WO2016197675A1

WO2016197675A1 - Method and apparatus for identifying crank call

Info

Publication number: WO2016197675A1
Application number: PCT/CN2016/078170
Authority: WO
Inventors: 王飞
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-06-10
Filing date: 2016-03-31
Publication date: 2016-12-15
Also published as: CN106255113A

Abstract

Provided are a method and apparatus for identifying a crank call, wherein the method comprises: acquiring a call record of a subscriber number, and parsing subscriber calling information from the call record, the subscriber calling information comprising at least one of the following: a calling number, a called number, calling time and ringing time; monitoring calling behaviour information about a terminal corresponding to the subscriber calling information, the calling behaviour information comprising: a calling frequency in a pre-set time period, calling behaviour characteristics and called behaviour characteristics; matching with a pre-set monitor policy according to the calling behaviour information, wherein the pre-set monitor policy comprises: a monitor threshold value corresponding to the calling behaviour information; and confirming the subscriber number to be a crank call number in the case where the calling behaviour information and the pre-set monitor policy are consistent, so that the problem of a low crank call interception rate is solved, and the interception rate of crank calls is improved.

Description

Method and device for identifying harassing calls

Technical field

The present invention relates to the field of communications, and in particular to a method and apparatus for identifying a nuisance call.

Background technique

With the continuous expansion of communication services, the phenomenon of using the communication network to make harassing calls has appeared in large numbers, which has become one of the important reasons for user complaints and the impact on the communication network. The typical situation of harassing calls is that unscrupulous users make large-scale calls to telecom customers, hang up after a short time ringing, and call the voice station or voice recording when the customer calls back, causing harassment and fraud. The harassing call has seriously interfered with people. The normal life is rested, and it is becoming more and more serious, which has caused a great negative impact on telecom operators.

In order to better reflect social responsibility, purify the network communication environment, and effectively protect consumer rights and service users, many operators have considered various types of harassment telephone monitoring technologies and interception methods to intercept harassing calls, but most of the monitoring methods are relatively simple. The interception effect of harassing calls is not very obvious.

In view of the related art, the problem of harassing the telephone interception rate is not high, and no effective solution has been proposed yet.

Summary of the invention

The invention provides a method and a device for identifying a harassing phone, so as to at least solve the problem that the interception rate of the harassment phone is not high in the related art.

According to an aspect of the present invention, a method for identifying a nuisance phone is provided, including:

Acquiring a bill record of the user number, parsing the user call information from the bill record, the user call information comprising at least one of the following: a calling number, a called number, a calling time, a ringing time;

Monitoring call behavior information of the terminal corresponding to the user call information, where the call behavior information includes: a call frequency, a calling behavior feature, and a called behavior feature in a preset time period;

Matching the call behavior information with a preset monitoring policy, where the preset monitoring policy includes: a monitoring threshold corresponding to the call behavior information;

In case the call behavior information is consistent with the preset monitoring policy, the user number is confirmed as an harassing phone number.

Further, the calling behavior feature includes at least one of the following: a call completion rate, a number of times the phone is hanged, a number of calls initiated by the calling number per unit time, and the calling number of the unit time. The first percentage of the number of calls initiated and received;

The called behavior feature includes at least one of the following: a total number of calls per unit time and a second ratio of the number of the called numbers that are different in the unit time, a proportion of the province number, and a ringing duration.

Further, after the confirming that the user number is an harassing phone number, the method further includes:

When the user number is recorded to the blacklist and the user number of the blacklist is monitored, the user number is confirmed as the harassing phone number.

Send the user number to the manual auditing platform, and confirm again whether the user number is an harassing phone number.

Further, the acquiring the bill record of the user number comprises: acquiring the bill record of the user number from the CRBT platform, the signaling monitoring system, the switch, and the signaling processor.

According to another aspect of the present invention, there is also provided an apparatus for identifying an harassing telephone, comprising:

The obtaining module is configured to obtain a bill record of the user number, and parse the user call information from the bill record, where the user call information includes at least one of the following: a calling number, a called number, a calling time, and a ringing time. ;

The monitoring module is configured to monitor call behavior information of the terminal corresponding to the user call information, where the call behavior information includes: a call frequency, a calling behavior feature, and a called behavior feature in a preset time period;

The matching module is configured to match the preset behavior according to the call behavior information, where the preset monitoring policy includes: a monitoring threshold corresponding to the call behavior information;

The first confirmation module is configured to confirm that the user number is an harassing phone number if the call behavior information and the preset monitoring policy are consistent.

