KR20100034289A - System for blocking ars and one ring spam telephone and method therefor - Google Patents

Abstract

PURPOSE: A system for blocking ARS(Automatic Response System) and one ring spam calls and a method thereof are provided to analyze and manage a spam call using a subscriber call processing message and block call origination of a subscriber corresponding to the extracted spam call. CONSTITUTION: A monitoring device(400) indexes and outputs a connection attempt rate and a black list of a spam call according to a spam call origination number and a call connection attempt rate according to a telephone number in a gray list. The monitoring device stores and manages a spam call generation history by the indexed origination number. A spam management server(500) receives spam call generation histories by the indexed origination number in real time. The spam management server provides the received call generation histories to a manager.

Description

ARS and One-Ring Spam Call Blocking System and Its Method {SYSTEM FOR BLOCKING ARS AND ONE RING SPAM TELEPHONE AND METHOD THEREFOR}

The present invention relates to an ARS and one ring spam call blocking system and method thereof, and more particularly, to analyze a spam call using a subscriber call processing message extracted from a signal message collected through monitoring of a signal link in an E1 line. The present invention relates to an ARS and one-ring spam call blocking system that manages and blocks outgoing subscribers corresponding to the spam call, and a method for providing the same.

In general, an automatic response system (ARS) spam call is a method in which a spam server attempts to call an unspecified subscriber to unilaterally deliver an advertisement within a few seconds to several tens of seconds, or provide a guidance message to induce a subscriber's service response. The One Ring spam phone sends a ring signal once or twice to an unspecified subscriber from the spam server, terminates the call, and delivers the call back phone number of the spam service server to the subscriber. Refers to inducing billing by inducing a call from a received telephone subscriber to a spam service server.

Unlike existing spam phones that use identification numbers such as 060, mobile phone numbers or landline phone numbers are used as it is, so it is not easy to distinguish between spam calls. The damage is getting bigger, such as by imposing telephone subscribers on information usage fees in addition to call charges.

Such ARS and one-ring spam calls are shown in FIG. 1 in which a spammer generates a spam call through a spam service server or a spam sending server via a separate telephone killer network or a VoIP telephone network, a wired telephone network and a wireless telephone network. Has a structure.

In fact, the proportion of one-ring spam calls out of all spam calls increased from 6.7% in 2005 and 6.4% in 2006 to 12.3% in 2007.

Although the government and various carriers are making great efforts to eradicate such ARS and one-ring spam calls, the one-ring spam calls due to the lack of spam monitoring and blocking measures for relay calls between spammers, wireline networks, and wireless telephone networks. The situation is not basically solved the damage.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and collects call processing messages by monitoring signal links in a connected E1 line for subscriber access at a gateway exchange or circuit switching period, and extracts subscriber call extracts from the collected call processing messages. It analyzes and manages spam calls by using processed messages and provides blocking of outgoing subscribers corresponding to extracted spam calls.

The ARS and one-ring spam call blocking system according to the present invention for achieving the above technical problem, a circuit mirroring device for mirroring the E1 line connected to the gateway switch or circuit switch, and collects the signaling message, and through monitoring the E1 line Receiving and indexing subscriber call processing messages by receiving signaling messages in the E1 line, and monitoring the E1 line and controlling the termination of signal links according to the administrator's operation, and through the collection of indexed subscriber call processing messages. Spam analysis device that determines the spam call by classifying each call type of ARS and one ring, checks whether there is additional call for black list, and generates gray list for new spam call, connected line monitoring device, spam Spam based on spam caller's number as well as control of collection and spam analysis devices A monitoring device for storing and managing the spam call occurrence history by indexed calling number, outputting the number of connection attempts according to the number and type of the call attempt attempt rate according to the telephone number in the black list and the gray list. Spam management server for receiving the real-time spam call generation history by index and provides the administrator to the spam.

In addition, the circuit mirroring device is characterized by including an electronic CDF (Calling Delivery Function) / QDF (Quicken Delivery Function).

In addition, the spam collection device is characterized by supplying a reference clock to the line mirroring device through the reference clock devices (DOTS, BITS) through the E1 line clock synchronization unit provided therein.

