KR20170006158A - System and method for detecting fraud usage of message - Google Patents

Abstract

The present invention relates to a method and system for detecting an unauthorized user sending an abnormal text message. According to the present invention, a method of detecting an unauthorized user who abnormally sends a text message in a fraud detection system, comprises a step of collecting telephone numbers suspected of being fraud users and registering them in an analysis target list as an analysis target telephone number; a step of checking whether or not a character usage pattern using the analysis target telephone number recorded in the analysis target list matches each of fraud usage patterns recorded in a rule set by referring to the rule set in which the fraud usage patterns for each profile are recorded, and evaluating a score for each profile; a step of evaluating the negative index of the analysis target telephone number based on each evaluated profile score; and a step of determining that a subscriber having the analysis target telephone number is an unauthorized user if the negative index of the analyzed target telephone number exceeds a negative threshold value set in advance. So, it is possible to monitor and detect spammers in real time by analyzing collected data.

Description

TECHNICAL FIELD [0001] The present invention relates to a method and system for detecting fraudulent use of a text message,

The present invention relates to a method for detecting illegal use of a text message, and more particularly, to a method and system for detecting an unauthorized user sending an abnormal text message.

BACKGROUND ART [0002] Due to the rapid development of mobile communication networks and mobile communication devices today, advertisement using text messages has become popular. The following patent document discloses a location-based text message advertisement method using a base station location. However, the advertisement using the text message is abused, and spam messages related to malicious spam messages, that is, pornography, gambling, drugs, and loans are being sent.

When the mobile communication subscriber notifies the spam text message received by the subscriber to a designated agency (for example, KISA), the agency requests the mobile communication company to block the transmission of the SMS to the calling number, And suspends or terminates the calling number and blocks the spammer from sending a character.

However, such a notification method of the receiver is a form in which the agency and the mobile communication company directly examine the contents of the reported spam characters and judge whether or not the corresponding characters are the spam characters finally, so that there is a lot of manpower to be input and only post-response is possible.

Meanwhile, in the past, spammers constructed a spam-sending server and operated the spam-sending agent business at a lower cost than the mobile communication company through the server. However, a spam detection system based on a sender was introduced in the mobile communication company, Due to the introduction of new terms and systems that regard illegal activities as related, the frequency of use of the spam sending method based on the text proxy server has been greatly reduced.

However, in recent years, spammers have opened a large number of low-cost phones, installed an illegal text sending application on a low-cost phone, and constructed an illegal text sending system equipped with a server interlocked with the application. This illegal text sending system is a structure in which, when a spammer connects to a server and creates a spam text message, the spam text message is sent through a low-priced phone equipped with an illegal text sending application.

If the illegal text sending system continuously sends spam characters, the profit structure of the mobile communication company may be adversely affected, and the service satisfaction of the user may be deteriorated.

Korean Patent Laid-Open No. 10-2006-0107729

It is an object of the present invention to provide a method and system for detecting fraudulent use of fraud in real time by analyzing collected data.

Other objects and advantages of the present invention will become apparent from the following description, and it will be understood by those skilled in the art that the present invention is not limited thereto. It will also be readily apparent that the objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

According to a first aspect of the present invention, there is provided a method for detecting a fraudulent user who abnormally sends a text message in an fraud detection system, comprising: collecting phone numbers suspected of being fraudulent users; Registering in a target list; It is checked whether or not the character usage pattern using the analysis target telephone number recorded in the analysis target list coincides with each of the fraudulent use patterns recorded in the rule set, Evaluating; Evaluating a negative index of the target telephone number based on the evaluated profile score; And determining that the subscriber having the analysis target telephone number is an unauthorized user if it is determined that the negative index of the analyzed telephone number exceeds the negative threshold value set in advance and exceeds the negative threshold value .

According to a second aspect of the present invention, there is provided a fraud detection system comprising: a database for storing a rule set in which a fraudulent use pattern for each profile is recorded; A data collection unit for collecting telephone numbers suspected of being an unauthorized user and registering the telephone numbers as analysis target telephone numbers in an analysis target list; It is determined whether or not the character usage pattern using the analysis target telephone number recorded in the analysis target list coincides with each of the unauthorized use patterns recorded in the ruleset by referring to the ruleset to evaluate the score for each profile, An indefinite exponent evaluating unit for evaluating a negative index of the target telephone number based on the score; And an unauthorized use judging unit for judging, as an unauthorized user, a subscriber having the analysis target telephone number if it determines whether the negative index of the analysis target telephone number exceeds a negative threshold value set in advance and exceeds the negative threshold value .

The present invention is advantageous in that it can automatically detect an unauthorized user by analyzing a character sending pattern of an unauthorized user and reduce the spam text message generated in the mobile communication network by imposing sanctions such as suspension, have.

In addition, the present invention can be applied to a mobile communication system that compares a malicious use pattern information defined beforehand with a character sending pattern of a character sender, and uses a very fast and lightweight algorithm to evaluate the negative index of a suspicious phone number based on the comparison result. It is possible to save resources (that is, CPU, memory) necessary for discrimination of an unauthorized user, and also to detect an unauthorized user at a high speed.

