KR102322779B1 - Method for detecting illegal call and apparatus thererfor - Google Patents

Abstract

An illegal call detection method and apparatus are disclosed. The illegal call detection device receives call data between the caller and the receiver from a collection blocking device located in the communication network, and detects whether the caller is a suspect of an illegal call using a detection rule defined by combining at least one or more information included in the call data, , when a suspected illegal call is designated as a blocking target according to the manager's request or a predefined blocking target determination method, a cut-off command is transmitted to the network access device to cut the caller's connection call.

Description

Method for detecting illegal call and apparatus therefor

An embodiment of the present invention relates to a method and apparatus for detecting and blocking or cutting illegal calls.

When a hacker steals and uses a phone number, a huge amount of billing damage occurs. As VoIP (Voice over Internet Protocol) is widely used, the risk of phone number theft by hackers is increasing. Stolen phone numbers can be used for various crimes such as voice phishing as well as simple billing, so it is necessary to detect and block illegal calls.

1 is a diagram illustrating a telephone connection procedure using a conventional ISUP (ISDN User Part) protocol.

Referring to FIG. 1 , a caller 100 transmits an Initial Address Message (IAM) to a receiver 110 for a call connection request. IAM includes OPC (Original Point Code), DPC (Designated Point Code), CIC (Carrier Identification Code), caller's phone number and receiver's phone number. The receiver 110 receiving the IAM transmits an ACM (Address Complete Message) including OPC, DPC, CIC, etc. to the sender 100 . The sender 100 again transmits an ANM (Answer Message) including OPC, DPC, CIC, etc. to the receiver, and a phone call is made between the sender 100 and the receiver 110 .

When the caller 100 wants to end the phone call, the caller 100 sends a REL (Release) including OPC, DPC, CIC, and call termination cause (relase cause) to the receiver 110, and the receiver 110 responds to the RLC ( Release Complete) to terminate the two-way call normally.

2 is a diagram illustrating a telephone connection procedure using a conventional Session Initiation Protocol (SIP).

Referring to FIG. 2 , the caller 200 transmits an INVITE to the receiver 210 for a call connection request, and the receiver 210 sends '100 Trying', '180 Ringing', '200 OK' messages, etc. transmitted sequentially. When the sender 200 transmits an 'Ack' message to the receiver 210, a bilateral call connection is established.

In the case of wanting to end the phone call, the receiver 210 transmits a 'BYE' message to the sender 200, and the sender 200 transmits a '200 OK' message to this to normally end the call.

An object of the present invention is to provide a method and an apparatus capable of detecting and blocking or cutting an illegal call based on a rule, and an apparatus thereof.

In order to achieve the above technical problem, an example of an illegal call detection method according to an embodiment of the present invention is an illegal call detection method performed by an illegal call detection device, between a sender and a receiver from a collection blocking device located in a communication network. receiving call data of detecting whether the caller is an illegal call suspect using a detection rule defined by combining at least one piece of information included in call data; When the suspicious person is designated as a blocking target according to a request of an administrator or a predefined blocking target determination method, transmitting a cut-off command to a network access device so that the caller's connection call can be cut off.

In order to achieve the above technical object, an example of an illegal call detection device according to an embodiment of the present invention includes a data receiving unit for receiving call data between a caller and a receiver from a collection blocking device located in a communication network; a suspect detection unit configured to detect whether the caller is an illegal caller using a detection rule defined by combining at least one piece of information included in the call data; and a cutting unit that transmits a cut-off command to a network access device so that the caller's connection call can be cut off when the suspected illegal call is designated as a block target according to a manager's request or a predefined blocking target determination method.

According to an embodiment of the present invention, it is possible to detect illegality in all types of phone calls, such as international calls, domestic calls, land calls, and Internet calls. In addition, since illegal calls are detected based on rules, various types of illegal calls can be flexibly dealt with. In addition, if an illegal call is detected, the previously connected call can be cut, thereby reducing billing damage.