In addition, spam calls include one-ring spam calls and ARS spam calls, where one-ring spam calls are outgoing phone calls that exceed a set threshold, with a call requesting the release of calls prior to the recipient's incoming response during the measurement period, The ARS spam call is characterized by being an outgoing call that exceeds the set reference rate when the incoming call is received by the receiver during the measurement period, but the call time between the called party and the called party is less than or equal to the set reference call time.

In addition, the spam analysis apparatus may include an in-depth management function in which an administrator directly determines whether or not spam is provided by providing data such as measurement and statistics on a call according to a specific caller number selected by an administrator.

On the other hand, ARS and one-ring spam call blocking method based on the above-described system, (a) the line mirroring device to extract the signal message in the E1 line by mirroring the E1 line of the gateway switch or circuit switching period, and spam (B) the collecting device extracting and indexing the subscriber call processing message from the signaling message, and the spam analysis device including ARS spam and one-ring spam based on the calling party number and originating type in the indexed subscriber call processing message. (C) analyzing the spam calls, and the monitoring device manages the ARS spam attempt rate and one-ring spam attempt rate statistics for the specific outgoing phone number based on the analyzed spam calls, and the spam call origination history, respectively. (D) performing update and notification and spam blocking for the black list and gray lists.

In addition, (d) step (d-1) to determine whether the spam analysis device is included in the white list, the spam analysis device, and spam that the spam analysis device is not included in the white list If it is a call, if the analyzed spam calls are the end of the call before the incoming response, the step (d-2) of discriminating whether or not the analyzed spam calls are the end of the call before the incoming response is performed. It is determined that the ring spam call and the spam analysis device determines whether the call is out of the reference value during the measurement period (d-3a) and (d-3a). (D-4a), the spam analysis device determines whether the original ring spam call is a caller number previously registered in the black list, and if the original ring spam call is not the caller number previously registered in the black list, the spam analysis device Has won ring spam ho (D-5a) adding to the list, and if the original ring spam call is a caller number pre-registered in the black list, the spam analysis device updates the original ring spam call to the blacklist (d-6a). do.

Then, after step (d-2), if the result of the division of step (d-2) indicates that the analyzed spam calls are successful calls, the spam analysis device determines whether the talk time is less than the reference time during the measurement period. If the determination result of step (d-3b) and (d-3b) indicates that the ARS spam call is less than or equal to the reference time during the measurement period, the spam analysis device determines whether the ARS spam call is an originating number already registered in the blacklist. (D-4b) determining, (d-5b) the spam analyzing apparatus adds the ARS spam call to the gray list if the ARS spam call is not a registered caller number, and the ARS spam call blacklist. If the caller ID is registered in advance, the spam analysis apparatus further includes updating the ARS spam call to the blacklist (d-6b).

According to the present invention as described above, the indirect monitoring function for monitoring the signaling link of the gateway switch or the E1 line of the circuit switching period to collect the subscriber call processing message, and analyze and manage the information of the spam call in the collected subscriber call processing message. By using it, there is an effect of providing a monitoring and blocking function for spam calls.

In addition, the present invention is a service call processing device that increases the load on the existing subscriber call processing service device for spam monitoring by operating as an independent system that spam monitoring does not directly interwork with the subscriber call processing service device of the operator; This eliminates the need for the implementation of additional interworking functions between spam devices and prevents instability of subscriber services that can occur due to additional interworking between service call processing equipment and spam devices.

In addition, there is an effect of making the introduction of a spam monitoring device more smoothly by not impairing service instability.

Specific features and advantages of the present invention will become more apparent from the following detailed description based on the accompanying drawings. Prior to this, terms and words used in the present specification and claims are to be interpreted in accordance with the technical idea of the present invention based on the principle that the inventor can properly define the concept of the term in order to explain his invention in the best way. It should be interpreted in terms of meaning and concept. It is to be noted that the detailed description of known functions and constructions related to the present invention is omitted when it is determined that the gist of the present invention may be unnecessarily blurred.

Figure 2 is a block diagram showing a one ring spam call blocking system according to the present invention.

As shown in FIG. 2, the one-ring spam call blocking system S according to the present invention includes a line mirroring device 100, a spam collection device 200, a spam analysis device 300, a monitoring device 400, and spam. It is configured to include a management server (500).

