KR20100059007A - Central management server for blocking voip spam - Google Patents

Abstract

PURPOSE: A center management server for blocking the VoIP spam is provided to block spams effectively by analyzing a telephone call pattern of a spammer and receiver reaction. CONSTITUTION: A discrete reputation board index receiver(172) receives a discrete reputation board index reflecting a call pattern information of a caller terminal using a VoIP(Voice over Internet Protocol) and reputation board index from spam blocking devices. A total reputation board index output unit(174) outputs the synthesis reputation at board index of the caller terminal using the discrete reputation board index. The discrete reputation board index is produced by mixing a receiver index of the caller terminal, a conversation time index, a traffic index, a receive refuse index, a call interval index, a sending attempt index, a blacklist index and a declaration index.

Description

Central management server for blocking VoIP spam}

The present invention relates to an internet phone service, and more particularly, to a central management server for Internet phone service spam blocking.

With the development of the Internet technology, Voice over IP (VoIP) service, which is a telephone service using the Internet, is being gradually activated due to the advantages of providing a low rate and various additional services. It is expected to replace.

However, various call spams, instant spams, and presence spams, which are constantly occurring in existing PSTNs and mobile networks, provide undesired information or are illegal or fraudulent, and especially financial damage through voice phishing. As damages spread to the road, it is necessary to prepare countermeasures.

Spam may be normal content in itself and may be useful information for some people, but there is a problem that the recipient may feel uncomfortable with content that they do not want. Each user may have a different response, and there may be limitations in determining whether spam is used using simple indicators. Therefore, there is a need for a technique for blocking spam in consideration of the characteristics of spammers.

In addition, if multiple service providers provide Internet telephony services, spammers can calculate the spam-related indexes that can be calculated by each service provider. It is limited and is hard to be seen as accurate. In other words, spammers deliver spam to multiple carriers, while domain-specific blocking policies rely on information collected individually, in which case, if spammers deliver less spam to specific carriers, they will be spammers. There is a problem in that the extraction is limited. In addition, there is a problem in that information on spammers, etc. collected from abroad is limited in responding individually in each service provider domain.

In addition, if a large amount of spam sent by spammers is blocked at the service provider's source, spam is not spread, so it can be responded very efficiently. However, if there is no policy at the central management agency level, it must be blocked at the receiving end. have.

The background art described above is technical information possessed by the inventors for the derivation of the present invention or acquired during the derivation process of the present invention, and is not necessarily a publicly known technique disclosed to the general public before the application of the present invention.

An object of the present invention is to provide a central management server for blocking an internet phone service spam that can effectively block spam by analyzing a caller pattern and a receiver response of a spammer.

In addition, the present invention is not limited to individual carriers, but to provide a central management server for blocking Internet telephone service spam that can provide spammer information for all carriers.

In addition, the present invention provides spammers to all carriers, overcoming the limitations corresponding to spammers with the information collected by each carrier, integrated utilization of spammers collected from abroad, and spam is a receiving domain It is to provide a central management server for Internet phone service spam blocking, which can be blocked in outgoing and transit domains before protecting the network resources.

Technical problems other than the present invention will be easily understood through the following description.

According to an aspect of the present invention, in the central management server to block spam for Internet telephony (VoIP) service, a plurality of individual reputation index reflecting call pattern information and reputation information of the caller terminal using the Internet telephony service Internet reputation service including an individual reputation index receiving unit for receiving from the spam blocking device, a comprehensive reputation index calculation unit for calculating a comprehensive reputation index of the caller terminal using the received plurality of individual reputation indexes, and a storage for storing the comprehensive reputation index A central management server for spam protection is presented.

The individual reputation index may be calculated by combining any one or more of a receiver index, a call time index, a traffic index, a rejection index, a call interval index, a call attempt index, a blacklist index, and a report index of the caller terminal.

The receiver index, the talk time index, the traffic index, the rejection index, the call interval index, and the outgoing attempt index may be calculated using the following equation.

,

,

,

,

,

,

,

,

,

,

는 상기 수신자 지수,

는 소정의 시간동안 상기 발신자 단말기의 수신자 수, N은 상기 시간동안 상기 발신자 단말기가 발신한 통화수,

는 상기 통화시간 지수,

는 소정의 시간동안 상기 발신자 단말기의 통화지속시간이 기준값보다 작은 통화건수,

는 상기 트래픽 지수,

는 소정의 시간동안 상기 발신자 단말기의 전송 트래픽이 기준값보다 큰 통화건수,

는 상기 수신거부 지수,

는 모든 발신자 단말기의 수신거부수의 표준편차,

는 상기 발신자 단말기의 평균 수신거부수,

은 모든 발신자 단말기의 평균 수신거부수,

는 상기 통화간격 지수,

는 모든 발신자 단말기의 통화간격의 표준편차,

는 상기 발신자 단말기의 평균 통화간격,

는 모든 발신자 단말기의 평균 통화간격,

는 상기 발신시도 지수,

는 소정의 시간동안 모든 발신자 단말기의 발신시도수의 표준편차,

는 소정의 시간동안 상기 발신자 단말기의 평균 발신시도수,

은 소 정의 시간동안 모든 발신자 단말기의 평균 발신시도수이다. here,

Is the recipient index,

Is the number of recipients of the caller terminal during the predetermined time, N is the number of calls made by the caller terminal during the time,

