CN104301896A - Intelligent fraud short message monitor and alarm system and method - Google Patents

Abstract

The invention discloses an intelligent fraud short message monitor and alarm system. After the system converges short message service signaling data and location updating service signaling data of mobile users of network elements in a kernel mobile network, real-time matching monitor of various intelligent analysis models is carried out on short message data of the users, useful signaling data are stored in a database, suspected fraud short messages are confirmed, an alarm message is sent to potential fooled users, and the potential fooled users are warned in advance in time. The system is provided with a signaling data converging assembly, an intelligent monitor service processing assembly, an intelligent monitor management assembly, an intelligent alarm assembly and the intelligent monitor service database. The invention further discloses an intelligent fraud short message monitor and alarm method. According to the technical scheme, fraud short messages can be recognized rapidly, an alarm is given in time once fraud short messages are confirmed, the potential fooled users of fraud short messages are reminded in time through messages, and economic losses of users are reduced to the greatest extent.

Description

Swindle short message intelligent monitoring warning system and method

Technical field

The present invention relates to a kind of swindle short message intelligent monitoring warning system and method, belong to the technical field of network security.

Background technology

Along with the fast development of China's mobile communication, SMS has become the information communication mode that people generally use.In recent years, some lawless persons utilize SMS to propagate deceptive information and defraud of money, and have had a strong impact on the normal life order of broad masses of the people, have become the new delinquent problem of disturbing public order.The harm of swindle note is very serious, causes the economic loss of people on the one hand, has a strong impact on the harmonious development of society on the other hand especially.Ministry of Industry and Information and Telecom Carriers also take regulator measure for short message fraud, but, the mode of swindle note is also in continuous change, its swindle form emerges in an endless stream, mainly carry out distribution information with various content-forms such as getting the winning number in a bond, transfer accounts, recent new fraudulent mode of carrying out swindling with pseudo-base station form, has had a strong impact on the proper communication environment of the people especially simultaneously.

At present, for swindle note carry out the system and method that identifies mainly concentrate have several as follows, but all there are some defects in these methods, is described as follows:

Note analysis rule based on system is analyzed doubtful number and is formed number storehouse: note identification module identifies doubtful swindle note according to swindle note rule, and produce reminding short message, after reminding short message being sent to note system via SMS transmission module again, be transmitted to user (mobile terminal); Meanwhile, system produces anti-swindle note number storehouse, and reports to the whole network number storehouse in real time.The method in this employing note rule analysis number storehouse, does not describe note analytical method in detail, is just illustrated for analysis process; Do not analyze different business scenarios yet, its identify the authenticity of doubtful swindle note or function all still to be tested.Moreover SMS Tip does not have artificial configuration mode, suggestion content can not be selected.

Keywords matching mode identification swindle note based on mobile phone terminal: receive short message content by mobile phone terminal and carry out mating comparative analysis with preset note keyword database, if the keyword that mobile phone terminal analyzes this note mates entirely, then directly filter or delete this note, as note keyword be semi-match time, then this note is classified as doubtful swindle note, and sends SMS Tip based on preset Familiarity Number.In addition, keywords database wants real-time update, and mobile phone terminal upgrades keywords database to local by the webserver in real time or off and on.The webserver is reported to the police by Alarm Server according to the swindle note identified.This analysis carrying out swindling short message content based on keyword by mobile phone terminal judges, for the renewal frequency of keywords database and effect also still to be tested.In addition, if swindle information sends to Familiarity Number simultaneously, secondary waste note can be produced.Its type of alarm is reported to the police by server, if mobile phone terminal data network condition of contact bad (as user do not open data cube computation operation or the data field network coverage of communication network bad time), then can not Real-time Alarm.

Carry out source code based on note and determine user, or realize identifying swindle note according to the report number frequency: by the short message content of transmit leg, add note for note and carry out source code, for determining the feature of transmit leg user uniquely.Then come the blacklist of source code and database, white list or gray list according to note to mate.Judged by the number of times setting reported based on user's note when the gray list of database and blacklist: when reporting N time, be classified as gray list, when report is more than N+M time, add blacklist.Finally note matching result is sent to recipient user.This method is also provided with interactive voice answering (IVR, Interactive Voice Response), whether the short message enquiry content of Short Message Service (SMS, Short Messaging Service) mode is the flow process swindling note.Thisly differentiate the note true and false by user with IVR or SMS inquiry mode, the note frequency simultaneously based on user's report is classified as blacklist and carries out judgement system or the method for follow-up blacklist according to ex-post analysis blacklist mode, just cannot accomplish something for first fraudulent act.

Whether carry out mating based on mobile phone terminal short message content and cloud database and realize identifying: the short message content received by user terminal, carrying out matching judgment respectively according to the transmission number of note and/or short message content and local data base is swindle note; Terminal can real-time update cloud database simultaneously.Mobile terminal carries out pointing out user with voice and/or the mode such as vibration prompting, picture prompting according to matching result.This method needs user to judge whether it is suspicious swindle note according to comparison result, also needs user that judged result is uploaded to Cloud Server, trivial operations, trifling, and user needs to be grasped corresponding knowledge or ability.Simultaneously synchronous also the having of local data base and cloud database postpones and causes erroneous judgement.

Summary of the invention

In view of this, the object of this invention is to provide a kind of swindle short message intelligent monitoring warning system and method, present system carries out real-time security monitoring for the note in communication network, pattern based on swindle note carries out large data analysis for short message content, swindle note can be identified fast, and once the just timely alarm of confirmation swindle note, also timely prompting message is carried out to the potential user of being deceived of swindle note, reduce the economic loss of user to greatest extent.

In order to achieve the above object, the invention provides a kind of swindle short message intelligent monitoring warning system, this system is after the short message service signaling of the mobile subscriber of each network element in the core mobile network to telecom operators and location updating traffic signaling data carry out convergence processing, the note data of user is carried out to the real-time matching monitoring of multiple intelligent analytical model, by useful signaling data stored in database, doubtful swindle note confirmed simultaneously and send a warning message to the potential user of being deceived, realizing the timely warning function of the potential user that is deceived; This system is provided with signaling data and converges assembly, intelligent monitoring Business Processing assembly, intelligent monitoring Management Unit, intelligent alarm assembly and intelligent monitoring Service Database five comprising modules; Wherein:

Signaling data converges assembly, be responsible for being gathered by the protocol adaptation interface of this assembly and converging signaling data, then therefrom extract short message service signaling and location updating traffic signaling data by signaling data extraction module, then this short message service signaling and location updating traffic signaling data are carried out real-time data interaction via monitoring business Processing Interface and intelligent monitoring Business Processing assembly; Be provided with protocol adaptation interface, signaling data extraction module and monitoring business Processing Interface three comprising modules;

