KR102135242B1 - Apparatus and method for detecting illegal call - Google Patents

Abstract

As an illegal call detection device, a raw packet generated when a subscriber terminal uses a voice over internet protocol (VoIP) service is collected from at least one of the subscriber terminal or a call exchanger, and CDR data associated with the row packet A data collection unit that collects (Call Detail Record Data) from a charging server, generates training data using service usage information extracted from the CDR data and service detail information extracted from the raw packet, and sets the training data to a preset imaging rule. According to the pre-processing unit to generate a learning image by converting it to an image, and through the illegal phone detection model, extracting at least one or more features from the learning image, and using the features to learn whether the learning image is associated with an illegal call Includes learning department.

Description

Apparatus and method for illegal phone detection{APPARATUS AND METHOD FOR DETECTING ILLEGAL CALL}

The present invention relates to an apparatus and method for detecting illegal calls.

As Internet utilization increases, Internet phone (VoIP) services such as Internet phone, VoLTE, or Mobile VoIP are rapidly spreading, and various types of Internet phone such as IP-PBX for business, CALL BOX or Softphone are also spreading.

However, Internet phones are vulnerable to security because they are connected to the Internet, and in particular, corporate IP-PBXs, which customers purchase directly, can use the ID and password set at the time of production at the factory or simply find them with a simple program. There are many cases. Accordingly, by using the ID and password used for Internet phone calls to induce illegal calls, the situation is causing billing damages ranging from tens of millions to tens of millions of won a month to customers.

The problem to be solved by the present invention is to provide a technique for detecting and blocking illegal calls by learning the generated illegal phone pattern through a CNN algorithm.

An illegal telephone detection apparatus according to an embodiment of the present invention collects a raw packet generated by a subscriber terminal using a Voice over Internet Protocol (VoIP) service from at least one of the subscriber terminal or a call exchange, The data collection unit collects CDR data (Call Detail Record Data) related to the raw packet from a charging server, generates learning data using service usage information extracted from the CDR data and service detailed information extracted from the raw packet, and A pre-processing unit that converts the training data into an image according to a preset imaging rule to generate a training image, and extracts at least one or more features from the training image through an illegal phone detection model, and uses the features to extract the training image. It includes a learning unit that learns whether it is related to illegal phone calls.

The service usage information includes at least one of detection time information, calling number information or called number information, and the service detail information includes at least one of called country information, source IP information, IP country information, and terminal identifier information.

The preprocessor generates the learning data by sequentially arranging information in a table in the order of information included in the service usage information and information included in the service detail information.

The pre-processing unit generates unit polygons visualizing each of the information based on the byte size of the information arranged in the table, and generates the learning image by arranging the unit polygons in the sorted order in the table.

The unit polygons are formed of rectangles having lengths of any sides facing each other in length proportional to the size of each of the pieces of information, and are arranged in the order arranged in the table in a vertical direction to be staggered on the learning image.

The illegal phone detection apparatus further includes an illegal phone detection unit that determines whether the new learning image is associated with an illegal phone by inputting the new learning image into the illegal phone detection model when a new learning image is generated.

The illegal phone detection apparatus further includes a step of blocking a subscriber terminal associated with the new learning image when the new learning image is associated with an illegal call.

The method for the illegal telephone detection apparatus to learn the illegal telephone detection model according to an embodiment of the present invention collects raw packets generated by the detected illegal telephone from at least one of a subscriber terminal or a call exchanger associated with the illegal telephone, Collecting CDR data related to the raw packet from a charging server, extracting service usage information from the CDR data, and extracting service detail information from the raw packet, included in the service usage information and the service detail information Determining illegal phone pattern information using information, generating learning data using the service usage information, the service detail information, and the illegal phone pattern information, and converting the learning data into an image according to a preset imaging rule Converting to generate a learning image, and learning through the illegal phone detection model that the learning image is related to an illegal call.

