WO2011127692A1 - 一种短消息监控装置及方法 - Google Patents

一种短消息监控装置及方法 Download PDF

Info

Publication number
WO2011127692A1
WO2011127692A1 PCT/CN2010/074745 CN2010074745W WO2011127692A1 WO 2011127692 A1 WO2011127692 A1 WO 2011127692A1 CN 2010074745 W CN2010074745 W CN 2010074745W WO 2011127692 A1 WO2011127692 A1 WO 2011127692A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
balance
monitoring
rule
query
Prior art date
Application number
PCT/CN2010/074745
Other languages
English (en)
French (fr)
Inventor
庞磊
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2011127692A1 publication Critical patent/WO2011127692A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/83—Notification aspects
    • H04M15/85—Notification aspects characterised by the type of condition triggering a notification
    • H04M15/857—Cumulative charges
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/58—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP based on statistics of usage or network monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/82—Criteria or parameters used for performing billing operations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/82—Criteria or parameters used for performing billing operations
    • H04M15/8221—Message based
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/83—Notification aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/83—Notification aspects
    • H04M15/85—Notification aspects characterised by the type of condition triggering a notification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/88—Provision for limiting connection, or expenditure
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/212—Monitoring or handling of messages using filtering or selective blocking
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/58—Message adaptation for wireless communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M2215/00—Metering arrangements; Time controlling arrangements; Time indicating arrangements
    • H04M2215/28—SMS billing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/08—Testing, supervising or monitoring using real traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/10—Scheduling measurement reports ; Arrangements for measurement reports
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Definitions

