RU2774054C1 - System and method for subscriber data protection in case of an unwanted call - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: invention relates to computer technology. A method for protecting subscriber data in case of an unwanted call, that is: intercepting traffic, including call parameters and call streaming data; performing a preliminary analysis of call parameters, the results of which determine the first value of the probability of determining the call as unwanted; if the first probability value exceeds the first threshold value, additional call parameters are determined by analyzing the call streaming data; repeated analysis of the call parameters is performed taking into account additional parameters, the results of which determine the second value of the probability of determining the call undesirable; if the mentioned second probability value exceeds the second threshold value, the call is considered unwanted, in addition, the subscriber is determined who makes the unwanted call and the subscriber whose data is subject to protection in case of an unwanted call; transmitting all the parameters of the call identified as unwanted to at least one of: the application on the device of the protected subscriber, the security agent of at least one of the mentioned data operator, the security agent on the server of the communication provider.

EFFECT: reducing errors of the first and second kind when identifying unwanted calls.

32 cl, 5 dwg

Description

Technical field

The invention relates to the field of information security.

State of the art

In the modern world, almost every network subscriber (hereinafter referred to as the subscriber) has encountered fraudulent calls (also telephone fraud, English phone fraud, scam). This problem is relevant both for the telephone network and for the computer network, in particular Internet telephony (VoIP - voice over internet protocol) and Internet instant messengers, which are used to exchange various multimedia content. The purpose of malefactors (fraudsters) is to obtain profit by fraudulent means, theft of other people's property, obtaining unauthorized access to information and other interference in the operation of information systems.

Due to telephone fraud, large financial losses are incurred not only by end users, but also by communication providers and various data operators servicing user data (for example, a bank). Some phone scams are similar to email and spam scams. However, more and more sophisticated methods of telephone fraud have recently appeared. For example, an attacker pretends to be a bank security officer, during a conversation he gains confidence in the victim subscriber and fraudulently receives confidential bank card data (number, expiration date, CVV2 code, SMS code to confirm the operation, authorization data on the Internet bank, etc.). After receiving confidential data, the attacker uses it to make illegal banking transactions and withdraw funds.

There are cases when the attacker appears to be a law enforcement officer, such as a police officer. Under the pretext of investigating an illegal transaction, he forces the victim to transfer money to him or take out a bank loan. In this case, the attacker influences the victim using various psychological techniques, uses social engineering methods, for example, intimidates with responsibility for refusing to cooperate with law enforcement agencies, responsibility for providing false information, etc. In such a scam scheme, even knowledgeable users can become victims. After all, an attacker can find out in advance the necessary addresses, phone numbers and other information about law enforcement agencies. Therefore, an attempt to verify this information by the victim will only increase her confidence in the attacker.

Fraudulent calls fall into the category of undesirable/unwanted calls/communications, that is, calls that the receiving subscriber of the telephone network would not want to receive if he were aware of the real intentions of the caller. Unwanted calls also include the following categories: advertising; surveys; calls from organizations to which the user mistakenly provided his number; spam; intrusive calls from acquaintances of the subscriber; telephone hooliganism; silent calls; telemarketing; calls from a robot (eng. robocalls); However, it should be noted that, in general, the calling subscriber can also be the victim of a fraudulent call if the called (receiving) subscriber is an intruder. Or, for example, if the attacker called the victim, after which he ended the call. After that, a careless victim subscriber can call the attacker back. Such fraudulent calls are more difficult to detect, because the victim called the attacker herself.

Attackers use modern technology to hide their activities and to effectively deceive victims. Examples of such technologies are IP telephony, complex call forwarding architectures through VPN servers and proxy servers, spoofing numbers, the ability to make calls from abroad, voice spoofing and copying. Such fraud schemes are difficult to detect, not only using automated spam detection tools, but also by trained information security professionals.

In addition, the life of a modern user cannot be imagined without the use of various Internet services in which the user registers to receive services. However, from time to time, various, even large Internet services themselves become victims of intruders, as a result of which huge amounts of confidential user data fall into the hands of intruders. Such data may include usernames and last names, phone numbers, bank card details, purchase details, etc. As a result, attackers can conduct targeted attacks (also targeted attacks) when calling victims and they may need less data to making illegal transactions. Thus, an attacker can know in advance the full name and number of the user's bank card, and in order to illegally use this card, it will be enough for him to find out the remaining card details from the victim.

Thus, there is a need for systems for identifying unwanted calls and protecting subscriber data in the event of an unwanted call. However, there is also a technical problem in that the level of detection of unwanted calls is low.

From the prior art known patent US8315593, which describes a method for authorizing calls to phone numbers. To do this, the payment label is checked and the call is denied if this label was not found. The known method allows you to exclude some types of fraud associated with the substitution of numbers. There are also many ways to identify fraudulent calls using lists of fraudulent phone numbers. However, the use of these lists will not allow identifying fraudulent calls and calls in the event, for example, of a number substitution or when a fraudulent call is made from a number that is not on the list, and the fact of fraud can be determined during the call.

However, known technologies do not completely solve the claimed technical problem. Therefore, there is a need for the claimed invention.

Disclosure of the essence of the invention

The present invention is intended to protect subscriber data in the event of an unwanted call.

The first technical result is to reduce errors of the first and second kind in the detection of unwanted calls.

The second technical result is to increase the level of protection of the subscriber's data in case of an unwanted call.

According to an implementation variant, a method for protecting subscriber data in case of an unwanted call is used, implemented by a computer device using a determination module associated with a gateway on a communication provider server, in which: traffic is intercepted, including call parameters and call streaming data, while the call parameters include subscriber identifiers; perform a preliminary analysis of the parameters of the call, the results of which determine the first value of the probability of determining the call as unwanted; if the first probability value exceeds the first threshold value, additional call parameters are determined by analyzing the streaming data of the call, where the additional parameters include information about the data operator associated with at least one subscriber, where the information about the data operator includes, in particular, one of : name, identifier; perform a reanalysis of the call parameters, taking into account additional parameters, the results of which determine the second value of the probability of determining the call as unwanted; if the said second probability value exceeds the second threshold value, the call is recognized as unwanted, in addition, the subscriber who makes the unwanted call (hereinafter referred to as the unwanted caller) and the subscriber whose data are subject to protection in case of an unwanted call (hereinafter referred to as the protected subscriber) are determined, while supplement the call parameters with labels about the unwanted subscriber and the protected subscriber, as well as information that the call is defined as unwanted; transfer all the parameters of the call, determined as unwanted, to at least one of: the application on the device of the protected subscriber, the security agent of at least one mentioned data operator, the security agent on the server of the communication provider, while the specified application and security agents protect the data of the protected subscriber, respectively on the user's device, on the server of the data operator, on the server of the communication provider.

According to one particular implementation, the call stream data is at least one of the following: an audio stream, a video stream, an audiovisual stream, an instant messaging stream, a free-form data stream.

According to another particular implementation variant, analysis of streaming data is performed: using speech recognition methods in an audio stream, followed by conversion to text, if the streaming data includes an audio stream; using image recognition methods in the video stream and subsequent conversion to text if the stream data includes a video stream; using at least one of the following text analysis methods: text mining, semantic text analysis, text parsing, wherein said text is extracted from streaming data.

According to another particular implementation option, the analysis of streaming call data includes extracting keywords, phrases, and tokens to determine information about the data operator associated with at least one subscriber by matching the extracted keywords, phrases, and tokens with known keywords, phrases, and tokens. associated with information about said data operator.

According to one of the private implementation options, additional parameters also include at least one of: keywords, phrases, tokens present in the streaming data; sentiment of text extracted from streaming data.

According to another particular implementation variant, the preliminary analysis of the call parameters includes at least one of: signature analysis, in which, if the call parameters match the unwanted call signature, the first value of the probability of determining the call as unwanted is higher than the first threshold value; heuristic analysis, in which, if the parameters of the call coincide with the heuristic of the unwanted call, a first value of the probability of determining the call is unwanted is determined above the first threshold value; analysis using a trained machine learning model to classify a call as unwanted/normal, wherein said model takes call parameters as input, and the result of applying said model is the first probability value of determining the call as unwanted and the first threshold value.

According to another particular embodiment, the reanalysis of the call parameters taking into account additional parameters includes at least one of: signature analysis, in which, if the call parameters and additional parameters match with the second unwanted call signature, a second value of the probability of determining the call as unwanted is higher than the second threshold value; heuristic analysis, in which, if the parameters of the call and additional parameters match with the second heuristic of an unwanted call, a second value of the probability of determining the call is unwanted is determined above the second threshold value; analysis using a trained second machine learning model to classify a call as unwanted/normal, wherein said second model takes call parameters and additional parameters as input, and the result of applying said second model is a second value of the probability of determining a call as unwanted and a second threshold value.

