KR20220021584A - System for Detecting Voice Phishing and Caller's location - Google Patents

Abstract

Disclosed is a voice phishing and caller location detection system. According to the present invention, a voice phishing and caller location detection system includes: an abnormal symptom determination unit (100) for determining an abnormal symptom of identification information data of a communication terminal (10); and a location detection unit (200) for detecting a location of the communication terminal (10). In addition, the present invention detects a voice phishing caller's call terminal which performs voice phishing based on identification information and call time of the call terminal, and tracks communication wave between the voice phishing caller's terminal and the base station to detect the location of the voice phishing caller terminal.

Description

System for Detecting Voice Phishing and Caller's location

The present invention relates to a voice phishing and caller location detection system, and more particularly, a voice phishing and caller location detection system that detects a voice phishing caller terminal that performs voice phishing in a call history and detects the location of the voice phishing caller terminal is about

Recently, in Korea, cases of illegal or illegal use of mobile network terminals covering 2G, 3G, 4G, and 5G are increasing. Examples of this are largely as follows.

(1) For terminal communication, a USIM used for subscriber authentication is illegally issued and installed on a remote terminal, and then used for voice phishing or text message phishing transmission.

(2) A method of smuggling high-priced mobile phones abroad after using expensive mobile phones for illegal borrowing after opening, copying and falsifying terminal information such as IMEI of low-priced second-hand mobile phones.

(3) Using up to the maximum number of voice calls and text messages allowed by the unlimited voice/text plan for individual or corporate customers to use illegally for the purpose of sending advertisements and spam text messages that are not permitted in the Terms of Use.

In order to prevent the above illegal/illicit use, in the past, the white list system was used to block access to the network of unregistered terminals. We are implementing a personal blacklist system.

Due to the implementation of the blacklist system, users can directly purchase or select devices that are not dependent on a telecommunication company to broaden their options. There is a risk that various social problems will spread widely as unobtained smuggled terminals are distributed in the market, and these distributed terminals are combined with an illegally issued USIM and used for crimes or illegal use.

In particular, indiscriminately without even checking the check digit used in the last digit of the 15 digits in IMEI (International Mobile Equipment Identity, hereinafter referred to as 'IMEI'), which is a unique number assigned to a terminal or modem at this time. By allowing network access, it is possible to achieve the same effect as changing a USIM (Universal Subscriber Identity Module, hereinafter referred to as 'USIM') device using the altered IMEI, and through this, it is difficult to even track lost or stolen devices.

Nevertheless, in most countries around the world, IMEI falsification is illegal or prohibited by international regulations that are equivalent to illegal, and it can be easily inferred that the act of providing or aiding the IMEI tampering method is also not in the public interest. there is.

The present invention provides a solution for detecting and tracking a communication terminal of a user who engages in voice phishing using such illegal activity.

Korean Patent Registration No. 10-1295442 Korean Patent Publication No. 10-2010-0136709

https://en.wikipedia.org/wiki/Metadata https://en.wikipedia.org/wiki/Software-defined_radio https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity

The present invention detects a voice phishing caller's call terminal performing voice phishing based on identification information and call time of the call terminal, and tracks the communication wave between the voice phishing caller terminal and the base station to provide a system for detecting the location of the voice phishing caller terminal will do

In order to solve the above problems, in the voice phishing and caller location detection system according to an embodiment of the present invention, an abnormal symptom determination unit 100 for determining an abnormal symptom of the identification information data of the communication terminal 10; and a location detection unit 200 for detecting the location of the communication terminal 10 .

At this time, the abnormal symptom determination unit 100, the information collection unit 110 for collecting identification information of the communication terminal; a conversion unit 120 for converting the identification information collected by the information collection unit 100 into meta data; a storage unit 130 for storing the meta data; a detection unit 140 that analyzes the metadata and detects the metadata based on the time of the metadata; and a determination unit 150 for discriminating an abnormal symptom from the metadata detected by the detection unit 140 .

In this case, the detection unit 140 detects the meta data having the shortest or longest time interval of the meta data.

In this case, the determination unit 150 determines an abnormality in the metadata based on a specific erasure or weighting condition for the temporal pattern of the metadata detected by the detection unit 140 .

At this time, the location detection unit 200, the remote detection unit 210 for detecting the location of the communication terminal 10 when the distance from the communication terminal 10 or more; and a short-distance detection unit 220 for detecting the location of the communication terminal 10 when it is less than a specific distance from the communication terminal 10 .

In this case, the remote detection unit 210 detects the location of the communication terminal 10 up to the specific distance when the communication terminal 10 performs signal processing communication with the base station 20 .

In this case, the short-distance detection unit 220 detects the location of the communication terminal 10 when the communication terminal 10 performs information communication with the base station 20 .

