WO2005018152A1

WO2005018152A1 - A system and method of intelligently monitoring the message centers

Info

Publication number: WO2005018152A1
Application number: PCT/CN2004/000486
Authority: WO
Inventors: Kai Fu; Zhigui Yuan
Original assignee: Zte Corporation
Priority date: 2003-08-15
Filing date: 2004-05-14
Publication date: 2005-02-24
Also published as: CN1314293C; CN1582038A

Abstract

This invention provides a system of intelligently monitoring message centers, includes a service processor, a monitor server and a monitor administration station, the service processor sends message which need to be monitored, the monitor server processes the message which need to be monitored depends on monitor parameters sent by the monitor administration station, output the user blacklist table produced to the service processor, service processor controls the processing of the message service depends on the user blacklist ; this invention can automatically capture the doubtful objects, and set them as blacklist users, the service processor cutoffs all message sources from this user; at the same time delete the users which meet unrestricted condition from the blacklist table , and immediately stop restricting the corresponding message sources . Furthermore, this invention can modify monitor configure parameters in time, and can be applied to the monitoring of all kinds of short message, multimedia message centers and mail center etc.

Description

System and method for intelligently monitoring message center

The present invention relates to the technical field of monitoring message centers in communication systems, and in particular, to a system and method for intelligently monitoring short message centers, multimedia message centers, mail centers, etc. of CDMA communication systems, GSM communication systems, and wireless local telephone systems.

Background technique

At present, the function of the message center in the communication system is becoming increasingly powerful, and it has developed from a short message center to a multimedia message center and a mail center. The number of users who use the message center is increasing, and the use of the message center to promote advertising is endless, and communication networks have gradually realized interconnection. The amount of messages flowing between communication networks has grown geometrically. Here Under this kind of market environment, a large number of spam and malicious messages will inevitably appear. Spam attacks in a short period of time can cause the transmission volume of communication networks to increase rapidly and easily cause network paralysis. Frequent spam and malicious messages, etc. It will also annoy users who use the message center; and reactionary and rumorous messages will have extremely bad social impact.

Therefore, various types of message centers need to be monitored, including message traffic and message content. At present, the monitoring methods of the message center are mainly as follows: The manager of the message center manually sets a blacklist number on the service processor of the message center for specified filtering, but this method is inconvenient and inaccurate, and cannot be real-time according to the network conditions. Modifying the blacklist number is very time-consuming and cannot cope with the large message traffic of the current message center. Therefore, there is an urgent need for a system and method that can automatically monitor the message center. However, no publicly similar technical solution has been found.

Summary of the invention

The technical problem to be solved by the present invention is to provide a system and method for intelligently monitoring a message center. This method can automatically monitor various types of message centers, and modify the monitoring configuration parameters according to the actual situation of the communication network to avoid the spread of spam and malicious messages and ensure the stability of the message center.

The system of the intelligent monitoring message center of the present invention includes a service processor, a monitoring server, and at least one monitoring management station, wherein the service processor is configured to process a received information service and send a message to be monitored to the monitoring server, And controlling the processing of information services according to the user blacklist returned by the monitoring server; the monitoring server is configured to process the messages to be monitored according to the monitoring configuration parameters output by the monitoring management station, and generate a user blacklist to output to the service processing The monitoring management station is configured to generate monitoring configuration parameters and send the monitoring configuration parameters to the monitoring server.

In the service processor and the monitoring server, a message database is provided for storing records generated during the message monitoring process, including the banned messages themselves and the monitoring results.

The service processor is further provided with a user blacklist table for storing the user blacklist, and performing blacklist monitoring on the user according to the user blacklist.

The monitoring server is also provided with a message flow monitoring table for storing information of monitoring users. The method for intelligently monitoring a message center according to the present invention includes the following steps: a service processor sends a message to be monitored to a monitoring server; the monitoring server monitors the monitoring message in real time according to the monitoring configuration parameters sent by the monitoring management station; the monitoring server The forbidden user generates a user blacklist and sends it to the service processor; the service processor controls the processing of information services according to the user blacklist.