Is the talk time index,

Is the number of calls in which the call duration of the caller terminal is smaller than a reference value for a predetermined time;

Is the traffic index,

Is a number of calls in which the transmission traffic of the caller terminal is larger than a reference value for a predetermined time;

Is the unsubscribe index,

Is the standard deviation of the rejection count of all calling terminals,

Is the average number of rejection of the caller terminal,

Is the average number of unsubscribed from all calling terminals,

Is the currency interval index,

Is the standard deviation of the call interval of all calling terminals,

Is the average call interval of the caller terminal,

Is the average call interval for all calling terminals,

Is the outgoing attempt index,

Is the standard deviation of the number of originating attempts of all calling terminals,

Is the average number of transmission attempts of the caller terminal for a predetermined time,

Is the average number of outgoing attempts of all caller terminals during the specified time period.

In addition, the blacklist index may be calculated using the following equation.

는 상기 블랙리스트 지수,

는 상기 발신자 단말기가 블랙리스트에 등록된 회수,

은 상기 스팸 차단 장치와 결합된 프록시 서버에 연결되는 전체 사용자 단말기의 수이다. here,

Is the blacklist index,

The number of times the caller terminal is registered in the blacklist,

Is the total number of user terminals connected to the proxy server associated with the spam blocking device.

In addition, the reporting index may be calculated using the following equation.

는 상기 신고 지수,

는 상기 발신자 단말기가 스패머로 신고된 회수,

은 상기 스팸 차단 장치와 결합된 프록시 서버에 연결되는 전체 사용자 단말기의 수이다. here,

Is the reporting index,

Is the number of times the caller terminal was reported as a spammer,

Is the total number of user terminals connected to the proxy server associated with the spam blocking device.

The individual reputation index may be calculated by combining the call pattern index reflecting the call pattern information of the caller terminal and the receiver response index reflecting the reputation information of the caller terminal.

The currency pattern index may be calculated using the following equation.

는 스팸 지수,

는 수신자 지수,

는 통화시간 지수,

는 트래픽 지수,

는 수신거부 지수,

는 통화간격 지수,

는 발신시도 지수,

이다. here,

Is the spam index,

Is the recipient index,

Is the talk time index,

Is the traffic index,

Is the unsubscribe index,

Is the currency interval index,

Is the outgoing attempt index,

to be.

In addition, the receiver response index may be calculated using the following equation.

는 상기 수신자 반응 지수,

는 상기 블랙리스트 지수,

는 상기 신고 지수,

이다. here,

Is the receiver response index,

Is the blacklist index,

Is the reporting index,

to be.

Individual reputation index can be calculated using the following equation.

는 상기 개별 평판 지수,

는 상기 수신자 반응 지수,

는 상기 통화 패턴 지수,

이다. here,

Is the individual reputation index,

Is the receiver response index,

Is the currency pattern index,

to be.

In addition, the comprehensive plate index may be calculated using the following equation.

은 상기 종합 평판 지수,

은 i번째 통신 사업자 서버에 등록된 사용자 단말기수,

는 상기 개별 평판 지수이다. here,

Is the comprehensive reputation index,

Is the number of user terminals registered in the i-th carrier server,

Is the individual reputation index.

Other aspects, features, and advantages other than those described above will become apparent from the following drawings, claims, and detailed description of the invention.

The central management server for Internet telephone service spam blocking according to the present invention can block spam by analyzing a spammer's call pattern and a receiver's response, and is not limited to individual service providers, and can provide spammer information to all service providers. It has an effect.

In addition, the central management server for Internet phone service spam blocking according to the present invention provides spammers information to all carriers, overcoming the limitations corresponding to spammers with information collected by each carrier, collected abroad Integrating spammer information and blocking spam from outgoing and transit domains before reaching the receiving domain can protect network resources.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items. When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. As used herein, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described on the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art.

In the following description of the present invention with reference to the accompanying drawings, the same components are denoted by the same reference numerals regardless of the reference numerals, and redundant explanations thereof will be omitted. In the following description of the present invention, if it is determined that the detailed description of the related known technology may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

1 is a system configuration for blocking Internet phone service spam according to an embodiment of the present invention. Referring to Figure 1, the sender terminal (110a, 110b), spam blocking device (120: 120a, 120b), proxy server (125: 125a, 125b), IP network 130, receiving gateway 140, receiving side Switching stations 150a and 150b, receiving base station 155, receiver terminals 160a to 160d, central management server 170 are shown.