Specifically, the circuit mirroring device 100 is connected to the gateway switch 10 or the E1 line 20 connected to the circuit switch 10 to mirror the E1 line 20, and collects the collected signal messages as a spam collection device. Forward to 200.

In addition, when an electronic CDF (Calling Delivery Function) / QDF (Quicken Delivery Function) is used, mirroring can be performed without installing additional equipment for mirroring.

Here, the gateway exchange 10 means an exchange used for interconnection between wired and wireless carriers, and the circuit exchange means an exchange configured only within an individual carrier.

In addition, the E1 line 20 means the line equipment interconnected with the plurality of gateway exchanges 10, and mirroring is transmitted on the E1 line 20 between the exchange 10 and the exchange 10. It means collecting without direct intervention on signaling message for subscriber service.

The spam collection apparatus 200 receives the SS7 standard signaling message, which is a signaling message transmitted during the gateway exchange period through the circuit mirroring apparatus 100, extracts and indexes the subscriber call processing message therefrom, and performs an E1 operation according to the operation of the administrator. It monitors the circuit 20 and controls the termination of the signal link 30.

In addition, the reference clock received through the reference clock supply devices (DOTS, BITS) through the E1 line clock synchronization unit provided therein is characterized in that for supplying to the line mirroring device (100).

The spam analysis device 300 determines the spam call by dividing the ARS and the original ring type call through the subscriber call processing message aggregation in the indexed E1 line 20 received from the plurality of spam collection devices 200. In addition, it checks whether an additional call has occurred for the black list, generates a gray list for a new spam call, and supports in-depth management of a call according to a specific caller number by an administrator.

Here, the call means that the subscriber occupies the communication line for the purpose of the call, and call detail data (call number, called number, call volume) for the subscriber group according to call detail reporting (CDR). And call time).

In addition, spam calls are divided into two types: one-ring spam calls and advanced record system (ARS) spam calls. One-ring spam calls exceed a set threshold when a call requesting the release of a call is received before the recipient's incoming response during the measurement period. Is an outgoing call.

The ARS spam call is an outgoing call that exceeds the set reference rate when an incoming call is received by the receiver during the measurement period, but the call time between the called party and the called party is less than or equal to the set reference call time.

In addition, the in-depth management may be understood as managing so that the administrator can directly determine whether or not spam by providing data such as measurement and statistics on the call for a specific call number selected by the administrator.

The monitoring device 400 is connected to the line monitoring device 100, the spam collection device 200, and the spam analysis device 300 to control them, and the connection attempt rate of the spam call according to the spam call number, the blacklist and It outputs the statistics of the call connection attempt according to the telephone number in the gray list by number and type, and saves and manages the spam call occurrence history by indexed calling number.

In addition, the spam management server 500, receiving the real-time spam call generation history by index number from the monitoring device 400 to the administrator in addition to the spam call generation history KISA and communication service providers The Korea Information Security Agency and the Signaling Network Operation Management System will block spam calls based on the history of spam calls.

The spam analysis device 300, the monitoring device 400, and the spam management server 500 are classified into logical functions, and may be physically integrated into one system as necessary.

Hereinafter, a method of blocking a one-ring spam call based on the above-described system will be described with reference to FIGS. 3 and 4.

First, the line mirroring apparatus 100 mirrors the E1 line 20 between the gateway switch 10 or the circuit switch 10 (S10), and extracts a signal message from the E1 line (S20).

Subsequently, the spam collection apparatus 200 extracts and indexes the subscriber call processing message from the signal messages collected from the plurality of circuit mirroring apparatus 100 (S30).

Later, the spam analysis apparatus 300 analyzes the spam calls based on the caller's telephone number and origination type in the subscriber call processing message indexed from the plurality of spam collection apparatuses 200 (S40).

Subsequently, the monitoring apparatus 400 organizes the ARS spam attempt rate, the one-ring spam attempt rate statistics, and the respective call origination histories for the specific outgoing telephone number based on the analyzed call information (S50), and the indexed black. Update and notification of the list and gray lists and spam blocking through interworking with the signal network operation management system (S60).