  • the present invention relates to the field of short message monitoring technologies, and in particular, to a short message monitoring apparatus and method.
  • short message service has become more and more important as a basic service of mobile communication networks by system operators and users.
  • the means by which operators, profit-making groups and individuals use the message center for promotion are endless; the activities of interconnection between networks are like fire; the amount of news on the Internet is also growing geometrically.
  • the development of short message service while making a considerable profit for operators, provides users with convenient messaging services, and also provides a channel for the spread of spam messages. At present, spam messages have become more and more powerful and have become a major public nuisance.
  • a large number of malicious messages and advertisement messages not only annoy the users, but also may cause the operator's operating environment to be paralyzed; some malicious users even use the delay of the operator's billing system to send a large number of short messages when the arrears are close. In turn, operators suffer huge economic losses.
  • Another object of the present invention is to provide a short message monitoring method for solving the problem that the current short message monitoring system for capturing suspicious users is too simple to meet the monitoring requirements of normal users and malicious users.
  • the short message monitoring device of the present invention includes a rule definition module and an analysis module, wherein the rule definition module is configured to pre-configure the monitoring rule, and includes a monitoring gate for monitoring the traffic within the rule duration.
  • the limit and balance thresholds are configured; the analysis module is configured to count and analyze the number of short messages sent by the user, and when the number of short messages sent by the user reaches the monitoring threshold, the balance of the user is queried, and the balance of the user is less than the configured balance. When the threshold is reached, the user is identified as a suspicious user.
  • the analysis module includes a statistics unit, a query unit, and a comparison unit, where the statistics unit is configured to perform statistics on all short messages sent by the user within the current rule duration, and notify the query when the number of short messages sent by the user reaches the monitoring threshold.
  • the unit queries the balance of the user; the query unit is configured to query the business operation support system for the balance of the user; the comparison unit is configured to compare the balance of the user queried by the query unit with the balance threshold, and when the balance of the user is less than the balance threshold, The user ID is a suspicious user.
  • the rule definition module is further configured to set a rule duration and a time granularity, where the rule duration is an integer multiple of the time granularity; the current rule duration is the end time of the granularity of the current time point, and the rule duration is pushed forward.
  • the rule definition module is further configured to set a query interval; the query unit in the analysis module is further configured to query the service operation support system for the user when the time when the balance of the user is last queried is greater than the set query interval. Balance.
  • the short message monitoring apparatus further includes:
  • a display module that is set to display user information of the suspicious user.
  • the method for monitoring short messages of the present invention comprises the following steps:
  • Pre-configure monitoring rules including monitoring thresholds and balance thresholds for traffic monitoring within the pre-configured rule duration;
  • the number of short messages sent by the user is counted and analyzed.
  • the balance of the user is queried, and when the balance of the user is less than the set threshold, the user is identified as a suspicious user.
  • the step of counting and analyzing the number of short messages sent by the user is to count the number of all short messages sent by the user within the current rule duration; the step of querying the balance of the user is to query the business operation support system for the balance of the user.
  • the short message monitoring method further includes the following steps:
  • the short message monitoring method further includes the following steps:
  • the query interval is set in advance, and the user balance information is queried to the business operation support system when the time from the last query of the user balance is greater than the set query interval.
  • the short message monitoring method further includes the following steps: displaying user information of the suspicious user.
  • the beneficial effects of the present invention are: According to the short message monitoring apparatus and method of the present invention, by introducing a query for the user balance in the monitoring process, in the case that the monitoring system monitors all users for short message traffic, the normal operation can be guaranteed.
  • the communication needs of the user can also effectively control the number of short messages sent by users whose balance is too low, thereby avoiding the situation that malicious arrears users use the loopholes of the billing system to send spam messages in a large amount, which can be more comprehensively
  • the user monitors and effectively implements the arrears control.
  • FIG. 1 is a schematic structural diagram of a short message monitoring system according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a short message monitoring method according to an embodiment of the present invention.
  • the core idea of the present invention is: counting and counting the number of short messages sent by the user based on the monitoring rule.
  • the user balance obtained by the query is The balance threshold of the rule (set according to the reputation) is compared, if the user balance is less than the set balance threshold, the user is identified as a suspicious user.
  • the rule duration refers to:
  • the monitoring duration of a monitoring rule must be a multiple of the time granularity, which is calculated in terms of time granularity. For example, 1 time granularity, 2 time granularities, and the like. Therefore, one rule time can contain one or more time granularities.
  • Time granularity used to indicate the set length of time, which is the basic unit of monitoring duration, such as 10 minutes, 1 hour, and so on.
  • Time granularity The start time is the granularity start time, and the start time of the time granularity plus the time granularity is the granularity end time.
  • the monitoring rule is a rule based on the analysis and determination of the user message by the analysis module in the monitoring system.
  • the parameters of the monitoring threshold, time granularity, and rule duration are mainly specified.
  • Traffic monitoring is to monitor the short message volume within the rule duration. It uses the preset threshold for traffic monitoring as the basis for monitoring. The monitoring is performed according to the preset monitoring threshold of the traffic monitoring, that is, when the short message volume sent by the user within the rule duration is greater than or equal to the threshold of the traffic monitoring, the corresponding user is considered as a suspicious user, thereby limiting the suspicious user to send the short message. the behavior of.
  • the short message monitoring apparatus of the present invention comprises: a rule definition module and an analysis module.