In this embodiment, in the Internet telephony service to which Voice over Internet Protocol (VoIP) technology is applied, the central management server 170 integrates call detail records (CDRs) and reputation information managed by each service provider server to spam as a whole. Providing techniques to block spam can provide techniques for blocking spam. That is, according to the present embodiment, the call history record including the information of the receiver, time, traffic, rejection, call interval, call origination, etc. of the call records of the caller terminal (110a, 110b) and reputation information that is the response information of the receiver Use to determine whether the sender is a spammer (spammer) and can be used to block spam using this determination result.

The spam blocking method according to the present invention can be applied to the case where the caller's call pattern can be analyzed without being limited to the types of spam, for example, call spam, instant spam, and presence spam.

The user terminal according to the present embodiment includes caller terminals 110a and 110b and receiver terminals 160a to 160d. The caller terminals 110a and 110b used by the caller may include various types of terminals such as an Internet dedicated telephone 110c (for example, an IP phone) and a user PC 110d. The caller terminals 110a and 110b finally communicate with the receiver terminals 160a to 160d via the IP network 130. The form of the Internet telephone service is from the Internet dedicated telephone 110a (or user PC 110b) to the Internet dedicated telephone 160c (or user PC 160d), the Internet dedicated telephone 110a (or user PC 110b). )) From mobile communication terminal 160a (or general landline phone 160b) to mobile communication terminal 160a (or general landline phone 160b) The present embodiment can be applied to various forms of providing such an Internet telephone service.

The operation procedure of the present embodiment will be described below with a focus on the form of the Internet-only phone 110a to the Internet-only phone 160c. First, the Internet-only phone 110a transmits call information via the spam blocking device 120a and the proxy server 125a. After the control signal is transmitted and received, the call is connected, and the call information of the Internet-only phone 110a is transmitted to the proxy server 125b and the spam blocking device 120b via the IP network 130, thereby providing the Internet-only phone 160c. Is passed on. Here, the communication service provider managing the spam blocking device 120a and the proxy server 125a may be different from the communication service provider managing the spam blocking device 120b and the proxy server 125b.

For example, when using SIP, the Internet-only phone 110a, which is UAC, uses a spam blocking device 120a, a proxy server 125a, and an IP network 130 to the Internet-only phone 160c, which is a UAS to participate in a session. Then, the request is transmitted through the proxy server 125b and the spam blocking device 120b, and the Internet-only telephone 160c may connect the call by returning an appropriate response to the SIP request.

Here, the information related to the call between the calling party and the receiving party is stored as a call history record. The call history record is a detailed record of the call history. The call history records various information related to the telephone usage, such as the calling number of the Internet-only telephone 110a, the called number of the Internet-only telephone 160c, the call volume, the call duration, and the like. Can be used as data. The call history record may be recorded in any one of the proxy server 125 or a separate device (for example, a billing server) coupled thereto.

In addition, reputation information of the receiver terminals 160a to 160d with respect to each sender terminal 110a or 110b according to the present embodiment, that is, the receiver response information, may also be used to block spam. The receiver response information may also be recorded in any one of the proxy server 125 or a separate device (for example, a billing server) coupled thereto.

The spam blocker 120 extracts call history records and receiver response information of the caller terminals 110a and 110b using the Internet phone service, and uses the call pattern index to reflect call pattern information of the caller terminals 110a and 110b. After calculating the recipient response index reflecting the reputation information and the combination of individual reputation index is more than the reference value by registering the sender terminal (110a, 110b) in the spammer list, spam can be blocked. For example, when the caller terminals 110a and 110b request a call, the spam blocking device 120 determines whether the phone numbers of the caller terminals 110a and 110b are registered in the spammer list and rejects the call request if registered. can do.

That is, the spam blocker 120 analyzes call history records and receiver response information of the caller terminals 110a and 110b to determine the recipient index, the talk time index, the traffic index, the rejection index, and the call of the caller terminals 110a and 110b. The individual reputation index is calculated by combining one or more of the interval index, the origination attempt index, the blacklist index, and the reporting index. Detailed description of each index will be described later.

The spam blocking device 120 may be provided as a separate device coupled to the IP network 130. In addition, the spam blocking device 120 may block spam by registering specific sender terminals 110a and 110b in a spammer list using a comprehensive reputation index calculated by integrating individual reputation indices in the central management server 170 to be described later. Can be.

If the receiver terminal is a mobile communication terminal 160a (or a general landline telephone 160b), the call information of the calling party passes through the IP network 130 and the receiving gateway 140, and then the receiving exchange 150a / receive. The call is connected by being transmitted to the mobile communication terminal 160a (or the general fixed line telephone 160b) via the side base station 155 or the receiving side exchange 150b. In this case, since the spam blocking device 120 is coupled to the IP network 130, the procedure for calculating the individual reputation index is as described above.

