TW202348002A - Method and system for preventing Internet fraud capable of predicting user information of a fraudster from a large amount of communication data when a fraud has not occurred, or identifying user information of the fraudster from digital traces - Google Patents

Abstract

The present invention provides a method for preventing an Internet fraud. The method includes: collecting first communication data from a plurality of user devices; parsing the first communication data to obtain first information, wherein the first information is associated with user information of the user devices; parsing the first communication data to obtain second information, wherein the second information is associated with network information used by the user devices; and determining third communication data used in the fraud based on the first information and the second information. Based on the method of the present invention, user information of a fraudster can be predicted from a large amount of communication data when a fraud has not occurred, or user information of the fraudster can be identified from digital traces, so as to effectively prevent fraud or sanction the fraudster.

Description

Methods and systems for preventing and controlling Internet fraud

The present invention is a method and system for preventing and controlling Internet fraud. In particular, it refers to using the habits of known fraud methods to train artificial intelligence algorithms, thereby predicting from a large amount of communication data (1) When fraud does not occur, the fraudster’s behavior User information, or (2) find out the user information of the fraudster from digital traces to effectively prevent fraud or punish the fraudster.

With the development of computer network technology, people can easily obtain various information through network services. Although computer and network technology has indeed brought people the advantages of fast and convenient services, it has also given criminals tools that facilitate money fraud. Please refer to Figure 1 for a schematic diagram of currently common fraud methods 100. Currently, in order to obtain the private information of the victim 130, such as accounts, passwords, and one-time passwords (OTP), fraud group 110 uses methods to steal other people's social accounts or create new social accounts. Establish a relationship with the victim to commit fraud, such as pretending to be the victim's friend to chat with and borrow money; or forge a link URL or simulated web page, and use social/dating platforms (such as Facebook/Meta, Twitter, Instagram, etc.), communications Software (such as Line, WeChat, etc.) or phishing websites (such as fake lottery-winning advertising URLs, pornographic websites, etc. that pop up on some networks) are randomly sent to the victim 130. When the victim 130 clicks on the fake URL or webpage After entering the personal information, the fraud group 110 can learn the private information of the victim 130, and can transfer the assets of the victim 130 from the financial institution 120 based on the private information.

Regarding the above-mentioned methods, Fraud Group 110 now does not use fixed IPs for connection, but uses a large number of Internet access door numbers that cannot be traced with floating IPs. Telecom services in some countries require identity authentication to obtain a specific domestic phone number. That is, a domestic phone number corresponds to a set of identity information. In order to avoid identity tracing by the police, Fraud Group 110 mostly uses user devices (such as mobile phones and tablets) with foreign numbers (BlackBerry cards, prepaid cards) that do not require identity verification to access the Internet. For more details, please refer to the schematic diagram of the foreign phone number network connection mechanism 200 shown in Figure 2. In the network connection mechanism 200, the user device 210 using the foreign phone number utilizes the roaming mechanism. Data transmission is maintained with the domestic telecom operator 220, and the transmitted data packets will be directly returned to the foreign telecom operator 230 for transmission to the Internet 240. In other words, once the fraud group 110 uses the user device 210 with a foreign phone number to When roaming to the Internet, it is difficult to trace the phone number used by the fraud group, and the fraud group 110 can still continue to commit fraud.

To sum up, the current stage of technological law enforcement requires a new method to trace the door numbers and locations of domestic fraud groups to prevent and control the fraud groups’ financial fraud.

In order to overcome the above shortcomings, one idea of the present invention is to use the information corresponding to known fraud methods to conduct artificial intelligence algorithm training to generate a prediction model, and compare a large amount of communication data to predict the fraud method patterns. The door number; or the residual digital trace provided by the defrauded victim is input into the prediction model to compare the door number that matches the digital trace.

Based on the foregoing concept, the present invention provides a method for preventing and controlling Internet fraud, which includes: collecting first communication data from a plurality of user devices; parsing the first communication data to obtain first information, and the first information is associated with User information of the user devices; parsing the first communication data to obtain second information, the second information being associated with the network information used by the user devices; based on the first information and the second information Determine the third communication data used in fraud.

Based on the foregoing concept, the present invention further provides a method for preventing and controlling Internet fraud, which includes: collecting first communication data from a plurality of user devices; using a first algorithm to parse the first communication data into a plurality of first communication data. Information, the first information is user information associated with the user devices; a second algorithm parses the first communication data into a plurality of second information, the second information is associated with the user devices The network information used; providing a third algorithm that is generated by an artificial intelligence algorithm based on the second communication data corresponding to known fraud methods; converting a digit corresponding to the fraud into The trajectory, the first information and the second information are input to the third algorithm to identify the third communication data corresponding to the digital trajectory from the first information and the second information.

