CN102378180A - Method and device for determining user identity - Google Patents

Abstract

The invention discloses a user identity determination method and device. Wherein, the method includes: counting whether the number of short messages sent by the user within the rule duration meets the flow threshold; if so, counting the failure rate of the user's first short message within the rule duration; if the failure rate meets the ratio monitoring threshold, determine the The user is a blacklist user. The invention solves the problem that the strategy for capturing suspicious users is too simple, and the recall rate and precision rate are contradictory, and improves the overall performance of the short message monitoring system.

Description

Method and device for determining user identity

technical field

The present invention relates to the communication field, in particular, to a method and device for determining user identity.

Background technique

At present, the function of the message center in the communication field is growing day by day: the application scope is from the short message center, to the multimedia message center, and then to the mail center; Emerging in endlessly; the interconnection and intercommunication activities between various networks are in full swing; the amount of information flowing on the Internet has also increased exponentially. In this market environment, it is inevitable that there will be a large number of spam messages, malicious messages, advertising messages, etc., and the groups or individuals who send these messages are considered suspicious users, or even blacklisted users. A large number of spam messages in a short period of time can lead to the paralysis of the operator's operating environment; some malicious users even take advantage of the delay of the operator's billing system to send a large number of short messages when they are close to arrears, thereby causing the operator to suffer huge economic losses. Not only that, frequent spam advertisements and malicious messages will also annoy users.

In view of this, a spam short message monitoring system has emerged as the times require. Its main function is to automatically discover suspicious users based on a large number of monitored short messages, and then restrict suspicious users from sending short messages. Although there are many commercial spam monitoring systems on the market, the basis for judgment is still relatively simple in terms of its core function of "finding suspicious users", usually based on monitoring rules to judge the messages sent by users within a unit time If so, the user is considered to be a suspicious user (here the preset monitoring threshold and the length of the unit time are all regulated by the monitoring rules), and then the suspicious user is restricted from sending short messages the behavior of. The defect of this monitoring method is that it simply counts the amount of messages sent by the user within a unit time, and judges whether it reaches the preset threshold value. Usually, in order to meet the communication needs of normal users, the traffic violation threshold in the rules is usually not set too small, which makes some malicious users take advantage of this feature of the system to continue sending spam at a low frequency for a long time SMS, so as to escape the monitoring of the system, the recall rate of the corresponding spam monitoring will be reduced, and the precision rate will be increased accordingly; at the same time, in order to deal with users’ spam SMS complaints, the traffic violation threshold in the rules should not be set too large to ensure More suspicious users are monitored, so that some users who send normal text messages, such as those who send business contacts, number changes, birth blessings, etc., are misjudged as suspicious users, or even blacklisted users, and the text message function is turned off. The recall rate of the corresponding garbage monitoring will increase, but the precision rate will decrease accordingly.

Aiming at the problem that the strategy for capturing suspicious users in related technologies is too simple, and the recall rate and precision rate are contradictory, no effective solution has been proposed yet.

Contents of the invention

Aiming at the problem that the strategy for capturing suspicious users is too simple and the recall rate and precision rate are contradictory, the present invention provides a method and device for determining user identity to at least solve the above problems.

According to one aspect of the present invention, a method for determining user identity is provided, including: counting whether the number of short messages sent by the user within the rule time meets the traffic threshold; if so, counting the number of short messages sent by the user for the first time within the rule time Failure rate; if the failure rate meets the ratio monitoring threshold, it is determined that the user is a blacklist user.

Preferably, before counting the number of short messages sent by the above-mentioned users within the duration of the rule to meet the traffic threshold, the method also includes: configuring the ratio monitoring threshold of the first delivery failure rate and at least one monitoring rule; wherein, the monitoring rule includes rule duration, Time granularity and the traffic threshold monitored by traffic within the rule duration, and the rule duration is an integer multiple of the time granularity.

Preferably, counting whether the number of short messages sent by the user within the rule duration meets the traffic threshold includes: when multiple monitoring rules are configured, counting and counting the short messages sent by the user based on each configured monitoring rule.

Preferably, counting and counting the short messages sent by the above-mentioned users based on each monitoring rule configured includes: selecting a monitoring rule from a plurality of monitoring rules one by one; The number of short messages sent by the user is counted; if the count of the user reaches the traffic threshold in the current time granularity, it is determined that the number of short messages of the user in the rule duration meets the traffic threshold; continue to select the next monitoring rule to count until more than A monitoring rule is selected.

Preferably, counting the failure rate of the first short message sent by the above-mentioned user within the regular time period includes: calculating the number of all short messages sent by the user within the regular time period; Calculate the number of times; calculate the ratio of the number of failed short messages sent for the first time to the number of all short messages, and use the ratio as the failure rate of the user's first short message sent within the rule period.