Intelligent monitoring Business Processing assembly, be responsible for converging interface to the short message service signaling received and the process of location updating traffic signaling data analysis by the signaling data of this assembly, respectively with service provider SP (Service Provider) short message service, point-to-point short message service, pseudo-base station short message business totally three business diagnosis processing module interaction datas, these three modules carry out the matching ratio pair of number data simultaneously with intelligent monitoring Service Database, if comparison is unsuccessful, then the doubtful swindle note number analyzed is fed back to SMS service management interface, the rear subscriber number confirmed is produced alarm data through alarm business module by intelligent monitoring Management Unit, sent a warning message to the potential user of being deceived by alarm interface, the calling number of the swindle note of confirmation is stored in intelligent monitoring Service Database by SMS service management interface simultaneously, intelligent monitoring Business Processing assembly is provided with SMS service management interface, SP short message service analysis and processing module, point-to-point short message service analysis and processing module, pseudo-base station short message business diagnosis processing module, signaling data convergence interface, alarm business module, alarm interface, business datum bank interface totally eight comprising modules,

Intelligent monitoring Management Unit, the calling and called Subscriber Number being responsible for the doubtful swindle note tentatively confirmed by intelligent monitoring Business Processing assembly carries out gathering and presenting, again via after manual confirmation, send a warning message to the potential user of being deceived in time, and the rear subscriber number after confirming is classified as blacklist and stored in intelligent monitoring Service Database; Be provided with SMS service management interface, swindle short-message users administration module, warning information administration module, database interface totally four comprising modules;

Intelligent alarm assembly, responsible warning information intelligent monitoring Business Processing assembly being returned the potential user of being deceived and issue, and after carrying out protocol adaptation according to the different conditions of mobile phone terminal, be handed down to mobile phone terminal and/or APP client; Be provided with alarm data Processing Interface, alarm business processing module and protocol adaptation interface three comprising modules;

Intelligent monitoring Service Database, for intelligent monitoring Business Processing component interaction information, to know the blacklist of the blacklist of SP note, the blacklist of point-to-point note and pseudo-base station short message; Storing daily record relevant information simultaneously; Also for intelligent monitoring Management Unit interactive information, store the swindle calling number of note and the data template of warning information.

Present invention also provides a kind of swindle short message intelligent monitoring alarm method, the method is implemented by described swindle short message intelligent monitoring warning system, first short message service signaling and the location updating traffic signaling data of telecommunications core network are converged in real time, extract comprising calling number according to the communication protocol used, called number, caller GT address, called GT address, sms center address, LAC, CI, sms center address, short message type, the much information of note length and short message content, then according to the analysis and processing module of the swindle note in this intelligent monitoring warning system, swindle note is analyzed, again the calling subscriber of the swindle note of analysis confirmation and called subscriber are performed according to early warning rule respectively and process operation accordingly, described method comprises following operative step:

Step 1, Real-time Collection with converge short message signaling data: signaling converges assembly Real-time Collection and converges telecommunications core network short message service signaling and location updating traffic signaling data, comprises the much information of calling number, called number, caller GT address, called GT address, sms center address, LAC, CI, sms center address, short message type, note length and short message content according to the communication protocol extraction note of use;

Step 2, intelligent monitoring process is performed to swindle note: for magnanimity note data, the identification and determination swindling note is carried out respectively according to the different intelligent monitor processing method of SP note, point-to-point note, pseudo-base station short message, after confirming swindle note, the rear subscriber number of this swindle note is classified as blacklist; Again called number is gathered and form potential swindle note victim user group;

Step 3, send intelligent early-warning signal: according to the number information of potential swindle note victim user group, select corresponding early warning information template to be ready for sending early warning short message, then according to the different conditions of mobile phone terminal, adaptive different bearing protocol send this early warning short message.

Carried out analysis and the alarm of short message signaling data by swindle short message intelligent monitoring warning system, the note data of user is carried out in real time the real-time monitoring coupling of multiple intelligent analytical model, thus realize the timely alarm function of potential swindle user.

Accompanying drawing explanation

The swindle short message intelligent monitoring warning system structured flowchart that Fig. 1 provides for the embodiment of the present application;

Fig. 2 is the structural representation of the signaling data convergence assembly in system shown in Figure 1;

Fig. 3 is the structural representation of the intelligent monitoring Business Processing assembly in system shown in Figure 1;

Fig. 4 is the structural representation of the intelligent monitoring Management Unit in system shown in Figure 1;

Fig. 5 is the structural representation of the intelligent alarm assembly in system shown in Figure 1;

The swindle short message intelligent monitoring alarm method flow schematic diagram that Fig. 6 provides for the embodiment of the present application;

The SP short message intelligent monitoring alarm schematic flow sheet that Fig. 7 provides for the embodiment of the present application;

The point-to-point short message intelligent monitoring alarm schematic flow sheet that Fig. 8 provides for the embodiment of the present application;

The pseudo-base station short message intelligent monitoring alarm processing schematic diagram that Fig. 9 provides for the embodiment of the present application.

Embodiment

For making the object, technical solutions and advantages of the present invention clearly, below in conjunction with accompanying drawing, the present invention is described in further detail.

From the system composition aspect such as structure, major function, swindle short message intelligent monitoring warning system and method are described.

The composition structure of the swindle short message intelligent monitoring warning system that the embodiment of the present application provides as shown in Figure 1.Swindle short message intelligent monitoring warning system is the short message service signaling of the mobile subscriber in the core mobile network based on convergence telecom operators in each network element, location updating traffic signaling data, assembly is converged by after convergence process by signaling data, route distribution carries out the intellectual analysis of short message content to intelligent monitoring Business Processing assembly, and by useful data stored in database, by intelligent management and control Management Unit, doubtful swindle note is confirmed simultaneously, send a warning message finally by intelligent alarm assembly, thus realize the timely warning function of potential swindle short-message users.This system is provided with signaling data and converges assembly, intelligent monitoring Business Processing assembly, intelligent monitoring Management Unit, intelligent alarm assembly and intelligent monitoring Service Database five comprising modules.

The signaling data that Fig. 2 shows the embodiment of the present application to be provided converges the structure of assembly.As shown in Figure 2, signaling data convergence assembly is made up of protocol adaptation interface, signaling data extraction module, monitoring business Processing Interface.Protocol adaptation interface is used for gathering and converging signaling data, then therefrom extract short message service signaling and location updating traffic signaling data by signaling data extraction module, then this short message service signaling and location updating service note signaling data are carried out real-time data interaction via monitoring business Processing Interface and intelligent monitoring Business Processing assembly; Be provided with protocol adaptation interface, signaling data extraction module and monitoring business Processing Interface three comprising modules.