In a preferred embodiment of the present invention, the first communication data includes a signaling (GTP-C) and a message (GTP-U).

In a preferred embodiment of the present invention, the first information includes at least one of: door number, integrated circuit card number, mobile phone serial number, base station location, country, and roaming telecommunications operator. The second information includes: at least one of the destination URL, Internet Protocol address, network traffic, communication protocol, and application service. The third communication information includes: door number, integrated circuit card number, mobile phone serial number, base station location, country, roaming telecommunications operator, destination website address, Internet Protocol address, network traffic, communication protocol, and application program Serve at least one of these.

Based on the foregoing concepts, the present invention provides a system for preventing and controlling Internet fraud, including: a first server installed on a telecommunications operator, which is used to collect and parse first communication data from a plurality of user devices, wherein the first server The first server has: a neural network unit, which is generated by an artificial intelligence algorithm based on the second communication data corresponding to the known fraud means; a second server installed in a public security unit, which is connected to the third server. A server communication connection to provide a digital trajectory to the first server; wherein the neural network unit identifies a third party corresponding to the digital trajectory from the parsed first communication data based on the digital trajectory communication data, and the first server provides the third communication data to the second server.

In a preferred embodiment of the present invention, the first communication data includes a signaling (GTP-C) and a transaction (GTP-U).

In a preferred embodiment of the present invention, it further includes a storage unit for storing the parsed first communication data, wherein the neural network unit retrieves the parsed first communication data from the storage unit material.

In a preferred embodiment of the present invention, the parsed first communication data includes: a plurality of first information parsed by a first computing unit, the first information includes: door number, integrated circuit At least one of the card number, mobile phone serial number, base station location, country, and roaming telecommunications operator; and a plurality of second information parsed by a second computing unit, the second information includes: destination URL, At least one of Internet Protocol addresses, network traffic, communication protocols, and application services.

In a preferred embodiment of the present invention, the third communication data includes: door number, integrated circuit card number, mobile phone serial number, base station location, country, roaming telecommunications operator, destination URL, Internet Protocol At least one of address, network traffic, communication protocol, and application service.

Please refer to FIG. 3 , which illustrates the architecture diagram of the Internet fraud prevention and control system 1000 of the present invention. The system 1000 is applied to local telecommunications operators and local security units, and the transmission relationship between foreign telecommunications operators is omitted. Here we only briefly describe the functions of each component and the connection relationships between them, and the details will be described later. As shown in the figure, the system 1000 includes a first server 1100 installed in a local telecommunications operator (or a domestic telecommunications operator) and a first server 1100 installed in a security unit (such as the local police, to be more specific, responsible for computers and networks). A second server 2000 of the Technology Crime Prevention Center for Criminal Investigation Work). The first server 1100 and the second server 2000 form a communication connection to transmit a specific data (such as a digital trace described later) to each other and in real time. or predict outcomes). The first server 1100 has a first computing unit 1110, a second computing unit 1120 and a neural network unit 1130. The first computing unit 1110 and the second computing unit 1120 are used to interpret or analyze the first communication data S1 from a plurality of user devices, wherein the first communication data S1 refers to received data from a plurality of user devices by different local base stations. The GTP (GPRS Tunneling Protocol, GTP) data uploaded by each user device equipped with a phone number card (the phone number card here is not limited to any type) (one phone number corresponds to one GTP data) is then sent by these bases The station compiles multiple GTP data into one GTP stream (GTP FLOW). Then the base stations transmit the first communication data S1 (corresponding to the GTP FLOW in Figure 3) to the first server 1100, or the first server 1100 obtains the first communication from the base stations. Data S1.

The first server 1100 will interpret GTP-C in GTP FLOW in the first computing unit 1110 (corresponding to the first layer in Figure 3), and in the second computing unit 1120 (corresponding to the second layer in Figure 3) ) Interpret GTP-U in GTP FLOW, and make predictions based on the interpreted data using artificial intelligence algorithms (corresponding to the third layer in Figure 3). The details of the first server 1100's interpretation and subsequent prediction of GTP FLOW will be described in detail in the following paragraphs.