The present invention also provides a method and system for tracking a telephone number associated with a telephone number associated with a telephone number associated with the telephone number, It is possible to search for an unauthorized user who sends out a spam message by using the message.

The present invention also analyzes the collected data to automatically detect an unauthorized user, thereby reducing the cost of a mobile communication company caused by sending a spam text message, and reducing labor input to identify a spam text message There are advantages to be able to.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are incorporated in and form a part of the specification, illustrate exemplary embodiments of the invention and, together with the description, serve to explain the principles of the invention. And shall not be construed as limited to such matters.
1 is a diagram illustrating a communication environment to which a fraud detection system according to an exemplary embodiment of the present invention is applied.
FIG. 2 is a diagram illustrating a configuration of a fraud detection system according to an exemplary embodiment of the present invention. Referring to FIG.
3 is a diagram illustrating a rule set in which a fraudulent use pattern item is recorded.
4 is a flowchart illustrating a method for detecting fraudulent use of a telephone number used to send a spam text message in a fraud detection system according to an exemplary embodiment of the present invention.
5 is a diagram illustrating a group and a telephone number in which a negative index is evaluated according to an embodiment of the present invention.

The foregoing and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, in which: There will be. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a communication environment to which a fraud detection system according to an exemplary embodiment of the present invention is applied.

As shown in FIG. 1, the fraud detection system 200 according to an embodiment of the present invention communicates with the spam reception center 110 and the spam notification service server 120 via the network 300. Here, the network 300 includes a mobile communication network and a broadband wired communication network, and corresponds to a well-known conventional technology of the present invention, and thus a detailed description thereof will be omitted.

The spam reception center 110 is a system managed by a designated spam processing organization (for example, KISA), receives a spam letter report, and stores a spam text message and a caller ID. In addition, the spam reception center 110 provides the spam text message and the calling number reported as spam to the fraud detection system 200 at real time or at regular intervals.

The spam notification service server 120 is a server (for example, a KT company's after-service server) built on a mobile communication company server, and transmits spam notification (i.e., telephone number and text message) from a subscriber in cooperation with a spam- It is possible to receive it. In addition, when the spam notification service server 120 receives an incoming call or a text message from the mobile terminal in cooperation with the spam detection application installed in the mobile terminal, the spam notification service server 120 receives the origination number of the incoming call or text message from the mobile terminal, It confirms whether the calling number is a spam related telephone number in the database and provides the result to the mobile terminal in real time. The spam notification service server 120 transmits a telephone number and a text message reported as spam to the fraud detection system 200 at regular intervals or in real time.

The fraud detection system 200 performs a series of operations to determine whether a suspected telephone number as a spammer corresponds to a spam phone number. That is, the fraud detection system 200 collects a suspicious phone number as a spammer, and then filters the collected phone number according to a predetermined criterion. In addition, the fraud detection system 200 tracks a filtering telephone number and a telephone number that satisfies a predetermined condition, and registers each telephone number thus tracked in the group. In addition, the fraud detection system 200 analyzes the character transmission pattern of each telephone number, sequentially evaluates the fraud index for the profile, the fraud index for the fraud type, and the fraud index of the telephone number, It is determined whether or not the corresponding telephone number is an illegally used telephone number based on the negative index of the number.

FIG. 2 is a diagram illustrating a configuration of a fraud detection system according to an exemplary embodiment of the present invention. Referring to FIG.

2, the illegal use detection system 200 according to an exemplary embodiment of the present invention includes a data collection unit 210, a phone number filtering unit 220, a number tracking unit 230, a group setting unit 240, a negation exponent evaluation unit 250, a fraud determination unit 260, and a database 270. These components may be implemented in hardware, software, or a combination of hardware and software have.

The database 270 stores various data such as text data related to sending of letters, subscriber information, a rule set in which fraudulent use pattern items are recorded, an analysis target list, a block list, an unavailable list, a group information, . The rule set (see FIG. 3) is defined and recorded in one or more profiles classified according to negative types such as black list, spammers, impersonator, and each profile has one or more illegal use patterns and scores according to the patterns are defined and recorded do. One or more telephone numbers suspected of being fraudulent users (hereinafter referred to as "analysis target telephone numbers") are recorded in the analysis target list. In the block list, telephone numbers that are paused in service in the past and present are recorded. In the unavailable list, telephone numbers that can not be reused in the past and present (i.e., telephone numbers that can not be given to the subscriber) are recorded. Further, in the group information, at least one telephone number belonging to the group and a representative telephone number representative of the group are recorded. In the computation data, a character transmission amount per phone number, a character transmission content, a call reception number, and the like are recorded. Also, the spam report history records the number of spammers reported by telephone number, the text message contents, and the called number. The subscriber information includes information on the name of the mobile communication subscriber, payment information (e.g., credit card information, account information, billing address), opening point information, identification information of the mobile terminal (e.g., IMEI) The forwarding telephone number, the opening date, and the fare information.