Particularly,

Protocol adaptation interface, the interactive adaptation being responsible for completing with the network element relevant interface of core telecommunication network agreement operates, gather core network signaling message by the protocol interface of Web Service and/or real-time Socket again, be transmitted to signaling data extraction module and process;

Signaling data extraction module, be responsible for the core network signaling message gathered from protocol adaptation interface, extraction comprises rear subscriber number, called number, caller global title (GT, Global Title) address, called GT address, sms center address, lane place (LAC, Location Area Code), cell ID (CI, Cell Id), the information of short message service type, note length and short message content, then send the information extracted to monitoring business Processing Interface;

Monitoring business Processing Interface, is responsible for the signaling information after to extraction and carries out alternately according to by monitoring business Processing Interface and intelligent monitoring Business Processing assembly.

Intelligent monitoring Business Processing assembly carries out the Treatment Analysis of note data message by short message service Processing Interface, respectively with SP short message service analysis and processing module, point-to-point short message service analysis and processing module, pseudo-base station short message business diagnosis processing module carries out data interaction, these three modules and intelligent monitoring Service Database do number data comparison simultaneously, as comparison is unsuccessful, then by analyze doubtful swindle note number to SMS service management Processing Interface, and produce alarm data through the message of Management Unit, the transmission of warning information is carried out by alarm interface, the number data of the swindle note of confirmation is stored in intelligent monitoring Service Database simultaneously.

Fig. 3 shows the structure of the intelligent monitoring Business Processing assembly that the embodiment of the present application provides, and intelligent monitoring Business Processing assembly converges interface by signaling data, alarm interface, alarm business module, SP short message service analysis and processing module, point-to-point short message service analysis and processing module, pseudo-base station short message business diagnosis processing module, business datum bank interface, SMS service management interface form.Signaling data converges interface to the short message signaling data analysis process received, respectively with SP short message service analysis and processing module, point-to-point short message service analysis and processing module and pseudo-base station short message business diagnosis processing module interaction data, described three business diagnosis processing modules carry out the matching ratio pair of number data simultaneously with intelligent monitoring Service Database, if comparison is unsuccessful, then the doubtful swindle note number analyzed is fed back to SMS service management interface, the rear subscriber number confirmed is produced alarm data through alarm business module by intelligent monitoring Management Unit, sent a warning message to the potential user of being deceived by alarm interface, the calling number of the swindle note of confirmation is stored in intelligent monitoring Service Database by SMS service management interface simultaneously.Particularly,

Signaling data converges interface, be responsible for receiving the short message that signaling data converges assembly, and this short message data is carried out data interaction with SP short message service analysis and processing module, point-to-point short message service analysis and processing module, pseudo-base station short message business diagnosis processing module respectively;

SP short message service analysis and processing module, for converging interactive interfacing with signaling data, according to SP short message service analytical model, carries out swindle note analyzing and processing to SP class note; With SMS service management interactive interfacing, confirmation is carried out and alarm to doubtful SP class swindle note; Also mutual by business datum bank interface and intelligent monitoring Service Database, to compare with the SP class calling subscriber blacklist in this database, while storing daily record relevant information;

Point-to-point short message service analysis and processing module, for converging interactive interfacing with signaling data, according to point-to-point short message service analytical model, carries out swindle note analyzing and processing to point-to-point class note; With SMS service management interactive interfacing, confirmation is carried out and alarm to doubtful point-to-point class swindle note; Also mutual by business datum bank interface and intelligent monitoring Service Database, to compare with the point-to-point calling subscriber's blacklist in this database, while storing daily record relevant information;

Pseudo-base station short message business diagnosis processing module, for converging interactive interfacing with signaling data, according to pseudo-base station short message business diagnosis model, carries out swindle note analyzing and processing to pseudo-base station class note; Mutual with APP client, judge APP client state; With SMS service management interactive interfacing, doubtful pseudo-base station class swindle note is confirmed and alarm, simultaneously by business datum bank interface storing daily record relevant information;

SMS service management interface, is responsible for mutual with SP short message service analysis and processing module respectively, doubtful SP swindle note data and intelligent monitoring Management Unit is carried out data interaction; Mutual with point-to-point short message service analysis and processing module, doubtful point-to-point swindle note data and intelligent monitoring Management Unit are carried out data interaction; Mutual with pseudo-base station short message business diagnosis processing module, doubtful pseudo-base station swindle note data and intelligent monitoring Management Unit are carried out data interaction; Also with alarm business module interactive information, the service logic of the Real-time Alarm information that process intelligent monitoring Management Unit issues, then be transmitted to alarm interface;

Alarm business module, for SMS service management interactive interfacing information, the alarm business logical data of process intelligent monitoring Management Unit; Carry out alternately, sending alarm information to intelligent alarm assembly via alarm interface with alarm interface;

Alarm interface, for mutual with alarm business module, receives the Real-time Alarm information that intelligent monitoring Management Unit issues; Also with intelligent alarm component interaction information, data analysis and route are carried out to warning information;

Business datum bank interface, for carrying out alternately with SP short message service analysis and processing module, point-to-point short message service analysis and processing module and pseudo-base station short message business diagnosis processing module respectively, to carry out the data analysis of doubtful swindle note according to the blacklist list of the blacklist of SP note, the blacklist of point-to-point note and pseudo-base station.

Intelligent monitoring Management Unit, the calling and called Subscriber Number being responsible for the doubtful swindle note tentatively confirmed by intelligent monitoring Business Processing assembly carries out gathering and presenting, again via after manual confirmation, send a warning message to the potential user of being deceived in time, and the rear subscriber number after confirming is classified as blacklist and stored in intelligent monitoring Service Database.

The structure of the intelligent monitoring Management Unit that Fig. 4 provides for the embodiment of the present application, intelligent monitoring Management Unit is made up of SMS service management interface, swindle short-message users administration module, warning information administration module, database interface.

SMS service management interface, for intelligent monitoring Business Processing component interaction information, by the doubtful swindle note after this monitor component Business Processing, send to swindle short-message users administration module;

Swindle short-message users administration module, for SMS service management interactive interfacing information, from swindle note, extract rear subscriber number and called number; With warning information administration module interactive information, warning information is produced to the called subscriber of doubtful swindle note; Carry out alternately with management data bank interface, the rear subscriber number of swindle note is stored into the blacklist of intelligent monitoring Service Database, simultaneously storing daily record relevant information;

Warning information administration module, for swindle short-message users administration module interactive information, after the called number of swindle note is gathered and extracting, warning information is performed and chooses and confirm to operate; Carry out alternately, storing the template of warning information and choosing with management data bank interface, simultaneously storing daily record relevant information;

Management data bank interface, for swindle short-message users administration module interactive information, calling number data are stored into the blacklist of intelligent monitoring Service Database; Carry out alternately with warning information administration module, formulate and store the data template of warning information.

