CN102946400A - Safety filtering method and system for mass short message content based on behavioural analysis - Google Patents
Safety filtering method and system for mass short message content based on behavioural analysis Download PDFInfo
- Publication number
- CN102946400A CN102946400A CN2012104981002A CN201210498100A CN102946400A CN 102946400 A CN102946400 A CN 102946400A CN 2012104981002 A CN2012104981002 A CN 2012104981002A CN 201210498100 A CN201210498100 A CN 201210498100A CN 102946400 A CN102946400 A CN 102946400A
- Authority
- CN
- China
- Prior art keywords
- note
- short message
- information
- messages
- batch
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Abstract
The invention discloses a safety filtering method and a system for mass short message content based on behavioural analysis. The method includes extracting one of mass short messages which are sent from the same terminal and have the same content as the short message to be verified, performing a first sensitive word matching on the short message to be verified, and if the matching successes, determining the mass short messages not to pass; if the matching fails, performing user behavioural analysis on the short message to be verified, verifying whether behavioural information of a sender accords with general information, if yes, determining the mass short message to pass, otherwise performing a second sensitive word matching, if the matching successes, determining the mass short message to pass, and otherwise determining the mass short message to pass. According to the method and the system, not only the filtering performance of the short messages is improved, but also the filtering efficiency is high, and a safe information environment can be provided for communication users.
Description
Technical field
The present invention relates to moving communicating field, relate in particular to a kind of magnanimity short message content safety filtering method and system based on behavioural analysis.
?
Background technology
Along with the develop rapidly of science and technology, people more and more rely on high-tech product, and particularly the utilization rate to mobile phone and network is more and more higher.Mobile phone and network are providing a lot of informationizations also to have easily a lot of potential safety hazards simultaneously to us; junk information also increases increasingly; such as usually receiving in the mobile phone that content relates to the refuse messages such as advertisement, yellow information or reaction advertisement information; particularly might receive the note of swindle content, our daily life is caused certain interference.
In the prior art, technology that magnanimity information is filtered occurred, but technique filters to the keyword of the information content simply just, and be one by one note to be filtered, cause its performance low.
In view of this, prior art haves much room for improvement and improves.
Summary of the invention
In view of the deficiencies in the prior art, the object of the present invention is to provide a kind of magnanimity short message content safety filtering method and system based on behavioural analysis, be intended to and the low problem of the performance that occurs in the filtering technique based on keyword that exists in the prior art is improved, a kind of method and system that can the high-rate fitration short message content is provided.
Technical scheme of the present invention is as follows:
A kind of magnanimity short message content safety filtering method based on behavioural analysis wherein, may further comprise the steps:
Extract one as note to be verified the identical messages in batch of S1, the content that sends from same terminal;
S2, described note to be verified is carried out sensitive word first coupling, if the match is successful, judge that then messages in batch does not pass through, otherwise carry out step S3;
S3, note to be verified is carried out user behavior analysis, whether checking sender's behavioural information is consistent with common information, if unanimously then judge that messages in batch passes through, otherwise carries out step S4;
S4, note to be verified is carried out sensitive word second coupling, if the match is successful, judge that then messages in batch does not pass through, otherwise judge that messages in batch passes through.
Described a kind of magnanimity short message content safety filtering method based on behavioural analysis, wherein, among the described step S3, sender's behavioural information comprises: note transmitting time, IP address, browser information and transmission object information.
Described a kind of magnanimity short message content safety filtering method based on behavioural analysis, wherein, among the described step S3 user behavior analysis is specifically comprised: two and common information inconsistency are arranged in note transmitting time, IP address, browser information and transmission object information, then be considered as inconsistent.
Described a kind of magnanimity short message content safety filtering method based on behavioural analysis, wherein, described sensitive word the second coupling is the sensitive word fuzzy matching.
