WO2010133063A1

WO2010133063A1 - System and method for short message monitoring

Info

Publication number: WO2010133063A1
Application number: PCT/CN2009/074516
Authority: WO
Inventors: 赵阳; 陈苏
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-05-20
Filing date: 2009-10-19
Publication date: 2010-11-25
Also published as: CN101895828B; CN101895828A

Abstract

A system and a method for short message monitoring are provided, in the system, the interface unit (1) is used for weighting the arbitrating results after being matched returned by each arbitrating unit (2) and judging whether the blur short message is the short message of breaking the rule; the arbitrating unit (2) is used for obtaining the blur short message transmitted by the interface unit (1), matching different kinds of arbitrating rules with blur short message respectively and returning each arbitrating result after being matched to the interface unit (1). The method for short message monitoring includes that: the arbitrating unit (2) matches different kinds of arbitrating rules with blur short message respectively, and returns each arbitrating result after being matched to the interface unit (1); the interface unit (1) weights each arbitrating result after being matched; if the arbitrating result is less than the preset first threshold, the blur short message is judged as the short message of breaking the rule. The system and the method of the invention improve the monitoring ability for the blur short message.

Description

Short message monitoring system and method

TECHNICAL FIELD The present invention relates to short message monitoring technologies, and in particular, to a short message monitoring system and method based on machine learning arbitration results. BACKGROUND Currently, various monitoring systems have been fully utilized in various fields such as short message monitoring and multimedia message monitoring, including a spam monitoring system. It should be noted here that a short message may also be referred to as a short message. Most spam short message monitoring systems implement monitoring of spam short messages based on the set of limited keywords and monitoring rules of traffic statistics. For example, when the set traffic statistics count is reached, the current short message is determined to be a spam short message. With the development of the times, the behavior and content of users sending messages have undergone great changes, presenting diverse and complex features, and only relying on existing traffic and limited keywords, this only reflects the logic of the single logic. It is impossible to correctly determine whether the short message is a spam short message. Here, the existing monitoring rule, such as the traffic rule and the keyword rule of the ticket, cannot correctly determine whether the suspicious message of the garbage short message is called a fuzzy short message. If there is no limit, keep increasing the number of keywords to? The ability of Shanshan to monitor fuzzy short messages will greatly affect the real-time performance of the monitoring system. At present, there is no effective solution to how to effectively determine whether a fuzzy short message is a garbage short message and implement monitoring of the garbage short message. SUMMARY OF THE INVENTION In view of this, the main object of the present invention is to provide a short message monitoring system and method, which can improve the monitoring capability of a fuzzy short message, and can effectively determine whether the fuzzy short message is a garbage short message and realize short garbage. Monitoring of messages. To achieve the above object, the technical solution of the present invention is achieved as follows: According to an aspect of the present invention, a short message monitoring system is provided. The short message monitoring system according to the present invention includes: an interface unit and an arbitration unit; wherein, the interface unit is configured to forward the fuzzy short message to the arbitration unit for arbitration; The returned matching arbitration result is subjected to a weighting operation; when the operation result is less than the set first threshold value, the fuzzy short message is determined to be a violation short message; and the arbitration unit is configured to obtain the fuzzy short message by forwarding by the interface unit. ; Match the fuzzy short message according to different categories of arbitration rules, and return the matched arbitration results to the interface unit. Preferably, the foregoing arbitration rules include: a keyword rule, a user number type information rule, and a user number segment information rule. Preferably, the arbitration unit further includes at least two arbitration modules, and each of the arbitration rules included in each arbitration module belongs to a different category; each arbitration module is configured to match the fuzzy short message according to the respective included arbitration rules, and The matched arbitration results are returned to the sigma unit. Preferably, each of the foregoing arbitration modules is further configured to determine a fuzzy short message according to each arbitration result, and obtain a judgment result for the fuzzy short message by each arbitration module; and obtain a judgment result for the fuzzy short message by the interface unit, During the set system running time, when the probability that the current arbitration module and the interface unit determine the same result is greater than the first expected value, the arbitration weight of the current arbitration module is increased; the probability that the current arbitration module and the interface unit have the same judgment result is smaller than the first In the expected value state, the arbitration weight of the current arbitration module is reduced; the modified arbitration weight is returned to the interface unit to update the arbitration weight. Preferably, the interface unit is further used to perform a weighting operation on the operation formula Result. X ω _{

