KR101618730B1 - Device for blocking illegal internet international originating call and method for blocking illegal internet international originating call - Google Patents

Abstract

An illegal internet international calling party which detects in real time an authentication attempt point of a terminal using account information (for example, an ID and a password) stolen by a hacker and blocks an illegal international call using the stolen account information A blocking device and an illegal internet international outgoing call blocking method are disclosed. A method for blocking an illegal internet international call origination call in an illegal internet international call blocking device according to an aspect of the present invention includes: storing a mapping table in which a telephone number and corresponding pattern matching information and an IP address are recorded; Collecting information of an Internet origination call originated from a terminal to a communication system; Analyzing the collected information of the outgoing call and confirming whether it is a call relating to registration or a call relating to the call; And registering the information of the outgoing call in the black list according to a result of the comparison between the collected information of the outgoing call and the telephone number of the received mapping table and the pattern matching information.

Description

TECHNICAL FIELD [0001] The present invention relates to an illegal internet outgoing call blocking device and an illegal internet outgoing call blocking method using pattern matching,

The present invention relates to detection and blocking of an illegal internet international call by hacking, and more particularly, to an apparatus and method for detecting and blocking an illegal internet international call through pattern matching of a signal message.

In recent years, Internet telephony has been spreading rapidly and private IP addresses (PBXs) such as Private Branch eXchange (PBX), which are purchased directly by customers, can be used as factory IDs and passwords (PassWord: PW) In many cases, the hacker easily identifies the ID and the password. By stealing the ID and password of the Internet phone terminal and causing an illegal international call, To tens of thousands of won.

However, there is currently no way to detect such hacking attempts and illegal international call origination in real time, and there is a method of detecting and blocking this based on statistical techniques using some billing information. However, There is a problem that the damage can not be fundamentally prevented since it is already detected after a large amount of international telephone billing damage occurs.

Korean Public Patent No. 2012-0010372 (2012.02.03 published)

Disclosure of Invention Technical Problem [8] The present invention has been proposed in order to solve such a conventional problem, and it is an object of the present invention to provide a system and method for detecting an authentication attempt time of a terminal using account information (e.g., ID and password) stolen by a hacker in real time, The purpose of this is to provide an illegal internet international call blocking device and an illegal internet international call blocking method which block the illegal internet international call.

Other objects and advantages of the present invention will become apparent from the following description, and it will be understood by those skilled in the art that the present invention is not limited thereto. It will also be readily apparent that the objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

According to an aspect of the present invention, there is provided a method for blocking an illegal internet international call from an illegal internet call origination device, the method comprising: storing a mapping table in which a phone number, pattern matching information corresponding thereto, step; Collecting information of an Internet origination call originated from a terminal to a communication system; Analyzing the collected information of the outgoing call and confirming whether it is a call relating to registration or a call relating to the call; And registering the information of the outgoing call in the black list according to a result of the comparison between the collected information of the outgoing call and the telephone number of the received mapping table and the pattern matching information.

Comparing the information of the collected outgoing call with the black list when the information related to the call origination is confirmed in the confirming step and if the information of the outgoing call is recorded in the black list, And blocking the call.

The confirming step may determine that the call relating to call initiation is performed when the SIP packet method is INVITE.

The blocking step may record the number of calls or the call time to the calling telephone number of the illegal internet international origination call and may block the outgoing call if the number of calls or the call time exceeds the threshold value.

The confirming step may determine that the SIP packet is a REGISTERS call if the method is REGISTER.

The step of registering in the black list may include comparing an outgoing telephone number and pattern matching information included in the collected outgoing call information with outgoing telephone numbers and pattern matching information stored in the mapping table; And checking if the IP address included in the outgoing call information is an overseas IP address, if the comparison result does not match.

If the IP address included in the outgoing call information is an overseas IP address, the step of registering in the black list may register the outgoing phone number and the IP address included in the outgoing call information in the black list.

The step of collecting the information of the outgoing call may collect information of the Internet origination call from a network access device connecting the terminal and the communication system.

The pattern matching information may include at least one of a header number, a header order, and a header value.

