CN104301896B - Swindle short message intelligent monitoring warning system and method - Google Patents
Swindle short message intelligent monitoring warning system and method Download PDFInfo
- Publication number
- CN104301896B CN104301896B CN201410545283.8A CN201410545283A CN104301896B CN 104301896 B CN104301896 B CN 104301896B CN 201410545283 A CN201410545283 A CN 201410545283A CN 104301896 B CN104301896 B CN 104301896B
- Authority
- CN
- China
- Prior art keywords
- short message
- message
- business
- text message
- intelligent monitoring
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 153
- 238000000034 method Methods 0.000 title claims abstract description 38
- 238000012545 processing Methods 0.000 claims abstract description 135
- 230000011664 signaling Effects 0.000 claims abstract description 127
- 238000007726 management method Methods 0.000 claims description 83
- 238000004458 analytical method Methods 0.000 claims description 71
- 238000003745 diagnosis Methods 0.000 claims description 32
- 230000002452 interceptive effect Effects 0.000 claims description 32
- 230000006978 adaptation Effects 0.000 claims description 24
- 230000005540 biological transmission Effects 0.000 claims description 19
- 238000004891 communication Methods 0.000 claims description 18
- 230000003993 interaction Effects 0.000 claims description 18
- 238000000605 extraction Methods 0.000 claims description 17
- 230000002159 abnormal effect Effects 0.000 claims description 11
- 238000013075 data extraction Methods 0.000 claims description 10
- 238000012790 confirmation Methods 0.000 claims description 9
- 238000007689 inspection Methods 0.000 claims description 9
- 239000000203 mixture Substances 0.000 claims description 7
- 238000003672 processing method Methods 0.000 claims description 7
- 230000008569 process Effects 0.000 claims description 5
- 238000007405 data analysis Methods 0.000 claims description 4
- 238000003860 storage Methods 0.000 claims description 2
- 230000008859 change Effects 0.000 description 6
- 239000000284 extract Substances 0.000 description 4
- 238000012986 modification Methods 0.000 description 4
- 230000004048 modification Effects 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 230000008929 regeneration Effects 0.000 description 3
- 238000011069 regeneration method Methods 0.000 description 3
- PEDCQBHIVMGVHV-UHFFFAOYSA-N Glycerine Chemical compound OCC(O)CO PEDCQBHIVMGVHV-UHFFFAOYSA-N 0.000 description 2
- 230000005856 abnormality Effects 0.000 description 2
- 230000002776 aggregation Effects 0.000 description 2
- 238000004220 aggregation Methods 0.000 description 2
- 238000013500 data storage Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 230000018109 developmental process Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000009826 distribution Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 241001269238 Data Species 0.000 description 1
- 241000282326 Felis catus Species 0.000 description 1
- 238000012098 association analyses Methods 0.000 description 1
- 238000010835 comparative analysis Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000000151 deposition Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/12—Messaging; Mailboxes; Announcements
- H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Mobile Radio Communication Systems (AREA)
- Telephonic Communication Services (AREA)
Abstract
This application discloses a kind of swindle short message intelligent monitoring warning system, after the system carries out convergence processing to the short message service signaling of the mobile subscriber of each network element in core mobile network and location updating traffic signaling data, the real-time matching monitoring of a variety of intelligent analytical models is carried out to the note data of user, by in useful signaling data deposit database, doubtful fraud text message is confirmed and sent a warning message to the potential user that is deceived simultaneously, realizes the timely warning function of the potential user that is deceived；The system is provided with five signaling data and converges assembly, intelligent monitoring Business Processing assembly, intelligent monitoring management assembly, intelligent alarm assembly and intelligent monitoring Service Database comprising modules.Disclosed herein as well is fraud text message intelligent monitoring alarm method.Technical scheme can quickly identify fraud text message, and the alarm in time once fraud text message is confirmed, also carry out timely prompting message to the potential user that is deceived of fraud text message, reduce the economic loss of user to greatest extent.
Description
Technical field
The present invention relates to a kind of swindle short message intelligent monitoring warning system and method, belong to the technical field of network security.
Background technology
With the fast development of China's mobile communication, SMS has become the information communication side that people generally use
Formula.In recent years, some criminals propagate deceptive information using SMS and defrauded of money, and have had a strong impact on broad masses of the people
Normal life order, have become the new delinquent problem disturbed public order.The harm of fraud text message is very serious,
On the one hand the economic loss of people is caused, is on the other hand even more the harmonious development for having a strong impact on society.Ministry of Industry and Information and telecom operation
Enterprise also takes regulator measure for short message fraud, and still, the mode of fraud text message is also constantly changing, and it swindles shape
Formula emerges in an endless stream, and mainly carries out distribution information with the various content-forms such as get the winning number in a bond, transfer accounts, while carried out in the recent period in the form of pseudo-base station
The new fraudulent mode of swindle, the proper communication environment of the people is even more had a strong impact on.
At present, following several, but these methods are mainly concentrated with for the system and method that fraud text message is identified
Some defects be present, be described as follows:
Short message analysis rule based on system analyzes doubtful number and forms number storehouse：Short message identification module is according to fraud text message
Rule identifies doubtful fraud text message, and produces reminding short message, then reminding short message is sent into short message system via SMS transmission module
After system, user (mobile terminal) is transmitted to；Meanwhile system produces anti-swindle note number storehouse, and carried out in real time to the whole network number storehouse
Report.This method using short message rule analysis number storehouse, short message analysis method is not described in, is flowed just for analysis
Journey is illustrated；Also without different business scenarios is analyzed, it identifies that the authenticity of doubtful fraud text message or function all need
Checking.Furthermore SMS Tip does not have artificial configuration mode, suggestion content not may be selected.
Keywords matching mode based on mobile phone terminal identifies fraud text message：By mobile phone terminal receive short message content with it is preset
Short message keyword database carry out matching comparative analysis, if the keyword that mobile phone terminal analyzes the short message matches entirely, direct mistake
The short message is filtered or deleted, when such as short message keyword being part matching, then the short message is classified as doubtful fraud text message, and based on preset
Familiarity Number send SMS Tip.In addition, keywords database wants real-time update, mobile phone terminal is real-time or intermittently passes through network service
Device updates keywords database to locally.The webserver is alarmed according to the fraud text message of identification by Alarm Server.It is this to pass through
The analysis that mobile phone terminal carries out fraud text message content based on keyword judges that renewal frequency and effect for keywords database also need
Checking.In addition, if fraud information is sent to Familiarity Number simultaneously, secondary waste short message can be produced.Its type of alarm is to pass through clothes
It is engaged in device alarm, if mobile phone terminal is in data network condition of contact, bad (such as user is not turned on data attended operation or communication network
The data field network coverage it is bad when), then be unable to Real-time Alarm.
User is determined come source code based on short message, or identification fraud text message is realized according to the report number frequency：Pass through transmission
The short message content of side, add short message for short message and carry out source code, for uniquely determining the feature of sender user.Then according to short
Letter carrys out source code and matched with the blacklist, white list or gray list of database.The base when gray list and blacklist of database
Judge in the number setting that user's short message is reported：When reporting n times, gray list is classified as, when reporting more than N+M times, is added black
List.Finally short message matching result is sent to recipient user.This method be additionally provided with interactive voice answering (IVR,
Interactive Voice Response), the inquiry of Short Message Service (SMS, Short Messaging Service) mode
Short message content whether be fraud text message flow.It is this that the short message true and false is differentiated with IVR or SMS inquiry modes by user, simultaneously
The short message frequency based on user's report is classified as blacklist and carries out sentencing for follow-up blacklist according to ex-post analysis blacklist mode
Disconnected system or method, can not just accomplish something for first fraudulent act.
With cloud database match based on mobile phone terminal short message content and realize identification：Received by user terminal short
Believe content, carry out whether matching judgment is swindle respectively according to the transmission number and/or short message content of short message and local data base
Short message；Terminal can real-time update cloud database simultaneously.Mobile terminal according to matching result carry out with voice and/or vibration prompting,
The modes such as picture prompting prompt user.This method needs user judges whether it is suspicious fraud text message according to comparison result, also
User is needed to will determine that result uploads to Cloud Server, trivial operations, trifling, user needs to be grasped corresponding knowledge or ability.Together
When local data base it is synchronous with cloud database also have delay and cause to judge by accident.