  • the rule definition module is configured to configure at least one monitoring rule.
  • the monitoring threshold and the threshold of the traffic monitoring are configured in the rule duration, and the query interval, the rule duration, and the time granularity are further configured, where the rule duration is an integer multiple of the time granularity.
  • the monitoring rule may be configured with one or more rules, and different monitoring rules may configure different monitoring thresholds, rule durations, and time granularities according to different credibility.
  • the analyzing module is configured to perform counting analysis on the number of short messages sent by the user, and when the number of short messages sent by the user reaches the monitoring threshold, query the balance of the user, and when the balance of the user is less than the set threshold, The user ID is a suspicious user.
  • the analysis module includes: a statistical unit, a query unit, and a comparison unit.
  • the statistics unit is configured to collect statistics on the number of all short messages sent by the user within the current rule duration, and notify the query unit to query the balance of the user when the number of short messages sent by the user reaches the monitoring threshold; the current rule duration is current The end time of the time granularity at the time point is pushed forward by a rule duration.
  • a query unit configured to query user service support system for user balance information
  • the comparing unit is configured to compare the user balance information queried by the query unit with the balance threshold, and when the balance of the user is less than the balance threshold, identify the user as a suspicious user.
  • the current rule duration is a rule duration of the time granularity of the current time point.
  • rule definition module further set the query interval, and the query unit in the analysis module, Further, when the time from the last query of the user balance is greater than the set query interval, the user balance information is queried to the business operation support system.
  • the short message monitoring apparatus of the present invention may further include: a display module, configured to display the monitored user information of the suspicious user.
  • FIG. 1 is a schematic structural diagram of a short message monitoring system according to an embodiment of the present invention.
  • a console (Human Machine Interface) 201 is used for monitoring the configuration of rules and the like and displaying the user information, that is, the console combines the functions of the rule definition module and the display module.
  • data can be configured, such as the configuration of monitoring rules, and the suspicious user information monitored by the monitoring system can be displayed. After the console's data configuration is complete, it will be synchronized to the analysis module and the database management operation module.
  • the analyzing module 202 is configured to receive the message of the short message center, perform counting and counting according to the monitoring rule configured by the console, and when the threshold of the traffic monitoring configured by the console is reached, query the BOSS 205 for the balance of the user through the socket interface, if the balance If the credit is less than the credibility in the rule, the user is considered suspicious, and the user information of the user is sent to the database management operation module 203 to perform the operation of inserting the database 204, so as to record the user information.
  • the database management operation module 203 is mainly configured to record the suspicious user data sent by the received analysis module 202 into the database 204, thereby providing data for operations such as post-query of the console 201.
  • the short message monitoring method of the present invention comprises the following steps:
  • Step 100 Pre-configure the monitoring rule, including configuring the monitoring threshold and the balance threshold according to the traffic monitoring within the rule duration;
  • Step 200 Perform counting analysis on the number of short messages sent by the user, and when the number of short messages sent by the user reaches the monitoring threshold, query the balance of the user, and when the balance of the user is less than the set threshold, The user ID is a suspicious user.
  • step 200 counting and analyzing the number of short messages sent by the user is performed by counting the number of all short messages sent by the user within the current rule duration; querying the balance of the user is querying the user balance of the business operation support system. information.
  • the rule duration and the time granularity may be further preset, where The rule duration is an integer multiple of the time granularity; the current rule duration is the end time of the time granularity of the current time point.
  • the query interval may be set in advance; in step 200, the user balance information is queried to the business operation support system when the time from the last query of the user balance is greater than the set query interval.
  • steps may be further included: displaying user information of the suspicious user.
  • FIG. 2 it is a flowchart of a short message monitoring method according to an embodiment of the present invention, which specifically includes the following steps:
  • Count according to the configured monitoring rule, the number of short messages sent by the user, that is, each time the user sends a short message, for all rules, add one to the statistical value of the current granularity of each rule (normally, the counter) No overflow), then proceed to the next step S103.
  • 5105 Compare the statistical value in S104 with the threshold value of the current rule. If the statistical value reaches the rule threshold, execute S106; otherwise, execute S107.
  • the short message monitoring apparatus and method of the present invention by introducing a query for the user balance in the monitoring process, it is possible to treat different users according to different levels of user balances, according to different settings in multiple rules. Credibility, the traffic threshold used for monitoring users with different balances is also different. In this way, when the monitoring system monitors all users for short message traffic, it can not only ensure the communication needs of normal users, but also effectively control the number of short messages sent by users with low balances, thereby avoiding malicious arrears. Users use the vulnerabilities of the billing system to send spam messages in large quantities. In short, in the process of monitoring, different monitoring thresholds are applied to users with different balances, so that users can be monitored more comprehensively, and arrears control is effectively realized.
  • the query of the user balance can be introduced in the monitoring process, so that by monitoring the short message traffic of the user, the communication requirement of the normal user can be ensured, and the balance can be effectively low.
  • the number of short messages sent by the user is controlled, thereby avoiding the situation that the malicious arrears users use the loopholes of the billing system to send a large amount of spam messages, and can more comprehensively monitor the users, and effectively realize the arrears control.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • General Business, Economics & Management (AREA)
  • Business, Economics & Management (AREA)
  • Probability & Statistics with Applications (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Telephonic Communication Services (AREA)
  • Mobile Radio Communication Systems (AREA)

