TW201332314A - Instant messaging fraud alarm system and alarm message delivery method - Google Patents

Abstract

This invention concerns an instant messaging fraud alarm system and alarm message delivery method that mainly provide a robotic system as the contact person added by instant messaging users so as to receive messages sent from instant messaging users. When the account of instant communication is stolen and sends malicious links to every contact person, the robotic system retrieves and analyzes the message, and an early warning message, based upon the analysis result, then is sent to the instant messaging user to remind the user to change passwords so as to intercept the stolen account.

Description

Instant messaging fraud warning system and early warning message delivery method

The invention relates to an instant messaging fraud warning system and a method for dispatching an early warning message, in particular to a related technology capable of generating an early warning message in advance of an instant messaging account but without changing the password to remind the instant message to save the stolen account in time.

The so-called "instant messaging" refers to a real-time communication system that allows two or more people to use the Internet to instantly transmit text messages, files, voice and video communication. Famous instant messaging tools such as Microsoft Windows Live Messenger (hereinafter referred to as For MSN) and Yahoo! Messenger of Yahoo! (hereinafter referred to as "Instant Messenger"), these instant messaging tools enable instant communication and sharing between contacts. According to Wikipedia's 2009 statistics, Microsoft's MSN users have about 330 million users, and there are millions of users in Taiwan. Due to the large number of users and frequent use, they have finally become the target of fraud groups.

The so-called instant messaging fraud is generally obtained by the Trojan horse program user password, and also uses the phishing website to automatically collect the user's login information, and then fake the user's name to log in to the instant messaging and then scam the user's contact person. The common scam is required. The contact person buys game points. If the contact person does not suspect him, he will be deceived and cause losses. In addition, the fraud group will send a malicious link. Once the contact clicks on the link, it will become the victim of the next stolen account. . The above-mentioned fraudulent practices are very common and serious. The severity has allowed the industry to publish information and inform users of how the account has been stolen. However, the handling of the account is very complicated. The famous MSN informs the user of the processing method: "

1. Immediately report to the local police station and obtain the report triple list. At the same time, ask the police to log in to the MSN account suspension application form in the police internal system, and ask the police to print the application and fax it to 165 for processing.

2. After transmitting the notice to Microsoft in 165, we will try our best to freeze the stolen account within 24 hours.

3. If you want to retrieve your account, please visit here and follow the instructions to fill out the form to retrieve your account. "

It can be seen from the above information that the official version of the MSN account after being stolen is no different from the general criminal burglary. You must first report the case to obtain the triple order, and ask the police unit to log in to the application for suspension of the right, and must print it out and fax it to the fraud line. After that, the stolen account will be frozen. If you want to get an account, you must fill out the form and follow another procedure to apply for the account. The complexity of the program is astounding. It can be seen that once the MSN account is stolen, it will cause confusion for users. Therefore, the related technologies for preventing the misappropriation of instant messaging accounts are extremely needed by the operators and users. Before discussing how to prevent the misappropriation of instant messaging, you must first understand the methods and behaviors of fraudulent groups to steal accounts. You can find a solution from it: as mentioned earlier, most fraudulent groups use Trojans or phishing websites to steal them. The password of the instant messaging account, that is, the operation of stealing the account password is performed by the computer. After the fraud group obtains the account password by the computer, the password will not be changed in the first time because the password is changed manually, but the computer is used. The number of passwords obtained is very large. Therefore, after obtaining the account for a period of time, it is possible to manually change the password of the stolen account. However, before this, the fraud group will still fully use the obtained account password to automatically log in to the stolen account by the computer. Send a message or maliciously link to the contact person of the account to implant a Trojan horse or seduce a phishing website, and then steal more account passwords. The behavior of this method is to log in and send a malicious link and then go offline. In addition to simply sending a link, the scam computer will send general interactive texts in sequence before sending malicious links, such as the commonly used greetings "Hi", "Hello", "An", etc., and then there will be some basic Communicate to reduce the contact's mental defense, and then send a malicious link to entice the contact to click. After the above-mentioned computerized operation, in the case of human license, the password is manually changed, and the real person interacts with the contact person of the stolen account.

It can be seen from the above that before the fraud group changes the password of the stolen account, there will be a process of computer automatic operation. If the user can know the status of the theft in advance in the foregoing process, the password can be actively changed in time to effectively prevent the instant message. The account is a fraudulent tool and avoids the trouble of stealing the account itself.

