KR20230106985A - Apparatus and method for detecting illegal communication device - Google Patents

Abstract

Disclosed is an apparatus and method for detecting illegal communication equipment for detecting domestic and foreign illegal communication equipment used for alteration of calling numbers by collecting and analyzing VoIP packets in a domestic backbone network or international interworking section. An illegal communication equipment detection device according to an aspect includes a collection unit for collecting illegal call reporting phone numbers; a test call generating unit generating a test call packet for the reported phone number; and an IP address is extracted from a packet corresponding to the test call packet among packets collected from the Internet, and when characteristics of the packets corresponding to the extracted IP address satisfy a critical condition, the extracted IP address is converted to the IP address of the illegal communication device. It includes a detection unit that determines

Description

Apparatus and method for detecting illegal communication device}

The present invention relates to an apparatus and method for detecting illegal communication equipment, and more particularly, to an illegal communication equipment detection apparatus and method for detecting an illegal communication equipment that transmits a call by altering an origination number.

In general, VoIP (Voice over IP) service is a service using Internet protocol, and is a service that enables voice communication service provided in a circuit network such as a public switched telephone network (PSTN) to be provided in a packet network. am. As VoIP technology spreads, various illegal calls are generated. Representative illegal calls using VoIP technology are toll bypass fraud and voice phishing. Illegal bypass billing is an illegal call that causes long-distance calls via VoIP communication equipment and causes billing losses by avoiding billing. Voice phishing is an illegal call that impersonates a bank or financial institution to make financial demands.

Among them, the damage of voice phishing is increasing every year. It is evolving from a method of simply sending a VoIP call from overseas to Korea to a method of converting the calling number of a VoIP call from abroad to Korea into a domestic mobile communication number and inducing a call to be received. That is, when a call is sent to a VoIP call processing device from a VoIP terminal abroad, the VoIP call processing device transmits a SIP (Session Initiation Protocol) signal, which is a session initiation protocol, to illegal communication equipment installed in Korea, and the illegal communication equipment transmits a signal to the called terminal. By changing the calling number of the outgoing call transmitted to the domestic mobile communication number, the called party makes it look like a domestic outgoing call.

Such illegal communication equipment sends illegal voice phishing calls to many users at the same time by inserting up to dozens of USIMs in a state in which mobile communication is opened in Korea and given a domestic mobile communication number. It is not easy to arrest the members of voice phishing organizations because they have overseas call centers and install illegal communication equipment in various parts of the country to commit crimes. Therefore, it is important to find illegal communication equipment and block communication.

An object of the present invention is to provide an illegal communication equipment detection apparatus and method for detecting domestic and foreign illegal communication equipment used for alteration of calling numbers by collecting and analyzing VoIP packets in a domestic backbone network or an international interworking section.

An illegal communication equipment detection device according to an aspect includes a collection unit for collecting illegal call reporting phone numbers; a test call generating unit generating a test call packet for the reported phone number; and an IP address is extracted from a packet corresponding to the test call packet among packets collected from the Internet, and when characteristics of the packets corresponding to the extracted IP address satisfy a critical condition, the extracted IP address is converted to the IP address of the illegal communication device. It includes a detection unit that determines

The test call generation unit may set identification information for identifying a test call in the test call packet.

The test call generating unit sets available information of a Session Initiation Protocol (SIP) header to a specific pattern and specific value, or sets available information of a Session Description Protocol (SDP) attribute as the identification information. It can be set with a specific pattern and specific value, or can be set by combining available information of the SIP header and available information of the SDP attribute.

The detection unit extracts a source IP address and a destination IP address from packets that match the identification information among packets collected from the Internet and are transmitted from Korea to overseas, and when characteristics of packets collected for each IP address satisfy a critical condition , The source IP address can be determined as the IP address of domestic illegal communication equipment, and the destination IP address can be determined as the IP address of foreign illegal communication equipment.

The detection unit may apply a weight to the critical condition when the location of the destination IP address is an IP address of a preset risk area.