A kind of magnanimity short message content safety filtering system based on behavioural analysis, wherein, described system comprises:
Abstraction module, the identical messages in batch of content that is used for sending from same terminal extracts one as note to be verified;
The first matching module is used for described note to be verified is carried out sensitive word the first coupling, if the match is successful, judges that then messages in batch does not pass through, and analyzes otherwise send into described behavioural analysis module;
The behavioural analysis module is used for note to be verified is carried out user behavior analysis, and whether checking sender's behavioural information is consistent with common information, if unanimously then judge that messages in batch passes through, analyzes otherwise send into described the second matching module;
The second matching module is used for note to be verified is carried out sensitive word the second coupling, if the match is successful, judges that then messages in batch does not pass through, otherwise judges that messages in batch passes through.
Described magnanimity short message content safety filtering system based on behavioural analysis, wherein, in the described behavioural analysis module, sender's behavioural information comprises: note transmitting time, IP address, browser information and transmission object information.
Described magnanimity short message content safety filtering system based on behavioural analysis, wherein, in the described behavioural analysis module user behavior analysis is specifically comprised: two and common information inconsistency are arranged in note transmitting time, IP address, browser information and transmission object information, then be considered as inconsistent.
Beneficial effect: a kind of magnanimity short message content safety filtering method and system based on behavioural analysis provided by the invention, common carrier adopts wherein arbitrary note of same batch is carried out the processing of sensitive word exact matching, and the usage behavior analytical technology is not to verifying by the note of sensitive word coupling, carry out the sensitive word fuzzy matching to wherein having user behavior and the common inconsistent note of behavior, thereby the magnanimity short message content is filtered layer by layer, removing wherein, content contains swindle, yellow, the refuse messages of promoting is for the communication network user provides a safe and reliable information environment.
Description of drawings
Fig. 1 is a kind of magnanimity short message content safety filtering method flow diagram based on behavioural analysis of the application.
Fig. 2 is the structure principle chart of a kind of magnanimity short message content safety filtering system based on behavioural analysis of the application.
Embodiment
For making purpose of the present invention, technical scheme and advantage clearer, clear and definite, developing simultaneously referring to accompanying drawing, the present invention is described in more detail for embodiment.Should be appreciated that specific embodiment described herein only in order to explain the present invention, is not intended to limit the present invention.
As shown in Figure 1, the magnanimity short message content safety filtering method based on behavioural analysis that most preferred embodiment of the present invention provides, it may further comprise the steps:
Extract one as note to be verified the identical messages in batch of S1, the content that sends from same terminal.
Common carrier is processed the identical messages in batch of content that sends from same terminal, therefrom extracts one as note to be verified.Concrete, the port that sends from messages in batch or PTN and the time of sending determine whether the identical messages in batch of content that sends from same terminal.If messages in batch that send from same port or PTN and that send for the same time, the content that can be judged to be note is identical.Because short message content is identical, so can therefrom extract arbitrarily a note out, as note to be verified, thereby the workload of minimizing filtration system is raised the efficiency.
S2, described note to be verified is carried out sensitive word first coupling, if the match is successful, judge that then messages in batch does not pass through, otherwise carry out step S3.
The note that above-mentioned steps is extracted out is carried out sensitive word the first coupling.Described the first coupling is for carrying out exact matching to the sensitive word that occurs in the short message content.
The technology of exact matching has appearred much sensitive word being carried out in the prior art, mainly contain plain text search and replacement, DFA algorithm (also claiming the automaton algorithm) and TTMP algorithm (character string multi-mode exact matching) etc., its core is for setting up a responsive dictionary in system, then based on this sensitivity dictionary target text is carried out sensitive word and extract operation, therefore unique difference of each automation processing mode just is the difference of sensitive word extraction algorithm, because algorithm is different, efficient is different, the result also may be different.
