WO2013075462A1 - 用户身份的确定方法和装置 - Google Patents

用户身份的确定方法和装置 Download PDF

Info

Publication number
WO2013075462A1
WO2013075462A1 PCT/CN2012/074640 CN2012074640W WO2013075462A1 WO 2013075462 A1 WO2013075462 A1 WO 2013075462A1 CN 2012074640 W CN2012074640 W CN 2012074640W WO 2013075462 A1 WO2013075462 A1 WO 2013075462A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
rule
monitoring
duration
threshold
Prior art date
Application number
PCT/CN2012/074640
Other languages
English (en)
French (fr)
Inventor
李冠军
储昊明
庞磊
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2013075462A1 publication Critical patent/WO2013075462A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Definitions

  • the present invention relates to the field of communications, and in particular to a method and apparatus for determining a user identity.
  • BACKGROUND Currently, the function of the message center in the field of communication is growing: applications range from a short message center to a multimedia message center to a mail center; and users are also increasing; various operators, profit groups, and individuals use the message center for promotion. Means are also emerging incessantly; the interconnection and interoperability between networks is in full swing; the amount of information flowing on the Internet has also grown geometrically. In this market environment, a large number of spam messages, malicious messages, advertisement messages, etc. will inevitably occur, and the collective or individual who issues these messages is considered to be suspicious users, even blacklisted users.
  • a large amount of spam in a short period of time can lead to a paralyzed operating environment for operators; some malicious users even use the delay of the operator's billing system to send a large amount of short messages when they are close to arrears, which in turn causes operators to suffer huge economic losses. Not only that, but frequent spa advertisements and malicious messages can also annoy users.
  • a garbage short message monitoring system has emerged, and its function is mainly to automatically discover suspicious users according to a large number of monitored short messages, thereby restricting suspicious users from sending short messages.
  • the monitoring rules are used to judge the messages sent by users in the unit time. Whether the quantity reaches the preset monitoring threshold, and if so, the user is considered to be a suspicious user (the preset monitoring threshold and the length of the unit time are all specified by the monitoring rules), thereby limiting the suspicious user to send the short message. the behavior of.
  • the drawback of this monitoring method is that it simply counts the amount of messages sent by the user in a unit time to determine whether the preset threshold is reached.
  • the traffic violation threshold in the rule is usually not set too small, which makes some malicious users use the characteristics of the system to continuously send garbage at a lower frequency for a long time.
  • the recall rate of the corresponding garbage monitoring will be reduced, and the precision rate will be increased accordingly.
  • the traffic violation threshold in the rules should be avoided to be too large to ensure More suspicious users are monitored, so that users who send normal text messages, such as users who send text messages such as business contacts, exchange numbers, birth curses, etc., are mistakenly judged as suspicious users or even blacklisted users, thereby being shut down.
  • the recall rate of the corresponding garbage monitoring will increase, but the precision will be reduced accordingly.
  • the strategy for capturing suspicious users in related technologies is too simple, and there is a contradiction between the recall rate and the precision rate. At present, no effective solution has been proposed.
  • Embodiments of the present invention provide a method and apparatus for determining a user identity, so as to solve at least the problem that the strategy for capturing a suspicious user is too simple, and the recall rate and the precision ratio are contradictory.
  • a method for determining a user identity is provided, including: whether the number of short messages sent by the user within the duration of the statistical rule meets a traffic threshold; if yes, the user sends the short message for the first time in the statistical rule duration The failure rate of the message; if the failure rate satisfies the ratio monitoring threshold, it is determined that the user is a blacklisted user.
  • the method further includes: configuring a ratio monitoring threshold of the first delivery failure rate and at least one monitoring rule, where the number of the short messages sent by the user in the statistical rule duration is equal to the traffic threshold; wherein the monitoring rule includes a rule duration, The time granularity and the traffic threshold monitored by the traffic within the rule duration.
  • the rule duration is an integer multiple of the time granularity.
  • whether the number of short messages sent by the user in the statistical rule duration meets the traffic threshold includes: When multiple monitoring rules are configured, the short messages sent by the user are counted and counted separately according to the configured monitoring rules.
  • the counting statistics of the short messages sent by the user are respectively performed according to the configured monitoring rules, including: selecting one monitoring rule from the plurality of monitoring rules one by one; in the time granularity unit, within the rule duration of the selected monitoring rule If the number of short messages sent by the user reaches the traffic threshold, the number of short messages of the user in the rule duration is determined to meet the traffic threshold; continue to select the next monitoring rule for counting, until The monitoring rules are selected.
  • the failure rate of the first time that the user sends the short message in the duration of the rule includes: calculating the number of all short messages sent by the user within the rule duration; failing to send the short message for the first time in the rule duration The number of times is calculated.
  • the ratio of the number of failures of the first delivery of the short message to the number of all short messages is calculated.
  • the ratio is used as the failure rate of the first time the user sends the short message within the rule duration.
  • the method further includes: acquiring association information of the short message sent by the user in the rule duration, where the association information includes at least one of the following: a frequency of the call, a content length consistency rate, The frequency of occurrence of the keyword and the continuous rate of the destination number; wherein, the frequency of the call, the consistency of the content length, the frequency of occurrence of the keyword, and the continuous rate of the destination number are each configured with an associated threshold; if one of the associated information meets the corresponding associated threshold, the determination is made.
  • a device for determining a user identity including: a traffic statistics module, configured to determine whether a number of short messages sent by a user within a duration of a statistical rule meets a traffic threshold; a failure rate statistics module, setting If the result of the statistics of the traffic statistics module is that the number of short messages meets the traffic threshold, the failure rate of the short message sent by the user for the first time in the statistical rule duration; the identity determination module is set to be the failure rate of the failure rate statistics module.