The service usage information includes at least one of detection time information, calling number information, or called number information, and the service detailed information includes at least one of called country information, source IP information, IP country information, and terminal identifier information, The illegal telephone pattern information includes at least one of cumulative number of outgoing calls or cumulative number of incoming calls.

The determining of the illegal telephone pattern information includes determining the cumulative number of outgoing calls from the subscriber station during a threshold time by using the caller ID information included in the service use information, and the incoming calls included in the service use information Determining, by using the number information, the cumulative number of incoming calls received by the subscriber station during the threshold time, and tagging at least one of the cumulative number of calls or the accumulated number of calls as being related to an illegal call; Includes.

In the generating of the learning data, information included in the service usage information, information included in the service detail information, and information included in the illegal telephone pattern information are sequentially arranged in a table in order to generate the learning data.

The generating of the learning image includes generating unit polygons visualizing information arranged in the table based on the byte size of information arranged in the table, and arranging the unit polygons in the order sorted in the table. And generating the learning image.

The unit polygons are formed in a rectangular shape having lengths on both sides facing lengths proportional to the byte size of the information arranged in the table, and are sequentially arranged in a vertical direction to be staggered on the learning image.

The method for the illegal phone detection apparatus to learn the illegal phone detection model includes: when a new learning image is generated, inputting the new learning image into the illegal phone detection model to determine whether the new learning image is associated with an illegal call; In addition, when the new learning image is associated with an illegal call, the method further includes blocking a subscriber terminal associated with the new learning image.

According to the present invention, by detecting and blocking illegal calls in real time, it is possible to fundamentally prevent charging damage caused by illegal calls.

1 is a diagram illustrating an environment in which an illegal telephone detection apparatus according to an embodiment of the present invention is implemented.
2 is a view for explaining an illegal phone detection apparatus according to an embodiment of the present invention.
3 is a diagram illustrating a method in which the pre-processing unit generates a learning image.
FIG. 4 is a diagram for explaining a method of pre-processing the contents included in each of the unit rectangles.
FIG. 5 is a diagram illustrating a method in which a learning unit learns a learning image through a convolution filter.
6 is a diagram for explaining a method for an illegal telephone detection apparatus to train an illegal telephone detection model.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art to which the present invention pertains may easily practice. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. In addition, in order to clearly describe the present invention in the drawings, parts irrelevant to the description are omitted, and like reference numerals are assigned to similar parts throughout the specification.

Throughout the specification, when a part “includes” a certain component, this means that other components may be further included rather than excluding other components unless otherwise specified. In addition, terms such as “…unit”, “…group”, and “module” described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware or software or a combination of hardware and software. have.

1 is a diagram illustrating an environment in which an illegal telephone detection apparatus according to an embodiment of the present invention is implemented.

Referring to FIG. 1, the subscriber station 100 generates a raw packet by using a Voice over Internet Protocol (VoIP) service.

Specifically, the subscriber terminal 100 is an Internet telephone terminal device for subscribers of VoIP service to use the Internet telephone service.

The subscriber terminal 100 may include a VoIP terminal, and may be a physical VoIP terminal device such as a SoIP phone, IP-PBX, or Call Box, or a softphone operating in software on a PC or mobile device. In addition, the subscriber terminal 100 may include a terminal device for receiving VoIP service through the VoIP network 400.

When the subscriber station 100 uses a VoIP service, the subscriber station 100 transmits a low packet including a call connection request through the VoIP network 400 to the call exchange 200.

When the call exchanger 200 receives a low packet from the subscriber terminal 100, it transmits a call connection request signal to the called terminal (not shown) corresponding to the call connection request included in the low packet.

The call exchanger 200 is included in the VoIP service provider network and interworked with the charging server 300 to transmit information generated by using the VoIP service of the subscriber station 100 to the charging server 300.

The charging server 300 generates call detail record data (CDR) data for the subscriber station 100 using the information received from the currency exchange 200.