Preferred in this method and system, use DFA algorithm of the prior art that short message content is carried out the sensitive word exact matching, use this algorithm that the word of short message content is filtered one by one, check wherein whether exist in the dictionary that sensitive word forms, in case there is the word that occurs in the responsive dictionary in the discovery short message content, then this time the match is successful, thinks that then this batch note contains the information of dangerous or rubbish, judges that this batch note do not pass through.If do not find sensitive word, judge and this time to mate unsuccessfully, then this note is carried out processing in next step S3 step.
S3, note to be verified is carried out user behavior analysis, whether checking sender's behavioural information is consistent with common information, if unanimously then judge that messages in batch passes through, otherwise carries out step S4.
To in the above-mentioned steps with responsive dictionary in the unmatched note of sensitive word carry out user behavior analysis.Described user behavior analysis is analyzed for the behavior that the user is shown usually, therefrom obtains the general behavior track of user, this user's behavior and the behavior before it is compared, thereby predict whether this note sends unusual.
Concrete, the content of user behavior analysis comprises: note transmitting time, IP address, browser information and transmission object information etc. are analyzed.
Common carrier can inquire and send batch short-message users at the historical record that uses signal intelligence, find following information from historical record: note sends roughly time period, IP address information, browser information and transmission object information etc. before this user, and these information and the time of this transmission batch information, IP address, browser information and the transmission object of use are compared.Detailed contrast is: whether the time that the user sends note is and be close in the past, whether identical the IP address of using is, whether consistent the browser that uses is, whether the object that sends is with identical or near identical before, if keeping with before record is consistent more than two, judge then that this batch short message sends and pass through, otherwise, carry out next step processing.
For example: if the time of this time messages in batch transmission is points in the mornings 10, use before this this IP address to send the time of messages in batch too as between 9 o'clock to the 11 o'clock morning, and the quantity of Batch sending note is between the 40-60 bar before this, this is 50, the then this time transmission of messages in batch of this user and being recorded to rare these 3 and being consistent before this, judge that this short message sends and pass through, the time of this IP address transmission messages in batch is about 1:00 AM else if, Batch sending note quantity is 300, judge that then this time to send note inconsistent with record before this, can not be by checking, this need to be verified that note carries out next step checking and process.
S4, note to be verified is carried out sensitive word second coupling, if the match is successful, judge that then messages in batch does not pass through, otherwise judge that messages in batch passes through.
The checking note of not passing through in step S3 is carried out again processing, and this is treated to the content of note is carried out the second coupling, and its concrete content is for to carry out the sensitive word fuzzy matching to short message content.The coupling of the algorithm that this time uses for the sensitive word in the short message content is blured, the replacement word of adding sensitive word, forbidding word, warning word in responsive dictionary are if exist the substitute of sensitive word in the short message content.Like this, can be detected too even occurred punctuation mark in the sensitive word.
Short message content is carried out sensitive word the second coupling, if match the substitute that occurs sensitive word in the short message content or the forbidding word occurs, judge that then the match is successful, contain sensitive word in this short message content, judge that bulk information does not pass through.If mate unsuccessfully, then the decision verification short message content is safe, and this batch note is by checking.
A kind of magnanimity short message content safety filtering method based on behavioural analysis provided by the invention, by extracting one as note to be verified to appointing in the messages in batch, this checking note is carried out sensitive word the first coupling, one or multinomial checking in user behavior analysis and sensitive word the second coupling, and then determine the user of whether containing sensitive word and/or this Batch sending note in this checking note and whether be consistent with before record, final decision goes out whether this checking note is security information, the result who verifies thus note judges whether this batch note is security information, thereby the information environment of a safety is provided for the user.
The present invention also provides a kind of magnanimity short message content safety filtering system based on behavioural analysis, and as described in Figure 2, it specifically comprises following part:
The identical messages in batch of content that abstraction module 110 is used for sending from same terminal extracts one as note to be verified, one of arbitrary extracting in the messages in batch of same content is verified, greatly reduce the workload of system, improved the efficient of authorization information.Concrete identical with step S1.
The first matching module 120 is used for described note to be verified is carried out sensitive word the first coupling, if the match is successful, judges that then messages in batch does not pass through, and analyzes otherwise send into described behavioural analysis module.