The apparatus for detecting illegal communication equipment may further include a determining unit that determines whether the reported phone number is a test target phone number.

The determination unit may determine the test target phone number when the reporting phone number is registered in a blacklist and the terminal type corresponding to the reporting phone number is a self-sufficient terminal.

The apparatus for detecting illegal communication equipment may further include a blocking unit for blocking packets for an IP address of the illegal communication equipment and stopping use of a communication subscription of a reporting telephone number corresponding to the IP address.

A method for detecting illegal communication equipment according to another aspect includes collecting illegal call reporting phone numbers; generating a test call packet for the reported phone number; and an IP address is extracted from a packet corresponding to the test call packet among packets collected from the Internet, and when characteristics of the packets corresponding to the extracted IP address satisfy a critical condition, the extracted IP address is converted to the IP address of the illegal communication device. It includes the step of judging by

In the generating step, identification information for identifying the test call may be set in the test call packet.

The generating step may set available information of a Session Initiation Protocol (SIP) header to a specific pattern and specific value, or set available information of a Session Description Protocol (SDP) attribute as the identification information. It can be set with a specific pattern and specific value, or can be set by combining available information of the SIP header and available information of the SDP attribute.

The determining step may include extracting a source IP address and a destination IP address from packets that match the identification information among packets collected from the Internet and are transmitted from Korea to overseas; and determining that the source IP address is the IP address of domestic illegal communication equipment and the destination IP address is the IP address of overseas illegal communication equipment, if the characteristics of the packets collected for each IP address satisfy the critical condition. can include

When the location of the destination IP address is an IP address in a preset dangerous area, a weight may be applied to the critical condition.

The method may further include determining whether the reported phone number is a test target phone number.

In the step of determining whether the phone number is the test target phone number, if the report phone number is registered in the blacklist and the terminal type corresponding to the report phone number is a self-sufficient terminal, the test subject phone number may be determined.

The method may further include blocking packets for the IP address of the illegal communication equipment and disabling the communication subscription of the reporting phone number corresponding to the IP address.

According to the present invention, by accurately detecting IP addresses of domestic and foreign illegal communication equipment using test call packets, criminal acts through domestic and foreign illegal communication equipment can be quickly blocked.

In addition, the present invention can prevent voice phishing crimes in advance by stopping the use of other phone numbers opened by the owner of domestic illegal communication equipment.

1 is a diagram illustrating a communication system including illegal communication equipment and a detection device according to an embodiment of the present invention.
2 is a diagram showing the configuration of a detection device according to an embodiment of the present invention.
3 is a flowchart illustrating a method of detecting illegal communication equipment according to an embodiment of the present invention.

Hereinafter, the embodiments disclosed in this specification will be described in detail with reference to the accompanying drawings, but the same or similar components are given the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted. The suffix "part" for components used in the following description is given or used interchangeably in consideration of ease of writing the specification, and does not itself have a meaning or role distinct from each other. In addition, in describing the embodiments disclosed in this specification, if it is determined that a detailed description of a related known technology may obscure the gist of the embodiment disclosed in this specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in this specification, the technical idea disclosed in this specification is not limited by the accompanying drawings, and all changes included in the spirit and technical scope of the present invention , it should be understood to include equivalents or substitutes.

Terms including ordinal numbers, such as first and second, may be used to describe various components, but the components are not limited by the terms. These terms are only used for the purpose of distinguishing one component from another.

Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as "comprise" or "have" are intended to designate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, but one or more other features It should be understood that the presence or addition of numbers, steps, operations, components, parts, or combinations thereof is not precluded.