The warning information that the potential user of being deceived issues is responsible for intelligent monitoring Business Processing assembly to return by intelligent alarm assembly, and after carrying out protocol adaptation according to the different conditions of mobile phone terminal, is handed down to mobile phone terminal and/or APP client.

Fig. 5 shows the structure of the intelligent alarm assembly that the embodiment of the present application provides, and intelligent alarm assembly is made up of alarm data Processing Interface, alarm business processing module, protocol adaptation interface.

Alarm data Processing Interface, to communicate with intelligent monitoring Business Processing assembly, the message of alarm business is carried out data interaction; Communicate with alarm business processing module, the concrete business for alarm carries out logical process analysis;

Alarm business processing module, communicates with alarm business Processing Interface, and the concrete business for alarm carries out logical process analysis; Carry out alternately with protocol adaptation interface, continue the transmission of alarm information according to the condition adapted different agreement of mobile phone terminal;

Protocol adaptation interface, alarm business process is carried out alternately, and the adaptive different agreement of the different conditions for mobile phone terminal continues the transmission of alarm information.

Intelligent monitoring Service Database, for intelligent monitoring Business Processing component interaction information, to know the blacklist of the blacklist of SP note, the blacklist of point-to-point note and pseudo-base station short message; Storing daily record relevant information simultaneously; Also for intelligent monitoring Management Unit interactive information, store the swindle calling number of note and the data template of warning information.

Described swindle short message intelligent monitoring warning system also comprises swindle short message intelligent monitoring application APP client, this device is responsible for and intelligent monitoring Business Processing component interaction information, to monitor the operating state of this client, the timely early warning that the called subscriber of swindle note is sent a warning message simultaneously; The Data Source of described system is the magnanimity communication signaling data of telecommunications mobile subscriber.

Present invention also provides a kind of swindle short message intelligent monitoring alarm method based on above-mentioned swindle short message intelligent monitoring warning system.The swindle short message intelligent monitoring alarm method flow that Fig. 6 provides for the embodiment of the present application, first short message service signaling and the location updating traffic signaling data of telecommunications core network are converged in real time, extract comprising calling number according to the communication protocol used, called number, caller GT address, called GT address, sms center address, LAC, CI, sms center address, short message type, the much information of note length and short message content, then according to the analysis and processing module of the swindle note in this intelligent monitoring warning system, swindle note is analyzed, again the calling subscriber of the swindle note of analysis confirmation and called subscriber are performed according to early warning rule respectively and process operation accordingly, described method comprises following operative step:

Step 1, Real-time Collection with converge short message service signaling and location updating traffic signaling data: signaling converges assembly Real-time Collection and converges telecommunications core network short message service signaling and location updating traffic signaling data, comprises the much information of calling number, called number, caller GT address, called GT address, sms center address, LAC, CI, sms center address, short message type, note length and short message content according to the communication protocol extraction note of note use;

Step 2, intelligent monitoring process is performed to swindle note: for magnanimity note data, the identification and determination swindling note is carried out respectively according to the different intelligent monitor processing method of SP note, point-to-point note, pseudo-base station short message, after confirming swindle note, the rear subscriber number of this swindle note is classified as blacklist; Again called number is gathered and form potential swindle note and to be deceived customer group;

Step 3, send intelligent early-warning signal: according to the number information of the potential customer group of being deceived of swindle note, select corresponding early warning information template to be ready for sending early warning short message, then according to the different conditions of mobile phone terminal, adaptive different bearing protocol send this early warning short message.

For SP note, general note appearance form is the note that starts with 95,106,10000,10086,10010 equal sign sections of calling number mainly.Its feature is exactly the order business according to user, on time for the message issuing various content with note form of a large number of users.

In communication network, the Network Access Point of this kind of SP user is fixing, general by Short Message Service Gateway (SMGW or SMG, Short Message Gateway) or the unified access of the IAD such as integrated business access gateway (ISAG, Integrated Service Access Gateway).In the signaling message of communication network, Mobile solution agreement (MAP can be passed through, Mobile Application Protocol) routing iinformation of signaling message carries out judging whether to be correct route direction, namely for the note of SP class, in communication signaling, can judge that its caller GT code, OPC, start ip address and port (port) carry out judging the originating point of SP short message sending.According to routing rule, as noted abnormalities, then it is the object that doubtful swindle note is analyzed.For SP note, generally the type fashion of its transmitting short message is that MT (Mobile Terminated) mode issues, i.e. downlink short message form.If checked by signaling message, having caller to be with 95,106,10000,10086,10010 equal sign sections beginnings and be the note of MO (Mobile Originate) mode, is then the object that doubtful swindle note is analyzed.Simultaneously in analysis based on the mode of black and white lists, carry out the confirmation of SP number.Eventually pass the analysis of SP short message content, SP short message content is analyzed and resolves and self-learning algorithm according to the meaning of one's words of the Chinese character of SP content, identify the short message content of swindle.For the swindle note identified, extract called number customer group, form the potential customer group of being deceived of swindle note, then send early warning information in time and remind.

Short message content analysis judges whether it is swindle note according to the sms center address of short message content, note length, short message content field.

The SP short message intelligent monitoring alarm flow chart that Fig. 7 provides for the embodiment of the present application, based on SP note with MT, namely downlink short message mode issues, therefore when checking signaling message, if find, caller is be that number section starts and is the note of MO mode with 95,106,10000,10086 and 10010, then think that it is the analytic target of doubtful swindle note; Carry out the confirmation of SP number simultaneously based on black and white lists mode, also resolve according to the meaning of one's words of the Chinese character of SP content and self-learning algorithm analysis short message content, judge to identify whether it is swindle note; Then, for the swindle note identified, extract called number and generate potential swindle note victim user group, the last early warning information that sends in time is reminded; The method comprises following content of operation:

Step 21, converges short message signaling data;

Step 22, judges that whether SP routing address is normal: whether the routing rule of caller GT address meets the network planning requires: if normal, then perform subsequent step 23; Otherwise redirect performs step 26;

Step 23, judges that whether SP short message type is normal: if normal, then perform subsequent step 24; Otherwise redirect performs step 26;

Step 24, carries out white list inspection to the rear subscriber number of SP note, if rear subscriber number is positioned at white list, then note is put logical; Otherwise, perform subsequent step 25;

Step 25, carries out blacklist inspection to the rear subscriber number of SP note, if rear subscriber number is positioned at blacklist, then extracts called number customer group, performs intelligent early-warning; Otherwise, perform subsequent step (26);

Step 26, carries out judgement to SP short message content and identifies, if not swindle note, then note is put logical; If swindle note, then extract called number customer group, perform intelligent early-warning;

Step 27, extracts the called number of swindle note, forms swindle note potential customer group of being deceived, regeneration and issue early warning short message.