The content of the invention
In view of this, it is an object of the invention to provide a kind of swindle short message intelligent monitoring warning system and method, the present invention
System carries out real-time security monitoring for the short message in communication network, and form and content based on fraud text message are entered for short message content
Row big data is analyzed, and fraud text message, and the alarm in time once fraud text message is confirmed can be quickly identified, also to fraud text message
The potential user that is deceived carries out timely prompting message, reduces the economic loss of user to greatest extent.
In order to achieve the above object, it is pair the invention provides a kind of swindle short message intelligent monitoring warning system, the system
The short message service signaling and location updating traffic signaling of the mobile subscriber of each network element in the core mobile network of telecom operators
After data carry out convergence processing, the real-time matching monitoring of a variety of intelligent analytical models is carried out to the note data of user, will be useful
Signaling data deposit database in, while doubtful fraud text message is confirmed and to it is potential be deceived user send alarm letter
Breath, realize the timely warning function of the potential user that is deceived；The system is provided with signaling data and converges assembly, intelligent monitoring business processing
Five component, intelligent monitoring management assembly, intelligent alarm assembly and intelligent monitoring Service Database comprising modules；Wherein：
Signaling data and converges assembly, it is responsible for the rotocol adaptation interface collection by the component and convergence signaling data, then
Short message service signaling and location updating traffic signaling data are therefrom extracted by signaling data extraction module, then the short message service is believed
Order and location updating traffic signaling data carry out real-time via monitoring business Processing Interface and intelligent monitoring Business Processing assembly
Data interaction；Provided with three rotocol adaptation interface, signaling data extraction module and monitoring business Processing Interface comprising modules；
Intelligent monitoring Business Processing assembly, it is responsible for converging short message service of the interface to reception by the signaling data of the component
Signaling and location updating traffic signaling data are analyzed and processed, short with service provider SP (Service Provider) respectively
Communication service, point-to-point note business, pseudo-base station note business totally three business diagnosis processing module interaction datas, three modules
The matching for carrying out number data with intelligent monitoring Service Database simultaneously compares, if comparison is unsuccessful, by the doubtful swindleness of analysis
Deceive note number and feed back to SMS service management interface, the rear subscriber number that intelligent monitoring management assembly will confirm that is by alarm
Business module produces alarm data, is sent a warning message by alarm interface to the potential user that is deceived, while SMS service management
The calling number for the fraud text message that interface will confirm that is stored into intelligent monitoring Service Database；Intelligent monitoring Business Processing assembly
Provided with SMS service management interface, SP short message services analysis and processing module, point-to-point note business diagnosis processing module, pseudo-base station
Short message service analysis and processing module, signaling data convergence interface, alarm business module, alarm interface, business datum bank interface are total to
Eight comprising modules；
Intelligent monitoring management assembly, it is responsible for the master of doubtful fraud text message for tentatively confirming intelligent monitoring Business Processing assembly
Called number is collected and presented, then via manual confirmation after, sent a warning message in time to the potential user that is deceived, and
Rear subscriber number after will confirm that is classified as blacklist and deposit intelligent monitoring Service Database；Connect provided with SMS service management
Mouth, swindle short-message users management module, warning information management module, database interface totally four comprising modules；
Intelligent alarm assembly, it is responsible for the alarm letter that intelligent monitoring Business Processing assembly is returned to the potential user that is deceived and issued
Breath, and according to the different conditions of mobile phone terminal carry out protocol adaptation after, be handed down to mobile phone terminal and/or APP clients；Provided with announcement
Three alert data-processing interface, alarm business processing module and rotocol adaptation interface comprising modules；
Intelligent monitoring Service Database, for intelligent monitoring Business Processing assembly interactive information, to know SP short messages
Blacklist, the blacklist of point-to-point note and the blacklist of pseudo-base station note；Store daily record relevant information simultaneously；Be additionally operable to
Intelligent monitoring management assembly interactive information, store the calling number of fraud text message and the data template of warning information.
Present invention also provides a kind of fraud text message intelligent monitoring alarm method, this method is by described fraud text message intelligence
Monitoring warning system is implemented, and converges the short message service signaling and location updating traffic signaling data of telecommunications core network in real time first,
According to the communication protocol extraction used including in calling number, called number, caller GT addresses, called GT addresses, short message
Heart location, LAC, CI, sms center address, short message type, the much information of short message length and short message content, then according to the intelligence
The analysis and processing module of fraud text message in energy monitoring warning system is analyzed fraud text message, then the swindle to being analyzed to identify
The calling subscribe and called subscriber of short message perform corresponding processing operation according to early warning rule respectively；Methods described includes following behaviour
Make step：
Step 1, collection in real time and convergence short message signaling data：The collection in real time of signaling convergence component and convergence telecommunications core network
Short message service signaling and location updating traffic signaling data, according to use communication protocol extraction short message include calling number,
Called number, caller GT addresses, called GT addresses, sms center address, LAC, CI, sms center address, short message type, short message
The much information of length and short message content；
Step 2, intelligent monitoring processing is performed to fraud text message：For magnanimity note data, respectively according to SP short messages, point pair
Point short message, the different intelligent monitor processing method of pseudo-base station note carry out the identification and confirmation of fraud text message, confirm fraud text message
Afterwards, the rear subscriber number of the fraud text message is classified as blacklist；Called number is aggregated to form potential fraud text message again
Victim user group；
Step 3, intelligent early-warning signal is sent：It is corresponding according to the number information of potential fraud text message victim user group, selection
Warning information template be ready for sending early warning short message, further according to the different conditions of mobile phone terminal, be adapted to different bearing protocols
Send the early warning short message.
The analysis and alarm of short message signaling data are carried out by swindle short message intelligent monitoring warning system, by the short message of user
Data carry out the real-time monitoring matching of a variety of intelligent analytical models in real time, so as to realize the timely alarm work(of potential swindle user
Energy.
Brief description of the drawings
Fig. 1 is the swindle short message intelligent monitoring warning system structured flowchart that the embodiment of the present application provides；
Fig. 2 is the structural representation of the signaling data and converges assembly in system shown in Figure 1；
Fig. 3 is the structural representation of the intelligent monitoring Business Processing assembly in system shown in Figure 1；
Fig. 4 is the structural representation of the intelligent monitoring management assembly in system shown in Figure 1；
Fig. 5 is the structural representation of the intelligent alarm assembly in system shown in Figure 1；
Fig. 6 is the fraud text message intelligent monitoring alarm method schematic flow sheet that the embodiment of the present application provides；
Fig. 7 is the SP short message intelligent monitoring alarm schematic flow sheets that the embodiment of the present application provides；
Fig. 8 is the point-to-point note intelligent monitoring alarm processing schematic diagram that the embodiment of the present application provides；
Fig. 9 is the pseudo-base station note intelligent monitoring alarm processing schematic diagram that the embodiment of the present application provides.
Embodiment
To make the object, technical solutions and advantages of the present invention clearer, the present invention is made below in conjunction with the accompanying drawings further
Detailed description.
From system composition structure, major function etc. description swindle short message intelligent monitoring warning system and method.
The composition structure for the swindle short message intelligent monitoring warning system that the embodiment of the present application provides is as shown in Figure 1.Swindle short
Letter intelligent monitoring warning system is the mobile subscriber in the core mobile network based on convergence telecom operators in each network element
Short message service signaling, location updating traffic signaling data, after by signaling data and converges assembly, convergence is handled, route point
The intellectual analysis that intelligent monitoring Business Processing assembly carries out short message content is dealt into, and useful data is stored in database, simultaneously
Confirmed by intelligent management and control management assembly for doubtful fraud text message, alarm letter is sent finally by intelligent alarm assembly
Breath, so as to realize the timely warning function of potential fraud text message user.The system is provided with signaling data and converges assembly, intelligent monitoring
Five business processing component, intelligent monitoring management assembly, intelligent alarm assembly and intelligent monitoring Service Database comprising modules.