In implementing the present invention, components may be subdivided for convenience of description, but these components may be implemented in one device or module, or one component may be divided into multiple devices or modules may be implemented in

1 is a diagram illustrating a communication system including illegal communication equipment and a detection device according to an embodiment of the present invention. Referring to FIG. 1, voice phishing organizations install illegal communication equipment in Korea and abroad, respectively, and generate calls from overseas to Korea through VoIP. When the overseas voice phishing calling terminal 110 generates an outgoing call through the call processing server 120, which is an illegal overseas communication device, the outgoing call passes through the Internet 130 to the illegal communication equipment 140 installed in the country. , and the domestic illegal communication equipment 140 converts the origination number of the outgoing call into a domestic mobile communication number, and then transmits it to the victim's terminal, that is, the called terminal 160 through the domestic mobile communication network 150. Therefore, the victims do not recognize the call as an overseas call, but recognize it as a normal call from Korea. The detection device 170 according to the present invention generates a test packet with a phone number suspected of voice phishing, collects and analyzes the test packet transmitted and received through the Internet 130, and uses domestic and foreign illegal communication equipment ( 120, 140) are detected.

Overseas, a calling terminal 110 and a call processing server 120 installed by criminal organizations that send illegal voice phishing calls are located. The originating terminal 110 is a terminal capable of using the VoIP service, such as a smart phone, tablet PC, or laptop computer. The outgoing terminal 110 transmits the outgoing call to the call processing server 120 according to the user's manipulation. In this embodiment, the calling terminal 110 is a communication terminal used by criminals who make illegal calls.

The call processing server 120, as an illegal overseas communication device, provides a VoIP (Voice over IP) service. The call processing server 120 is, for example, a Session Initiation Protocol (SIP) server or a PBX server. SIP is a signaling protocol defined by the IETF to control multimedia sessions such as voice and video calls. The call processing server 120 may receive a SIP INVITE packet as an outgoing call from the originating terminal 110 .

When an outgoing call is received from the outgoing terminal 110, the call processing server 120 transmits the outgoing call to the illegal communication equipment 140 installed in the country through the Internet 130. The Internet 130 may include an international interworking section, a domestic backbone network, and a domestic wired/wireless network. The call processing server 120 sets the IP address and port information of the illegal communication equipment 140 as the destination IP address and port information of the outgoing call, and also sets the originating number and the destination number in the outgoing call. Here, the destination number is the phone number of the victim located in Korea. Also, the call processing server 120 may set unique characteristic information (eg, user agent) of the call processing server 120 in an outgoing call. Extension numbers capable of mutual identification (eg, 2222, 2442, etc.) may be used between the calling terminal 110, the call processing server 120, and the illegal communication equipment 140.

The illegal communication equipment 140 is a device installed in the country by a criminal organization that sends illegal calls, and is connected to the Internet 130 and is equipped with a plurality of subscriber identification modules, that is, USIMs opened in the country, to move within the country. Sending a call through the communication network (150). That is, the illegal communication device 140 can send a call to each mobile communication number by holding as many domestic mobile communication numbers as the number of USIMs. Specifically, when an outgoing call is received from the call processing server 120 through the Internet 130, the illegal communication device 140 transforms the outgoing call into a domestic mobile communication number and then transmits the victim through the domestic mobile communication network 150. It is transmitted to the terminal of the group, that is, the called terminal 160.

The illegal communication device 140 has a plurality of domestic mobile communication numbers, and IDs can be matched, stored, and managed for each domestic mobile communication number. For example, 010-1111-1111 is stored and managed in the same way as ID 1 and 010-1111-1112 as ID 2. When a criminal organization makes an illegal call to the calling terminal 110 from abroad, it is possible to set an ID that is matched and managed for each domestic mobile communication number in the illegal communication equipment 140, not in the form of a phone number as the calling number. That is, in the outgoing call transmitted from the calling terminal 110 to the call processing server 120 and from the call processing server 120 to the illegal communication equipment 140, numbers, letters, and special An ID composed of letters and the like may be included.

The illegal communication equipment 140 has a plurality of domestic mobile communication numbers, and therefore can simultaneously process a plurality of outgoing calls with different domestic mobile communication numbers. Therefore, in a criminal organization, several members of the organization simultaneously make illegal calls to the receiving terminals 160 of several victims through one illegal communication device 140 . That is, it is common that a plurality of outgoing calls, eg, SIP INVITE packets, having the same source IP address and destination IP address and different destination numbers occur within a predetermined period of time.

