CN109600750A - A kind of anti-spam behavioral value method and device - Google Patents
A kind of anti-spam behavioral value method and device Download PDFInfo
- Publication number
- CN109600750A CN109600750A CN201710922802.1A CN201710922802A CN109600750A CN 109600750 A CN109600750 A CN 109600750A CN 201710922802 A CN201710922802 A CN 201710922802A CN 109600750 A CN109600750 A CN 109600750A
- Authority
- CN
- China
- Prior art keywords
- detected
- message
- detection
- preset
- testing result
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M3/00—Automatic or semi-automatic exchanges
- H04M3/22—Arrangements for supervision, monitoring or testing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2203/00—Aspects of automatic or semi-automatic exchanges
- H04M2203/60—Aspects of automatic or semi-automatic exchanges related to security aspects in telephonic communication systems
- H04M2203/6027—Fraud preventions
Abstract
The invention discloses a kind of anti-spam behavioral value method and devices, improve the precision and detection efficiency of anti-spam behavioral value.The anti-spam behavioral value method, comprising: judge number to be detected preset detection time point send message sending method whether be mass-sending；If so, using preset dispersion algorithm, carrying out violation detection according to the corresponding multiple receiving numbers of the number to be detected and its quantity is put between in the detection to the number to be detected, obtaining testing result；Otherwise, according to the quantity of the corresponding receiving number of number to be detected described in preset detection time section, and the quantity of the number of message is sent to the number to be detected, utilizes preset fan degree algorithm, violation detection is carried out to the number to be detected, obtains testing result；When determining that the testing result characterization obtained sends message in violation of rules and regulations, within the preset interception period, the message sent to the number to be detected is intercepted.
Description
Technical field
The present invention relates to content anti-spam detection field more particularly to a kind of anti-spam behavioral value method and devices.
Background technique
It is other to pay attention to being divided into rubbish discovery, rubbish identification and garbage disposal three categories for internet content anti-spam product at present.
Rubbish is the discovery that one link of most important one, the range and determination is directly affected content anti-spam product that rubbish is found
Working efficiency.
Rubbish discovery is divided into unlawful practice prediction and content rubbish is found.Wherein, unlawful practice prediction is so that anti-spam row
For the stage for being no longer limited to " post-processing ", the behavior of most offending users is big with traffic volume, transmitting-receiving is bigger than ratio, sends
The interval time short obvious characteristics such as low with recipient's number dispersion.In the prior art, main by counting sender's account
Login times, message traffic volume and number IP and number attribution are sent to judge the unlawful practice of user, pass through above-mentioned side
Method may search for the account of doubtful unlawful practice, then be judged by observation message recent violation record and last bit message
Account whether there is unlawful practice, if discovery is in violation of rules and regulations, can directly carry out number drawing black processing, and intercepted rapidly,
It prevents from spreading.
By the above-mentioned judgment mode for sender's behavior, although suspicious user can be found on a large scale, and to it
It executes positioning and blocks, advertisement mass-sending, violation short message can be taken precautions against to a certain extent in existing social category software application scene
The diffusion of mass-sending, rubbish mass-sending class and hot spot class message etc., but due to account login times, message traffic volume, transmission number
IP and number attribution behavioral data judge precision deficiency to unlawful practice, need the cooperation of manual examination and verification that can realize essence
Quasi- control, reduces the detection efficiency of anti-spam behavior.
It therefore, is that the prior art is urgently to be resolved how in the precision and detection efficiency for improving anti-spam behavioral value
One of the technical issues of.
Summary of the invention
The present invention provides a kind of anti-spam behavioral value method and devices, improve the precision of anti-spam behavioral value
With detection efficiency.
In a first aspect, the embodiment of the invention provides a kind of anti-spam behavioral value methods, comprising:
Judge number to be detected preset detection time point send message sending method whether be mass-sending；
If so, according to the corresponding multiple receiving numbers of the number to be detected and its quantity is put between in the detection,
Using preset dispersion algorithm, violation detection is carried out to the number to be detected, obtains testing result；
Otherwise, according to the quantity of the corresponding receiving number of number to be detected described in preset detection time section, Yi Jixiang
The quantity for the number that the number to be detected sends message carries out the number to be detected separated using preset fan degree algorithm
Rule detection, obtains testing result；
When determining that the testing result characterization obtained sends message in violation of rules and regulations, within the preset interception period, to described to be checked
The message that number is sent is surveyed to be intercepted；
Wherein, the detection time section is one section of continuous time comprising the detection time point；The dispersion algorithm
It is the calculation that the probability of transmission rubbish message of number to be detected is determined by the dispersion of multiple receiving numbers of detection time point
Method；The fan degree algorithm be by number to be detected when detecting between transmission message in section fan degree, determine number to be detected
Transmission rubbish message probability algorithm.
Preferably, according to the corresponding multiple receiving numbers of the number to be detected and its quantity is put between in the detection,
Using preset dispersion algorithm, violation detection is carried out to the number to be detected, testing result is obtained, specifically includes:
The corresponding multiple receiving numbers of the number to be detected are put between obtaining in the detection；
When the quantity of receiving number is greater than the first preset threshold, according to the multiple receiving number and the reception number
The quantity of code, utilizes formulaCalculate the dispersion of the multiple receiving number；
Violation detection is carried out to the number to be detected according to the dispersion, obtains testing result；
Wherein, D indicates the dispersion of the multiple receiving number, and n indicates the number of receiving number, xiIt indicates to connect for i-th
Collect the digits code, and x indicates the average value of the multiple receiving number.