It is: Result '⁴; where Result is the result of the operation, ^Result ' is the result of each arbitration, ^ is the arbitration weight of each arbitration module, and n is the number of arbitration modules. Preferably, each of the foregoing arbitration modules is further configured to: when the arbitration result is greater than the set second threshold value, determine that the fuzzy short message is a violation short message; wherein, the second threshold is 1/n times the first threshold n is the number of arbitration modules. Preferably, the interface unit is further configured to increase the current first threshold value in a state in which the interface unit determines that the rate of the violation short message is greater than the second expected value within the set system running time; In the state where the 4 rate of the violation short message is less than 1 time of the second expected value, Reduce the current first threshold; return the modified first threshold to each arbitration module for update. According to another aspect of the present invention, a short message monitoring method is provided. The short message monitoring method according to the present invention includes: the arbitration unit respectively matches the fuzzy short message according to different categories of arbitration rules, and returns the matched arbitration results to the interface unit; the interface unit performs weighting operation according to the matched arbitration results; When the operation result is less than the set first threshold, it is determined that the fuzzy short message is a violation short message. Preferably, the arbitration rules include: a keyword rule, a user number type information rule, and a user number segment information rule. Preferably, when the arbitration unit includes at least two arbitration modules, and the arbitration rules respectively included in the respective arbitration modules belong to different categories, the arbitration unit further performs: the arbitration modules respectively are short according to the respective arbitration rules and fuzzy rules. The messages match and the matching arbitration results are returned to the interface unit. The method further includes: A. Each arbitration module respectively determines the fuzzy short message according to each arbitration result, and obtains a determination result for the fuzzy short message by each arbitration module;

B. Obtain a judgment result of the fuzzy short message by the interface unit; and increase the arbitration weight of the current arbitration module when the probability that the current arbitration module and the interface unit have the same judgment result is greater than the first expected value in the set system running time; If the probability that the current arbitration module and the interface unit determine the same result is less than the first expected value, reduce the arbitration weight of the current arbitration module; and return the modified arbitration weight to the interface unit to update the arbitration weight;

C. The interface unit performs a force according to the returned updated arbitration weight value. The weight operation, and continue to perform the judgment for the fuzzy short message. Preferably, the operation formula used by the interface unit to perform the weighting operation is:

^Result. x<w.

Result= '=i ; where Result is the result of the operation and ^Result ' is the result of each arbitration.