Preferably, if the failure rate does not meet the ratio monitoring threshold, the above method further includes: acquiring associated information of the short messages sent by the above-mentioned users within the specified duration, wherein the associated information includes at least one of the following: calling frequency, content length consistency rate, Keyword occurrence frequency and destination number continuity rate; among them, frequency of initiating calls, content length consistency rate, keyword occurrence frequency and destination number continuity rate are respectively configured with an association threshold; if one of the association information satisfies the corresponding association threshold, determine This user is a blacklist user.

According to another aspect of the present invention, a device for determining a user identity is provided, including: a traffic statistics module, used to count whether the number of short messages sent by a user within a rule period meets the traffic threshold; a failure rate statistics module, used to count if The statistical result of the traffic statistics module is that the number of short messages meets the traffic threshold, and the failure rate of the user sending short messages for the first time within the time period of the statistical rule; the identity determination module is used to monitor if the failure rate statistics module’s statistical structure is that the failure rate satisfies the ratio Threshold, determine that the user is a blacklist user.

Preferably, the above device further includes: a configuration module, configured to configure a ratio monitoring threshold of the failure rate of the first delivery and at least one monitoring rule; wherein, the monitoring rule includes rule duration, time granularity, and a flow threshold for monitoring traffic within the rule duration, The rule duration is an integer multiple of the time granularity.

Preferably, the above-mentioned traffic statistics module includes: a traffic statistics unit, configured to count and count the short messages sent by the above-mentioned users based on each configured monitoring rule when the configuration module configures multiple monitoring rules.

Preferably, the above-mentioned failure rate statistics module includes: a short message number calculation unit, used to calculate the number of all short messages sent by the above-mentioned user within the regular time period; a failure count calculation unit, used for all the first-time Send the number of times that short message fails to calculate; Failure rate calculation unit, the ratio of the number of times that the failure rate calculation unit calculates and the number of all short messages calculated by the calculation unit for sending short messages for the first time is calculated, and the ratio is used as The failure rate of the user sending short messages for the first time within the rule duration.

Preferably, the above-mentioned device further includes: an associated information acquisition module, used to obtain the associated information of the short messages sent by the above-mentioned users within the specified time period if the failure rate counted by the failure rate statistics module does not meet the ratio monitoring threshold, wherein the associated information includes at least One of the following: calling frequency, content length consistency rate, keyword occurrence frequency, and destination number continuity rate; wherein, each of the origination call frequency, content length consistency rate, keyword occurrence frequency, and destination number continuity rate is configured with an associated threshold; The identity reconfirmation module is used to determine that the user is a blacklisted user if one of the associated information obtained by the associated information obtaining module satisfies the corresponding associated threshold.

Through the present invention, on the basis of traffic monitoring combined with the monitoring of the first failure rate, the strategy of capturing suspicious users is too simple, and the problem of contradiction between the recall rate and the precision rate is solved, and the overall performance of the short message monitoring system is improved. .

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

Fig. 1 is a flowchart of a method for determining a user identity according to an embodiment of the present invention;

Fig. 2 is a structural block diagram of a device for determining a user identity according to an embodiment of the present invention;

Fig. 3 is a structural block diagram of a device for determining a preferred user identity according to an embodiment of the present invention;

Fig. 4 is a structural block diagram of another device for determining a preferred user identity according to an embodiment of the present invention;

Fig. 5 is the structural block diagram of the failure rate statistical module according to the embodiment of the present invention;

Fig. 6 is a structural block diagram of another device for determining a preferred user identity according to an embodiment of the present invention;

Figure 7 is a schematic diagram of a short message monitoring system according to a preferred embodiment of the present invention;

Fig. 8 is a schematic diagram of the architecture of a short message monitoring system according to a preferred embodiment of the present invention;

Fig. 9 is the flow chart of the short message monitoring method according to the preferred embodiment of the present invention;

Fig. 10 is a flow chart of counting short messages sent by users based on multiple monitoring rules according to a preferred embodiment of the present invention.

Detailed ways

Hereinafter, the present invention will be described in detail with reference to the drawings and examples. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

The embodiment of the present invention is aimed at the characteristics of mass sending of spam short messages. Generally, there may be some invalid numbers (shutdown, no such number, etc.) in the called number, and the messages sent to these numbers will fail to be delivered, and a method for determining the identity of the user is provided. and device. The following will be described through specific examples.

As shown in Figure 1, according to the flow chart of the method for determining user identity according to an embodiment of the present invention, the method can be implemented in a short message monitoring system, and includes the following steps:

Step S102, counting whether the number of short messages sent by the user within the specified period of time meets the traffic threshold; if yes, execute step S104; if not, execute step S108.

Step S104, counting the failure rate of the user sending short messages for the first time within the specified time period.