The first matching module 120 is used for the note to be verified that abstraction module 110 extracts is carried out sensitive word the first coupling, concrete, described sensitive word the first coupling is the sensitive word exact matching, in the first matching module, be provided with responsive dictionary and sensitive word exact matching algorithm, in the present embodiment, this algorithm is that DFA algorithm of the prior art is compared one by one to the word in the content in this checking note, whether the word that detects wherein is relevant with sensitive word, if the match is successful, verifying therewith then that same batch of relevant note of note is judged as wherein contains the sensitiveness word, can not be by checking.If it fails to match then this authorization information is sent to the checking of carrying out next step in the behavioural analysis module.Concrete, the function of the first matching module 120 is identical with step S2.
Behavioural analysis module 130 is used for note to be verified is carried out user behavior analysis, and whether checking sender's behavioural information is consistent with common information, if unanimously then judge that messages in batch passes through, analyzes otherwise send into described the second matching module.Concrete identical with step S3 in the said method.
Behavioural analysis module 130 is used for the first matching module 120 checking note that it fails to match that receives is carried out user behavior analysis.The content of described user behavior analysis comprises: when note transmitting time, IP address, browser information and transmission object information.
A kind of magnanimity short message content safety filtering method and system based on behavioural analysis provided by the invention, by adopting in batches filtration and user behavior analysis the magnanimity short message content to be carried out the filtration of safety high speed, not only improved the performance of filtering short message, and its efficient compare with prior art in only adopt the method that keyword is filtered to improve a lot.System disclosed by the invention can provide a safer information environment for communication user.
Should be understood that application of the present invention is not limited to above-mentioned giving an example, for those of ordinary skills, can be improved according to the above description or conversion that all these improvement and conversion all should belong to the protection range of claims of the present invention.
Claims (7)
1. the magnanimity short message content safety filtering method based on behavioural analysis is characterized in that, may further comprise the steps:
Extract one as note to be verified the identical messages in batch of S1, the content that sends from same terminal;
S2, described note to be verified is carried out sensitive word first coupling, if the match is successful, judge that then messages in batch does not pass through, otherwise carry out step S3;
S3, note to be verified is carried out user behavior analysis, whether checking sender's behavioural information is consistent with common information, if unanimously then judge that messages in batch passes through, otherwise carries out step S4;
S4, note to be verified is carried out sensitive word second coupling, if the match is successful, judge that then messages in batch does not pass through, otherwise judge that messages in batch passes through.
2. described magnanimity short message content safety filtering method based on behavioural analysis according to claim 1 is characterized in that among the described step S3, sender's behavioural information comprises: note transmitting time, IP address, browser information and transmission object information.
3. described magnanimity short message content safety filtering method based on behavioural analysis according to claim 2, it is characterized in that, among the described step S3 user behavior analysis is specifically comprised: two and common information inconsistency are arranged in note transmitting time, IP address, browser information and transmission object information, then be considered as inconsistent.
4. described magnanimity short message content safety filtering method based on behavioural analysis according to claim 1 is characterized in that, described sensitive word the second coupling is the sensitive word fuzzy matching.
5. magnanimity short message content safety filtering system based on behavioural analysis is characterized in that described system comprises:
Abstraction module, the identical messages in batch of content that is used for sending from same terminal extracts one as note to be verified;
The first matching module is used for described note to be verified is carried out sensitive word the first coupling, if the match is successful, judges that then messages in batch does not pass through, and analyzes otherwise send into described behavioural analysis module;
The behavioural analysis module is used for note to be verified is carried out user behavior analysis, and whether checking sender's behavioural information is consistent with common information, if unanimously then judge that messages in batch passes through, analyzes otherwise send into described the second matching module;
The second matching module is used for note to be verified is carried out sensitive word the second coupling, if the match is successful, judges that then messages in batch does not pass through, otherwise judges that messages in batch passes through.