The monitoring server monitors the monitored messages in real time, including monitoring the message content and monitoring the message traffic.

The system and method according to the present invention can automatically intercept suspicious objects according to the monitoring configuration parameters, and set them as blacklisted users, and the service processor immediately closes the message source corresponding to the user; meanwhile, it can also automatically The user is deleted from the blacklist, so that the corresponding message source is unblocked immediately. The invention can modify the monitoring configuration parameters in real time, and the monitoring operation takes effect immediately. In addition, the present invention can be Control configuration for multi-channel alarms; each remote terminal with authority can monitor the monitoring status in real time, and can query and analyze its historical records at any time. The invention can be applied to the monitoring of various short message centers, multimedia message centers, and mail centers.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of a network structure of a system of an intelligent monitoring message center according to the present invention;

2 is a schematic diagram of a data flow of a system of an intelligent monitoring message center according to the present invention;

3 is a schematic flowchart of monitoring user message traffic in the method of the present invention;

4 is a schematic flowchart of monitoring message content in the method of the present invention;

FIG. 5 is a schematic flowchart of a service processor controlling information service processing according to a user blacklist in the method of the present invention.

detailed description

The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

The message centers of various communication systems generally include a service processor 110, a service access server 160, a switching center 140, and a WW server 150. The service access server 160 is mainly used to access information services from the switching center 140 and the stomach server 150. The service processor 110 is used to process various types of information services, such as short messages, multimedia short messages, and multimedia mails, and to perform various types of messages and mail interactions with the switching center 140 and WW server 150 through the service access server 16 Send and receive.

As shown in FIG. 1, the system for intelligently monitoring a message center provided by the present invention includes: a service processor 110 located in the message center, a monitoring server 120 and a monitoring management station 130. The business processor 110 communicates with the monitoring server 120. In addition to completing general information service processing, the business processor 110 also sends messages to be monitored to the monitoring server 120. The monitoring server 120 is separately connected to the business processor 110 and the monitoring management station. 130 is connected and communicates in real time, and is used for real-time monitoring of the monitored messages according to the monitoring configuration parameters, and generates a user blacklist and a blacklist unban list, and sends it to the service processor 110; the monitoring management station 130 is used to set monitoring configuration parameters and send them to the monitoring server 120. In addition, the monitoring server 120 may also send the monitoring result to the monitoring management station 130.

The message to be monitored sent by the service processor 110 to the monitoring server 120 may be the received information itself; or it may be a simplification of the information, such as a bill.

The monitoring server 120 is also provided with at least one remote interface 180 to provide an interface for remote users. The monitoring server 120 may be connected to a remote terminal 181 or a browser 182 through the remote interface 180 to provide a remote user with a configuration interface or a monitoring interface for monitoring configuration parameters. In addition, the monitoring server 120 may also be connected to a log printing device 191 or an acousto-optic alarm device 192 to output and display a monitoring result.

A message database is set in the business processor 110 and the monitoring server 120, and is used to store records generated during the monitoring process of the message, including the banned messages themselves and the monitoring results. The above message database may be located in the memory of the business processor 110 and the monitoring server 120, and is a data table organized in a HASH manner. The specific implementation is: apply for a structure array area in the memory, each member structure of the array corresponds to a Chennai record; a certain member in the member structure is used as an index, such as a number. Hash algorithm is used to locate the corresponding record according to the index, which can locate the data at high speed. The method of resolving HASH conflicts uses the chain address method, that is, using the free queue to manage the usage of the memory table: whenever a record is inserted in the memory table, a unit is removed from the head of the idle queue; whenever a record is deleted, the The corresponding unit is placed at the end of the idle queue. In this way, the operation of the memory table can be as convenient as operating a physical database, and it is more real-time and efficient because it is in memory.

The monitoring configuration parameters are information used to guide the monitoring server 120 to perform monitoring, including configuration parameters of the monitoring mode, parameters of monitoring result processing, blacklist user lifting conditions, super users, monitoring keywords, etc., where the monitoring mode refers to the monitoring server 120 Information of the messages to be monitored, such as message traffic monitoring, message content monitoring, etc. Super users are users who do not perform message monitoring. specifically, Configuration parameters for message traffic monitoring include monitoring time, monitoring count, threshold, etc .; configuration parameters for message content monitoring include monitoring keywords; parameters for processing monitoring results include "generate user blacklist", "monitoring results feedback", "sound and light""Alarm","Logprint","Notifyadministrator", etc.