In addition, the spam blocking method through the KISA and the signaling network operation management system for the spam call list by the originating number of the spam management server 500 provides a different procedure according to the network configuration and the operator. Does not present.

On the other hand, if the step of S40 in detail, the step of analyzing the spam analysis device to exclude the analysis, that is included in the white list, that is included in the white list (S41), and the analyzed spam call is not included in the white list If it is not a spam call, step S42 is performed to determine whether the analyzed spam calls are call termination before an incoming response.

As a result of the discrimination in step S42, if the analyzed spam calls are the end of the call before the incoming response, it is determined that the original ring spam call, and the spam analysis device determines whether the outgoing call more than the reference value during the measurement period (S43a). .

Subsequently, when the determination result of step S43a indicates that the one-ring spam call is an outgoing call that is greater than or equal to the reference value during the measurement period, the spam analyzing apparatus determines whether the one-ring spam call is a calling number previously registered in the black list (S43b). Perform

Later, as a result of the determination in step S43b, if the original ring spam call is not a registered call number previously registered in the black list, the spam analysis device adds the original ring spam call to the gray list (S43c), and the one ring spam call is black. If the originating number is already registered in the list, the spam analysis device updates the original ring spam call to the black list (S43d).

On the other hand, if it is determined in step S42 that the analyzed spam calls are not the end of the call before the incoming response, it is determined that the ARS spam call, and the spam analysis device determines whether the talk time is less than the reference time during the measurement period S44a is performed.

Subsequently, when the determination result of step S44a indicates that the ARS spam call is less than the reference time during the measurement period, the spam analyzing apparatus determines whether the ARS spam call is a calling number previously registered in the blacklist (S44b). Perform

Later, as a result of the determination in step S44b, if the ARS spam call is not the registered call number pre-registered in the black list, the spam analyzing apparatus adds the ARS spam call to the gray list (S44c), and the ARS spam call is pre-registered in the black list. If it is the calling number, the spam analyzing apparatus updates the ARS spam call to the black list (S44d).

On the other hand, if the calling number is a white list in step S41 or the original ring spam call does not send more than the reference value during the measurement period in step S43a, or the ARS spam call does not have the talk time less than the reference value during the measurement period in step S44a, In operation S45, the controller 110 determines that the call is normal and ends without performing a separate list update and addition.

As described above and described with reference to a preferred embodiment for illustrating the technical idea of the present invention, the present invention is not limited to the configuration and operation as shown and described as described above, it is a deviation from the scope of the technical idea It will be understood by those skilled in the art that many modifications and variations can be made to the invention without departing from the scope of the invention. Accordingly, all such suitable changes and modifications and equivalents should be considered to be within the scope of the present invention.

1 is a block diagram showing a conventional one-ring spam call generation.

Figure 2 is a block diagram showing a one ring spam call blocking system in the present invention.

Figure 3 is a flow chart illustrating a one ring spam call blocking method according to the present invention.

Figure 4 is a flow chart showing the detailed steps of step S40 according to the one-ring spam call blocking method of the present invention.

** Description of symbols for the main parts of the drawing **

S: One Ring Spam Blocking System 10: Gateway Switch, Circuit Switch

20: E1 line 30: signal link

100: line mirroring device 200: spam collection device

300: spam analysis device 400: monitoring device

500: spam management server

Claims (9)