Step S106, if the failure rate meets the ratio monitoring threshold, it is determined that the user is a blacklist user.

Step S108, determining that the user is a legitimate user.

In this embodiment, by combining the monitoring of the first failure rate on the basis of traffic monitoring, the behavior of continuously sending spam messages at a low frequency for a long time can be limited, and the occurrence of false monitoring can be avoided, and the recall rate and precision rate are improved at the same time The method solves the problem that the strategy for capturing suspicious users is too simple and the recall rate and precision rate are contradictory in related technologies, and improves the overall performance of the short message monitoring system.

When the number of short messages sent by the user within the time period of the statistical rule meets the above traffic threshold, it can be temporarily determined that the user may be a suspicious user. It is determined that the user is a suspicious user, that is, the user is the above-mentioned blacklisted user.

The above-mentioned rule duration refers to the monitoring duration of a monitoring rule. The rule duration in this embodiment is a multiple of the time granularity, and the time granularity is used as the calculation unit. For example, 1 time granularity, 2 time granularities, etc. Therefore, one or more time granularities can be included in a rule duration. The time granularity is used to indicate the set time length, which is the basic unit of monitoring time, such as 10 minutes, 1 hour, etc. The time granularity in this embodiment is defined by the granularity start time and the granularity end time, the granularity start time is the start time of the time granularity; the granularity end time is the time granularity plus the time granularity start time.

Before the number of short messages sent by the user meets the traffic threshold within the above statistical rules, you can configure the system according to your needs, for example: configure the ratio monitoring threshold of the failure rate of the first delivery and at least one monitoring rule; among them, the monitoring rule Including the rule duration, time granularity and the traffic threshold monitored by traffic within the rule duration, the rule duration is an integer multiple of the time granularity. This configuration method can be configured according to the actual monitoring needs of the system, so that the configured parameters can better meet the monitoring requirements and increase the flexibility of the system. Of course, for generally applicable scenarios, the default configuration of the system can also be used, that is, the above configuration does not need to be performed separately.

When multiple monitoring rules are configured, the short messages sent by the user can be counted and counted based on each configured monitoring rule. For example: select a monitoring rule from multiple monitoring rules one by one; take time granularity as the unit, count the number of short messages sent by users within the rule duration of the selected monitoring rule; if the count of users in the current time granularity reaches the traffic threshold , it is determined that the number of short messages of the user within the rule duration satisfies the traffic threshold; continue to select the next monitoring rule to count until multiple monitoring rules are selected. By configuring multiple monitoring rules, the user's identity can be determined more accurately.

In this embodiment, the user's short message sending situation recorded by the short message center can be used to count the failure rate of the user sending short messages for the first time in the rule time length. Specifically, the following process is used to complete: Calculate the number of short messages; 2) calculate the number of times that the user fails to send short messages for the first time in the rule duration; 3) calculate the ratio of the number of times that the first time the short message fails to send short messages to the number of all short messages, and use the ratio as The failure rate of the user sending short messages for the first time within the rule duration. This statistical method first takes out a monitoring rule, counts the short messages sent by the user based on the monitoring rule, and then takes out another monitoring rule when it is determined that there are other monitoring rules, and then counts the short messages sent by the user based on the monitoring rule. The number of messages is counted. This statistical method is relatively orderly and easy to implement.

As can be seen from the above scheme, the flow monitoring in this embodiment refers to monitoring the amount of short messages within a regular duration, and it uses the preset threshold for monitoring by flow as the monitoring basis, and is divided into simple flow monitoring and composite flow monitoring. Simple flow monitoring mainly refers to directly monitoring the preset threshold of monitoring by flow as the suspicious threshold, that is, when the amount of short messages sent by a user within the specified time is greater than or equal to the threshold of monitoring by flow, the corresponding user is considered as suspicious. Suspicious users, and then limit the behavior of suspicious users to send short messages. Composite traffic monitoring refers to follow-up monitoring combined with monitoring types on the basis of simple traffic monitoring, that is, to first judge whether the amount of short messages sent by users within the specified time reaches the threshold of traffic monitoring, and when the threshold of traffic monitoring is reached On this basis, follow-up monitoring is performed on the short messages that have been monitored within the specified time period according to different monitoring types.

The above-mentioned follow-up monitoring is relative to the real-time traffic monitoring. The follow-up monitoring is to further judge and analyze all the short messages sent by users who violate the pure flow monitoring within the time granularity before the end time of a time granularity. analyze. In the process of follow-up monitoring, the issue of monitoring type is involved. The monitoring type is one of the attributes in each monitoring rule, indicating which type the monitoring rule is based on. For subsequent monitoring, the monitoring type it includes It can be monitored by calling frequency, keyword frequency, number continuity, etc. Based on this, if the failure rate does not meet the ratio monitoring threshold, the above method also includes: obtaining the associated information of the short messages sent by the user within the rule duration, wherein the associated information includes at least one of the following: call frequency, content length consistency rate, key Word occurrence frequency and destination number continuity rate; among them, frequency of initiating calls, content length consistency rate, keyword occurrence frequency and destination number continuity rate are respectively configured with an association threshold; if one of the acquired association information satisfies the corresponding association threshold, Then it is determined that the user is a blacklist user. This monitoring method is more comprehensive, can accurately capture suspicious users, and both recall and precision can be guaranteed.