1 is a view showing a telephone connection procedure using a conventional ISUP (ISDN User Part) protocol;
2 is a diagram illustrating a telephone connection procedure using a conventional SIP (Session Initiation Protocol);
3 is a view showing an example of a schematic structure of a communication system to which an illegal call detection method according to an embodiment of the present invention is applied;
4 is a view showing an example of an illegal call detection method according to an embodiment of the present invention;
5 is a diagram illustrating an example of a detection rule according to an embodiment of the present invention;
6 is a diagram illustrating an example of a method for defining a blocking rule according to an embodiment of the present invention;
7 is a view showing an example of a call blocking method of a collection blocking device according to an embodiment of the present invention;
8 is a diagram illustrating an example of a call disconnection method of a network access device according to an embodiment of the present invention;
9 is a view showing an example of the configuration of a collection blocking device according to an embodiment of the present invention;
10 is a view showing an example of the configuration of an illegal call detection device according to an embodiment of the present invention, and;
11 is a diagram illustrating another example of the configuration of an illegal call detection apparatus according to an embodiment of the present invention.

Hereinafter, an illegal call detection method and apparatus according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

3 is a diagram illustrating an example of a schematic structure of a communication system to which an illegal call detection method according to an embodiment of the present invention is applied.

Referring to FIG. 3 , network access devices 320a and 320b for connecting international calls or domestic calls are located between communication networks 340 , 350 , 360 , 370 , and 380 . International or domestic calls may use the ISUP protocol or various protocols such as the SIP protocol.

In this embodiment, for convenience of explanation, the international network access device 320a connected to the international telephone networks 340 and 350 and the domestic network access device 320b connected to the domestic telephone networks 370 and 380 are respectively illustrated one by one, but this is for convenience of description. For this purpose only, a plurality of network access devices may exist between various networks according to embodiments.

The subscribers 330a, 330b, and 330c can make domestic or international calls using a general wireline telephone network, an Internet telephone network, or a mobile telephone network. The domestic and international telephone networks of this embodiment are an example for helping understanding, and this embodiment is not limited to a specific telephone network.

Collection blocking devices (310a, 310b, 310c, 310d, 310e) are located in various places in the telephone network. For example, the collection blocking device (310a, 310b, 310c, 310d, 310e) is between the international network access device (320a) and the mobile communication network 360, between the international network access device (320a) and the domestic network access device (320b) , may be located between the domestic network access device (320b) and various telephone networks (370, 380).

The collection blocking devices 310a, 310b, 310c, 310d, and 310e collect call data between the sender and the called party and, if necessary, block the call connection. Call data refers to data exchanged between a caller and a receiver for connection and termination of a call, as shown in FIGS. 1 and 2 . The collection blocking devices 310a, 310b, 310c, 310d, and 310e may collect call data transmitted and received through the telephone network using a tap device, a VoIP aggregator, an active prober, etc. .

The illegal call detection device 300 receives call data from at least one collection blocking device 310a, 310b, 310c, 310d, and 310e, and detects whether there is an illegal call. If an illegal call is detected, the call can be blocked or truncated. A method for the illegal call detection device 300 to detect an illegal call and block or cut a call will be described again in FIG. 4 .

4 is a diagram illustrating an example of a method for detecting an illegal call according to an embodiment of the present invention.

1 and 4, the collection blocking device 310 collects call data between the caller and the receiver (S400). The collection blocking device 310 may include a black list indicating a call blocking target or a white list indicating a call blocking exclusion target. In addition, as will be seen later, the collection blocking device 310 may further include a blocking rule. According to an embodiment, the collection blocking device 310 may include only a blacklist.

The collection blocking device 310 detects the caller's phone number from the collected call data and blocks the call connection if the caller's phone number exists in the blacklist (S410) (S420). Alternatively, the collection blocking device 310 may block the call connection when the caller's call connection corresponds to the blocking rule (S410) (S420). The blocking rule will be reviewed again in FIG. 6 .