Meanwhile, the illegal communication device 140 transmits a response packet to the outgoing call to the call processing server 120 through the Internet 130. Here, the response packet is, for example, a SIP Response packet, such as SIP 100 Trying, 180 Ringing, 183 Session Progress, and 200 OK. According to the SIP standard, packets subsequent to the SIP INVITE packet include the same source number, destination number, source IP address/port information, and destination IP address/port information identical to those of the SIP INVITE packet. That is, an ID composed of numbers, letters, special characters, etc., not in the format of a phone number is included as the calling number in the response packet. And, similarly to an outgoing call, a plurality of response packets having the same source IP address and destination IP address and different destination numbers are generated in a large amount of a predetermined number or more within a predetermined time.

An illegal communication equipment detection device (hereinafter, referred to as a detection device) 170 detects domestic illegal communication equipment 140 and overseas illegal communication equipment 120 . Specifically, the detection device 170 collects a report phone number from the National Police Agency, etc., compares it with a blacklist, and generates a test call to generate a test call when the report phone number is a new phone number not registered on the blacklist. Send the corresponding test call to At this time, the detection device 170 sets identification information capable of identifying the test call to the test call. The detection device 170 collects VoIP packets through a traffic collector installed in the Internet 130, filters VoIP packets matching the identification information among the collected VoIP packets, and the IP address in the filtered VoIP packets is constant. If satisfies, it can be determined as the IP address of the illegal communication equipment (120, 140). The detection device 170 will be described in detail with reference to FIG. 2 below.

2 is a diagram showing the configuration of a detection device according to an embodiment of the present invention. Referring to FIG. 2 , the detection device 170 includes a report information collection unit 171, a determination unit 172, a test call generation unit 173, a detection unit 174, and a blocking unit 175. The detection device 170 may include a memory, one or more processors (CPUs), a peripheral interface, an input/output (I/O) subsystem, a display device, an input device, and communication circuitry.

The memory may include high-speed random access memory, and may also include one or more magnetic disk storage devices, non-volatile memory such as flash memory devices, or other non-volatile semiconductor memory devices. The memory may store various types of information and program instructions, and the program is executed by a processor.

Peripheral interfaces connect I/O peripherals with the processor and memory. One or more processors execute various software programs and/or sets of instructions stored in memory to perform various functions and process data for the system.

The I/O subsystem provides an interface between peripheral interfaces and input/output peripherals such as display devices and input devices. The communication circuit performs communication through an external port or communication by an RF signal. The communication circuitry converts electrical signals to RF signals and vice versa, and communicates with the communication network, other mobile gateway devices, and communication devices via the RF signals.

The report information collection unit 171, determination unit 172, test call generation unit 173, detection unit 174, and blocking unit 175 may be implemented as programs, stored in memory, and executed by at least one processor. It can be implemented and operated as a combination of hardware and software.

The report information collection unit 171 collects phone numbers for reporting illegal calls such as voice phishing from the National Police Agency, the Financial Supervisory Service, and the like.

The determination unit 172 determines whether the collected report phone number is a test target phone number. Specifically, the determination unit 172 checks whether the collected report phone number is registered in the blacklist, and if registered in the blacklist, whether it is valid. The blacklist is a record of phone numbers used for voice phishing, and includes information such as detection date, block application, and block release status. Therefore, not all of those registered in the blacklist are subject to blocking, and unblocked phone numbers may also be registered in the blacklist. , If it is a valid phone number that is registered in the blacklist but unblocked, it can be determined as the phone number to be tested.

In one embodiment, the determination unit 172 checks the terminal information for the reporting phone number and determines the final test target phone number only when the terminal type corresponding to the reporting phone number is an open market device (OMD). can Even if the reported phone number is a new phone number that is not registered in the blacklist, if the terminal type is a private terminal, it is a terminal opened through a telecommunication company agency, so even if it is used for other purposes, it can be used as illegal communication equipment 140 described in this embodiment. Because the chances are low. The blacklist and terminal information may be stored and used in a separate storage device.

