KR20150080302A - Method for deciding spam massage based on user`s behavior pattern - Google Patents

Abstract

The present invention relates to a method for determining a spam message based on a user behavior pattern whereby, more specifically, spam messages for advertisement and smartphone hacking by smishing, currently causing issues, are prevented. The method includes the steps of: (a) firstly determining whether a plurality of text messages are spam messages or not by matching each of the received text messages with spam determination rules which are predetermined; (b) generating a warning message for each of the text messages determined as spam messages and then simultaneously transmitting the text messages and the warning message to a plurality of receiving terminals; (c) secondly determining whether each text message, determined as a spam message, is a spam message by using a reception rate and reception time information of each text message transmitted from the receiving terminals and a reception rate and reception time information of the warning message corresponding to each text message; and (d) determining, as a final result, whether each text message is a spam message based on the second determination result. According to the present invention, accuracy for determining a spam message can be significantly increased.

Description

[0001] The present invention relates to a method for determining a spam message based on a user behavior pattern,

The present invention relates to a method for determining a spam message based on a user behavior pattern. More particularly, the present invention relates to a spam message determination method based on a user behavior pattern capable of preventing spam messages for advertising purposes and preventing smart phone hacking caused by smithing, which is a recent problem.

In the case of a text message service, which is one of various services provided to a mobile communication terminal such as a smart phone, it means a service in which a plurality of users can easily exchange a short message or a multimedia message through the mobile communication terminal.

However, spam messages exploiting such a text message service are distributed indiscriminately to an unspecified number of users, causing inconvenience or irritation to users of mobile communication terminals. In the case of such spam messages, Most of the advertisement messages were occupied.

However, as the spread of smart phones has rapidly expanded in recent years, spam messages are being developed as a means of attempting to hack smartphones using the Android operating system, an open operating system of smartphones, rather than simply advertising.

For example, in the case of smishing, which is one of the smartphone hacking methods using spam messages, a text message containing a specific URL is transmitted to an unspecified number of smartphones, and then the spam message is not recognized, The hacking program is installed on the smartphone of the user who clicked on the URL, and the hacker hacking the smartphone with the hacking program is mainly utilized.

When the smart phone is hacked by such a smearing, it is possible to abuse the smart phone by fraudulent fraud, so that a user who uses the hacked smart phone has a problem that he or she receives a large financial damage without recognizing the microblogging fraud at all.

Therefore, there is a need for a method for determining a spam message sent for the purpose of smoothing in addition to determining a spam message transmitted for a simple advertisement purpose.

Disclosure of Invention Technical Problem [8] Accordingly, the present invention has been made to solve the above-mentioned problems, and it is an object of the present invention to provide a method and apparatus for detecting a spam message by simultaneously utilizing information contained in a text message, behavior pattern information of a sender for sending a text message, The present invention also provides a method for determining a spam message based on a user behavior pattern, which can greatly improve the accuracy of spam message judgment.

According to another aspect of the present invention, there is provided a method for determining a spam message based on a user behavior pattern, the method comprising: (a) matching each of a plurality of received text messages with a predetermined spam determination rule, Determining whether the spam is spam; (b) generating a warning message for each of at least one or more text messages primarily determined as spam among the plurality of text messages, and simultaneously transmitting the at least one text message and the warning message to a plurality of receiving terminals; (c) receiving the at least one or more text messages from the at least one or more text messages and the reception rate and reception time information corresponding to the at least one or more text messages, Determining whether each of the at least one text message is spam; And (d) finally determining whether or not each of the plurality of text messages is spam according to the secondary determination result.

In the step (a), the spam judgment rule may include the number of the text message receiving number and whether the text message includes an attachment file or a URL link.

In addition, (a) may include: (a1) selecting a text message having a predetermined number or more of the number of the text message receiving numbers among the plurality of text messages; (a2) selecting a text message including an attachment file or a URL link among the text messages selected in the step (a1); And (a3) determining at least one or more text messages selected in the step (a2) as a text message matched with the spam judgment rule.

In the step (a), the spam judgment rule may be action pattern information for the sender of each of the plurality of text messages stored in advance.

In addition, in the step (b), the plurality of receiving terminals may be determined according to behavior pattern information of the recipients of each of the plurality of text messages stored in advance.

The step (c) may further comprise the steps of: (c1) if the reception ratio of at least one of the at least one text message judged as the spam is below a predetermined threshold, or if the reception rate of the warning message corresponding to the at least one text message is not less than a predetermined threshold Selecting a text message; (c2) selecting a text message having a difference value between the reception time of the text message and the reception time of the alert message, which is lower than a predetermined threshold, among the text messages selected in the step (c1); And (c3) determining that the text message selected in the step (c2) is spam.