^ is the arbitration weight of each arbitration module, where n is the number of arbitration modules. Preferably, in A, the determining, by each arbitration module, the fuzzy short message according to each arbitration result further comprises: when the arbitration result is greater than the set second threshold, determining that the fuzzy short message is a violation short message; wherein, the second valve The value is 1/n times the first threshold; n is the number of arbitration modules. Preferably, after C, the method further includes: increasing, in the set system running time, the current first threshold value when the interface unit determines that the probability of the violation short message is greater than the second expected value; and determining that the violation is short in the interface unit If the probability of the message is less than 1 time of the second expected value, the current first threshold is decreased; and the modified first threshold is returned to each arbitration module for updating. The arbitration unit of the present invention matches the fuzzy short message according to different types of arbitration rules, and returns the matched arbitration results to the interface unit; the interface unit performs weighting operation according to each of the matched arbitration results; when the operation result is smaller than the set When the first threshold is reached, it is determined that the fuzzy short message is a violation short message. The invention provides a processing scheme for the fuzzy short message, which is a good supplement to the current monitoring system 4, and can greatly improve the ability to process the fuzzy short message without affecting the function of the current monitoring system, and actively respond to the new garbage short. The message poses challenges to the current monitoring system and maximizes the real-time performance of the monitoring system. The invention overcomes the defects in the current monitoring system that the fuzzy short message cannot be judged or relies on manual judgment, and proposes a monitoring system that matches the fuzzy short message and automatically judges according to different types of arbitration rules, so as to analyze the garbage more comprehensively. The characteristics of short messages, and capture violations of short messages and violating users. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic structural diagram of a short message monitoring system according to an embodiment of the present invention; FIG. 2 is a schematic flowchart of an implementation of a short message monitoring method according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The basic idea of the present invention is: Matching fuzzy short messages according to different categories of arbitration rules, and automatically determining fuzzy short messages. The implementation of the technical solution will be further described in detail below with reference to the accompanying drawings. FIG. 1 is a schematic structural diagram of a short message monitoring system according to an embodiment of the present invention. As shown in FIG. 1, the short message monitoring system includes: an interface unit and an arbitration unit. The interface unit is configured to forward the fuzzy short message to the arbitration unit for arbitration; perform weighting operation according to the matched arbitration results returned by the arbitration unit; and when the operation result is less than the first threshold value set in the interface unit, The fuzzy short message is determined to be a violation short message; when the operation result is greater than the set first threshold value, the fuzzy short message is determined to be a normal short message. An arbitration unit, configured to obtain a fuzzy short message by forwarding by the interface unit; respectively matching the fuzzy short message according to different categories of arbitration rules, and returning each matched arbitration result to the interface unit, so that the interface unit matches the matched arbitration result After the weighting operation, the first threshold value set in the interface unit is compared and the fuzzy short message is characterized. The arbitration rules include: a keyword rule, a user number type information rule, and a user number segment information rule. The short message monitoring system may further include: a monitoring unit and a human-machine interaction unit. The monitoring unit and the human-machine interaction unit are both existing, and they are described herein. The monitoring unit is configured to obtain short messages and count the number of traffic, and the number of statistics of the short messages and the monitoring unit The configured traffic rules are matched to implement filtering of short message traffic; the short message with successful traffic matching is sent to the human-machine interaction unit, so that the human-computer interaction unit performs further filtering according to the keyword rule. The human-machine interaction unit is configured to receive a short message with successful traffic matching from the monitoring unit, and match the keyword of the short message with successful traffic matching with the keyword rule configured in the human-computer interaction unit to implement filtering of the short message content. In the matching dog state, the short message that the keyword is successfully matched is determined to be a violation short message, and the user who sends the violation short message is directly added to the blacklist, and the user who subsequently sends the violation short message can not send the short message again. In the state that the matching is unsuccessful, the short message that determines that the keyword match is unsuccessful is a fuzzy short message and is sent to the interface unit, so that further filtering is performed through the interaction between the interface unit and the arbitration unit, and the fuzzy is performed. The short message is qualitatively determined to correctly and effectively determine whether the fuzzy short message is a violation short message or a normal short message. Among them, the so-called fuzzy short message means: At this stage, it is impossible to correctly and effectively determine whether the short message is a suspicious message or a normal short message. The non-compliant short message involved is a spam short message, which will not be described below. It should be noted here that the above filtering by the traffic rules of the monitoring unit and the filtering by the keyword rules of the human-machine interaction unit are all filtering based on the existing monitoring rules. In particular, where the cartridge is a single rule keyword, keywords, rules different from shellfish subsequent arbitration unit employed in the ¹ J. The keyword rules used in the arbitration unit are complex, including not only a wide range of keywords, such as keywords in different categories including political, advertising, and security; but also Complex logical operation relationships between categories of keywords. For the system component structure of the present invention, the monitoring unit specifically includes: a monitoring processing module and a monitoring management module. The monitoring processing module is configured to obtain a short message from the short message center and collect the number of the traffic, and match the number of the statistics of the short message with the configured traffic rule; and send the short message with the successfully matched traffic to the monitoring management module. The monitoring management module is configured to receive the short message with successful traffic matching and forward it to the human-machine interaction unit; and parse the user information in the short message with successful traffic matching and store it. Here, the so-called user information refers to: in the short message that the traffic matching succeeds, all the information encapsulated by the user who sends the short message includes: a primary and a called user number; a short message specific content including a keyword; Called user number type; primary and called user number segment information. The human-computer interaction unit is further configured to configure an arbitration rule of the arbitration unit and synchronize to the arbitration unit. The configuration may be configured by using a command line input manner, or may be configured by using a batch file command, so that the arbitration unit can obtain the time in time. Arbitration rules after synchronization update, according to the synchronously updated arbitration rules, can arbitrate fuzzy short messages in a timely, correct and effective manner. Here, the arbitration rule is the above-mentioned arbitration rules of a plurality of categories including a keyword rule, a user number type information rule, and a user number segment information rule. The human-machine interaction unit is further configured to display monitoring information including a fuzzy short message and a judgment result obtained after the fuzzy short message is arbitrated, so as to visually display the information of the monitoring and management module and the interface unit returning the human-computer interaction unit, in time Adjusting the configuration information in the human-computer interaction unit is beneficial for efficient monitoring. The arbitration unit further includes a plurality of arbitration modules, and each of the arbitration rules included in each arbitration module belongs to a different category; each arbitration module is configured to match the fuzzy short message according to the respective included arbitration rules, and each of the matched arbitration messages The arbitration result is returned to the interface unit. Here, each arbitration module is further configured to determine the fuzzy short message according to each arbitration result, and obtain a judgment result for the fuzzy short message by each arbitration module; obtain the judgment result of the fuzzy short message by the interface unit, and set During the system running time, when the current arbitration module and the interface unit determine that the same rate is greater than the first expected value, the arbitration weight of the current arbitration module is increased; the probability that the current arbitration module and the interface unit determine the same result is less than the first expected value. In the state, the arbitration weight of the current arbitration module is reduced; the modified arbitration weight is returned to the interface unit to update the arbitration weight. Correspondingly, the interface unit is further configured to perform a weighting operation according to the returned updated arbitration weight value, and continue to perform the determination for the fuzzy short message. Here, for the weighting operation performed by the interface unit, the interface unit is further used for adding

^Result. x<w.