According to another aspect of the present invention, there is provided an apparatus for blocking an illegal internet international call, comprising: a database for storing a mapping table in which a phone number and corresponding pattern matching information and an IP address are recorded; An outgoing call information collecting unit for collecting information of an outgoing call originated from a terminal to a communication system; An origination call analyzer for analyzing the collected information of the outgoing call to check whether the call is related to the call or the call related to the registration and delivering the information of the outgoing call to the blacklist register if the call is related to the registration; And a blacklist registration unit for registering the information of the outgoing call in the black list according to the result of the comparison of the collected outgoing call information and the phone number of the mapping table and the pattern matching information.

The apparatus further includes an illegal international call disconnection unit, wherein the outgoing call analyzing unit analyzes the collected information of the outgoing call and delivers the information of the outgoing call to the illegal international call disconnection unit when the call is related to the call initiation, The illegal international call origination blocking unit compares the collected outgoing call information with the black list, and when the information of the originated call is recorded in the black list, the illegal international call origination blocking unit may block the origination call by determining it as an illegal internet international origination call.

The outgoing call analyzing unit may determine that the call related to the call initiation when the method of the SIP packet is INVITE.

The illegal international call origination blocking unit may record the number of calls or the call duration with respect to the originating phone number of the illegal internet international origination call and may block the outgoing call when the number of calls or the call duration exceeds the threshold.

The outgoing call analyzing unit may determine that the SIP packet is a registration related call when the method of the SIP packet is REGISTER.

Wherein the blacklist register compares the calling telephone number and pattern matching information included in the collected outgoing call information with the outgoing telephone number and pattern matching information stored in the mapping table and if the comparison result does not match, And if the IP address is an IP address, the calling telephone number and the IP address included in the information of the origination call can be registered in the black list.

The outgoing call information collecting unit may collect information of the outgoing call from the network connecting device connecting the terminal and the communication system.

The pattern matching information may include at least one of a header number, a header order, and a header value.

According to an aspect of the present invention, there is provided a method for detecting an authentication attempt of a terminal using account information, that is, an ID and a password, which are hijacked by a hacker in real time, and, when an internet international call using account information stolen by the hacker occurs By blocking this, it is possible to prevent illegal internet international telephone billing damage from origin.

FIG. 1 is a block diagram illustrating a configuration of a communication system in which an illegal internet international origination call detection and blocking method according to an embodiment of the present invention is implemented.
2 is a block diagram of an illegal internet international call blocking apparatus according to an embodiment of the present invention.
FIG. 3 is a flowchart illustrating a method for constructing a blacklist table and a terminal-based terminal authentication request IP table according to an embodiment of the present invention.
4 is a flow diagram illustrating a procedure for determining and blocking an illegal international call, in accordance with an embodiment of the present invention.

The foregoing and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, in which: There will be. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise. Also, the terms ""," module ", etc. in the specification mean a unit for processing at least one function or operation, and may be implemented by hardware or software or a combination of hardware and software.

FIG. 1 is a block diagram illustrating a configuration of a communication system in which an illegal internet international origination call detection and blocking method according to an embodiment of the present invention is implemented.

Referring to FIG. 1, the communication system in which the present invention is implemented includes an Internet telephone system, and more specifically, an illegal internet international call blocking device 100 that provides a service for detecting and blocking an illegal Internet international call, An Internet telephone service server 300, an Internet telephone service subscriber terminal 400, and a ISP communication network.

First, the illegal internet international call origination call blocking system according to the present invention collects an Internet origination call originated in the network connecting device 200 of the Internet phone service communication system shown in the drawing, by the illegal internet international origination call interception device 100 , And after detecting an illegal international call, if it is confirmed as an illegal international call, the above-mentioned Internet origination call is blocked so that the subscriber of the communication service is prevented from damaging the illegal international call.

The illegal internet international call origination device 100 collects information of an Internet telephone origination call originated from the subscriber terminal 400 to the communication system and detects illegal international origination call, Processing is performed.

The illegal internet international calling party blocking device 100 is connected to the network connecting device 200 receiving an Internet telephone call, and collects and monitors the Internet telephone authentication and signaling messages during a call. The illegal internet international call blocking device 100 includes a database 150 in which a telephone number, a header number, a header order, a header-specific value, and an IP address of a signal message used for terminal authentication are recorded. And refers to the database 150 when the call is determined.