Therefore, the main purpose of the present invention is to provide an instant messaging fraud warning system, which is mainly a robot system that can be joined as a contact by an instant messaging user, which can determine whether a user has a specific behavior characteristic, and once the above situation occurs, the instant messaging will occur. The user is notified to enable the user to change the password before the account is replaced, so as to effectively save the stolen account.

The main technical means adopted to achieve the foregoing objectives is that the aforementioned instant messaging fraud warning system includes: a contact person joining the module, mainly using one main account for more than one instant messaging user to join as a contact; a behavioral feature analysis module For analyzing the behavior characteristics of the instant messaging user interacting with the contact person, the behavior characteristic includes the text content, the dialogue and/or the online and offline status in the message, to determine whether the instant messaging user's account has been stolen, and An early warning message is generated when it is judged that there is a misappropriation; a message dispatching module is used to send an alert message generated by the behavioral feature analysis module to an instant messaging user suspected of being stolen.

Since the above-mentioned instant messaging fraud warning system is a robot system, it can be added as a contact person for the instant messaging user, and thus can receive the message sent by the instant messaging user; when the instant messaging user's account is stolen, the fraudulent computer logs into the stolen account, and When a specific behavioral feature occurs, such as sending a malicious link to the contact person of the account and/or an abnormal login status (such as sending a link after login, then offline), the instant messaging fraud warning system of the present invention is also a contact person. First, the above message will also be received. When the behavioral feature analysis module analyzes that the content of the sent message contains a malicious link, the message dispatching module transmits an alert message to the instant messaging user, because the fraudulent computer is still in the process of automatic operation. The password of the stolen account has not been changed, so the instant messaging user can still log in using the original account password. After receiving the alert message after logging in, the user can actively change the password and save the stolen account in time.

Another object of the present invention is to provide a method for dispatching an instant messaging fraud alert message, which can issue an early warning message to an instant messaging user of a stolen account in the early stage of instant messaging misappropriation, so as to timely rescue the stolen account.

The main technical means to achieve the above objectives is to accept the message sent by the instant messaging user after receiving more than one instant messaging user as the contact person; analyze whether the above message contains the link and/or the instant messaging user. Line status; when the analysis result of the message is abnormal, an early warning message is sent to the instant messaging user; the above method is mainly for the instant messaging user to be added as a contact, in order to receive the message sent by the instant messaging user, once the instant messaging user's account is stolen And when the contact person of the account sends a malicious link and/or an abnormal online and offline state, the present invention can receive the foregoing message and analyze it, and once it is analyzed that the sending message is abnormal, the suspected stolen account is The instant messaging user sends an alert message to remind him to change the password in time and intercept the retrieved stolen account.

The instant messaging fraud warning system of the present invention is a robot system, and the robot system provides an instant messaging account for users of the same or mutually supported instant messaging (such as MSN, SKYPE, "instant messaging" or QQ, etc.) to join as a contact person. Providing an automatic answering service to the instant messaging user who joins the contact; it must be stated that it is known to add the robotic system as a contact to obtain an automatic answering and interactive service, and the technical feature of the present invention is to provide the robot system. The spoofing warning function, in order to support the above-mentioned early warning function, the present invention mainly provides an instant messaging fraud early warning system. The system architecture of a preferred embodiment is shown in FIG. 1 , including a contact joining module 10 and a behavioral feature. The analysis module 20 and a message delivery module 30; wherein: the contact person joining module 10 performs contact management, mainly by using a master account for the user to join as a contact; as disclosed above, due to the present invention The instant messaging fraud alert system is a robotic system that can be added as a contact for instant messaging users, but instant messaging The number of users is huge, and the instant messaging industry usually has a contact limit for a single user, and in order to provide more users as contacts, the contact joining module 10 of the present invention further provides a dynamic account management program, mainly in When the number of contacts approaches or reaches an upper limit, more than one alternate account responds to the invitation of the instant messaging user; assuming that the contact limit of an instant messaging account (such as MSN) is 1,000, the contact at the primary account When approaching or reaching 1,000 people, another alternate account accepts the invitation to join the instant messaging user, thereby expanding the number of contacts, and the number of contacts increases with the expansion of the alternate account; due to the primary account and each alternate account The nickname is the same, so whether you join the primary or backup account, the relative contacts will display the same nickname on their operating interface, so there is no impact on the contact identification.