The data collection unit 210 receives the spam report information from each of the spam reception center 110 and the spam notification service server 120 through the network 300. The data collection unit 210 stores the telephone number recorded in the spam report information in the database 270, In the analysis target list. The spam report information includes a telephone number and a text message reported as a spammer. Also, the data collecting unit 210 can check the telephone number of the subscriber who has exceeded the allowable threshold value for the number of text message sending for a specific period (for example, one day), and record the telephone number in the analysis target list.

The telephone number filtering unit 220 performs a function of removing a telephone number that is unnecessary to analyze among the telephone numbers recorded in the analysis target list of the database 270. [ Specifically, the telephone number filtering unit 220 extracts a telephone number that does not start with '010', a permitted telephone number (for example, a business telephone number such as a card company or an insurance company), or a telephone number managed by another mobile communication company Remove from the list. Also, the telephone number filtering unit 220 refers to the computer data recorded in the database 270, checks the average of the character amounts of the previous month and the previous month of each telephone number recorded in the analysis target list for each telephone number, (For example, 500) or less, and removes the telephone number from which the text message is sent from the analysis target list.

The number tracking unit 230 identifies the telephone number recorded in the analysis target list of the database 270 and refers to the subscriber information and the computation data of the database 270 to track the telephone number associated with the telephone number, As shown in FIG. The number tracking unit 230 tracks a telephone number having the same subscriber name as the telephone number recorded in the analysis target list (i.e., a personal name or a corporation name) and a telephone number using the same terminal, and records the telephone number in the analysis target list . Also, the number tracking unit 230 tracks another telephone number that the subscriber having the telephone number recorded in the analysis target list has used in the past and records the same in the analysis target list. In addition, the number tracking unit 230 tracks the telephone number to which the telephone number recorded in the analysis target list is forwarded, and records it in the analysis target list.

The group setting unit 240 registers each telephone number stored in the analysis target list in the group by referring to a predefined group rule. Specifically, the group setting unit 240 compares the data of the analysis target telephone number (i.e., the subscriber information and the computation data) with the data of the representative telephone numbers of the respective groups and determines whether the same name as the analysis target telephone number is used, Whether or not there is a history of transmission using the same terminal, whether or not there is the same payment information, whether or not the same forwarding telephone number has been set, and confirms a group setting primary condition, And the representative telephone number of the group exists, the analysis target telephone number is registered in the group.

The group setting unit 240 sets the correlation between the analysis target telephone number and each group based on the secondary condition item as shown in Table 1 below for the analysis target telephone number in which there is no group meeting the group setting primary condition Calculates the score, and registers the corresponding telephone number in the group having the highest correlation score among them. Meanwhile, the group setting unit 240 may form the analysis target telephone number into a separate new group and store the analysis target telephone number in the database 270 if there is an analysis target telephone number having no correlation score with the existing group. In this case, the group setting unit 240 may set the telephone number set as the first group to the representative telephone number.

The indefinite exponent evaluating unit 250 refers to the rule set of the database 270 to determine whether or not the character usage pattern using the telephone number to be analyzed conforms to the fraudulent use pattern, and based on the determined fraudulent use pattern The index of the profile of the analyzed telephone number, and the index of the negative type are sequentially evaluated. Also, the indefinite exponent evaluating unit 250 evaluates the highest index among the indices of the negative type evaluated as the negative index of the analyzed telephone number. The details of the negative index evaluation of the analysis target telephone number will be described later with reference to FIG.

3 is a diagram illustrating a rule set in which a fraudulent use pattern item is recorded.

Referring to FIG. 3, the ruleset records an illegal type as a large class classification, a profile as a class classification classifier, and an unused usage pattern as a class classification classifier. As the negative type, a black list, a spammer and an impostor are recorded in the ruleset. Also, the blacklist negative type includes a re-import profile, and the impersonator negative type includes an impersonation profile. The spammer negative type includes a number assignment operation profile, a spam phrase profile, a number of reports, a transmission profile, a transmission time profile, and a shipping agency profile. As shown in FIG. 3, the information about the fraudulent pattern and the corresponding score are recorded in each profile.

The unauthorized use judging unit 260 judges whether or not the negative index of the analysis target telephone number is equal to or higher than a preset threshold (for example, 70%), and if the negative index is equal to or higher than the threshold value, . At this time, the fraudulent use judging unit 260 may request the operator to sanction the subscriber who has discriminated as an unauthorized user (for example, cancel the service right, stop the service, or the like).

4 is a flowchart illustrating a method for detecting fraudulent use of a telephone number used to send a spam text message in a fraud detection system according to an exemplary embodiment of the present invention.

Referring to FIG. 4, the data collection unit 210 collects suspicious phone numbers as spammers and registers them in the analysis target list of the database 270 (S401). The data collection unit 210 receives the spam phone number and the spam text message from the spam reception center 110 and the spam notification service server 120 and records the spam phone number in the analysis target list of the database 270 .