Description

一种短消息监控装置及方法
技术领域
本发明涉及短消息监控技术领域，特别涉及一种短消息监控装置及方法。
背景技术
近年来， 短消息服务作为移动通讯网络的一种基本业务已越来越多地受 到系统运营商和广大用户的重视。 各个运营商、 盈利集团和个人利用消息中 心进行促销的手段层出不穷； 各网络之间互联互通的活动如火如茶； 网上流 动的消息量也随之成几何级数增长。 短消息业务的发展， 在为运营商賺取可 观的利润， 为用户提供便捷的消息通讯服务的同时， 也为垃圾短信的传播提 供了渠道。 目前， 垃圾短信有着愈演愈烈之势， 已成为社会一大公害。 大量 的恶意消息、 广告消息不仅使用户烦不胜烦， 而且还有可能导致运营商的运 营环境瘫痪； 某些恶意用户甚至利用运营商计费系统的延迟， 在接近欠费时 发送大量短消息， 进而使运营商蒙受巨额的经济损失。
为此， 需要找到一种方法， 能够对短消息进行监控， 从而避免恶意用户 在接近欠费时发送大量短消息， 进而使运营商蒙受巨额的经济损失。
发明内容
本发明的目的在于， 提供一种短消息监控装置， 以解决当前短消息监控 系统中对于捕获可疑用户的策略过于简单， 无法同时满足正常用户和恶意欠 费用户的监控需求问题。
本发明的另一目的在于， 提供一种短消息监控方法， 以解决当前短消息 监控系统中对于捕获可疑用户的策略过于简单， 无法同时满足正常用户和恶 意欠费用户的监控需求问题。
本发明的短消息监控装置， 包括规则定义模块和分析模块， 其中， 规则 定义模块设置为预先配置监控规则， 包括对规则时长内按流量监控的监控门 限、 余额门限进行配置； 分析模块设置为对用户发送的短消息数进行计数分 析， 在用户发送的短消息数达到监控门限时， 查询该用户的余额， 并在该用 户的余额小于配置的余额门限时， 将该用户标识为可疑用户。
上述分析模块包括统计单元、 查询单元和比较单元， 其中， 统计单元设 置为对用户在当前规则时长内发送的所有短消息数进行统计， 并在用户发送 的短消息数达到监控门限时， 通知查询单元查询该用户的余额； 查询单元设 置为向业务运营支撑系统查询用户的余额； 比较单元设置为将查询单元查询 的用户的余额与余额门限进行比较， 在该用户的余额小于余额门限时， 将该 用户标识为可疑用户。
上述规则定义模块还设置为设置规则时长和时间粒度， 其中， 规则时长 为时间粒度的整数倍； 当前规则时长为当前时间点所在时间粒度的结束时间 往前推一个规则时长。
优选地， 上述规则定义模块还设置为设置查询间隔； 上述分析模块中的 查询单元还设置为在距上次查询该用户的余额的时间大于设置的查询间隔 时， 向业务运营支撑系统查询用户的余额。
优选地， 上述短消息监控装置还包括：
显示模块， 其设置为显示可疑用户的用户信息。
本发明的短消息监控的方法， 包括下列步骤：
预先配置监控规则， 包括预先配置规则时长内按流量监控的监控门限、 余额门限；
对用户发送的短消息数进行计数分析， 在用户发送的短消息数达到监控 门限时， 查询该用户的余额， 并在该用户的余额小于设定的余额门限时， 将 用户标识为可疑用户。
其中， 对用户发送的短消息数进行计数分析的步骤为对用户在当前规则 时长内发送的所有短消息数进行统计； 查询用户的余额的步骤为向业务运营 支撑系统查询用户的余额。
优选地， 上述短消息监控方法还包括下列步骤：
预先设置规则时长和时间粒度， 其中， 规则时长为时间粒度的整数倍； 当前规则时长为当前时间点所在时间粒度的结束时间往前推一个规则时长。 优选地， 上述短消息监控方法还包括下列步骤：
预先设置查询间隔， 并在距上次查询该用户余额的时间大于设置的查询 间隔时， 向业务运营支撑系统查询用户余额信息。
优选地， 上述短消息监控方法还包括下列步骤： 显示可疑用户的用户信 息。
本发明的有益效果是： 依照本发明的短消息监控装置及方法， 通过在监 控过程中引入对用户余额的查询， 这样在监控系统对所有用户进行短消息流 量监控的情况下， 既可以保证正常用户的通信需求， 同时也能有效地对余额 过低的用户发送的短消息的数量进行控制， 进而避免了恶意欠费用户利用计 费系统的漏洞大量发送垃圾短信的情况， 可以更全面地对用户进行监控， 同 时也有效地实现了欠费控制。
附图概述