The monitoring management station 130 generates monitoring configuration parameters and sends the monitoring configuration parameters to the monitoring server 120. The monitoring configuration parameters are global structural variables stored in the memory of the monitoring server 120. The monitoring server 120 monitors the messages to be monitored in real time according to the specific monitoring configuration parameters. After receiving the monitoring configuration parameters of the monitoring management station 130, the monitoring server 120 immediately modifies the monitoring configuration parameter items in the memory, and the monitoring server 120 performs monitoring according to the new monitoring configuration parameters. At the same time, the monitoring server 120 writes the new configuration parameters into the monitoring configuration file to prevent the configuration parameters from being lost, and is also available for the monitoring management station 130 to verify.

The monitoring server 120 monitors the monitored messages according to the monitoring configuration parameters, which may be the traffic of the monitored messages and / or the content of the messages. The monitoring server 120 is provided with a message flow monitoring table for storing information of monitoring users. The message flow monitoring table is a memory table that uses a structured array area in memory, such as HASH. At the same time, in order to prevent the number of records from being larger than the capacity of the memory table, the LRU algorithm can be further used to ensure the security of the table and the effectiveness of the records in the table.

The monitoring server 120 generates a user blacklist for users who meet the prohibition conditions according to the monitoring result, and sends the user blacklist to the service processor 110. The service processor 110 controls the processing of information services according to the blacklist, and filters the blacklist users. To this end, a user blacklist table is set in the service processor 110 for storing the user blacklist. The blacklist table can also be a memory table that uses a structured array area in memory, and further uses the LRU algorithm to ensure the security of the table and the effectiveness of the records in the table.

The method for intelligently monitoring a message center according to the present invention includes: the service processor 110 sends a message to be monitored to the monitoring server 120; the monitoring server 120 monitors the monitoring message in real time according to the monitoring configuration parameters sent by the monitoring management station 130; the monitoring server 120 According to the monitoring results, automatically select the users who meet the prohibition conditions and generate a user blacklist, and send it to the business processor 110; business processing The machine 110 controls the processing of information services according to the user blacklist, and closes the message sources of the blacklisted users. In the above process, the monitoring configuration parameters are configured by the administrator on the monitoring management station 130 through a graphical configuration interface. The monitoring server 120 may also send the monitoring results to the monitoring management station 130 or other authorized remote terminals or users, and may also perform all-round alarms, including sound and light alarms. In addition, the monitoring server 120 may also automatically generate a blacklist unbanning list and send it to the service processor 110, and the service processor 110 deletes the unbanned blacklist user from the user blacklist table, thereby unbanning the user.

In the method of the present invention, the data flow between the message center and the monitoring system is shown in FIG. 2, where data flow A is the information to be processed received by the business processor 110; data B is the information processed by the business processor Data C is the message to be monitored sent by the service processor 110 to the monitoring server 120. The message to be monitored may be the information received by the service processor 110 itself, or it may be a simplification of the above information, such as a bill, etc .; The data flow D is The user blacklist or blacklist unban list sent by the monitoring server 120 to the business processor 110; data streams 1, 2, and 3 are monitoring configuration parameters sent by the monitoring management station 130 or other remote users to the monitoring server 120; data stream 4 , 5, 6, 7, 8, and 9 are messages sent by the monitoring server 120 to the monitoring management station 130 and other various terminals for alarm, browsing, and tracking analysis.