The operation formula used in the weight operation is: Result w ; where Result is the result of the operation, ^Result < is the result of each arbitration, and is the arbitration weight of each arbitration module, where n is the number of arbitration modules. Here, for each of the arbitration modules to determine the fuzzy short message according to each arbitration result, each arbitration module is further configured to determine that the fuzzy short message is a violation short message when the arbitration result is greater than the set second threshold value; The second threshold is 1/n times the first threshold. Among them, the result of each arbitration is ^ReSult '-. Here, for the type of the arbitration module, the arbitration module specifically includes: an arbitration module including a keyword rule, an arbitration module including a user number type information rule, and an arbitration module including a user number segment information rule. The keyword rules include: keyword rules of at least one of the political class, the advertising class, and the security class, that is, the keyword rule can be a keyword rule of any one of the categories, such as a political class. Keyword rules; or keyword rules of combined categories in these categories, such as the keyword rules of the political category plus the security category, the keyword rules using this combination category can express complex logical operation relationships, Therefore, the arbitration of the fuzzy short message can be better realized. The user number type information rule includes: a primary and a called user number type information rule. The user number segment information rule includes: a primary and a called user number segment information rule. Here, for the interface unit to continue to perform the judgment for the fuzzy short message according to the updated arbitration weight value, the interface unit is further configured to determine, in the set system running time, that the probability of the violation short message is greater than the second expected value in the interface unit. In the state of 1 time, the current first threshold is increased; and when the interface unit determines that the probability of the violation short message is less than 1 time of the second expected value, the current first threshold is decreased. Returning the modified first threshold to each arbitration module for updating; by interacting with each arbitration module, and updating the arbitration weight, the first threshold, and implementing the judgment result of the interface unit for the fuzzy short message at the second expected value In the way of convergence in the upper and lower 20% range, the completion of the fuzzy short message is the judgment of the violation short message. In summary, the core component of the system according to the present invention is an arbitration unit, an arbitration module in the case where the arbitration unit includes at least one arbitration module, and an interface unit. For the arbitration module, the arbitration module judges whether the fuzzy short message is a violation short message: based on the configured keyword content, and the judgment of the complex logical relationship between the keywords contained in the fuzzy short message, and adds the fuzzy The short message main and the called user's state judgment are comprehensively considered, and the judgment for the fuzzy short message is automatically realized by the interaction of at least one arbitration module and the interface unit. Further, according to the present invention, the arbitration weight is learned through the interaction between the at least one arbitration module and the interface unit, and after the system runs for a period of time according to the set system running time, the optimal arbiter and the arbitration weight can be finally obtained. combination. That is, the interaction between the at least one arbitration module and the interface unit, and updating the arbitration weight, the first threshold, and the implementation of the interface unit for the fuzzy short message converge within the upper and lower 20% of the second expected value. The way to complete the fuzzy short message is to judge the violation of the short message. FIG. 2 is a schematic diagram of an implementation process of a short message monitoring method according to an embodiment of the present invention. As shown in FIG. 2, the short message monitoring method includes the following steps: Step S101: The interface unit forwards the fuzzy short message to the arbitration unit for arbitration, and the arbitration unit respectively matches the fuzzy short message according to different types of arbitration rules, and The individual arbitration results are returned to the interface unit. Here, the arbitration rules include: a keyword rule, a user number type information rule, and a user number segment information rule. The keyword rule includes: a keyword rule of at least one of a political class, an advertisement class, and a security class; the user number type information rule includes: a primary and a called user number type information rule; the user number segment information rule includes: The called user number segment information rule. Step S102: The interface unit performs a weighting operation according to the matched arbitration results returned by the arbitration unit. When the operation result is less than the set first threshold, it is determined that the fuzzy short message is a violation short message. Here, the operation formula used by the interface unit to perform the weighting operation is: ^Result. x<w.