According to one of the private implementation options, using the application of the protected subscriber, the protection of the data of the protected subscriber on the device of the protected subscriber is carried out at least by: changing the information security settings of the device of the protected subscriber on which the application is installed; end the current call and block subsequent incoming or outgoing calls with an unwanted caller.

According to another particular implementation variant, all parameters of said call determined to be unwanted are passed to the unwanted subscriber application.

According to another particular implementation variant, using the unwanted subscriber application, the protection of the data of the protected subscriber on the device of the unwanted subscriber is carried out at least by: changing the information security settings of the device of the unwanted subscriber on which the application is installed; end the current call and block subsequent incoming or outgoing calls with the protected subscriber.

According to one of the private implementation options using a data operator security agent, the protected subscriber's data is protected on the data operator's server in at least one of the following ways: by restricting access to the protected subscriber's data; additional protection of access to data of the protected subscriber; cancellation of previously granted access to the data of the protected subscriber.

According to another private implementation variant, using a security agent on the server of the communication provider, the data of the protected subscriber is protected on the server of the communication provider in one of the following ways: by terminating an unwanted call; end the current call and block subsequent incoming or outgoing calls with an unwanted caller.

In another particular embodiment, the call parameters further include at least one of: call start time; information about the data transfer protocol used during the call; call duration; end time for the completed call.

According to one of the particular implementation options, the call parameters additionally include the context of the call, in particular: the number of previous calls between the mentioned subscribers, the parameters of the mentioned previous calls.

According to another particular embodiment, the call parameters further include the device context of the subscriber on which the application is installed, while additionally receiving said device context from the application of at least one subscriber, where the device context includes: data from device sensors; interaction of the device with other network devices; connecting new devices to the user's device network; the number of new devices connected to the user's device network; access to device resources; a list of resources to which access is provided; device characteristics; data transfer; type of transmitted data; antivirus events; device security events; information about interaction with payment services and applications.

According to another particular implementation variant, in the preliminary analysis and in the re-analysis, the call parameters are adjusted by interacting with the administrator of the determination module.

According to an implementation variant, a subscriber data protection system is used in case of an unwanted call, containing: at least one detection module, implemented with the possibility of execution on the processor of a computer device and associated with a gateway on the server of the communication provider, while intended for: intercepting traffic, including call parameters and call streaming data, wherein the call parameters include the identifiers of call subscribers; performing a preliminary analysis of the parameters of the call, the results of which determine the first value of the probability of determining the call as unwanted; determining additional call parameters by analyzing streaming call data in case the first probability value exceeds the first threshold value, where the additional parameters include information about the data operator associated with at least one subscriber, where the information about the data operator includes, in particular, one of : name, identifier; re-analyzing the call parameters, taking into account additional parameters; determining the second value of the probability of determining the call as unwanted based on the results of the reanalysis; determining if the second probability value exceeds the second threshold value, the call is unwanted, as well as determining the subscriber who makes the unwanted call (hereinafter referred to as the unwanted caller) and the subscriber whose data is subject to protection in case of an unwanted call (hereinafter referred to as the protected subscriber); addition of call parameters with labels about unwanted subscriber and protected subscriber, as well as information that the call is defined as unwanted; transferring the parameters of the call, determined to be unwanted, to at least one of: an application on the device of the protected subscriber, a security agent on the server of at least one data operator, a security agent of the communication provider; an application implemented with the possibility of execution on the processor of the device of at least the protected subscriber, designed to protect the data of the protected subscriber on the device of the protected subscriber; a data operator security agent implemented with the possibility of executing at least one data operator on the server processor, designed to protect the data of the protected subscriber on the data operator server; communication provider security agent, implemented with the ability to execute on the processor of the communication provider's server, designed to protect the data of the protected subscriber on the server of the communication provider.

According to one particular implementation, the call stream data is at least one of the following: an audio stream, a video stream, an audiovisual stream, an instant messaging stream.

According to another particular implementation variant, the determination module serves to analyze streaming data in at least one of the following ways: using speech recognition techniques in an audio stream, followed by conversion to text if the streaming data includes an audio stream; using image recognition methods in the video stream and subsequent conversion to text if the stream data includes a video stream; using at least one of the following text analysis methods: text mining, semantic text analysis, text parsing, wherein said text is extracted from streaming data.

According to another particular implementation option, the analysis of streaming call data includes extracting keywords, phrases, and tokens to determine information about the data operator associated with at least one subscriber by matching the extracted keywords, phrases, and tokens with known keywords, phrases, and tokens. associated with information about said data operator.

According to one of the private implementation options, additional parameters also include at least one of: keywords, phrases, tokens present in the streaming data; sentiment of text extracted from streaming data.

According to another particular implementation variant, the preliminary analysis of the call parameters includes at least one of: signature analysis, in which, if the call parameters match the unwanted call signature, the first value of the probability of determining the call as unwanted is higher than the first threshold value; heuristic analysis, in which, if the parameters of the call coincide with the heuristic of the unwanted call, determine the first value of the probability of determining the call as unwanted above the first threshold value; analysis using a trained machine learning model to classify a call as unwanted/normal, wherein said model takes call parameters as input, and the result of applying said model is the first value of the probability of determining the call as unwanted and the first threshold value.

According to another particular embodiment, the reanalysis of the call parameters taking into account additional parameters includes at least one of: signature analysis, in which, if the call parameters and additional parameters match with the second unwanted call signature, a second value of the probability of determining the call as unwanted is higher than the second threshold value; heuristic analysis, in which, if the parameters of the call and additional parameters match with the second heuristic of an unwanted call, a second value of the probability of determining the call is unwanted is determined above the second threshold value; analysis using a trained second machine learning model to classify a call as unwanted/normal, wherein said second model takes call parameters and additional parameters as input, and the result of applying said second model is a second value of the probability of determining a call as unwanted and a second threshold value.

According to one of the private implementation options, the application of the protected subscriber is designed to protect the data of the protected subscriber on the device of the protected subscriber at least by: changing the information security settings of the device of the protected subscriber on which the application is installed; end the current call and block subsequent incoming or outgoing calls with an unwanted caller.

According to another particular implementation variant, the determination module is used to transfer all the parameters of said call, determined to be unwanted, to the application of the unwanted subscriber.

According to another particular implementation variant, the unwanted subscriber application serves to protect the data of the protected subscriber on the device of the unwanted subscriber, at least by: changing the information security settings of the unwanted subscriber device on which the application is installed; end the current call and block subsequent incoming or outgoing calls with the protected subscriber.

According to one of the private implementation options, the data operator security agent serves to protect the data of the protected subscriber on the data operator server in at least one of the following ways: by restricting access to the data of the protected subscriber; additional protection of access to data of the protected subscriber; cancellation of previously granted access to the data of the protected subscriber.

According to another private implementation variant, the security agent on the server of the communication provider serves to protect the data of the protected subscriber on the server of the communication provider in one of the following ways: by terminating an unwanted call; end the current call and block subsequent incoming or outgoing calls with an unwanted caller.

In another particular embodiment, the call parameters further include at least one of: call start time; information about the data transfer protocol used during the call; call duration; end time for the completed call.

According to one of the particular implementation options, the call parameters additionally include the context of the call, in particular: the number of previous calls between the mentioned subscribers, the parameters of the mentioned previous calls.

According to another particular embodiment, the call parameters further include the device context of the subscriber on which the application is installed, while additionally receiving said device context from the application of at least one subscriber, where the device context includes: data from device sensors; interaction of the device with other network devices; connecting new devices to the user's device network; the number of new devices connected to the user's device network; access to device resources; a list of resources to which access is provided; device characteristics; data transfer; type of transmitted data; antivirus events; device security events; information about interaction with payment services and applications.

According to another particular implementation variant, in the preliminary analysis and in the re-analysis, the call parameters are adjusted by interacting with the administrator of the determination module.

Brief description of the drawings

Additional objects, features and advantages of the present invention will become apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

Figure 1 shows the general scheme of the subscriber data protection system in case of an unwanted call.

Figure 2 shows a possible implementation of the definition module.

Figure 3 shows a possible example of the modules of the computer protection tool.

Figure 4 shows a method for protecting subscriber data in case of an unwanted call.

Figure 5 shows an example of a general purpose computer system.

Implementation of the invention

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The gist of the description is nothing but specific details provided to assist a person skilled in the art in a thorough understanding of the invention, and the present invention is defined within the scope of the appended claims.