During actual implementation, the monitoring rules can be set in the following manner: the rule corresponding to the relationship between the number of short messages sent by the user and the traffic threshold in the statistical rule duration in the above-mentioned steps S102 is used as a parent rule, and the above-mentioned steps S104-S106 The relationship between the failure rate of the user's first short message delivery and the ratio monitoring threshold within the duration of the above rules is used as a sub-rule. The parent rule refers to a rule cluster. If rule A needs to be executed before rule B, it is called rule A. is the parent rule of rule B. The above simple traffic monitoring rule is the parent rule for subsequent monitoring. A sub-rule refers to a rule cluster. If rule A needs to be executed after rule B, then rule A is said to be a sub-rule of rule B. Subsequent monitoring is a sub-rule of the simple traffic monitoring rule.

The above-mentioned blacklist refers to users whose sending times exceed a certain threshold or send keywords exceeding a threshold within a certain period of time are defined as blacklist users, and the short message sending function will be turned off for this user. Compared with the blacklist, there is also a whitelist in the monitoring system, and the users in the whitelist are users who are not monitored, that is, no matter how the user sends a short message, they will not be monitored.

The determination method of the above-mentioned user identity can be applied in the short message monitoring method. First, the number of short messages sent by the user is counted based on the monitoring rules. After the threshold, within the end of the time granularity, record all the short messages sent by the user in the regular duration before the end time of the granularity; secondly, every time the user sends a short message, the number of failed calls/all short messages for the first time (equivalent to The calculation is performed on the basis of the failure rate of the first delivery of the short message by the above user, and when the calculated ratio reaches the monitoring threshold of the failure rate of the first delivery, the user is identified as a suspicious user. Further, the sending behavior of the suspicious user is restricted.

By introducing the judgment of the failure of the user's short message delivery for the first time, it is possible to effectively monitor the characteristics of some invalid numbers (shutdown, no such number, etc.) among the group sending and called numbers. If the proportion of terminal call failures is high, It is considered to be suspected of sending spam messages. Since the first delivery failure rate monitoring is based on traffic monitoring and screening, when configuring a lower traffic threshold, it can not only limit the behavior of sending spam messages at a lower frequency for a long time, but also avoid false monitoring. , while improving recall and precision. In a word, by judging the failure of the first delivery, a more comprehensive monitoring effect of capturing suspicious users is achieved, and at the same time, the overall performance of the short message monitoring system is improved.

Corresponding to the method for determining the user identity described above, this embodiment also provides a device for determining the user identity. As shown in Figure 2, the structural block diagram of the device for determining user identity according to the embodiment of the present invention, the device can be set in the short message monitoring system, and the device includes: traffic statistics module 22, failure rate statistics module 24, identity determination module 26. The following describes the structure of the above modules in detail:

Traffic statistics module 22, whether the number of short messages sent by the user in the time length of the statistics rule meets the traffic threshold; Failure rate statistics module 24, connected with the traffic statistics module 22, is used for if the result of traffic statistics module 22 statistics is the number of short messages The number meets the traffic threshold, and the failure rate of the user's first short message in the statistical rule time length; the identity determination module 26 is connected with the failure rate statistics module 24, and is used for if the structure of the failure rate statistics module 24 statistics is that the failure rate meets the ratio monitoring threshold , to determine that the user is a blacklist user.

The device of this embodiment can limit the behavior of continuously sending spam messages at a lower frequency for a long time by combining the monitoring of the failure rate statistics module 24 on the basis of traffic monitoring by the traffic statistics module 22, and can avoid false monitoring. The appearance of the system improves the recall rate and precision rate at the same time, solves the problem that the strategy for capturing suspicious users in related technologies is too simple, and the recall rate and precision rate have contradictions, and improves the overall performance of the short message monitoring system.

As shown in FIG. 3, the structural block diagram of the device for determining the preferred user identity according to the embodiment of the present invention, the above-mentioned device may also include: a configuration module 32, connected to the traffic statistics module 22 and the identity determination module 26, for configuring the first delivery The ratio monitoring threshold of the failure rate and at least one monitoring rule; wherein, the monitoring rule includes the rule duration, time granularity and traffic threshold monitored by traffic within the rule duration, and the rule duration is an integer multiple of the time granularity.