The behavioral feature analysis module 20 is configured to analyze the interaction between the instant messaging user and the contact person to have a specific behavior characteristic. If the instant messaging user has a specific behavior characteristic, it indicates that the instant messaging user's account has been stolen. According to this, an instant messaging message is sent to the instant messaging user, so that the instant messaging user can respond early; the analysis of the behavior characteristics mentioned includes:

1. The message contains the link and abnormal line status: Since the fraud group obtains the account of the instant messaging user, before manually changing the password and making a live dialogue with the contact person, the computer automation is firstly performed, mainly by computer program. Log in to the stolen account and send a message with a malicious link to the contact person of the account, and then immediately (off) the line after sending. Therefore, the behavioral feature analysis module 20 analyzes whether the instant messaging user added as the contact has the behavior characteristic. If the behavior characteristic has been generated, it indicates that the instant messaging user's account may have been stolen, and then the message delivery module is available. 30. Sending an alert message to the instant messaging user, and the account of the instant messaging user has been stolen. Since the password has not been changed, the original user can still log in normally, so the foregoing warning message can be received.

2. Specific dialogue and interaction mode: In addition to using a computer program to log in to an account and send a message containing a link, the fraud group also uses a computer program to send a specific mode or sequence of dialogues to interact with the contact person of the account and send it during the dialogue. Messages containing malicious links, such as inviting contacts to view their albums or blogs. When the contact person clicks on the link without suspiciously, the trojan may be implanted or baited into the phishing website, and the password of the contact person is also Will be stolen. Therefore, the above behavioral feature analysis module 20 will still analyze whether the instant messaging user added as the contact has the above behavior characteristics. If the behavior characteristic has already occurred, the message delivery module 30 will also send an early warning message to the instant messaging user.

In addition to analyzing the behavior characteristics of the instant messaging user, the behavior characteristic analysis module 20 described above, when the instant messaging user has the above behavior characteristics, the message content will be stored in a virus database for comparison analysis of the behavior characteristics of the subsequent analysis.

The message delivery module 30 receives the alert message generated by the behavior feature analysis module 20 for instant messaging users suspected of being stolen; since most instant messaging tools have traffic control, MSN is used as an example, per minute. The number of contacts to send messages does not exceed 8~9. Once the system displays the situation of the stolen account, the system must send a warning message to each corresponding instant messaging user within a short period of time. Messages are automatically sent to instant messaging users who are suspected of being poisoned.

The so-called dynamic dispatching program performs an automatic dispatch schedule to periodically send an alert message to the instant messaging user, and determines whether the instant messaging user is in an interactive state during the non-delivery period between the delivery periods. When the instant messaging user transmitting the alert message is in an interactive state, the alert message is sent preferentially to the user in the interaction.

For a specific process of the foregoing dynamic dispatching program, a first preferred embodiment of the present invention is shown in FIG. 2, which includes: performing automatic scheduling (201) to set a scheduling delivery period, and the scheduling delivery period can be based on an instant. The flow control standard of communication is set. For example, the flow control standard of MSN is no more than 8~9 message transmission objects in 1 minute, so it can be a scheduling period every 6 seconds or 7 seconds, in each scheduling delivery period. Sending an alert message to an instant messaging user suspected of being stolen, because an alert message is sent to an instant messaging user every 6 or 7 seconds, the alert message sent during the scheduled delivery period must conform to the traffic control of the instant messaging; Arriving to the scheduling delivery period (202); if the scheduled delivery period has been reached, the instant messaging user of the suspected stolen account is sent an alert message (203); if the scheduled delivery period is not, the instant communication of the suspected stolen account is further determined. Whether the user is in an "interactive state" (204), and the aforementioned "interactive state" means that the instant messaging user is connected to the early warning system of the present invention through instant messaging. Medium and/or instant messaging users are transmitting messages to the early warning system via instant messaging. According to MSN's traffic control rules, instant messaging users send messages to contacts in the connection or respond to incoming messages from instant messaging users. The above-mentioned object for transmitting messages per minute does not exceed the traffic limit of 8-9 people. Therefore, the foregoing feature can be used to quickly send an alert message to the corresponding instant messaging user during the non-scheduled delivery cycle; as described above, The instant messaging user who is determined to be dispatched with the early warning message is in an interactive state, that is, an early warning message is sent to the instant messaging user in the interactive state (205), and after the warning message is sent, the user returns to the foregoing step (202); if the instant messaging user is not In the interactive state, directly return to the foregoing step (202) to determine whether the scheduled delivery period is reached.