In addition, the data collection unit 210 can identify the telephone number of the subscriber whose number of text message transmission exceeds the allowable threshold value for a specific period (for example, one day) and record the phone number in the analysis target list of the database 270. Alternatively, the data collection unit 210 may receive a telephone number suspected of being a spammer from an administrator, and may record the received telephone number in an analysis target list of the database 270.

Next, when the telephone number is recorded in the analysis target list, the telephone number filtering unit 220 filters the telephone numbers recorded in the analysis target list at regular intervals or in real time to remove unnecessary telephone numbers from the analysis target list (S403). At this time, the telephone number filtering unit 220 first removes a telephone number that does not start with '010' from the analysis target list, and selects a telephone number (for example, Company telephone number) is secondarily removed from the analysis target list. Then, the phone number filtering unit 220 checks whether a telephone number managed by another mobile communication company is recorded among the telephone numbers recorded in the analysis target list, and stores the telephone number managed by the other mobile communication company in the analysis target list as the third Remove. Also, the telephone number filtering unit 220 refers to the computerized data of the database 270, checks the average of the character transmission amounts of the previous month and the previous month of each telephone number recorded in the analysis target list for each telephone number, A telephone number whose average amount of shots is less than a predetermined allowable amount (for example, 500) is selected and removed from the analysis target list.

When the filtering of the analysis target list is completed, the number tracking unit 230 tracks the telephone number associated with the telephone number recorded in the analysis target list and additionally registers the telephone number in the analysis target list (S405). Specifically, the number tracking unit 230 tracks the telephone number having the same subscriber name as the telephone number recorded in the analysis target list (that is, a personal name or a corporation name) in the subscriber information of the database 270 and records it in the analysis target list do. Also, the number tracking unit 230 identifies the terminal identification information (e.g., IMEI: International Mobile Equipment Identity) using the telephone number recorded in the analysis target list in the subscriber information, Is tracked in the subscriber information, and recorded in the analysis target list. That is, the number tracking unit 230 checks the identification information of the terminal using the analysis target telephone number, and determines whether the terminal having the identification information has a history of sending a text message using another telephone number, And if there is a shipment history, the another telephone number is recorded in the analysis target list.

In addition, the number tracking unit 230 tracks another telephone number previously used by the subscriber having the telephone number recorded in the analysis target list in the subscriber information. That is, if the subscriber has a telephone number change history, the number tracking unit 230 keeps track of another busy number previously used by the subscriber in the subscriber information and registers the same in the analysis target list. The number tracking unit 230 checks in the subscriber information whether the telephone number recorded in the analysis target list is used as the call forwarding service. If the telephone number is used as an incoming call service, The other telephone number is tracked from the subscriber information and recorded in the analysis target list.

Further, since an unauthorized user sends out a spam text message using a plurality of telephone numbers, the number tracking unit 230 tracks and records the telephone number associated with the analysis target telephone number in the analysis target list.

When the tracking of the related telephone number is completed in the number tracking unit 230, the group setting unit 240 registers each telephone number stored in the analysis target list in the group by referring to the predefined group rule, (S407). At this time, the group setting unit 240 analyzes the correlation between the telephone number registered in the analysis target list and the existing group, registers the telephone number in the group having the highest correlation, .

The group setting unit 240 compares the computed data of the telephone numbers registered in the analysis target item and the computed data of the representative telephone numbers of the respective groups one by one, and determines whether the primary correlation, that is, whether the same name is used, Whether or not the forwarding phrase is transmitted, whether there is a history using the same terminal, whether or not the same payment information (the same bank account as the payment information, the same credit card information is also the same as the billing address) If the telephone number matches any of the telephone numbers and the representative telephone number of the group exists, the telephone number is registered in the group having the representative telephone number. That is, the group setting unit 240 sets the telephone number having the same name, the telephone number to which the same sending phrase is transmitted, the telephone number of the history information using the same terminal, or the telephone number having the same payment information. Numbers are formed into the same group.

On the other hand, the group setting unit 240 sets the correlation between the analysis target telephone number and the representative telephone number of each group, based on the following second condition item, for the analysis target telephone number in which there is no group meeting the first condition Calculates the score, and registers the corresponding telephone number in the group having the highest correlation score among them.

Table 1 below is a table illustrating secondary condition items for forming a group.