More than describing is only description to present pre-ferred embodiments, any restriction not to the scope of the invention, and any change that the those of ordinary skill in field of the present invention does according to above-mentioned disclosure, modification, all belong to the protection range of claims.

For point-to-point note, the mainly short message sending of mobile subscriber individual to individual, but also there is some people and utilize the special short messages such as note cat to send instrument, use multiple mobile SIM card, a point time-division user does not stop paying out and send.According to the requirement of Ministry of Industry and Information, for the user of day traffic volume more than 200, short message service will be done and suspend process.For this kind of transmission note, its, traffic volume was generally below 200 every day, but relatively 200, and the amount that every day sends is substantially identical.Carry out comprehensive descision according to the frequency of short message sending and the traffic volume of many days, as certain user's traffic volume every day is all a lot, sky traffic volume and the moon traffic volume be all like this, the analysis of doubtful swindle note can be carried out according to overall trend analysis.

According to the number rule analysis of called subscriber, according to front 7 information of home location can knowing user of called subscriber's phone number, as 1390010 for ownership place is Pekinese user, 1860020 is the user in ownership Guangzhou, status.According to calling subscriber's phone number attaching information and called number attaching information, the transmission scene of point-to-point note can be analyzed, this province this city Home Network note, this province this city rete mirabile note, this province different city Home Network note, this province different city rete mirabile note, this province other places Home Network note, this province other places rete mirabile note are generally divided into for transmission scene.According to analyzing scene above, for point-to-point user, according to the transmission interpretation of result of every day, monthly note, the short message sending scene type based on user behavior can be understood.When the transmission scene of user notes abnormalities, then follow-uply carry out the analysis of doubtful swindle note.

Short message content analysis judges whether it is swindle note according to the sms center address of short message content, note length, short message content field.

The intelligent monitoring processing method carrying out swindling note identification according to point-to-point note that Fig. 8 provides for the embodiment of the present application: first according to the attaching information of calling subscriber's phone number and called number, analyze the transmission scene of point-to-point note: this province this city Home Network note, this province this city rete mirabile note, this province different city Home Network note, this province different city rete mirabile note, this province other places Home Network note and this province other places rete mirabile note; Analyze according to scene analysis and this user's every day and/or point-to-point short message sending quantity monthly and result again, understand the short message sending scene type that this user is; Once find that the transmission scene of user is abnormal, just analyzing and judging whether it sends doubtful swindle note, extract called number and send early warning information in time; Described method comprises following content of operation:

Step 2A, converges short message signaling data;

Step 2B, judge the frequency of point-to-point note and historical trend whether normal: if normal, then perform subsequent step 2C; Otherwise redirect performs step 2G;

Step 2C, judges the number home information of point-to-point note, analyzes short message sending scene and user behavior respectively, judges that whether this note is normal, if normally, then perform subsequent step 2D according to user behavior and scene; If note scene is abnormal, then redirect performs step 2G;

Step 2D, carries out white list inspection to the rear subscriber number of point-to-point note, if rear subscriber number is positioned at white list, then note is put logical; Otherwise, perform subsequent step 2E;

Step 2E, the rear subscriber number for point-to-point note carries out blacklist inspection, if rear subscriber number is positioned at blacklist, then extracts called number customer group, performs intelligent early-warning; Otherwise, perform subsequent step 2F;

Step 2F, carries out judgement to point-to-point short message content and identifies, if not swindle note, then note is put logical; If swindle note, then extract called number customer group, perform intelligent early-warning; If not swindle note, then note is put logical; If swindle note, then perform subsequent step 2G;

Step 2G, extracts the called number of swindle note, forms swindle note potential customer group of being deceived, regeneration and issue early warning short message.

More than describing is only description to present pre-ferred embodiments, any restriction not to the scope of the invention, and any change that the those of ordinary skill in field of the present invention does according to above-mentioned disclosure, modification, all belong to the protection range of claims.

The principle of pseudo-base station short message intelligent monitoring alarm method is: under normal circumstances, when the LAC number in communication network changes, then normal position renewal is carried out in mobile terminal.For pseudo-base station class note, according to the historical trending analysis of the location updating of certain community.When the exception of the location updating business datum of community, as abnormal in location updating sum, and the community of update abnormal presents linear distribution, if cell update is near focus near roads, market etc., then can suspect the existence having potential pseudo-base station near community.According to the signaling data of location updating, LAC, CI before extraction upgrades and LAC, CI data after renewal are analyzed, according to the coding rule of LAC, as the LAC of close region, its location updating business belongs to normal, the LAC closed on as non-, and its location updating is then abnormal data.Simultaneously according to the APP client of mobile subscriber's mobile phone terminal and the connection status analysis of intelligent monitoring warning system, the client of mobile terminals a large amount of near certain community loses with intelligent monitoring warning system and is connected, then can judge has potential pseudo-base station to exist near community.

The intelligent monitoring processing method carrying out swindling note identification according to pseudo-base station short message that the embodiment of the present application provides is that the historical trend upgraded according to subdistrict position carries out analyzing: according to the signaling data of location updating, extract before upgrading respectively, after LAC and CI be analyzed, contrast LAC again, the network planning coding rule of CI is compared: if LAC, the location updating signaling data Trend Stationary of CI value matching network planning coding rule or history, then this LAC, CI location updating business belongs to normal, if described LAC, CI value is not mated with network planning coding rule or the location updating signaling data trend anomaly of history, then think this LAC, the location updating business of CI is abnormal data, analyze the APP client of mobile phone terminal and the connection status of intelligent monitoring warning system: when client and the intelligent monitoring warning system of mobile terminals a large amount of near certain community lose and be connected simultaneously, just can judge to there is potential pseudo-base station near community,

Step 2a, converges short message service signaling, location updating traffic signaling data;

Step 2b, judge the frequency of location updating business and historical trend whether normal: if abnormal, then perform subsequent step (2c); If normal, then note is put logical;

Step 2c, judge that whether APP client's side link is normal, if normally, then note is put logical; If connect abnormal, then perform subsequent step 2d;

Step 2d, after APP client's side link recovers, Automatic inquirying note history, if there is new message, then continues to perform subsequent step 2e; Otherwise it is without new message, then without exception;

Step 2e, judges short message content, if not swindle note, then note is put logical; If swindle note, then extract called number user, perform intelligent early-warning;

Step 2f, extracts the called number of swindle note, forms swindle note potential customer group of being deceived, regeneration and issue early warning short message.