Regarding the second preferred embodiment of the foregoing dynamic dispatching procedure, please refer to FIG. 3, which includes: performing automatic scheduling (301) to set a scheduling delivery period; determining whether a scheduled delivery period is reached (302); If the scheduled delivery period has been reached, the priority delivery judging mechanism is further implemented, mainly determining whether the instant messaging user to be sent the alert message has been online (303); if the instant messaging user is not online, the alert is dispatched according to the original schedule. Message (304), after the delivery is completed, return to step (302); if the instant messaging user to be dispatched with the alert message is online, the priority message is sent to it (305), after the delivery is completed, the process returns to step (302); Furthermore, if it is determined in the foregoing step (302) that it is a non-scheduled delivery period, it is further determined whether the instant messaging user to send the early warning message is in an interactive state (306); if the instant messaging user is in an interactive state, that is, The contact person in the interactive state sends an alert message (307), and returns to the foregoing step (302) after the alert message is sent; if the instant messaging user is not in the interactive state, directly returns to the foregoing step (302), it is determined whether the delivery schedule arrival period.

The difference between the above embodiment and the previous embodiment is that the prioritized delivery mechanism is added before the dispatching of the early warning message, and the main purpose is to enable the instant messaging user who has been online to obtain the early warning message, thereby improving the benefit of sending the early warning message. .

For a third preferred embodiment of the foregoing dynamic dispatching procedure, please refer to FIG. 4, which includes: performing automatic scheduling (401) to set a scheduling delivery period; determining whether a scheduled delivery period is reached (402); If the scheduled delivery period has been reached, the priority delivery judgment mechanism is further implemented, mainly determining whether the instant messaging user to be sent the alert message has been online (403); if the instant messaging user to be dispatched the alert message is not online, the original subscription is The schedule sends an alert message to the instant messaging user (404). After the delivery is completed, the process returns to step (402); if the instant messaging user is online, the instant messaging user (80) is preferentially dispatched to the online instant messaging user, and after the delivery is completed, Going back to step (402); further, if it is determined in the foregoing step (402) that it is a non-scheduled delivery period, it is further determined whether the instant messaging user to send the early warning message is in an interactive state (406); The instant messaging user of the message is in an interactive state, that is, an alert message (407) is sent to the message, and the alert message is returned to the foregoing step (402); if the alert message is to be sent, A non-interactive user communications in the state, directly back to step (402), it is determined whether the delivery schedule arrival period.

The foregoing steps (401)-(407) are substantially the same as the steps (301)-(307) in the previous embodiment, except that the present embodiment sends an alert message to the instant messaging user who is to send the alert message (whether it is a row The delivery period or the non-scheduled delivery period further determines whether the instant messaging message is successfully sent (408); if the instant messaging response message is successfully delivered, the instant messaging user to which the alert message is sent is added to the delivery success list (409), Returning to the foregoing step (402); if the instant messaging does not respond to the successful delivery of the message, indicating that the alert message delivery fails, the instant messaging user to which the alert message is sent is re-added to the automatic scheduling (410), and after rescheduling, It sends an alert message and then returns to the previous step (402).

The foregoing steps (408) to (410) use the characteristics of instant messaging to confirm whether the early warning message is successfully delivered. According to the characteristics of instant messaging, it does not generate an error message for the message that fails to be transmitted, but for the message that the transmission is successful, The response message is successfully transmitted. Therefore, the foregoing steps (408) to (410) are based on the above characteristics to confirm whether the early warning message has been successfully sent to the instant messaging user to be sent the warning message, and if unsuccessful, reschedule the delivery, thus It ensures that the alert message is effectively transmitted to the instant messaging user.

As shown in FIG. 5, in the foregoing step (408), if the instant messaging response message is successfully sent, a step (408A) of requesting the input of the verification code may be further added, and it is determined whether the instant messaging user correctly inputs the verification code (408B). Start to join the delivery success list (409), if you do not enter the verification code or enter the verification code is incorrect, then re-join the automatic scheduling (410); to confirm that the original instant messaging user did receive the warning message. Since the fraud group has used the computer program to automatically log in to the account and send a message after manually changing the password, at this stage, if the fraud group logs in to the account with the computer program, it will also receive an alert message, but the computer program cannot recognize and input. Verification code, it can be regarded as unsuccessful delivery, so it will be rescheduled and continue to send early warning messages until the original instant messaging user receives and enters the verification code, and then joins the delivery success list.

It can be understood by those having ordinary knowledge in the art that the mechanism for confirming whether the foregoing warning message is successfully sent to the instant messaging user is not limited to the second preferred embodiment (ie, the third preferred embodiment). It is also doubtful that the first preferred embodiment can be used, that is, after the scheduled delivery message (203) or the non-scheduled delivery message (205), it can be further determined whether the instant messaging responds to the message delivery success, if the instant messaging response message If the delivery is successful, the instant messaging user sent by the warning message is added to the delivery success list, and then returns to the foregoing step (202); if the instant messaging does not respond to the successful delivery of the message, indicating that the warning message delivery fails, the warning message is sent immediately. The communication user rejoins the automatic scheduling, sends an alert message after rescheduling, and then returns to the previous step (202).