As shown in FIG. 4 , according to the structural block diagram of another device for determining a preferred user identity according to an embodiment of the present invention, the traffic statistics module 22 may include: a traffic statistics unit 222, which is connected with the configuration module 32, and is used when the configuration module 32 configures multiple When there are no monitoring rules, count and count the short messages sent by users based on each configured monitoring rule.

As shown in Figure 5 according to the structural block diagram of the failure rate statistical module 24 of the embodiment of the present invention, the failure rate statistical module 24 may include:

The number of short messages calculation unit 242 is used to calculate the number of all short messages sent by the user within the regular duration;

The number of times of failure calculation unit 244 is used to calculate the number of times that the user fails to send short messages for the first time within the rule duration;

The failure rate calculation unit 246 is connected with the number of short messages calculation unit 242 and the number of times of failure calculation unit 244, and is used to calculate the number of times that the number of failures calculation unit 244 calculates the number of failed short messages sent for the first time and all short messages calculated by the number of short messages calculation unit 242. The ratio of the number of messages, and the ratio is used as the failure rate of the user sending a short message for the first time within the rule time.

As shown in FIG. 6, a structural block diagram of another device for determining a preferred user identity according to an embodiment of the present invention, the above-mentioned device may also include:

Associated information obtaining module 62, is connected with failure rate statistics module 24, is used for if the failure rate of failure rate statistics module 24 statistics does not meet the ratio monitoring threshold, obtains the associated information of the short message that user sends in the rule duration, wherein, associated information is at least Including one of the following: call frequency, content length consistency rate, keyword appearance frequency and destination number continuity rate; among them, the origination call frequency, content length consistency rate, keyword appearance frequency and destination number continuity rate are respectively configured with an associated threshold ;

The identity reconfirmation module 64 is connected with the association information acquisition module 62, and is used to determine that the user is a blacklist user if one of the association information acquired by the association information acquisition module 62 meets the corresponding association threshold.

A detailed description will be given below in conjunction with a preferred embodiment, which combines the above-mentioned embodiments and preferred implementation modes.

In this preferred embodiment, another division method of the device for determining the above-mentioned user identity is provided, as shown in FIG. A preliminary analysis module 72 , a subsequent analysis module 74 , and a display module 76 . Among them, the configuration module 70 is used to configure the monitoring threshold of the failure rate for the first delivery, and configure at least one monitoring rule, wherein the monitoring rule includes: the threshold, rule duration and time granularity of traffic monitoring within the rule duration, and the rule duration is time Integer multiples of the granularity, and the configured monitoring rules are sent to the preliminary analysis module 72, and the configured user level monitoring threshold is sent to the follow-up analysis module 76; the preliminary analysis module 72 is connected with the configuration module 70 for user The number of short messages sent is counted. When the number of short messages sent by a user reaches the threshold of traffic monitoring within a specified time period within a time granularity, the user information of the user is recorded, and within the end of the time granularity, the end time of the record granularity is recorded. All short messages sent by the user in the previous rule duration are also sent to the follow-up analysis module 74; the follow-up analysis module 74 is connected with the configuration module 70 and the preliminary analysis module 72, and is used to calculate all short messages and the first number of times of terminal call failures, When calculating the number of failed calls/all short messages for the first time and reaching the monitoring threshold of the failure rate for the first time, the user is identified as a suspicious user; the display module 76 is connected with the follow-up analysis module 74 for displaying the user information of the suspicious user.

This preferred embodiment has increased the follow-up analysis module 74, namely introduced follow-up first delivery failure rate monitoring, so when configuring a lower traffic threshold, it can limit the behavior of continuously sending spam short messages with a lower frequency for a long time, and can also Avoid false monitoring, and improve the recall rate and precision rate at the same time, so as to achieve the purpose of improving the reliability of the monitoring system.

When the configuration module 70 has configured a plurality of monitoring rules, the preliminary analysis module 72 is specifically used to count the short messages sent by the user based on the configured monitoring rules, and more specifically, take out a monitoring rule, and based on the monitoring rule, respectively count the short messages sent by the user. The short messages sent are counted, and when it is determined that there are other monitoring rules, another monitoring rule is taken out, and the number of short messages sent by the user is counted based on the monitoring rule.

The follow-up analysis module 76 specifically includes: a calculation unit, used to calculate the number of all short messages sent by the user within a regular period of time and the number of failed call terminations for the first time; Compared with the first delivery failure rate monitoring threshold, when the calculated value reaches the first delivery failure rate monitoring threshold, the user is identified as a suspicious user.