Fig. 2 shows the structure for the signaling data and converges assembly that the embodiment of the present application provides.As shown in Fig. 2 signaling data
Convergence component is made up of rotocol adaptation interface, signaling data extraction module, monitoring business Processing Interface.Rotocol adaptation interface is used for
Collection and convergence signaling data, are then therefrom extracted short message service signaling and location updating business letter by signaling data extraction module
Data are made, then by the short message service signaling and location updating service note signaling data via monitoring business Processing Interface and intelligence
Monitoring business processing component carries out real-time data interaction；Provided with rotocol adaptation interface, signaling data extraction module and monitoring industry
Business three comprising modules of Processing Interface.
Specifically,
Rotocol adaptation interface, the interactive adaptation for being responsible for completing agreement with the network element relevant interface of core telecommunication network operate,
Core network signaling message is gathered by Web Service and/or real-time Socket protocol interface again, signaling data is transmitted to and carries
Modulus block is handled；
Signaling data extraction module, is responsible for the core network signaling message from rotocol adaptation interface collection, and extraction includes caller
Subscriber Number, called number, caller global title (GT, Global Title) address, called GT addresses, sms center
Location, position area (LAC, Location Area Code), cell ID (CI, Cell Id), short message service type, short message length
With the information of short message content, then by the information transmission extracted to monitoring business Processing Interface；
Monitoring business Processing Interface, it is responsible for the signaling information after extraction according to passing through monitoring business Processing Interface and intelligence
Monitoring business processing component interacts.
Intelligent monitoring Business Processing assembly carries out the Treatment Analysis of note data message by short message service Processing Interface, point
Not with SP short message services analysis and processing module, point-to-point note business diagnosis processing module, pseudo-base station note business diagnosis processing
Module carries out data interaction, while these three modules are done number data with intelligent monitoring Service Database and compared, such as comparison not into
Work(, then give the doubtful fraud text message number of analysis to SMS service management Processing Interface, and the message Jing Guo management assembly produces
Alarm data, the transmission of warning information is carried out by alarm interface, while the number data storage for the fraud text message that will confirm that is arrived
In intelligent monitoring Service Database.
Fig. 3 shows the structure for the intelligent monitoring Business Processing assembly that the embodiment of the present application provides, at intelligent monitoring business
Manage component and interface, alarm interface, alarm business module, SP short message services analysis and processing module, point-to-point is converged by signaling data
Short message service analysis and processing module, pseudo-base station note business diagnosis processing module, business datum bank interface, SMS service management connect
Mouth composition.Signaling data convergence interface analyzes and processes to the short message signaling data of reception, is analyzed respectively with SP short message services
Processing module, point-to-point note business diagnosis processing module and pseudo-base station note business diagnosis processing module interaction data, it is described
The matching that three business diagnosis processing modules carry out number data with intelligent monitoring Service Database simultaneously compares, if can not compare
Work(, then the doubtful fraud text message number of analysis is fed back into SMS service management interface, what intelligent monitoring management assembly will confirm that
Rear subscriber number produces alarm data by alarm business module, and alarm letter is sent to the potential user that is deceived by alarm interface
Breath, while the calling number of fraud text message that SMS service management interface will confirm that is stored into intelligent monitoring Service Database.
Specifically,
Signaling data converges interface, is responsible for receiving the short message of signaling data and converges assembly, and the short message data is divided
Do not handled with SP short message services analysis and processing module, point-to-point note business diagnosis processing module, pseudo-base station note business diagnosis
Module carries out data interaction；
SP short message service analysis and processing modules, for converging interactive interfacing with signaling data, analyzed according to SP short message services
Model, fraud text message analyzing and processing is carried out to SP classes short message；Interacted with SMS service management interface, to doubtful SP classes fraud text message
Confirmed and alerted；Also interacted by business datum bank interface with intelligent monitoring Service Database, so as to in the database
SP class calling subscribe's blacklists be compared, while store daily record relevant information；
Point-to-point note business diagnosis processing module, for converging interactive interfacing with signaling data, according to point-to-point note
Business diagnosis model, fraud text message analyzing and processing is carried out to point-to-point class short message；Interacted with SMS service management interface, to doubtful
Point-to-point class fraud text message is confirmed and alerted；Also interacted by business datum bank interface with intelligent monitoring Service Database,
To be compared with point-to-point calling subscribe's blacklist in the database, while store daily record relevant information；
Pseudo-base station note business diagnosis processing module, for converging interactive interfacing with signaling data, according to pseudo-base station note
Business diagnosis model, fraud text message analyzing and processing is carried out to pseudo-base station class short message；Interacted with APP clients, judge APP clients
State；Interacted with SMS service management interface, doubtful pseudo-base station class fraud text message is confirmed and alerted, while passes through business
Database interface stores daily record relevant information；
SMS service management interface, it is responsible for interacting with SP short message service analysis and processing modules respectively, doubtful SP is swindled short
Letter data carries out data interaction with intelligent monitoring management assembly；Interacted with point-to-point note business diagnosis processing module, will be doubtful
Point-to-point fraud text message data carry out data interaction with intelligent monitoring management assembly；With pseudo-base station note business diagnosis processing module
Interaction, doubtful pseudo-base station fraud text message data and intelligent monitoring management assembly are subjected to data interaction；Also with alarm business module
Interactive information, the service logic for the Real-time Alarm information that processing intelligent monitoring management assembly issues, relays to alarm interface；
Alarm business module, for SMS service management interface interactive information, handle the announcement of intelligent monitoring management assembly
Alert service logic data；Interacted with alarm interface, send alarm information to intelligent alarm assembly via alarm interface；
Alarm interface, for being interacted with alarm business module, receive the Real-time Alarm letter that intelligent monitoring management assembly issues
Breath；Also with intelligent alarm assembly interactive information, data analysis and route are carried out to warning information；
Business datum bank interface, for respectively with SP short message services analysis and processing module, point-to-point note business diagnosis
Reason module and pseudo-base station note business diagnosis processing module interact, so as to the blacklist according to SP short messages, point-to-point note
Blacklist and the blacklist list of pseudo-base station carry out the data analysis of doubtful fraud text message.
Intelligent monitoring management assembly, it is responsible for the master of doubtful fraud text message for tentatively confirming intelligent monitoring Business Processing assembly
Called number is collected and presented, then via manual confirmation after, sent a warning message in time to the potential user that is deceived, and
Rear subscriber number after will confirm that is classified as blacklist and deposit intelligent monitoring Service Database.
Fig. 4 is the structure for the intelligent monitoring management assembly that the embodiment of the present application provides, and intelligent monitoring management assembly is by short message
Service management interface, swindle short-message users management module, warning information management module, database interface composition.
SMS service management interface, for intelligent monitoring Business Processing assembly interactive information, by the monitor component business
Doubtful fraud text message after processing, is sent to swindle short-message users management module；
Swindle short-message users management module, for SMS service management interface interactive information, extracted from fraud text message
Rear subscriber number and called number；With warning information management module interactive information, to the called use of doubtful fraud text message
Family produces warning information；Interacted with management database interface, by the rear subscriber number storage of fraud text message to intelligence prison
The blacklist of Service Database is controlled, while stores daily record relevant information；
Warning information management module, for swindle short-message users management module interactive information, fraud text message is called
After Subscriber Number is collected and extracted, warning information is performed and chooses and confirms to operate；Handed over management database interface
Mutually, the template of warning information is stored and chosen, while store daily record relevant information；
Manage database interface, for swindle short-message users management module interactive information, by calling number data storage
To the blacklist of intelligent monitoring Service Database；Interacted with warning information management module, formulate and store warning information
Data template.
Intelligent alarm assembly is responsible for the warning information that intelligent monitoring Business Processing assembly is returned to the potential user that is deceived and issued,
And according to the different conditions of mobile phone terminal carry out protocol adaptation after, be handed down to mobile phone terminal and/or APP clients.
Fig. 5 shows the structure for the intelligent alarm assembly that the embodiment of the present application provides, and intelligent alarm assembly is by alarm data
Processing Interface, alarm business processing module, rotocol adaptation interface composition.
Alarm data Processing Interface, communicated with intelligent monitoring Business Processing assembly, the message of alarm business is carried out
Data interaction；Communicated with alarm business processing module, logical process analysis is carried out for the specific business of alarm；
Alarm business processing module, communicated with alarm business Processing Interface, patrolled for the specific business of alarm
Collect Treatment Analysis；Interacted with rotocol adaptation interface, continuing alarm according to the condition adapted different agreement of mobile phone terminal disappears
The transmission of breath；
Rotocol adaptation interface, alarm business processing are interacted, and different associations is adapted to for the different conditions of mobile phone terminal
View continues the transmission of alarm information.