The central management server 170 may perform spam blocking more efficiently by combining the individual reputation indexes calculated and managed by each service provider to calculate the comprehensive reputation index. In other words, spammers send spam to subscribers belonging to various carriers, that is, VoIP providers, and the individual reputation index that each operator can calculate is limited to the spammer information that can be obtained. it's difficult. In addition, if a large amount of spam sent by spammers is blocked at the operator's origin, spam is not spread, so it is possible to respond very efficiently, but without a policy of the central management server 170, the receiver may have to block the resource, causing resource waste. . In this case, the central management server 170 may be a server in which one country or several countries are integrated and managed. In addition, the central management server 170 transmits the spam information collected through overseas or other organizations to each communication provider (for example, spam blocking device 120), there is an advantage that can be integrated to respond to spam. .

In the above description, a configuration diagram generally illustrating a system for blocking Internet telephone service spam has been described. Hereinafter, an apparatus and method for blocking internet telephone service spam according to the present invention will be described with reference to the accompanying drawings. Shall be. An embodiment of calculating an individual reputation index will first be described, and then an embodiment of calculating the comprehensive reputation index will be described. It is obvious that the present invention is not limited to these examples.

Figure 2 is a block diagram of an Internet phone service spam blocking device according to an embodiment of the present invention. Referring to FIG. 2, a data extractor 122, an individual plate index calculator 124, a spammer list calculator 126, and a storage 128 are illustrated.

The data extraction unit 122 extracts the above-mentioned call history record and reputation information as basic data for calculating the individual reputation index. Since call history records and reputation information can be managed by various carriers in various formats, only data necessary for calculating an individual reputation index can be selected and extracted. Here, the meaning of the call history record and reputation information extraction means that the data extractor 122 requests and extracts only the data necessary for calculating the individual reputation index from each communication provider, or manages and stores call history records and reputation information for each service provider. It may include the meaning of extracting the information necessary to receive and calculate the individual reputation index according to the present embodiment.

Individual reputation index calculation unit 124 calculates the individual reputation index of the specific caller terminal (110a, 110b) from the extracted call history record and reputation information. The individual reputation index is calculated by combining the call pattern index reflecting the call pattern information of the caller terminals 110a and 110b and the receiver response index reflecting the reputation information. Here, the call pattern information is information including characteristics of the spammer, and includes caller side information, receiver side information, and time information. That is, the call pattern information includes the number of recipients of the caller terminals 110a and 110b for a predetermined time, the number of calls in which the call duration time of the caller terminals 110a and 110b is smaller than a reference value for a predetermined time, and the caller terminal (for a predetermined time). The number of calls in which the transmission traffic of 110a and 110b is greater than the reference value, the average number of rejection of the caller terminals 110a and 110b, the average call interval of the caller terminals 110a and 110b, and the average call attempts of the caller terminals 110a and 110b. Contains any one or more of numbers.

In addition, the reputation information includes any one or more of the number of times the caller terminal (110a, 110b) registered in the black list and the number of times the caller terminal (110a, 110b) is reported as a spammer.

The spammer list calculator 126 registers the caller terminals 110a and 110b in the spammer list when the calculated individual reputation index and / or the comprehensive reputation index to be described later are equal to or greater than a predetermined reference value. Here, the predetermined reference value may be determined in consideration of the average value reflecting the sender's information rather than the spammer. The spammer list may include identification information such as a spammer's subscription information, a telephone number, and the like. The spammer list may be stored in storage 128, for example, a database.

Here, the meaning that the individual reputation index and / or the comprehensive reputation index is more than a predetermined reference value means that the index is out of the reference value. Deviations from the baseline may mean that they are numerically greater, or they may include cases where the spammer's index is below the baseline. The latter case may include numerically smaller. For example, the spammer's call interval is generally smaller than the general caller's call interval, so in this case the spammer's reputation index is smaller than the predetermined reference value, and this may also be included in the case where it is above the reference value of the present invention.

3 is a block diagram of an individual plate index calculator according to an exemplary embodiment of the present invention. Referring to FIG. 3, the receiver index calculator 1241, the talk time index calculator 1242, the traffic index calculator 1243, the rejection index calculator 1244, the call interval index calculator 1245, and the call origin The trial index calculator 1246, the blacklist index calculator 1247, and the report index calculator 1248 are illustrated. Hereinafter, each index calculation unit will be described in detail.

The receiver index calculator 1241 calculates an index for the number of receiver terminals 160a to 160d to which caller terminals 110a and 110b make a call for a predetermined time. The recipient index is an index that reflects the fact that the number of callers per predetermined hour increases rapidly as the caller is a spammer, and the number of recipients is relatively high for the same number of calls.

The recipient index can be calculated using the following equation.

(1)

(One)

는 수신자 지수,

는 소정의 시간동안 발신자 단말기(110a, 110b)의 수신자 수, N은 해당 시간동안 발신자 단말기(110a, 110b)가 발신한 통화수이다. 예를 들면, 발신자가 100건의 통화를 하고, 수신자가 30명이라면, 수신자 지수는 0.3이다. here,

Is the recipient index,

Is the number of recipients of the caller terminals 110a and 110b for a predetermined time, and N is the number of calls made by the caller terminals 110a and 110b during the corresponding time. For example, if the caller makes 100 calls and there are 30 recipients, the recipient index is 0.3.