On the other hand, the charging server 300, even if the subscriber terminal 100 uses a specific VoIP service (for example, IP-Centrex (IP-Centrex) or CFC (Calls Free Calls)), the subscriber terminal 100 CDR data for can be generated.

The VoIP network 400 connects the subscriber terminal 100 and the call exchanger 200, and may be a typical Internet network that allows the subscriber terminal 100 to transmit and receive data required to receive VoIP service.

The illegal telephone detection apparatus 500 collects raw packets from at least one of the subscriber terminal 100 or the call exchanger 200, collects CDR data from the charging server 300, and learns using the raw packets and the CDR data. It generates images and learns through the illegal phone detection model to detect and block illegal calls. Hereinafter, the illegal phone detection apparatus 500 will be described in detail.

2 is a view for explaining an illegal phone detection apparatus according to an embodiment of the present invention, FIG. 3 is a diagram for explaining a method for generating a learning image by a pre-processing unit, and FIG. 4 is a pre-processing unit included in each of the unit rectangles FIG. 5 is a diagram for explaining a method of digitizing contents, and FIG. 5 is a diagram for explaining a method in which a learning unit learns a training image through a convolution filter.

Referring to FIG. 2, the illegal telephone detection apparatus 500 includes a data collection unit 510, a pre-processing unit 520, a learning unit 530, an illegal telephone detection unit 540, and an action unit 550.

The data collection unit 510 collects raw packets generated by the subscriber station 100 as it uses the VoIP service from at least one of the subscriber station 100 or the call exchanger 200.

Specifically, when the VoIP service is processed through the Session Initiation Protocol (SIP) or the Integrated Services Digital Network (ISDN) User Part (ISUP), the subscriber station 100 generates a low packet including various signal information and data The collection unit 510 receives the generated raw packet. Table 1 shows field information of an exemplary row packet generated when using the SIP protocol.

INVITE SIP/2.0 Call-id Via From To

In addition, the data collection unit 510 collects the CDR data (Call Detail Record Data) associated with the raw packet generated by the subscriber terminal 100 from the charging server 300. The subscriber station 100 is a VoIP service It includes information necessary to charge a fee incurred as a result of using, specifically, call number information, called number information, call start time information, and call time information.

The pre-processing unit 520 generates learning data using service usage information extracted from CDR data and service detail information extracted from raw packets.

Specifically, the pre-processing unit 520 determines detection time information using the time when the CDR data is collected, and extracts at least one of caller ID information or called party number information included in the CDR data to generate service usage information. That is, the service usage information includes at least one of detection time information, calling number information, or called number information.

In addition, the pre-processor 520 determines at least one of the destination country information, the source IP information, the IP country information, and the terminal identifier using information included in the raw data to generate service details. That is, the service detail information includes at least one of the destination country information, source IP information, IP country information, and terminal identifier.

The pre-processing unit 520 sequentially generates the learning data by sequentially sorting the table in the order of information included in service usage information and information included in service detail information.

Specifically, the pre-processing unit 520 generates learning data by sequentially sorting the table in the order of detection time information, calling number information, called number information, called country information, source IP information, IP country information, and terminal identifier information. Table 2 shows an example of the training data, and the training data in Table 2 may be composed of 244 bytes in total.

detection
Time Sent
number Incoming
number Incoming
country Source IP IP country Terminal
Identifier 20
byte 20
byte 40
byte 40
byte 20
byte 40
byte 64
byte 2018/10/15/14:00 010-2139-1230 02-529-0219 KR 110.111.111 KR 1wk12

The pre-processing unit 520 converts the generated training data into an image according to a preset imaging rule to generate a training image. Referring to FIG. 3, the pre-processing unit 520 is based on the byte size of information arranged in the table. The unit polygons visualizing the respective information are generated, and the unit polygons are arranged in a sorted order in the table to generate a learning image.

In this case, the unit polygons are formed of rectangles having lengths of arbitrary sides facing each other in proportion to the size of each byte of information, and are sequentially arranged in a vertical direction to be staggered on the training image.