The method may further include: (e) following the step (d), collecting sender information on a text message that is determined as spam among the plurality of text messages; And (f) analyzing the collected caller information and storing the analysis results of the caller information and the caller information.

In the step (e), the caller information may be a telephone number of the caller terminal and a log file of the caller terminal.

The step (f) may include analyzing a log file of the sender terminal to determine a message menu use period, a message send / receive period, or a large message send period in the sender terminal, and then store the message menu.

According to the present invention, it is determined whether or not a spam message is a text message by simultaneously using information contained in a text message, information on a behavior pattern of a user stored in a database in advance, and information transmitted from a receiver receiving a text message, Can be greatly improved.

In addition, since the spam message sender is continuously managed by collecting, analyzing, and storing the information of the sender determined to have transmitted the spam message, it is possible to promptly process the spam message when the same sender sends the spam message .

1 is a block diagram of a spam message determination server based on a user behavior pattern according to a preferred embodiment of the present invention;
FIG. 2 is a flowchart of a method for determining a spam message based on a user behavior pattern according to a preferred embodiment of the present invention;
3 is a detailed flowchart of S100 of FIG. 2,
4 is a detailed flowchart of S300 in Fig. 2, and Fig.
5 is a reference diagram for S300 of FIG.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same reference numerals are used to designate the same or similar components throughout the drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. Further, the preferred embodiments of the present invention will be described below, but it is needless to say that the technical idea of the present invention is not limited thereto and can be practiced by those skilled in the art.

1 is a block diagram of a spam message determination server based on a user behavior pattern according to a preferred embodiment of the present invention.

1, a user behavior pattern-based spam message determination server 1 according to a preferred embodiment of the present invention includes a message reception unit 10, a spam message determination unit 20, a message transmission unit 40, A receiving unit 40, and a user information database 50. [

The message receiver 10 receives a plurality of text messages transmitted from at least one sender terminal, and the spam message determiner 20 determines whether the received text messages are spam messages.

At this time, the spam message determination unit 20 firstly determines whether each of the plurality of text messages is spam by matching each of the received plurality of text messages with a predetermined spam judgment rule, and then determines whether the plurality of text messages are spam And transmits a text message that is not primarily determined to at least one receiving terminal through the message transmitting unit 30. [

After generating a warning message for each of at least one or more text messages determined as spam among the plurality of text messages, the at least one text message and the warning message are simultaneously transmitted to a plurality of receiving terminals, A second determination unit that determines whether the plurality of text messages are spam based on the text message and the information transmitted from the plurality of reception terminals according to the warning message, Or not.

In the case of a detailed process in which the spam message determination unit 20 determines whether or not spam is to be applied to each of the plurality of text messages by first determining and secondarily determining whether the plurality of text messages are spam, Will be described in more detail with reference to FIG.

The message transmission unit 30 transmits a text message not primarily determined as spam, a text message determined primarily as spam, and a text message determined primarily as the spam among the plurality of text messages in the spam message determination unit 20, To the plurality of receiving terminals.

The information receiving unit 40 receives information transmitted from the plurality of receiving terminals according to a text message first determined as spam sent to the plurality of receiving terminals and a warning message corresponding to a text message first determined as spam .

At this time, the information transmitted to the information receiving unit 40 includes a reception rate and reception time information of the plurality of reception terminals of each of the text messages determined as the spam, and a warning corresponding to each of the text messages primarily determined as the spam And a reception rate and reception time information of the plurality of reception terminals of the message.

In addition, the information receiver 40 can further receive the sender information of the text message finally determined as spam by the spam message determiner 20 among the plurality of text messages, and the sender information includes the telephone number of the sender terminal, It may be a log file of the terminal.

The user information database 50 may store user behavior pattern information (in other words, behavior pattern information of a sender that transmits a text message and behavior pattern information of a receiver that receives a text message) in advance, ) Of the caller.

At this time, the user behavior pattern information stored in advance in the user information database 50 can be generated from the log file information of the terminal periodically transmitted from the terminal of the caller or the receiver to the information receiver 40, The user behavior pattern information may be the SNS (Social Network Service) application use period, the message menu use period, the message sending / receiving period, or the large capacity file sending period information of the receiver terminal. According to the information, the sender's rank and the receiver's rank can be determined in advance.