From the perspective of data flow, the method of the present invention is specifically as follows: after receiving the information to be processed or mail, that is, data flow A, the service processor 110 sends the data to the subsequent processing server for normal processing (data flow B), and also monitors The server 120 sends a message to be monitored, that is, the data stream C for monitoring, and the data stream C sent to the monitoring server 120 may carry only basic information required for monitoring. The monitoring server 120 monitors the monitoring messages in real time according to the monitoring configuration parameters sent by each monitoring management station 130, that is, data streams 1, 2, and 3, and sends monitoring results that are data streams 4, 5, 6, 7, 8, and 9 To each monitoring management station 130, analysis terminal, alarm device, or printing device. The monitoring server 120 monitors the obtained user blacklist data, namely The data stream D is immediately sent to the service processor 110 and stored in the user blacklist table, so that the information service of the user is closed. The monitoring server 120 also periodically checks the user blacklist table according to the unbanning conditions configured by the monitoring management station 1 30, filters out the blacklisted users who meet the unbanning conditions, generates a blacklist unbanning list, and sends the blacklist to the service processor 110. The blacklisted users in the unbanned list are deleted, and the information services of these users are lifted.

The monitoring of monitored messages includes monitoring of message traffic and monitoring of message content.

The monitoring of message traffic refers to monitoring whether the amount of information sent by the information user within a set unit time exceeds a set threshold, and if it exceeds, a user blacklist is generated; then the monitoring server 120 sends the user blacklist to the service processor 110 Or output to the alarm device or perform other monitoring results processing.

In order to monitor the message traffic, a message traffic monitoring table is set in the monitoring server 120, which is used to store information of the monitoring users, including at least the user's number, the current monitoring time, and the current monitoring count value. The message flow monitoring table uses the form of an in-memory database.

As shown in FIG. 3, the specific steps for monitoring the message traffic by the monitoring server 120 include: First, the monitoring server 120 receives the message to be monitored sent by the service processor 110 (step 301), and the monitoring server O checks whether the user of the message to be monitored is It already exists in the message flow monitoring table (step 302).

If the user is not in the message flow monitoring table, the monitoring server 120 records the information of the user in the message flow monitoring table, where the count value of the recording monitoring is 1, and the recording current time is the monitoring start time (step 303). The monitoring server 120 then checks whether the count value of the user exceeds the set monitoring count threshold (step 306). If the count value does not exceed the monitoring count threshold, it indicates that the message traffic of the user does not exceed the preset threshold, and ends the monitoring. If the count value exceeds the monitoring count threshold, it indicates that the information traffic of the user has exceeded a preset threshold, and the monitoring server 120 processes the monitoring result (step 307), which may be: generating a blacklist of the user and sending it to the business process machine 110, either feedback the monitoring result to the monitoring management station 130, or perform an acousto-optic alarm or the like, or all of the above three processes. Then the monitoring server 120 resets the record of the user, the count value returns to 0 (step 308), and the monitoring ends.

If the user has been recorded in the message flow monitoring table, the monitoring server 120 checks whether the current monitoring time of the user reaches the set monitoring time interval (step 304). If the monitoring time interval is exceeded, the monitoring server 120 resets the user Record, the count value returns to 0 (step 308), and the monitoring ends. If the monitoring time interval has not been exceeded, the monitoring server 120 checks whether the user's record has just been reset (step 305), and if so, sets the user's count value to 1 and sets the current time as the monitoring start time, Then step 306 is performed; if it has not just been reset, then the count value of the user is incremented by 1, and then step 306 is performed.

The monitoring of the content of the message refers to monitoring the content of the short message, the content of the multimedia short message, and the subject of the multimedia mail according to the monitoring keywords configured by the monitoring management station 130.

The monitoring process of the message content is shown in Figure 4. First, the monitoring server 120 receives the message to be monitored sent by the service processor 110 (step 401), and then checks whether the content of the received message to be monitored contains the set monitoring key. Word (step 402). If it does, the monitoring server 120 processes the monitoring result (step 403), which may be: generating a user blacklist and sending it to the service processor 110, or performing an audible and visual alarm, or feeding back the monitoring result to the monitoring management station 130, Or all three processes described above are performed. If there is no monitoring keyword, the monitoring is ended (step 404).

If a super user is set in the monitoring management station 130, check whether the user of the message to be monitored is a super user before monitoring the monitored messages, and if so, do not perform monitoring processing on the monitored messages; if not, perform subsequent monitoring deal with.