Secondary condition Correlation score Same reply phone number 3 The same opening point 3 A similar date One Similar character usage One The last 4 digits of the same phone number One Similar rates One Subscribe to call forwarding service One

Referring to Table 1, the group setting unit 240 compares the computation data of the analysis target telephone number and the computation data of the group representative telephone number by one-to-one, so that the analysis target telephone number and the representative telephone number of the group use the same reply telephone number And if they are the same, adds 3 points to the correlation number of the group to be analyzed and the analysis target telephone number. Also, the group setting unit 240 checks whether the analysis target telephone number and the representative telephone number are opened at the same opening point. If the analysis target telephone number and the representative telephone number are opened at the same opening point, Is added. In addition, when the opening interval between the analysis target telephone number and the representative telephone number is within a preset period (for example, 30), the group setting unit 240 adds one point to the correlation number of the analysis target telephone number and the group . The group setting unit 240 adds 1 point to the analysis target telephone number and the correlation score of the group if the analysis target telephone number and the representative telephone number have similar character usage amounts. At this time, if the difference between the analysis target telephone number sent for a predetermined period (for example, three months) and the average character usage amount of the representative telephone number is below the critical usage amount, the group setting unit 240 sets the character usage amount of the two telephone numbers It is judged to be similar and one point can be added to the correlation phone number of the analysis target and the correlation score of the group.

If the analysis target telephone number and the representative telephone number are the same after the last four digits of the telephone number, the group setting unit 240 adds one point to the analysis target telephone number and the correlation score of the group. The group setting unit 240 adds one point to the analysis target telephone number and the correlation score of the group if the analysis target telephone number and the representative telephone number are telephone numbers using the call forwarding service.

When the analysis target telephone number and the correlation score of each group are calculated according to the group setting secondary condition, the group setting unit 240 registers the analysis target telephone number in the group having the highest correlation score among the groups.

On the other hand, the group setting unit 240 can form the telephone number as a separate new group if there is a telephone number in which no correlation score with the existing group appears at all.

When a group of analysis target telephone numbers is set by the group setting unit 240, the irregularity exponent evaluating unit 250 refers to the rule set stored in the database 270 to calculate the irregular use pattern defined in the rule set, The data is compared (S409), and it is determined whether or not the character usage pattern using the phone number to be analyzed corresponds to the illegal use pattern. That is, the indefinite exponent evaluating unit 250 checks whether the character usage pattern using the phone number to be analyzed coincides with each of the fraudulent use patterns recorded in the rule set as shown in FIG. 3, The score corresponding to the illegal use pattern is added.

Referring back to FIG. 3, the irregularity index evaluating unit 250 adds five points of the score of the re-entry profile of the telephone number when the analysis target telephone number is recorded in the unavailable list. Further, the indefinite index evaluating unit 250 adds three points of the re-index profile of the analysis target telephone number when the analysis target telephone number is a telephone number recorded in the block list.

The indefinite exponent evaluating unit 250 analyzes the computation data of the telephone number of the analysis target and, if it is determined that the calling number of the text message using the analysis target telephone number is changed, adds the transmission operation profile score of the analysis target telephone number to the three- . At this time, based on the computation data of the analysis target telephone number, the indefinite exponent evaluating unit 250 determines whether the origination number of the text message is manipulated by checking whether the actual origination number and the line number in the text message are different can do. In addition, the indefinite exponent evaluating unit 250 checks whether or not the average of the character sending amounts using the analysis target telephone number is 1000 or more for a predetermined period (for example, 3 months), and if the number is 1000 or more, Three points are added to the number of operation number of operation number of telephone number.

The indefinite exponent evaluating unit 250 analyzes the text message transmitted using the analysis target telephone number to determine whether or not a message relating to the malicious spam content (i.e., sex / adult, drug, loan, gambling) is recorded in the message content , And when the information is recorded, the spam stationery profile score of the analysis target telephone number is added by three points. In addition, the irregularity index evaluating unit 250 checks the history of the analysis target telephone number as a spammer in the database 270, and if there is a reported history, it judges whether or not the content of the reported character is malicious spam content If the content is malicious spam, the spam phrase profile score of the phone number to be analyzed is added by three points.

The irregularity index evaluating unit 250 checks the number of times the analysis target phone number is reported as a spammer from the reporting spam accepting center 110. If the reporting number is five or more, . The indefinite exponent evaluating unit 250 checks the number of times that the analysis target phone number is reported as a spammer from the spam notification service server 120. If the reporting number is 10 or more, .

The indefinite exponent evaluating unit 250 checks the character transmission amount of the analysis target telephone number in the computerized data of the database 270 and extracts the character sent out using the analysis target telephone number for a predetermined period of time If the average number (for example, monthly average) of the number of called numbers in the message is 1000 or more, 3 points are added to the transmission profile score of the analysis target telephone number. If the average number (for example, monthly average) of the number of sent text messages transmitted through the use of the analysis target telephone number during a predetermined period is 1000 or more, the irreversibility index evaluating unit 250 calculates three points . The indefinite exponent evaluating unit 250 checks the number of times that the number of daily text messages using the analysis target telephone number is 150 or more during a predetermined period of time. If the number of times of transmission is ten or more, 1 point is added. The irrelevant exponent evaluating unit 250 checks the group to which the analysis target telephone number belongs, determines whether the number of the telephone number registered in the group is 10 or more, and if the number is 10 or more, 1 point is added. If the number of the destination numbers designated as the text message destination is 1000 or more for a predetermined period (for example, one month) in the group to which the analysis target telephone number belongs, the irreversibility index evaluating unit 250 calculates Add three points.