Intelligent monitoring Service Database, for intelligent monitoring Business Processing assembly interactive information, to know SP short messages
Blacklist, the blacklist of point-to-point note and the blacklist of pseudo-base station note；Store daily record relevant information simultaneously；Be additionally operable to
Intelligent monitoring management assembly interactive information, store the calling number of fraud text message and the data template of warning information.
The swindle short message intelligent monitoring warning system also includes fraud text message intelligent monitoring application APP clients, the dress
Responsible and intelligent monitoring Business Processing assembly interactive information is put, to monitor the working condition of the client, while in time to swindle
The early warning that the called subscriber of short message sends a warning message；The data source of the system is the magnanimity communication letter of telecommunications mobile subscriber
Make data.
Present invention also provides a kind of fraud text message intelligent monitoring based on above-mentioned swindle short message intelligent monitoring warning system
Alarm method.Fig. 6 is the fraud text message intelligent monitoring alarm method flow that the embodiment of the present application provides, and converges telecommunications in real time first
The short message service signaling and location updating traffic signaling data of core net, extracted according to the communication protocol used including caller
Number, called number, caller GT addresses, called GT addresses, sms center address, LAC, CI, sms center address, short message class
The analysis of the much information of type, short message length and short message content, the then fraud text message in the intelligent monitoring warning system
Processing module is analyzed fraud text message, then the calling subscribe of the fraud text message to being analyzed to identify and called subscriber basis respectively
Early warning rule performs corresponding processing operation；Methods described includes following operative step：
Step 1, collection in real time and convergence short message service signaling and location updating traffic signaling data：Signaling convergence component is real
When gather and convergence telecommunications core network short message service signaling and location updating traffic signaling data, the communication protocols used according to short message
View extraction short message include calling number, called number, caller GT addresses, be called GT addresses, sms center address, LAC, CI,
Sms center address, short message type, the much information of short message length and short message content；
Step 2, intelligent monitoring processing is performed to fraud text message：For magnanimity note data, respectively according to SP short messages, point pair
Point short message, the different intelligent monitor processing method of pseudo-base station note carry out the identification and confirmation of fraud text message, confirm fraud text message
Afterwards, the rear subscriber number of the fraud text message is classified as blacklist；Called number is aggregated to form potential fraud text message again
Be deceived customer group；
Step 3, intelligent early-warning signal is sent：It is corresponding according to the number information of the potential customer group of being deceived of fraud text message, selection
Warning information template be ready for sending early warning short message, further according to the different conditions of mobile phone terminal, be adapted to different bearing protocols
Send the early warning short message.
For SP short messages, general short message appearance form is mainly calling number with 95,106,10000,10086,10010 etc.
The short message of number section beginning.Its feature is exactly the order business according to user, is issued on time for a large number of users in the form of short message
The message of various contents.
In communication network, the Network Access Point of this kind of SP user be it is fixed, typically by Short Message Service Gateway (SMGW or SMG,
Short Message Gateway) or integrated business access gateway (ISAG, Integrated Service Access
) etc. Gateway access gateway is uniformly accessed into.In the signaling message of communication network, can by Mobile solution agreement (MAP,
Mobile Application Protocol) routing iinformation of signaling message judge whether it being correct route direction, i.e.,
For the short message of SP classes, it can judge that its caller GT codes, OPC, start ip address and port (port) are carried out in communication signaling
Judge the originating point of SP short message sendings.According to routing rule, such as note abnormalities, be then the object of doubtful fraud text message analysis.
For SP short messages, the type fashion of its general transmitting short message is that MT (Mobile Terminated) mode issues, i.e. downlink short message
Form.If by signaling message inspection, there is caller to be and started with the number sections such as 95,106,10000,10086,10010 and be
The short message of MO (Mobile Originate) mode, then it is the object of doubtful fraud text message analysis.It is based on simultaneously in analysis
The mode of black and white lists, carry out the confirmation of SP numbers.Finally analyzed by SP short message contents, basis is analyzed for SP short message contents
The meaning of one's words parsing of the Chinese character of SP contents and self-learning algorithm, identify the short message content of swindle.For the fraud text message identified,
Called number customer group is extracted, forms the potential customer group of being deceived of fraud text message, early warning information is then sent in time and reminds.
Short message content analysis judges whether according to the sms center address of short message content, short message length, short message content field
It is fraud text message.
Fig. 7 is the SP short message intelligent monitoring alarm flow charts that the embodiment of the present application provides, based on SP short messages with MT, i.e., descending
Short message mode issues, therefore when checking signaling message, if finding, caller is for number section with 95,106,10000,10086 and 10010
Beginning and be the short message of MO modes, then it is assumed that it is the analysis object of doubtful fraud text message；It is based on black and white lists mode simultaneously
The confirmation of SP numbers is carried out, short message content is analyzed in the meaning of one's words parsing and self-learning algorithm always according to the Chinese character of SP contents, is judged
Identify whether it is fraud text message；Then, for the fraud text message identified, extraction called number and the potential fraud text message of generation
Victim user group, the last early warning information that sends in time are reminded；This method includes following operation content：
Step 21, short message signaling data are converged；
Step 22, judge whether SP routing address is normal：Whether the routing rule of caller GT addresses meets the network planning will
Ask：If normal, subsequent step 23 is performed；Otherwise, redirect and perform step 26；
Step 23, judge whether SP short message types are normal：If normal, subsequent step 24 is performed；Otherwise, redirect and perform step
Rapid 26；
Step 24, white list inspection is carried out to the rear subscriber number of SP short messages, if rear subscriber number is located at white list,
Then short message is put logical；Otherwise, subsequent step 25 is performed；
Step 25, blacklist inspection is carried out to the rear subscriber number of SP short messages, if rear subscriber number is located at blacklist,
Called number customer group is then extracted, performs intelligent early-warning；Otherwise, subsequent step (26) is performed；
Step 26, judgement identification is carried out to SP short message contents, if not fraud text message, then short message is put logical；If swindle is short
Letter, then called number customer group is extracted, perform intelligent early-warning；
Step 27, extract the called number of fraud text message, form the potential customer group of being deceived of fraud text message, regeneration and
Issue early warning short message.
Above description is only the description to present pre-ferred embodiments, not to any restriction of the scope of the invention, this hair
Any change, the modification that the those of ordinary skill in bright field does according to the disclosure above content, belong to the protection of claims
Scope.
For point-to-point note, the mainly individual-to-individual short message sending of mobile subscriber, but there is also some people utilization
The special short messages such as short message cat send instrument, and using multiple mobile SIM cards, timesharing divides user not stop paying out to send.According to wanting for Ministry of Industry and Information
Ask, for day user of the traffic volume more than 200, short message service pause processing will be done.For this kind of transmission short message, its is daily
Traffic volume is typically below 200, but relatively 200, and the amount sent daily is essentially identical.According to short message sending
The traffic volume of the frequency and more days carries out comprehensive descision, as the daily traffic volume of some user is a lot, day traffic volume and moon traffic volume
It is in this way, doubtful fraud text message analysis can be carried out according to overall trend analysis.
Analyzed according to the number rule of called subscriber, be known that user's according to first 7 of called subscriber's phone number
Information of home location, it is that ownership place is Pekinese user if 1390010,1860020 are the user for belonging to status Guangzhou.According to
Calling subscribe's phone number attaching information and called number attaching information, the transmission scene of point-to-point note can be analyzed, for
Sending scene, to be generally divided into this province this city Home Network short message, this province this city rete mirabile short message, the different city's Home Network short message of this province, different city of this province different
Net short message, this province other places Home Network short message, this province other places rete mirabile short message.Scene is analyzed more than, for point-to-point user, according to
Daily, the monthly transmission interpretation of result of short message, it will be appreciated that the short message sending scene type based on user behavior.When the hair of user
Send scene to note abnormalities, then subsequently carry out doubtful fraud text message analysis.
Short message content analysis judges whether according to the sms center address of short message content, short message length, short message content field
It is fraud text message.