Glossary

Network subscriber (hereinafter referred to as the subscriber) is a user who has access to computer network resources or to a computer communication network (Dorot V., Novikov F.: Explanatory Dictionary of Modern Computer Vocabulary: 3rd ed. St. Petersburg: BHV-Petersburg, 2004, p. 71).

Subscriber's device - a terminal, computer or workstation connected to a computer network or computer communication network.

Callback, call (English callback, call) - a scheme for establishing communication between network subscribers.

A call is a temporary connection of two or more network subscribers.

Data protection - measures against unauthorized access to information stored in computer memory (Dorot V., Novikov F.: Explanatory Dictionary of Modern Computer Vocabulary: 3rd ed. St. Petersburg: BHV-Petersburg, 2004, p. 196 ).

Personal data - any information relating to a directly or indirectly identified or identifiable individual (subject of personal data) (Federal Law No. 152-FZ of July 27, 2006 "On Personal Data", paragraph 1 of Article 3).

Operator (data operator) - a state body, municipal body, legal entity or individual, independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions ( transactions) performed with personal data (Federal Law of July 27, 2006 No. 152-FZ “On Personal Data”, paragraph 2 of Article 3).

Figure 1 shows the general scheme of the subscriber data protection system in case of an unwanted call.

Consider a system 100 in which a call (voice or audiovisual) is made between two parties using devices 130 and 140 . It should be noted that, in the general case, there can be three or more subscribers participating in the call and the devices they use in the case of, for example, using a conference call. However, for simplicity, the following description will be based on the example of two parties involved in a call. Subscriber devices 130 and 140 may be any computer devices known in the art for making a call, such as a mobile phone, smartphone, IP phone (IP phone), desk phone, computer, etc. Service provider server 110 connected via computer network 120 with devices 130 and 140 and is designed to establish communication between devices 130 and 140 , transfer call traffic, complete communication between subscriber devices 130 and 140 . The traffic includes call parameters (metadata) as well as call streaming data (multimedia content). The call parameters include caller IDs (for example, phone number, IP address, etc.). In addition, the call parameters may include the start and/or end time of the call. Call streaming data includes at least one of the following types of data: audio stream, video stream, instant message stream, arbitrary format data stream (eg, files being transferred, resource links, etc.). When one subscriber calls another subscriber, the SIP (Session Initiation Protocol) protocol can be used to establish communication. After the connection is established, a call is made, while for the transmission of call traffic, for example, the RTP protocol (Real-time Transport Protocol) can be used. It should be noted that other known communication protocols can be used, in particular H.323, SRTP and others.

At the same time, the device of at least one of the subscribers uses IP telephony to make a call. In the event that the other party's device is using analog communications, an IP adapter will be installed in system 100 for data conversion.

The service provider's server 110 includes a gateway 111 that establishes a connection on a call and provides subsequent call traffic between subscriber devices 130 and 140 , as well as providing call termination. Gateway 111 may be, in particular, a proxy server, a VPN server or a SIP server. The determination module 112 is connected (associated) to the gateway 111 and is designed to intercept traffic containing call parameters and call streaming data, while the call parameters include call subscriber identifiers (for example, phone number, IP address, etc.) In addition, the call parameters may include the start and/or end time of the call. It is worth noting that the determination module 112 may receive mirrored traffic. To do this, the definition module 112 is physically connected to the SPAN port (English port mirroring, SPAN - abbr. from Switched Port Analyzer, mirroring / duplicating packets of one port of a network switch or VPN / proxy server on another) of the gateway 111 . In a particular implementation, the call parameters further include at least one of: information about the data transfer protocol used during the call (eg, one or more of: SIP, RTP, IP); call duration (current for the current call or total for the completed call); end time for the completed call (that is, when the call ended and the call ended).

The determination module 112 may receive incoming or outgoing traffic of the gateway 111 . In a particular implementation, the provider's server 110 may include a second definition module 113 that is associated with the definition module 112 and is designed to intercept traffic that the definition module 112 does not intercept - incoming or outgoing traffic, respectively. Thus, the use of two interconnected determination modules 112 - 113 makes it possible to analyze outgoing and incoming call traffic and determine more call parameters. The incoming traffic of the gateway 111 includes, in particular, the original identifier (eg, phone number) of the first subscriber using the device 130 '. While the outgoing traffic of the gateway 111 contains the original identifier of the second subscriber using the device 140 . In addition, if the first subscriber uses the substitution (modification) of its identifier, the outgoing traffic will also contain the specified substitution identifier of the first subscriber and will not contain the original identifier of the first subscriber. Thus, the use of two detection modules 112 and 113 will allow to determine more call parameters, which will further increase the level of detection of unwanted calls, which in turn will reduce errors of the first and second types in determining unwanted calls. A possible implementation of the definition modules 112 and 113 will be presented later in Fig.2 .

In one particular implementation, the determination modules 112 and 113 are directly connected, such as through network 120 '. In another particular implementation, the determination module 113 injects a given data packet into the traffic it receives and, when the determination module 112 determines in the received other traffic of the said specified packet, the determination module 112 supplements the determined call parameters with the call parameters that were determined by the determination module 113 . Thus, the determination module 113 may determine the initial identifier of the first subscriber, but not determine the identifier of the second subscriber. While the determination module 112 will determine the surrogate identifier of the first subscriber and the original identifier of the second subscriber. As a result, the determination module 112 will receive from the determination module 113 also the initial identifier of the first subscriber as call parameters.

The unwanted call may occur using a large number of intermediate gateways, such as gateway 111-2 on the carrier's server 110 and gateway 111-3 not located on the carrier's server 110 but also connected to network 120 . Attackers use complex schemes to hide their fraudulent activities and to spoof their identity (for example, phone number). As an example, consider a phone call made using the device of the first subscriber 130 (which is unwanted) to the device of the second subscriber 140 (which is the victim). In the traffic in the call parameters, the initial phone number of the first subscriber is indicated as the caller's number, and a certain third identifier is indicated as the called subscriber's number - the IP address of the fraudulent gateway 111-3 . In this case, the gateway 111 forwards the call traffic to the rogue gateway 111-3 because considers it to be the called subscriber. Gateway 111-3 is fraudulent and contains a list with a large number of fake phone numbers used for fraudulent calls. Next, the gateway 111-3 selects one of the spoof numbers and makes a call, where the selected spoof phone number is indicated as the calling number, and the phone number of the second victim subscriber is indicated as the called number. The traffic of the specified call returns through the gateway 111 of the server of the service provider 110 and then goes to the device of the second subscriber 140 . In this case, the device of the second subscriber 140 will indicate the replacement phone number as the called subscriber number, and not the original number of the first subscriber. And in the outgoing traffic intercepted by the detection module 112 , the caller ID will contain the IP address of the fraudulent gateway 111-3 .

It is worth noting that the fraudulent scheme may contain a large number of intermediate gateways, such as the 111-3 gateway or the 111-2 gateway. Moreover, these gateways can be physically located on different remote servers, in different states, use different protocols (SIP, VPN, proxy) to spoof numbers and hide fraudulent activities. Therefore, technologies that check calling phone numbers against "black lists" of phone numbers of intruders will not always allow you to identify unwanted and fraudulent calls. That is why the present invention was developed, using all intercepted traffic to analyze the parameters of the call and identify fraudulent calls and, more broadly, all unwanted calls. It is worth noting that the traffic intercepted by the detection module 112 contains the real identifier of the first subscriber - in this example, the IP address of the gateway 111-3 , while the fake phone number is not contained in the mentioned traffic. In one particular implementation, the determination module 112 may request the specified alias phone number from the provider's security agent 114 . In this case, the security agent of the provider 114 is a technical tool implemented with the ability to execute on the processor of the device (for example, the server) of the communication provider 110 and designed to protect the data of the protected subscriber, which is stored on the server of the communication provider 110 , taking into account the parameters of an unwanted call. In another particular implementation, the determination module 112 can obtain the specified proxy phone number from the determination module 113 if the specified determination module 113 has inserted a given data packet into the intercepted traffic, allowing you to match the calls intercepted by both determination modules 112 and 113 .

For definiteness, the preferred implementation uses a single determination module 112 intercepting the outgoing traffic of the gateway 111 . The determination module 112 , as well as the determination module 113 , are executable on the processor 21 of the computing device 20 (see FIG. 5 ). That is, in different implementations, the determination module 112 and the determination module 113 are either separate computing devices 20 or virtual machines running on the processor 21 of the computing device 20 . In a second example, execution module 112 and execution module 113 may be implemented as two different virtual machines running on the processor 21 of one computing device 20 or two different computing devices.