In this embodiment, call disconnection means terminating the call connection before the two-way call connection so that a call connection between the caller and the called party does not occur from the beginning, and call disconnection means a normal call between the caller and the called party. It means that the phone call between both parties is forcibly terminated after the connection is established. An example of a method for the collection blocking device 310 to block a call will be described again in FIG. 7 .

If the collected call data does not correspond to the blocking target, the collection blocking device 310 transmits the call data to the illegal call detection device 300 (S430). Since the illegal call detection device 300 receives only call data that is not a target of blocking from the collection blocking device 310 rather than directly determining whether or not the target is blocked after receiving all the call data, the system load for illegal detection can be reduced. can

The illegal call detection device 300 detects whether the caller is an illegal call suspect using a predefined detection rule (S440). The detection rule may be composed of a combination of various information included in the call data. For example, as shown in FIG. 5 , the detection rule may consist of a list of dangerous countries or a condition of a predefined threshold for the number of calls. The detection rule will be described in detail again with reference to FIG. 5 .

The illegal call detection device 300 determines whether the caller is a subject to be blocked when the caller is detected as a suspected illegal call through the detection rule (S450). For example, the illegal call detection device 300 may provide information of the detected illegal call suspect to the manager, and the manager may determine whether to block the illegal call suspect. As another example, the illegal call detection device 300 may automatically determine whether the illegal call suspect is a target for blocking by a predefined method. For example, the illegal call detection device 300 may automatically designate as a blocking target when the same caller is detected as an illegal call suspect more than a predefined number of times within a predetermined period. In addition to this, various methods for designating whether or not an illegal call suspect is a target may be applied to the present embodiment.

The illegal call detection device 300 may transmit a cut-off command to the network access device 320 when the suspected illegal call is designated as a blocking target (S450) (S460). For example, a command to cut off the caller's current call connection detected as an illegal call is transmitted to the network access device 320, or if there is another call connection of the caller other than the current call connection, the network connection is performed to cut the other call connection. It transmits a cut command to the device 320 . Although the present embodiment shows one network access device 320, if there are a plurality of call connections from the caller and the plurality of call connections are managed by a plurality of network access devices 320, the illegal call detection device 300 ) may transmit a cut-off command to each of the plurality of network access devices 320 .

For example, the illegal call detection apparatus 300 may first inquire whether a call connection of a caller to be blocked exists to the plurality of network access apparatuses 320 . For example, the illegal call detection device 300 transmits a call information request including a caller phone number to a plurality of network access devices 320, and each network access device 320 receives a connected call based on the caller phone number. After the search, the search result may be transmitted to the illegal call detection device 300 . The search result may include call identification information (Call ID) corresponding to the caller's phone number. The illegal call detection device 300 transmits a cut-off command including call identification information to be cut based on the search result received from each network access device 320 to the network access device 320 . An example of a cutting method of the network access device 320 will be looked at again in FIG. 8 .

When the illegal call detection device 300 is designated as a blocking target for the suspected illegal call (S450), the collection blocking device 310 designates the blocked caller as a blacklist and transmits the blacklist (S470). The collection blocking device 310 updates the blacklist to include the received caller, and if there is an attempt to connect a call from the same caller thereafter, it blocks it.

The illegal call detection device 300 may also transmit a blocking rule to the collection blocking device 310 . For example, the illegal call detection device 300 may designate at least one of the plurality of detection rules as a blocking rule and transmit the designation to the collection blocking device 310 . Which detection rule among the detection rules is designated as the blocking rule will be described with reference to FIG. 6 .

5 is a diagram illustrating an example of a detection rule according to an embodiment of the present invention.

Referring to FIG. 5 , the manager combines at least one or more pieces of information included in the call data 500 , at least one or more pieces of information included in the customer data 510 , and at least one or more pieces of information included in the call statistical analysis data 420 . Thus, at least one detection rule 530 may be defined and stored in the illegal call detection device 300 .