图 1为本发明实施例的短消息监控系统的架构示意图；
图 2为本发明实施例的短消息监控方法的流程图。
本发明的较佳实施方式
以下， 参考附图 1~2详细描述本发明的短消息监控装置及方法。
本发明的核心思想是： 基于监控规则对用户发送的短消息数进行计数统 计， 用户在当前规则时长中所发送的短消息总数达到某一监控规则的流量门 限时， 将查询所得的用户余额与该规则的余额门限（根据信誉度而设定）相 比较， 如果用户余额小于设定的余额门限， 则将该用户标识为可疑用户。
其中， 规则时长是指： 一条监控规则的监控时长， 必须是时间粒度的倍 数， 它以时间粒度为计算单位。 例如 1个时间粒度、 2个时间粒度等。 因此 一个规则时长内可以包含有 1个或多个时间粒度。 时间粒度， 用来表示设定 的时间长度， 它是监控时长的基本单位， 如 10分钟、 1小时等。 时间粒度的 起始时间为粒度开始时间 , 时间粒度的起始时间加上时间粒度为粒度结束时 间。
监控规则， 是监控系统中的分析模块对用户消息进行分析判定所依据的 规则， 其中主要规定了监控的门限、 时间粒度、 规则时长等参数。
流量监控， 是对规则时长内的短消息量进行监控， 它以预先设置的按流 量监控的门限作为监控基础。 根据预先设置的按流量监控的监控门限进行监 控，即当用户在规则时长内发送的短消息量大于或等于按流量监控的门限时， 就认为相应用户为可疑用户， 进而限制可疑用户发送短消息的行为。
本发明的短消息监控装置， 包括： 规则定义模块和分析模块。 其中， 规 则定义模块， 用于配置至少一条监控规则。 其中， 对规则时长内按流量监控 的监控门限、 余额门限进行配置， 以及进一步对查询间隔、 规则时长和时间 粒度进行配置， 其中， 所述规则时长为所述时间粒度的整数倍。 所述监控规 则可配置一条或多条， 多条监控规则中可根据不同的信誉度配置不同的监控 门限、 规则时长和时间粒度等。
分析模块， 用于对用户发送的短消息数进行计数分析， 在用户发送的短 消息数达到监控门限时， 查询该用户的余额， 并在该用户的余额小于设定的 余额门限时， 将该用户标识为可疑用户。
具体地， 该分析模块包括： 统计单元、 查询单元和比较单元。
其中， 统计单元， 用于对用户在当前规则时长内发送的所有短消息数进 行统计， 并在用户发送的短消息数达到监控门限时， 通知查询单元查询该用 户的余额； 当前规则时长为当前时间点所在时间粒度的结束时间往前推一个 规则时长。
查询单元， 用于向业务运营支撑系统查询用户余额信息；
比较单元， 用于将查询单元查询的用户余额信息与余额门限进行比较， 在该用户的余额小于余额门限时， 将该用户标识为可疑用户。
另外， 在规则定义模块中， 进一步设置规则时长和时间粒度时， 当前规 则时长为当前时间点所在时间粒度的结束时间往前推一个规则时长。
此外， 在规则定义模块， 进一步设置查询间隔， 分析模块中的查询单元， 进一步用于在距上次查询该用户余额的时间大于所述设置的查询间隔时， 向 业务运营支撑系统查询用户余额信息。
另外， 本发明的短消息监控装置可以进一步包括： 显示模块， 用于显示 监测出的可疑用户的用户信息。
如图 1所示， 为本发明实施例的短消息监控系统的架构示意图。
控制台（人机交互界面） 201 , 用于监控规则等的配置以及用户信息的显 示， 即该控制台结合了规则定义模块和显示模块的功能。 在该控制台上， 既 可以进行数据的配置， 如监控规则的配置， 又可以将监控系统所监控到的可 疑用户信息进行显示。 控制台的数据配置完成后， 将同步给分析模块和数据 库管理操作模块。
分析模块 202 , 用于接收短消息中心的消息， 按照控制台配置的监控规 则进行计数统计， 当达到控制台配置的流量监控的门限时， 就通过 socket接 口向 BOSS 205查询用户的余额， 如果余额小于规则中的信誉度则认为用户 可疑， 并将该用户的用户信息发送给数据库管理操作模块 203进行插入数据 库 204操作， 目的在于对用户信息进行记录。
数据库管理操作模块 203 , 主要用于将接收到的分析模块 202所发送的 可疑用户数据记入数据库 204, 从而为控制台 201 的事后查询等操作提供数 据。
本发明的短消息监控方法， 包括下列步骤：