The determination module 112 is also designed to perform a preliminary analysis of the call parameters, based on the results of which it determines the first value of the probability of determining the call as unwanted. In the event that said first probability value exceeds the first threshold value, additional parameters of said call are determined using the determination module 112 by analyzing the streaming data of the call. In this case, the additional call parameters include, in particular, information about at least one data operator (for example, the identifier or name of the data operator), the server of which stores the data of at least one of the subscribers.

In a particular implementation, streaming data is analyzed:

using speech recognition methods in an audio stream with subsequent conversion to text if the stream data includes an audio stream;

using image recognition methods in the video stream and subsequent conversion to text if the stream data includes a video stream;

using at least one of the following text analysis methods: text mining, semantic text analysis, text parsing, wherein said text is extracted from streaming data.

The determination module 112 is used to re-analyze the parameters of the call, taking into account additional parameters, the results of which determine the second value of the probability of determining the call as unwanted. In the event that said second probability value exceeds the second threshold value, the determination module 112 determines (deems) the call as unwanted, and also determines the subscriber who makes the unwanted call (hereinafter referred to as the unwanted caller) and the subscriber whose data is subject to protection in case of an unwanted call (hereinafter - protected subscriber). Identification of an unwanted subscriber and a protected subscriber can be carried out by subscriber identifiers present in the call parameters. At the same time, the definition module 112 supplements the call parameters with labels about the unwanted subscriber and the protected subscriber, as well as information that the call is defined as unwanted.

In another particular implementation, the determination module 112 also requests additional call parameters, in particular, from the application 141 on the device of the protected subscriber 140 . Application 141 is implemented to run on the processor of device 140 . Such additional parameters may include device data of the protected subscriber 140 and activity data of the protected subscriber, in particular:

interaction of the device 140 with other devices of the network 120 ;

access to the resources of the device 140 (memory, processor, etc.);

a list of resources to which access is provided;

characteristics of the device 140 (for example, type and version of the installed OS, installed software (SW), hardware characteristics of the device - used processor, memory, etc.);

data transfer;

type of transmitted data (for example, commands, raw data, encrypted data, etc.);

events of the antivirus 143 (protection tool) installed on the device 140 and associated with the application 141 . Events of the antivirus 143 include, for example, the following: detection of a malicious file, disabling self-defense, failed update attempt, and other events of the antivirus and antivirus modules 143 (see Fig.3 );

subscriber activity type.

In this case, the subscriber's activity type can be one of the following:

being in a certain location (according to the coordinates of the device);

vehicle control;

interacting with at least one of the user's devices;

interaction with new devices.

In this invention, the activity of the subscriber is understood, in particular, as the movement of the subscriber (change of location), the interaction of the subscriber with devices, the interaction of the subscriber with services (for example, interaction with the email application on the subscriber's device), the interaction of devices or services of the subscriber with each other (for example, installation of a new application on the device, data exchange between two or more devices of the subscriber).

The mentioned additional parameters of the call, in particular data on the activity of the protected subscriber and his location, may indicate that the protected subscriber during an unwanted call, after the end of an unwanted call, or in the period between several unwanted calls from one unwanted subscriber, is subjected to fraudulent actions. For example, if the location of a protected subscriber has changed to a location located near a bank or ATM, this may indicate a threat to the bank card data of the protected subscriber. After all, the attacker could force the protected subscriber to withdraw money or transfer money using the attacker's card number. Therefore, the use of such additional call parameters will allow you to identify an unwanted call and improve the protection of the data of the protected subscriber.

The definition module 112 is also designed to transfer all the parameters of the mentioned call (that is, taking into account additional parameters) determined to be unwanted, at least one of: the application 141 on the device 140 of at least the protected subscriber, the security agent of at least one mentioned data operator 151 to the data operator's server 150 , to the security agent 114 on the server of the communication provider 110 , while the specified application 141 and security agents 151 , 114 protect the data of the protected subscriber, respectively, on the user's device 140 , on the server of the data operator 150 , on the server of the communication provider 110 , taking into account unwanted call settings. In this case, in a particular implementation, the data of the protected subscriber stored on at least one of the mentioned devices (on the user's device 140 , on the server of the data operator 150 , on the server of the communication provider 110 ) can be identified in accordance with the identifier of the protected subscriber. Security agent 151 is a technical tool implemented with the ability to execute on the processor of the data operator server 150 and designed to protect the data of the protected subscriber, which is stored on the data operator server 150 , taking into account the parameters of an unwanted call. At the same time, the determination module 112 determines that the data operator 150 and, accordingly, the data operator security agent 151 serve to protect the data of the protected subscriber according to the information about the data operator contained in the additional parameters of the call (for example, the name or identifier of the data operator). In addition, a list of possible data statements may be held in advance by the definition module 112 . Therefore, if the identifier of one or more data operators is present in the information about the data operator for the protected subscriber, then the determination module 112 will transfer the parameters of the call determined as unwanted to the security agents 151 only those data operators 150 that correspond to the protected subscriber and information about them is present in additional call options.

In another particular implementation, the determination module 112 also requests additional call parameters, in particular, from the application 131 of the device of the unwanted subscriber 130 , if the application 131 is installed on the device of the unwanted subscriber 130 , implemented with the possibility of execution on the processor of the said device 130 . Such additional parameters may include unwanted subscriber device data 130 and unwanted subscriber activity data similar to the protected subscriber activity data mentioned earlier. Thus, unwanted caller activity data includes:

interaction of the device 130 with other devices of the network 120 ;

access to device resources 130 ;

a list of resources to which access is provided;

device characteristics 130 ;

data transfer;

type of transmitted data;

events of the antivirus 133 (protection tool) installed on the device 130 and associated with the application 131 (see Fig. 3 );

subscriber activity type.

Figure 2 shows an implementation of the definition modules 112 and 113 . The means of the definition module 112 (as well as the definition module 113 ) are designed to perform the functionality of the definition module 112 described earlier in FIG. 1 , as well as to perform the functionality that will be described later. Thus, the traffic interceptor 221 serves to intercept gateway traffic 111 containing call parameters and call streaming data and store the call parameters and streaming data in a call database 225 contained in a machine-readable medium, such as ROM 24 . The interceptor 221 can be connected via a network interface to the gateway 111 , for example, to the SPAN port of the gateway 111 .

In addition, the intercepted traffic related to said call can be stored in the call database 225 . The analyzer 222 serves to perform a preliminary analysis of the parameters of the call from the database of calls 225 , according to the results of which the analyzer 222 determines the first value of the probability of determining the call as unwanted. In addition, the analyzer 222 also serves to determine additional parameters of said call in the event that said first probability value exceeds the first threshold value, by analyzing the streaming data of the call, where the additional parameters include, in particular, information about at least one data operator, which is associated with at least one subscriber, that is, which performs the functions of storing and processing data of the specified subscriber. At the same time, the analysis tool 222 stores additional call parameters in the call database 225 .

The analyzer 222 also serves to reanalyze the parameters of the call considering the additional parameters and to determine a second probability value for determining the call as unwanted from the results of the reanalysis. The analyzer 222 is also designed to determine if said second probability value exceeds the second threshold value, the call is unwanted, the unwanted caller, and the protected caller. Certain information is also stored in the call database 225 . The transmission means 223 serves to transfer the parameters of said call, determined to be unwanted, from the call database 225 to the application 141 on the device of the protected subscriber 140 , the security agent 151 of at least one mentioned data operator, the security agent 114 on the server of the communication provider 110 over the network 120 or directly. However, if the call was not determined to be unwanted (the second probability value is below the second threshold), the analyzer 225 may wait for the call parameters and call streaming data to be updated. And when the specified data is updated (for example, new call streaming data, new call parameters, etc.) the analyzer 225 will again perform a preliminary analysis and re-analysis of the call parameters taking into account the updated data.

In a particular implementation, using the analysis tool 222 of the definition module 112 , information about the data operator associated with at least one subscriber is determined by matching the selected keywords, phrases and tokens from the call stream data with a predefined list of keywords, phrases and tokens, which are associated with a predefined list of data statements. For example, the following keywords and phrases were highlighted: "bank", "bank card", "bank A". At the same time, the list of data operators contains a data operator named "bank A", and the keyword "bank A" is associated with it in the list of keywords. Therefore, the determining module will determine the information about the data operator associated with the subscriber, namely the name "bank A".

At the same time, if the streaming data contains an audio stream, then the analysis of the streaming data (audio stream) includes the use of speech recognition methods to extract text from speech in the audio stream and subsequent text analysis to extract the mentioned keywords, phrases and lexemes.