Fig. 8 is the intelligent monitoring processing side that fraud text message identification is carried out according to point-to-point note that the embodiment of the present application provides
Method：First according to calling subscribe's phone number and the attaching information of called number, the transmission scene of point-to-point note is analyzed：This province sheet
City's Home Network short message, this province this city rete mirabile short message, the different city's Home Network short message of this province, the different city's rete mirabile short message of this province, this province other places Home Network are short
Letter and this province other places rete mirabile short message；Further according to the point-to-point note quantity forwarded of scene analysis and the user daily and/or monthly
Analyzed with result, understand the short message sending scene type that the user is；When the transmission scene exception of user is found, just
Analysis judges whether it sends doubtful fraud text message, in time extraction called number and transmission early warning information；Under methods described includes
Row operation content：
Step 2A, converge short message signaling data；
Step 2B, judge whether the frequency of point-to-point note and historical trend are normal：If normal, subsequent step is performed
2C；Otherwise, redirect and perform step 2G；
Step 2C, judge the number home information of point-to-point note, analyze short message sending scene and user behavior, root respectively
Judge whether the short message is normal according to user behavior and scene, if normally, performing subsequent step 2D；If short message scene is abnormal,
Redirect and perform step 2G；
Step 2D, white list inspection is carried out to the rear subscriber number of point-to-point note, if rear subscriber number is positioned at white
List, then short message put logical；Otherwise, subsequent step 2E is performed；
Step 2E, blacklist inspection is carried out for the rear subscriber number of point-to-point note, if rear subscriber number is located at
Blacklist, then called number customer group is extracted, perform intelligent early-warning；Otherwise, subsequent step 2F is performed；
Step 2F, judgement identification is carried out to point-to-point note content, if not fraud text message, then short message is put logical；If swindleness
Short message is deceived, then extracts called number customer group, performs intelligent early-warning；If not fraud text message, then short message is put logical；If swindle is short
Letter, then perform subsequent step 2G；
Step 2G, extracts the called number of fraud text message, forms the potential customer group of being deceived of fraud text message, regeneration and
Issue early warning short message.
Above description is only the description to present pre-ferred embodiments, not to any restriction of the scope of the invention, this hair
Any change, the modification that the those of ordinary skill in bright field does according to the disclosure above content, belong to the protection of claims
Scope.
The principle of pseudo-base station note intelligent monitoring alarm method is：Under normal circumstances, when the LAC numbers in communication network have change
During change, then mobile terminal carries out normal position renewal.For pseudo-base station class short message, according to the historical trend of the location updating of certain cell
Analysis.When the exception of the location updating business datum of cell, and line is presented in the cell of update abnormal such as location updating sum extremely
Property distribution, such as cell update near focus near roads, market, then can suspect cell nearby have depositing for potential pseudo-base station
.According to the signaling data of location updating, LAC, CI before extraction renewal and LAC, CI data after renewal are analyzed,
According to LAC coding rule, such as the LAC of close region, its location updating business belongs to normal, such as the non-LAC closed on, its position
Renewal is then abnormal data.Simultaneously according to the APP clients of mobile subscriber's mobile phone terminal and the connection of intelligent monitoring warning system
State analysis, when certain cell, nearby the client of substantial amounts of mobile terminal disconnects with intelligent monitoring warning system, then can be with
Judge cell nearby with the presence of potential pseudo-base station.
The embodiment of the present application provide according to pseudo-base station note carry out fraud text message identification intelligent monitoring processing method be
What the historical trend updated according to subdistrict position was analyzed：According to the signaling data of location updating, extraction renewal is forward and backward respectively
LAC and CI be analyzed, then compare LAC, CI network planning coding rule and be compared：If LAC, CI value pair net
Network plans coding rule or the location updating signaling data Trend Stationary of history, then LAC, CI location updating business belongs to just
Often, if LAC, CI value is mismatched with network planning coding rule or the location updating signaling data trend anomaly of history,
The location updating business for thinking LAC, the CI is abnormal data；The APP clients and intelligent monitoring for analyzing mobile phone terminal simultaneously are accused
The connection status of alert system：When certain cell, nearby the client of substantial amounts of mobile terminal disconnects with intelligent monitoring warning system
When, it becomes possible to judge that cell nearby has potential pseudo-base station；
Step 2a, convergence short message service signaling, location updating traffic signaling data；
Step 2b, judge whether the frequency of location updating business and historical trend are normal：If abnormal, subsequent step is performed
(2c)；If normal, short message is put logical；
Step 2c, judge whether the connection of APP clients is normal, if normally, short message is put logical；If connection is abnormal, perform
Subsequent step 2d；
Step 2d, after APP clients, which connect, to be recovered, automatic short message enquiry history, if there is new message, after continuing executing with
Continuous step 2e；Otherwise it is without new message, then without exception；
Step 2e, judges short message content, if not fraud text message, then short message is put logical；If fraud text message, then carry
Called number user is taken, performs intelligent early-warning；
Step 2f, extracts the called number of fraud text message, forms the potential customer group of being deceived of fraud text message, regeneration and
Issue early warning short message.
Above description is only the description to present pre-ferred embodiments, not to any restriction of the scope of the invention, this hair
Any change, the modification that the those of ordinary skill in bright field does according to the disclosure above content, belong to the protection of claims
Scope.
Technical scheme has following business innovation point relative to prior art：
Magnanimity signaling data converges：Set up by signaling data convergence for signaling message progress aggregation process, including from
Core net A/IU interfaces, C/D interfaces, the location updating signaling of GN/R-P interfaces collection user, short message signaling, SOT state of termination etc..
Signaling data trend analysis：Trend anomaly analysis summary is carried out by data such as hour, day, week, the moons, for exception
Data are extracted in time.
Different analyzing and processing is carried out according to short message type, SP short messages carry out route analysis, short message type analysis；It is point-to-point
Short message carries out frequency analysis, the analysis of short message scene type；Pseudo-base station note connects different according to location updating exception with APP clients
Often analysis；Cover various types of short messages.
For fraud text message user, quickly collect potential customer group of being deceived, in time according to the short message mould manually customized
Plate quickly issues early warning information.
Technical scheme relative to prior art there is following technology to realize innovative point：
Based on the protocol adaptation layers in convergence component, the user data of each network element is entered by different agreement interface
Row aggregation process, data source from core net A/IU interfaces, C/D interfaces, GN/R-P interfaces signaling message.
Based on big data analytical technology, signaling message is quickly subjected to business model identification, distinguishes SP short messages, point-to-point short
Letter, pseudo-base station note, for the fraud text message business discriminance analysis of each short message service.
Based on SP short message types, the route field extraction for carrying out short message carries out data ratio with telecommunications network routing rule
It is right, judge whether route is abnormal；The field analysis of short message type is carried out, for up MO short message, judges short message type exception；
Based on point-to-point note type, carry out the comparison of the frequency and historical trend of short message service, for hour, day, week,
The data such as the moon carry out trend anomaly analysis summary, and trend anomaly then carries out fraud text message content analysis；Carry out returning for short-message users
Belong to information, judge the short-message users behavior of user, for the transmission scene of exception, then carry out fraud text message content analysis；
For pseudo-base station note type, the trend for carrying out location updating business compares, and is judged according to renewal service exception pseudo-
Base station；Judged according to APP clients and the connection status of intelligent monitoring warning system, according to follow-up if connecting after exception
The comparison and analysis of short message carry out the judgement of pseudo-base station.
Based on different fraud text message types, the artificial early warning information that customizes sends template, according to different early warning information templates
Issuing for early warning information is carried out, judges that the state of terminal carries out the transmission of early warning information.
Technical scheme can realize following technique effect：
Magnanimity signaling data of the system based on user carries out convergence and association analysis processing, by the unified extraction of signaling data
And association, and real-time update, data accuracy is up to more than 98%；
Historical trending analysis user behavior of the system based on user, point of short message content is carried out if finding trend anomaly
Analysis and judgement；
The system is based on SP short messages, point-to-point note, pseudo-base station note and is analyzed and judged respectively, covers short message comprehensively
Signaling message monitoring and fraud text message content recognition；
Reminded in time for fraud text message user, so as to remind the potential user that is deceived in time, reduce use to greatest extent
The loss at family.