The test call generation unit 173 generates a test call to the report phone number determined by the determination unit 172 as the test target phone number. That is, the test call packet is transmitted via the Internet 130 by setting the reporting phone number as the called phone number. At this time, the test call generating unit 173 sets identification information for identifying the test call to the test call. Identification information is multiple information that combines available information (User Agent, Call-ID, etc.) of the SIP header and available information (Owner Username, Session Name emd) of SDP (Session Description Protocol) attributes. can

VoIP packet information (source IP address, SIP header information, etc.) can be changed while passing through a Session Border Controller (SBC) or SIP Gateway. If identification information is set in a single form in the test call, identification information may be changed in SBC or SIP Gatewar, etc., making identification impossible later. Even if it is, it is preferable to set the identification information in multiple forms as above, since only some information is changed and identification is possible later.

The following is an example of defining Call-ID and User Agent among SIP Header information as identification information with a specific pattern and specific value. This example makes it clear that other patterns and values, etc. may be defined as an example.

The following is an example of defining Owner Username and Session Name as specific values among SDP Attribute information as identification information. This example makes it clear that other patterns and values, etc. may be defined as an example.

The test call packet sent in this way is received by the illegal communication equipment 140, and the illegal communication equipment 140 transmits it to the call processing server 120, which is an overseas illegal communication equipment, via the Internet 130. Then, the call processing server 120 returns the call response packet to the domestic illegal communication equipment 140. In this way, according to the test call, the domestic illegal communication equipment 140 and the overseas illegal communication equipment 120 transmit and receive VoIP packets for call signaling, and in this process, the identification information set in the test call packet is included in the VoIP packet. maintain. Accordingly, a VoIP packet corresponding to a test call may be identified from packets transmitted and received through the Internet 130 .

The detection unit 174 filters VoIP packets that match the identification information set for the test call by the test call generation unit 173 among the VoIP packets collected through the traffic collector installed in the Internet 130, and filters the filtered VoIP packets. An IP address is extracted from , and when characteristics of packets corresponding to the extracted IP address satisfy a critical condition, the extracted IP address can be determined as the IP address of the illegal communication equipment (120, 140).

First, the detection unit 174 extracts a source IP address and a destination IP address from packets transmitted from domestic to overseas among the filtered VoIP packets, and classifies the VoIP packets collected by the traffic collector for each IP address. The detection unit 174 analyzes the characteristics of VoIP packets for each classified IP address to determine whether the threshold condition is satisfied, and the IP address having the characteristics of the packet that satisfies the threshold condition is assigned to the IP address of the illegal communication equipment 120 or 140. judge by address.

At this time, the detection unit 174 compares the extracted source IP address and destination IP address with a blacklist, and classifies the VoIP packets collected by the traffic collector for each IP address if it is a new IP address not registered on the blacklist. , it is possible to determine whether a critical condition is satisfied by analyzing the characteristics of VoIP packets for each classified IP address.

In one embodiment, the detection unit 174 classifies the VoIP packets collected by the traffic collector for the source IP address, and the characteristics of the corresponding VoIP packets, for example, To Number (where Number is the phone number of domestic victims) If the threshold is exceeded by analyzing the number of in/out calls in unit time, the number of in/out calls in unit time, etc., the corresponding source IP address is determined to be the IP address of the domestic illegal communication equipment (140). The domestic illegal communication equipment 140 generally sends a large number of calls to the domestic mobile communication network 150 within a short period of time and has characteristics such as sending calls only during banking hours. In addition, a large number of calls are sent to a specific called number within a short time, and accordingly, a large number of calls are canceled within a short time. In addition, since a large number of calls are generated, call time and charges exceeding the threshold may occur. Based on these characteristics, it can be determined whether the source IP address is the IP address of the domestic illegal communication equipment 140.