In a particular implementation, if the streaming data includes a video stream, then the analysis of the streaming data (video stream) includes the extraction of keywords, phrases and tokens from the video traffic stream using pattern recognition methods. In this case, sign language recognition or lip movement recognition of subscribers in the video stream will be performed, that is, speech recognition by lips and conversion to text. In addition, optical character recognition (OCR) methods can be used if there is text data in the video stream, for example, the subscriber shows a sheet of paper containing text.

In another particular implementation, if the streaming data includes instant messages, then the analysis of streaming data (instant messages), as well as the analysis of text extracted from an audio stream or a video stream, includes text analysis methods with the selection of keywords, phrases and lexemes, such as: text mining, semantic text analysis, text parsing (also parsing, parsing, parsing), etc.

In yet another particular implementation, if the stream data includes an arbitrary format data stream, the content of the specified data stream can be analyzed for the presence of malicious content using an antivirus (see Fig.3 ) or the presence of keywords, phrases and tokens using methods text analysis.

In a particular implementation, the traffic interceptor 221 of the definition module 112 is additionally designed to communicate with at least one other computer device to determine an unwanted call (for example, the definition module 113 ) and is additionally designed to receive call parameters from the other device - the definition module 113 .

In one particular embodiment, the previously mentioned injection of a given data packet into the traffic is carried out using the traffic interceptor 221 of the determination module 113 . In this case, the subsequent determination of the embedded packet is also carried out by the traffic interceptor 221 belonging to the determination module 112 .

In another particular implementation, the traffic interceptor 221 is additionally designed to receive call parameters from the application 141 (or 131 ) installed on the subscriber's computer device 140 (or 130 , respectively).

In yet another particular implementation, the additional parameters include keywords, phrases, and tokens present in the stream data. In addition, additional parameters may include the sentiment of text extracted from streaming data (eg, an audio stream). At the same time, the tonality of the text (conversation) in a particular implementation is determined using the methods of analyzing the tonality of the text (sentiment analysis, English sentiment analysis, opinion mining) by analyzing the text extracted from the streaming data and consisting of the mentioned words, phrases and lexemes.

In a particular implementation, the call parameters preliminary analysis includes at least one of:

Signature analysis, in which, if the call parameters match the signature of an unwanted call, the first value of the probability of determining the call as unwanted is determined above the first threshold value. For example, the following signature can be used: the identifier of one of the subscribers is contained in the list of fraudulent identifiers.

Heuristic analysis, in which, if the call parameters coincide with the unwanted call heuristic, the first value of the probability of determining the call as unwanted is determined above the first threshold value.

An analysis using a trained machine learning model 227 to classify a call as unwanted/normal, wherein said model takes call parameters as input, and the result of applying said model is a first probability value for determining a call as unwanted and a first threshold value.

At the same time, the signature database 228 is stored on a computer-readable medium and contains the mentioned signatures and heuristics of unwanted calls.

In the case of using a trained machine learning model 227 , said model is stored on a computer readable medium and can be trained by the determination module 112 using the learning tool 226 .

In another particular implementation, the determination module 112 can be associated with a remote server 210 that is designed to update the signature database 228 with the remote signature database 218 , as well as to train the remote machine learning model 217 and update the machine learning model 227 using it. definition module 112 . Said update of the machine learning model 227 may be to replace the machine learning model 227 on the determination module 112 with the remote machine learning model 217 or to copy the parameter values of the deleted machine learning model 217 to the machine learning model 227 . In this case, the remote server 210 contains a remote call database 215 that includes records of the call database 225 of one or more definition modules 112 and 113 . In addition, the remote server 210 includes a remote training tool 216 for training and retraining the remote machine learning model 217 on the data from the remote call base 215 . For specificity, the following description will be given for training the machine learning model 227 using the learner 226 . However, the described embodiments also apply to training a remote model 217 with a remote trainer 216 on a remote server 210 .

Thus, the learning tool 226 serves to train and retrain the machine learning model according to the training sample from the call base 225 . The training sample includes feature values based on call parameters for the historical observation period (for example, a week, a month). It should be noted that retraining in this application refers to the retraining of the model 227 on new data or using new parameters of the model 227 . Also, retraining in this application refers to the retraining of the model 227 using the new model specification 227 , for example, changing the neural network to logistic regression for the machine learning model 227 . In a particular implementation, retraining of the model 227 occurs periodically, for example, once a month. In yet another implementation example, an online machine learning approach may be used in which data is made available in sequential order and is used to update model 227 parameters for future data at each step. That is, model 227 is retrained each time new data is received. This approach will better take into account changes in the behavior of attackers and victims of fraud.

The machine learning model 227 may be any machine learning model known in the art that can be applied to the disclosed invention. Following are a few possible machine learning models. However, the present invention is not limited to them, and other known models can be applied in the invention.

If the training sample contains a small number of examples with unwanted calls (that is, the number of examples with unwanted calls, for example, less than 10 or less than 1% of the total number of examples), then a machine learning model can be used on the assumption that the features of the training sample follow a Gaussian distribution. In this case, according to the data of the training sample, the sample means and sample variances for each feature will be estimated, after which the joint probability density of the distribution will be calculated. As a result, if the first value of the probability of determining the call as unwanted, estimated on the new data, turns out to be higher than the threshold (given distribution quantile), then the call will be defined as unwanted. In this case, the device of the subscriber, which is unwanted or protected, can be determined by the smallest value of the probability density for the signs of the call, related to the unwanted or, respectively, to the protected subscriber. In this case, the test and validation sets will contain a small number of examples with unwanted calls, sufficient to determine the quality of the model and then adjust the model parameters to maximize the quality. In addition, time series models such as ARIMA, ARIMAX, etc. can be used as a machine learning model 227 .

When the training set contains a large number of examples containing information about unwanted calls, then classification models can be used, such as logistic regression, neural networks, decision tree, decision forest, support vector machine, nearest neighbor method, etc. Such a machine learning model for classification will classify the call as unwanted/normal.

In a particular implementation, the machine learning model 227 contains a set of models, that is, an ensemble that makes a decision by averaging the results of individual models from the set. In yet another particular implementation, the neural network is optimized using genetic algorithms. In another particular implementation, the neural network is selected using one of the quality metrics, such as the NAB metric or the F1 metric.

In a particular implementation, the construction of the machine learning model 227 occurs as follows. First, a neural network architecture template is selected, for example: a multilayer perceptron, a convolutional neural network, a recurrent neural network, or others. Next, a description of the selected architecture is formed:

• optimizer and its parameters;

• initial values of weight coefficients and shifts;

• maximum number of layers;

• for each layer:

- a list of possible layer types, consisting of at least a subset of the following layers: Dense, Convolutional, GRU, LSTM, Dropout;

- activation function: linear, ReLU, Tanh, sigmoid, Softmax, etc.;

- possible layer size (number of neurons in the layer).

Then, the neural network architecture is optimized using the optimizer. In a particular implementation, the optimization of the neural network architecture is performed using genetic algorithms. A quality metric is also used to select the best architecture. In a particular implementation, a quality metric is used, for example: NAB-metric, F1-metric.

The determination module 112 additionally serves to receive feedback (for example, through a transmission means 223 ) from the application 141 of the device of the protected subscriber 140 , from the security agent of the data operator 151 or from the security agent of the provider 114 , confirming or denying an unwanted call, and this information is included in the training sample for additional training of the machine learning model 227 . Thus, additional training of model 227 allows to reduce errors of the first and second kind when determining an unwanted call.

In yet another particular implementation, reanalysis of call parameters includes at least one of:

Signature analysis, in which, if the call parameters match the second unwanted call signature, the second value of the probability of determining the call as unwanted is determined above the second threshold value.

Heuristic analysis, in which, if the call parameters coincide with the second unwanted call heuristic, the second value of the probability of determining the call as unwanted is determined above the second threshold value. For example, the following heuristic can be used: the product of the number of calls between certain subscribers (subscribers are identified by subscriber IDs) and the duration of calls in seconds in which at least three keywords are mentioned is greater than 1000. When this heuristic is executed (rules) will determine the second probability value call spam definition equal to 1, which is higher than the second threshold value (for example, 0.5). Otherwise, if said product is below 1000, the second value of the probability of determining the call as unwanted is determined to be 0, that is, below the second threshold value.

Analysis using a trained second machine learning model to classify a call as unwanted/normal, wherein said second model takes call parameters as input, and the result of applying said second model is a second value of the probability of determining a call as unwanted and a second threshold value.