Predetermined time means a specific time range or unit time. Here, the unit time may be a unit of time determined by dividing the time into predetermined units, and may also be a time when the number N of calls made by the caller is connected or attempted.

In addition, the number of recipients of the caller terminals 110a and 110b and / or the number of calls made by the caller terminals 110a and 110b include at least one of the number of calls to which an actual call is connected and the number of call attempts to which a call is not connected. It means the number of calls to say. In the following, the number of calls and a predetermined time may be used as described above.

The talk time index calculator 1242 calculates a talk time index indicating an average talk time. The talk time index reflects the fact that the average call time is shorter as the caller is a spammer.

The talk time index may be calculated using the following equation.

(2)

(2)

는 통화시간 지수,

는 소정의 시간동안 발신자 단말기(110a, 110b)의 통화지속시간이 기준값보다 작은 통화건수, N은 해당 시간동안 발신자 단말기(110a, 110b)가 발신한 통화수이다.here,

Is the talk time index,

Is the number of calls in which the call duration time of the caller terminals 110a and 110b is smaller than the reference value for a predetermined time, and N is the number of calls made by the caller terminals 110a and 110b during the corresponding time.

Here, the reference value refers to the call duration reference value, and may be determined by referring to the average talk time of the caller rather than the spammer. For example, the reference value may be 5 seconds to 1 minute. For example, when the caller makes 100 calls, the reference value is 5 seconds, and the number of calls completed within 5 seconds is 30, the call time index is 0.3.

The traffic index calculator 1243 calculates a traffic index related to the amount of traffic required for the call of the Internet telephone. The traffic index is not a heavy traffic because the RTP packet is not transmitted during a normal call, but ARS spam reflects the fact that considerable traffic can occur even during the same time call because there is no silence. In addition, the traffic index is an index that reflects the fact that the spammer makes a large number of call attempts compared to the general caller, so that the call greatly changes the average traffic volume.

The traffic index may be calculated using the following equation.

(3)

(3)

는 트래픽 지수,

는 소정의 시간동안 발신자 단말기(110a, 110b)의 전송 트래픽이 기준값보다 큰 통화건수, N은 해당 시간동안 발신자 단말기(110a, 110b)가 발신한 통화수이다.here,

Is the traffic index,

Is the number of calls in which the transmission traffic of the caller terminals 110a and 110b is greater than the reference value for a predetermined time, and N is the number of calls made by the caller terminals 110a and 110b during the corresponding time.

Here, the reference value refers to a traffic reference value and may be determined by referring to an average traffic of a sender rather than a spammer. For example, if a particular caller makes 100 calls and the reference value is 1M, and there are 30 calls with more than 1M of the caller, the traffic index is 0.3.

The reject index calculator 1244 calculates a reject index indicating a reject rate of a particular caller. The rejection index is an index that reflects the higher rejection rate as spammers.

The rejection index may be calculated using the following equation.

(4)

(4)

는 수신거부 지수,

는 모든 발신자 단말 기(110a, 110b)의 수신거부수의 표준편차,

는 특정 발신자 단말기(110a, 110b)의 평균 수신거부수,

은 모든 발신자 단말기(110a, 110b)의 평균 수신거부수이다.here,

Is the unsubscribe index,

Is the standard deviation of the rejection count of all caller terminals 110a and 110b,

Is the average number of rejection of specific caller terminal (110a, 110b),

Is the average number of rejection of all caller terminals (110a, 110b).

는 단위 시간당 특정 발신자 단말기(110a, 110b)의 평균 수신거부수가 될 수 있다. 수신거부에 해당하는 경우는 결번인 번호를 대상으로 통화를 시도하는 경우, 수신자가 전화를 받기 전에 끊는 경우, 수신자가 차단하는 경우를 포함할 수 있다. This rejection index indicates the ratio of the number of positions compared to general statistics by normalizing the number of rejection for the specific caller terminal (110a, 110b). Each component may be calculated for the number of calls the caller terminal 110a, 110b talked for a predetermined time. here,

May be the average number of rejections of specific caller terminals 110a and 110b per unit time. The case of rejection may include a case in which a call is attempted to a missing number, a case in which the receiver hangs up before answering the call, and the receiver blocks.

The call interval index calculator 1245 calculates a call interval index indicating a time difference between each call of a specific caller. The currency interval index reflects the smaller spacing between spammers.

Currency interval index can be calculated using the following equation.

(5)

(5)

는 통화간격 지수,

는 모든 발신자 단말기(110a, 110b)의 통화간격의 표준편차,

는 특정 발신자 단말기(110a, 110b)의 평균 통화간격,

는 모든 발신자 단말기(110a, 110b)의 평균 통화간 격이다.here,

Is the currency interval index,

Is the standard deviation of the call intervals of all caller terminals 110a and 110b,

Is the average call interval of the specific caller terminal (110a, 110b),

Is the average call interval of all caller terminals (110a, 110b).