Corresponding to the above short message monitoring system, this preferred embodiment also provides a short message monitoring system architecture. As shown in Figure 8, according to the schematic diagram of the structure of the short message monitoring system of the preferred embodiment of the present invention, the system includes:

Console (human-computer interaction interface) 80, is used for the configuration of data and the display of user information, promptly this console has combined the function of configuration module 70 and display module 76 in the short message monitoring system as shown in Figure 7, in On the console, you can configure data, such as monitoring rules and the configuration of the monitoring threshold for the failure rate of the first delivery, and display the user information of suspicious users monitored by the monitoring system. After the data configuration of the console is completed, it will be synchronized to the analysis module and the database management operation module.

Analysis module 82, its function is basically the same as the function of preliminary analysis module 72 in the short message monitoring system as shown in Figure 7, is used for being responsible for receiving the message of short message center, counts according to the monitoring rule of console configuration, when reaching When the parent rule configured by the console reaches the threshold of traffic monitoring, the user information of the user is sent to the database management operation module 84 to be inserted into the database 86 for the purpose of recording the user information. The user's short message sends all short messages sent by the intercepted user within the specified time period to the database management operation module within a time granularity, so as to record all short messages.

Database management operation module 86, the function of this module is basically the same as the function of follow-up analysis module 74 in the short message monitoring system as shown in Figure 7, is mainly used for inserting database 86 operations after receiving the data of analysis module 82, and Carry out follow-up analysis, follow-up analysis includes calling the stored procedure to take out the short message that this user sends in the database 86 within a regular period of time and calculate the number of failures of the first call termination, and judge whether the number of failures of the first call failure/all short messages reaches the first time. Delivery failure rate monitoring threshold.

Based on the above short message monitoring system and its architecture, this preferred embodiment also provides a short message monitoring method. As shown in Figure 9, according to the flow chart of the short message monitoring method of the preferred embodiment of the present invention, the method includes:

Step S900, configure the monitoring threshold for the failure rate of the first delivery, and configure at least one monitoring rule, wherein the monitoring rule includes: the threshold for traffic monitoring within the rule duration, rule duration and time granularity, and the rule duration is an integer multiple of the time granularity.

For the first delivery failure rate monitoring threshold, if multiple monitoring rules are configured, at least one of the three items of traffic monitoring threshold, rule duration, and time granularity is different for different monitoring rules. For example, two different monitoring rules are configured, and the parameters configured in one monitoring rule are: the threshold of monitoring by traffic is 100 short messages, and the rule duration is 10 minutes; the parameters configured in the other monitoring rule are: monitoring by traffic The threshold is 200 short messages, and the rule duration is 15 minutes.

Step S902, extracting one monitoring rule from at least one monitoring rule configured above. The retrieved monitoring rule will provide the basis for the following counting process.

Step S904, counting the number of short messages sent by the user, and judging in real time whether the number of short messages sent by the user within a time granularity reaches the threshold of monitoring according to the flow rate in the regular time period, if yes, then perform step S906; if not, then Finish.

Step S906, record the user information of the user, and record all short messages sent by the user within the regular time period before the end of the time granularity within the end of the time granularity.

Specifically, the recording of user information can be completed by inserting user information into the database using the database management module; similarly, the recording of short messages can be completed by inserting all short messages into the database using the database management module.

This process can be regarded as the simple flow monitoring in the above-mentioned composite flow monitoring, that is, it is only judged whether the number of short messages sent by the user within the specified time reaches the threshold of flow monitoring. In this process, the counting process of all users is carried out in the flow counting memory bank, that is, the counting records of users are stored in the flow memory bank, so before counting, the user's counting records should be initialized, if There is no counting record of the user in the traffic counting memory bank, and a counting record of the user needs to be generated in the traffic counting memory bank before the initialization setting, which is used to count the number of short messages sent by the user later.

Step S908, calculate the recorded number of failed first call terminations/number of all short messages, and when the calculated value reaches the monitoring threshold for the failure rate of the first delivery, identify the user as a suspicious user.

This process can be regarded as follow-up monitoring, that is, on the basis of simple traffic monitoring, the failure rate of the first delivery of short messages that have been monitored within the specified time period is monitored.

Step S910, displaying the user information of the above-mentioned suspicious user. For suspicious users, their behavior of sending short messages will be restricted, and the user information of the suspicious users will be displayed.

On the basis of flow monitoring, this preferred embodiment introduces subsequent first delivery failure rate monitoring, so when a lower flow threshold is configured, it can limit the behavior of continuously sending spam messages at a lower frequency for a long time, and can also Avoid false monitoring, improve recall and precision, and capture suspicious users more comprehensively.

It can be seen from step S900 of the above short message monitoring method that there may be multiple monitoring rules configured. When multiple monitoring rules are configured, the short messages sent by users will be counted based on each monitoring rule. For the case where there are multiple monitoring rules, the process of counting the traffic of a certain user in the short message monitoring method will be further described below in conjunction with FIG. 10 .