The network access device 200 connects the signal traffic of the subscriber originating from the Internet telephone service subscriber terminal 400 to the ISP communication network. The network access device 200 transmits the Internet telephone call originated from the subscriber terminal 400 to the Internet telephone service server 300 through the ISP communication network. The network access device 200 is connected to the illegal internet international call origination device 100 and transmits information of an Internet telephone origination call originated from the subscriber terminal 400 to the illegal internet international origination call interception device 100 ). Such a network connection device 200 may include, for example, a switch, a router, other traffic tangential devices, and the like.

The Internet telephone service server 300 performs call processing to provide Internet telephone set-up / call-out and call service to the Internet telephone service subscribers through the subscriber terminal 400. The Internet phone service server 300 includes a VoIP server and provides a communication service in cooperation with an ISP internal network, an ISP external network, a mobile communication network, and a public switched network. In addition, Internet telephone landing / calling and calling calls include VoIP calls.

The subscriber terminal 400 is an Internet phone terminal for using an Internet telephone service of subscribers subscribed to the Internet telephone service. The subscriber terminal 400 may include a VoIP terminal. Also, the subscriber terminal 400 may include a terminal device for receiving a telephone service through a data communication network.

2 is a block diagram of an illegal internet international call blocking apparatus according to an embodiment of the present invention.

Referring to FIG. 2, the illegal internet international call blocking apparatus 100 according to the present invention includes an outgoing call information collecting unit 110, an origination call analyzing unit 120, a black list registering unit 130, A part 140 and a database 150. [

The database 150 stores a mapping table including a telephone number of the terminal, pattern matching information, and an IP address. The telephone number, pattern matching information, and IP address of the terminal of the mapping table can be stored at the time of first subscription of the service, or can be stored in the subscriber terminal 400 and the Internet telephone And analyzing the transmission / reception messages between the service server 300 and the service server 300.

Also, the database 150 stores account information such as an ID and a password, and stores a telephone number and an IP address of a terminal attempting illegal international Internet call in a black list from abroad.

The outgoing call information collecting unit 110 collects information of an Internet telephone call originated from the subscriber terminal 400 to the network access device 200.

The origination call analyzing unit 120 analyzes the information of the Internet call originated call collected by the origination call information collecting unit 110 to determine whether the Internet call origination call is related to registration or call initiation, And transmits the information of the outgoing call to the blacklist register 130 or the illegal international call disconnection block 140 according to the result.

Specifically, the outgoing call analysis unit 120 parses a Session Initiation Protocol (SIP) packet from the information of the Internet call origination call, and if the method of the SIP packet is a REGISTER, And transmits the extracted information to the blacklist registration unit 130. The blacklist registration unit 130 extracts the IP address and the information for pattern matching from the received IP address. Here, the information for pattern matching includes at least one of a header number, a header order, and a header value.

In addition, when the method of the SIP packet is INVITE as a result of parsing the SIP packet in the information of the INVITE call origination call, the outgoing call analyzing unit 120 extracts the outgoing phone number, the incoming phone number, and the source IP address from the SIP packet, And transmits the extracted origination phone number / incoming phone number / source IP address to the illegal international call origination blocking unit 140. The IP address is an IP address of the calling subscriber terminal and is a source IP address included in the SIP packet.

The black list registration unit 130 refers to the mapping table stored in the database 150 and transmits the corresponding origination call, It is determined whether the attempt is an attempt to register in the foreign country by the account information hijacking such as an ID and a password. If the attempt is for registration in the foreign country by the account information hijacking, the information of the origination call is recorded in the database 150 as a black list.

That is, the blacklist register 130 registers the calling telephone number and the information for pattern matching, which are transmitted from the origination call analyzer 120, to the telephone number, the pattern matching information and the telephone number recorded in the mapping table stored in the database 150 If the received IP address is an overseas IP address without matching the outgoing call or registration attempt as a normal registration and not recording it as a black list, the outgoing call number of the outgoing call and the corresponding call And records the originated foreign IP address in the database 150 in a black list. The blacklist may further include an originating telephone number, an overseas IP address, as well as an authentication IP address allocated at the time of first subscription of the service.

At this time, the blacklist register 130 compares the outgoing phone number and pattern matching information transmitted from the outbound call analyzer 120 with the telephone number and pattern matching information recorded in the mapping table stored in the database 150 , The authentication IP address of the mapping table stored in the database 150 may be modified to the forwarded IP address without black list if the forwarded IP address is not an overseas IP address. The reason as described above is that the subscriber can connect the subscriber terminal to the Internet at a location other than the initial authentication location in the country and use a new IP address to use the internet telephone, .