In one embodiment, the detection unit 174 classifies the VoIP packets collected by the traffic collector for the destination IP address, and the characteristics of the corresponding VoIP packets, for example, the number of source IP addresses, unit time in/out calls If the threshold value is exceeded by analyzing the number of in/out calls canceled per unit time, etc., the corresponding destination IP address is determined to be the IP address of the overseas illegal communication equipment 120. Overseas illegal communication equipment 120 communicates with several domestic illegal communication equipment 140 . Therefore, packets of different source IP addresses are received by the illegal communication equipment 120 on the overseas side. Also, like the domestic illegal communication equipment 140, a large number of calls may be transmitted or canceled within a short period of time. Based on these characteristics, it can be determined whether the destination IP address is the IP address of the overseas illegal communication equipment 120.

At this time, the detection unit 174 analyzes the location information of the destination IP address, and if the location of the destination IP address is an IP address in a preset risk area, a weight is applied to the critical condition to detect illegal overseas communication equipment 120. It is possible to increase the possibility of being judged as an IP address of In the above example, a different threshold may be applied by weighting the IP address of the dangerous area. For example, even if the number of in/out calls per unit time is small, if the weight of the destination IP address is high, it can be determined as the IP address of the illegal communication equipment 120 on the overseas side.

The blocking unit 175 may register the IP addresses of the domestic and foreign illegal communication devices 120 and 140 determined by the detecting unit 174 and the reporting telephone numbers corresponding to the IP addresses in the blacklist. In addition, the blocking unit 175 blocks the Internet 130 and/or the domestic mobile communication network so that packets or mobile communication calls generated from the IP addresses of the domestic and foreign illegal communication equipment 120 and 140 and the corresponding reporting phone numbers are not transmitted to domestic victims. It can be blocked by setting related information in (150). If the IP address of the illegal overseas communication equipment (120) is blocked, even if the voice phishing organization installs the new illegal communication equipment (140) in Korea, communication with the illegal overseas communication equipment (120) is impossible, so the new illegal communication equipment (140) damage can be reduced. In addition, the blocking unit 175 may stop using the mobile communication subscription for the reporting phone number, and may also stop using other phone numbers opened in the name of the reporting phone number.

3 is a flowchart illustrating a method of detecting illegal communication equipment according to an embodiment of the present invention.

Referring to FIG. 3 , in step S301, the detection device 170 collects illegal call reporting phone numbers such as voice phishing from the National Police Agency and the Financial Supervisory Service.

In step S302, the detection device 170 determines whether the collected report phone number is a test target phone number. Specifically, the detection device 170 checks whether the collected report phone number is registered in the blacklist, and if registered in the blacklist, whether it is valid. The detection device 170 may determine the phone number to be tested if the reported phone number is a new phone number not registered in the blacklist or a phone number registered in the blacklist but unblocked and valid. In one embodiment, the detection device 170 checks the terminal information for the reporting phone number, and determines the final test target phone number only when the terminal type corresponding to the reporting phone number is an open market device (OMD). can

In step S303, the detection device 170 generates a test call to the reported phone number determined as the test target phone number. That is, the detection device 170 transmits a test call packet via the Internet 130 by setting the reporting phone number as the destination phone number. At this time, the detection device 170 sets identification information capable of identifying the test call to the test call. Identification information is multiple information that combines available information (User Agent, Call-ID, etc.) of the SIP header and available information (Owner Username, Session Name emd) of SDP (Session Description Protocol) attributes. can

The test call packet sent in this way is received by the illegal communication equipment 140, and the illegal communication equipment 140 transmits it to the call processing server 120, which is an overseas illegal communication equipment, via the Internet 130. Then, the call processing server 120 returns the call response packet to the domestic illegal communication equipment 140. In this way, according to the test call, the domestic illegal communication equipment 140 and the overseas illegal communication equipment 120 transmit and receive VoIP packets for call signaling, and in this process, the identification information set in the test call packet is included in the VoIP packet. maintain. Accordingly, a VoIP packet corresponding to a test call may be identified from packets transmitted and received through the Internet 130 .