步骤 100: 预先配置监控规则， 包括对规则时长内按流量监控的监控门 限、 余额门限进行配置；
步骤 200: 对用户发送的短消息数进行计数分析， 在用户发送的短消息 数达到所述监控门限时， 查询该用户的余额， 并在该用户的余额小于设定的 余额门限时， 将所述用户标识为可疑用户。
其中， 在步骤 200中， 对用户发送的短消息数进行计数分析， 是对该用 户在当前规则时长内发送的所有短消息数进行统计； 查询用户的余额， 是向 业务运营支撑系统查询用户余额信息。
另外， 在步骤 100中， 可以进一步预先设置规则时长和时间粒度， 其中， 规则时长为时间粒度的整数倍； 当前规则时长为当前时间点所在时间粒度的 结束时间往前推一个规则时长。
此外， 在步骤 100中， 可以预先设置查询间隔； 在步骤 200中， 在距上 次查询该用户余额的时间大于所述设置的查询间隔时， 向业务运营支撑系统 查询用户余额信息。
另外， 还可以进一步包括下列步骤： 显示可疑用户的用户信息。
如图 2所示， 为本发明实施例的短消息监控方法的流程图， 具体包括下 列步骤：
5101 , 接收短信中心的监控请求， 获取短消息受控结构体， 根据该短消 息受控结构体解析出起呼用户号码， 然后执行下一步 S102。
5102, 基于所配置的监控规则， 对该用户所发送的短信数量计数， 即该 用户每发送一条短消息， 对于所有规则， 在各规则当前所处粒度的统计值上 加一（正常情况下计数器没有溢出） ， 然后执行下一步 S103。
5103 , 从上述配置的监控规则中取出一条监控规则。 取出的该条监控规 则将为以下的计数过程提供依据， 然后执行下一步 S104。
5104 , 基于当前监控规则对该起呼用户发送的短消息进行统计， 即计算 包括当前粒度在内的一个规则时长中各粒度所发送的消息总和， 然后执行下 一步 S105。
5105 ,将 S104中的统计值与当前规则的门限值作比较，如果统计值达到 规则门限， 执行 S106; 否则， 执行 S107。
5106, 判断监控系统是否第一次向 BOSS查询该用户的余额， 如果是第 一次， 执行 S108; 否则， 执行 S109。
5107 , 判断是否还有未取的其它监控规则， 如果是， 返回执行 S103 , 继 续分析是否违反其它规则； 否则， 该用户当前正常， 结束此次流程， 等待接 收短信中心的监控请求触发新的流程；
5108, 向业务运营支撑系统（BOSS )发送余额查询请求， BOSS返回查 询结果， 然后执行下一步 S110。 其中， 查询用户余额的过程是通过 BOSS提 供的 socket接口来实现的。 5109 , 判断距上次查询该用户余额的时间是否大于当前规则中的查询间 隔， 如果是， 执行 S108; 否则， 执行 S110。
5110 , 比较该用户余额和当前规则中的信誉度， 如果用户余额小于信誉 度， 将该用户置为可疑用户， 结束此次流程， 等待接收短信中心的监控请求 触发新的流程； 否则， 执行 S107。
综上所述， 依照本发明的短消息监控装置及方法， 通过在监控过程中引 入对用户余额的查询，可以针对所有用户根据用户余额的不同分级区别对待， 根据多条规则中设定的不同信誉度， 对余额不同的用户监控时所使用的流量 门限也不同。 这样在监控系统对所有用户进行短消息流量监控的情况下， 既 可以保证正常用户的通信需求， 同时也能有效的控制余额过低的用户发送的 短消息数量进行控制， 进而避免了恶意欠费用户利用计费系统的漏洞大量发 送垃圾短信的情况。 总之， 在监控的过程中对余额不同的用户运用不同的监 控门限， 这样就可以更全面地对用户进行监控， 同时也有效地实现了欠费控 制。
以上是为了使本领域普通技术人员理解本发明， 而对本发明所进行的详 细描述， 但可以想到， 在不脱离本发明的权利要求所涵盖的范围内还可以做 出其它的变化和修改， 这些变化和修改均在本发明的保护范围内。
工业实用性
釆用本发明的短消息监控装置及方法， 可以在监控过程中引入对用户余 额的查询， 从而通过监控用户短消息流量， 既可以保证正常用户的通信需求， 也能有效地对余额过低的用户发送的短消息的数量进行控制， 进而避免了恶 意欠费用户利用计费系统的漏洞大量发送垃圾短信的情况， 可以更全面地对 用户进行监控， 同时也有效地实现了欠费控制。