For example, in FIG. 3, the pre-processing unit 520 may generate a unit rectangle having the same vertical length and byte size as the vertical length for each of the information in Table 2.

On the other hand, the pre-processing unit 520 determines information having the smallest byte size in the learning data, and determines a polygon having a byte size smaller than the byte size of the information as a length of one side. Thereafter, the pre-processing unit 520 sequentially arranges the unit rectangles within the determined polygonal shape.

For example, the pre-processing unit 520 determines the polygon having a horizontal length of 18 bytes smaller than 20 bytes because the smallest byte size of each information in Table 2 is 20 bytes, and for each information in the polygon. The unit rectangle may be sequentially arranged from detection time information to terminal identifier information.

In this case, 18 of the 20 bytes of the detection time information are displayed in the first column, and the remaining 2 bytes are displayed in the second column. In addition, 16 of the 20 bytes of the caller ID information are displayed in the second column and the remaining 4 bytes are displayed in the third column. If the unit rectangles are sequentially arranged in this way, the unit rectangles may be alternately arranged within the entire polygon.

The pre-processing unit 520 purifies the contents included in each of the unit rectangles.

Specifically, the pre-processing unit 520 divides the contents input in the form of bits into each of the unit rectangles into preset bit units, and integerizes the divided bit units.

For example, referring to FIG. 4, a syllable "two" included in an arbitrary unit rectangle is composed of a total of 24 bits of "111010111001000110010000" when input in UFT-8 (Unicode Transformation Format-8bit) format. In this case, the pre-processing unit 520 may divide “111010111001000110010000” into 8-bit units to generate “11101011”, “10010001”, and “10010000”, and integerize the divided bit units, respectively. The integerized results correspond to "235", "145" and "144".

The pre-processing unit 520 generates a learning image by imaging the entire polygons in which unit rectangles are alternately arranged using an imaging algorithm. For example, in FIG. 3, when imaging a polygon having 18 bytes as a length of one side, a learning image of the same polygon shape having a length of one side as 144 pixels may be generated.

The learning unit 530 extracts at least one feature from the learning image through the illegal phone detection model, and learns whether the learning image is associated with the illegal phone using the features.

Specifically, the learning unit 530 uses an illegal call detection model that classifies whether the learning image is related to an illegal call or a normal call through a CNN algorithm.

The illegal phone detection model is composed of at least one convolutional layer in the neural network, and the learning unit 530 extracts features for the learning image through convolution filters of the convolutional layers, and extracts the extracted features from the neural network. It classifies whether it is a learning image related to an illegal call or a learning image related to a normal call.

For example, referring to FIG. 5, the learning unit 530 may extract features using a convolution filter having a size of 3*3 with respect to the learning image of FIG. 3. In this case, in the learning image of FIG. 3, since each information is arranged alternately with each other, characteristics of a plurality of information may be simultaneously extracted.

Specifically, in FIG. 5, the learning unit 530 may extract and learn a feature for vertical association between detection time information and caller ID information at the time of initial filtering, and then detect time information as the convolution filter moves. It is possible to learn by extracting a feature for vertical association between three pieces of information, called number information and called number information.

Meanwhile, the administrator determines the classification accuracy by inputting a learning image related to an illegal phone or a learning image related to a normal phone into the illegal phone detection model, and training the illegal phone detection model until the classification accuracy exceeds a preset threshold accuracy. Can.

When a new learning image is generated, the illegal phone detection unit 540 determines whether the new learning image is associated with an illegal call by inputting the learning image of the new learning image into the illegal phone detection model.

The action unit 550 blocks the subscriber terminal associated with the new learning image when the new learning image is associated with an illegal call.

Specifically, if it is a new learning image related to an illegal call, the action unit 550 checks the new learning data related to the new learning image.