In step S304, the detection device 170 collects VoIP packets through a traffic collector installed in the Internet 130. In step S305, the detection device 170 filters VoIP packets that match the identification information set for the test call in step S303 among the collected VoIP packets.

In step S306, the detection device 170 extracts a source IP address and a destination IP address from packets transmitted from domestic to overseas among the filtered VoIP packets. In step S307, the detection device 170 classifies the VoIP packets collected by the traffic collector for each IP address.

In step S308, the detection device 170 determines whether a critical condition is satisfied by analyzing the characteristics of the VoIP packet for each classified IP address. At this time, the detection device 170 compares the extracted source IP address and destination IP address with the blacklist, and collects the VoIP packets collected by the traffic collector for each IP address only when the new IP address is not registered on the blacklist. can be classified.

In one embodiment, the detection device 170 classifies the VoIP packets collected by the traffic collector for the source IP address, and the characteristics of the corresponding VoIP packets, for example, To Number (where Number is the phone number of domestic victims) ), the number of in/out calls in unit time, and the number of cancels in/out calls in unit time, etc., to check if the threshold is exceeded.

In one embodiment, the detection device 170 classifies the VoIP packets collected by the traffic collector for the destination IP address, and the characteristics of the corresponding VoIP packets, for example, the number of source IP addresses, unit time In/out It analyzes the number of calls, the number of in/out call cancellations per unit time, etc., and checks whether it exceeds the threshold.

In one embodiment, the detection device 170 may analyze the location information of the destination IP address and apply a weight to a critical condition when the location of the destination IP address is an IP address in a dangerous area. In the above example, if the threshold for the IP address in the dangerous area is set low or an artificial intelligence model is applied, the weight itself can be used as an analysis parameter.

In step S309, the detection device 170 determines the corresponding IP address as the IP address of the illegal communication devices 120 and 140 when the characteristic of the VoIP packet for each classified IP address satisfies the critical condition. If the characteristics of the VoIP packet of the source IP address satisfy the critical condition, the corresponding source IP address is determined to be the IP address of the domestic illegal communication equipment 140, and the characteristics of the VoIP packet of the destination IP address satisfy the critical condition. In this case, the corresponding destination IP address is determined as the IP address of the overseas illegal communication equipment (120).

In step S310, the detection device 170 is connected to the Internet 130 and / or the Internet 130 and / or to prevent packets or mobile communication calls generated from the IP addresses of the domestic and foreign illegal communication devices 120 and 140 and the corresponding reporting phone numbers from being transmitted to domestic victims. It can be blocked by setting related information in the domestic mobile communication network 150 . In addition, the detection device 170 may register IP addresses of domestic and foreign illegal communication devices 120 and 140 and reporting phone numbers corresponding to the IP addresses in the blacklist. In addition, the detection device 170 may stop using the mobile communication subscription for the reporting phone number, and may also stop using other phone numbers opened in the name of the reporting phone number.

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, features described in separate embodiments in this specification may be implemented in combination in a single embodiment. Conversely, various features that are described in this specification in a single embodiment may be implemented in various embodiments individually or in combination as appropriate.

Although actions are described in a particular order in the drawings, it should not be understood that such actions are performed in the specific order as shown, or that the actions are performed in a series of sequential order, or that all described actions are performed to achieve a desired result. . Multitasking and parallel processing can be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The program components and systems described above may generally be implemented as a package in a single software product or multiple software products.

The method of the present invention as described above may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily performed by a person skilled in the art to which the present invention belongs, it will not be described in detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention to those skilled in the art in the technical field to which the present invention belongs, so It is not limited by drawings.