The illegal international call disconnection blocking unit 140 compares the outgoing call number, the source (source) IP address, and the incoming phone number from the outgoing call information collecting unit 110 with the black list recorded in the database 150 And judges whether the call is an illegal international call and blocks the call if it is an illegal international call.

Specifically, when an illegal international call origination blocking unit 140 includes an international call identification number such as 00X in an incoming call number received from the origination call information collecting unit 110, the outgoing call information collecting unit 110 Or the source IP address is present in the black list recorded in the database 150.

The illegal international call disconnection blocking unit 140 does not block the call if either the originating phone number or the source IP address is not present in the black list, and either the originating phone number or the source IP address is present in the black list , It is judged to be an illegal international call and requests call blocking to the network access device or the Internet telephone service server.

The illegal international call disconnection blocking unit 140 can immediately block the call when it determines an illegal international call or accumulate the number of calls or the talk time of the corresponding outgoing phone number to reach the number of calls or the talk time The call blocking can be performed.

FIG. 3 is a flowchart illustrating a method for constructing a blacklist table and a terminal-based terminal authentication request IP table according to an embodiment of the present invention.

Referring to FIG. 3, the illegal internet international origination call blocking apparatus 100 loads a mapping table including a phone number, pattern matching information, and IP address registered at the time of subscription to the initial service at system startup. Or the illegal internet international calling signal blocking device 100 analyzes and transmits a transmission / reception message between the subscriber terminal 400 and the Internet phone service server 300 transmitted from the network access device 200 during authentication for a predetermined period of time A mapping table including pattern matching information may be loaded (S301).

An example of the mapping table is shown in Table 1 below.

Phone number Header count Header sequence Header value IP address 070-7777-1111 9 Via,
Max-Forwards,
From,
To,
Call-ID,
CSeq,
Contact,
User-Agent,
Content-Length aaaa: aaaa,
70,
07077771111,
07077771111,
123456,
1 REGISTER,
sip: 07077771111 @ aaaa: 5060, AAAA,
0 1.1.1.1 070-7777-2222 10 To,
Call-ID,
CSeq,
Via,
Max-Forwards,
From,
Contact,
User-Agent,
Allow,
Content-Length 07077772222,
aa456,
101 REGISTER,
bbbb: bbbb,
75,
07077772222,
sip: 07077772222 @ bbbb: 5060, BBBB,
INVITE,
0 2.2.2.2 070-7777-3333 ... ... ... 3.3.3.3 ... ... ... ... ...

An example of a REGISTER (SIP method) signal message transmitted from the subscriber terminal 400 at 070-7777-1111 is shown in Table 2 below.

[Example of REGISTER signal message of 070-7777-1111]
REGISTER sip: voip.co.kr: 5060 SIP / 2.0
Via: SIP / 2.0 / UDP aaaa: aaaa
Max-Forwards: 70
From: "7077771111"<sip:07077771111@voip.co.kr>; tag = voip.co.kr
To: "7077771111"<sip:07077771111@voip.co.kr>
Call-ID: 123456
CSeq: 1 REGISTER
Contact: <sip: 07077771111 @ aaaa: 5060; transport = udp>
User-Agent: AAAA
Content-Length: 0
IP: 1.1.1.1

The illegal internet international origination call blocking apparatus 100 parses an incoming SIP packet after operating the system and confirms whether the method of the SIP packet is a REGISTER (a SIP method used in an authentication request) (S303, S305).

If the parsing result is REGISTER, the illegal internet international call blocking apparatus 100 parses the header of the packet and extracts the information for the calling telephone number and the pattern matching and the IP address (S307). The illegal internet international origination call blocking apparatus 100 compares the pattern matching information corresponding to the extracted originated telephone number with the information of the constructed mapping table (S309, S311). The comparison between the mapping table and the pattern matching information corresponding to the extracted originating telephone number can be made for all or part of the header number, the header order, and the header value. Also, when comparing header order and header value, it is also possible to compare only the whole or a part thereof.