Preferably, according to the quantity of the corresponding receiving number of number to be detected described in preset detection time section, and
The quantity that the number of message is sent to the number to be detected carries out the number to be detected using preset fan degree algorithm
It detects in violation of rules and regulations, obtains testing result, specifically include:
Obtain the quantity of the corresponding receiving number of the number to be detected in preset detection time section, to described to be checked
The quantity and the number to be detected of surveying the number of number transmission message send the quantity of message；
When the quantity that the number to be detected sends message is greater than the second preset threshold, according to the number of the receiving number
The quantity of amount and the number that message is sent to the number to be detected calculates the number to be detected and exists using formula Q=y/z
The fan degree of transmission message in the detection time section；
Violation detection is carried out to the number to be detected according to the fan degree, obtains testing result；
Wherein, the fan degree of the transmission message between Q indicates the number to be detected in the detection in section, y are indicated in institute
The quantity for stating the corresponding receiving number of the number to be detected in detection time section, to institute in section between z is indicated in the detection
State the quantity that number to be detected sends the number of message.
Preferably, carrying out violation detection to the number to be detected according to the dispersion, testing result is obtained, it is specific to wrap
It includes:
Judge whether the dispersion is less than third predetermined threshold value；
If the dispersion is less than third predetermined threshold value, it is determined that testing result is to send message in violation of rules and regulations；
If the dispersion is more than or equal to third predetermined threshold value, it is determined that testing result is to close rule to send message.
Preferably, carrying out violation detection to the number to be detected according to the fan degree, testing result is obtained, it is specific to wrap
It includes:
Judge the fan degree whether less than the 4th preset threshold；
If the fan degree is less than the 4th preset threshold, it is determined that testing result is to send message in violation of rules and regulations；
If the fan degree is more than or equal to the 4th preset threshold, it is determined that testing result is to close rule to send message.
Second aspect, the embodiment of the invention provides a kind of anti-spam behavioral value devices, comprising:
Judging unit, for judge number to be detected preset detection time point send message sending method whether be
Mass-sending；
First detection unit, if the judging result for the judging unit be it is yes, according between in the detection
The corresponding multiple receiving numbers of the number to be detected and its quantity are put, using preset dispersion algorithm, to described to be detected
Number carries out violation detection, obtains testing result；Wherein, the dispersion algorithm is multiple receptions number by detection time point
The dispersion of code determines the algorithm of the probability of the transmission rubbish message of number to be detected；
Second detection unit, if the judging result for the judging unit be it is no, according to preset detection time
The quantity of the corresponding receiving number of the number to be detected in section, and send to the number to be detected the number of the number of message
Amount carries out violation detection to the number to be detected, obtains testing result using preset fan degree algorithm；Wherein, the detection
Period is one section of continuous time comprising the detection time point；The fan degree algorithm be by number to be detected when detecting
Between transmission message in section fan degree, determine the algorithm of the probability of the transmission rubbish message of number to be detected.
Interception unit, when for determining that the testing result obtained characterization sends message in violation of rules and regulations, in the preset interception period
Interior, the message sent to the number to be detected intercepts.
Preferably, the first detection unit, specifically for putting the number pair to be detected between obtaining in the detection
The multiple receiving numbers answered；When the quantity of receiving number is greater than the first preset threshold, according to the multiple receiving number and
The quantity of the receiving number, utilizes formulaCalculate the dispersion of the multiple receiving number；According to described
Dispersion carries out violation detection to the number to be detected, obtains testing result；Wherein, D indicates the multiple receiving number
Dispersion, n indicate the number of receiving number, xiIndicate i-th of receiving number,Indicate the average value of the multiple receiving number.
Preferably, the second detection unit, is specifically used for obtaining described to be detected number in preset detection time section
The quantity of the corresponding receiving number of code, the quantity that the number of message is sent to the number to be detected and the number hair to be detected
Send the quantity of message；When the quantity that the number to be detected sends message is greater than the second preset threshold, according to the reception number
The quantity of code and the quantity for the number that message is sent to the number to be detected are calculated described to be detected using formula Q=y/z
Number in the detection between transmission message in section fan degree；Violation inspection is carried out to the number to be detected according to the fan degree
It surveys, obtains testing result；Wherein, the fan degree of the transmission message between Q indicates the number to be detected in the detection in section, y
Between indicating in the detection in section the corresponding receiving number of the number to be detected quantity, between z is indicated in the detection
The introversive number to be detected of section sends the quantity of the number of message.
Preferably, the first detection unit, specifically for judging whether the dispersion is less than third predetermined threshold value；Such as
Dispersion described in fruit is less than third predetermined threshold value, it is determined that testing result is to send message in violation of rules and regulations；If the dispersion is greater than
Equal to third predetermined threshold value, it is determined that testing result is to close rule to send message.
Preferably, whether the second detection unit, be specifically used for judging the fan degree less than the 4th preset threshold；If
The fan degree is less than the 4th preset threshold, it is determined that testing result is to send message in violation of rules and regulations；If the fan degree is more than or equal to the
Four preset thresholds, it is determined that testing result is to close rule to send message.