It should be noted that particular implementations for the machine learning model 227 are also applicable to the second machine learning model, with the difference that the trained second machine learning model also takes additional call parameters as input, and the result of applying the mentioned second model is the second value of the call detection probability unwanted and a second threshold value. In this case, the learning tool 226 is further configured to train the second machine learning model. In addition, the second machine learning model can be trained on the remote server 210 via the remote learning tool 216 '.

Also in a particular implementation, signature database 228 is stored on a computer-readable medium and contains second unwanted call signatures and second unwanted call heuristics. The trained second machine learning model is also stored on a computer-readable medium.

In a private embodiment, using the application of the protected subscriber 141 , the data of the protected subscriber is protected on the device of the protected subscriber 140 , taking into account the parameters of an unwanted call, at least by:

notifications of a third-party application 142 installed on the device of the protected subscriber 140 about the definition of a call as unwanted (in this case, the parameter is taken into account - the mark of an unwanted call);

changes in the information security settings of the device of the protected subscriber 140 , on which the application 141 is installed (in this case, the parameter is taken into account - the mark of an unwanted call);

notification of the protected subscriber about the definition of the call as unwanted (in this case, the following parameters are taken into account - the mark of the unwanted call, the identifier of the unwanted subscriber);

terminating the current call and blocking subsequent incoming or outgoing calls with an unwanted subscriber (in this case, the parameters are taken into account - the mark of an unwanted call, the identifier of an unwanted subscriber, while the identifier of an unwanted subscriber will be checked for subsequent calls and in case of a call with an unwanted subscriber identifier, the incoming call will be blocked).

In a particular implementation, using at least one determination module 112 (by means of the transmission means 223 ), the parameters of said call, determined as unwanted, are transmitted to the application of the unwanted subscriber 131 .

In another particular embodiment, using the application of an unwanted subscriber 131 , the protected subscriber's data is protected on the device of an unwanted subscriber 130 , taking into account the parameters of an unwanted call, at least by:

notification of a third-party application 132 installed on the device of an unwanted subscriber 130 about the definition of a call as unwanted;

changing the information security settings of the unwanted subscriber's device 130 on which the application 131 is installed;

notifying the application of the protected subscriber 141 about the definition of the call as unwanted;

terminating the current call and blocking subsequent incoming or outgoing calls with the protected subscriber, which is determined by the identifier of the protected subscriber, which is present among the unwanted call parameters.

In a particular implementation, changing the information security settings of devices 130 and 140 includes one or more of the following:

implementation of an anti-virus scan using up-to-date antivirus databases 133 or 143 respectively;

changing network settings;

limitation of device functionality;

limiting the interaction of the device with other devices;

restricting access to device resources;

enable multi-factor authentication;

updating the protection tool on the device;

receiving feedback on the results of the actions described above.

In another private embodiment, antiviruses 133 or 143 additionally serve to change the information security settings of other subscriber devices, for example, those containing data that are subject to protection. For example, determiner 112 has determined device subscriber 130 to be unwanted and device subscriber 140 to be protected. Also, the determination tool 112 determined the data operator - the bank based on the results of the analysis of additional call parameters. For example, an unwanted subscriber introduced himself on behalf of the said bank or demanded to give the details of a bank card issued by the said bank. In this example, the bank data of the protected subscriber in the mentioned bank will be defined as the data to be protected. If a third-party application 142 is installed on the device of the protected subscriber 140 , which is the Internet bank of a certain bank, then using the application 141 of the protected subscriber, the subscriber's data can be protected taking into account the parameters of an unwanted call, for example, by notifying the application 142 , which in turn will execute blocking bank cards, enhancing the protection of bank card data, enabling multi-factor authentication for transactions with bank cards, etc. In addition, if the protected subscriber has other devices (for example, a computer, telephone, etc.) that store protected data (data bank cards), the application 141 will notify the specified devices about the detection of an unwanted call. Data protection will also be implemented on these additional devices.

In a private implementation, using the security agent of the data operator 151 , the data of the protected subscriber is protected on the server of the data operator 150 , taking into account the parameters of an unwanted call in at least one of the following ways:

restricting access to data of the protected subscriber, while the protected subscriber is determined from the parameters of an unwanted call by the identifier of the protected subscriber;

additional protection of access to data of the protected subscriber;

cancellation of previously granted access to the data of the protected subscriber.

In another private implementation, using the security agent 114 on the server of the communication provider 110 , the data of the protected subscriber is protected, taking into account the parameters of an unwanted call in one of the following ways:

termination of an unwanted call (for example, disconnection of the port of the communication channel through which the call traffic is transmitted, or network break), while using the parameters of the unwanted call (for example, subscriber IDs) to establish a communication channel through which the call traffic is transmitted;

notification of the protected subscriber about the definition of the call as unwanted, while the protected subscriber is determined from the parameters of the unwanted call by the identifier of the protected subscriber;

terminating the current call and blocking subsequent incoming or outgoing calls with an unwanted subscriber, while the unwanted subscriber is determined from the unwanted call parameters by the identifier of the unwanted subscriber;

notification of law enforcement agencies (also, for example, authorized bodies, banking regulator) about an unwanted call and an unwanted subscriber.

In a particular embodiment, the parameters of said call additionally include the context of the call, in particular: the number of previous calls between the mentioned subscribers, the parameters of the mentioned previous calls.

In another particular embodiment, the call parameters additionally include the device context of the subscriber 130 or 140 respectively, on which the application 131 or application 141 respectively is installed, while additionally receiving said device context from the application of at least one subscriber, where the device context includes:

data from device sensors;

device interaction with other network devices 120 ;

access to device resources;

a list of resources to which access is provided;

device characteristics;

data transfer;

type of transmitted data;

antivirus events;

device security events;

information about interaction with payment services and applications.

In a particular implementation, the determination module 112 further comprises an administration tool 229 for providing feedback from the administrator that can be used in pre-analysis and re-analysis, for example by adjusting call parameters. For example, using feedback, calls in the training sample can be marked as unwanted/normal. In another particular implementation, the administration tool 229 is used to configure the signatures, heuristics, and parameters of the machine learning model. Similarly, the remote server 210 may include a remote administration tool 219 to perform functionality on the remote server 210 similar to that of the administration tool 229 '.

On FIG. 3 shows an exemplary protection module 133 and 143 of devices 130 and 140 , respectively. The protection tool (antivirus or other protection tool) of the device may contain modules designed to ensure the security of the device: on-access scanner, on-demand scanner, mail antivirus, web antivirus, proactive protection module, HIPS module (Eng. Host Intrusion Prevention System - system intrusion prevention), DLP module (data loss prevention), vulnerability scanner, emulator, firewall, etc. In a private implementation, these modules can be an integral part of the protection tool. In yet another embodiment, these modules may be implemented as separate software components.

The on-access scanner contains the functionality of detecting malicious activity of all opened, launched and saved files on the user's computer system. An on-demand scanner differs from an on-access scanner in that it scans user-specified files and directories at the user's request.

An email antivirus is required to monitor incoming and outgoing e-mail for malicious content. Web anti-virus is used to prevent the execution of malicious code that may be contained on websites visited by the user, as well as to block the opening of websites. The HIPS module is used to detect unwanted and malicious program activity and block it at the time of execution. The DLP module is used to detect and prevent leakage of confidential data outside the computer or network. A vulnerability scanner is required to detect vulnerabilities on the device (for example, some components of the protection tool are disabled, virus databases are out of date, a network port is open, etc.). The firewall monitors and filters network traffic in accordance with the specified rules. The emulator's job is to simulate a guest system while executing file instructions in the emulator, and will be discussed in more detail later. The proactive defense module uses behavioral signatures to determine the behavior of applications and classify them by trust level.

On FIG. 4 shows a method for protecting subscriber data in case of an unwanted call. Thus, in step 410 , using the determination module 112 connected to the gateway 111 on the server of the service provider 110 , traffic containing call parameters and call streaming data is intercepted. Next, at step 420, using the determination module 112 , a preliminary analysis of the call parameters is performed, the results of which determine the first value of the probability of determining the call as unwanted. If said first probability value exceeds the first threshold value, at step 430 , using determination module 112 , additional parameters of said call are determined by analyzing streaming data of the call, in particular information about the data operator (for example, name, identifier) associated with at least by one subscriber. At step 440 , using the determination module 112 , the call parameters are reanalyzed, taking into account additional parameters, the results of which determine the second value of the probability of calling unwanted. If said second probability value exceeds the second threshold value, at step 450 the call is determined as unwanted, furthermore, the subscriber who makes the unwanted call and the subscriber whose data is to be protected are determined. At the same time, the call parameters are supplemented with labels about the unwanted subscriber and the protected subscriber, as well as information that the call is defined as unwanted. The label about the unwanted subscriber will be assigned to the identifier of the subscriber recognized as unwanted, and the label about the protected subscriber will be assigned to the identifier of the subscriber recognized as protected. Thus, by the specified label, it will be possible to unambiguously determine which subscriber identifier defines an unwanted subscriber, and which one defines a protected subscriber. As a result, at step 460, using at least one determination module 112 , all parameters (that is, taking into account additional parameters) of the mentioned call, determined as unwanted, are transmitted to at least one of: application 141 on the device of the protected subscriber 140 , security agent 151 at least one mentioned data operator (according to the information about the data operator in the additional parameters of the call), the security agent of the communication provider 114 , while these applications and security agents protect the data of the protected subscriber, taking into account the parameters of an unwanted call.