Above description is only the description to present pre-ferred embodiments, not to any restriction of the scope of the invention, this hair
Any change, the modification that the those of ordinary skill in bright field does according to the disclosure above content, belong to the protection of claims
Scope.
Claims (11)
- A kind of 1. swindle short message intelligent monitoring warning system, it is characterised in that：The system is the core movement to telecom operators It is right after the short message service signaling of the mobile subscriber of each network element and location updating traffic signaling data carry out convergence processing in network The note data of user carries out the real-time matching monitoring of a variety of intelligent analytical models, and useful signaling data is stored in into database In, while doubtful fraud text message is confirmed and sent a warning message to the potential user that is deceived, realized and potential be deceived user's Timely warning function；The system is provided with signaling data and converges assembly, intelligent monitoring Business Processing assembly, intelligent monitoring management group Five part, intelligent alarm assembly and intelligent monitoring Service Database comprising modules；Wherein：Signaling data and converges assembly, provided with rotocol adaptation interface, signaling data extraction module and monitoring business Processing Interface three Comprising modules；Rotocol adaptation interface is used to gathering and converging signaling data, is then therefrom extracted by signaling data extraction module short Communication service signaling and location updating traffic signaling data, then by the short message service signaling and location updating traffic signaling data via Monitoring business Processing Interface carries out real-time data interaction with intelligent monitoring Business Processing assembly；Intelligent monitoring Business Processing assembly, provided with SMS service management interface, service provider SP short message service analyzing and processing mould Block, point-to-point note business diagnosis processing module, pseudo-base station note business diagnosis processing module, signaling data convergence interface, announcement Warn business module, alarm interface, business datum bank interface totally eight comprising modules；Signaling data converges short message of the interface to reception Signaling data is analyzed and processed, respectively with SP short message services analysis and processing module, point-to-point note business diagnosis processing module With pseudo-base station note business diagnosis processing module interaction data, three business diagnosis processing modules simultaneously with intelligent monitoring industry The matching for database progress number data of being engaged in is compared, if comparison is unsuccessful, the doubtful fraud text message number of analysis is fed back to SMS service management interface, the rear subscriber number that intelligent monitoring management assembly will confirm that produce alarm by alarm business module Data, sent a warning message by alarm interface to the potential user that is deceived, while the swindle that SMS service management interface will confirm that The calling number of short message is stored into intelligent monitoring Service Database；Intelligent monitoring management assembly, it is responsible for the calling and called of doubtful fraud text message for tentatively confirming intelligent monitoring Business Processing assembly Subscriber Number is collected and presented, then via manual confirmation after, sent a warning message in time to the potential user that is deceived, and will be true Rear subscriber number after recognizing is classified as blacklist and deposit intelligent monitoring Service Database；Intelligent alarm assembly, it is responsible for the warning information that intelligent monitoring Business Processing assembly is returned to the potential user that is deceived and issued, and After carrying out protocol adaptation according to the different conditions of mobile phone terminal, mobile phone terminal and/or APP clients are handed down to；Intelligent monitoring industry Be engaged in database, for intelligent monitoring Business Processing assembly interactive information, to know the blacklist of SP short messages, point-to-point note Blacklist and pseudo-base station note blacklist；Store daily record relevant information simultaneously；It is additionally operable to hand over intelligent monitoring management assembly Mutual information, store the calling number of fraud text message and the data template of warning information.
- 2. system according to claim 1, it is characterised in that：The system also includes fraud text message intelligent monitoring application APP clients, the client is responsible for and intelligent monitoring Business Processing assembly interactive information, to monitor the work shape of the client State, while the early warning to be sent a warning message in time to the called subscriber of fraud text message；The data source of the system is that telecommunications is moved Employ the magnanimity communication signaling data at family.
- 3. system according to claim 1, it is characterised in that：Modules function in the signaling data and converges assembly It is described as follows：Rotocol adaptation interface, the interactive adaptation for being responsible for completing agreement with the network element relevant interface of core telecommunication network operates, then leads to Web Service and/or real-time Socket protocol interface collection core network signaling message is crossed, is transmitted to signaling data extraction mould Block is handled；Signaling data extraction module, is responsible for the core network signaling message from rotocol adaptation interface collection, and extraction includes calling subscribe Number, called number, caller GT addresses, called GT addresses, sms center address, position area LAC, cell CI, short message industry The information of service type, short message length and short message content, then by the information transmission extracted to monitoring business Processing Interface；Monitoring business Processing Interface, it is responsible for passing through monitoring business Processing Interface and intelligent monitoring business to the signaling information after extraction Processing component interacts.
- 4. system according to claim 1, it is characterised in that：Modules in the intelligent monitoring Business Processing assembly Function declaration is as follows：Signaling data converge interface, be responsible for receive signaling data and converges assembly short message, and by the short message data respectively with SP short message services analysis and processing module, point-to-point note business diagnosis processing module, pseudo-base station note business diagnosis processing module Carry out data interaction；SP short message service analysis and processing modules, for converging interactive interfacing with signaling data, according to SP short message service analysis models, Fraud text message analyzing and processing is carried out to SP classes short message；Interacted with SMS service management interface, doubtful SP classes fraud text message is carried out Confirm and alert；Also interacted by business datum bank interface with intelligent monitoring Service Database, so as to the SP in the database Class calling subscribe's blacklist is compared, while stores daily record relevant information；Point-to-point note business diagnosis processing module, for converging interactive interfacing with signaling data, according to point-to-point note business Analysis model, fraud text message analyzing and processing is carried out to point-to-point class short message；Interacted with SMS service management interface, to doubtful point pair Point class fraud text message is confirmed and alerted；Also interacted by business datum bank interface with intelligent monitoring Service Database, so as to It is compared with point-to-point calling subscribe's blacklist in the database, while stores daily record relevant information；Pseudo-base station note business diagnosis processing module, for converging interactive interfacing with signaling data, according to pseudo-base station note business Analysis model, fraud text message analyzing and processing is carried out to pseudo-base station class short message；Interacted with APP clients, judge APP client shapes State；Interacted with SMS service management interface, doubtful pseudo-base station class fraud text message is confirmed and alerted, while passes through business number Daily record relevant information is stored according to bank interface；SMS service management interface, it is responsible for interacting with SP short message service analysis and processing modules respectively, by doubtful SP fraud text messages number Data interaction is carried out according to intelligent monitoring management assembly；Interacted with point-to-point note business diagnosis processing module, by doubtful point pair Point fraud text message data carry out data interaction with intelligent monitoring management assembly；Handed over pseudo-base station note business diagnosis processing module Mutually, doubtful pseudo-base station fraud text message data and intelligent monitoring management assembly are subjected to data interaction；Also handed over alarm business module Mutual information, the service logic for the Real-time Alarm information that processing intelligent monitoring management assembly issues, relays to alarm interface；Alarm business module, for SMS service management interface interactive information, handle the alarm industry of intelligent monitoring management assembly Business logical data；Interacted with alarm interface, send alarm information to intelligent alarm assembly via alarm interface；Alarm interface, for being interacted with alarm business module, receive the Real-time Alarm information that intelligent monitoring management assembly issues；Also With intelligent alarm assembly interactive information, data analysis and route are carried out to warning information；Business datum bank interface, for handling mould with SP short message services analysis and processing module, point-to-point note business diagnosis respectively Block and pseudo-base station note business diagnosis processing module interact, so as to the blacklist according to SP short messages, point-to-point note it is black The blacklist list of list and pseudo-base station carries out the data analysis of doubtful fraud text message.
- 5. system according to claim 1, it is characterised in that：The intelligent monitoring management assembly is by SMS service management interface, swindle short-message users management module, warning information management Module, management database interface composition；SMS service management interface, for intelligent monitoring Business Processing assembly interactive information, by the monitor component business processing Doubtful fraud text message afterwards, is sent to swindle short-message users management module；Swindle short-message users management module, for SMS service management interface interactive information, caller is extracted from fraud text message Subscriber Number and called number；With warning information management module interactive information, the called subscriber of doubtful fraud text message is produced Raw warning information；Interacted with management database interface, intelligent monitoring industry is arrived into the rear subscriber number storage of fraud text message The blacklist of business database, while store daily record relevant information；Warning information management module, for swindle short-message users management module interactive information, to the called subscriber of fraud text message After number is collected and extracted, warning information is performed and chooses and confirms to operate；Interacted with management database interface, it is right The template of warning information is stored and chosen, while stores daily record relevant information；Manage database interface, for swindle short-message users management module interactive information, by calling number data Cun Chudao intelligence The blacklist of energy monitoring business database；Interacted with warning information management module, formulate and store the data of warning information Template.