Further, the device further includes:

The recording module is configured to record the user number to the blacklist, and if the user number of the blacklist is monitored, confirm that the user number is an harassing phone number.

Further, the device further includes:

The second confirmation module is configured to send the user number to the manual auditing platform, and confirm whether the user number is an harassing phone number.

Further, the obtaining module includes:

The first acquiring unit is configured to acquire a bill record of the user number from the CRBT platform, the signaling monitoring system, the switch, and the signaling processor.

Through the invention, the CDR record of the user number is obtained, and the user call information is parsed from the CDR record, and the user call information includes at least one of the following: a calling number, a called number, a calling time, a ringing time, and monitoring and The call behavior information of the terminal corresponding to the user call information, the call behavior information includes: a call frequency, a caller behavior feature, and a called behavior feature in a preset time period, and the call behavior information is matched with the preset monitoring policy according to the call behavior information. The preset monitoring policy includes: a monitoring threshold corresponding to the call behavior information, and if the calling behavior information is consistent with the preset monitoring policy, confirming that the user number is a harassing phone number, and solving the harassment phone interception rate The problem is not high, providing an interception rate for harassing calls.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flow chart of a method for identifying a nuisance call according to an embodiment of the present invention;

2 is a block diagram showing the structure of an apparatus for identifying an harassing telephone according to an embodiment of the present invention;

3 is a schematic diagram of a general model of a harassment phone policy in accordance with a preferred embodiment of the present invention;

4 is a schematic diagram showing the structure of a disturbance telephone monitoring system in accordance with a preferred embodiment of the present invention;

Figure 5 is a general flow chart of a disturbance telephone monitoring system in accordance with a preferred embodiment of the present invention;

6 is a flow chart of a decision to harass a telephone policy in accordance with a preferred embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

It is to be understood that the terms "first", "second" and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order.

In this embodiment, a method for identifying a nuisance phone is provided. FIG. 1 is a flowchart of a method for identifying a nuisance phone according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:

Step S102: Acquire a bill record of the user number, and parse the user call information from the bill record. The user call information includes at least one of the following: a calling number, a called number, a calling time, and a ringing time;

Step S104: Monitor call behavior information of the terminal corresponding to the user call information, where the call behavior information includes: a call frequency, a calling behavior feature, and a called behavior feature in a preset time period;

Step S106: The call behavior information is matched with the preset monitoring policy, where the preset monitoring policy includes: a monitoring threshold corresponding to the call behavior information;

Step S108: If the call behavior information is consistent with the preset monitoring policy, confirm that the user number is an harassing phone number.

Through the above steps, the CDR record of the user number is obtained, the user call information is parsed from the CDR record, the call behavior information of the terminal corresponding to the user call information is monitored, and the call behavior information is matched with the preset monitoring policy according to the call behavior information. If the call behavior information is consistent with the preset monitoring policy, the user number is confirmed as the harassing phone number, and the manner of confirming the harassing phone is comprehensive and effective, and the call frequency, the calling behavior feature, the called behavior feature, etc. are confirmed. Whether the user number is an harassing phone number solves the problem that the harassment phone interception rate is not high, and provides the interception rate of the harassing phone.

In this embodiment, the calling behavior feature may include: a call completion rate, a number of times the phone is hanged, a number of calls initiated by the calling number per unit time, and initiation and reception of the calling number in the unit time. The first percentage of the number of calls;

In this embodiment, after confirming that the user number is the harassing phone number, the user number can also be recorded to the blacklist. When the user number of the blacklist is monitored, the user number is confirmed as the harassing phone number. The user number can also be sent to the manual review platform to reconfirm whether the user number is an harassment phone number.

In this embodiment, there are many ways to obtain the CDR record of the user number, and the CDR record of the user number can be obtained from the CRBT platform, the signaling monitoring system, the switch, and the signaling processor.