Such a call interval index represents a ratio of how much the average call interval for a particular caller terminal (110a, 110b) is compared to the general statistics. As described above, each component may be calculated for the number of calls the caller terminals 110a and 110b talked for during a predetermined time.

The outgoing attempt index calculator 1246 calculates an outgoing attempt index indicating the number of outgoing attempts during a predetermined time of a specific sender. Outgoing attempt index is an index that reflects that the number of outgoing attempts per unit time increases as spammers.

The transmission attempt index may be calculated using the following equation.

(6)

(6)

는 발신시도 지수,

는 소정의 시간동안 모든 발신자 단말기(110a, 110b)의 발신시도수의 표준편차,

는 소정의 시간동안 특정 발신자 단말기(110a, 110b)의 평균 발신시도수,

은 소정의 시간동안 모든 발신자 단말기(110a, 110b)의 평균 발신시도수이다. here,

Is the outgoing attempt index,

Is the standard deviation of the transmission attempt frequency of all caller terminals 110a and 110b for a predetermined time,

Is the average number of transmission attempts of specific caller terminals 110a and 110b for a predetermined time,

Is the average number of transmission attempts of all caller terminals 110a and 110b for a predetermined time.

Such an outgoing attempt index indicates a ratio of how much the average outgoing attempt number for a particular caller terminal 110a or 110b is in relation to general statistics.

The blacklist index calculator 1247 calculates a blacklist index indicating the number of times that specific caller terminals 110a and 110b are registered in the blacklist. The blacklist index reflects the increase in the number of blacklisted spammers. The higher the number of blacklist registrations for a particular sender, the larger the blacklist index.

The blacklist index may be calculated using the following equation.

(7)

(7)

는 블랙리스트 지수,

는 특정 발신자 단말기(110a, 110b)가 블랙리스트에 등록된 회수,

은 특정 스팸 차단 장치(120)와 결합된 특정 프록시 서버(125)에 연결되는 전체 사용자 단말기의 수이다. here,

Is the blacklist index,

The number of times a specific caller terminal (110a, 110b) is registered in the blacklist,

Is the total number of user terminals connected to a particular proxy server 125 associated with a particular spam blocker 120.

The report index calculation unit 1248 calculates a report index indicating the number of times that specific caller terminals 110a and 110b are reported as spammers. The reporting index reflects the increase in the number of spammers reported as spammers.

The report index may be calculated using the following equation.

(8)

(8)

는 신고 지수,

는 특정 발신자 단말기(110a, 110b)가 스패머로 신고된 회수이다. here,

Is the reporting index,

Is the number of times a particular caller terminal (110a, 110b) has been reported as a spammer.

The individual reputation index calculator 124 combines any one or more of the above-mentioned indices of the receiver index, the talk time index, the traffic index, the rejection index, the call interval index, and the call attempt index of the caller terminal 110a or 110b. The index can be calculated. For example, the currency pattern index may be as follows.

(9)

(9)

(Call Traffic Factors)는 통화 패턴 지수,

이다. here,

Call Traffic Factors is the currency pattern index,

to be.

In addition, the individual reputation index calculator 124 may calculate the receiver response index using the blacklist index and the report index. For example, the receiver response index may be as follows.

(10)

10

(Callee Response Factors)는 상기 수신자 반응 지수,

이다. here,

(Callee Response Factors) is the recipient response index,

to be.

In addition, the individual reputation index calculator 124 may calculate the individual reputation index by combining the currency pattern index and the receiver response index. For example, the individual reputation index may be as follows.

(11)

(11)

는 개별 평판 지수,

이다. here,

Is the individual reputation index,

to be.

This individual reputation index is sent to the central management server 170 is used to calculate the comprehensive reputation index to be described later.

Figure 4 is a block diagram of a central management server for blocking Internet phone service spam according to an embodiment of the present invention. Referring to FIG. 4, an individual reputation index receiver 172, a comprehensive reputation index calculator 174, a comprehensive reputation index transmitter 176, and a storage unit 178 are illustrated.

The individual reputation index receiver 172 receives the plurality of individual reputation indices from the plurality of spam blocking devices 120. When one communication provider has one spam blocking device 120, the individual reputation index received by each spam blocking device 120 becomes a reputation index determined by each communication provider. In addition, when one communication provider has a plurality of spam blocking devices 120, as described below, the individual reputation index received by each spam blocking device 120 becomes a reputation index determined by a part of each communication service provider.

The comprehensive reputation index calculator 174 calculates the comprehensive reputation index of the caller terminal by using the received individual reputation indexes. For example, the comprehensive reputation index may be calculated as follows.

(12)

(12)

은 종합 평판 지수,

은 i번째 통신 사업자 서버에 등록된 사용자 단말기수이다. here,

Is a comprehensive reputation index,

Is the number of user terminals registered in the i-th carrier server.