In addition, before the monitoring server 120 generates the user blacklist, the method further includes: judging whether the monitored suspicious user meets the blacklist generating widget set by the monitoring management station 130 (such as being detected in a unit time). In order to determine whether the frequency of suspicious users reaches the specified threshold, suspicious users who meet the blacklist generation conditions are determined as blacklisted users.

After receiving the user blacklist from the monitoring server 120, the service processor 110 stores the user blacklist in the user blacklist table. This table may use a memory table in the form of an in-memory database. The service processor 110 performs filtering processing on the blacklisted users according to the user blacklist table, intercepts messages of the users in the user blacklist table, and processes only messages of legitimate users. In addition, the monitoring server 120 periodically checks the user blacklist table according to the banning conditions configured by the monitoring management station 130, selects the blacklist users who meet the banning conditions, generates a blacklist banning list, and sends it to the service processor 110.

After receiving the blacklist lifted list, the service processor 110 deletes the users in the lifted list from the user blacklist and unblocks its information services.

Figure 5 shows the process of the service processor controlling the information service processing according to the user blacklist. First, the service processor 110 receives the information to be processed (step 501), and then checks whether the user of the information is recorded in the user blacklist (step 502). If it has been recorded in the user blacklist, the service processor 110 terminates the processing of the information service, and can determine whether to save the truncated information according to the configuration of the system (step 503). If the information user is not a blacklisted user, the service processor 110 performs normal processing on the information service (step 504).

It should be pointed out that the monitoring methods used in the system and method of the present invention are not limited to the above-mentioned monitoring of message traffic and message content. For other monitoring methods, reference may be made to the above two types of monitoring methods, and the present invention does not limit the use of Monitoring of the above two parameters.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limiting. Although the present invention is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technology of the present invention can be Modifications or equivalent replacements of the solutions without departing from the spirit and scope of the technical solutions of the present invention should be covered by the claims of the present invention.

Claims

Claim

1. A system for intelligently monitoring a message center, comprising a business processor, a monitoring server, and at least one monitoring management station;

The service processor is configured to process the received information service, send a message to be monitored to the monitoring server, and control the processing of the information service according to the user blacklist returned by the monitoring server;

The monitoring server is configured to process a message to be monitored according to the monitoring configuration parameters output by the monitoring management station, and generate a user blacklist to output to the service processor;

The monitoring management station is configured to generate monitoring configuration parameters and send the monitoring configuration parameters to the monitoring server.

2. The intelligent monitoring message center system according to claim 1, wherein the service processor and the monitoring server are each provided with a message database for storing messages generated during the message monitoring process. record of.

3. The system for intelligently monitoring a message center according to claim 2, wherein the record includes at least the banned message itself and its monitoring result.

4. The system for intelligently monitoring a message center according to claim 1, wherein the service processor is provided with at least one user blacklist table for storing the user blacklist, and according to the user blacklist, the user is Perform blacklist monitoring.

5. The intelligent monitoring message center system according to claim 1, wherein the monitoring server is provided with at least one message flow monitoring table for storing information of monitoring users.

6. The system for intelligently monitoring a message center according to claim 2 or 4 or 5, wherein the message database, the user blacklist table, and the message traffic monitoring table are all structured arrays in memory. Memory table.

7. The intelligent monitoring message center system according to claim 6, wherein the message database uses a HASH algorithm to form a memory table.

8. The system of intelligent monitoring message center according to claim 7, wherein the memory table is managed by an idle queue, and when the record is stored in the memory table, the unit is removed from the head of the idle queue, and when the record is deleted, The released unit is placed at the end of the idle queue.

9. The system for intelligently monitoring a message center according to claim 6, wherein the message database, the user blacklist table, and the message traffic monitoring table use a LRU algorithm to control the number of records.

10. The system for intelligently monitoring a message center according to claim 1, wherein the monitoring configuration parameters include at least: configuration parameters of a monitoring mode, parameters of processing of monitoring results, conditions for lifting a blacklisted user, superusers, and monitoring Keywords, where the monitoring mode refers to the information of the message to be monitored that the monitoring server should monitor; the super user refers to the user who does not perform message monitoring.