As shown in Figure 10, according to the flowchart of counting the short messages sent by users based on multiple monitoring rules according to the preferred embodiment of the present invention, when there are multiple monitoring rules, the process of counting the short messages sent by users includes:

Step S1002, obtaining the short message controlled structure from the short message center, and analyzing the originating user number according to the short message controlled structure;

Step S1004, the analyzing module takes out one monitoring rule from the multiple monitoring rules;

Step S1006, counting the short messages sent by the calling user based on the monitoring rule, that is, adding one to the counting value of the monitoring rule at the time granularity of the calling user (the counter does not overflow under normal circumstances);

Step S1008, judging whether the short message count value reaches the threshold of traffic monitoring, if so, proceed to step S1010, if not, proceed to step S1012;

Step S1010, record the user number of the user who made the call, and record all short messages sent by the user within the regular time period before the end of the time granularity within the end of the time granularity. Specifically, the user number and all short messages can be sent to the database The management operation module is realized by the way it completes the operation of inserting into the database;

Step S1012, judging whether there are other monitoring rules, if yes, return to step S1004.

Through this preferred embodiment, it is realized that in the process of traffic monitoring, multiple monitoring rules can be configured to monitor the short messages sent by users, thus effectively improving the intensity of monitoring.

It can be known from the foregoing description that follow-up monitoring includes various types of monitoring, such as monitoring by content length consistency, keyword frequency monitoring, and number continuity monitoring. Therefore, the following will take the monitoring type as monitoring based on the failure rate of the first delivery as an example to further describe the short message monitoring method, which includes:

Step 1. First, configure the monitoring rules on the human-computer interaction interface of short message monitoring, including configuring the parent rule-the threshold of traffic monitoring, that is, when the short message sent by a certain number within the rule duration reaches this value, the Perform follow-up monitoring; then configure the sub-rule - the first delivery failure rate monitoring threshold. After the configuration is completed, the configured above parameters are synchronized to the analysis module and the database management operation module.

Step 2. Initialize the counting records of users in the traffic counting memory bank. If there are different monitoring rules, the counting records counted based on each rule must be initialized. Of course, if the traffic counting memory does not exist in the User’s counting record, a counting record of the user should be generated in the traffic counting memory bank before initialization.

Step 3: Obtain the controlled structure of the short message to be monitored, which must contain user information such as the calling user number, message body, and whether the first call fails.

Step 4: According to the obtained controlled structure of the short message, the number of the calling party is analyzed, and the number of the calling party is counted in the traffic counting memory base based on each monitoring rule within the time granularity.

Step 5, when within a time granularity, the count value in the traffic counting memory bank reaches the subrule - the parent rule of the first delivery failure rate monitoring threshold - the threshold of traffic monitoring, the user information of the user is sent to the database The management operation module stores the physical database for the purpose of recording the user information of the user.

Step 6, when the granularity end time mentioned above in step 5 is reached, record all the short messages sent by the user within the regular duration before the granularity end time, that is, the user will move forward one step between the granularity end time and the granularity end time All short messages sent within the time range of the regular duration, that is, within a regular duration, notify the database management operation module, and the database management operation module inserts all short messages into the database.

Step 7, the database management operation module calls the stored procedure to take out all the short messages sent by the user within a regular time period in the physical database for calculation. For the monitoring of the failure rate of the first delivery, it is necessary to sum all the short messages separately , The number of times of first-time call-out failures is summed, and it is judged whether the value obtained from the number of times of first-time call-out failures/the number of all short messages reaches the monitoring threshold for the failure rate of the first delivery. If so, the user is identified as a suspicious user, and the The user information of the suspicious user is sent to the display module for display, and his behavior of sending short messages will be restricted. If not, it indicates that the corresponding user is not a suspicious user, and the behavior of sending short messages will not be restricted.

The first delivery failure rate monitoring involved in this preferred embodiment is the follow-up monitoring in composite traffic monitoring, which is not only applicable to the monitoring type of the first delivery failure rate, but also applicable to the monitoring type of content length consistency monitoring , monitoring by keyword frequency, monitoring by number continuity and other composite traffic monitoring, we will not describe them one by one here.

As can be seen from the above description, the present invention has achieved the following technical effects: the introduction of the judgment of the first delivery failure of the user's short message can be aimed at group sending, and there may be some invalid numbers (shutdown, no such number, etc.) in the called number. ) features are effectively monitored, and if the proportion of final call failures is high, it is considered that there is a suspicion of sending spam messages. Since the first delivery failure rate monitoring is based on traffic monitoring and screening, when configuring a lower traffic threshold, it can not only limit the behavior of sending spam messages at a lower frequency for a long time, but also avoid false monitoring. , while improving the recall rate and precision rate, thereby improving the reliability of the system.