The third aspect the embodiment of the invention provides a kind of electronic equipment, including memory, processor and is stored in described
On memory and the computer program that can run on the processor, the processor realize the present invention when executing described program
The anti-spam behavioral value method.
Fourth aspect, the embodiment of the invention provides a kind of computer readable storage mediums, are stored thereon with computer journey
Sequence, the program realize the step in anti-spam behavioral value method of the present invention when being executed by processor.
The beneficial effect comprise that
In anti-spam behavioral value method and device provided in an embodiment of the present invention, safety control platform judges to be detected number
Whether code is mass-sending in the sending method that preset detection time point sends message, if described sender formula is mass-sending, root
According to the corresponding multiple receiving numbers of the number to be detected and its quantity is put between in the detection, preset dispersion is utilized to calculate
Method carries out violation detection to the number to be detected, obtains testing result, if described sender formula is point-to-point transmission,
According to the quantity of the corresponding receiving number of number to be detected described in preset detection time section, and to the number to be detected
The quantity for sending the number of message carries out violation detection to the number to be detected, is detected using preset fan degree algorithm
As a result, when determining that the testing result obtained characterization sends message in violation of rules and regulations, within the preset interception period, to described to be detected
The message that number is sent is intercepted, wherein and the detection time section is one section of continuous time comprising the detection time point,
The dispersion algorithm is the transmission rubbish that number to be detected is determined by the dispersion of multiple receiving numbers of detection time point
The algorithm of the probability of message, the fan degree algorithm be by number to be detected when detecting between transmission message in section fan degree,
Determine the algorithm of the probability of the transmission rubbish message of number to be detected, above scheme provided in an embodiment of the present invention, according to transmission
The situation of receiving and sending messages interior when detecting of number and receiving number, proposes by utilizing dispersion algorithm and fan degree algorithm
The probability for determining the transmission rubbish message of number to be detected, carries out violation detection to number to be detected, effectively reduces in violation of rules and regulations
The range of behavior judgement, improves the precision and detection efficiency of anti-spam behavioral value.
Other features and advantages of the present invention will be illustrated in the following description, also, partly becomes from specification
It obtains it is clear that understand through the implementation of the invention.The objectives and other advantages of the invention can be by written explanation
Specifically noted structure is achieved and obtained in book, claims and attached drawing.
Detailed description of the invention
The drawings described herein are used to provide a further understanding of the present invention, constitutes a part of the invention, this hair
Bright illustrative embodiments and their description are used to explain the present invention, and are not constituted improper limitations of the present invention.In the accompanying drawings:
Fig. 1 is the implementation process diagram for the anti-spam behavioral value method that the embodiment of the present invention one provides；
Fig. 2 is the structural schematic diagram of anti-spam behavioral value device provided by Embodiment 2 of the present invention.
Specific embodiment
The present invention provides a kind of anti-spam behavioral value method and devices, improve the precision of anti-spam behavioral value
With detection efficiency.
The implementation principle of anti-spam behavioral value method provided in an embodiment of the present invention is: safety control platform judges to be checked
Whether survey number in the sending method that preset detection time point sends message is mass-sending, if described sender formula is mass-sending,
Then according to putting the corresponding multiple receiving numbers of the number to be detected and its quantity between in the detection, using preset discrete
Algorithm is spent, violation detection is carried out to the number to be detected, obtains testing result, if described sender formula is point-to-point hair
It send, then according to the quantity of the corresponding receiving number of number to be detected described in preset detection time section, and to described to be checked
The quantity that number sends the number of message is surveyed, using preset fan degree algorithm, violation detection is carried out to the number to be detected, is obtained
Testing result is obtained, when determining the testing result obtained characterization transmission message in violation of rules and regulations, within the preset interception period, to described
The message that number to be detected is sent is intercepted, wherein the detection time section is the Duan Lian comprising the detection time point
The continuous time, the dispersion algorithm is the hair that number to be detected is determined by the dispersion of multiple receiving numbers of detection time point
Send the algorithm of the probability of rubbish message, the fan degree algorithm be by number to be detected when detecting between transmission message in section
Fan degree, determine number to be detected transmission rubbish message probability algorithm, above scheme provided in an embodiment of the present invention, according to
The situation of receiving and sending messages interior when detecting for sending number and receiving number, proposes by utilizing dispersion algorithm and fan degree
Algorithm determines the probability of the transmission rubbish message of number to be detected, carries out violation detection to number to be detected, effectively reduces
The range of unlawful practice judgement, improves the precision and detection efficiency of anti-spam behavioral value.
Below in conjunction with Figure of description, preferred embodiment of the present invention will be described, it should be understood that described herein
Preferred embodiment only for the purpose of illustrating and explaining the present invention and is not intended to limit the present invention, and in the absence of conflict, this hair
The feature in embodiment and embodiment in bright can be combined with each other.
Embodiment one
As shown in Figure 1, the implementation process diagram of its anti-spam behavioral value method provided for the embodiment of the present invention one,
It may comprise steps of:
S11, judge number to be detected preset detection time point send message sending method whether be mass-sending, if
It is to then follow the steps S12, it is no to then follow the steps S13.