ARS and one ring spam call blocking system, A circuit mirroring device for mirroring the E1 circuit connected to the gateway switch or circuit switch and collecting signal messages; A spam collection device that receives the signaling message in the E1 line through the monitoring of the E1 line, extracts and indexes the subscriber call processing message, and controls the monitoring and termination of the signal links for the E1 line according to an operation of an administrator; Spam analysis that determines the spam call by classifying the call types of the ARS and the original ring through the collection of the indexed subscriber call processing messages, examines whether an additional call is generated for the black list, and generates a gray list for the new spam call. Device; By controlling the connected line monitoring device, spam collection device, and spam analysis device, the connection attempt rate of spam calls according to the spam call origination number and the call connection attempt rate according to the phone numbers in the blacklist and gray list are counted by number and type. A monitoring device for storing and managing the spam call occurrence history for each indexed outgoing number; And A spam management server that receives the indexed spam call occurrence history for each calling number in real time and provides the same to an administrator; ARS and one-ring spam call blocking system comprising a. The method of claim 1, The line mirroring device, An ARS and one-ring spam call blocking system comprising an electronic CDF (Calling Delivery Function) / QDF (Quicken Delivery Function). The method of claim 1, The spam collection device, ARS and one-ring spam call blocking system, characterized in that to supply a reference clock to the line mirroring device through a reference clock device (DOTS, BITS) through an E1 line clock synchronization unit provided therein. The method of claim 1, The spam call is, Include one-ring spam calls and ARS spam calls, The one-ring spam call is an outgoing telephone call in which a call requesting the release of the call before the incoming response of the receiving side during the measurement period exceeds a set threshold value, The ARS spam call is an outgoing telephone call that exceeds the set reference rate when the receiving party's incoming response is made during the measurement period but the call time between the called party and the called party is less than or equal to the set reference call time. Phone blocking system. The method of claim 1, The spam analysis device, ARS and one-ring spam call blocking system, characterized in that it includes in-depth management function to determine whether the administrator directly spam by providing data such as measurement and statistics for the call according to the specific call number selected by the administrator's operation . The method of claim 1, The spam management server, Spam call occurrence history indexed by the calling number indexed from the monitoring device is provided to the administrator in real time, and the spam call generation history is transmitted to the Korea Information Security Agency and the service provider's signal network operation management system. ARS and one ring spam call blocking system, characterized in that the Korea Information Security Agency and the signal network operation management system to block the spam call according to the history of spam call generation. In the method of blocking ARS and one-ring spam calls, (a) a circuit mirroring device mirroring an E1 line in a gateway switch or a circuit switched period to extract a signal message in the E1 line; (b) the spam collection device extracting and indexing the subscriber call processing message from the signaling message; (c) the spam analysis device analyzing the spam calls including ARS spam and one-ring spam based on the calling party's telephone number and origination type in the indexed subscriber call processing message; And (d) The monitoring apparatus manages the ARS spam attempt rate and one-ring spam attempt rate statistics for the specific outgoing telephone number based on the analyzed spam calls, and the history of the spam call origination respectively, and the blacklist and gray lists for the Performing update and notification and spam prevention; ARS and one ring spam call blocking method comprising the. The method of claim 7, wherein In step (d), (d-1) the spam analyzing apparatus discriminating whether the analyzed spam calls are included in a white list; (d-2) if the spam analysis device is a spam call whose analyzed spam calls are not included in the white list, discriminating whether the analyzed spam calls are a call termination before an incoming response; (d-3a) If the result of the division of the step (d-2) indicates that the analyzed spam calls are the end of the call before the incoming response, it is determined that the original ring is a spam ring, and the spam analysis device recognizes the outgoing call more than the reference value during the measurement period. Determining; (d-4a) If the one-ring spam call is an outgoing call that is greater than or equal to the reference value during the measurement period, the spam analysis device sends the one-ring spam call to the blacklist. Determining whether a number; (d-5a) if the original ring spam call is not a registered call number previously registered in the black list, the spam analyzing apparatus adding the original ring spam call to the gray list; And (d-6a) if the original ring spam call is an originating number previously registered in the black list, the spam analyzing apparatus updating the original ring spam call to blacklist; ARS and one ring spam call blocking method further comprising a. The method of claim 8, After the step (d-2), (d-3b) In the case where the analyzed spam calls are an incoming response when the classified result of the step (d-2) is determined, it is determined that the ARS spam calls are received, and the spam analysis device calls the reference time during the measurement period. Determining whether it is less than or equal to; (d-4b) If the determination result of step (d-3b) indicates that the ARS spam call is less than or equal to the reference time during the measurement period, the spam analysis device sets the ARS spam call to the blacklist, and the calling number previously registered. Determining whether it is; (d-5b) if the ARS spam call is not a registered call number registered in the black list, adding the ARS spam call to the gray list by the spam analyzing apparatus; And (d-6b) if the ARS spam call is a calling number pre-registered in the black list, updating the ARS spam call to blacklist by the spam analyzing apparatus; ARS and one ring spam call blocking method further comprising a.

Images