To sum up, it can be seen that this embodiment solves the problem that the strategy for capturing suspicious users in related technologies is too simple and the recall rate and precision rate are contradictory by combining the monitoring of the initial failure rate on the basis of traffic monitoring. Improve the overall performance of the short message monitoring system.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned present invention can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present invention is not limited to any specific combination of hardware and software.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (11)

1. A method for determining user identity, comprising: Whether the number of short messages sent by users within the duration of the statistical rule meets the traffic threshold; If yes, count the failure rate of the first short message sent by the user in the rule duration; If the failure rate meets the ratio monitoring threshold, it is determined that the user is a blacklist user. 2. method according to claim 1, it is characterized in that, before the number of short messages sent by the user in the statistical rule duration meets the traffic threshold, the method also includes: Configure the ratio monitoring threshold of the failure rate of the first delivery and at least one monitoring rule; wherein, the monitoring rule includes a rule duration, a time granularity, and a traffic threshold monitored by traffic within the rule duration, and the rule duration is the time granularity Integer multiples of . 3. The method according to claim 2, characterized in that whether the number of short messages sent by the user in the statistical rule duration meets the traffic threshold comprises: When multiple monitoring rules are configured, the short messages sent by the user are counted and counted based on each configured monitoring rule. 4. method according to claim 3, it is characterized in that, based on each monitoring rule of configuration, counting the short message sent by user respectively comprises: selecting a monitoring rule from the plurality of monitoring rules one by one; Taking time granularity as the unit, counting the number of short messages sent by the user within the rule duration of the selected monitoring rule; If the count of the user in the current time granularity reaches the traffic threshold, then determine that the number of short messages of the user in the rule duration satisfies the traffic threshold; Continue to select the next monitoring rule for counting until the multiple monitoring rules are selected. 5. The method according to claim 1, characterized in that, counting the failure rate of the first short message sent by the user within the rule duration comprises: Calculate the number of all short messages sent by the user within the rule duration; Calculate the number of times that the user fails to send short messages for the first time within the rule duration; Calculate the ratio of the number of times of failure to send short messages for the first time to the number of all short messages, and use the ratio as the failure rate of the user's first delivery of short messages within the regular time period. 6. The method according to any one of claims 1-5, wherein if the failure rate does not meet the ratio monitoring threshold, the method further comprises: Obtaining the associated information of the short message sent by the user within the specified duration, wherein the associated information includes at least one of the following: call frequency, content length consistency rate, keyword occurrence frequency, and destination number continuity rate; wherein, The calling frequency, the content length consistency rate, the keyword occurrence frequency and the destination number continuity rate are respectively configured with an associated threshold; If any of the association information satisfies a corresponding association threshold, it is determined that the user is a blacklist user. 7. A device for determining a user identity, comprising: The traffic statistics module is used to count whether the number of short messages sent by users within the rule period meets the traffic threshold; A failure rate statistics module, used to count the failure rate of the first short message sent by the user within the rule duration if the statistics result of the traffic statistics module is that the number of short messages satisfies the traffic threshold; The identity determination module is configured to determine that the user is a blacklist user if the failure rate statistical module counts the structure that the failure rate meets the ratio monitoring threshold. 8. The device according to claim 7, further comprising: A configuration module, configured to configure the ratio monitoring threshold of the failure rate of the first delivery and at least one monitoring rule; wherein, the monitoring rule includes a rule duration, a time granularity, and a traffic threshold monitored by traffic within the rule duration, and the rule duration It is an integer multiple of the time granularity. 9. The device according to claim 8, wherein the traffic statistics module comprises: The traffic statistics unit is used for counting and counting the short messages sent by the user based on each configured monitoring rule when the configuration module configures multiple monitoring rules. 10. The device according to claim 7, wherein the failure rate statistics module comprises: A short message number calculation unit, configured to calculate the number of all short messages sent by the user within the regular time period; The number of failure calculation unit is used to calculate the number of times that the user fails to send short messages for the first time within the rule duration; A failure rate calculation unit, configured to calculate the ratio of the number of failed short messages delivered for the first time calculated by the failure times calculation unit to the number of all short messages calculated by the number of short messages calculation unit, and use the ratio as The failure rate of the user sending a short message for the first time within the rule duration. 11. The device according to any one of claims 7-10, wherein the device further comprises: An associated information acquisition module, configured to obtain associated information of short messages sent by the user within the rule duration if the failure rate counted by the failure rate statistics module does not meet the ratio monitoring threshold, wherein the associated information is at least Including one of the following: call frequency, content length consistency rate, keyword appearance frequency and destination number continuity rate; wherein, the call origination frequency, the content length consistency rate, the keyword appearance frequency and the destination number The continuity rate is configured with an associated threshold respectively; An identity reconfirmation module, configured to determine that the user is a blacklisted user if one of the associated information obtained by the associated information obtaining module satisfies a corresponding associated threshold.

Images