More than describing is only description to present pre-ferred embodiments, any restriction not to the scope of the invention, and any change that the those of ordinary skill in field of the present invention does according to above-mentioned disclosure, modification, all belong to the protection range of claims.

Technical scheme, relative to prior art, has following business innovation point:

Magnanimity signaling data converges: converge to set up by signaling data and carry out aggregation process for signaling message, comprise location updating signaling, short message signaling, SOT state of termination etc. from core net A/IU interface, C/D interface, GN/R-P interface collection user.

Signaling data trend analysis: by hour, day, week, the moon etc. data carry out trend anomaly general analyzes, abnormal data is extracted in time.

Carry out different analyzing and processing according to short message type, SP note carries out route analysis, short message type analysis; Point-to-point note carries out frequency analysis, and note scene type is analyzed; Pseudo-base station short message is abnormal and APP client's side link anomaly analysis according to location updating; Cover various types of note.

For swindle short-message users, gather potential customer group of being deceived fast, issue early warning information fast according to the short message template of artificial customization in time.

Technical scheme, relative to prior art, has following technology and realizes innovative point:

Based on the protocol adaptation layers in convergence assembly, by different agreement interface, the user data of each network element is carried out aggregation process, data source is from the signaling message of core net A/IU interface, C/D interface, GN/R-P interface.

Based on large data analysis technique, signaling message is carried out business model identification fast, distinguish SP note, point-to-point note, pseudo-base station short message, for the swindle short message service discriminance analysis of each short message service.

Based on SP short message type, the route field carrying out short message extracts and carries out comparing with telecommunications network routing rule, judges that whether route is abnormal; Carry out the field analysis of short message type, for the note of up MO, judge that short message type is abnormal;

Based on point-to-point short message type, carry out the frequency of short message service and the comparison of historical trend, for hour, day, week, the moon etc. data carry out trend anomaly general analyzes, trend anomaly then carries out the analysis of swindle short message content; Carry out the attaching information of short-message users, judge the short-message users behavior of user, for the transmission scene of exception, then carry out the analysis of swindle short message content;

For pseudo-base station short message type, carry out the trend comparison of location updating business, judge pseudo-base station according to renewal service exception; Connection status according to APP client and intelligent monitoring warning system judges, as connect abnormal after then according to the comparison of follow-up note with analyze the judgement carrying out pseudo-base station.

Based on different swindle short message type, artificial customization early warning information sends template, carries out issuing of early warning information, judge that the state of terminal carries out the transmission of early warning information according to different early warning information template.

Technical scheme can realize following technique effect:

This system carries out convergence and association analysis process based on the magnanimity signaling data of user, extracts unified for signaling data and associate, and real-time update, data accuracy reaches more than 98%;

This system is based on the historical trending analysis user behavior of user, and as found, trend anomaly then carries out analysis and the judgement of short message content;

This system is analyzed respectively based on SP note, point-to-point note, pseudo-base station short message and judges, contains signaling message monitoring and the identification of swindle short message content of note comprehensively;

Swindle short-message users is reminded in time, thus reminds the potential user that is deceived in time, reduce the loss of user to greatest extent.

More than describing is only description to present pre-ferred embodiments, any restriction not to the scope of the invention, and any change that the those of ordinary skill in field of the present invention does according to above-mentioned disclosure, modification, all belong to the protection range of claims.

Claims (11)

1. a swindle short message intelligent monitoring warning system, it is characterized in that: this system is after the short message service signaling of the mobile subscriber of each network element in the core mobile network to telecom operators and location updating traffic signaling data carry out convergence processing, the note data of user is carried out to the real-time matching monitoring of multiple intelligent analytical model, by useful signaling data stored in database, doubtful swindle note confirmed simultaneously and send a warning message to the potential user of being deceived, realizing the timely warning function of the potential user that is deceived; This system is provided with signaling data and converges assembly, intelligent monitoring Business Processing assembly, intelligent monitoring Management Unit, intelligent alarm assembly and intelligent monitoring Service Database five comprising modules; Wherein:

Signaling data converges assembly, is provided with protocol adaptation interface, signaling data extraction module and monitoring business Processing Interface three comprising modules; Protocol adaptation interface is used for gathering and converging signaling data, then therefrom extract short message service signaling and location updating traffic signaling data by signaling data extraction module, then this short message service signaling and location updating traffic signaling data are carried out real-time data interaction via monitoring business Processing Interface and intelligent monitoring Business Processing assembly;

Intelligent monitoring Business Processing assembly, is provided with SMS service management interface, service provider SP short message service analysis and processing module, point-to-point short message service analysis and processing module, pseudo-base station short message business diagnosis processing module, signaling data convergence interface, alarm business module, alarm interface, business datum bank interface totally eight comprising modules, signaling data converges interface to the short message signaling data analysis process received, respectively with SP short message service analysis and processing module, point-to-point short message service analysis and processing module and pseudo-base station short message business diagnosis processing module interaction data, described three business diagnosis processing modules carry out the matching ratio pair of number data simultaneously with intelligent monitoring Service Database, if comparison is unsuccessful, then the doubtful swindle note number analyzed is fed back to SMS service management interface, the rear subscriber number confirmed is produced alarm data through alarm business module by intelligent monitoring Management Unit, sent a warning message to the potential user of being deceived by alarm interface, the calling number of the swindle note of confirmation is stored in intelligent monitoring Service Database by SMS service management interface simultaneously,

Intelligent monitoring Management Unit, the calling and called Subscriber Number being responsible for the doubtful swindle note tentatively confirmed by intelligent monitoring Business Processing assembly carries out gathering and presenting, again via after manual confirmation, send a warning message to the potential user of being deceived in time, and the rear subscriber number after confirming is classified as blacklist and stored in intelligent monitoring Service Database;

Intelligent alarm assembly, responsible warning information intelligent monitoring Business Processing assembly being returned the potential user of being deceived and issue, and after carrying out protocol adaptation according to the different conditions of mobile phone terminal, be handed down to mobile phone terminal and/or APP client; Intelligent monitoring Service Database, for intelligent monitoring Business Processing component interaction information, to know the blacklist of the blacklist of SP note, the blacklist of point-to-point note and pseudo-base station short message; Storing daily record relevant information simultaneously; Also for intelligent monitoring Management Unit interactive information, store the swindle calling number of note and the data template of warning information.