6. described magnanimity short message content safety filtering system based on behavioural analysis according to claim 5 is characterized in that in the described behavioural analysis module, sender's behavioural information comprises: note transmitting time, IP address, browser information and transmission object information.
7. described magnanimity short message content safety filtering system based on behavioural analysis according to claim 6, it is characterized in that, in the described behavioural analysis module user behavior analysis is specifically comprised: two and common information inconsistency are arranged in note transmitting time, IP address, browser information and transmission object information, then be considered as inconsistent.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210498100.2A CN102946400B (en) | 2012-11-29 | 2012-11-29 | The magnanimity short message content safety filtering method and system that a kind of Behavior-based control is analyzed |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210498100.2A CN102946400B (en) | 2012-11-29 | 2012-11-29 | The magnanimity short message content safety filtering method and system that a kind of Behavior-based control is analyzed |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102946400A true CN102946400A (en) | 2013-02-27 |
| CN102946400B CN102946400B (en) | 2016-03-09 |
Family
ID=47729307
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210498100.2A Active CN102946400B (en) | 2012-11-29 | 2012-11-29 | The magnanimity short message content safety filtering method and system that a kind of Behavior-based control is analyzed |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102946400B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105160268A (en) * | 2015-08-06 | 2015-12-16 | 武汉亚星电子技术有限责任公司 | Data tracking and monitoring system, intelligent router and data tracking and monitoring method for intelligent router |
| WO2018054061A1 (en) * | 2016-09-22 | 2018-03-29 | 中兴通讯股份有限公司 | Short message recognition method, device, system and computer storage medium |
| CN109558592A (en) * | 2018-11-29 | 2019-04-02 | 上海点融信息科技有限责任公司 | The method and apparatus of customer Credit Risk assessment information is obtained based on artificial intelligence |
| CN110996272A (en) * | 2019-11-05 | 2020-04-10 | 武汉普斯顿网络科技有限公司 | Game service verification method, device, equipment and medium |
| CN112383887A (en) * | 2020-11-02 | 2021-02-19 | 安徽泡泡云信息技术服务有限公司 | Short message pushing system based on artificial intelligence |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070254683A1 (en) * | 2006-04-27 | 2007-11-01 | Guo Chang Jie | Method and apparatus for filtering short message system spam |
| CN101137087A (en) * | 2007-08-01 | 2008-03-05 | 浙江大学 | Short message monitoring center and monitoring method |
| CN101477544A (en) * | 2009-01-12 | 2009-07-08 | 腾讯科技（深圳）有限公司 | Rubbish text recognition method and system |
| US20100036918A1 (en) * | 2008-08-11 | 2010-02-11 | Embarq Holdings Company, Llc | Message filtering system |
| CN102547621A (en) * | 2010-12-23 | 2012-07-04 | 中国移动通信集团公司 | System and device as well as method for monitoring and processing junk short messages |
| CN102790752A (en) * | 2011-05-20 | 2012-11-21 | 盛乐信息技术（上海）有限公司 | Fraud information filtering system and method on basis of feature identification |
-
2012
- 2012-11-29 CN CN201210498100.2A patent/CN102946400B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20070254683A1 (en) * | 2006-04-27 | 2007-11-01 | Guo Chang Jie | Method and apparatus for filtering short message system spam |
| CN101137087A (en) * | 2007-08-01 | 2008-03-05 | 浙江大学 | Short message monitoring center and monitoring method |
| US20100036918A1 (en) * | 2008-08-11 | 2010-02-11 | Embarq Holdings Company, Llc | Message filtering system |
| CN101477544A (en) * | 2009-01-12 | 2009-07-08 | 腾讯科技（深圳）有限公司 | Rubbish text recognition method and system |
| CN102547621A (en) * | 2010-12-23 | 2012-07-04 | 中国移动通信集团公司 | System and device as well as method for monitoring and processing junk short messages |