Subsequently, the action unit 550 determines a call related to the calling number information, the called number information, the called country information, or the terminal identification information included in the new learning data, blocks the determined call, or voices that the call is impossible through the announcement. Gives

6 is a diagram for explaining a method for an illegal telephone detection apparatus to train an illegal telephone detection model.

In FIG. 6, the same content as in FIGS. 1 to 5 is omitted.

Referring to FIG. 6, the illegal telephone detection apparatus 500 collects raw packets generated by previously detected illegal telephones from at least one of a subscriber terminal or a call exchanger associated with the illegal telephones, and charges CDR data associated with the raw packets. Collect from the server (S100).

The illegal telephone detection apparatus 500 extracts service usage information from the CDR data, and extracts service detail information from the raw packet (S110).

The illegal telephone detection apparatus 500 determines illegal telephone pattern information using information included in service usage information and service detail information (S120).

Specifically, the illegal telephone detection apparatus 500 generates cumulative call number information based on caller ID information and called party number information included in service usage information. In this case, the cumulative number of calls includes cumulative number of outgoing calls and cumulative number of incoming calls.

The illegal call detection apparatus 500 counts the number of calls made from the subscriber terminal 100 during the threshold time to determine the cumulative number of calls. For example, the illegal telephone detection apparatus 500 may determine the cumulative number of outgoing calls by counting the number of calls made from the subscriber terminal 100 for 1 minute, 3 minutes, and 60 minutes. Here, the threshold time may be set in advance or may be set dynamically.

In addition, the illegal telephone detection apparatus 500 counts the number of calls received by the subscriber terminal 100 during the threshold time to determine the cumulative number of incoming calls. For example, the illegal telephone detection apparatus 500 may determine the cumulative number of incoming calls using the number of calls received from the subscriber terminal 100 for 1 minute, 3 minutes, and 60 minutes. Here, the threshold time may be set in advance or may be set dynamically.

The illegal telephone detection apparatus 500 tags illegal telephone pattern information including at least one of accumulated call number information or accumulated call number information as being related to an illegal call.

Specifically, since the illegal phone detection apparatus 500 collects the raw data and the CDR data generated by the illegal phone, the determined information is tagged as related to the illegal phone.

The illegal telephone detection apparatus 500 generates learning data using service usage information, service detail information, and illegal telephone pattern information.

Specifically, the illegal phone detection apparatus 500 sequentially generates the learning data by sequentially sorting the table in the order of information included in service usage information, information included in service detail information, and information included in illegal phone pattern information (S130) ).

For example, the illegal telephone detection device 500 detects the detection time information, the calling number information, the called number information, the called country information, the source IP information, the IP country information, the terminal identifier information, the accumulated call number information, and the cumulative call number information. You can generate training data by sorting them sequentially in the table.

The illegal phone detection apparatus 500 converts the learning data into images according to a preset imaging rule to generate a learning image.

Specifically, the illegal telephone detection apparatus 500 generates unit polygons visualizing the information arranged in the table based on the byte size of the information arranged in the table, and arranges the unit polygons in the order sorted in the table (S140) ).

The illegal telephone detection apparatus 500 divides the contents input in the form of bits into each of the unit rectangles into preset bit units, and integerizes the divided bit units (S150).

The illegal telephone detection apparatus 500 generates a learning image by imaging the entire polygons in which unit rectangles are alternately arranged using an imaging algorithm (S160).

The illegal phone detection apparatus 500 learns that the learning image is related to an illegal phone through the illegal phone detection model (S170). In this case, the generated learning image includes illegal call pattern information including at least one of accumulated call number information or accumulated call number information in addition to service usage information and service details, so that patterns related to illegal calls collected during a critical time period are generated. You can learn further.

Subsequently, when a new learning image is generated, the illegal phone detection apparatus 500 determines whether the new learning image is associated with an illegal call by inputting the new learning image into the illegal phone detection model, and when the new learning image is associated with an illegal call. The subscriber terminal associated with the new learning image may be blocked.