2. system according to claim 1, it is characterized in that: described system also comprises swindle short message intelligent monitoring application APP client, this device is responsible for and intelligent monitoring Business Processing component interaction information, to monitor the operating state of this client, the timely early warning that the called subscriber of swindle note is sent a warning message simultaneously; The Data Source of described system is the magnanimity communication signaling data of telecommunications mobile subscriber.

3. system according to claim 1, is characterized in that: the modules function declaration that described signaling data converges in assembly is as follows:

Protocol adaptation interface, the interactive adaptation being responsible for completing with the network element relevant interface of core telecommunication network agreement operates, gather core network signaling message by the protocol interface of Web Service and/or real-time Socket again, be transmitted to signaling data extraction module and process;

Signaling data extraction module, be responsible for the core network signaling message gathered from protocol adaptation interface, extract the information comprising rear subscriber number, called number, caller GT address, called GT address, sms center address, lane place LAC, community CI, short message service type, note length and short message content, then send the information extracted to monitoring business Processing Interface;

Monitoring business Processing Interface, is responsible for the signaling information after to extraction and carries out alternately according to by monitoring business Processing Interface and intelligent monitoring Business Processing assembly.

4. system according to claim 1, is characterized in that: the modules function declaration in described intelligent monitoring Business Processing assembly is as follows:

Signaling data converges interface, be responsible for receiving the short message that signaling data converges assembly, and this short message data is carried out data interaction with SP short message service analysis and processing module, point-to-point short message service analysis and processing module, pseudo-base station short message business diagnosis processing module respectively;

SP short message service analysis and processing module, for converging interactive interfacing with signaling data, according to SP short message service analytical model, carries out swindle note analyzing and processing to SP class note; With SMS service management interactive interfacing, confirmation is carried out and alarm to doubtful SP class swindle note; Also mutual by business datum bank interface and intelligent monitoring Service Database, to compare with the SP class calling subscriber blacklist in this database, while storing daily record relevant information;

Point-to-point short message service analysis and processing module, for converging interactive interfacing with signaling data, according to point-to-point short message service analytical model, carries out swindle note analyzing and processing to point-to-point class note; With SMS service management interactive interfacing, confirmation is carried out and alarm to doubtful point-to-point class swindle note; Also mutual by business datum bank interface and intelligent monitoring Service Database, to compare with the point-to-point calling subscriber's blacklist in this database, while storing daily record relevant information;

Pseudo-base station short message business diagnosis processing module, for converging interactive interfacing with signaling data, according to pseudo-base station short message business diagnosis model, carries out swindle note analyzing and processing to pseudo-base station class note; Mutual with APP client, judge APP client state; With SMS service management interactive interfacing, doubtful pseudo-base station class swindle note is confirmed and alarm, simultaneously by business datum bank interface storing daily record relevant information;

SMS service management interface, is responsible for mutual with SP short message service analysis and processing module respectively, doubtful SP swindle note data and intelligent monitoring Management Unit is carried out data interaction; Mutual with point-to-point short message service analysis and processing module, doubtful point-to-point swindle note data and intelligent monitoring Management Unit are carried out data interaction; Mutual with pseudo-base station short message business diagnosis processing module, doubtful pseudo-base station swindle note data and intelligent monitoring Management Unit are carried out data interaction; Also with alarm business module interactive information, the service logic of the Real-time Alarm information that process intelligent monitoring Management Unit issues, then be transmitted to alarm interface;

Alarm business module, for SMS service management interactive interfacing information, the alarm business logical data of process intelligent monitoring Management Unit; Carry out alternately, sending alarm information to intelligent alarm assembly via alarm interface with alarm interface;

Alarm interface, for mutual with alarm business module, receives the Real-time Alarm information that intelligent monitoring Management Unit issues; Also with intelligent alarm component interaction information, data analysis and route are carried out to warning information;

Business datum bank interface, for carrying out alternately with SP short message service analysis and processing module, point-to-point short message service analysis and processing module and pseudo-base station short message business diagnosis processing module respectively, to carry out the data analysis of doubtful swindle note according to the blacklist list of the blacklist of SP note, the blacklist of point-to-point note and pseudo-base station.

5. system according to claim 1, is characterized in that:

Described intelligent monitoring Management Unit is made up of SMS service management interface, swindle short-message users administration module, warning information administration module, database interface;

SMS service management interface, for intelligent monitoring Business Processing component interaction information, by the doubtful swindle note after this monitor component Business Processing, send to swindle short-message users administration module;

Swindle short-message users administration module, for SMS service management interactive interfacing information, from swindle note, extract rear subscriber number and called number; With warning information administration module interactive information, warning information is produced to the called subscriber of doubtful swindle note; Carry out alternately with management data bank interface, the rear subscriber number of swindle note is stored into the blacklist of intelligent monitoring Service Database, simultaneously storing daily record relevant information;

Warning information administration module, for swindle short-message users administration module interactive information, after the called number of swindle note is gathered and extracting, warning information is performed and chooses and confirm to operate; Carry out alternately, storing the template of warning information and choosing with management data bank interface, simultaneously storing daily record relevant information;

Management data bank interface, for swindle short-message users administration module interactive information, calling number data are stored into the blacklist of intelligent monitoring Service Database; Carry out alternately with warning information administration module, formulate and store the data template of warning information.

6. system according to claim 1, is characterized in that: described intelligent alarm assembly is made up of alarm data Processing Interface, alarm business processing module and protocol adaptation interface;

Alarm data Processing Interface, to communicate with intelligent monitoring Business Processing assembly, the message of alarm business is carried out data interaction; Communicate with alarm business processing module, the concrete business for alarm carries out logical process analysis;

Alarm business processing module, communicates with alarm business Processing Interface, and the concrete business for alarm carries out logical process analysis; Carry out alternately with protocol adaptation interface, continue the transmission of alarm information according to the condition adapted different agreement of mobile phone terminal;

Protocol adaptation interface, alarm business process is carried out alternately, and the adaptive different agreement of the different conditions for mobile phone terminal continues the transmission of alarm information.