If the indefinite index evaluating unit 250 determines that a certain amount (for example, 50%) of the text message transmitted from the analysis target telephone number is transmitted from 21:00 to 8:00, 3 points are added. The indefinite exponent evaluating unit 250 analyzes the content of the text message transmitted from the analysis target telephone number, and if there is a text message related to the malicious (i.e., gambling, drug, loan, Three points are added to the score of the calling time profile of the target telephone number.

The indefinite exponent evaluating unit 250 may be configured such that if a text message sent with the same content as the analysis target telephone number is included in the computed data and the number of types of texts recorded in the sent text message is five or more, Add 3 points to the score. That is, if the type of the text message having the same phrase is five or more, if the analysis target telephone number is a telephone number used for the sending agency, the indefinite exponent evaluating unit 250 calculates the sending agency profile Add 3 points to the score. Also, the indefinite exponent evaluating unit 250 analyzes the text message sent from the group to which the analysis target telephone number belongs and, if there are three or more telephone numbers to which the same text message is sent, Add 3 points to the proxy profile score.

The indefinite exponent evaluating unit 250 checks the number of different names in the group to which the analysis target telephone number belongs, and adds 3 points to the impersonation profile score of the analysis target telephone number when the number of the persons is three or more . Also, the indefinite exponent evaluating unit 250 analyzes the text message sent from the group to which the analysis target telephone number belongs, and if there are three or more telephone numbers to which the same text message is sent, Add 3 points to the theft profile score.

The indefinite exponent evaluating unit 250 can adjust each profile score so that the score of each profile does not exceed 5. [ That is, the indefinite exponent evaluation unit 250 can keep the profile score at 5 when the specific profile score exceeds 5. Accordingly, the profile score has a number of 5 or less.

Thus, when the score is evaluated for each profile, the indefinite exponent evaluating unit 250 evaluates the index (%) of the profile based on the profile score (S411). That is, the indefinite exponent evaluating unit 250 evaluates the profile index by dividing the profile score by 5 and multiplying by 100%. For example, the irregularity index evaluating unit 250 may evaluate the index of the issuing operation profile at 60% when the number of the issuing operation profile is three points.

The indefinite exponent evaluator 250 identifies one or more profiles included in the indefinite type (i.e., the black list, the spammers, and the impostor), and identifies the largest index among the indices of each profile included in the indefinite type, And is evaluated as an index (S413). For example, when the rating index is 60%, the spam phrase profile index is 60%, the report number profile index is 60%, the sender profile index is 100%, the sending time profile index is 60% , The indefinite exponent evaluator 250 can evaluate the highest exponent (that is, 100%) as an index of the spammer negative type.

Then, the indefinite index evaluating unit 250 evaluates the largest index among the plurality of negative types evaluated as a negative index of the analysis target telephone number (S415). For example, when the malicious type index of the black list is 60%, the malicious type index of the spammers is 100%, and the fraud type index of the impersonator is 0%, the malicious indices evaluation unit 250 calculates the highest index 100%) can be evaluated as a negative index of the target telephone number.

Next, the indefinite exponent evaluating unit 250 evaluates the negative index of the group (S417). At this time, the irrationality index evaluating unit 250 evaluates the average value of the irregularities of the telephone number belonging to the group as the negative index of the corresponding group.

5 is a diagram illustrating a group and a telephone number in which a negative index is evaluated according to an embodiment of the present invention.

Referring to FIG. 5, 010-XXXX-1234 has the highest index in the profile of each profile among the profiles. Thus, the negative type index of the spammer is also evaluated to be 90%, and the target telephone number 010-XXXX The negative index of -1234 is also evaluated as 90%.

In addition, the negative index (90%) of the originating number 010-XXXX-1234 and the average value (82.5%) of the negative index (75%) of 010-XXXX-3456 are evaluated as the negative index of the group having ID 201.

If the indefinite index of the target telephone number is evaluated by the indefinite exponent evaluating unit 250, the indefinite use determining unit 260 determines that the indefinite exponent of the analysis target telephone number exceeds the previously set negative threshold value (for example, 70%) (S419). If the negative threshold is exceeded, the subscriber having the analysis target telephone number is determined to be an unauthorized user (e.g., a spammer) (S421). The unauthorized use judging unit 260 requests the operator for sanctioning the subscriber determined as the unauthorized user (for example, canceling the service right, stopping the service, etc.).

4 is a description of one cycle, in which the fraud detection system 200 repeatedly executes the processor according to FIG. 4 at a predetermined periodic interval, or when a new telephone number is recorded in the analysis target list Perform iteratively.

Meanwhile, it is made clear that one or more items may be omitted or new items may be added to the group rule and rule set described in the above embodiments.