When it is implemented, safety control platform acquires the full dose real-time messages and number of users of each number from business platform in real time
According to and store, wherein the real-time messages of acquisition can include but is not limited to: message sending time, message body content, user data
It can include but is not limited to: sending number, receiving number, login time information.Wherein, each number can be mobile subscriber's mobile phone
Number.
When it is implemented, sending time of the safety control platform according to each transmission message of number to be detected, counts institute
State the number for the transmission message that number to be detected is sent in preset detection time point, and according to the number, judgement it is described to
Point sends whether the sending method of message is mass-sending between detecting number in the detection.Specifically, if in the detection
Between put number to be detected and send the number of message and be greater than 1, it is determined that its sending method is mass-sending, i.e., number to be detected is in the detection
This moment at time point has sent multiple messages simultaneously, if putting the number that number to be detected sends message between in the detection
Equal to 1, i.e., number to be detected only has sent 1 message at detection time this moment of point, it is determined that its sending method is point
It is sent to.Wherein, user can sets itself detection time point according to actual needs, be not construed as limiting herein.
S12, according to the corresponding multiple receiving numbers of the number to be detected and its quantity is put between in the detection, utilize
Preset dispersion algorithm carries out violation detection to the number to be detected, obtains testing result.
When it is implemented, the dispersion algorithm be determined by the dispersions of multiple receiving numbers of detection time point to
Detect the algorithm of the probability of the transmission rubbish message of number.
Specifically, safety control platform puts the corresponding multiple receptions number of the number to be detected between obtaining in the detection
Code；When the quantity of receiving number is greater than the first preset threshold, according to the multiple receiving number and the receiving number
Quantity utilizes formulaCalculate the dispersion of the multiple receiving number；According to the dispersion to it is described to
It detects number and carries out violation detection, obtain testing result；Wherein, D indicates the dispersion of the multiple receiving number, and n expression connects
Collect the digits the number of code, xiIndicate i-th of receiving number,Indicate the average value of the multiple receiving number.Wherein, first is default
Threshold value can be set by safety control platform.
When it is implemented, dispersion algorithm can also be Euclidean vector-distance or minimum angle cosine value-based algorithm.
If the secondary mass-sending number is more, when being greater than the first preset threshold, diffusivity is stronger, and there are offending message suspicion
It doubts, then further calculates the dispersion of the number of the secondary mass-sending.
Further, violation detection is carried out to the number to be detected according to the dispersion, obtains testing result, specifically
Are as follows: judge whether the dispersion is less than third predetermined threshold value；If the dispersion is less than third predetermined threshold value, it is determined that inspection
Surveying result is to send message in violation of rules and regulations；If the dispersion is more than or equal to third predetermined threshold value, it is determined that testing result is to close rule
Send message.Wherein, third predetermined threshold value can be set based on experience value by safety control platform.
When the quantity of receiving number is less than or equal to first preset threshold, illustrate that this mass-sending is not belonging to rubbish message
Dispersal behavior, no spread risk, then without carrying out the judgment step for closing rule behavior in next step according to dispersion algorithm.
For example, current detection time point is 8:00, and number to be detected is in the sending method that this detection time point sends message
Mass-sending, safety control platform obtain the corresponding multiple receiving numbers of message that the number to be detected of storage is mass-sended in 8:00, it is assumed that there are 5,
Respectively phone number: 13900000000,13800000000,13700000000,13600000000,13500000000, it is denoted as x respectively1
~x5.Assuming that the first preset threshold is set as 4, since the quantity of receiving number is greater than 4, then the dispersion of multiple receiving number is calculated,
Specifically, x1~x5Average value
x1~x10DispersionFurther, then by the dispersion and pacify
The third predetermined threshold value of full control platform setting is compared, if the dispersion is less than third predetermined threshold value, it is determined that detection
It as a result is transmission message in violation of rules and regulations；If the dispersion is more than or equal to third predetermined threshold value, it is determined that testing result is to close rule hair
Send message.
S13, according to the quantity of the corresponding receiving number of number to be detected described in preset detection time section, and to institute
The quantity that number to be detected sends the number of message is stated, using preset fan degree algorithm, the number to be detected is carried out in violation of rules and regulations
Detection obtains testing result.
When it is implemented, the detection time section is one section of continuous time comprising the detection time point, the fan degree
Algorithm be by number to be detected when detecting between transmission message in section fan degree, determine that the transmission rubbish of number to be detected disappears
The algorithm of the probability of breath.
Specifically, safety control platform obtains that the number to be detected in preset detection time section is corresponding to be received number
The quantity of code, the quantity that the number of message is sent to the number to be detected and the number to be detected send the quantity of message；
When the quantity that the number to be detected sends message is greater than the second preset threshold, according to the quantity of the receiving number with to institute
The quantity that number to be detected sends the number of message is stated, using formula Q=y/z, calculates the number to be detected in the detection
The fan degree of transmission message in period；Violation detection is carried out to the number to be detected according to the fan degree, obtains detection knot
Fruit；Wherein, the fan degree of the transmission message between Q indicates the number to be detected in the detection in section, y are indicated in the detection
The quantity of the corresponding receiving number of the number to be detected in period, section is introversive described to be checked between z is indicated in the detection
Survey the quantity that number sends the number of message.Wherein, the second preset threshold can be set by safety control platform.