^ is the arbitration weight of each arbitration module, where n is the number of arbitration modules. For the technical solution of the above steps S101 to S102, the step S101 may further include: the monitoring unit acquires the short message and counts the number of the traffic, and the number of the traffic of the short message is matched with the configured traffic rule; The short message with successful traffic matching is sent to the human interaction unit. After that, the human interaction unit matches the keyword of the short message with successful traffic matching with the configured keyword rule; the short message with the keyword matching success is determined as the violation short message; The unsuccessful short message is judged as a fuzzy short message and sent to the interface unit. Here, before the human-computer interaction unit performs keyword rule matching, the method may further include: initially configuring the arbitration rule and synchronizing to the arbitration unit. Here, after the configuration of the arbitration rule is 4, the human interaction unit synchronously updates the arbitrated arbitration rule to the arbitration unit. The human-computer interaction unit can display the monitoring information including the fuzzy short message and the judgment result obtained after the fuzzy short message is arbitrated. Therefore, after the monitoring information is displayed, the configuration of the arbitration rule can be selectively modified according to the displayed monitoring information. And update to the arbitration unit synchronously. It should be noted that, when the arbitration unit includes multiple arbitration modules, and the arbitration rules respectively included in the respective arbitration modules belong to different categories, the processing of step S101 further includes: each arbitration module separately according to the arbitration rules respectively included Matches with the fuzzy short message, and returns the matched arbitration results to the interface unit. Here, after step S102, the method further includes: Step S103: Each arbitration module determines the fuzzy short message according to each arbitration result, and obtains a determination result for the fuzzy short message by each arbitration module. The specific processing process for determining, by each arbitration module, the fuzzy short message according to each arbitration result includes: when the arbitration result is greater than the set second threshold, determining that the fuzzy short message is a violation short message; wherein, the second threshold It is 1/n times the first threshold, that is, the second threshold = 1 / η χ the first threshold, and η is the number of arbitration modules. Step S104: Each arbitration module acquires a determination result of the fuzzy short message by the interface unit. Step S105: In the set system running time, when the probability that the current arbitration module and the interface unit determine the same result is greater than the first expected value, increase the arbitration weight of the current arbitration module; and the current arbitration module and the interface unit determine the same result. When the probability is less than the first expected value, the arbitration weight of the current arbitration module is reduced; and the 4 modified arbitration weight is returned to the interface unit for updating the arbitration weight. Step S106: The interface unit performs a force according to the returned updated arbitration weight value. The weight operation, and continue to perform the judgment for the fuzzy short message. Here, after step S106, the method may further include: Step S107: In the set system running time, when the interface unit determines that the 3⁄4⁄4 rate of the violation short message is greater than the second expected value, the current first threshold is increased; and the probability of the violation short message is determined by the interface unit is less than In the case where the second expected value is 1 time, the current first threshold value is decreased. Step S108: The interface unit returns the modified first threshold value to each arbitration module for updating; and interacts with each arbitration module, and updates the arbitration weight, the first threshold, and the interface unit to determine the fuzzy short message. As a result, the manner in which the fuzzy short message is completed is a violation of the short message in a manner of convergence in the upper and lower 20% of the second expected value. The first embodiment of the method is as follows: The monitoring unit includes a monitoring processing module and a monitoring management module. When the arbitration unit includes multiple arbitration modules, the arbitration function and the interface unit do not need to perform multiple interactions of the arbitration module to learn and update the arbitration weight. The monitoring process for implementing the short message includes the following steps: Step S201: The monitoring processing module receives the short message sent by the user from the short message center. Here, the short message encapsulates the primary and called user numbers; the short message specific content including the keyword; the primary and the called user number type; the primary and the called user number segment information and the like. Step S202: The monitoring processing module performs statistical counting on the received short message, and matches the traffic rule configured by the system, and sends a short message with successful traffic matching to the monitoring management module, and the monitoring management module imports the short message with successful traffic matching. The database stores and sends a short message with successful traffic matching to the human interaction unit. Here, the human-computer interaction unit may also be referred to as a console, and the short message with successful traffic matching is a violation short message, and the corresponding user is a violation user. Step S203: The human-machine interaction unit displays the offending user, and filters the content of the short message with the matching of the traffic, and matches the keyword of the short message with the matching of the traffic to the keyword rule configured in the human-computer interaction unit. Filtering the content of the short message; In the ^^ dog state with successful matching, the short message that the keyword is successfully matched is determined to be a violation short message; if the matching is unsuccessful, the short message with the unsuccessful keyword matching is determined to be fuzzy The short message is sent to the interface unit. Here, the keyword rules configured in the human-computer interaction unit are the same as the existing keyword rules, and may also be referred to as specific keyword rules. The violating user corresponding to the violation short message containing the specific keyword is directly added to the blacklist, and the subsequent violating user can no longer send the short message, and the fuzzy short message that does not contain the specific keyword, mainly including the political category and the security keyword, is sent. To the interface unit processing. Step S204: The interface unit sends the fuzzy short message that needs to be arbitrated to the n arbitration modules, and configures the initial arbitration weight of each arbitration module, and the arbitration module times out, the first threshold After waiting for the information, wait for the response of each arbitration module. Step S205: Each arbitration module arbitrates the fuzzy short message to be arbitrated. Step S206: Each arbitrator returns the arbitration result to the interface unit. Step S207: The interface unit performs a weighting operation according to the arbitration result returned by each arbitration module, compares and determines with the set first threshold, and characterizes the fuzzy short message. Here, the so-called qualitative short message refers to: Determine whether the nature of the fuzzy short message is a violation short message or a normal short