In the embodiment, an identification device for the harassing phone is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and will not be described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

2 is a structural block diagram of an apparatus for identifying an harassing telephone according to an embodiment of the present invention. As shown in FIG. 2, the apparatus includes:

The obtaining module 22 is configured to obtain a bill record of the user number, and parse the user call information from the bill record, where the user call information includes at least one of the following: a calling number, a called number, a calling time, and a ringing time;

The monitoring module 24 is configured to monitor call behavior information of the terminal corresponding to the user call information, where the call behavior information includes: a call frequency, a calling behavior feature, and a called behavior feature in a preset time period;

The matching module 26 is configured to match the preset monitoring policy according to the call behavior information, where the preset monitoring policy includes: a monitoring threshold corresponding to the call behavior information;

The first confirmation module 28 is configured to confirm that the call behavior information is consistent with the preset monitoring policy. The household number is the harassing phone number.

Obtaining a bill record of the user number by using the foregoing device, parsing the user call information from the bill record, monitoring the call behavior information of the terminal corresponding to the user call information, and matching the preset behavior according to the call behavior information, If the call behavior information is consistent with the preset monitoring policy, the user number is confirmed as the harassing phone number, and the manner of confirming the harassing phone is comprehensive and effective, and the call frequency, the calling behavior feature, the called behavior feature, etc. are confirmed. Whether the user number is an harassing phone number solves the problem that the harassment phone interception rate is not high, and provides the interception rate of the harassing phone.

In this embodiment, the device further includes:

The recording module is configured to record the user number to the blacklist, and if the user number of the blacklist is monitored, the user number is confirmed as the harassing phone number.

In this embodiment, the device further includes:

In this embodiment, the obtaining module 22 includes:

The first acquiring unit is configured to obtain a bill record of the user number from the CRBT platform, the signaling monitoring system, the switch, and the signaling processor.

The invention will now be described in detail in conjunction with the preferred embodiments and embodiments.

The preferred embodiment provides a comprehensive identification method and device for harassing telephones, which solves the problem that the success rate of harassing telephone interception is not high in the prior art, and improves the customer satisfaction of the telecom operators.

An harassing telephone caller often appears to have a higher frequency of calling frequencies over a period of time and has different calling behavior characteristics and called behavior characteristics than normal telephone callers. The calling behavior characteristics mainly refer to the call completion rate, the number of active call completions (release times) and the proportion of callers (caller ratio = number of calls initiated by the caller per unit time / all calls and receptions of the caller) Number of calls). Harassing phone callers tend to have lower turn-on rates, higher number of active hang-ups (number of releases), and higher caller occupancy characteristics. The called behavior characteristics mainly refer to the ringing duration, the called number dispersion (called discrete rate = total number of calls per unit time / number of different called numbers per unit time) and the proportion of the province number, and the harassing phone caller often It has a low ringing duration feature, and the called number is widely distributed, and the repetition rate is very low, with a high degree of called number dispersion. At the same time, many callers with the same calling number with the characteristics of the harassing phone are found through analysis. The called number is mainly the provincial number.

The preferred embodiment utilizes the monitoring of the harassing call by the difference between the caller's behavior and the normal caller's behavior in the frequency of the call, the characteristics of the calling behavior and the characteristics of the called behavior. By analyzing the call frequency characteristics, caller behavior characteristics and called behavior characteristics of the harassing telephone caller, a general harassment telephone monitoring strategy model is extracted, and the harassment telephone monitoring is performed according to the strategy model, and according to the actual situation of the monitoring, The strategy model is adjusted.

The harassing telephone caller has high frequency and low frequency, and the high frequency harassing telephone caller makes a large number of harassing calls in a short time; Low-frequency harassment phone callers do not make harassing calls in a short period of time, but make a large number of harassing calls within a certain period; harassing phone callers in different user groups (different segments) will also behave differently. . Therefore, it is necessary to formulate different harassment telephone monitoring strategy models for different situations. The monitoring system can perform matching policies one by one when performing harassing telephone monitoring to improve the recall rate of harassing calls.

In order to realize the spoofing telephone detection based on the above features, the preferred embodiment firstly acquires and parses the user's calling CDRs on the operator side, analyzes the historical call records in a certain period of time, and extracts the calling frequency characteristics of the harassing telephone users, and the calling party The behavioral characteristics, the behavioral characteristics of the called party, and the user group in which the telephone user is harassed (differentiated according to the number segment), develop a set of universal harassment telephone monitoring strategy model, and the model contains multiple strategies. The call CDR of the user is the same as the CDR recording function and function of the subscriber number in the above embodiment.