It is worth noting that the particular implementations mentioned for FIG. 1-3 are also applicable to the method of FIG. 4 . Thus, the claimed invention allows solving the claimed technical problem and achieving the indicated technical results. So, the reduction of errors of the first kind is achieved by increasing the level of detection of unwanted calls, which was mentioned earlier. Type II error reduction is achieved through the use of pre-analysis and re-analysis of the call parameters, thus reducing the likelihood of a normal call being identified as unwanted.

Increased protection of subscriber data in case of an unwanted call is achieved by protecting the data of the protected subscriber by the application 141 on the device of the protected subscriber 140 , the security agent 151 of at least one data operator 150 and the security agent 114 on the server of the communication provider 110 after determining the call as unwanted.

Also, by increasing the level of detection of unwanted calls, the stated technical problem is solved.

It is worth noting that the present invention can analyze both the traffic of the current call and the traffic of the completed call. That is, even the analysis of the completed call and the definition of this call as unwanted will protect the data of the protected subscriber. After all, a threat to data can arise both during the call and after it is completed - for example, when the protected subscriber, after the end of the call, attempts to transfer funds to the attacker using the details received during the call. In this case, the application 141 on the device of the protected subscriber 140 can inform the determination module 112 about the change in the device context of the protected subscriber 140. And the determination module 112 will reanalyze the call taking into account the updated call parameters. In this case, re-analysis of the call will determine it as unwanted, which will protect the subscriber's data, for example, by blocking the specified transfer by application 141 or security agent 151 on the server of the data operator 150 (in this example, the bank). Thus, the call can be analyzed several times when the call parameters change or when new streaming data is received. Therefore, even if there was not enough data at the time of the call to determine the specified call as unwanted, after changing the context of the call, it may eventually be determined as unwanted.

Thus, in both cases, technical results will be achieved - errors of the first and second kind when determining unwanted calls are reduced and the level of protection of subscriber data in case of an unwanted call is increased. The stated technical problem will also be solved.

Fig. 5 shows an example of a general purpose computer system, a personal computer or a server 20 ', comprising a central processing unit 21 ', system memory 22 ', and a system bus 23 ', which contains various system components including memory associated with the central processing unit 21 '. The system bus 23 is implemented as any bus structure known in the art, in turn comprising a bus memory or bus memory controller, a peripheral bus, and a local bus capable of interfacing with any other bus architecture. The system memory contains read-only memory (ROM) 24 , random access memory (RAM) 25 . The main input/output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between the elements of a personal computer 20 , for example, at the time of booting the operating system using ROM 24 .

The personal computer 20 in turn comprises a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29 and an optical drive 30 for reading and writing to removable optical disks 31 such as CD-ROM, DVD -ROM and other optical storage media. The hard disk 27 , the magnetic disk drive 28 , the optical drive 30 are connected to the system bus 23 via the hard disk interface 32 , the magnetic disk interface 33 , and the optical drive interface 34 , respectively. Drives and related computer storage media are non-volatile means of storing computer instructions, data structures, program modules, and other personal computer data 20 .

The present description discloses an implementation of a system that uses a hard disk 27 ', a removable magnetic disk 29 ', and a removable optical disk 31 ', but it should be understood that other types of computer storage media 56 that are capable of storing data in a computer-readable form (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.), which are connected to the system bus 23 through the controller 55 .

The computer 20 has a file system 36 that stores the recorded operating system 35 as well as additional software applications 37 , other program modules 38 and program data 39 . The user has the ability to enter commands and information into the personal computer 20 through input devices (keyboard 40 , mouse 42 ). Other input devices (not shown) may be used: microphone, joystick, game console, scanner, etc. Such input devices are normally connected to the computer system 20 through a serial port 46 , which in turn is connected to the system bus, but may be connected in other ways, such as through a parallel port, game port, or universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48 '. In addition to the monitor 47 , the personal computer may be equipped with other peripheral output devices (not shown), such as speakers, a printer, and the like.

The personal computer 20 is capable of operating in a networked environment using a network connection to another or more remote computers 49 . The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the nature of the personal computer 20 shown in FIG. 5 . Other devices may also be present in the computer network, such as routers, network stations, peer-to-peer devices, or other network nodes.

The network connections may form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks (also information systems), internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local network 50 via a network adapter or network interface 51 . When using networks, personal computer 20 may use a modem 54 or other means to communicate with a wide area network, such as the Internet. The modem 54 , which is an internal or external device, is connected to the system bus 23 via the serial port 46 . It should be clarified that network connections are only indicative and are not required to represent the exact network configuration, i.e. in fact, there are other ways to establish a connection by technical means of communication from one computer to another.

As described, the components, execution steps, data structure described above can be executed using various types of operating systems, computer platforms, programs.

In conclusion, it should be noted that the information given in the description are examples that do not limit the scope of the present invention defined by the formula.

Claims (110)