message. Step S208, ending the current short message monitoring process. The second embodiment of the method is as follows: In the case that the arbitration unit includes multiple arbitration modules, the interaction between the arbitration module and the interface unit is required to learn and update the arbitration weight. In the embodiment of the method, the monitoring process of the short message includes the following steps. Step S301: The human-machine interaction unit of the short message monitoring completes the basic attribute configuration of the system, the configuration of the monitoring rule, and the related configuration of the arbitration module, and synchronizes the monitoring rules. Here, for example, configuration related traffic and keyword rules; for example, the number of the arbitration module can be initialized to three; the arbitration weight of each arbitration module can be configured, and the arbitration weight can be initialized to 1; Information; Configure timeout processing information, which can be initialized to 3 seconds to determine whether the user who sent the short message is a violating user. Step S302: Each arbitration module imports a related configuration for the arbitration module. Here, the related configuration of the imported arbitration module includes a monitoring rule configured for the arbitration module, and the monitoring rule includes at least one category of arbitration rules including a keyword rule, a user type information rule, and a segment information rule. For the keyword rule, the keyword rule configured in the arbitration module is different from the keyword rule configured in the human-computer interaction unit in the human-computer interaction unit, and the keyword rule configured in the arbitration module has a very large amount of information. Large, keywords basically include: all political, advertising, and security-type violation characters and complex logical operations between them. For the user type information rule, the user type information includes: all blacklist and whitelist information, online charging system (OCS) arrears user information, and packet format protocol (H2) attribute information with the camp interface. Type information. For the segment information rule, the segment information includes: all prepaid number segments, the province number segment, the network segment segment, and the special user segment segment, that is, the whitelist segment segment. Among them, the user Type information rule master and called user number type information rules; User number segment information rules include: primary and called user number segment information rules. Step S303: The monitoring unit receives the short message of the short message center, performs traffic counting on the short message, and matches the traffic rule configured by the system. The short message with the successfully matched traffic is determined as the violation short message, and the violation of the traffic monitoring rule is reached. The violating user corresponding to the short message is displayed by the human-computer interaction unit. Step S304: The human-machine interaction unit filters the content of the violation short message, that is, matches the keyword of the short message with successful traffic matching with the keyword rule configured in the human-computer interaction unit to implement the short message content. Filtering. Step S305: The fuzzy short message generated after filtering is sent to each arbitration module through an interface unit for arbitration, and each arbitration module arbitrates the fuzzy short message to be arbitrated. Here, for the arbitration module, the arbitration result of initializing each arbitration module is 20, and the arbitration module can be divided into the following five categories, as follows: The first type of arbitration module is: an arbitration module containing a keyword rule, used for The fuzzy short messages are classified and arbitrated according to the keyword rules. Different keywords are divided into several levels according to their importance, which are 10 points, 8 points, 5 points, 2 points and 4 levels. Among them, political categories: such as Falun Gong, Tiananmen incidents, etc. are configured as type 1 keywords; security categories: such as self-immolation, sit-down, pistol, etc. are configured as type 2 keywords; pornography: such as adult, erotic, etc. are configured as three types of keywords; Advertising categories: such as satellite installation, invoices, etc. are configured as 4 types of keywords, and combined configuration of various logical relationship keywords, such as opposition & Communist, porn & satellite installation, government & (quiet sit I parade), etc. Level of keywords. All the keywords are matched to the content of the fuzzy short message, the matched keywords are counted, and the matching keywords are deducted for arbitration, and the score is deducted to 0 and processed as 0. The second type of arbitration module is: a calling user type arbitration module including a calling party number type information rule, configured to perform number classification and arbitration on the calling user according to the calling party number type information rule. The number is divided into the following levels: whitelist users plus 10 points, blacklist users minus 20 points, OCS arrears users deduct 10 points, H2 attributes are diamond card users plus 10 points, gold card users plus 5, silver card users force. 3 points, ordinary card users do not add points, the main and called users are matched to get the arbitration result, the score is deducted to 0 and then treated as 0 points. Among them, the diamond card user, the gold card user, the 4 Leica user, and the ordinary card user are different ratings of the operator in the camping system. The third type of arbitration module is: a called user type arbitration module that includes a called user number type information rule, configured to perform number classification and arbitration on the called user according to the called user number type information rule. The number is divided into the following levels: whitelist users plus 10 points, blacklist users minus 20 points, OCS arrears users deduct 10 points, H2 attributes are diamond card users plus 10 points, gold card users plus 5, silver card users force. 3 points, the ordinary card does not add points, the matching user is matched to get the arbitration result, and the score is deducted to 0 and then treated as 0. The fourth type of arbitration module is: a calling number segment information arbitration module including a calling party number segment information rule, configured to classify and arbitrate the calling party according to the calling party number segment information rule. The number is divided into the following levels: VIP group number plus 10 points, global number section plus 5 points, Monternet gateway plus 5 points, industry gateway does not add points, prepaid number paragraph does not add points, foreign province number minus 2 The sub-group and the external network number segment are reduced by 5 points, etc., and the matching result is obtained after matching the calling and called users, and the score is deducted to 0 and then treated as 0 points. All of the above segment information is configured by the operator. Among them, the VIP group number segment is the number provided by the operator to the large group users. The number of calls made by the users in the number segment is low, and the short number can be dialed directly; the Monternet Gateway is a service provider directly operated by the operator; The gateway is a service provider operated by a non-operator; the prepaid number segment is a number segment set by the operator, and all numbers in the number segment are all prepaid users. The fifth type of arbitration module is: a called number segment information arbitration module that includes a called user number segment information rule, and is used for classifying and arbitrating the called user according to the called user number segment information rule. The number is divided into the following