10. . . Contact to join the module

20. . . Behavioral feature analysis module

30. . . Message delivery module

1 is a schematic diagram of the system architecture of the present invention.

2 is a flow chart of a first preferred embodiment of the early warning method of the present invention.

3 is a flow chart of a second preferred embodiment of the early warning method of the present invention.

4 is a flow chart of a third preferred embodiment of the early warning method of the present invention.

FIG. 5 is still another flow chart of the third preferred embodiment of the early warning method of the present invention.

10. . . Contact to join the module

20. . . Behavioral feature analysis module

30. . . Message delivery module

Claims (10)

An instant messaging fraud warning system includes: a contact person joining a module, mainly by using one master account for more than one instant messaging user to join as a contact; a behavioral feature analysis module for analyzing instant messaging users and contacts The behavioral characteristics of the interaction, the behavioral features include the text content in the message, the conversation and the status of the online and offline lines and the text content in the message, the conversation or the status of the online and offline, to determine whether the instant messaging user's account has been stolen, and An early warning message is generated when it is judged that there is a misappropriation; a message dispatching module is used to send an alert message generated by the behavioral feature analysis module to an instant messaging user suspected of being stolen. The behavioral feature analysis module further includes a virus database, and when the behavior feature analysis module determines that the instant communication user has a specific behavior characteristic, the message content is stored in the virus. The database serves as the basis for future comparisons. An instant messaging fraud alert delivery method mainly involves receiving a message from a user of an instant messaging user after receiving more than one instant messaging user as a contact in a robotic system; analyzing whether the message contains a link and/or an instant The status of the communication user's online and offline; when the analysis result of the message is abnormal, an alert message is sent to the instant messaging user. The method for dispatching an instant messaging fraud alert message according to claim 3, the sending of the foregoing alert message is performed according to the following steps: performing automatic scheduling to set a scheduling delivery period; determining whether the scheduled delivery period is reached; The dispatching period, that is, the instant messaging user who sends the early warning message, sends an early warning message; if the scheduled delivery period is not, it further determines whether the instant messaging user to be sent the early warning message is in an interactive state; if the instant messaging user is in an interactive state, That is, an alert message is sent to it; if the instant messaging user is not in an interactive state, it returns to the step of judging whether or not the scheduled delivery period is reached. The method for dispatching an instant messaging fraud alert message according to claim 4, the sending of the foregoing alert message further includes the following steps: if it is determined to be a scheduled delivery period, the priority dispatching judgment mechanism is further executed, mainly determining that the early warning message is to be dispatched Whether the communication user has been online; if the instant messaging user is not online, an alert message is sent to the instant messaging user list according to the original scheduling; if the instant messaging user is online, the early warning message is sent. The instant messaging fraud alert delivery method described in claim 4, after the completion of the dispatching of the alert message, further determining whether the instant messaging responds to the successful delivery of the message, and if the instant messaging response message is successfully delivered, the instant messaging user dispatched by the alert message Join the delivery success list; if the instant message does not respond to the message delivery success, indicating that the alert message delivery failed, the instant messaging user dispatched by the alert message is re-added to the automatic scheduling. The method for dispatching an instant messaging fraud alert message according to claim 5, after the completion of the dispatching of the alert message, further determining whether the instant messaging responds to the successful delivery of the message, and if the instant messaging response message is successfully delivered, the instant messaging user dispatched by the alert message Join the delivery success list; if the instant message does not respond to the message delivery success, indicating that the alert message delivery failed, the instant messaging user dispatched by the alert message is re-added to the automatic scheduling. The method for dispatching an instant messaging fraud alert message according to any one of claims 3 to 7, wherein the interactive state means that the instant messaging user is connecting to the robot system through instant messaging and the instant messaging user is communicating to the robot through instant messaging. The system transmits messages, instant messaging users are connecting to the robot system via instant messaging or instant messaging users are transmitting messages to the robot system via instant messaging. The method for dispatching an instant messaging fraud alert message according to claim 6 or 7, when the instant messaging response message is successfully sent, further adding a step of requesting the input of the verification code, if the instant messaging user inputs the verification code, the joining success list is entered; If the verification code is not entered or the verification code is incorrect, re-join the automatic schedule. The method for dispatching an instant messaging fraud alert message according to claim 8, wherein the instant messaging refers to MSN, SKYPE, "instant messaging" or QQ.