7. a swindle short message intelligent monitoring alarm method, it is characterized in that: the method is implemented by swindling short message intelligent monitoring warning system as claimed in claim 1, first short message service signaling and the location updating traffic signaling data of telecommunications core network are converged in real time, extract comprising calling number according to the communication protocol used, called number, caller GT address, called GT address, sms center address, LAC, CI, sms center address, short message type, the much information of note length and short message content, then according to the analysis and processing module of the swindle note in this intelligent monitoring warning system, swindle note is analyzed, again the calling subscriber of the swindle note of analysis confirmation and called subscriber are performed according to early warning rule respectively and process operation accordingly, described method comprises following operative step:

Step 1, Real-time Collection with converge short message service signaling and location updating traffic signaling data: signaling converges assembly Real-time Collection and converges telecommunications core network short message service signaling and location updating traffic signaling data, comprises the much information of calling number, called number, caller GT address, called GT address, sms center address, LAC, CI, sms center address, short message type, note length and short message content according to the communication protocol extraction note of note use;

Step 2, intelligent monitoring process is performed to swindle note: for magnanimity note data, the identification and determination swindling note is carried out respectively according to the different intelligent monitor processing method of SP note, point-to-point note, pseudo-base station short message, after confirming swindle note, the rear subscriber number of this swindle note is classified as blacklist; Again called number is gathered and form potential swindle note and to be deceived customer group;

Step 3, send intelligent early-warning signal: according to the number information of the potential customer group of being deceived of swindle note, select corresponding early warning information template to be ready for sending early warning short message, then according to the different conditions of mobile phone terminal, adaptive different bearing protocol send this early warning short message.

8. method according to claim 7, it is characterized in that: in described step 2, the intelligent monitoring processing method carrying out swindling note identification according to SP note is: based on SP note with MT, namely downlink short message mode issues, therefore when checking signaling message, if find, caller is be that number section starts and is the note of MO mode with 95,106,10000,10086 and 10010, then think that it is the analytic target of doubtful swindle note; Carry out the confirmation of SP number simultaneously based on black and white lists mode, also resolve according to the meaning of one's words of the Chinese character of SP content and self-learning algorithm analysis short message content, judge to identify whether it is swindle note; Then, for the swindle note identified, extract called number and generate the potential customer group of being deceived of swindle note, the last early warning information that sends in time is reminded; The method comprises following content of operation:

Step 21, converges short message signaling data;

Step 22, judges that whether SP routing address is normal: whether the routing rule of caller GT address meets the network planning requires: if normal, then perform subsequent step 23; Otherwise redirect performs step 26;

Step 23, judges that whether SP short message type is normal: if normal, then perform subsequent step 24; Otherwise redirect performs step 26;

Step 24, carries out white list inspection to the rear subscriber number of SP note, if rear subscriber number is positioned at white list, then note is put logical; Otherwise, perform subsequent step 25;

Step 25, carries out blacklist inspection to the rear subscriber number of SP note, if rear subscriber number is positioned at blacklist, then extracts called number customer group, performs intelligent early-warning; Otherwise, perform subsequent step (26);

Step 26, carries out judgement to SP short message content and identifies, if not swindle note, then note is put logical; If swindle note, then extract called number customer group, perform intelligent early-warning;

Step 27, extracts the called number of swindle note, forms swindle note potential customer group of being deceived, regeneration and issue early warning short message.

9. method according to claim 7, it is characterized in that: in described step 2, the described intelligent monitoring processing method carrying out swindling note identification according to point-to-point note is: first according to the attaching information of calling subscriber's phone number and called number, analyze the transmission scene of point-to-point note: this province this city Home Network note, this province this city rete mirabile note, this province different city Home Network note, this province different city rete mirabile note, this province other places Home Network note and this province other places rete mirabile note; Analyze according to scene analysis and this user's every day and/or point-to-point short message sending quantity monthly and result again, understand the short message sending scene type that this user is; Once find that the transmission scene of user is abnormal, just analyzing and judging whether it sends doubtful swindle note, extract called number and send early warning information in time; Described method comprises following content of operation:

Step 2A, converges short message signaling data;

Step 2B, judge the frequency of point-to-point note and historical trend whether normal: if normal, then perform subsequent step 2C; Otherwise redirect performs step 2G;

Step 2C, judges the number home information of point-to-point note, analyzes short message sending scene and user behavior respectively, judges that whether this note is normal, if normally, then perform subsequent step 2D according to user behavior and scene; If note scene is abnormal, then redirect performs step 2G;

Step 2D, carries out white list inspection to the rear subscriber number of point-to-point note, if rear subscriber number is positioned at white list, then note is put logical; Otherwise, perform subsequent step 2E;

Step 2E, the rear subscriber number for point-to-point note carries out blacklist inspection, if rear subscriber number is positioned at blacklist, then extracts called number customer group, performs intelligent early-warning; Otherwise, perform subsequent step 2F;

Step 2F, carries out judgement to point-to-point short message content and identifies, if not swindle note, then note is put logical; If swindle note, then extract called number customer group, perform intelligent early-warning; If not swindle note, then note is put logical; If swindle note, then perform subsequent step 2G;

Step 2G, extracts the called number of swindle note, forms swindle note potential customer group of being deceived, regeneration and issue early warning short message.

10. method according to claim 7, it is characterized in that: in described step 2, the described intelligent monitoring processing method carrying out swindling note identification according to pseudo-base station short message is that the historical trend upgrading traffic signaling according to subdistrict position carries out analyzing: according to the signaling data of location updating, extract before upgrading respectively, after LAC and CI be analyzed, contrast LAC again, the network planning coding rule of CI is compared: if LAC, the location updating signaling data Trend Stationary of CI value matching network planning coding rule or history, then this LAC, CI location updating business belongs to normal, if described LAC, CI value is not mated with network planning coding rule or the location updating signaling data trend anomaly of history, then think this LAC, the location updating business of CI is abnormal data, analyze the APP client of mobile phone terminal and the connection status of intelligent monitoring warning system: when client and the intelligent monitoring warning system of mobile terminals a large amount of near certain community lose and be connected simultaneously, just can judge to there is potential pseudo-base station near community,

Step 2a, converges short message service signaling, location updating traffic signaling data;

Step 2b, judge the frequency of location updating business and historical trend whether normal: if abnormal, then perform subsequent step (2c); If normal, then note is put logical;

Step 2c, judge that whether APP client's side link is normal, if normally, then note is put logical; If connect abnormal, then perform subsequent step 2d;

Step 2d, after APP client's side link recovers, Automatic inquirying note history, if there is new message, then continues to perform subsequent step 2e; Otherwise it is without new message, then without exception;

Step 2e, judges short message content, if not swindle note, then note is put logical; If swindle note, then extract called number user, perform intelligent early-warning;

Step 2f, extracts the called number of swindle note, forms swindle note potential customer group of being deceived, regeneration and issue early warning short message.

Method described in 11. according to Claim 8 or 9 or 10, is characterized in that: described short message content analysis is sms center address according to caller GT, called GT, LAC, CI, rear subscriber number, called number, short message content, multiple field informations of note length, short message content determine whether to swindle note.