When the system performs harassment phone detection, it first performs black-and-white list-based detection. If the phone caller is on the black and white list, the user is directly skipped; then the policy-based detection is performed, and if a policy is triggered, a suspicious nuisance call is generated. User records are manually reviewed; if multiple policies are configured in the system, multiple policies can be matched in parallel.

In order to implement the above detection method, an identification device for harassing a telephone includes a policy management module, a monitoring data acquisition module, a monitoring processing module, a manual auditing module, a black and white list management module, and a database module. The monitoring data acquisition module has the same functions and functions as those of the acquisition module 22 in the above embodiment. The monitoring processing module has the same functions and functions as the monitoring module 24, the matching module 26, and the first confirmation module 28 in the above embodiment.

The policy management module is responsible for managing and maintaining the policy model and synchronizing the policy model to the monitoring processing module; the monitoring data collection module is responsible for collecting user bill records from the ring back tone platform, the signaling monitoring system, the switch, the signaling processor, and the like. The bill record usually includes parameters such as the calling number, calling time, ringing duration, etc. The monitoring data acquisition module parses out the records and forwards them to the monitoring processing module one by one; the monitoring processing module serves as the core module of the system according to the policy model to the monitoring data acquisition module. The forwarded bill record is based on the strategy model analysis, and the suspicious harassment phone user is put into the warehouse; the manual audit module extracts the suspicious harassment phone user from the database for review, and if it is confirmed as the harassing phone user, the blacklist synchronization is generated to the blacklist. Management module; the blacklist management module manages and stores the black and white list, and the generated blacklist is periodically synchronized to the operator's network management system, so that the operator can intercept the harassing call in time; the database is used to store the policy generated by the policy management module and the suspicious harassing call. Family records.

In the related art, some of the harassment phone monitoring is monitoring the harassing phone on the terminal side, some need the support of signaling, and some monitoring technologies are relatively single, and the harassing phone cannot be fully and effectively monitored. The preferred embodiment is directly deployed on the operator side, and obtains a common harassment telephone monitoring strategy model by obtaining a parsing call CDR, analyzing the calling frequency, calling behavior and called behavior of the harassing telephone caller. According to the strategy model, the success rate of harassment telephone interception can be greatly improved, and the original network of the operator will not be affected.

3 is a schematic diagram of a general model of a harassment phone policy according to a preferred embodiment of the present invention. As shown in FIG. 3, a policy set consists of a black and white list configuration and a plurality of policies. A policy consists of three rules: call frequency, caller behavior analysis and called behavior analysis rules. The logical relationship between the three rules is logical AND. The caller behavior analysis consists of three sub-rules: the connection rate, the number of releases, and the proportion of the caller. The logical relationship between the sub-rules can be logical AND or logical OR. The called behavior analysis consists of three sub-rules: the ringing duration, the called dispersion and the provincial number. The logical relationship between the sub-rules can be Logic "and" or logic "or". Each policy has a policy attribute (that is, the scope of the policy), the policy attribute contains the user group attribute and the time slice attribute; the user group attribute indicates which users (usually distinguished by the number segment) are monitored by the policy; The slice attribute indicates the time span of user behavior monitoring. The time slice length can be 1 minute, 1 hour, 6 hours, 24 hours, and so on.

4 is a schematic diagram of a structure of a nuisance telephone monitoring system according to a preferred embodiment of the present invention. As shown in FIG. 4, the system is deployed on the operator side, does not change the existing network of the operator, and the system is composed of a policy management module and a monitoring data acquisition module. , monitoring and processing module, manual audit module, black and white list management module and database module. The monitoring data collection module acquires a bill record from a ring back tone platform, a signaling monitoring system, a switch, a signaling processor, and the like by a File Transfer Protocol (FTP), a black and white list management module, and a network management system. The black and white list is also synchronized by FTP. The policy management module, the monitoring processing module, the manual auditing module, and the black and white list management module are all connected to the database.