levels: VIP group number plus 10 points, global number section plus 5 points, Monternet gateway plus 5 points, industry gateway does not add points, prepaid number paragraph does not add points, foreign province number minus 2 The sub-network and the external network number segment are deducted by 5 points, etc., and the matching result is obtained after matching the called user, and the score is deducted to 0 and then treated as 0. Step S306: Each arbitration module sends the arbitration result to the interface unit, and the interface unit performs a weighting operation on the arbitration result. In the case of the above five types of arbitration modules, the number of arbitration modules is 5, the formula used for the weighting operation is: Result=Resulti X ω ₁ +Result ₂ ^χ ω ₂ +Result ₃ χ ω ₃ +Result ₄ χ ω ₄ +Result ₅ χ ω ₅ , wherein the arbitration weights of the arbiters are 0^, ω ₂ , ω ₃ . ω ₄ , ω _{5 are} all initialized to 1, and the operation result is compared with the set first threshold, where the first threshold is Can be initialized to 80. When the operation result is less than the set first threshold, it is determined that the fuzzy short message is a violation short message, otherwise it is a normal short message. Step S307, the interface unit returns the operation result to each arbitration module, and the arbitration module first The operation result is compared with the set second threshold, where the second threshold of each arbitration module is the same, which is 1/5 times the first threshold set by the interface unit. When the operation result is less than the set second threshold, it is determined that the fuzzy short message is a normal short message; when the operation result is greater than the set second threshold, it is determined that the fuzzy short message is a violation short message. Step S308, comparing whether the judgment result of the fuzzy short message by each arbitration module is the same as the judgment result of the fuzzy short message by the interface unit, if the same, determining that the judgment result by the arbitration module for the fuzzy short message is correct, otherwise determining that the error is incorrect . Step S309: After the arbitration module runs for a period of time, the weight learning is performed. The period is the default system running time, which can be 1 hour, and the current arbitration module determines the correct rate and the first time during the calculated period. For a comparison of expected values, the first expected value here may be set to 50%; if the probability of the current arbitration module determining that the correctness is greater than 50%, the arbitration weight of the current arbitration module is increased, for example, the arbitration weight of the next stage is increased by 0.1; If the current arbitration module judges that the correct phase ratio is less than 50%, the arbitration weight of the current arbitration module is reduced, for example, the arbitration weight of the next stage is reduced by 0.1; the modified arbitration weight is sent to the interface unit, and the interface machine performs The renewal of the arbitration weight. Here, the calculation of the current arbitration module determines that the correct rate is: the probability that the current arbitration module judges correctly = the total number of messages/judged messages that are determined by the respective arbitration modules for the fuzzy short message. Step S310: After the interface machine runs for a period of time, the period of time refers to the default system running time, which may be 1 hour, and compares the calculated probability of the violation short message with the second expected value during the period, where the second The expected value can be initially set to 40%, but not more than 50%; if the probability of the violation short message is less than 1 times of the second expected value, then the current first threshold is reduced, such as reducing the first threshold by 5; If the 3⁄4⁄4 rate of the short message is greater than the second expected value by one time, the current first threshold is increased, for example, the first threshold is increased by 5; and the fourth modified threshold is sent to each arbitration module, and each arbitration is performed. The module updates the first threshold. Step S311: Write a result of the percentage of the violation short message to the total message within 24 hours every day, and the file is a file including the judgment result of the interface unit for the fuzzy short message, and observe whether the judgment result converges within a range, if the convergence The range is small, and around the second expected value, such as convergence in the upper and lower 20% of the second expected value, the system's arbitration weight and the first and second threshold training results are considered normal; if the result is divergent, then After the second expected value is modified, the training is performed, and the judgment result is observed one day later and the corresponding processing is performed. In summary, according to the present invention, it takes a certain time to perform training in the initial stage of the system operation, but after training the optimal expected value and the arbitration weight, the automatic arbitration result of the fuzzy short message is compared with the existing manual. Judgment has been greatly improved, including the accuracy and automation of judgment. It is a good complement to the existing short message monitoring system. At the same time, it can analyze some behavior habits of users sending spam messages, and provides some risks for improving existing systems. Since the existing short message monitoring system can only monitor based on the traffic rules or the keyword rules of the single ticket, that is, the keyword rules configured in the human-computer interaction unit mentioned above, it is easy to disable the monitoring and monitor There are fewer and fewer short messages. If the threshold of traffic reduction is reduced, the number of monitored short messages will increase by an order of magnitude, and the workload of manual operation and maintenance will be large. The content of new violation short messages is endless. Only adding limited and individual keywords will not meet the monitoring requirements. In particular, some new content violation short message delivery modes are difficult to configure only keywords for monitoring. The invention greatly improves the performance of the system by increasing the complex operation relationship between the keywords; and the monitoring system of the present invention automatically learns the arbitration weight through the machine based on the interaction between the arbitration module and the interface unit, thereby A reliable arbitration result can be obtained, which is a great improvement for the existing monitoring system. In addition, the present invention classifies and arbitrates the short message of the violation, and arbitrates the short message that does not contain the specific keyword in the message content, and the fuzzy short message is automatically arbitrated by the arbitration module. The message content of the message, the type of the main and called numbers, the type of the main and the called number, and the like, are comprehensively analyzed. Finally, whether the fuzzy short message is a junk short message is judged, and the present invention is adopted than the existing monitoring system. The single maintenance personnel carry out manual and subjective judgment programs, and the accuracy and efficiency are greatly improved. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device, or they may be separately fabricated into individual integrated circuit modules, or they may be Multiple modules or steps are made into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. It will be apparent to those skilled in the art that various modifications and changes can be made in the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A short message monitoring system, the system comprising: an interface unit and an arbitration unit;