The neural network unit 1130 predicts or identifies the phone number used by the fraud group based on the interpreted data (first information D1, second information D2). The neural network unit 1130 is a prediction model trained by artificial intelligence algorithms based on communication data corresponding to known fraud methods.

The system 1000 further includes a first storage unit 1210 and a second storage unit 1220, which respectively store the data (first information D1 and second information D2) interpreted by the first operation unit 1110 and the second operation unit 1120. The neural network unit 1130 obtains the interpreted data (first information D1, second information D2) from the first storage unit 1210 and the second storage unit 1220 to perform calculations and predictions. The aforementioned first computing unit 1110, second computing unit 1120 and neural network unit 1130 are executed by a central processing unit (Central Processing Unit, CPU), and the first storage unit 1210 and the second storage unit 1220 are hard disks. (Hard Disk Drive, HDD) or Solid State Drive (SSD), which are individually configured in the same or different network locations or servers. In other embodiments of the present invention, the first storage unit 1210 and the second storage unit 1220 may be configured in the same server, or even in the first server 1100 .

The following describes the process of the first server 1100 interpreting the first communication data S1. Please refer to FIG. 3 and FIG. 5 for steps S110 to S130 in the step diagram of processing communication data by the telecommunications operator server of the present invention. In the embodiment of the present invention, General Packet Radio Service (GPRS) is used as an example for explanation.

In step S110, the first server 1100 collects first communication data S1 from a plurality of user devices from different local base stations. The first communication data S1 is a GPRS Tunneling Protocol (GTP) string. flow.

In step S120, the first computing unit 1110 of the first server 1100 uses a first algorithm to interpret the first communication data S1 into a plurality of first information D1, and the first information D1 is associated with the Wait for the user information of the user device. In a preferred embodiment of the present invention, the first computing unit 1110 adopts Deep Packet Inspection (DPI) technology and uses a protocol recognition (Protocol Recognition) algorithm to analyze the information in the first communication data S1. command, that is, the GTP-control plane (GTP-C) is interpreted to interpret the first information D1. The first information D1 includes the user number, integrated circuit card number (Integrate Circuit Card Identity (ICCID), mobile phone serial number (International Mobile Equipment Identity, IMEI), base station location, country, and roaming telecommunications operator. After the interpretation is completed, the first computing unit 1110 will store the first information D1 in the first storage unit 1210 and simultaneously transmit the information in the first communication data S1, that is, GTP-user data tunnel ( GTP-User Data Tunneling (GTP-U) and a notification to the second computing unit 1120 to perform further interpretation.

Next, in step S130, after receiving the aforementioned notification and GTP-U, the second calculation unit 1120 uses a second algorithm to interpret the GTP-U of the first communication data S1 to obtain the second information D2, in which the The second information D2 is associated with network information used by the user devices. In a preferred embodiment of the present invention, the second calculation unit 1120 uses information extraction (Information Extraction) technology and uses a pattern recognition (Pattern Recognition) algorithm to analyze GTP-U to obtain the second information D2. D2 includes: destination URL, Internet Protocol address, network traffic, communication protocol, application service (such as the application currently used by the user). After the interpretation is completed, the second computing unit 1120 will store the second information D2 in the second storage unit 1220, and transmit an execution notification to inform the neural network unit 1130 to perform further prediction actions. The execution notification is an execution instruction, and the neural network unit 1130 performs further prediction actions according to the execution instruction. In other embodiments of the present invention, the interpretation order of the first calculation unit 1110 and the second calculation unit 1120 is interchangeable, that is, the order of steps S120 and S130 is interchangeable, so that GTP-U is first interpreted and then GTP -C is interpreted, and under this interpretation sequence, the execution notification is transmitted from the first computing unit 1110 to the neural network unit 1130.

The following describes the details of the neural network unit 1130 of the present invention. Please refer to the architecture diagram of the neural network unit and the security unit of the present invention shown in FIG. 3 and FIG. 5 . In step S140, the neural network unit 1130 provides a third algorithm, which is generated by an artificial intelligence algorithm based on the second communication data corresponding to the known fraud method. Specifically, in the preferred embodiment of the present invention, the neural network unit 1130 uses computational thinking technology to use a decision tree (Decision Tree) algorithm based on the second fraud method (or behavior) corresponding to the known fraud method. The communication data is trained to generate a prediction model, in which the second communication data is the transmission data corresponding to the following preset mode: Preset mode (1) The mobile phone used by the fraud group matches a large number of house numbers at the same time, which means that the transmission data A mobile phone serial number corresponds to a large number of phone numbers at the same time; default mode (2) The mobile phones used by fraud groups usually stay in one location and do not move. That is to say, the transmitted data is a mobile phone serial number or a phone number that always stays in The same address or connection to the same base station; Default mode (3) Users usually do not only use social networking sites but browse a large number of different web pages, while fraud groups only use specific social platforms on mobile phones or Communication software, that is to say, the transmitted data is a mobile phone serial number or phone number that only corresponds to the use of a specific application service (social application or communication application).

Please refer to Figure 4 and Figure 5 at the same time. In step S150, when the fraud has not yet occurred, the present invention is in a leading indicator mode by default, which is defined as inputting the second communication data of the above-mentioned fraud default mode into the neural network. The unit 1130 generates a corresponding prediction model. Once the prediction model predicts a behavior that matches the preset pattern, it can immediately notify the security unit to prevent the fraud pattern. Specifically, in the leading indicator mode, the neural network unit 1130 having the prediction model corresponding to the second communication data in the above-mentioned preset mode receives a notification from the second calculation unit 1120, and the neural network unit 1130 will receive the notification from the second calculation unit 1120. A storage unit 1210 extracts the first information D1 and the second information D2 from the second storage unit 1220 for comparison, and then generates a prediction result. The prediction result is a third communication data S3 that is consistent with the fraud method (the above-mentioned default mode) (corresponding to the leading indicator output result in Figure 4). The third communication data S3 may include information from the first information D1 and The data of the second information D2, such as the aforementioned door number, integrated circuit card number, mobile phone serial number, base station location, country, roaming telecommunications operator, destination URL, Internet Protocol address, network traffic, communication protocol and application services.

And in step S160, if fraud has occurred, the present invention switches to a backward indicator mode, which is defined as when a fraud event has occurred, the security unit can analyze the first information D1, the third information D1, and the third information based on the remaining digital traces. Find the pattern of the corresponding door number in the second information D2. Specifically, in the lagging indicator mode, the security unit will report the crime to the victim to obtain the remaining digital trace D3 of the fraud group. This digital trace D3 can provide the fraud group with the time point of the fake website or URL, or the base of the connection. The station and other input conditions are provided by the second server 2000 of the security unit to the neural network unit 1130 in the first server 1100, by inputting the first information D1, the second information D2 and the digital trajectory. The input conditions of D3 (corresponding to the input conditions in Figure 4) are sent to the neural network unit 1130. The neural network unit 1130 will identify the third communication data S3 corresponding to the digital trajectory D3 (corresponding to the lagging indicator output results in Figure 4 ), the third communication data S3 may include data from the first information D1 and the second information D2, such as the aforementioned door number, integrated circuit card number, mobile phone serial number, base station location, country, roaming telecommunications Operators, destination URLs, IP addresses, network traffic, protocols and application services. More specifically, for the neural network unit 1130, the condition of the digital trajectory D3 is used to narrow the identification range, and then find out from the range the first information D1 and the second information D2 that match the fraud Information about tactics or patterns of fraud. For example, the security unit can enter the conditions within plus or minus five minutes of the time when the aforementioned fraud occurred (the time is inaccurate due to delay or time difference) (corresponding to the input conditions in Figure 4), and then identify the conditions within this ten-minute range. The door number or the base station connected to the fraud method that conforms to the fraud method or fraud pattern can quickly and accurately locate the door number or location of the fraud group.

See Figure 4. Finally, the third communication data S3 corresponding to the leading indicator pattern is predicted by the neural network unit 1130 in step S150 (corresponding to the leading indicator output result in Figure 4), or is identified by the neural network unit 1130 in step S160. The third communication data S3 corresponding to the lagging indicator mode (corresponding to the lagging indicator output result in Figure 4) will be transmitted from the first server 1100 shown in Figure 3 to the second server 2000, and the first server 1100 simultaneously A reminder notification will be given to the security unit so that the security unit can handle it in a timely manner. For example, in the leading indicator mode, the security unit can immediately request the telecom operator to cancel the phone number used by the fraud group or block its connection. It has reached The prevention effect, or in the backward indicator mode, is to locate the base station used by the fraud group to locate its current location and arrest it to prevent fraud.

So far, the method and system for preventing and controlling Internet fraud according to the present invention have been explained by the above descriptions and drawings. However, it should be understood that each specific embodiment of the present invention is for illustration only, and various changes can be made without departing from the patent scope and spirit of the present invention, and all should be included in the patent scope of the present invention. Therefore, the various specific embodiments described in this specification are not intended to limit the invention, and the true scope and spirit of the invention are disclosed in the following patent applications.

100: Fraudulent tactics 110:Fraud syndicate 120:Financial institutions 130:Victim 200:Network connection mechanism 210: User device using a foreign phone number 220:Domestic telecommunications operators 230: Foreign telecommunications operators 240:Internet 1000:System 1100:First server 1110: First calculation unit 1120: Second calculation unit 1130: Neural Network Unit 1210: First storage unit 1220: Second storage unit 2000:Second server D1: First information D2: Second information D3:Digital track S1: First communication information S3: Third communication data S100: Methods to prevent online fraud S110~S160: steps

Figure 1 shows a schematic diagram of current common fraud methods.

Figure 2 shows a schematic diagram of the overseas phone number network connection mechanism.

Figure 3 shows the architecture diagram of the Internet fraud prevention system of the present invention.

Figure 4 shows the architecture diagram of the neural network unit and the security unit of the present invention.

Figure 5 shows a step diagram of processing communication data by a telecommunications operator's server according to the present invention.

S100: Methods to prevent online fraud

S110~S160: steps

Claims (12)

A method to prevent and control online fraud, including: Collect first communication data from a plurality of user devices; Parse the first communication data to obtain first information, the first information being user information associated with the user devices; Parse the first communication data to obtain second information, the second information being associated with the network information used by the user devices; The third communication data used in the fraud method is determined based on the first information and the second information. A method to prevent and control online fraud, including: Collect first communication data from a plurality of user devices; Parse the first communication data to obtain first information, the first information being user information associated with the user devices; Parse the first communication data to obtain second information, the second information being associated with the network information used by the user devices; Provide a third algorithm, which is generated by an artificial intelligence algorithm based on the second communication data corresponding to the known fraud method; Input a corresponding digital trace, the first information and the second information after the fraud has been carried out into the third algorithm to identify the corresponding digital from the first information and the second information Locus of third communications. The method of claim 1 or 2, wherein the first communication data includes a signaling (GTP-C) and a message (GTP-U). The method as described in claim 1 or 2, wherein the first information includes at least one of: door number, integrated circuit card number, mobile phone serial number, base station location, country, and roaming telecommunications operator. The method described in request 4, wherein the second information includes at least one of: destination URL, Internet Protocol address, network traffic, communication protocol, and application service. The method described in claim 5, wherein the third communication data includes: door number, integrated circuit card number, mobile phone serial number, base station location, country, roaming telecommunications operator, destination website address, Internet Protocol address , network traffic, communication protocols, and application services at least one of them. A system to prevent and control online fraud, including: A first server installed in a telecommunications operator for collecting and parsing first communication data from a plurality of user devices, wherein the first server has: A neural network unit, which is generated by an artificial intelligence algorithm based on the second communication data corresponding to known fraud methods. The neural network unit generates a prediction result based on the analyzed first communication data. The prediction result Third party communication data related to a fraudulent method; A second server installed in a security unit, which is communicatively connected to the first server to receive the third communication data. A system to prevent and control online fraud, including: A first server installed in a telecommunications operator for collecting and parsing first communication data from a plurality of user devices, wherein the first server has: A neural network unit generated by an artificial intelligence algorithm based on the second communication data corresponding to known fraud methods; A second server installed in a security unit that is communicatively connected to the first server to provide a digital track to the first server; Wherein, the neural network unit identifies third communication data corresponding to the digital trajectory from the parsed first communication data based on the digital trajectory, and the first server provides the third communication data to the Second server. The system of claim 7 or 8, wherein the first communication data includes a signaling (GTP-C) and a message (GTP-U). The system according to claim 7 or 8, further comprising a storage unit for storing the parsed first communication data, wherein the neural network unit retrieves the parsed first communication from the storage unit material. The system as described in claim 7 or 8, wherein the parsed first communication data includes: A plurality of first information parsed by a first calculation unit, the first information includes at least one of: door number, integrated circuit card number, mobile phone serial number, base station location, country, and roaming telecommunications operator; as well as A plurality of second information parsed by a second computing unit, the second information includes at least one of: destination URL, Internet protocol address, network traffic, communication protocol, and application service. The system as described in claim 11, wherein the third communication data includes: door number, integrated circuit card number, mobile phone serial number, base station location, country, roaming telecommunications operator, destination website address, Internet Protocol address , network traffic, communication protocols, and application services at least one of them.