1. A method for protecting subscriber data in case of an unwanted call, implemented by a computer device using a definition module associated with a gateway on a communication provider's server, in which: a) intercepting traffic, including call parameters and call streaming data, wherein the call parameters include subscriber identifiers; b) perform a preliminary analysis of the parameters of the call, the results of which determine the first value of the probability of determining the call as unwanted; c) if the first probability value exceeds the first threshold value, additional call parameters are determined by analyzing the streaming data of the call, where the additional parameters include information about the data operator associated with at least one subscriber, where the information about the data operator includes, in particular, one of: name, identifier; d) perform re-analysis of the call parameters, taking into account additional parameters, the results of which determine the second value of the probability of determining the call as unwanted; e) if the mentioned second probability value exceeds the second threshold value, the call is recognized as unwanted, in addition, the subscriber who makes the unwanted call (hereinafter referred to as the unwanted caller) and the subscriber whose data are subject to protection in case of an unwanted call (hereinafter referred to as the protected subscriber) are determined , while supplementing the call parameters with labels about the unwanted subscriber and the protected subscriber, as well as information that the call is defined as unwanted; f) transmitting all the parameters of the call, determined to be unwanted, to at least one of: the application on the device of the protected subscriber, the security agent of at least one mentioned data operator, the security agent on the server of the communication provider, while the specified application and security agents protect the data of the protected subscriber subscriber, respectively, on the user's device, on the server of the data operator, on the server of the communication provider. 2. The method of claim 1, wherein the call stream data is at least one of an audio stream, a video stream, an audiovisual stream, an instant messaging stream, a freeform data stream. 3. The method according to p. 2, in which the analysis of streaming data is performed: a) using speech recognition methods in an audio stream with subsequent conversion to text, if the stream data includes an audio stream; b) using image recognition methods in the video stream and subsequent conversion to text, if the stream data includes a video stream; c) using at least one of the following text analysis methods: text mining, semantic text analysis, text parsing, wherein said text is extracted from streaming data. 4. The method of claim. 1, in which the analysis of streaming call data includes extracting keywords, phrases and tokens to determine information about the data operator associated with at least one subscriber by matching the extracted keywords, phrases and tokens with known keywords , phrases and tokens associated with information about the mentioned data operator. 5. The method according to p. 1, in which additional parameters also include at least one of: keywords, phrases, tokens present in the streaming data; sentiment of text extracted from streaming data. 6. The method according to claim 1, in which the preliminary analysis of the parameters of the call includes at least one of: • signature analysis, in which, if the call parameters match the signature of an unwanted call, the first value of the probability of determining the call as unwanted is determined above the first threshold value; • heuristic analysis, in which, if the call parameters coincide with the unwanted call heuristic, the first value of the probability of determining the call as unwanted is higher than the first threshold value; • analysis using a trained machine learning model to classify a call as unwanted/usual, while said model takes call parameters as input, and the result of applying said model is the first value of the probability of determining the call as unwanted and the first threshold value. 7. The method according to claim 1, in which the reanalysis of the parameters of the call, taking into account additional parameters, includes at least one of: • signature analysis, in which, if the call parameters and additional parameters match with the second unwanted call signature, the second value of the probability of determining the call as unwanted is determined above the second threshold value; • heuristic analysis, in which, if the call parameters and additional parameters coincide with the second unwanted call heuristic, the second value of the probability of determining the call as unwanted is higher than the second threshold value; • analysis using a trained second machine learning model to classify a call as unwanted/usual, while said second model takes call parameters and additional parameters as input, and the result of applying said second model is a second value of the probability of determining a call as unwanted and a second threshold value. 8. The method according to claim 1, in which, using the application of the protected subscriber, the data of the protected subscriber is protected on the device of the protected subscriber, at least by: • changing the information security settings of the device of the protected subscriber on which the application is installed; • end the current call and block subsequent incoming or outgoing calls with an unwanted party. 9. The method of claim 1, wherein all parameters of said call determined to be unwanted are passed to the unwanted caller application. 10. The method according to claim 9, wherein using the application of the unwanted subscriber, the data of the protected subscriber is protected on the device of the unwanted subscriber, at least by: • changing the information security settings of the unwanted subscriber's device on which the application is installed; • end the current call and block subsequent incoming or outgoing calls with the protected subscriber. 11. The method according to claim 1, in which, using the data operator's security agent, the protected subscriber's data is protected on the data operator's server in at least one of the following ways: • restriction of access to data of the protected subscriber; • additional protection of access to the protected subscriber's data; • cancellation of previously granted access to the protected subscriber's data. 12. The method according to claim 1, in which, using a security agent on the server of the communication provider, the data of the protected subscriber is protected on the server of the communication provider in one of the following ways: • termination of an unwanted call; • Ending the current call and blocking subsequent incoming or outgoing calls with an unwanted party. 13. The method according to p. 1, in which the parameters of the call further include at least one of: the start time of the call; information about the data transfer protocol used during the call; call duration; end time for the completed call. 14. The method according to claim. 1, in which the parameters of the call further include the context of the call, in particular: the number of previous calls between said subscribers, the parameters of said previous calls. 15. The method according to claim 1, wherein the call parameters further include a device context of the subscriber on which the application is installed, wherein in step c), said device context is additionally obtained from the application of at least one subscriber, where the device context includes: • data from device sensors; • device interaction with other network devices; • connection of new devices to the user's device network; • number of new devices connected to the user's device network; • access to device resources; • list of resources to which access is carried out; • characteristics of the device; • data transmission; • type of transmitted data; • antivirus events; • device security events; • information about interaction with payment services and applications. 16. The method according to claim. 1, in which in the preliminary analysis and in the re-analysis, the call parameters are adjusted by interacting with the administrator of the determination module. 17. A system for protecting subscriber data in case of an unwanted call, comprising: a) at least one determination module, implemented with the possibility of execution on the processor of the computer device and associated with the gateway on the server of the communication provider, while intended for: • interception of traffic, including call parameters and call streaming data, while call parameters include call subscriber identifiers; • performing a preliminary analysis of the call parameters, the results of which determine the first value of the probability of determining the call as unwanted; • determining additional call parameters by analyzing streaming call data in case the first probability value exceeds the first threshold value, where the additional parameters include information about the data operator associated with at least one subscriber, where the information about the data operator includes, in particular, one from: name, identifier; • re-analysis of call parameters taking into account additional parameters; • determination of the second value of the probability of determining the call as unwanted based on the results of the reanalysis; • determining if the second probability value exceeds the second threshold value, the call is unwanted, as well as determining the subscriber who makes the unwanted call (hereinafter referred to as the unwanted caller) and the subscriber whose data is subject to protection in case of an unwanted call (hereinafter referred to as the protected subscriber); • addition of call parameters with labels about the unwanted subscriber and the protected subscriber, as well as information that the call is defined as unwanted; • transferring parameters of a call defined as unwanted to at least one of: an application on the protected subscriber's device, a security agent on the server of at least one data operator, a communication provider's security agent; b) an application implemented with the possibility of execution on the processor of the device of at least the protected subscriber, designed to protect the data of the protected subscriber on the device of the protected subscriber; c) a data operator security agent implemented with the possibility of executing at least one data operator on the server processor, designed to protect the data of the protected subscriber on the data operator server; d) security agent of the communication provider, implemented with the possibility of execution on the processor of the server of the communication provider, designed to protect the data of the protected subscriber on the server of the communication provider. 18. The system of claim 17, wherein the streaming call data is at least one of an audio stream, a video stream, an audiovisual stream, an instant messaging stream. 19. The system according to claim 18, in which the determination module serves to analyze streaming data in at least one of the ways: a) using speech recognition methods in an audio stream with subsequent conversion to text, if the stream data includes an audio stream; b) using image recognition methods in the video stream and subsequent conversion to text, if the stream data includes a video stream; c) using at least one of the following text analysis methods: text mining, semantic text analysis, text parsing, wherein said text is extracted from streaming data. 20. The system of claim. 17, in which the analysis of streaming call data includes extracting keywords, phrases and tokens to determine information about the data operator associated with at least one subscriber by matching the extracted keywords, phrases and tokens with known keywords , phrases and tokens associated with information about the mentioned data operator. 21. The system according to claim 17, in which the additional parameters also include at least one of: keywords, phrases, tokens present in the streaming data; sentiment of text extracted from streaming data. 22. The system according to claim 17, in which the preliminary analysis of the parameters of the call includes at least one of: • signature analysis, in which, if the call parameters match the signature of an unwanted call, the first value of the probability of determining the call as unwanted is determined above the first threshold value; • heuristic analysis, in which, if the call parameters coincide with the unwanted call heuristic, the first value of the probability of determining the call as unwanted is higher than the first threshold value; • analysis using a trained machine learning model to classify a call as unwanted/usual, while said model takes call parameters as input, and the result of applying said model is the first value of the probability of determining the call as unwanted and the first threshold value. 23. The system according to claim 17, in which the reanalysis of the parameters of the call, taking into account additional parameters, includes at least one of: • signature analysis, in which, if the call parameters and additional parameters match with the second unwanted call signature, the second value of the probability of determining the call as unwanted is determined above the second threshold value; • heuristic analysis, in which, if the call parameters and additional parameters coincide with the second unwanted call heuristic, the second value of the probability of determining the call as unwanted is higher than the second threshold value; • analysis using a trained second machine learning model to classify a call as unwanted/usual, while said second model takes call parameters and additional parameters as input, and the result of applying said second model is a second value of the probability of determining a call as unwanted and a second threshold value. 24. The system according to claim 17, in which the application of the protected subscriber is designed to protect the data of the protected subscriber on the device of the protected subscriber, at least by: • changing the information security settings of the device of the protected subscriber on which the application is installed; • end the current call and block subsequent incoming or outgoing calls with an unwanted party. 25. The system of claim. 17, in which the definition module is used to transfer all the parameters of the said call, determined unwanted, the unwanted caller application. 26. The system of claim 25, wherein the unwanted subscriber application serves to protect protected subscriber data on the unwanted subscriber's device by at least: • changing the information security settings of the unwanted subscriber's device on which the application is installed; • end the current call and block subsequent incoming or outgoing calls with the protected subscriber. 27. The system according to claim 17, in which the data operator's security agent serves to protect the data of the protected subscriber on the data operator's server in at least one of the following ways: • restriction of access to data of the protected subscriber; • additional protection of access to the protected subscriber's data; • cancellation of previously granted access to the protected subscriber's data. 28. The system according to claim 17, in which the security agent on the server of the communication provider serves to protect the data of the protected subscriber on the server of the communication provider in one of the following ways: • termination of an unwanted call; • Ending the current call and blocking subsequent incoming or outgoing calls with an unwanted party. 29. The system according to claim 17, in which the parameters of the call further include at least one of: the start time of the call; information about the data transfer protocol used during the call; call duration; end time for the completed call. 30. The system according to claim 17, in which the call parameters additionally include the call context, in particular: the number of previous calls between said subscribers, the parameters of said previous calls. 31. The system of claim 17, wherein the call parameters further include a device context of the subscriber on which the application is installed, wherein said device context is additionally obtained from the application of at least one subscriber, where the device context includes: • data from device sensors; • device interaction with other network devices; • connection of new devices to the user's device network; • number of new devices connected to the user's device network; • access to device resources; • list of resources to which access is carried out; • characteristics of the device; • data transmission; • type of transmitted data; • antivirus events; • device security events; • information about interaction with payment services and applications. 32. The system according to claim 17, in which, in the preliminary analysis and in the re-analysis, the call parameters are adjusted by interacting with the administrator of the determination module.

Images