If the message traffic volume of the number to be detected is larger, and diffusivity is stronger, deposits in preset detection time section
In offending message suspicion, then the fan angle value of its transmission message in default detection time section is further calculated.
Further, violation detection is carried out to the number to be detected according to the fan degree, obtains testing result, specifically
Are as follows: judge the fan degree whether less than the 4th preset threshold；If the fan degree is less than the 4th preset threshold, it is determined that detection knot
Fruit is to send message in violation of rules and regulations；If the fan degree is more than or equal to the 4th preset threshold, it is determined that testing result is to close rule and send to disappear
Breath.Wherein, the 4th preset threshold can be set based on experience value by safety control platform.
If the quantity that number to be detected sends message is less than or equal to the second preset threshold, illustrate the account in preset inspection
Diffusivity is weaker in the survey time, is not belonging to rubbish message dispersal behavior, no spread risk, then without carrying out according to fan degree algorithm
The judgment step of rule behavior is closed in next step.
When S14, the determining testing result characterization obtained send message in violation of rules and regulations, within the preset interception period, to described
The message that number to be detected is sent is intercepted.
In this step, when safety control platform determines that the testing result characterization obtained sends message in violation of rules and regulations, preset
It intercepts in the period, the message sent to the number to be detected intercepts.
Wherein, intercepting the period can sets itself, such as several hours, several days etc. according to the actual situation.
The anti-spam behavioral value method that the embodiment of the present invention one provides, safety control platform judge number to be detected pre-
If detection time point send whether the sending method of message is mass-sending, if described sender formula is mass-sending, according in institute
The corresponding multiple receiving numbers of number to be detected described in detection time point and its quantity are stated, it is right using preset dispersion algorithm
The number to be detected carries out violation detection, obtains testing result, if described sender formula is point-to-point transmission, according to pre-
If detection time section in the corresponding receiving number of the number to be detected quantity, and disappear to the number transmission to be detected
The quantity of the number of breath carries out violation detection to the number to be detected, obtains testing result using preset fan degree algorithm,
When determining that the testing result obtained characterization sends message in violation of rules and regulations, within the preset interception period, to the number to be detected
The message of transmission is intercepted, wherein the detection time section is one section of continuous time comprising the detection time point, described
Dispersion algorithm is the transmission rubbish message that number to be detected is determined by the dispersion of multiple receiving numbers of detection time point
Probability algorithm, the fan degree algorithm be by number to be detected when detecting between transmission message in section fan degree, determine
The algorithm of the probability of the transmission rubbish message of number to be detected, above scheme provided in an embodiment of the present invention, according to transmission number
With the situation of receiving and sending messages interior when detecting of receiving number, propose to pass through determining using dispersion algorithm and fan degree algorithm
The probability of the transmission rubbish message of number to be detected, carries out violation detection to number to be detected, effectively reduces unlawful practice
The range of judgement improves the precision and detection efficiency of anti-spam behavioral value.
Embodiment two
Based on the same inventive concept, a kind of anti-spam behavioral value device is additionally provided in the embodiment of the present invention, due to upper
It is similar to above-mentioned anti-spam behavioral value method to state the principle that device solves the problems, such as, therefore the implementation side of may refer to of above-mentioned apparatus
The implementation of method, overlaps will not be repeated.
As shown in Fig. 2, it is structural schematic diagram of anti-spam behavioral value device provided by Embodiment 2 of the present invention, it can be with
Include:
Judging unit 21, for judge number to be detected preset detection time point send message sending method whether
For mass-sending；
First detection unit 22, if the judging result for the judging unit 21 be it is yes, according in the detection
The corresponding multiple receiving numbers of number to be detected described in time point and its quantity, using preset dispersion algorithm, to it is described to
It detects number and carries out violation detection, obtain testing result；Wherein, the dispersion algorithm is multiple the connecing by detection time point
Collect the digits code dispersion determine number to be detected transmission rubbish message probability algorithm；
Second detection unit 23, if the judging result for the judging unit 21 be it is no, according to preset detection
The quantity of the corresponding receiving number of the number to be detected in period, and send to the number to be detected the number of message
Quantity violation detection is carried out to the number to be detected, obtains testing result using preset fan degree algorithm；Wherein, described
Detection time section is one section of continuous time comprising the detection time point；The fan degree algorithm is being examined by number to be detected
The fan degree for surveying the transmission message in the period determines the algorithm of the probability of the transmission rubbish message of number to be detected.
Interception unit 24, when for determining that the testing result obtained characterization sends message in violation of rules and regulations, in the preset interception time
In section, the message sent to the number to be detected is intercepted.
Preferably, the first detection unit 22, specifically for putting the number to be detected between obtaining in the detection
Corresponding multiple receiving numbers；When the quantity of receiving number be greater than the first preset threshold when, according to the multiple receiving number with
And the quantity of the receiving number, utilize formulaCalculate the dispersion of the multiple receiving number；According to institute
It states dispersion and violation detection is carried out to the number to be detected, obtain testing result；Wherein, D indicates the multiple receiving number
Dispersion, n indicate receiving number number, xiIndicate i-th of receiving number,Indicate being averaged for the multiple receiving number
Value.