As described above, the fraud detection system 200 according to the embodiment of the present invention automatically detects fraudulent users by analyzing a character sending pattern of a fraudulent user, and transmits the fraudulent fraudulent user to the fraudulent user The spam text message generated in the mobile communication network can be reduced. In addition, the fraud detection system 200 according to the present invention compares the previously used fraud pattern information with the character sending pattern of the character sender, and based on the comparison result, the fraud index of the suspicious fraudulent phone number Because it detects fraudulent users through a very fast and lightweight algorithm to evaluate, it not only saves the resources (CPU, memory) required to identify fraudulent users, but it also can detect the administrator users at high speed. In addition, when the telephone number is reported as a spammer, the fraud detection system 200 according to the present invention tracks another telephone number associated with the telephone number and registers the same in a group, and transmits a text message It is possible to search for an unauthorized user who sends out a spam message by using a plurality of telephone numbers.

While the specification contains many features, such features should not be construed as limiting the scope of the invention or the scope of the claims. In addition, the features described in the individual embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described in the singular < Desc / Clms Page number 5 > embodiments herein may be implemented in various embodiments individually or in combination as appropriate.

Although the operations have been described in a particular order in the figures, it should be understood that such operations are performed in a particular order as shown, or that all described operations are performed to obtain a sequence of sequential orders, or a desired result . In certain circumstances, multitasking and parallel processing may be advantageous. It should also be understood that the division of various system components in the above embodiments does not require such distinction in all embodiments. The above-described program components and systems can generally be implemented as a single software product or as a package in multiple software products.

The method of the present invention as described above can be implemented by a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto optical disk, etc.). Such a process can be easily carried out by those skilled in the art and will not be described in detail.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. The present invention is not limited to the drawings.

110: Spam reception center 120: Spam notification service server
200: illegal use detection system 210: data collection unit
220: telephone number filtering unit 230: number tracking unit
240: Group setting section 250: Negative index evaluation section
260: Fraudulent use determination unit 270:
300: Network

Claims (24)