In addition, the spam message determination unit 50 analyzes the sender information of the text message finally determined as the spam stored in the sender information database 50, and further stores the analysis result in the sender information database 50 For example, the spam message determination unit 20 may analyze the log file of the sender terminal that has transmitted the last determined text message as the spam, and determine a message menu use period, a message send / receive period, and a large- Etc., and classify the sender of the text message finally determined as the spam by analyzing the log file of the sender terminal as described above.

Therefore, in the present invention, a text message is transmitted from the same sender later using the sender information about the sender who has transmitted the text message finally determined as the spam stored in the sender information database 50 and the analysis result of the sender information It is possible to judge whether or not the text message is a spam message more quickly.

2 is a flowchart illustrating a method for determining a spam message based on a user behavior pattern according to a preferred embodiment of the present invention.

As shown in FIG. 2, in step S100, the spam message determination unit 20 first determines whether each of the plurality of text messages is spam by matching each of the plurality of received text messages with a predetermined spam determination rule.

At this time, the spam judgment rule in S100 may be the number of the text message receiving number of each of the plurality of text messages, and whether the text message includes an attachment file or a URL link.

The reason why the number of the text message receiving number and whether or not the text message includes the attachment file or the URL link is determined in advance by the spam judgment rule is that the number of the receiving number is often large in the case of the spam message, This is because text messages often include attachments or URL links.

In step S100, the spam judgment rule may be behavior pattern information on a sender of each of the plurality of text messages stored in advance in the user information database 50. The spam message determination unit 20 may determine a behavior pattern A text message including an attached file or a URL link having a predetermined number or more of the number of received text messages among the text messages transmitted from a sender who has not frequently transmitted a text message is referred to as a text message .

The detailed process of S100 will be described in more detail with reference to FIG.

In step S200, the spam message determination unit 20 generates a warning message for each of at least one or more text messages that are first determined to be spam among the plurality of text messages, and then transmits the at least one text message and the warning message to a message transmission unit (30) to a plurality of receiving terminals simultaneously.

At this time, in S200, the plurality of receiving terminals may be determined according to a plurality of recipient behavior pattern information previously stored in the user information database 50. In other words, the spam message determination unit 20 determines that the at least one text message is transmitted The at least one text message and the warning message can be selectively transmitted only to the receiving terminal of the receiver having a higher rank determined according to the recipient behavior pattern information stored in the user information database 50 among the plurality of receiving terminals.

Here, the reason why the at least one text message and the warning message are selectively transmitted only to the receiving terminal of the higher-ranked recipient as described above is that the higher priority is given to the higher-ranked recipient (i.e., The at least one text message, and the feedback of the at least one text message and the warning message, thereby improving the accuracy of the spam message determination.

In step S300, the spam message determination unit 20 determines the reception ratio and the reception time information of each of the at least one or more text messages received through the information receiving unit 40, the reception ratio of the warning message corresponding to each of the at least one or more text messages, Information is used to make a secondary determination as to whether or not each of at least one or more text messages primarily judged as spam is spam.

The detailed procedure of S300 will be described in detail with reference to FIG.

If the spam message deciding unit 20 finally determines in step S400 whether or not each of the plurality of spam messages is spam based on the secondary determination result, the process ends.

Here, although not shown in the figure, following step S400, the spam message determination unit 20 collects sender information on a text message that is finally determined as spam among the plurality of text messages, analyzes the collected sender information, And storing the caller information and the caller information analysis result in the caller information database 50. [

The caller information may be a telephone number of the caller terminal and a log file of the caller terminal. Analysis of the caller information may include analyzing the log file of the caller terminal to determine a message menu use period, The period, and the transmission period of a large-capacity message.

3 is a detailed flowchart of S100 of FIG. 3, in step S110, the spam message determination unit 20 selects a text message having a predetermined number or more of the number of received text message among the plurality of text messages.

In step S130, the spam message determination unit 20 selects a text message including an attachment file or a URL link among the text messages selected in step S110, and transmits the text message including at least one text message selected in step S130 to the text message The process is terminated and S200 is performed.

FIG. 4 is a detailed flowchart of S300 of FIG. 2, and FIG. 5 is a reference diagram of S300 of FIG.

As shown in FIG. 4, in step S310, the spam message determination unit 20 determines whether or not the reception ratio of at least one of the at least one text messages determined as primary spam is below a predetermined threshold, And selects a text message that is greater than or equal to the predetermined threshold.

In this case, the reason why the spam message determination unit 20 selects a text message whose reception rate of the text message is lower than or equal to a predetermined threshold or a text message whose reception ratio of the warning message is lower than or equal to a predetermined threshold, The probability of deleting the spam message is high, and if not, the probability of confirming and deleting the spam message after confirming the warning message is high.