FIG. 5 is a general flowchart of a nuisance telephone monitoring system according to a preferred embodiment of the present invention. As shown in FIG. 5, the specific process includes the following steps:

Step 501: The monitoring data collection module obtains the CDR record of the operator from the ring back tone platform, the signaling monitoring system, the switch, the signaling processor, and the like by using the FTP mode, scans the records one by one, and resolves the calling and called numbers, the calling time, and the vibration. The information such as the length of the bell is forwarded to the monitoring processing module for user behavior monitoring.

Step 502: Perform blacklist-based filtering on each record. If the user is directly ignored on the black and white list, the monitoring process ends.

In step 503, the user is monitored based on the general policy model, and if the system is configured with multiple policies, all the policies are matched.

Step 504: Output a suspicious harassment phone record for the user monitoring the matching policy rule.

Step 505: The manual auditing module reviews the output of the suspicious harassment phone record, and if it is confirmed to be the harassing phone user, generates a blacklist synchronization to the blacklist management module.

Step 506, the black and white list management module synchronizes the blacklist to the network management system.

FIG. 6 is a flow chart of determining a nuisance call policy according to a preferred embodiment of the present invention. As shown in FIG. 6, the specific process includes the following steps:

Step 601: The monitoring processing module performs traffic counting for each user, including a user call frequency count, a turn-on count, a turn-on count, a ring duration count, and the like.

Step 602: Determine whether the user matches the policy user group attribute. If yes, go to step 603. Otherwise, the matching of the policy ends to enter the next policy match.

In step 603, the frequency of the call is monitored by the user, and it is determined whether the time-slot call frequency count specified by the policy reaches the threshold specified by the call frequency rule in the policy. If yes, the process proceeds to step 604. Otherwise, the matching of the policy ends to enter the next policy match.

In step 604, the calling behavior monitoring is performed on the user. The caller behavior monitoring includes three sub-rules monitoring of the connection rate, the number of releases, and the proportion of the caller. The calling party ratio calculation method: the proportion of the calling party = the number of calls initiated by the calling party per unit time / the number of calls initiated and received by the calling party. The logical relationship between the three sub-rules can be flexibly configured. For example, if there is a logical AND relationship between the three sub-rules, the connection rate is required, and the release count and the call-to-call ratio simultaneously satisfy the thresholds specified by the three sub-rules in the policy to satisfy the calling behavior rule; If the three sub-rules have a logical "or" relationship, the calling party's behavior rules are met as long as the threshold specified by any sub-rule is reached. It is determined that if the calling party behavior rule is met, the process proceeds to step 605, otherwise the matching of the policy ends and the next policy match is entered.

In step 605, the called behavior monitoring is performed on the user. The called behavior monitoring includes the duration of the ringing, the called dispersion and the number of the provinces are monitored by the three sub-rules. The method for calculating the degree of dispersion of the called party: the called party's dispersion degree = the number of different called numbers per unit time / the total number of calls per unit time, the calculation of the proportion of the province's number: the number of units in the called number in the unit time/unit The number of called numbers that are called during the time. The logical relationship between the three sub-rules can be flexibly configured. For example, if the relationship between the three sub-rules is a logical "and" relationship, the ringing duration is required, and the proportion of the called dispersion and the provincial number simultaneously reaches the threshold specified by the three sub-rules in the strategy to satisfy the called behavior rule. If the three sub-rules have a logical "or" relationship, the called behavior rule is satisfied as long as the threshold specified by any sub-rule is reached. It is determined that if the called behavior rule is met, the process proceeds to step 606, otherwise the matching of the policy ends and the next policy match is entered.

In step 606, after the policy analysis, the calling frequency, the calling behavior rule and the called behavior rule are satisfied, the suspicious harassing telephone user record is merged into the library.

In step 607, it is checked whether there is a next policy. If yes, the process returns to step 601 to perform matching of the next policy. Otherwise, the monitoring process of the user record ends.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

Embodiments of the present invention also provide a storage medium. Optionally, in the embodiment, the storage medium may be configured to store program code for performing the method steps of the above embodiment:

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory. A variety of media that can store program code, such as a disc or a disc.