Preferably, the second detection unit 23, is specifically used for obtaining described to be detected in preset detection time section
The quantity of the corresponding receiving number of number, the quantity that the number of message is sent to the number to be detected and the number to be detected
Send the quantity of message；When the quantity that the number to be detected sends message is greater than the second preset threshold, according to the reception
The quantity of number and the quantity for the number that message is sent to the number to be detected are calculated described to be checked using formula Q=y/z
The fan degree of transmission message between surveying number in the detection in section；The number to be detected is carried out in violation of rules and regulations according to the fan degree
Detection obtains testing result；Wherein, the fan degree of the transmission message between Q indicates the number to be detected in the detection in section,
Y indicate in the detection between in section the corresponding receiving number of the number to be detected quantity, between z is indicated in the detection
The introversive number to be detected of section sends the quantity of the number of message.
Preferably, the first detection unit 22, specifically for judging whether the dispersion is less than third predetermined threshold value；
If the dispersion is less than third predetermined threshold value, it is determined that testing result is to send message in violation of rules and regulations；If the dispersion is big
In equal to third predetermined threshold value, it is determined that testing result is to close rule to send message.
Preferably, whether the second detection unit 23, be specifically used for judging the fan degree less than the 4th preset threshold；Such as
Fan degree is less than the 4th preset threshold described in fruit, it is determined that testing result is to send message in violation of rules and regulations；If the fan degree is more than or equal to
4th preset threshold, it is determined that testing result is to close rule to send message.
For convenience of description, above each section is divided by function describes respectively for each module (or unit).Certainly, exist
Implement to realize the function of each module (or unit) in same or multiple softwares or hardware when the present invention.
Embodiment three
The embodiment of the present invention three provides a kind of electronic equipment, including memory, processor and is stored in the memory
Computer program that is upper and can running on the processor, the processor realize the embodiment of the present invention when executing described program
Anti-spam behavioral value method described in one.
Example IV
The embodiment of the present invention four provides a kind of computer readable storage medium, is stored thereon with computer program, the journey
The step in anti-spam behavioral value method described in the embodiment of the present invention one is realized when sequence is executed by processor.
It should be understood by those skilled in the art that, the embodiment of the present invention can provide as method, system or computer program
Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the present invention
Apply the form of example.Moreover, it wherein includes the computer of computer usable program code that the present invention, which can be used in one or more,
The computer program implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) produces
The form of product.
The present invention be referring to according to the method for the embodiment of the present invention, the process of equipment (system) and computer program product
Figure and/or block diagram describe.It should be understood that every one stream in flowchart and/or the block diagram can be realized by computer program instructions
The combination of process and/or box in journey and/or box and flowchart and/or the block diagram.It can provide these computer programs
Instruct the processor of general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices to produce
A raw machine, so that being generated by the instruction that computer or the processor of other programmable data processing devices execute for real
The device for the function of being specified in present one or more flows of the flowchart and/or one or more blocks of the block diagram.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
Although preferred embodiments of the present invention have been described, it is created once a person skilled in the art knows basic
Property concept, then additional changes and modifications can be made to these embodiments.So it includes excellent that the following claims are intended to be interpreted as
It selects embodiment and falls into all change and modification of the scope of the invention.
Obviously, various changes and modifications can be made to the invention without departing from essence of the invention by those skilled in the art
Mind and range.In this way, if these modifications and changes of the present invention belongs to the range of the claims in the present invention and its equivalent technologies
Within, then the present invention is also intended to include these modifications and variations.
Claims (12)
1. a kind of anti-spam behavioral value method characterized by comprising
Judge number to be detected preset detection time point send message sending method whether be mass-sending；
If so, being utilized according to the corresponding multiple receiving numbers of the number to be detected and its quantity is put between in the detection
Preset dispersion algorithm carries out violation detection to the number to be detected, obtains testing result；
Otherwise, according to the quantity of the corresponding receiving number of number to be detected described in preset detection time section, and to described
Number to be detected sends the quantity of the number of message, using preset fan degree algorithm, carries out violation inspection to the number to be detected
It surveys, obtains testing result；
When determining that the testing result characterization obtained sends message in violation of rules and regulations, within the preset interception period, to described to be detected number
The message that code is sent is intercepted；
Wherein, the detection time section is one section of continuous time comprising the detection time point；The dispersion algorithm is logical
Cross multiple receiving numbers of detection time point dispersion determine number to be detected transmission rubbish message probability algorithm；Institute
State fan degree algorithm be by number to be detected when detecting between transmission message in section fan degree, determine the transmission of number to be detected
The algorithm of the probability of rubbish message.
2. the method as described in claim 1, which is characterized in that according to putting between in the detection, the number to be detected is corresponding
Multiple receiving numbers and its quantity violation detection is carried out to the number to be detected, is obtained using preset dispersion algorithm
Testing result specifically includes:
The corresponding multiple receiving numbers of the number to be detected are put between obtaining in the detection；
When the quantity of receiving number is greater than the first preset threshold, according to the multiple receiving number and the receiving number
Quantity utilizes formulaCalculate the dispersion of the multiple receiving number；
Violation detection is carried out to the number to be detected according to the dispersion, obtains testing result；
Wherein, D indicates the dispersion of the multiple receiving number, and n indicates the number of receiving number, xiIndicate i-th of reception number
Code,Indicate the average value of the multiple receiving number.