A method for detecting an unauthorized user who abnormally sends a text message in a fraud detection system,
Collecting telephone numbers suspected of being an unauthorized user and registering the telephone numbers as analysis target telephone numbers in an analysis target list;
It is checked whether or not the character usage pattern using the analysis target telephone number recorded in the analysis target list coincides with each of the fraudulent use patterns recorded in the ruleset by referring to the rule set in which the profile-specific fraudulent use pattern is recorded, Evaluating;
Evaluating a negative index of the target telephone number based on the evaluated profile score; And
Determining whether a subscriber having the analysis target telephone number is an unauthorized user if it is determined that the negative index of the analyzed telephone number exceeds the negative threshold value set in advance; Detection method. The method according to claim 1,
In the rule set, a fraudulent use pattern for each profile, which is classified according to the fraud type, is recorded,
The step of evaluating the negative index may include:
The profile score corresponding to the negative type is added, the index of each negative type is calculated based on the profile score added for each negative type, and the highest index among the indices of the negative type is evaluated as the negative index of the telephone number A method of detecting fraudulent use of a text message. 3. The method of claim 2,
Wherein a blacklist type is recorded in the ruleset as the negative type, a reentrant profile in the profile of the blacklist is recorded in the ruleset, and one or more unauthorized use patterns as a negative usage pattern for the reentrant are recorded in the ruleset And detecting the unauthorized use of the text message. 3. The method of claim 2,
The illegality pattern is recorded in the ruleset, the profile of the impersonator is recorded in the ruleset, and the illegal use pattern for the impersonation profile includes at least one illegal use pattern, The method of claim 1, 3. The method of claim 2,
Wherein the spammer type is recorded in the ruleset and at least one of an issuance operation profile, a spam phrase profile, a report quantity profile, a delivery profile, a delivery profile, and a delivery agency profile is recorded, Wherein at least one illegal use pattern is recorded in the rule set in correspondence with the profile of the message. 6. The method according to any one of claims 1 to 5,
After the registering step,
Further comprising the step of filtering a phone number that is unnecessary to be analyzed among the analysis target phone numbers recorded in the analysis target list. The method according to claim 6,
Wherein the filtering comprises:
Removing, from the analysis target list, a telephone number that does not start with 010 among analysis target telephone numbers recorded in the analysis target list;
Removing, from the analysis target list, a telephone number from which the text message is allowed to be transmitted among the analysis target telephone numbers recorded in the analysis target list;
Removing a telephone number managed by another communication company from the analysis target list; And
And removing a telephone number whose character transmission amount average does not exceed a preset allowable amount from the analysis target list. 6. The method according to any one of claims 1 to 5,
After the registering step,
Further comprising: tracking the telephone number associated with the analysis target telephone number recorded in the analysis target list and additionally registering the telephone number in the analysis target list. 9. The method of claim 8,
Wherein the further registering further comprises:
A telephone number having the same name as the analysis target telephone number recorded in the analysis target list, a history telephone number using the same terminal as the analysis target telephone number, a telephone number previously used by the subscriber having the analysis target telephone number, Wherein the analysis target telephone number further tracks one or more of the telephone numbers to which the analysis target telephone number is forwarded and additionally registers the analysis result in the analysis target list. 6. The method according to any one of claims 1 to 5,
After the registering step,
Analyzing a correlation between the analysis target telephone number and each group recorded in the analysis target list and registering the analysis target telephone number in the group having the highest correlation; Detection method. 11. The method of claim 10,
The step of registering the analysis target telephone number in the group includes:
Comparing the data of the analysis target telephone number with the data of the representative telephone number of each group and comparing the representative telephone number using the same name as the analysis target telephone number and the history of sending the text message of the same phrase as the analysis target telephone number The representative telephone number, the representative telephone number having history using the same terminal as the analysis target telephone number, the representative telephone number having the same payment information as the analysis target telephone number, or the same forwarding telephone number as the analysis target telephone number is set Determining whether a representative telephone number exists; And
And if the representative telephone number exists, registers the analysis target telephone number in the group to which the representative telephone number belongs. 12. The method of claim 11,
If the representative telephone number does not exist as a result of the check, the correlation score between the analysis target telephone number and the representative telephone number of each group is calculated based on the secondary condition item for the group setting that has been set in advance, And registering the analysis target phone number in a group to which a representative telephone number having a score belongs. 11. The method of claim 10,
The step of evaluating the negative index may include:
And evaluating a negative index of the group to which the analysis target telephone number belongs based on the negative index of the evaluated target telephone number. 6. The method according to any one of claims 1 to 5,
Wherein the registering step comprises:
Receiving spam report information from an external server or center and registering the telephone number recorded in the spam report information in the analysis target list; And
And registering the telephone number having the number of sent text messages exceeding the threshold value in the analysis target list. A database for storing a rule set in which a profile-specific fraud pattern is recorded;
A data collection unit for collecting telephone numbers suspected of being an unauthorized user and registering the telephone numbers as analysis target telephone numbers in an analysis target list;
It is determined whether or not the character usage pattern using the analysis target telephone number recorded in the analysis target list coincides with each of the unauthorized use patterns recorded in the ruleset by referring to the ruleset to evaluate the score for each profile, An indefinite exponent evaluating unit for evaluating a negative index of the target telephone number based on the score; And
And an unauthorized use judging unit for judging, as an unauthorized user, a subscriber having the analysis target telephone number if it determines whether the negative index of the analysis target telephone number exceeds a negative threshold value set in advance and exceeds the negative threshold value, system. 16. The method of claim 15,
In the rule set, a fraudulent use pattern for each profile, which is classified according to the fraud type, is recorded,
The irregularity index evaluating unit calculates the index of each negative type on the basis of the profile score added for each negative type, adds the profile scores corresponding to the negative type, calculates the highest index among the indices of the negative type, Quot ;. < / RTI > 17. The method according to claim 15 or 16,
And a telephone number filtering unit for filtering telephone numbers unnecessary for analysis among the analysis target telephone numbers recorded in the analysis target list. 18. The method of claim 17,
The telephone number filtering unit,
A telephone number that does not start with 010 from the analysis target telephone numbers recorded in the analysis target list, a telephone number in which a text message is allowed to be sent, a telephone number managed in another communication company, and an average character transmission amount exceed a predetermined allowable amount And removing the telephone number from the analysis target list. 17. The method according to claim 15 or 16,
Further comprising: a number tracking unit for tracking a telephone number associated with the analysis target telephone number recorded in the analysis target list and additionally registering the telephone number in the analysis target list. 20. The method of claim 19,
The number-
A telephone number having the same name as the analysis target telephone number recorded in the analysis target list, a history telephone number using the same terminal as the analysis target telephone number, a telephone number previously used by the subscriber having the analysis target telephone number, And further registers at least one of the telephone numbers to which the analysis target telephone number is forwarded and additionally registers the analysis target list in the analysis target list. 17. The method according to claim 15 or 16,
Further comprising a group setting unit for analyzing a correlation between the analysis target telephone number and each group recorded in the analysis target list and registering the analysis target telephone number in the group having the highest correlation, Detection system. 22. The method of claim 21,
Wherein the group setting unit comprises:
Comparing the data of the analysis target telephone number with the data of the representative telephone number of each group and comparing the representative telephone number using the same name as the analysis target telephone number and the history of sending the text message of the same phrase as the analysis target telephone number The representative telephone number, the representative telephone number having history using the same terminal as the analysis target telephone number, the representative telephone number having the same payment information as the analysis target telephone number, or the same forwarding telephone number as the analysis target telephone number is set And if the representative telephone number exists, registers the analysis target telephone number in the group to which the representative telephone number belongs. 23. The method of claim 22,
Wherein the group setting unit comprises:
If there is no representative telephone number as a result of the primary check, a correlation score between the analysis target telephone number and the representative telephone number of each group is calculated based on the secondary condition item for the group setting previously set, And registering the analysis target telephone number in a group to which a representative telephone number having a correlation score belongs. 22. The method of claim 21,
Wherein the irregularity-
And evaluates the negative index of the group to which the analysis target telephone number belongs based on the negative index of the evaluated target telephone number.

Images