Optionally, in the embodiment, the processor executes the method of the above embodiment according to the stored program code in the storage medium.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. On, Alternatively, they may be implemented by program code executable by a computing device such that they may be stored in a storage device by a computing device and, in some cases, may be executed in a different order than herein. The steps shown or described are either made separately into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

Based on the foregoing technical solution provided by the embodiment of the present invention, the CDR record of the user number is obtained, and the user call information is parsed from the CDR record, and the user call information includes at least one of the following: a calling number, a called number, and a calling time. And ringing time, monitoring call behavior information of the terminal corresponding to the user call information, where the call behavior information includes: a call frequency within a preset time period, a caller behavior feature, a called behavior feature, and a call behavior information according to the call behavior information Matching with the preset monitoring policy, where the preset monitoring policy includes: a monitoring threshold corresponding to the calling behavior information, and confirming that the user number is a harassing phone number if the calling behavior information is consistent with the preset monitoring policy It solves the problem of low interception rate of harassment calls and provides the interception rate of harassing calls.

Claims

A method for identifying a harassing phone, comprising:

Acquiring a bill record of the user number, parsing the user call information from the bill record, the user call information comprising at least one of the following: a calling number, a called number, a calling time, a ringing time;

Monitoring call behavior information of the terminal corresponding to the user call information, where the call behavior information includes: a call frequency, a calling behavior feature, and a called behavior feature in a preset time period;

Matching the call behavior information with a preset monitoring policy, where the preset monitoring policy includes: a monitoring threshold corresponding to the call behavior information;

In case the call behavior information is consistent with the preset monitoring policy, the user number is confirmed as an harassing phone number.
The method of claim 1 comprising:

The calling behavior feature includes at least one of the following: a call completion rate, a number of times the phone is hanged, a number of calls initiated by the calling number per unit time, and initiation and reception of the calling number in the unit time. The first percentage of the number of calls;

The called behavior feature includes at least one of the following: a total number of calls per unit time and a second ratio of the number of the called numbers that are different in the unit time, a proportion of the province number, and a ringing duration.
The method of claim 1, wherein after the confirming the user number is a harassing phone number, the method further comprises:

When the user number is recorded to the blacklist and the user number of the blacklist is monitored, the user number is confirmed as the harassing phone number.
The method of claim 1, wherein after the confirming the user number is a harassing phone number, the method further comprises:

Send the user number to the manual auditing platform, and confirm again whether the user number is an harassing phone number.
The method according to any one of claims 1 to 4, wherein the acquiring the bill record of the subscriber number comprises: acquiring the bill record of the subscriber number from the CRBT platform, the signaling monitoring system, the switch, and the signaling processor.
An identification device for harassing a telephone, comprising:

The obtaining module is configured to obtain a bill record of the user number, and parse the user call information from the bill record, where the user call information includes at least one of the following: a calling number, a called number, a calling time, and a ringing time. ;

The monitoring module is configured to monitor call behavior information of the terminal corresponding to the user call information, where the call behavior information includes: a call frequency, a calling behavior feature, and a called behavior feature in a preset time period;

a matching module, configured to match the preset monitoring policy according to the call behavior information, where the pre- The monitoring policy includes: a monitoring threshold corresponding to the call behavior information;

The first confirmation module is configured to confirm that the user number is an harassing phone number if the call behavior information and the preset monitoring policy are consistent.
The apparatus of claim 6 comprising:

The calling behavior feature includes at least one of the following: a call completion rate, a number of times the phone is hanged, a number of calls initiated by the calling number per unit time, and initiation and reception of the calling number in the unit time. The first percentage of the number of calls;

The called behavior feature includes at least one of the following: a total number of calls per unit time and a second ratio of the number of the called numbers that are different in the unit time, a proportion of the province number, and a ringing duration.
The apparatus of claim 6 wherein said apparatus further comprises:

The recording module is configured to record the user number to the blacklist, and if the user number of the blacklist is monitored, confirm that the user number is an harassing phone number.
The apparatus of claim 6 wherein said apparatus further comprises:

The second confirmation module is configured to send the user number to the manual auditing platform, and confirm whether the user number is an harassing phone number.
The apparatus according to any one of claims 6 to 9, wherein the acquisition module comprises:

The first acquiring unit is configured to acquire a bill record of the user number from the CRBT platform, the signaling monitoring system, the switch, and the signaling processor.