3. the method as described in right 1, which is characterized in that corresponding according to the number to be detected in preset detection time section
The quantity of receiving number, and the quantity of the number to the number transmission message to be detected are right using preset fan degree algorithm
The number to be detected carries out violation detection, obtains testing result, specifically includes:
Obtain the quantity of the corresponding receiving number of the number to be detected in preset detection time section, to described to be detected number
Code sends the quantity of the number of message and the quantity of the number transmission message to be detected；
When the quantity that the number to be detected sends message is greater than the second preset threshold, according to the quantity of the receiving number with
The quantity that the number of message is sent to the number to be detected calculates the number to be detected described using formula Q=y/z
The fan degree of transmission message in detection time section；
Violation detection is carried out to the number to be detected according to the fan degree, obtains testing result；
Wherein, the fan degree of the transmission message between Q indicates the number to be detected in the detection in section, y are indicated in the inspection
The quantity for surveying the corresponding receiving number of the number to be detected in the period, between z is indicated in the detection section it is introversive it is described to
Detect the quantity that number sends the number of message.
4. method according to claim 2, which is characterized in that carried out in violation of rules and regulations according to the dispersion to the number to be detected
Detection obtains testing result, specifically includes:
Judge whether the dispersion is less than third predetermined threshold value；
If the dispersion is less than third predetermined threshold value, it is determined that testing result is to send message in violation of rules and regulations；
If the dispersion is more than or equal to third predetermined threshold value, it is determined that testing result is to close rule to send message.
5. method as claimed in claim 3, which is characterized in that carry out violation inspection to the number to be detected according to the fan degree
It surveys, obtains testing result, specifically include:
Judge the fan degree whether less than the 4th preset threshold；
If the fan degree is less than the 4th preset threshold, it is determined that testing result is to send message in violation of rules and regulations；
If the fan degree is more than or equal to the 4th preset threshold, it is determined that testing result is to close rule to send message.
6. a kind of anti-spam behavioral value device characterized by comprising
Whether judging unit is group for judging number to be detected in the sending method that preset detection time point sends message
Hair；
First detection unit, if the judging result for the judging unit be it is yes, put institute according between in the detection
The corresponding multiple receiving numbers of number to be detected and its quantity are stated, using preset dispersion algorithm, to the number to be detected
Violation detection is carried out, testing result is obtained；Wherein, the dispersion algorithm is multiple receiving numbers by detection time point
Dispersion determines the algorithm of the probability of the transmission rubbish message of number to be detected；
Second detection unit, if the judging result for the judging unit be it is no, according in preset detection time section
The quantity of the corresponding receiving number of the number to be detected, and the quantity of the number of message is sent to the number to be detected,
Using preset fan degree algorithm, violation detection is carried out to the number to be detected, obtains testing result；Wherein, when the detection
Between section be one section of continuous time comprising the detection time point；The fan degree algorithm be by number to be detected when detecting between
The fan degree of transmission message in section determines the algorithm of the probability of the transmission rubbish message of number to be detected.
Interception unit is right within the preset interception period when for determining that the testing result obtained characterization sends message in violation of rules and regulations
The message that the number to be detected is sent is intercepted.
7. device as claimed in claim 6, which is characterized in that
The first detection unit, specifically for putting the corresponding multiple receptions of the number to be detected between obtaining in the detection
Number；When the quantity of receiving number is greater than the first preset threshold, according to the multiple receiving number and the receiving number
Quantity, utilize formulaCalculate the dispersion of the multiple receiving number；According to the dispersion to described
Number to be detected carries out violation detection, obtains testing result；Wherein, D indicates the dispersion of the multiple receiving number, and n is indicated
The number of receiving number, xiIndicate i-th of receiving number,Indicate the average value of the multiple receiving number.
8. device as claimed in claim 6, which is characterized in that
The second detection unit is specifically used for obtaining the corresponding reception of the number to be detected in preset detection time section
The quantity of number, the quantity that the number of message is sent to the number to be detected and the number to be detected send the number of message
Amount；When the quantity that the number to be detected sends message is greater than the second preset threshold, according to the quantity of the receiving number with
The quantity that the number of message is sent to the number to be detected calculates the number to be detected described using formula Q=y/z
The fan degree of transmission message in detection time section；Violation detection is carried out to the number to be detected according to the fan degree, is examined
Survey result；Wherein, the fan degree of the transmission message between Q indicates the number to be detected in the detection in section, y are indicated described
The quantity of the corresponding receiving number of the number to be detected in detection time section, between z is indicated in the detection described in section introversion
Number to be detected sends the quantity of the number of message.
9. device as claimed in claim 7, which is characterized in that
The first detection unit, specifically for judging whether the dispersion is less than third predetermined threshold value；If described discrete
Degree is less than third predetermined threshold value, it is determined that testing result is to send message in violation of rules and regulations；If it is pre- that the dispersion is more than or equal to third
If threshold value, it is determined that testing result is to close rule to send message.
10. device as claimed in claim 8, which is characterized in that
Whether the second detection unit is specifically used for judging the fan degree less than the 4th preset threshold；If the fan degree is small
In the 4th preset threshold, it is determined that testing result is to send message in violation of rules and regulations；If the fan degree is more than or equal to the 4th preset threshold,
Then determine that testing result is to close rule to send message.