For example, the first detection rule is a rule for detecting a specific country and a specific service number by using the calling country and service number included in the call data, and the second detection rule is a It is a rule for detecting a suspected illegal call based on the number of calls, call time, and amount used, and the third detection rule is a rule for detecting calls originating from a plurality of suspicious countries. That is, a specific country and a specific service number are defined in the first detection rule, and a threshold value such as the number of calls is defined in the second detection rule.

Various detection rules that define detection conditions for various information existing in the call data 500 , the customer data 510 , the call statistical analysis data 520 , etc. may be used in this embodiment, and are not limited to a specific example. .

6 is a diagram illustrating an example of a method for defining a blocking rule according to an embodiment of the present invention.

Referring to FIG. 6 , any one of a plurality of detection rules 600 , 602 , and 604 may be designated as a blocking rule. The illegal call detection apparatus 300 may designate, as a blocking rule, a detection rule in which a blocking target designation ratio for a suspected illegal call is greater than or equal to a preset threshold value among a plurality of detection rules. Alternatively, the administrator may designate any one of a plurality of detection rules as a blocking rule.

For example, the blocking target designation ratio for the suspected illegal call detected using the first detection rule 600 is 99%, and the blocking target is blocked using the second detection rule 602 When the target designation ratio is 50% and the blocking target designation ratio for the suspected illegal call detected using the third detection rule 604 is 10%, the first detection rule ( 600) may be designated as the blocking rule 610 .

In another embodiment, the administrator may change the blocking target designation ratio to be high by imposing a different condition on a detection rule having a low blocking target designation ratio (eg, the third detection rule 604). In another embodiment, if the detection rule is designated as a blocking rule, the collection blocking device 310 will block the call with the corresponding blocking rule, so the illegal call detection device 300 sets the first detection rule ( 600) can be deleted. As another embodiment, the blocking rule may be newly defined by an administrator regardless of the detection rule.

7 is a diagram illustrating an example of a call blocking method of a collection blocking device according to an embodiment of the present invention.

Referring to FIG. 7 , when the caller 700 transmits a call connection request message to the receiver 710 ( S750 ), the collection blocking device 310 collects the corresponding call data through a tap device or the like ( S755 ). For example, in the case of the ISUP protocol, the collection blocking device 310 collects the IAM that the sender 700 transmits to the receiver 710 using a tap device, and in the case of the SIP protocol, the collection blocking device 310 . can collect INVITE messages. This embodiment exemplifies protocols such as ISUP and SIP, but is not limited thereto, and various conventional communication protocols may be applied to the present embodiment.

The collection blocking device 310 transmits a call termination message to the caller 700 and the receiver 710, respectively, when the phone number of the caller 700 is in the blacklist or the call connection of the caller corresponds to the blocking rule (S760). and (S765, S770), and receives a call termination confirmation message from the sender and the receiver (S775, S780). That is, the collection blocking device 310 allows the call connection request to be normally terminated through a normal procedure between the caller 700 and the receiver 710 .

For example, in the case of the ISUP protocol, the collection blocking device 310 transmits an REL message to the sender 700 and the receiver 710, respectively, and receives an RLC message from the sender 700 and the receiver 710, respectively. Terminate the connection procedure normally. In the case of the SIP protocol, the collection blocking device 310 transmits a "BYE" message to the sender 700 and the receiver 710, respectively, and receives the "200 OK" message from the sender 700 and the receiver 710 to call Terminate the connection procedure normally. As another embodiment, when transmitting the call termination message, the collection blocking device 310 may transmit the call termination message including the cause of the call termination.

The collection blocking device 310 transmits the collected call data to the illegal call detection device 300 when the caller 700's phone number does not exist in the blacklist and the caller's call connection does not correspond to the blocking rule (S760). send.