At this time, the location detection unit 200, the communication method change unit 230 instructs to change the communication method of the communication terminal 10; further includes.

According to an embodiment of the present invention, it is possible to detect a voice phishing caller's call terminal and find a voice phishing event even if there is no report, and by detecting the location of the voice phishing caller's terminal, the terminal used for the arrest of the voice phishing caller and voice phishing has the effect of facilitating the seizure of

1 is an exemplary diagram for explaining a voice phishing and caller location detection system according to an embodiment of the present invention.
2 is a block diagram for explaining the abnormal symptom determination unit 100 of the voice phishing and caller location detection system according to an embodiment of the present invention.
3 is a block diagram illustrating the location detection unit 200 of the voice phishing and caller location detection system according to an embodiment of the present invention.
4 is a block diagram for explaining the communication method change unit 230 of the voice phishing and caller location detection system according to an embodiment of the present invention.

Hereinafter, detailed contents for carrying out the present invention will be described based on the embodiments with reference to the drawings. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that various embodiments of the present invention are different but need not be mutually exclusive. For example, certain shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in relation to one embodiment. In addition, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description set forth below is not intended to be taken in a limiting sense, and the scope of the present invention, if properly described, is limited only by the appended claims, along with all scope equivalent to that claimed by the claims. Like reference numerals in the drawings refer to the same or similar functions throughout the various aspects.

Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used with the meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless specifically defined explicitly.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to enable those of ordinary skill in the art to easily practice the present invention.

1 is an exemplary diagram for explaining a voice phishing and caller location detection system according to an embodiment of the present invention.

As shown in FIG. 1, the voice phishing and caller location detection system of the present invention includes an abnormal symptom determination unit 100 that determines an abnormal symptom of the identification information data of the communication terminal 10 and the communication terminal 10 It consists of a position detection unit 200 for detecting a position.

In addition, the communication terminal 10 means a mobile communication terminal such as a mobile phone, a smart phone, a SIM box.

In addition, the identification information means information for identifying the communication terminal and the communication company, and has different identification information for each communication terminal.

In addition, the identification information is specifically IMEI (International Mobile Equipment Identity, hereinafter referred to as 'IMEI'), IMEISV (International Mobile Station Equipment Identity Software Version, hereinafter referred to as 'IMEISV'), IMSI (International mobile subscriber identity, hereinafter) 'IMSI') and TMSI (Temporary Mobile Subscriber Identity).

In addition, the position detection unit 200 is a device having a built-in multiple reception module and multiple antennas based on software defined radio (SDR) technology, and the technology for detecting the position is direction detection according to a phase change, beamforming, and radar. It may include distance detection using technology, and more accurate detection is possible using information of specific terminals and users such as frequency, IMSI, and IMEI.

2 is a block diagram for explaining the abnormal symptom determination unit 100 of the voice phishing and caller location detection system according to an embodiment of the present invention.

At this time, as shown in FIG. 2 , the abnormal symptom determination unit 100 uses the information collection unit 110 for collecting identification information of the communication terminal and the identification information collected by the information collection unit 100 as metadata. A conversion unit 120 that converts the metadata into ) consists of a discriminating unit 150 that discriminates anomalies from the detected meta data.

In addition, the information collection unit 110 also collects time (talk time) when collecting the identification information of the communication terminal 10 .

In addition, the metadata is data converted so that personal information cannot be extracted from the identification information in order to protect personal information since the identification information corresponds to personal information. The metadata should include the following types of information (below (A) to (J)).

(A) Metadata and timestamp indicating information about when the IMEI and combination are changed based on a specific IMSI

(B) Metadata and timestamp indicating information about when the combination with IMEISV is changed based on a specific IMSI

(C) Metadata and timestamp indicating information about the case in which the IMEISV of (B) is an unknown equipment state (a state in which suitability of the IMEISV cannot be determined, hereinafter referred to as an 'unknown equipment state')

(D) Metadata and timestamp indicating information about when the IMEI and combination are changed based on a specific TMSI

(E) Metadata and timestamp indicating information about when the combination with IMEISV is changed based on a specific TMSI

(F) Metadata and timestamp indicating information about the case where the IMEISV of (E) is in an unknown equipment state

(G) Metadata and timestamp indicating information about when the IMSI and combination are changed based on a specific IMEI

(H) Metadata and timestamp indicating information about when the TMSI and combination are changed based on a specific IMEI

(I) Metadata and timestamp indicating information about when the IMSI and combination are changed based on a specific IMEISV

(J) Metadata and timestamp indicating information about when the TMSI and combination are changed based on a specific IMEISV

In addition, the time (call time) of the metadata used by the detection unit 140 corresponds to a timestamp among information included in the metadata.

Also, at this time, the detection unit 140 detects the meta data having the shortest or longest time interval of the meta data.