If the pattern matching information corresponding to the extracted outgoing phone number matches the information of the mapping table, the illegal internet international call blocking device 100 determines whether the extracted outgoing phone number exists in the black list table (S313). If the calling telephone number does not exist in the blacklist table, the illegal internet international calling signal blocking device 100 performs the packet receiving operation again. On the other hand, if the origination phone number exists in the black list table, since the legitimate originating phone number is erroneously registered, the illegal internet international origination call blocking apparatus 100 deletes the corresponding origination phone number and IP address from the black list table Thereafter, a packet reception operation is performed again (S315).

If it is determined as a result of the comparison in step S311, the illegal internet international call blocking device 100 determines whether the IP address of the corresponding terminal extracted from the packet is an overseas IP address (S317). In the case of an overseas IP address, it is highly likely that the illegal internet international origination call blocking device 100 has been hacked by a foreign hacker. Therefore, the originating phone number and the IP address are registered in the black list table (S319). On the other hand, if the IP address is not the foreign IP address, the illegal internet international call blocking device 100 modifies the IP address of the mapping table to the IP address of the terminal and then receives the packet again (S321). As described above, the reason why the IP address of the mapping table is modified to the IP address of the terminal is that the subscriber connects the subscriber terminal at a location other than the initial authentication location in Korea, allocates a new IP address, This is because it is not judged to be illegal in such cases.

Examples of the black list table are shown in Table 3 below.

Phone number Recently Registered IP Address 070-7777-2222 1.1.1.1 (Overseas IP address) 02-555-5555 2.2.2.2 (Foreign IP address) 042-777-7777 3.3.3.3 (Foreign IP address)

4 is a flow diagram illustrating a procedure for determining and blocking an illegal international call, in accordance with an embodiment of the present invention.

Referring to FIG. 4, the illegal internet international origination call blocking apparatus 100 parses an incoming SIP packet after operating the system to check whether a SIP packet method is INVITE (SIP method used in a call request) (S401, S403 ).

If the parsing result is INVITE, the illegal internet international call dispatcher 100 extracts the incoming telephone number from the packet (S405). The illegal internet international outgoing call blocking apparatus 100 confirms whether the outgoing call number is an international call origination call by checking whether the extracted incoming telephone number includes an international telephone identification number such as 00x or the like (S407).

In the case of an international call origination call, the illegal internet call origination device 100 extracts a source telephone number or a source IP address from the packet, and the extracted origination telephone number or source IP address is stored in a black list table (S409, S411, S413).

If the calling telephone number or the source IP address does not exist in the black list table, the illegal internet international call blocking apparatus 100 determines that the call is a normal international call and performs a next packet receiving operation. However, if the calling telephone number exists in the black list table, it is judged illegal international call and blocks the call. At this time, the illegal internet international origination call blocking apparatus 100 increases the count to the origination phone number or the source IP address when it is determined that the call is an illegal international call, as shown in FIG. 4, If the number of counts is larger than the threshold value, the call can be blocked (S415, S417, S419)

As described above, according to the present invention, when an international call is made using the account information stolen by the hacker, it is possible to prevent the illegal international telephone billing damage by blocking the Internet origination call.

While the specification contains many features, such features should not be construed as limiting the scope of the invention or the scope of the claims. In addition, the features described in the individual embodiments herein may be combined and implemented in a single embodiment. On the contrary, the various features described in the singular embodiments may be individually implemented in various embodiments or properly combined.

Although the operations are described in a particular order in the figures, it should be understood that such operations are performed in a particular order as shown, or that all described operations are performed in a series of sequential orders, or to obtain the desired result. In certain circumstances, multitasking and parallel processing may be advantageous. It should also be understood that the division of various system components in the above embodiments does not require such distinction in all embodiments. The above-described program components and systems can generally be implemented as a single software product or as a package in multiple software products.

The method of the present invention as described above can be implemented by a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto optical disk, etc.). Such a process can be easily carried out by those skilled in the art and will not be described in detail.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. The present invention is not limited to the drawings.