11. a kind of electronic equipment, including memory, processor and it is stored on the memory and can transports on the processor
Capable computer program, which is characterized in that the processor is realized when executing described program such as any one of Claims 1 to 5 institute
The anti-spam behavioral value method stated.
12. a kind of computer readable storage medium, is stored thereon with computer program, which is characterized in that the program is by processor
The step in anti-spam behavioral value method as claimed in any one of claims 1 to 5 is realized when execution.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710922802.1A CN109600750A (en) | 2017-09-30 | 2017-09-30 | A kind of anti-spam behavioral value method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710922802.1A CN109600750A (en) | 2017-09-30 | 2017-09-30 | A kind of anti-spam behavioral value method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109600750A true CN109600750A (en) | 2019-04-09 |
Family
ID=65955966
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710922802.1A Pending CN109600750A (en) | 2017-09-30 | 2017-09-30 | A kind of anti-spam behavioral value method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109600750A (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101453522A (en) * | 2008-12-19 | 2009-06-10 | 中国移动通信集团浙江有限公司 | Method for non-standardized dialing service monitoring between networks |
| CN101730017A (en) * | 2008-10-27 | 2010-06-09 | 中国移动通信集团吉林有限公司 | Method and device for determining users sending spam short messages |
| CN105323390A (en) * | 2014-08-05 | 2016-02-10 | 武汉科技大学 | Crank call identification system based on called dispersion |
| CN105472586A (en) * | 2015-12-22 | 2016-04-06 | 安徽一拓通信科技集团股份有限公司 | Spam message monitoring system and method |
| CN105704691A (en) * | 2016-04-27 | 2016-06-22 | 宇龙计算机通信科技(深圳)有限公司 | Scam short message recognition method and device |
| CN106255113A (en) * | 2015-06-10 | 2016-12-21 | 中兴通讯股份有限公司 | The recognition methods of harassing call and device |
-
2017
- 2017-09-30 CN CN201710922802.1A patent/CN109600750A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101730017A (en) * | 2008-10-27 | 2010-06-09 | 中国移动通信集团吉林有限公司 | Method and device for determining users sending spam short messages |
| CN101453522A (en) * | 2008-12-19 | 2009-06-10 | 中国移动通信集团浙江有限公司 | Method for non-standardized dialing service monitoring between networks |
| CN105323390A (en) * | 2014-08-05 | 2016-02-10 | 武汉科技大学 | Crank call identification system based on called dispersion |
| CN106255113A (en) * | 2015-06-10 | 2016-12-21 | 中兴通讯股份有限公司 | The recognition methods of harassing call and device |
| CN105472586A (en) * | 2015-12-22 | 2016-04-06 | 安徽一拓通信科技集团股份有限公司 | Spam message monitoring system and method |
| CN105704691A (en) * | 2016-04-27 | 2016-06-22 | 宇龙计算机通信科技(深圳)有限公司 | Scam short message recognition method and device |
Non-Patent Citations (1)
| Title |
|---|
| 武丽虹: "走进中考看"三差"", 《理科考试研究 数学版》 * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105376255B (en) | A kind of Android platform intrusion detection method based on K-means cluster | |
| US9325730B2 (en) | Collaborative phishing attack detection | |
| US9253207B2 (en) | Collaborative phishing attack detection | |
| US9398038B2 (en) | Collaborative phishing attack detection | |
| CN109660539A (en) | It falls device identification method, device, electronic equipment and storage medium | |
| TWI743787B (en) | Monitoring method and device for resisting attack | |
| CN109559192A (en) | Risk checking method, device, equipment and storage medium based on association map | |
| CN108418777A (en) | A kind of fishing mail detection method, apparatus and system | |
| CN106790023A (en) | Network security Alliance Defense method and apparatus | |
| CN111629010B (en) | Malicious user identification method and device | |
| CN106295349A (en) | Risk Identification Method, identification device and the anti-Ore-controlling Role that account is stolen | |
| CN105721416A (en) | Apt event attack organization homology analysis method and apparatus | |
| RU2011138462A (en) | USE OF USER SOLUTIONS TO DETECT UNKNOWN COMPUTER THREATS | |
| CN108881263A (en) | A kind of network attack result detection method and system | |
| CN108449218B (en) | The network security situation sensing system of next-generation key message infrastructure | |
| CN110213236B (en) | Method for determining business safety risk, electronic equipment and computer storage medium | |
| CN103136255B (en) | The method and apparatus of information management | |
| CN105472618B (en) | The recognition methods of pseudo-base station message and device | |
| KR20130035572A (en) | Detecting apparatus and method for messenger phishing | |
| CN106599688A (en) | Application category-based Android malicious software detection method | |
| CN109922065A (en) | Malicious websites method for quickly identifying | |
| CN109600362A (en) | Zombie host recognition methods, identification equipment and medium based on identification model | |
| CN109842858A (en) | A kind of service exception order detection method and device | |
| CN106790041B (en) | Internet protocol IP credit database generation method and device | |
| CN103996006A (en) | Information system security risk assessment method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20190409 |
|
| RJ01 | Rejection of invention patent application after publication |