Claims

权 利 要 求 书
1. 一种短消息监控装置， 包括规则定义模块和分析模块， 其中， 所述规则定义模块设置为预先配置监控规则， 包括预先配置规则时长内 按流量监控的监控门限、 余额门限； 以及
所述分析模块其设置为对用户发送的短消息数进行计数分析， 在用户发 送的短消息数达到所述监控门限时， 查询所述用户的余额， 并在所述用户的 余额小于所述余额门限时， 将所述用户标识为可疑用户。
2. 如权利要求 1所述的短消息监控装置， 其中， 所述分析模块包括统计 单元、 查询单元和比较单元， 其中，
所述统计单元设置为对所述用户在当前规则时长内发送的所有短消息数 进行统计， 并在所述用户发送的短消息数达到所述监控门限时， 通知所述查 询单元查询所述用户的余额；
所述查询单元设置为向业务运营支撑系统查询所述用户的余额； 所述比较单元设置为将所述查询单元查询的所述用户的余额与所述余额 门限进行比较， 在所述用户的余额小于所述余额门限时， 将所述用户标识为 可疑用户。
3. 如权利要求 2所述的短消息监控装置， 其中，
所述规则定义模块还设置为设置规则时长和时间粒度， 其中， 所述规则 时长为所述时间粒度的整数倍； 所述当前规则时长为当前时间点所在时间粒 度的结束时间往前推一个所述规则时长。
4. 如权利要求 2或 3所述的短消息监控装置， 其中，
所述规则定义模块还设置为设置查询间隔；
所述分析模块中的查询单元还设置为在距上次查询所述用户的余额的时 间大于设置的查询间隔时， 向所述业务运营支撑系统查询所述用户的余额。
5. 如权利要求 4所述的短消息监控装置， 还包括：
显示模块， 其设置为显示可疑用户的用户信息。
6. 一种短消息监控的方法， 包括下列步骤： 预先配置监控规则， 包括预先配置规则时长内按流量监控的监控门限、 余额门限； 以及
对用户发送的短消息数进行计数分析， 在用户发送的短消息数达到所述 监控门限时， 查询所述用户的余额， 并在所述用户的余额小于配置的余额门 限时， 将所述用户标识为可疑用户。
7. 如权利要求 6所述的短消息监控的方法， 其中，
对用户发送的短消息数进行计数分析的所述步骤为： 对所述用户在当前 规则时长内发送的所有短消息数进行统计；
查询所述用户的余额的所述步骤为： 向业务运营支撑系统查询所述用户 的余额。
8. 如权利要求 6所述的短消息监控的方法， 还包括下列步骤： 预先设置规则时长和时间粒度， 其中， 所述规则时长为所述时间粒度的 整数倍； 当前规则时长为当前时间点所在时间粒度的结束时间往前推一个所 述规则时长。
9. 如权利要求 6所述的短消息监控的方法， 还包括下列步骤： 预先设置查询间隔， 并在距上次查询所述用户的余额的时间大于设置的 查询间隔时， 向业务运营支撑系统查询所述用户的余额。
10. 如权利要求 6 所述的短消息监控的方法， 还包括下列步骤： 显示可 疑用户的用户信息。
PCT/CN2010/074745 2010-04-14 2010-06-29 一种短消息监控装置及方法 WO2011127692A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010146258.4 2010-04-14
CN201010146258A CN101827328A (zh) 2010-04-14 2010-04-14 一种短消息监控装置及方法

Publications (1)

Publication Number Publication Date
WO2011127692A1 true WO2011127692A1 (zh) 2011-10-20