는 A지역 또는 B지역의 홈위치등록기(HLR)에 등록한 사용자 단말기수 또는 스팸 차단 장치(120)와 결합된 VoIP 프록시 서버(132)에 연결되는 사용자 단말기의 수가 될 수 있다.Each communication service provider may operate with one spam blocking device 120. In addition, according to another embodiment, each service provider operates a plurality of spam blocking devices, and the individual reputation index of each spam blocking device 120 is registered on the service provider server divided by the criteria for distinguishing the spam blocking device 120. It may correspond to the number of user terminals. For example, if a communication service provider is provided with two anti-spam devices, and each anti-spam device is installed separately in the A region and the B region,

May be the number of user terminals registered in the home location register (HLR) in the region A or the region B or the number of user terminals connected to the VoIP proxy server 132 coupled with the spam blocking device 120.

The storage unit 178 stores the calculated comprehensive reputation index, and the comprehensive reputation index transmitter 176 transmits the calculated comprehensive reputation index to a plurality of spam blocking devices 120 belonging to a plurality of communication providers. Then, each spam blocking device 120 may block spam by using the received comprehensive reputation index.

5 is a flowchart of a method for blocking Internet telephone service spam according to an embodiment of the present invention.

In step S510, the data extraction unit 122 of the spam blocking device 120 extracts the above-mentioned call history record and reputation information as basic data for calculating the individual reputation index.

In step S520, the individual reputation index calculator 124 calculates the individual reputation index of the specific caller terminal (110a, 110b) from the extracted call history record and reputation information. The individual reputation index is calculated by analyzing call history records and reputation information of specific caller terminals 110a and 110b and reflects caller pattern information and response information of the receiver.

In step S521 to step S528, the above-mentioned recipient index, talk time index, traffic index, rejection index, call interval index, call attempt index, blacklist index and report index are calculated, respectively. Each index may be calculated sequentially or simultaneously. Thereafter, the individual reputation index calculator 124 calculates individual reputation indexes of specific caller terminals 110a and 110b by combining the calculated indexes.

In operation S530, the central management server 170 receives individual reputation indices calculated from the plurality of spam blocking devices 120. In operation S540, the central management server 170 calculates the aforementioned comprehensive reputation index using the received individual reputation index.

In operation S550, the central management server 170 transmits the calculated comprehensive reputation index to the plurality of spam blocking devices 120 belonging to the plurality of service providers. According to another embodiment, the comprehensive reputation index is stored in the storage unit 178, and the data extraction unit 122 of the spam blocking device 120 may extract the comprehensive reputation index.

In operation S560, the spam blocking apparatus 120 registers the caller terminals 110a and 110b in the spammer list when the calculated individual reputation index and / or the received comprehensive reputation index are greater than or equal to a predetermined reference value. In operation S570, the spam blocking device 120 blocks spam by using a spammer list. For example, the spammer list records phone numbers of the caller terminals 110a and 110b, and the spam blocking device 120 does not connect the call or data call attempted from the caller terminals 110a and 110b to the recipient. You can block spam by doing so. To this end, the source exchanger 120a or 120b and / or the IP network 130 may block spam by using information about the spammer of the spam blocking device 120.

In addition, according to another embodiment, the phone number and reputation index (individual reputation index or composite reputation index) of the caller terminal (110a, 110b) to the receiver terminal (160a to 160d) so that the receiver can determine whether to receive can do. For example, if the sender has a reputation index above the reference value, but the recipient is a legitimate sender, the recipient may be able to block spam by providing information to determine whether or not to receive it. In addition, when the receiver receives the call, the spam blocking request signal may be transmitted by pressing a predetermined button provided in the application program of the receiver terminals 160a to 160d, and the spam blocking device 120 receives the spam blocking request signal. The call of the corresponding caller terminal (110a, 110b) may not be connected to the receiver terminal (160a to 160d).

In addition, detailed descriptions of common platform technologies such as a specific protocol for Internet telephony, embedded systems, and O / S, communication protocols, and interface standardization technologies such as I / O interfaces according to an embodiment of the present invention belong to the present invention. As it is obvious to a person of ordinary skill in the art, it will be omitted.

The spam blocking method according to the embodiment of the present invention described above may be performed after being stored in a recording medium and combined with a predetermined device, for example, a computer. Here, the recording medium may be a magnetic or optical recording medium such as a hard disk, a video tape, a CD, a VCD, a DVD, or a database of a client or server computer built offline or online.

In addition, as described above, the spam blocking device according to the present embodiment has been described an embodiment using a combination of a specific item of the information of the sender and the information of the receiver, which is in accordance with the overall policy according to the environment of the carrier, spam and And / or used in part. That is, even if one or more of the presented index is missing or another index is included, a third method for blocking spammers may be included in the scope of the present invention.

As described above, the spam blocking device according to an embodiment of the present invention described various indexes and sender terminals according to an embodiment, but the present disclosure is not necessarily limited thereto, and any one of the indexes may be calculated in different ways. Even if the sender is designated as a spammer, not the sender's terminal, if there is no difference in the overall operation and effect, such other configuration may be included in the scope of the present invention, and those skilled in the art may claim It will be understood that various modifications and changes can be made in the present invention without departing from the spirit and scope of the invention as set forth herein.