| CN102790752A (en) * | 2011-05-20 | 2012-11-21 | 盛乐信息技术（上海）有限公司 | Fraud information filtering system and method on basis of feature identification |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105160268A (en) * | 2015-08-06 | 2015-12-16 | 武汉亚星电子技术有限责任公司 | Data tracking and monitoring system, intelligent router and data tracking and monitoring method for intelligent router |
| CN105160268B (en) * | 2015-08-06 | 2018-06-01 | 武汉亚星电子技术有限责任公司 | Data tracking and monitoring system, intelligent router and its data tracking monitoring method |
| WO2018054061A1 (en) * | 2016-09-22 | 2018-03-29 | 中兴通讯股份有限公司 | Short message recognition method, device, system and computer storage medium |
| CN109558592A (en) * | 2018-11-29 | 2019-04-02 | 上海点融信息科技有限责任公司 | The method and apparatus of customer Credit Risk assessment information is obtained based on artificial intelligence |
| CN110996272A (en) * | 2019-11-05 | 2020-04-10 | 武汉普斯顿网络科技有限公司 | Game service verification method, device, equipment and medium |
| CN110996272B (en) * | 2019-11-05 | 2021-10-22 | 武汉普斯顿网络科技有限公司 | Game service verification method, device, equipment and medium |
| CN112383887A (en) * | 2020-11-02 | 2021-02-19 | 安徽泡泡云信息技术服务有限公司 | Short message pushing system based on artificial intelligence |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102946400B (en) | 2016-03-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109960729B (en) | Method and system for detecting HTTP malicious traffic | |
| CN109547409B (en) | Method and system for analyzing industrial network transmission protocol | |
| CN104462509A (en) | Review spam detection method and device | |
| CN102647422B (en) | Phishing website detection method and device | |
| CN110661680B (en) | Method and system for detecting data stream white list based on regular expression | |
| CN108491720B (en) | Application identification method, system and related equipment | |
| CN102946400A (en) | Safety filtering method and system for mass short message content based on behavioural analysis | |
| CN102523223B (en) | Trojan detection method and apparatus thereof | |
| CN107229638A (en) | A kind of text message processing method and device | |
| CN102571767A (en) | File type recognition method and file type recognition device | |
| CN103415004B (en) | A kind of method and device detecting junk short message | |
| CN106953855B (en) | Method for intrusion detection of GOOSE message of IEC61850 digital substation | |
| CN102158428A (en) | Rapid and high-accuracy junk mail filtering method | |
| CN113704328B (en) | User behavior big data mining method and system based on artificial intelligence | |
| CN104484407A (en) | Method and system for recognizing fraud information | |
| CN103309937A (en) | Method of supervising content of cloud platform | |
| CN102355517A (en) | Information classification apparatus, information classification method and terminal | |
| CN110868404A (en) | Industrial control equipment automatic identification method based on TCP/IP fingerprint | |
| CN110445750A (en) | A kind of car networking protocol traffic recognition methods and device | |
| CN103220277A (en) | Method, device and system for monitoring cross site scripting attacks | |
| Chen et al. | Intrusion detection system based on immune algorithm and support vector machine in wireless sensor network | |
| CN105592087A (en) | DNP abnormity detection method based on vector machine learning | |
| CN103246846A (en) | Method and device for detecting safety of customized ROM (read only memory) | |
| CN104917757A (en) | Event-triggered MTD protection system and method | |
| CN116781347A (en) | Industrial Internet of things intrusion detection method and device based on deep learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C56 | Change in the name or address of the patentee | ||
| CP03 | Change of name, title or address |
Address after: 528400, Guangdong, Zhongshan, four East Road, Zhongshan, 88, Shang Feng finance business center 5, one of the 18 layers Patentee after: All pass education group (Guangdong) Limited by Share Ltd Address before: 528400 Guangdong City, east of the East Bank of the library on the 1st comprehensive commercial building, the first floor of the fifth floor, Zhongshan Patentee before: Guangdong Qtone Education Co., Ltd. |