, and the called number of the first call belongs to the first 2. communication network; Obtaining a second CDR of a second call obtained by calling out the first call to the second communication network by the first communication network; wherein the first CDR and the second CDR have the same call identification, and both the first CDR and the second CDR include a calling number and a called number; both the first CDR and the second CDR are provided by a recording device in the first communication network; judging whether the first CDR matches the second CDR; When the judgment result is no, it is determined that the calling number of the first call is a false calling number; Wherein, obtaining the second CDR specifically includes: obtaining the second CDR recorded by the second communication network when transferring the second call back to the first communication network, provided by a record providing device in the first communication network; wherein, The second call results from the first communication network placing the first call out to the second communication network; Obtaining the first CDR specifically includes: Obtain the first CDR provided by the Service Control Point SCP in the first communication network; or When the communication network is an IP multimedia subsystem network, obtain the first CDR provided by a CSCF network element in the IP multimedia subsystem network. 2. The method according to claim 1, wherein the record providing device is: a gateway mobile switching center GMSC; or a signaling monitoring point device preset on a signaling link connected to the GMSC; or an international Gateway Bureau. 3. The method according to claim 1, wherein judging whether the first CDR matches the second CDR specifically comprises: judging whether the first CDR contains the same calling number as the calling number contained in the second CDR; When the judgment result is no, determine that the first CDR does not match the second CDR; When the judgment result is yes, respectively determine the called number in each record where the calling number contained in the first CDR is the same as the calling number contained in the second CDR; and compare the Whether the called number in each record containing the calling number contained in the second CDR and the same as the calling number contained in the first CDR is the same as the called number determined from the first CDR same number; When the comparison result is yes, determining that the first CDR matches the second CDR; When the comparison result is negative, but the called number determined from the first CDR is a legal IP number, determine that the first CDR matches the second CDR; When the comparison result is negative and the called number determined from the first CDR is not a valid IP number, it is determined that the first CDR does not match the second CDR. 4. The method according to claim 3, wherein judging whether the first CDR contains the same calling number as the calling number contained in the second CDR, specifically comprises: Judging whether each record contained in the first CDR and recorded within a specified time period from the time when the first CDR is generated contains the same caller number as that contained in the second CDR. call the number. 5. The method according to claim 1, wherein the first CDR also includes the generation time point of the first CDR; the second CDR also includes the generation of the second CDR point in time; then Judging whether the first CDR matches the second CDR specifically includes: Judging whether the calling numbers included in the first CDR and the second CDR are consistent, judging whether the called numbers included in the first CDR and the second CDR are matching, and judging whether the called numbers included in the first CDR are consistent. Whether the time length between the generation time point of the second CDR and the generation time point of the second CDR is less than a preset time length threshold; When the judgment results are all yes, determine that the first CDR matches the second CDR; Otherwise, it is determined that the first CDR does not match the second CDR. 6. A device for identifying a false calling number, characterized in that it comprises: The first CDR obtaining unit is configured to obtain the first call detail record CDR of the first call in the first communication network; wherein, the calling number of the first call belongs to the first communication network, and the first The called number of the call belongs to the second communication network; A second CDR obtaining unit, configured to obtain a second CDR of a second call obtained by calling out the first call to the second communication network by the first communication network; wherein, the first CDR and the The second CDR has the same call identifier, and both the first CDR and the second CDR include a calling number and a called number; both the first CDR and the second CDR are the first provided by recording equipment in the communication network; a judging unit, configured to judge whether the first CDR obtained by the first CDR obtaining unit matches the second CDR obtained by the second CDR obtaining unit; A false calling number determining unit, configured to determine that the calling number of the first call is a false calling number when the judgment result obtained by the judging unit is No; Wherein, the second CDR obtaining unit is specifically configured to: obtain the record providing device in the first communication network provided by the second communication network when the second call is transferred back to the first communication The second CDR recorded in the network; wherein, the second call is obtained by the first communication network calling out the first call to the second communication network; The first CDR obtaining unit is specifically configured to: obtain the first CDR provided by the service control point SCP in the first communication network; or specifically to: when the first communication network is an IP Multimedia Subsystem network, Obtain the first CDR provided by the CSCF network element in the IP Multimedia Subsystem network. 7. The device according to claim 6, wherein the record providing device is: a gateway mobile switching center GMSC; or a signaling monitoring point device preset on a signaling link connected to the GMSC; or an international Gateway Bureau. 8. The device according to claim 6, wherein the judging unit specifically comprises: A judging subunit, configured to judge whether the first CDR contains the same calling number as the calling number contained in the second CDR; The first determining subunit is configured to determine that the first CDR does not match the second CDR when the judgment result obtained by the judging subunit is No; The called number determining subunit is configured to determine the location of the calling number included in the first CDR and identical to the calling number included in the second CDR when the judgment result obtained by the judging subunit is Yes. The called number in each record of ; A comparison subunit, configured to compare whether the called number in each record containing the calling number contained in the second CDR and the same as the calling number contained in the first CDR is identical to the called number The called numbers determined by the subunits are the same; The second determination subunit is used to determine that the first CDR and the second CDR match when the comparison result obtained by the comparison subunit is Yes; the comparison result obtained by the comparison subunit is No, but from the first CDR When the called number determined in a CDR is a legal IP number, it is determined that the first CDR and the second CDR match; the comparison result obtained in the comparison subunit is no, and the determined IP number from the first CDR When the called number is not a valid IP number, it is determined that the first CDR does not match the second CDR. 9. The device according to claim 8, wherein the judging subunit is specifically configured to: judge the information contained in the first CDR and recorded within a specified time period from the time when the first CDR is generated Whether each record contains the same calling number as the calling number contained in the second CDR. 10. The device according to claim 6, wherein the first CDR includes the calling number, the called number and the generation time point of the first CDR; the second CDR includes the calling number , the called number and the generation time point of the second CDR; then The judging unit specifically includes: a judging subunit, configured to judge whether the calling numbers contained in the first CDR and the second CDR are consistent, and judge whether the called numbers contained in the first CDR and the second CDR are consistent, judging whether the time length between the generation time point of the first CDR and the generation time point of the second CDR is less than a preset time length threshold; The determination subunit is configured to determine that the first CDR matches the second CDR when the judgment results obtained by the judging subunit are all yes; otherwise, determine that the first CDR does not match the second CDR.