In addition, the reason why the detection unit 140 detects the metadata based on the time interval of the metadata is,

(1) If the other party recognizes voice phishing, the time interval will be short by hanging up the phone, and the possibility of voice phishing damage is low;

(2) If the other party does not recognize the voice phishing, the time interval will be long by continuing the call, and there is a high possibility of voice phishing damage;

(3) If the other party does not recognize the voice phishing and continues to call, the time interval is long and the possibility of voice phishing damage is very high if the call is made multiple times.

Also, at this time, the determining unit 150 determines the abnormality in the metadata based on a specific erasure or weighting condition for the temporal pattern of the metadata detected by the detection unit 140 .

In addition, the condition of the determination unit 150 is,

(1) If the time pattern is short, there is a high probability that the other party has recognized voice phishing, and the possibility of voice phishing damage is low, which may be a condition for erasure;

(2) If there is only a long time pattern, there is a possibility that it is a general call rather than voice phishing, so it may be an erasure condition or a low weight condition,

(3) If the time pattern is a mixture of git and short, it is possible that a short call that the other party recognized as voice phishing and a long call that the called party did not recognize as voice phishing may be a weighting condition. can,

(4) If the time pattern is mixed with the short ones and the long ones are mixed and there is a record of talking to each other, the possibility of voice phishing damage is very high, so it may be a high weight condition.

In addition, the determination unit 150 continuously learns (deep learning or decision tree or learning based on it) based on the conditions specified above, so that a more detailed and precise erasure or weighting condition based on the time pattern is obtained. updated.

3 is a block diagram for explaining the location detection unit 200 of the voice phishing and caller location detection system according to an embodiment of the present invention.

At this time, as shown in FIG. 3 , the location detection unit 200 includes a remote detection unit 210 that detects the location of the communication terminal 10 when it is separated from the communication terminal 10 by a specific distance or more. It consists of a short-distance detection unit 220 that detects the location of the communication terminal 10 when it is less than a specific distance from the communication terminal 10 .

In addition, at this time, the remote detection unit 210, when the communication terminal 10 and the base station 20 and the signal processing (Signaling Process) communication, detects the location of the communication terminal 10 up to the specific distance.

In addition, the remote detection unit 210 includes a remote detection antenna for wireless communication with the communication terminal (10).

In addition, the signal processing communication means a signaling process, which means a signal processing that the communication terminal 10 periodically or continuously connects to to communicate with the base station 20 . For example, in the case of domestic FDD-LTE communication, a signaling process, which is a signal processing in which the communication terminal 10 and the base station 20 are connected continuously or periodically, is performed in a frequency division method.

Also, at this time, the short-distance detection unit 220 detects the location of the communication terminal 10 when the communication terminal 10 performs information communication with the base station 20 .

In addition, the short-distance detection unit 220 includes a short-distance detection antenna for wireless communication with the communication terminal 10, and the short-distance detection antenna 221 is a directional antenna.

In addition, in the information communication, after the communication terminal 10 and the base station 20 complete the signal processing already connected, the communication terminal 10 performs information communication such as voice, text, or data. 20) to communicate with For example, in the case of domestic 3G communication, the communication terminal 10 may perform information communication such as voice, text, or data after processing a signal to access the base station 20 .

4 is a block diagram for explaining the communication method change unit 230 of the voice phishing and caller location detection system according to an embodiment of the present invention.

At this time, as shown in FIG. 4 , the location detection unit 200 further includes a communication method change unit 230 for instructing to change the communication method of the communication terminal 10 .

In addition, the communication method change unit 230 instructs the communication terminal 10 to change the method in which the communication terminal 10 currently communicates with the base station 20 by radio. For example, when the communication terminal 10 is performing wireless communication with the base station 20 in the LTE method, the communication terminal 10 may be instructed to wirelessly communicate with the base station 20 in the 3G method. Also, for example, when the communication terminal 10 is performing wireless communication with the base station 20 in the LTE method, after detecting the location of the communication terminal 10 up to a specific distance through the remote detection unit 210 The wireless communication method of the communication terminal 10 is changed to 3G through the communication method changing unit 230, and the communication terminal 10 is transferred to the base station 20 and 3G through the short-distance detection unit 220. In the case of information communication, the location of the communication terminal 10 may be detected.

Finally, since the present invention can apply various transformations and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the specific embodiments of the present invention, and it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention. In describing the present invention, if it is determined that a detailed description of a related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

Terms such as first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another.

Terms used in the present invention are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

The spatially relative terms below (below, beneath, lower), above (above, upper), etc. facilitate the correlation between one element or components and other elements or components, as shown in the drawings. can be used to describe The spatially relative terms should be understood as terms including different orientations of the device during use or operation in addition to the orientation shown in the drawings. For example, when an element shown in the drawings is turned over, an element described as below (below, beneath) another element may be placed above and above the other element. Accordingly, the example term below may include both downward and upward directions. The device may also be oriented in other orientations, and thus spatially relative terms may be interpreted according to orientation.