The interface unit is configured to forward the fuzzy short message to the arbitration unit for arbitration; perform weighting operation according to the matched arbitration results returned by the arbitration unit; and determine that the operation result is less than the set first threshold value The fuzzy short message is a violation short message; the arbitration unit is configured to obtain a fuzzy short message by forwarding by the interface unit; respectively, matching the fuzzy short message according to different categories of arbitration rules, and matching each of the arbitrated short messages The result is returned to the interface unit.

The system according to claim 1, wherein the arbitration rule comprises: a keyword rule, a user number type information rule, and a user number segment information rule.

The system according to claim 2, wherein the arbitration unit further comprises at least two arbitration modules, and the arbitration rules respectively included in each arbitration module belong to different categories; And matching the fuzzy short message according to the arbitration rules respectively included, and returning each of the matched arbitration results to the interface unit.

The system according to claim 3, wherein each of the arbitration modules is further configured to determine the fuzzy short message according to the respective arbitration results, and obtain the fuzzy by each arbitration module The result of the short message;

Acquiring the judgment result of the fuzzy short message by using the interface unit, in the set system running time, increasing the arbitration right of the current arbitration module when the probability that the current arbitration module and the interface unit determine the same result is greater than the first expected value If the probability that the current arbitration module and the interface unit determine the same result is less than the first expected value, the arbitration weight of the current arbitration module is reduced; and the 4 modified arbitration weight is returned to the interface unit to update the arbitration weight.

The system according to claim 3 or 4, wherein the interface unit is further configured to perform the weighting operation as: ^Result. x<w.

Result= '=i ; where Result is the result of the operation, ^Result ' is the result of each arbitration, ^ is the arbitration weight of each arbitration module, and n is the number of arbitration modules.

The system according to claim 4, wherein each of the arbitration modules is further configured to determine that the fuzzy short message is a violation short message when the arbitration result is greater than a set second threshold value. Wherein the second threshold is 1/n times the first threshold; n is the number of arbitration modules.

The system according to claim 5, wherein the interface unit is further configured to: during the set system running time, determine, by the interface unit, that the phase ratio of the violation short message is greater than the second expected value by one time. In the state, the current first threshold is increased; when the interface unit determines that the probability of the violation short message is less than 1 time of the second expected value, the current first threshold is decreased; and the modified first threshold is returned to the respective arbitration The module is updated.

A short message monitoring method, the method comprising:

The arbitration unit respectively matches the fuzzy short message according to different types of arbitration rules, and returns the matched arbitration results to the interface unit;

The interface unit performs a weighting operation according to each of the matched arbitration results; when the operation result 'J, at the set first threshold, it is determined that the fuzzy short message is a violation short message.

The method according to claim 8, wherein the arbitration rule comprises: a keyword rule, a user number type information rule, and a user number segment information rule.

The method according to claim 9, wherein when the arbitration unit includes at least two arbitration modules, and the arbitration rules respectively included in each arbitration module belong to different categories, the arbitration unit Performing the matching further includes: each arbitration module respectively matching the fuzzy short message according to the arbitration rule respectively included, and returning each of the matched arbitration results to the interface unit.

The method according to claim 10, wherein the interface unit performs a weighting operation according to each of the matched arbitration results; when the operation result is less than the set first threshold, determining that the fuzzy short message is a violation After the short message, the method further includes:

A. Each of the arbitration modules respectively shorts the blur according to the respective arbitration results The message is judged, and the judgment result of the fuzzy short message by each arbitration module is obtained;

B. Obtain a judgment result of the fuzzy short message by using the interface unit. In a set system running time, if the rate at which the current arbitration module and the interface unit determine the same result is greater than the first expected value, increase the current arbitration module. Arbitration weight; when the probability that the current arbitration module and the interface unit determine the same result is less than the first expected value, reduce the arbitration weight of the current arbitration module; and return the 4 modified arbitration weight to the interface unit for arbitration Update of value;

C. The interface unit performs a weighting operation according to the returned updated arbitration weight value, and continues to perform the determination for the fuzzy short message.

The method according to claim 10 or 11, wherein the interface unit performs

^Result. x<w.

The operation formula used in the weighting operation is: Result= '=i ;

Result is the result of the operation, and ^Result < is the arbitration result, which is the arbitration weight of each arbitration module, and n is the number of arbitration modules.

The method according to claim 11, wherein, in the A, the determining, by the respective arbitration modules, the fuzzy short message according to the respective arbitration results, further comprising:

When the arbitration result is greater than the set second threshold, determining that the fuzzy short message is a violation short message; wherein, the second threshold is 1/n times the first threshold; n is arbitration The number of modules.

The method according to claim 12, wherein after the C, the method further comprises:

In the set system running time, when the interface unit determines that the rate of the violation short message is greater than the second expected value by one time, the current first threshold is increased; and the interface unit determines that the violation short message is 4 When the rate is less than 1 time of the second expected value, the current first threshold is decreased; the modified first threshold is returned to each arbitration module for updating.