Family

ID=42690983

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/074745 WO2011127692A1 (zh) 2010-04-14 2010-06-29 一种短消息监控装置及方法

Country Status (2)

Country Link
CN (1) CN101827328A (zh)
WO (1) WO2011127692A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101768743B1 (ko) * 2010-10-04 2017-08-16 헤드워터 리서치 엘엘씨 사용자 통지를 제공하는 시스템 및 방법
CN102231888A (zh) * 2011-06-24 2011-11-02 中兴通讯股份有限公司 一种监控方法和装置
CN103325058A (zh) * 2013-05-23 2013-09-25 亚信联创科技（中国）有限公司 一种账户预算控制的方法和装置
CN104243227A (zh) * 2013-06-21 2014-12-24 宁夏新航信息科技有限公司 一种智能化流量监控方法
CN105873004A (zh) * 2015-01-23 2016-08-17 卓望数码技术（深圳）有限公司 一种基于用户信用的移动通信业务计费方法及计费系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030216147A1 (en) * 2002-05-15 2003-11-20 Telefonaktiebolaget L M Ericsson (Publ) Signed Real time charging of delivery and receipt of short message service in a telecommunications network
CN101330661A (zh) * 2008-07-07 2008-12-24 中国联合通信有限公司 一种网间漫游用户的短信计费方法及系统
CN101340628A (zh) * 2008-08-12 2009-01-07 中国移动通信集团江苏有限公司 一种点对点短消息欠费风险控制的方法和系统
CN101674540A (zh) * 2008-09-10 2010-03-17 中国移动通信集团上海有限公司 一种短信发送控制方法、装置及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030216147A1 (en) * 2002-05-15 2003-11-20 Telefonaktiebolaget L M Ericsson (Publ) Signed Real time charging of delivery and receipt of short message service in a telecommunications network
CN101330661A (zh) * 2008-07-07 2008-12-24 中国联合通信有限公司 一种网间漫游用户的短信计费方法及系统
CN101340628A (zh) * 2008-08-12 2009-01-07 中国移动通信集团江苏有限公司 一种点对点短消息欠费风险控制的方法和系统
CN101674540A (zh) * 2008-09-10 2010-03-17 中国移动通信集团上海有限公司 一种短信发送控制方法、装置及系统

Also Published As

Publication number Publication date
CN101827328A (zh) 2010-09-08

Similar Documents

Publication Publication Date Title
EP2377270B1 (en) Methods and apparatus for bandwidth efficient transmission of usage information from a pool of terminals in a data network
CN102209326B (zh) 基于智能手机无线电接口层的恶意行为检测方法及系统
WO2012174897A1 (zh) 一种监控方法和装置
CN103634409B (zh) 实现移动互联网应用永远在线的方法及系统
CN101136801B (zh) 网络故障检测方法
WO2020094036A1 (zh) 用于终端的无线网络连接方法
WO2020094035A1 (zh) 用于终端的无线网络连接方法
WO2011127692A1 (zh) 一种短消息监控装置及方法
WO2010145182A1 (zh) 短消息监控方法和系统
KR101384795B1 (ko) 네트워크 모니터링 및 분석 툴
WO2016197646A1 (zh) 骚扰电话监控方法及装置
WO2012083880A1 (zh) 一种呼叫时延信息处理方法及装置
EP2857992A1 (en) Online data processing method, device and system
WO2011035622A1 (zh) 一种基于内容识别技术的彩信内容监控系统和方法
EP2792182B1 (en) Classification of intercepted internet payload
WO2015154549A1 (zh) 数据的处理方法及装置
WO2012113191A1 (zh) 一种短消息监控方法和装置
WO2010091575A1 (zh) 一种规避垃圾短信的实现方法
WO2016037489A1 (zh) Rcs垃圾消息的监控方法、装置及系统
CN101771757A (zh) 一种检测与拦截骚扰电话的方法
CN103167502B (zh) 基于ota技术整治非法呼叫的方法
CN108040031A (zh) 一种基于portal协议实现AC黑白名单控制方法
CN102064972B (zh) 一种监视广告效果的方法及系统
CN102307361B (zh) 骚扰电话监测方法、装置及系统
WO2013078798A1 (zh) 一种短消息监控方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10849701

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10849701

Country of ref document: EP

Kind code of ref document: A1