In step S330, the spam message determination unit 20 selects a text message whose difference value between the reception time of the text message and the reception time of the warning message is less than or equal to a predetermined threshold, among the text messages selected in step S310.

At this time, the reason why the spam message determination unit 20 selects a text message whose difference value between the reception time of the text message and the reception time of the warning message is less than or equal to the predetermined threshold value at step S330 is that the receiver receives the warning message The probability of confirming the text message immediately after confirmation and processing (i.e., deleting or saving) the text message is high.

In step S330, the spam message determination unit 20 checks the content of the response message for the warning message transmitted from the recipient terminal by link selection included in the warning message shown in FIG. 5, It is also possible to select a text message whose selection ratio of the deletion processing item is equal to or larger than the predetermined threshold value.

 If the spam message determination unit 20 determines in step S350 that the selected text message is spam, the process is terminated and step S400 may be performed.

The present invention relates to a method and apparatus for managing information on a plurality of text messages transmitted from at least one sender terminal, that is, information including a number of a text message receiving number and whether an attached file or a URL link is included, The information on the behavior pattern information of the user (that is, the sender and the receiver) previously stored in the information database 50 and the information transmitted from the receiver receiving the text message (in other words, the reception rate and reception time information of the text message, And receiving time information), it is determined whether or not a spam message is included in each of a plurality of text messages, thereby greatly improving the accuracy of spam message determination.

In addition, the information of the sender of the text message finally determined as the spam message is collected, analyzed, and stored, and the spam message sender is continuously managed, so that the spam message transmitted from the same spam message sender can be processed more quickly.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments described in the present invention are intended to illustrate rather than limit the technical spirit of the present invention, and the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents thereof should be construed as being included in the scope of the present invention.

(1): a spam message judgment server based on a user behavior pattern
(10): message receiving unit (20): spam message judging unit
(30): message transmission unit (40): information reception unit
(50): a user information database

Claims (9)

(a) matching each of a plurality of received text messages with a predetermined spam determination rule to firstly determine whether or not each of the plurality of text messages is spam;
(b) generating a warning message for each of at least one or more text messages primarily determined as spam among the plurality of text messages, and simultaneously transmitting the at least one text message and the warning message to a plurality of receiving terminals;
(c) receiving the at least one or more text messages from the at least one or more text messages and the reception rate and reception time information corresponding to the at least one or more text messages, Determining whether each of the at least one text message is spam; And
and (d) finally determining whether or not each of the plurality of text messages is spam according to the result of the secondary determination. The method according to claim 1,
In the step (a)
Wherein the spam judgment rule includes whether the number of the text message receiving number and whether the text message includes an attached file or a URL link. 3. The method of claim 2,
The step (a)
(a1) selecting a text message having a predetermined number or more of the number of received text message among the plurality of text messages;
(a2) selecting a text message including an attachment file or a URL link among the text messages selected in the step (a1); And
(a3) determining at least one or more text messages selected in the step (a2) as a text message matched with the spam judgment rule. The method according to claim 1,
In the step (a)
Wherein the spam judgment rule is behavior pattern information for a sender of each of the plurality of text messages stored in advance. The method according to claim 1,
In the step (b)
Wherein the plurality of receiving terminals are determined according to behavior pattern information of a recipient of each of the plurality of text messages stored in advance. The method according to claim 1,
The step (c)
(c1) selecting a text message having a reception ratio less than or equal to a predetermined threshold value of at least one of the at least one text message judged as the spam, or a reception rate of the warning message corresponding to the at least one text message being equal to or greater than a predetermined threshold;
(c2) selecting a text message having a difference value between the reception time of the text message and the reception time of the alert message, which is lower than a predetermined threshold, among the text messages selected in the step (c1); And
(c3) determining that the text message selected in the step (c2) is spam; and determining the spam message based on the user behavior pattern. The method according to claim 1,
Following step (d) above,
(e) collecting sender information on a text message which is determined as spam among the plurality of text messages; And
(f) analyzing the collected sender information and storing the analysis results of the sender information and the sender information. 8. The method of claim 7,
In the step (e)
Wherein the sender information is a telephone number of the sender terminal and a log file of the sender terminal. 9. The method of claim 8,
The step (f)
Analyzing a log file of the sender terminal and determining a message menu use period, a message sending / receiving period, or a large message sending period in the sender terminal, and storing the determined message menu period.

Images