11. The system of intelligent monitoring message center according to claim 1, wherein the monitoring server further comprises at least one remote interface to provide an access interface for remote users.

12. The system of intelligent monitoring message center according to claim 11, wherein the monitoring server is further connected to a printing device or an acousto-optic alarm device to output a monitoring result.

13. A method for intelligently monitoring a message center, comprising the following steps: a service processor sends a message to be monitored to a monitoring server; the monitoring server monitors the monitoring message in real time according to the monitoring configuration parameters sent by the monitoring management station; monitoring The server generates a user blacklist for users who meet the prohibition conditions and sends it to the service processor; the service processor controls the processing of information services according to the user blacklist.

14. The method for intelligently monitoring a message center according to claim 13, wherein the monitoring server monitors messages to be monitored in real time, including monitoring message content and / or monitoring message traffic.

15. The method for intelligently monitoring a message center according to claim 13, wherein: The method further includes monitoring the server regularly checking the user blacklist table to see whether the blacklist users meet the conditions for lifting the ban, and if so, generating the blacklist users who meet the conditions from the blacklist to ban the list and sending them to the service processor; the service processor receives After the blacklist is lifted, the blacklist users who can be lifted from the user blacklist are deleted.

16. The method for intelligently monitoring a message center according to claim 14, wherein, if the monitoring management station is configured with super user parameters, it is checked whether the user of the message to be monitored is a super user before monitoring the monitored message. If yes, no monitoring processing is performed on the monitored messages; if not, subsequent monitoring processing is performed.

17. The method for intelligently monitoring a message center according to claim 13, before the monitoring server 120 generates the user blacklist, further comprising: judging whether the monitored suspicious users meet the blacklist generation set by the monitoring management station 130 Condition, the suspicious user who meets the blacklist generation condition is determined as the blacklist user.

18. The method for intelligently monitoring a message center according to any one of claims 13 to 17, wherein the method further comprises: the monitoring server sends a monitoring result to a monitoring management station or performs The audible and visual alarms are processed or printed out or sent to remote users who have permission to view the monitoring results.

19. The method for intelligently monitoring a message center according to claim 14 or 16, wherein the monitoring the content of the message is specifically: the monitoring server checks whether the content of the message to be monitored contains a monitoring keyword, if If yes, the sender of the message becomes a suspicious user, and a blacklist of users of the message to be monitored is generated and sent to the service processor to end the monitoring of the content of the message; if the message to be monitored does not contain a monitoring keyword, the end of this time monitor.

20. The method of intelligently monitoring a message center according to claim 14 or 16, characterized in that the monitoring of the message traffic is specifically-. Step 1) The monitoring server checks whether the user whose message is to be monitored is recorded in the message flow monitoring table; if the user is already recorded in the message flow monitoring table, go to step 2); if the user is not recorded in the message flow monitoring table In, then go to step 4);

Step 2) Check whether the monitoring time of the user reaches the monitoring time interval, and if it arrives, reset the record of the user in the message flow monitoring table and reset the count value to 0; end the monitoring;

Step 3) If the monitoring time of the user does not reach the monitoring time interval, determine whether the user has just been reset, and if so, set the count value of the user to 1, record the current time as the monitoring start time, and go to Step 5); if the user is not just reset, then increase the user's count value by 1; go to step 5)

Step 4) Record the information of the user in the message flow monitoring table, and record the monitored count value as 1, and record the current time as the monitoring start time;

Step 5) The monitoring server checks whether the count value of the user exceeds the monitoring count threshold. If the count value exceeds the monitoring count threshold, a user blacklist is generated for the user and sent to the business processor to end the monitoring; if the count value does not exceed If the monitoring count threshold is reached, the monitoring ends.

21. The method for intelligently monitoring a message center according to any one of claims 13 to 17, wherein the step of the service processor controlling the processing of the information service comprises: the service processor receives a user black message from the monitoring server. After the list, the user blacklist is stored in the user blacklist table; after receiving the pending information sent by the user, the service processor checks whether the user belongs to the user in the user blacklist table, and if it belongs, the processing of the information service is suspended If not, the information service is processed normally.