8 is a diagram illustrating an example of a call disconnection method of a network access device according to an embodiment of the present invention.

Referring to FIG. 8 , while a phone call is normally made between the sender 800 and the receiver 810 ( S850 ), the network access device 320 may receive a cut-off command from the illegal call detection device 300 ( S850 ). S852). The phone call (S850) between the caller 800 and the receiver 810 is already connected before the illegal call detection device 300 starts the illegal detection process or whether the illegal call detection device 300 is illegal. It can also be connected during detection. According to an embodiment, the cut-off command may include call identification information (Call ID). As another example, the cut-off command may include the phone number of the caller who is the cut-off target.

The network access device 320 transmits a call termination message to the caller 800 and the receiver 810 of the call, respectively, based on the call identification information or the caller's phone number included in the cut-off command, and the caller 800 and the receiver 810 ) receives a call termination confirmation message from each and terminates the call forcibly. The call termination message and the call termination confirmation message are the same as the salpin messages in FIG. 7 .

9 is a diagram illustrating an example of the configuration of a collection blocking device according to an embodiment of the present invention.

Referring to FIG. 9 , the collection blocking device 310 includes a collection unit 900 , a blocking unit 910 , a blacklist 920 , and a blocking rule 930 .

The collecting unit 900 collects various call data between the caller and the receiver using a tap device or the like.

The blacklist 920 includes various types of information that can identify a caller, such as a blocking target phone number. According to an embodiment, a white list indicating a connection target may be further included.

The blocking rule 930 includes a rule defining a condition for a target to block a call connection. A plurality of blocking rules 930 may exist according to embodiments. An example of a method of defining the blocking rule 930 is illustrated in FIG. 6 .

The blocking unit 910 blocks the caller's call connection when the caller corresponds to the blacklist or blocking rule. An example of a call blocking method is shown in FIG. 7 .

10 is a diagram illustrating an example of the configuration of an illegal call detection apparatus according to an embodiment of the present invention.

Referring to FIG. 10 , the illegal call detecting device 300 includes a data receiving unit 1000 , a suspicious person detecting unit 1010 , a cutting unit 1020 , a blocking definition unit 1030 , and a rule storage unit 1040 .

The data receiving unit 1000 receives call data from the collection blocking device, or receives customer data from a communication company server. Specifically, the data receiving unit 1000 includes an interface unit 1002 and a signal processing unit 1004 .

The interface unit 1002 may include a first interface unit connected to a communication company server and a second interface unit connected to each collection blocking device. The illegal call detection device 300 may be connected to a plurality of collection blocking devices, and protocols of call data collected by each collection blocking device may be different from each other. The second interface unit is connected to the collection blocking device using each communication path, and the illegal call detection device 300 provides information on the protocol of the call data collected by the collection blocking device connected through each communication path (for example, ISUP, SIP, etc.) are defined in advance and saved. Accordingly, the interface unit 1002 can easily identify a protocol to be used according to which communication path the call data is received. Then, the signal processing unit 1004 parses and analyzes the received call data according to a corresponding protocol to determine information included in the call data.

The suspicious person detection unit 1010 detects whether the caller is an illegal caller using the detection rule stored in the rule storage unit 1040 . The suspect detection unit 1010 may store and use call data of different protocols in a predefined data format.

The rule storage unit 1040 stores at least one detection rule. An example of a detection rule is shown in FIG. 5 .

When a caller detected as an illegal call suspect by the suspect detection unit 1010 is designated as a blocking target, the cut-off unit 1020 transmits a cut-off command to the network access device to cut the call of the caller.

The blocking definition unit 1030 transmits the blocking rule to the collection blocking device. The blocking rule may be designated from among a plurality of detection rules, an example of which is shown in FIG. 6 .

11 is a diagram illustrating another example of the configuration of an illegal call detection apparatus according to an embodiment of the present invention.