100: illegal internet international outgoing call blocking device
150: Database
200: Network access device
300: Internet telephone service server
400: subscriber terminal

Claims (17)

A method for blocking an illegal internet international call from an illegal internet international call blocking device,
Storing a mapping table in which a telephone number and corresponding pattern matching information and an IP address are recorded;
Collecting information of an Internet origination call originated from a terminal to a communication system;
Analyzing the collected information of the outgoing call and confirming whether it is a call relating to registration or a call relating to the call; And
Comparing the outgoing telephone number and pattern matching information included in the collected information of the outgoing call with the outgoing telephone number and pattern matching information stored in the mapping table;
Checking whether the IP address included in the outgoing call information is an overseas IP address if the comparison result does not match;
Registering a calling telephone number and an IP address included in the information of the outgoing call in a black list when the IP address included in the outgoing call information is an overseas IP address; And
If the IP address included in the outgoing call information is not an overseas IP address, the IP address corresponding to the originated phone number stored in the mapping table is not included in the outgoing call information, The method comprising the steps of: (a) modifying an illegal internet international call origination message including an IP address of a calling party; The method according to claim 1,
If it is ascertained in the call relating to call initiation in the step of ascertaining whether it is a call relating to the registration or a call relating to call initiation,
Comparing the collected information of the outgoing call with the black list and blocking the outgoing call by determining that the outgoing call is an illegal internet international call when the information of the outgoing call is recorded in the black list, Call blocking method. 3. The method of claim 2,
Wherein the step of verifying whether the call relating to the registration or the call relating to the call initiation comprises:
And if the method of the SIP packet is INVITE, it is determined to be a call relating to call initiation. 3. The method of claim 2,
Wherein the blocking step comprises:
The calling number is blocked when the number of calls or the calling time exceeds a threshold value, and the outgoing call is blocked when the number of calls or the calling time exceeds a threshold value. The method according to claim 1,
Wherein the step of verifying whether the call relating to the registration or the call relating to the call initiation comprises:
And if the method of the SIP packet is REGISTER, it is determined to be a call relating to registration. delete delete The method according to claim 1,
Wherein the collecting the information of the outgoing call comprises:
And collecting information on the Internet origination call from a network access device connecting the terminal and the communication system. The method as claimed in any one of claims 1 to 5 and 8,
Wherein the pattern matching information includes at least one of a header number, a header order, and a header value. An apparatus for blocking an illegal internet international call,
A database storing a mapping table in which a telephone number and corresponding pattern matching information and an IP address are recorded;
An outgoing call information collecting unit for collecting information of an outgoing call originated from a terminal to a communication system;
An origination call analyzer for analyzing the collected information of the outgoing call to check whether the call is related to the call or the call related to the registration and delivering the information of the outgoing call to the blacklist register if the call is related to the registration; And
And a black list registering unit for registering the information of the outgoing call in the black list according to the comparison result of the collected outgoing call information and the phone number of the mapping table and the pattern matching information,
Wherein the blacklist register comprises:
Comparing the calling telephone number and the pattern matching information included in the collected outgoing call information with the outgoing telephone number and pattern matching information stored in the mapping table and if the comparison result does not match the IP address included in the outgoing call information And registers the outgoing telephone number and the IP address included in the information of the outgoing call in the blacklist, and if the IP address included in the information of the outgoing call is not the foreign IP address, Wherein the IP address corresponding to the origination phone number stored in the mapping table is modified to an IP address included in the information of the origination call without registering the call information in the black list. 11. The method of claim 10,
Further comprising an illegal international call origination blocking unit,
Wherein the outgoing call analyzing unit,
Analyzes the collected information of the outgoing call and transmits the information of the outgoing call to the illegal international call blocking unit when the call is related to call initiation,
The illegal international call disconnection unit may include:
And comparing the collected information of the outgoing call with the black list, and when the information of the outgoing call is recorded in the black list, it is determined that the outgoing call is an illegal internet international call, and the outgoing call is blocked. Device. 12. The method of claim 11,
Wherein the outgoing call analyzing unit,
When the method of the SIP packet is INVITE, it is determined that the call is related to the call initiation. 12. The method of claim 11,
The illegal international call disconnection unit may include:
The calling number is blocked when the number of calls or the calling time exceeds the threshold value, and the outgoing call is blocked when the number of calls or the calling time exceeds the threshold value. 11. The method of claim 10,
Wherein the outgoing call analyzing unit,
And when the method of the SIP packet is REGISTER, it is determined that the call is related to registration. delete 11. The method of claim 10,
The outgoing call information collecting unit,
And collects the information of the Internet origination call from the network connection device connecting the terminal and the communication system. 17. The method according to any one of claims 10 to 14 and 16,
Wherein the pattern matching information includes at least one of a header number, a header order, and a header value.

Images