- 6. system according to claim 1, it is characterised in that：The intelligent alarm assembly by alarm data Processing Interface, Alarm business processing module and rotocol adaptation interface composition；Alarm data Processing Interface, is communicated with intelligent monitoring Business Processing assembly, and the message of alarm business is carried out into data Interaction；Communicated with alarm business processing module, logical process analysis is carried out for the specific business of alarm；Alarm business processing module, communicated with alarm business Processing Interface, carried out for the specific business of alarm at logic Reason analysis；Interacted with rotocol adaptation interface, alarm information is continued according to the condition adapted different agreement of mobile phone terminal Send；Rotocol adaptation interface, interacted with alarm business processing, different agreements is adapted to for the different conditions of mobile phone terminal Continue the transmission of alarm information.
- A kind of 7. fraud text message intelligent monitoring alarm method, it is characterised in that：This method is short by swindling as claimed in claim 1 Believe that intelligent monitoring warning system is implemented, converge the short message service signaling and location updating traffic signaling of telecommunications core network in real time first Data, according to the communication protocol extraction used including calling number, called number, caller GT addresses, called GT addresses, short Believe the much information of centre address, LAC, CI, sms center address, short message type, short message length and short message content, then basis SP short message services analysis and processing module, point-to-point note business diagnosis processing module and pseudo- base in the intelligent monitoring warning system Short message service analysis and processing module of standing is analyzed fraud text message, then the calling subscribe of the fraud text message to being analyzed to identify and by User is made to perform corresponding processing operation according to early warning rule respectively；Methods described includes following operative step：Step 1, collection in real time and convergence short message service signaling and location updating traffic signaling data：Signaling convergence component is adopted in real time Collection and convergence telecommunications core network short message service signaling and location updating traffic signaling data, the communication protocol used according to short message carry Short message is taken to include calling number, called number, caller GT addresses, called GT addresses, sms center address, LAC, CI, short message Centre address, short message type, the much information of short message length and short message content；Step 2, intelligent monitoring processing is performed to fraud text message：For magnanimity note data, respectively according to SP short messages, point-to-point short Letter, the different intelligent monitor processing method of pseudo-base station note carry out the identification and confirmation of fraud text message, will after confirming fraud text message The rear subscriber number of the fraud text message is classified as blacklist；Called number is aggregated to form into potential fraud text message again to be deceived use Family group；Step 3, intelligent early-warning signal is sent：According to the number information of the potential customer group of being deceived of fraud text message, selection is corresponding pre- Alert information model is ready for sending early warning short message, further according to the different conditions of mobile phone terminal, is adapted to different bearing protocols and sends The early warning short message.
- 8. according to the method for claim 7, it is characterised in that：In the step 2, fraud text message knowledge is carried out according to SP short messages Other intelligent monitoring processing method is：Issued based on SP short messages with MT, i.e. downlink short message mode, therefore when checking signaling message, If it was found that it by 95,106,10000,10086 and 10010 is that number section starts and is the short message in a manner of MO that caller, which is, then it is assumed that it is The analysis object of doubtful fraud text message；The confirmation of SP numbers is carried out based on black and white lists mode simultaneously, always according to SP contents The meaning of one's words parsing of Chinese character and self-learning algorithm analysis short message content, judge to identify whether it is fraud text message；Then, for knowing The fraud text message not gone out, extraction called number and the generation potential customer group of being deceived of fraud text message, it is last to send early warning information in time Remind；This method includes following operation content：Step 21, short message signaling data are converged；Step 22, judge whether SP routing address is normal：Whether the routing rule of caller GT addresses meets network planning requirement：If Normally, then subsequent step 23 is performed；Otherwise, redirect and perform step 26；Step 23, judge whether SP short message types are normal：If normal, subsequent step 24 is performed；Otherwise, execution step is redirected 26；Step 24, white list inspection is carried out to the rear subscriber number of SP short messages, it is short if rear subscriber number is located at white list Letter is put logical；Otherwise, subsequent step 25 is performed；Step 25, blacklist inspection is carried out to the rear subscriber number of SP short messages, if rear subscriber number is located at blacklist, carried Called number customer group is taken, performs intelligent early-warning；Otherwise, subsequent step 26 is performed；Step 26, judgement identification is carried out to SP short message contents, if not fraud text message, then short message is put logical；If fraud text message, then Called number customer group is extracted, performs intelligent early-warning, performs subsequent step 27；Step 27, the called number of fraud text message is extracted, the potential customer group of being deceived of fraud text message is formed, regenerates and issue Early warning short message.
- 9. according to the method for claim 7, it is characterised in that：It is described to be cheated according to point-to-point note in the step 2 Deceiving the intelligent monitoring processing method of short message identification is：First according to calling subscribe's phone number and the attaching information of called number, divide Analyse the transmission scene of point-to-point note：This province this city Home Network short message, this province this city rete mirabile short message, the different city's Home Network short message of this province, sheet The different city's rete mirabile short message of province, this province other places Home Network short message and this province other places rete mirabile short message；It is daily further according to scene analysis and the user And/or point-to-point note quantity forwarded monthly is analyzed with result, the short message sending scene type that the user is is understood；One When denier finds the transmission scene exception of user, just analysis judges whether it sends doubtful fraud text message, extraction called number with and When send early warning information；Methods described includes following operation content：Step 2A, converge short message signaling data；Step 2B, judge whether the frequency of point-to-point note and historical trend are normal：If normal, subsequent step 2C is performed；It is no Then, redirect and perform step 2G；Step 2C, judge the number home information of point-to-point note, analyze short message sending scene and user behavior respectively, according to Family behavior and scene judge whether the short message is normal, if normally, performing subsequent step 2D；If short message scene is abnormal, redirect Perform step 2G；Step 2D, white list inspection is carried out to the rear subscriber number of point-to-point note, if rear subscriber number is located at white list, Then short message is put logical；Otherwise, subsequent step 2E is performed；Step 2E, blacklist inspection is carried out for the rear subscriber number of point-to-point note, if rear subscriber number is located at black name It is single, then called number customer group is extracted, performs intelligent early-warning；Otherwise, subsequent step 2F is performed；Step 2F, judgement identification is carried out to point-to-point note content, if not fraud text message, then short message is put logical；If swindle is short Letter, then called number customer group is extracted, perform intelligent early-warning, then perform subsequent step 2G；Step 2G, the called number of fraud text message is extracted, form the potential customer group of being deceived of fraud text message, regenerate and issue Early warning short message.
- 10. according to the method for claim 7, it is characterised in that：It is described to be carried out according to pseudo-base station note in the step 2 The intelligent monitoring processing method of fraud text message identification is that the historical trend that traffic signaling is updated according to subdistrict position is analyzed： According to the signaling data of location updating, extraction updates forward and backward LAC respectively and CI is analyzed, then compares LAC, CI Network planning coding rule is compared：If LAC, CI value matching network plan coding rule or the location updating signaling number of history According to Trend Stationary, then LAC, CI location updating business belongs to normal, if LAC, CI value and network planning coding rule are not Matching or the location updating signaling data trend anomaly of history, then it is assumed that the location updating business of LAC, the CI are abnormal data； Analyze the APP clients of mobile phone terminal and the connection status of intelligent monitoring warning system simultaneously：Moved when certain cell is substantial amounts of nearby When the client of dynamic terminal disconnects with intelligent monitoring warning system, it becomes possible to judge that cell nearby has potential pseudo-base station；Step 2a, convergence short message service signaling, location updating traffic signaling data；Step 2b, judge whether the frequency of location updating business and historical trend are normal：If abnormal, subsequent step 2c is performed； If normal, short message is put logical；Step 2c, judge whether the connection of APP clients is normal, if normally, short message is put logical；If connection is abnormal, perform follow-up Step 2d；Step 2d, after APP clients, which connect, to be recovered, automatic short message enquiry history, if there is new message, continue executing with follow-up step Rapid 2e；Otherwise it is without new message, then without exception；Step 2e, judgement identification is carried out to short message content, if not fraud text message, then short message is put logical；If fraud text message, then carry Called number user is taken, performs intelligent early-warning, performs step 2f；Step 2f, the called number of fraud text message is extracted, form the potential customer group of being deceived of fraud text message, regenerate and issue Early warning short message.