Referring to FIG. 11 , the first interface unit 1110 and the second interface unit 1112 of the illegal call detection apparatus 300 correspond to the interface unit 1002 of FIG. 10 . The signal processing unit 1140 including the protocol processing unit 1130 and the packet processing unit 1120 corresponds to the signal processing unit 1004 of FIG. 10 .

CDR generation unit 1160, raw data management unit 1162, correlation analysis unit 1164, customer data management unit 1166, QoS analysis unit 1168, traffic generation unit 1170, rule management unit 1172, etc. 10 corresponds to the suspect detection unit 1010 , the black/white list 1174 , and the databases 1180 and 1182 correspond to the rule storage unit 1040 of FIG. 10 .

The first interface unit 1110 receives customer data from a communication company server or the like. In addition, the first interface unit 1110 transmits a cut-off command to the network access device, and transmits a blacklist or a blocking rule to the collection blocking device.

The second interface unit 1112 receives call data of various protocols from each collection blocking device. The second interface unit 1112 is connected to a plurality of collection blocking devices through respective communication paths, and a protocol used for each communication path is predefined.

The packet processing unit 1120 receives and decodes call data of various protocols, and the protocol processing unit 1130 parses and analyzes the call data according to the protocol of each call data.

The original data management unit 1162 stores and manages the original call data identified by the signal processing unit 1140, and the CDR generation unit 1160 converts the information of the call data into a predefined data format (eg, CDR (call) detail record) format). The CDR generator 1160 may calculate and store the number of calls and the accumulated billing amount based on the rate based on the caller ID when generating the CDR.

The correlation analysis unit 1164 analyzes the correlation between CDR data, customer data, traffic flow, and the like to determine whether there is an illegality. Various conventional analysis methods for analyzing correlations between information included in call data, customer data, call statistical analysis data, and the like may be applied to this embodiment.

The customer data management unit 1166 normalizes customer relationship management (CRM), billing data, and the like, and stores the normalized data to be used for detecting illegal calls.

The QoS analysis unit 1168 measures the quality by calculating MoS, jitter, etc. according to the ITU standard in order to check the VoIP call quality.

The traffic generation unit 1170 generates call history by operator or usage-specific call history for a call based on the CDR so that it can be used to detect illegal calls.

The rule management unit 1172 defines and stores a detection rule for detecting illegal calls by combining call data, customer data, statistical data, and the like.

Black/white list 1174 defines and stores a blacklist or whitelist. The databases 1180 and 1182 store and manage various call data, detection rules, blocking rules, and the like for the present embodiment.

The present invention can also be embodied as computer readable program code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data readable by a computer system is stored. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage device. In addition, the computer-readable recording medium is distributed in a network-connected computer system so that the computer-readable code can be stored and executed in a distributed manner.

So far, the present invention has been looked at with respect to preferred embodiments thereof. Those of ordinary skill in the art to which the present invention pertains will understand that the present invention can be implemented in a modified form without departing from the essential characteristics of the present invention. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is indicated in the claims rather than the foregoing description, and all differences within the scope equivalent thereto should be construed as being included in the present invention.

Claims (13)