110: sending terminal
120: call processing server
130: Internet
140: illegal communication equipment
150: mobile communication network
160: incoming terminal
170: detection device
171: report information collection department
172: judgment unit
173: test call generating unit
174: detection unit
175: blocking part

Claims (20)

In the illegal communication equipment detection device,
a collection unit that collects illegal call reporting phone numbers;
a test call generating unit generating a test call packet for the reported phone number; and
An IP address is extracted from a packet corresponding to the test call packet among packets collected from the Internet, and if the characteristics of the packets corresponding to the extracted IP address satisfy a critical condition, the extracted IP address is converted to an IP address of an illegal communication device. Illegal communication equipment detection device including a detection unit for determining. According to claim 1,
The test call generating unit,
Illegal communication equipment detection device characterized in that for setting the identification information for identifying the test call in the test call packet. According to claim 2,
The test call generating unit,
An illegal communication equipment detection device characterized in that for setting usable information of a SIP (Session Initiation Protocol) header as the identification information to a specific pattern and specific value. According to claim 2,
The test call generating unit,
An illegal communication equipment detection device, characterized in that for setting usable information of a Session Description Protocol (SDP) attribute as the identification information to a specific pattern and specific value. According to claim 2,
The test call generating unit,
An illegal communication equipment detection device characterized in that the identification information is set by combining available information of a Session Initiation Protocol (SIP) header and available information of a Session Description Protocol (SDP) attribute. According to claim 2,
The detecting unit,
Among the packets collected from the Internet, a source IP address and a destination IP address are extracted from packets that match the identification information and are transmitted from Korea to overseas, and when the characteristics of the packets collected for each IP address satisfy a critical condition, the source IP address The illegal communication equipment detection device, characterized in that the IP address of the domestic illegal communication equipment and the destination IP address as the IP address of the overseas illegal communication equipment. According to claim 6,
The detecting unit,
When the location of the destination IP address is an IP address in a preset dangerous area, a weight is applied to the critical condition. According to claim 1,
Illegal communication equipment detection device further comprising a determination unit for determining whether the reported phone number is a test target phone number. According to claim 8,
The judge,
Illegal communication equipment detection device, characterized in that for determining the test target phone number when the report phone number is registered in the blacklist and the terminal type corresponding to the report phone number is a self-sufficient terminal. According to any one of claims 1 to 9,
Illegal communication equipment detection device further comprising a blocking unit for blocking packets for the IP address of illegal communication equipment and stopping using the communication subscription of the reporting phone number corresponding to the IP address. In the method of detecting illegal communication equipment,
Collecting illegal call reporting phone numbers;
generating a test call packet for the reported phone number; and
An IP address is extracted from a packet corresponding to the test call packet among packets collected from the Internet, and if the characteristics of the packets corresponding to the extracted IP address satisfy a critical condition, the extracted IP address is converted to an IP address of an illegal communication device. A method comprising the step of judging. According to claim 1,
The generating step is
and setting identification information capable of identifying a test call in the test call packet. According to claim 12,
The generating step is
A method characterized in that setting usable information of a Session Initiation Protocol (SIP) header as the identification information to a specific pattern and specific value. According to claim 12,
The generating step is
A method characterized in that setting usable information of a Session Description Protocol (SDP) attribute as the identification information to a specific pattern and specific value. According to claim 12,
At the time of occurrence,
As the identification information, the usable information of a Session Initiation Protocol (SIP) header and the usable information of a Session Description Protocol (SDP) attribute are combined and set. According to claim 12,
The determining step is
Extracting a source IP address and a destination IP address from packets that match the identification information among packets collected from the Internet and are transmitted from Korea to overseas; and
When characteristics of packets collected for each IP address satisfy a critical condition, determining that the source IP address is the IP address of domestic illegal communication equipment and the destination IP address is the IP address of overseas illegal communication equipment. A method characterized by doing. According to claim 16,
and applying a weight to the critical condition when the location of the destination IP address is an IP address in a preset dangerous area. According to claim 11,
The method further comprising the step of determining whether the reported phone number is a test target phone number. According to claim 18,
The step of determining whether the test target phone number is
The method characterized in that if the report phone number is registered in the blacklist and the terminal type corresponding to the report phone number is a self-sufficient terminal, the test target phone number is determined. According to any one of claims 11 to 19,
The method further comprising the step of blocking packets for the IP address of the illegal communication equipment and disabling the communication subscription of the reporting telephone number corresponding to the IP address.

Images