1 is a system configuration for blocking Internet phone service spam according to an embodiment of the present invention.

Figure 2 is a block diagram of an Internet phone service spam blocking device according to an embodiment of the present invention.

3 is a block diagram of an individual plate index calculation unit according to an embodiment of the present invention.

Figure 4 is a block diagram of a central management server for blocking Internet phone service spam according to an embodiment of the present invention.

5 is a flowchart of a method for blocking Internet telephone service spam according to an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

110a, 110b: caller terminal 120: spam blocker

122: data extraction unit 124: individual reputation index calculation unit

125: proxy server 126: spammer list calculation unit

128, 178: storage 130: IP network

140: receiving gateway 150a, 150b: receiving exchange

155: receiving base station 160a to 160d: receiver terminal

170: Central Management Server 172: Individual Reputation Index Receiver

174: Comprehensive reputation index calculator 176: Comprehensive reputation index transmitter

1241: recipient index calculator 1242: talk time index calculator

1243: traffic index calculation unit 1244: reception rejection index calculation unit

1245: call interval index calculation unit 1246: call attempt index calculation unit

1247: blacklist index calculator 1248: report index calculator

Claims (10)

A central management server that blocks spam for Internet telephony (VoIP) services. An individual reputation index receiver configured to receive a plurality of individual reputation indexes from a plurality of spam blocking devices, which reflect call pattern information and reputation information of the caller terminal using the Internet telephone service; A comprehensive reputation index calculator for calculating a comprehensive reputation index of the caller terminal using the received plurality of individual reputation indices; And Central management server for Internet phone service spam blocking comprising a storage unit for storing the comprehensive reputation index. The method of claim 1, The individual reputation index is calculated by combining any one or more of the index, the call time index, the traffic index, the rejection index, the call interval index, the call attempt index, the blacklist index and the report index of the caller terminal. Central management server for Internet phone service spam blocking. The method of claim 2, The receiver index, call time index, traffic index, rejection index, call interval index, outgoing attempt index is a central management server for spam blocking Internet phone service, characterized in that calculated using the following equation.

,

,

,

,

,

here,

Is the recipient index,

Is the number of recipients of the caller terminal during the predetermined time, N is the number of calls made by the caller terminal during the time,

Is the talk time index,

Is the number of calls in which the call duration of the caller terminal is smaller than a reference value for a predetermined time;

Is the traffic index,

Is a number of calls in which the transmission traffic of the caller terminal is larger than a reference value for a predetermined time;

Is the unsubscribe index,

Is the standard deviation of the rejection count of all calling terminals,

Is the average number of rejection of the caller terminal,

Is the average number of unsubscribed from all calling terminals,

Is the currency interval index,

Is the standard deviation of the call interval of all calling terminals,

Is the average call interval of the caller terminal,

Is the average call interval for all calling terminals,

Is the outgoing attempt index,

Is the standard deviation of the number of originating attempts of all calling terminals,

Is the average number of transmission attempts of the caller terminal for a predetermined time,

Is the average number of outgoing attempts of all calling terminals. The method of claim 2, The blacklist index is a central management server for Internet phone service spam blocking, characterized in that calculated using the following equation.

here,

Is the blacklist index,

The number of times the caller terminal is registered in the blacklist,

Is the total number of user terminals connected to the proxy server associated with the spam blocker. The method of claim 2, The report index is a central management server for Internet phone service spam blocking, characterized in that calculated using the following equation.

here,

Is the reporting index,

Is the number of times the caller terminal was reported as a spammer,

Is the total number of user terminals connected to the proxy server associated with the spam blocker. The method of claim 2, The individual reputation index is a central management server for Internet phone service spam blocking, characterized in that the combination of the call pattern index reflecting the call pattern information of the caller terminal and the receiver response index reflecting the reputation information of the caller terminal. The method of claim 6, The call pattern index is a central management server for Internet phone service spam blocking, characterized in that calculated using the following equation.

here,

Is the currency pattern index,

Is the recipient index,

Is the talk time index,

Is the traffic index,

Is the unsubscribe index,

Is the currency interval index,

Is the outgoing attempt index,

being. The method of claim 6, The receiver response index is a central management server for Internet phone service spam blocking, characterized in that calculated using the following equation.

here,

Is the receiver response index,

Is the blacklist index,

Is the reporting index,

being. The method of claim 6, The individual reputation index is a central management server for Internet phone service spam blocking, characterized in that calculated using the following equation.

here,

Is the individual reputation index,

Is the receiver response index,

Is the currency pattern index,

being. The method of claim 6, The comprehensive reputation index is a central management server for Internet phone service spam blocking, characterized in that calculated using the following equation.

here,

Is the comprehensive reputation index,

Is the number of user terminals registered in the i-th carrier server,

Is the individual reputation index.

Images