In the illegal call detection method performed by the illegal call detection device,
Receiving call data between a caller and a receiver from a plurality of collection blocking devices located between the network access device and the subscriber;
detecting whether the caller is an illegal call suspect using a plurality of detection rules defined by combining a plurality of pieces of information constituting call data, customer data, or call statistics analysis data;
transmitting a cut-off command to a network access device so that the caller's connection call can be cut off when the suspected illegal call is designated as a block target according to a manager's request or a predefined blocking target determination method; and
Among the plurality of detection rules, a detection rule indicating that the blocking target designation rate of the suspected illegal call is greater than or equal to a preset ratio is designated as a blocking rule, and the plurality of collection blocking devices can block a call connection using the blocking rule. Including; transmitting a blocking rule to the plurality of collection blocking devices;
The cut-off command includes call identification information or a caller's phone number,
The step of transmitting the cut-off command includes transmitting the cut-off command to a network access device so that a normal phone call between the caller and at least one recipient can be forcibly terminated,
The blocking is to terminate the call connection before the call connection between the two parties so that the call connection between the caller and the called party does not occur in the first place, and the cutoff is to force the phone call between the two parties after a normal call connection between the caller and the called party is established Illegal call detection method comprising terminating. The method of claim 1,
The illegal call detection method further comprising; after being detected as a suspected illegal call by the detection rule, the information of the caller designated as a blocking target is designated as a blacklist and transmitted to the collection blocking device. delete The method of claim 1,
Storing a detection rule defined by combining at least one or more information included in the call data and at least one or more information included in customer data or statistical analysis data of call connection; further comprising,
In the step of determining whether the illegal call is suspected, the caller corresponds to the detection rule based on customer data or statistical analysis data identified based on the caller phone number included in the call data together with the call data between the caller and the receiver Analyzing whether or not an illegal call is suspected; an illegal call detection method comprising a. The method of claim 1, wherein transmitting the cut command comprises:
receiving a caller information list of a currently connected call from the network access device; and
and transmitting a cut-off command for the call corresponding to the blocking target in the caller information list to the network access device. The method of claim 1, wherein receiving the call data comprises:
Receiving the call data using a communication path respectively connected to the collection blocking device respectively located in the communication network using different protocols;
identifying a use protocol according to a communication path through which the call data is received, and parsing and identifying information included in the received call data according to the use protocol; and
and storing the information identified from the call data in a predefined data format. The method of claim 1, wherein receiving the call data comprises:
and receiving call data other than a call corresponding to a blacklist or blocking rule stored in the collection blocking device from the collection blocking device. a data receiver for receiving call data between a caller and a receiver from a plurality of collection blocking devices located between the network access device and the subscriber;
a suspect detection unit for detecting whether the caller is an illegal caller using a detection rule defined by combining a plurality of pieces of information constituting call data, customer data, or call statistics analysis data;
a cutting unit that transmits a cut-off command to a network access device so that the caller's connection call can be cut off when the suspected illegal call is designated as a block target according to a manager's request or a predefined blocking target determination method; and
Among the plurality of detection rules, a detection rule indicating that the blocking target designation rate of the suspected illegal call is greater than or equal to a preset ratio is designated as a blocking rule, and the plurality of collection blocking devices can block a call connection using the blocking rule. Including; blocking definition unit for transmitting the blocking rule to the plurality of collection blocking devices;
The cut-off command includes call identification information or a caller's phone number,
The cut-off unit transmits the cut-off command to the network access device to terminate a normal phone call between the caller and at least one recipient,
The blocking is to terminate the call connection before the call connection between the two parties so that the call connection between the caller and the called party does not occur in the first place, and the cutoff is to force the phone call between the two parties after a normal call connection between the caller and the called party is established Illegal call detection device, characterized in that the termination. 9. The method of claim 8,
The illegal call detection device further comprising a; blocking definition unit for designating as a blacklist the information of the caller designated as a blocking target after being detected as an illegal call suspect by the detection rule and transmitting the information to the collection blocking device. delete 9. The method of claim 8,
Illegal call, characterized in that it further comprises a; rule storage unit for storing a detection rule defined by combining at least one or more information included in customer data or statistical analysis data of call connection with at least one or more information included in call data. detection device. 9. The method of claim 8,
The data receiving unit,
an interface unit for receiving call data using communication paths respectively connected to collection blocking devices respectively located in communication networks using different protocols;
A signal processing unit for identifying a protocol to be used according to a communication path through which the call data is received, and parsing and identifying information included in the received call data according to the protocol used;
The illegal call detection device, characterized in that the suspect detection unit stores the information identified from the call data in a predefined data format. A computer-readable recording medium in which a program code for performing the method according to any one of claims 1, 2, and 4 to 7 is recorded.

Images