According to the present invention, by detecting and blocking illegal calls in real time, it is possible to fundamentally prevent damage caused by illegal calls.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concept of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

Claims (14)

An illegal phone detection device,
Raw packets generated by a subscriber terminal using a Voice over Internet Protocol (VoIP) service are collected from at least one of the subscriber terminal or a call exchanger, and CDR Detail (Call Detail Record Data) associated with the row packet is generated. Data collection unit that collects data from the charging server,
A pre-processing unit that generates training data by sorting service usage information extracted from the CDR data and service detail information extracted from the row packet into a table, and converting the training data into images according to a preset imaging rule to generate a training image, And
A learning unit that extracts at least one feature from the learning image through an illegal phone detection model and learns whether the learning image is associated with an illegal phone using the features.
Illegal phone detection device comprising a. In claim 1,
The service usage information
It includes at least one of detection time information, calling number information or called number information,
The above service details
Illegal telephone detection device comprising at least one of the destination country information, source IP information, IP country information, and terminal identifier information. delete In claim 1,
The pre-processing unit
Illegal telephone detection apparatus for generating unit polygons visualizing the information on the basis of the byte size of the information arranged in the table, and generating the learning image by arranging the unit polygons in the sorted order in the table. In claim 4,
The unit polygons
Illegal telephone detection device consisting of a rectangle having an arbitrary length of both sides facing a length proportional to the size of each of the information, and arranged in the order arranged in the table in a vertical direction to be staggered on the learning image. In claim 1,
When a new learning image is generated, an illegal call detection unit that determines whether the new learning image is associated with an illegal call by inputting the new learning image into the illegal phone detection model
Illegal phone detection device further comprising a. In claim 6,
If the new learning image is associated with an illegal phone, an action unit to block the subscriber terminal associated with the new learning image
Illegal phone detection device further comprising a. A method for an illegal telephone detection device to train an illegal telephone detection model,
Collecting the raw packet generated by the detected illegal telephone from at least one of a subscriber terminal or a call exchanger associated with the illegal telephone, and collecting CDR data associated with the raw packet from a charging server,
Extracting service usage information from the CDR data and extracting service details from the raw packet,
Determining illegal phone pattern information by using the service usage information and information included in the service detail information,
Generating learning data by arranging the service usage information, the service detail information, and the illegal telephone pattern information in a table,
Generating a learning image by converting the learning data into an image according to a preset imaging rule, and
Learning that the learning image is related to an illegal phone through an illegal phone detection model
Model learning method comprising a. In claim 8,
The service usage information
It includes at least one of detection time information, calling number information or called number information,
The above service details
At least one of the destination country information, source IP information, IP country information, terminal identifier information,
The illegal phone pattern information
A model learning method comprising at least one of accumulated call number information or accumulated call number information. In claim 8,
Determining the illegal phone pattern information is
Determining the cumulative number of outgoing calls from the subscriber station during a critical time using the outgoing number information included in the service usage information,
Determining, by using the called number information included in the service usage information, the cumulative number of incoming calls received by the subscriber station during the threshold time, and
Tagging at least one of the cumulative number of calls or the cumulative number of calls as being related to an illegal call
Model learning method comprising a. delete In claim 8,
The step of generating the learning image
Generating unit polygons visualizing the information arranged in the table based on the byte size of the information arranged in the table, and
Generating the learning image by arranging the unit polygons in the order arranged in the table.
Model learning method comprising a. In claim 12,
The unit polygons
A model learning method consisting of a rectangular shape having lengths of arbitrary sides opposite to the length proportional to the byte size of the information arranged in the table, and sequentially arranged in a vertical direction to be staggered on the training image. In claim 8,
If a new learning image is generated, determining whether the new learning image is associated with an illegal call by inputting the new learning image into the illegal phone detection model, and
Blocking the subscriber terminal associated with the new learning image when the new learning image is associated with an illegal call.
Model learning method further comprising a.

Images