As used in the present invention, an expression indicating a part such as "part" or "part" means a device in which the component may include a specific function, software that may include a specific function, or a device that may include the corresponding function. And it means that it can represent a combination of software, but it is not necessarily limited to the expressed function, which is provided to help a more general understanding of the present invention, and a person having ordinary knowledge in the field to which the present invention belongs If it is, various modifications and variations are possible from these base materials.

The invention has been described above for the purpose of method steps presenting the performance of specific functions and their relationships. The boundaries and order of these functional components and method steps have been arbitrarily defined herein for convenience of description. Alternative boundaries and orders may be defined so long as the specific functions and relationships are properly performed. Any such alternative boundaries and orders are therefore within the scope and spirit of the claimed invention. In addition, the boundaries of these functional components have been arbitrarily defined for convenience of description. Alternative boundaries can be defined as long as any important functions are properly performed. Likewise, flowchart blocks may also be arbitrarily defined herein to represent any significant functionality. For extended use, the flowchart block boundaries and order may have been defined and still perform some important function. Alternative definitions of both functional components and flowchart blocks and sequences are therefore within the scope and spirit of the claimed invention.

The invention may also have been described, at least in part, in terms of one or more embodiments. Embodiments of the present invention are used herein to represent the present invention, aspects thereof, features thereof, concepts thereof, and/or examples thereof. A physical embodiment of an apparatus, article of manufacture, machine, and/or process embodying the present invention may employ one or more aspects, features, concepts, examples, etc. described with reference to one or more embodiments described herein. may include Moreover, throughout the drawings, embodiments may incorporate the same or similarly named functions, steps, modules, etc., which may use the same or different reference numbers, as such, the functions, The steps, modules, etc. may be the same or similar functions, steps, modules, etc. or others.

As described above, in the present invention, specific matters such as specific components, etc., and limited embodiments and drawings have been described, but these are provided to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , various modifications and variations are possible from these descriptions by those of ordinary skill in the art to which the present invention pertains.

The above-described embodiments are examples for explaining the present invention, and the present invention is not limited thereto. Those of ordinary skill in the art to which the present invention pertains will be able to practice the present invention with various modifications therefrom, so the technical protection scope of the present invention should be defined by the appended claims.

10: communication terminal
20: base station
100: abnormal symptom determination unit
110: information collection unit
120: conversion unit
130: storage
140: detection unit
150: determination unit
200: location detection unit
210: remote detection unit
220: short-distance detection unit
230: communication method change unit

Claims (8)

In the voice phishing and caller location detection system,
an abnormal symptom determination unit 100 for determining an abnormal symptom of the identification information data of the communication terminal 10; and
a location detection unit 200 for detecting the location of the communication terminal 10;
Voice phishing and caller location detection system comprising a According to claim 1,
The abnormal symptom determination unit 100,
Information collection unit 110 for collecting identification information of the communication terminal;
a conversion unit 120 for converting the identification information collected by the information collection unit 100 into meta data;
a storage unit 130 for storing the meta data;
a detection unit 140 that analyzes the metadata and detects the metadata based on the time of the metadata; and
a determination unit 150 for discriminating an abnormal symptom from the metadata detected by the detection unit 140;
Voice phishing and caller location detection system comprising a 3. The method of claim 2,
The detection unit 140,
Voice phishing and caller location detection system, characterized in that the metadata is detected with the shortest or longest time interval 3. The method of claim 2,
The determination unit 150,
Voice phishing and caller location detection system, characterized in that the detection unit 140 determines an anomaly in the metadata based on a specific erasure or weighting condition for a temporal pattern of the metadata. According to claim 1,
The location detection unit 200,
a remote detection unit 210 for detecting the location of the communication terminal 10 when it is more than a certain distance away from the communication terminal 10; and
a short-distance detection unit 220 for detecting the location of the communication terminal 10 when it is less than a specific distance from the communication terminal 10;
Voice phishing and caller location detection system comprising a 6. The method of claim 5,
The remote detection unit 210,
Voice phishing and caller location detection system, characterized in that the communication terminal 10 detects the location of the communication terminal 10 up to the specific distance when the communication terminal 10 and the base station 20 and the signal processing (Signaling Process) communication 6. The method of claim 5,
The short-distance detection unit 220,
Voice phishing and caller location detection system, characterized in that the communication terminal (10) detects the location of the communication terminal (10) when performing information communication with the base station (20) 6. The method of claim 5,
a communication method change unit 230 for instructing to change the communication method of the communication terminal 10;
Voice phishing and caller location detection system further comprising a

Images