- 11. according to the method described in claim 8 or 9 or 10, it is characterised in that：The short message content judges that identification is according to master Cry GT, called GT, LAC, CI, rear subscriber number, called number, the sms center address of short message content, short message length, Multiple field informations of short message content determine whether fraud text message.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410545283.8A CN104301896B (en) | 2014-10-15 | 2014-10-15 | Swindle short message intelligent monitoring warning system and method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410545283.8A CN104301896B (en) | 2014-10-15 | 2014-10-15 | Swindle short message intelligent monitoring warning system and method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104301896A CN104301896A (en) | 2015-01-21 |
| CN104301896B true CN104301896B (en) | 2017-11-10 |
Family
ID=52321418
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410545283.8A Active CN104301896B (en) | 2014-10-15 | 2014-10-15 | Swindle short message intelligent monitoring warning system and method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104301896B (en) |
Families Citing this family (21)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104683984B (en) * | 2015-03-11 | 2018-05-08 | 无锡北邮感知技术产业研究院有限公司 | The real-time monitoring process method of wireless communication signals and system |
| CN106162688B (en) * | 2015-04-01 | 2019-08-27 | 中国移动通信集团湖北有限公司 | A pseudo base station positioning method and system |
| CN104917649B (en) * | 2015-06-05 | 2021-09-24 | 重庆智韬信息技术中心 | Method for reverse security audit of communication data |
| CN106714160B (en) * | 2015-11-17 | 2020-06-05 | 中国移动通信集团广东有限公司 | Method and device for checking validity of short message source, terminal and communication system |
| CN105335354A (en) * | 2015-12-09 | 2016-02-17 | 中国联合网络通信集团有限公司 | Cheat information recognition method and device |
| WO2017147832A1 (en) * | 2016-03-03 | 2017-09-08 | 臧利 | Method and system for positioning rogue base station |
| CN107229638A (en) * | 2016-03-24 | 2017-10-03 | 北京搜狗科技发展有限公司 | A kind of text message processing method and device |
| CN106570698A (en) * | 2016-11-18 | 2017-04-19 | 北京奇虎科技有限公司 | Message processing method applied to account transaction platform, and mobile communication terminal |
| CN108156001B (en) * | 2016-12-02 | 2022-05-13 | 中兴通讯股份有限公司 | Intelligent network problem reporting method and device based on signaling analysis |
| CN106850552A (en) * | 2016-12-21 | 2017-06-13 | 恒安嘉新(北京)科技有限公司 | A kind of method that harmful Call Intercept is realized based on signaling re-injection |
| CN106686261B (en) * | 2017-01-19 | 2021-03-12 | 腾讯科技（深圳）有限公司 | Information processing method and system |
| CN107819747B (en) * | 2017-10-26 | 2020-09-18 | 上海欣方智能系统有限公司 | Telecommunication fraud association analysis system and method based on communication event sequence |
| CN109728928B (en) * | 2017-10-30 | 2021-05-07 | 腾讯科技（深圳）有限公司 | Event recognition method, terminal, model generation method, server and storage medium |
| CN109462582B (en) * | 2018-10-30 | 2020-11-20 | 腾讯科技（深圳）有限公司 | Text recognition method, text recognition device, server and storage medium |
| CN109447180A (en) * | 2018-11-14 | 2019-03-08 | 山东省通信管理局 | A kind of fooled people's discovery method of the telecommunication fraud based on big data and machine learning |
| CN109547942B (en) * | 2019-01-14 | 2020-10-09 | 中国联合网络通信集团有限公司 | Fraud number identification method, device, device and computer-readable storage medium |
| CN110213449B (en) * | 2019-05-17 | 2020-12-25 | 国家计算机网络与信息安全管理中心 | Method for identifying roaming fraud number |
| CN110337107A (en) * | 2019-07-26 | 2019-10-15 | 金彩芬 | An intelligent monitoring and warning device for fraudulent short messages |
| CN111461231B (en) * | 2020-04-02 | 2023-06-30 | 腾讯云计算（北京）有限责任公司 | Short message sending control method, device and storage medium |
| CN111666412A (en) * | 2020-06-02 | 2020-09-15 | 国家计算机网络与信息安全管理中心 | Fraud log text analysis method and system based on SVM text analysis |
| CN117874209B (en) * | 2024-03-12 | 2024-05-17 | 深圳市诚立业科技发展有限公司 | NLP-based fraud short message monitoring and alarming system |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101702794A (en) * | 2009-11-09 | 2010-05-05 | 王铭温 | Reminder system of user content of telecommunication short messages |
| CN101990180A (en) * | 2009-08-04 | 2011-03-23 | 中兴通讯股份有限公司 | Method and system for preventing short message fraud |
| CN102547709A (en) * | 2010-12-23 | 2012-07-04 | 康佳集团股份有限公司 | Method and mobile phone for identifying fraud short messages |
-
2014
- 2014-10-15 CN CN201410545283.8A patent/CN104301896B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101990180A (en) * | 2009-08-04 | 2011-03-23 | 中兴通讯股份有限公司 | Method and system for preventing short message fraud |
| CN101702794A (en) * | 2009-11-09 | 2010-05-05 | 王铭温 | Reminder system of user content of telecommunication short messages |
| CN102547709A (en) * | 2010-12-23 | 2012-07-04 | 康佳集团股份有限公司 | Method and mobile phone for identifying fraud short messages |
Non-Patent Citations (2)
| Title |
|---|
| 一种短信提醒CDMA网用户防诈骗电话的方法;朱瑞举，刘长生;《中国通信学会信息通信网络技术委员会2013年年会论文集》;人民邮电出版社;20130822;全文 * |
| 一种高效垃圾短信过滤系统的实现;黄文良，陈纯，罗云彬;《信息科技》;人民邮电出版社;20080531;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104301896A (en) | 2015-01-21 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104301896B (en) | Swindle short message intelligent monitoring warning system and method | |
| CN102857921B (en) | Judge method and the device of spammer | |
| CN106550155B (en) | Swindle sample is carried out to suspicious number and screens the method and system sorted out and intercepted | |
| CN103354633B (en) | Specific mobile subscriber's coarse positioning system and method based on signaling data mining analysis | |
| WO2017186090A1 (en) | Communication number processing method and apparatus | |
| CN101686444B (en) | System and method for detecting spam SMS sender number in real time | |
| CN108737182A (en) | The processing method and system of system exception | |
| CN101860822A (en) | Method and system for monitoring spam messages | |
| CN107819747A (en) | A kind of telecommunication fraud correlation analysis system and method based on communication event sequence | |
| CN107169744A (en) | The time limit monitoring method and system of a kind of electronic work order | |
| CN106657689A (en) | Method for preventing and controlling international fraud call and apparatus thereof | |
| CN110705926A (en) | Method, device and system for acquiring logistics object distribution information | |
| CN114169438A (en) | A telecommunication network fraud identification method, device, equipment and storage medium | |
| CN104052880A (en) | Mobile terminal and harassment information processing method and device thereof | |
| CN110167030A (en) | Identify method, apparatus, electronic equipment and the storage medium of harassing call | |
| CN109120513A (en) | Full media system and implementation method based on intelligent robot response | |
| CN114168423A (en) | Abnormal number calling monitoring method, device, equipment and storage medium | |
| CN115659217A (en) | Fraud recognition model training method and device, electronic equipment and storage medium | |
| CN111246008A (en) | Method, system and device for realizing telephone assistant | |
| CN110337107A (en) | An intelligent monitoring and warning device for fraudulent short messages | |
| CN110072251B (en) | Method and device for analyzing user communication behavior and managing user | |
| CN101764754B (en) | Sample acquiring method in business identifying system based on DPI and DFI | |
| CN105763713A (en) | Harassing call intercepting method based on combination of Internet technology and communication technology | |
| CN102638778A (en) | System and method for monitoring internetwork junk short messages | |
| CN110097381A (en) | A kind of complaint automatic identification early warning system and method applied to airport service |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |