CN102055853A - Monitoring system and analysis and supervision method thereof - Google Patents
Monitoring system and analysis and supervision method thereof Download PDFInfo
- Publication number
- CN102055853A CN102055853A CN2009102123217A CN200910212321A CN102055853A CN 102055853 A CN102055853 A CN 102055853A CN 2009102123217 A CN2009102123217 A CN 2009102123217A CN 200910212321 A CN200910212321 A CN 200910212321A CN 102055853 A CN102055853 A CN 102055853A
- Authority
- CN
- China
- Prior art keywords
- message registration
- target
- monitoring system
- conversation
- intercept target
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
- Telephonic Communication Services (AREA)
Abstract
The invention discloses a monitoring system and an analysis and supervision method thereof, relating to a legal monitoring technology. The method disclosed by the invention comprises the following steps: the monitoring system extracts call records of a target to be analyzed in accordance with preset analysis conditions, constructs a statistic model based on call elements of the extracted call records, calculates a confidence interval in accordance with the constructed statistic model and the analysis conditions, screens out suspected call records outside the confidence interval, determines a target to be monitored in accordance with the suspected call records and displays the target for a user. By using the technical scheme, the preliminary analysis of massive calls can be finished, thereby helping the operator to finish data analysis and improving the hit ratio of suspected calls. Simultaneously, the technical scheme provides an automatic control setting function, thereby helping the operator to fast supervise suspected numbers in time.
Description
Technical field
The present invention relates to the Lawful Interception technology, be specifically related to the method that a kind of monitoring system and analysis thereof are deployed to ensure effective monitoring and control of illegal activities.
Background technology
In recent years, the mass memory with monitored data of developing rapidly along with the new function of Lawful Interception, monitoring technique is from basic functions such as real-time listening, content playback, historical querys, to higher the developing such as complex art application directions such as global location, speech recognition, conversation behavioural analyses of technology content.
At present, monitor voice call end to end and be still application the most widely.The real-time behavior of intercepted user is collected by the monitoring service device, operator's voice playback one by one more afterwards, and whether judging in view of the above has no abnormal conversation to take place, continue to monitor etc.
Yet in the face of the monitor log of a large amount of conversation incidents, data analysis and follow-up establishing are controlled operation and can be consumed a large amount of manpowers, and are difficult to guarantee that every conversation is all in time handled, and each suspicious object can in time be deployed to ensure effective monitoring and control of illegal activities.
Summary of the invention
Technical problem to be solved by this invention is the method that provides a kind of monitoring system and analysis thereof to deploy to ensure effective monitoring and control of illegal activities, thereby the analysis efficiency of mass data in the raising snoop procedure.
In order to address the above problem, the invention discloses a kind of analysis cloth control method of monitoring system, comprising:
Monitoring system is extracted the message registration of target to be analyzed according to the analysis condition of setting in advance, conversation key element structure statistical model according to the message registration that is extracted, and according to statistical model of constructing and described analysis condition calculating confidential interval, filter out the suspicious message registration that is positioned at outside the described confidential interval, determine to treat intercept target by described suspicious message registration, and be shown to the user.
Further, said method also comprises:
Open when establishing control function automatically in described monitoring system, described monitoring system is established control automatically to the described intercept target for the treatment of, and will establish control order and send to respective network elements.
Wherein, described monitoring system determines to treat that by suspicious message registration intercept target refers to, the correspondent of non-evaluating objects is for treating intercept target in the described suspicious message registration.
The analysis condition of described prior setting comprises treats intercept target, listening period section and confidence level.
Described monitoring system is calculated described confidential interval respectively according to the statistical model of structure and the confidence level in the described analysis condition.
The message registration of described target to be analyzed comprises the both call sides number, conversation time started, the end of conversation time and the duration of call;
The conversation key element of described message registration comprises the total duration of conversation of this evaluating objects, the voice frequency of this evaluating objects and duplicate numbers, the air time section of this evaluating objects and duplicate numbers, the duration of call of this evaluating objects and duplicate numbers.
The invention also discloses a kind of monitoring system, comprise analyzer and client, wherein:
Described analyzer, be used for extracting the message registration of target to be analyzed according to the analysis condition of setting in advance, conversation key element structure statistical model according to the message registration that is extracted, and according to statistical model of constructing and described analysis condition calculating confidential interval, filter out the suspicious message registration that is positioned at outside the described confidential interval, determine to treat intercept target according to the suspicious message registration that described analyzer sends, and described suspicious message registration and the determined intercept target for the treatment of are sent to client;
Described client is used for the intercept target for the treatment of that described analyzer sends is shown to the user.
Further, said system also comprises the monitoring main control unit:
Described client also is used for establishing the control switch automatically according to what monitoring system was opened or closed in user operation;
Described analyzer is opened in described client and describedly to be established control automatically during switch, and the described intercept target for the treatment of is sent to described monitoring main control unit;
Described monitoring main control unit is used to receive the intercept target for the treatment of that described analyzer sends, and the described intercept target for the treatment of is established control automatically, will establish the control order and send to respective network elements.
Wherein, described analyzer determines to treat that by described suspicious message registration intercept target refers to, the correspondent of non-evaluating objects is for treating intercept target in the described suspicious message registration.
The analysis condition of described prior setting comprises treats intercept target, listening period section and confidence level.
Described analyzer according to the statistical model of structure and the confidence level in the described analysis condition, calculates described confidential interval respectively.
The message registration of described target to be analyzed comprises the both call sides number, conversation time started, the end of conversation time and the duration of call;
The conversation key element of described message registration comprises the total duration of conversation of this evaluating objects, the voice frequency of this evaluating objects and duplicate numbers, the air time section of this evaluating objects and duplicate numbers, the duration of call of this evaluating objects and duplicate numbers.
Technical solution of the present invention can be finished the initial analysis to the magnanimity conversation, and the assistance operator finishes data analysis, has improved the hit rate of suspicious conversation.Simultaneously, technical solution of the present invention provides and has established the control function automatically, can help operator's suspicious number of deploying to ensure effective monitoring and control of illegal activities in time, fast.
Description of drawings
Fig. 1 is a system block diagram of using the embodiment of the invention;
Fig. 2 is the workflow diagram of system shown in Figure 1;
Fig. 3 is analysis process figure in the flow process shown in Figure 2;
Fig. 4 is a flow chart of establishing control in the flow process shown in Figure 2 automatically.
Embodiment
Main design of the present invention is, after the operator starts analytic function, analyzer will be retrieved relative recording, and quantizes the probability characteristics of its conversation key element according to the statistical nature of conversation behavior, lists the higher conversation of suspicious degree.The operator can this as foundation, select the record playback targetedly.One aspect of the present invention provides a kind of aid that excavates suspicious conversation for the operator, improves the hit rate of finding suspicious conversation by the data preliminary treatment, improves data analysis efficient.On the other hand, also provide based on the behavioural analysis result establish the control function automatically, improve and establish control efficient.
Below in conjunction with drawings and the specific embodiments technical solution of the present invention is described in further detail.
A kind of monitoring system as shown in Figure 1, comprises monitor information database 101, analyzer 102, client 103 and monitors main control unit 104.Introduce the function of each several part below.
Monitor information database: be used to store by the report of the life event of intercept target the configuration of monitored datas such as analysis condition;
Analyzer: the life event report and the analysis condition that are used for extracting intercept target from monitor information database, and from monitor information database, extract message registration by the analysis condition that extracts, and the statistical characteristics of calculating the conversation key element of each message registration, provide probability-distribution function, confidential interval, screening suspicious message registration (is that institute's statistical characteristics drops on confidential interval message registration in addition, think suspicious record), and list the suspicious intercept target for the treatment of, the suspicious message registration and the suspicious intercept target for the treatment of are sent to client, when starting " establishing the control function automatically ", also intercept target sends to the monitoring main control unit and establishes control analyzer with suspicious treating, wherein, the statistical characteristics of the key element of respectively conversing that analyzer calculated mainly is mean value and mean square error, type according to sampling can be divided into discrete type and continuous type data.
For example, be example with the talk times, if confidence level is 90%, its interval is that [5,8,9] are inferior, and then talk times is 10 o'clock, and promptly thinking has suspicious conversation;
Client: be used for analysis condition according to operator's operation setting intercept target, confidence level is set, and start or close " establishing the control function automatically ", and the suspicious intercept target for the treatment of that sends according to analyzer, the suspicious probability Distribution Model for the treatment of intercept target of graphical demonstration, confidence level and confidential interval), list suspicious message registration that analyzer provides and the suspicious intercept target for the treatment of;
At this moment, client can be carried out operations such as playback call voice record by shown suspicious call, and when starting " establishing the control function automatically ", client can selectively be established control according to this display result.
Monitor main control unit: when client " starts and establishes control function automatically ", establish the control target according to what analyzer calculated, tissue is established control order, is handed down to each related network elements and (promptly can starts the network node of call voice.Mobile switch etc. for example).。
Specify the course of work of above-mentioned monitoring system below, this process may further comprise the steps as shown in Figure 2:
Step 200: the operator selects intercept target, sets analysis condition, starts monitoring system;
In this step, the analysis condition of setting comprises target to be analyzed, time period and confidence level etc. at least.
Step 210: monitoring system is extracted message registration according to the analysis condition of setting, and the structure statistical model calculates confidential interval, filters out the high message registration of suspicious degree;
Step 220: monitoring system with analysis result graphically to be shown to the operator;
Step 230: opened when monitoring system and to have established the control function automatically, then treated intercept target and establish control automatically, and will establish the control order and send to respective network elements;
In this step, opened when monitoring system and to have established the control function automatically, monitoring system with analysis draw treat intercept target with and the formation of the data set of network type in each cell data, mate its network type, tissue is established the control command statement, will establish the network element that the control order sends to all-network type unanimity.
In the above-mentioned flow process, the specific operation process of step 210 as shown in Figure 3, may further comprise the steps:
Step 300: monitoring system reads the analysis condition of setting, comprises destination number to be analyzed, time range, confidence level etc.;
Step 310: monitoring system extracts all message registrations (as the HI2 report of etsi standard) of the target to be analyzed in the setting-up time scope, wherein can setting-up time be set by the client user;
In this step, the message registration of the target to be analyzed that monitoring system extracts comprises the both call sides number, conversation time started, the end of conversation time and the duration of call etc.;
Step 320: monitoring system is calculated the statistical characteristics (term prestige, mean square error etc. in full) of the conversation key element of all message registrations, the probabilistic model of structure conversation key element;
In this step, the conversation key element comprises the total duration of conversation of this evaluating objects, the voice frequency of this evaluating objects and duplicate numbers, the air time section of this evaluating objects and duplicate numbers, the duration of call of this evaluating objects and duplicate numbers etc.;
In the present embodiment, be that the characteristic value structure is evenly distributed probabilistic model with " voice frequency of target to be analyzed and fixed number "; With " the total duration of the conversation of target to be analyzed ", " duration of call of target to be analyzed and fixed number ", " the air time section of target to be analyzed and fixed number " is characteristic value structure Gaussian Profile probabilistic model.
Step 330: monitoring system is read operation person's preset confidence respectively;
Step 340: monitoring system is constructed its confidential interval respectively according to the probabilistic model of structure in the step 320 and the confidence level that reads;
Step 350: monitoring system progressively filters out " duration of call " from sample, " with the voice frequency of duplicate numbers ", " with the duration of call of duplicate numbers ", " with the air time section of duplicate numbers " drops on the outer message registration of confidential interval, and with these message registrations as message registration unusually;
Step 360: the unusual message registration that monitoring system is found step 250 is put into unusual conversation formation, and with the content of these these conversations of prompting operation person's precedence parse;
Step 370: monitoring system is put into a side of non-analyzed target in the unusual message registration of step 250 discovery and is treated the intercept target formation, reminds the operator to establish these numbers of control with this, or establishes control automatically as target.
In the above-mentioned flow process, the specific operation process of step 230 as shown in Figure 4, may further comprise the steps:
Step 400: monitoring system reads successively treats the intercept target formation;
Step 410: monitoring system judges whether the number that is read has established control, if, enter step 420, read next number otherwise return step 400;
Step 420: monitoring system sends to the network element of all and this number identical network type and establishes the control order, establishes this number of control;
Step 430: judge current number whether for treating last-number in the intercept target formation, if, process ends then; Otherwise return step 400 and read next number.
From the foregoing description as can be seen, technical solution of the present invention has increased the behavioural analysis module on the basic monitor function basis of having realized, finishes the initial analysis to the magnanimity conversation, and the assistance operator finishes data analysis, improves the hit rate of suspicious conversation.Simultaneously, technical solution of the present invention provides and has established the control function automatically, can help operator's suspicious number of deploying to ensure effective monitoring and control of illegal activities in time, fast.
Certainly; the present invention also can have other various embodiments; under the situation that does not deviate from spirit of the present invention and essence thereof; those of ordinary skill in the art work as can make various corresponding changes and distortion according to the present invention, but these corresponding changes and distortion all should belong to the protection range of the appended claim of the present invention.
Claims (12)
1. the analysis cloth control method of a monitoring system is characterized in that this method comprises:
Monitoring system is extracted the message registration of target to be analyzed according to the analysis condition of setting in advance, conversation key element structure statistical model according to the message registration that is extracted, and according to statistical model of constructing and described analysis condition calculating confidential interval, filter out the suspicious message registration that is positioned at outside the described confidential interval, determine to treat intercept target by described suspicious message registration, and be shown to the user.
2. the method for claim 1 is characterized in that, this method also comprises:
Open when establishing control function automatically in described monitoring system, described monitoring system is established control automatically to the described intercept target for the treatment of, and will establish control order and send to respective network elements.
3. method as claimed in claim 1 or 2 is characterized in that,
Described monitoring system determines to treat that by suspicious message registration intercept target refers to, the correspondent of non-evaluating objects is for treating intercept target in the described suspicious message registration.
4. method as claimed in claim 1 or 2 is characterized in that,
The analysis condition of described prior setting comprises treats intercept target, listening period section and confidence level.
5. method as claimed in claim 4 is characterized in that,
Described monitoring system is calculated described confidential interval respectively according to the statistical model of structure and the confidence level in the described analysis condition.
6. method as claimed in claim 1 or 2 is characterized in that,
The message registration of described target to be analyzed comprises the both call sides number, conversation time started, the end of conversation time and the duration of call;
The conversation key element of described message registration comprises the total duration of conversation of this evaluating objects, the voice frequency of this evaluating objects and duplicate numbers, the air time section of this evaluating objects and duplicate numbers, the duration of call of this evaluating objects and duplicate numbers.
7. a monitoring system is characterized in that, this system comprises analyzer and client, wherein:
Described analyzer, be used for extracting the message registration of target to be analyzed according to the analysis condition of setting in advance, conversation key element structure statistical model according to the message registration that is extracted, and according to statistical model of constructing and described analysis condition calculating confidential interval, filter out the suspicious message registration that is positioned at outside the described confidential interval, determine to treat intercept target according to the suspicious message registration that described analyzer sends, and described suspicious message registration and the determined intercept target for the treatment of are sent to client;
Described client is used for the intercept target for the treatment of that described analyzer sends is shown to the user.
8. system as claimed in claim 7 is characterized in that, this system also comprises the monitoring main control unit:
Described client also is used for establishing the control switch automatically according to what monitoring system was opened or closed in user operation;
Described analyzer is opened in described client and describedly to be established control automatically during switch, and the described intercept target for the treatment of is sent to described monitoring main control unit;
Described monitoring main control unit is used to receive the intercept target for the treatment of that described analyzer sends, and the described intercept target for the treatment of is established control automatically, will establish the control order and send to respective network elements.
9. as claim 7 or 8 described systems, it is characterized in that,
Described analyzer determines to treat that by described suspicious message registration intercept target refers to, the correspondent of non-evaluating objects is for treating intercept target in the described suspicious message registration.
10. as claim 7 or 8 described systems, it is characterized in that,
The analysis condition of described prior setting comprises treats intercept target, listening period section and confidence level.
11. system as claimed in claim 10 is characterized in that,
Described analyzer according to the statistical model of structure and the confidence level in the described analysis condition, calculates described confidential interval respectively.
12. as claim 7 or 8 described systems, it is characterized in that,
The message registration of described target to be analyzed comprises the both call sides number, conversation time started, the end of conversation time and the duration of call;
The conversation key element of described message registration comprises the total duration of conversation of this evaluating objects, the voice frequency of this evaluating objects and duplicate numbers, the air time section of this evaluating objects and duplicate numbers, the duration of call of this evaluating objects and duplicate numbers.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2009102123217A CN102055853A (en) | 2009-11-04 | 2009-11-04 | Monitoring system and analysis and supervision method thereof |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2009102123217A CN102055853A (en) | 2009-11-04 | 2009-11-04 | Monitoring system and analysis and supervision method thereof |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN102055853A true CN102055853A (en) | 2011-05-11 |
Family
ID=43959765
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2009102123217A Pending CN102055853A (en) | 2009-11-04 | 2009-11-04 | Monitoring system and analysis and supervision method thereof |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102055853A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102833738A (en) * | 2012-07-30 | 2012-12-19 | 中国联合网络通信集团有限公司 | Method and device for communication monitoring |
| US11381677B2 (en) * | 2019-11-25 | 2022-07-05 | Capital One Services, Llc | Systems and methods to manage models for call data |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1671086A (en) * | 2004-03-15 | 2005-09-21 | 华为技术有限公司 | A system and method for implementing snooping analysis |
| CN1984196A (en) * | 2005-12-12 | 2007-06-20 | 国际商业机器公司 | Method and system for managing internet telephone voice mail |
| CN101222379A (en) * | 2007-12-13 | 2008-07-16 | 东软集团有限公司 | Rubbish voice information detecting method and device |
| CN101449531A (en) * | 2006-05-19 | 2009-06-03 | Nec欧洲有限公司 | Method for identifying undesired telephone calls |
| US20090187987A1 (en) * | 2008-01-23 | 2009-07-23 | Yahoo! Inc. | Learning framework for online applications |
-
2009
- 2009-11-04 CN CN2009102123217A patent/CN102055853A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1671086A (en) * | 2004-03-15 | 2005-09-21 | 华为技术有限公司 | A system and method for implementing snooping analysis |
| CN1984196A (en) * | 2005-12-12 | 2007-06-20 | 国际商业机器公司 | Method and system for managing internet telephone voice mail |
| CN101449531A (en) * | 2006-05-19 | 2009-06-03 | Nec欧洲有限公司 | Method for identifying undesired telephone calls |
| CN101222379A (en) * | 2007-12-13 | 2008-07-16 | 东软集团有限公司 | Rubbish voice information detecting method and device |
| US20090187987A1 (en) * | 2008-01-23 | 2009-07-23 | Yahoo! Inc. | Learning framework for online applications |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102833738A (en) * | 2012-07-30 | 2012-12-19 | 中国联合网络通信集团有限公司 | Method and device for communication monitoring |
| CN102833738B (en) * | 2012-07-30 | 2015-05-20 | 中国联合网络通信集团有限公司 | Method and device for communication monitoring |
| US11381677B2 (en) * | 2019-11-25 | 2022-07-05 | Capital One Services, Llc | Systems and methods to manage models for call data |
| US11856129B2 (en) | 2019-11-25 | 2023-12-26 | Capital One Services, Llc | Systems and methods to manage models for call data |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103701999B (en) | The monitoring method of call center's voice call and system | |
| CN103152740B (en) | A kind of anti-monitor method and system for mobile terminal | |
| CN103095889B (en) | Junk call intercepting system based on talk mode identification and operating method thereof | |
| US7058166B2 (en) | System and method for real-time fraud detection within a telecommunications system | |
| DE112015001416B4 (en) | Detection of an unauthorized wireless communication device | |
| CN102892117A (en) | Method and system for monitoring crank call | |
| US8385906B2 (en) | Method and apparatus for identifying network affiliations of churned subscribers | |
| CN104735272B (en) | The hold-up interception method and system of a kind of harassing call | |
| CN110445942A (en) | A kind of outer paging system of intelligence and intelligent calling-out method | |
| CN105260662A (en) | Detection device and method of unknown application bug threat | |
| CN106936997A (en) | It is a kind of based on the rubbish voice recognition methods of social networks collection of illustrative plates and system | |
| CN109697989A (en) | Audio data processing method, server and readable storage medium storing program for executing | |
| CN106791231A (en) | A kind of harassing call treating method and apparatus | |
| CN102055853A (en) | Monitoring system and analysis and supervision method thereof | |
| CN101917309A (en) | Detection method of denial of service of public service number under soft switching platform | |
| CN114169438A (en) | Telecommunication network fraud identification method, device, equipment and storage medium | |
| CN103124430A (en) | Method and system for locating indoor users | |
| CN103279708A (en) | Method and system for monitoring and analyzing mobile terminal malicious code behaviors | |
| Slimen et al. | Anomaly prevision in radio access networks using functional data analysis | |
| CN101431731A (en) | Automatic catching device for illegal voice telephone and short message number based on user mobile phone | |
| CN103108084B (en) | A kind of anti-monitor method and system for mobile terminal | |
| CN103167502A (en) | Method of punishing illegal calling based on over-the-air (OTA) technology | |
| CN107087299A (en) | Wireless networking control method and device | |
| CN107786931A (en) | Audio-frequency detection and device | |
| CN101917445A (en) | Method for detecting denial of service attack of number segment in soft switching platform |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C02 | Deemed withdrawal of patent application after publication (patent law 2001) | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20110511 |