  • the ratio monitoring threshold determines that the user is a blacklisted user.
  • the foregoing apparatus further includes: a configuration module, configured to configure a ratio monitoring threshold for the first delivery failure rate and at least one monitoring rule; wherein the monitoring rule includes a rule duration, a time granularity, and a traffic threshold monitored by the traffic within the rule duration, The rule duration is an integer multiple of the time granularity.
  • the traffic statistics module includes: a traffic statistics unit, configured to collect statistics on the short messages sent by the user according to the configured monitoring rules when the configuration module configures multiple monitoring rules.
  • the failure rate statistics module includes: a short message number calculation unit configured to calculate the number of all short messages sent by the user within the rule duration; the failure number calculation unit is set to be the first time for the user within the rule duration The number of failures of the delivery of the short message is calculated; the failure rate calculation unit is set to the ratio of the number of failures of the first delivery of the short message calculated by the calculation failure number calculation unit to the number of all short messages calculated by the short message number calculation unit, and the ratio is used as the ratio The failure rate of the user sending the short message for the first time in the rule duration.
  • the device further includes: an association information acquiring module, configured to: if the failure rate of the failure rate statistics module does not meet the ratio monitoring threshold, obtain the association information of the short message sent by the user within the rule duration, where the association information includes at least One of the following: the frequency of the call, the consistency of the content length, the frequency of occurrence of the keyword, and the continuous rate of the destination number; wherein, the frequency of the call, the consistency of the content length, the frequency of occurrence of the keyword, and the continuous rate of the destination number are each configured with an associated threshold;
  • the identity re-confirmation module is configured to determine that the user is a blacklist user if one of the association information acquired by the association information acquisition module satisfies the corresponding association threshold.
  • FIG. 1 is a flowchart of a method for determining a user identity according to an embodiment of the present invention
  • 2 is a structural block diagram of a device for determining a user identity according to an embodiment of the present invention
  • FIG. 3 is a block diagram showing a structure of a device for determining a preferred user identity according to an embodiment of the present invention
  • FIG. 4 is another preferred user according to an embodiment of the present invention.
  • FIG. 5 is a structural block diagram of a failure rate statistic module according to an embodiment of the present invention
  • FIG. 6 is a structural block diagram of still another preferred user identity determining apparatus according to an embodiment of the present invention
  • FIG. 8 is a schematic structural diagram of a short message monitoring system according to a preferred embodiment of the present invention
  • FIG. 9 is a flowchart of a short message monitoring method according to a preferred embodiment of the present invention.
  • 10 is a flow chart for counting short messages sent by a user based on a plurality of monitoring rules in accordance with a preferred embodiment of the present invention.
  • BEST MODE FOR CARRYING OUT THE INVENTION will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.
  • the embodiment of the present invention is directed to the feature of spam group sending.
  • FIG. 1 is a flowchart of a method for determining a user identity according to an embodiment of the present invention.
  • the method may be implemented in a short message monitoring system, and includes the following steps: Step S102: Is the number of short messages sent by the user within a statistical rule duration? The flow threshold is met; if yes, step S104 is performed; if no, step S108 is performed.
  • step S104 the failure rate of the short message sent by the user for the first time in the rule duration is counted.
  • Step S106 If the failure rate meets the ratio monitoring threshold, determine that the user is a blacklist user.
  • Step S108 determining that the user is a legitimate user.
  • the strategy of capturing suspicious users in the related technology is too simple, the recall rate and the precision rate are contradictory, and the overall performance of the short message monitoring system is improved.
  • the user may be temporarily determined to be a suspicious user. If the failure rate of the first user of the suspicious user also meets the set ratio monitoring threshold, The user is determined to be a suspicious user, that is, the user is the blacklist user.
  • the duration of the rule is the monitoring duration of a monitoring rule.
  • the duration of the rule in this embodiment is a multiple of the time granularity. It is calculated in terms of time granularity. For example, 1 time granularity, 2 time granularities, and the like. Therefore, one rule time can contain one or more time granularities.
  • the time granularity is used to indicate the set length of time.
  • the time granularity of this embodiment is defined by the granularity start time and the granularity end time, and the granularity start time is the start time of the time granularity; the granularity end time is the start time of the time granularity plus the time granularity.
  • the number of short messages sent by the user is the same as the traffic threshold, you can configure the system as required. For example, configure the ratio of the first-time failure rate and the at least one monitoring rule. It includes the rule duration, time granularity, and traffic threshold monitored by traffic within the rule duration.
  • the rule duration is an integer multiple of the time granularity.
  • This configuration mode can be configured according to the actual monitoring needs of the system, so that the configured parameters are more in line with the monitoring requirements, which increases the flexibility of the system.
  • the system default configuration can also be used, that is, the above configuration is not required.
  • the short message sending condition of the user recorded in the short message center is used, and the failure rate of the first time the user sends the short message within the statistical rule duration is specifically implemented by the following process: 1) all the content sent by the user within the rule duration Calculate the number of short messages; 2) Calculate the number of times the user fails to deliver the short message for the first time in the rule duration; 3) Calculate the ratio of the number of failures of the first delivery of the short message to the number of all short messages, and use the ratio as the ratio The failure rate of the user sending the short message for the first time in the rule duration.
  • a monitoring rule is first taken, and short messages sent by the user are counted based on the monitoring rule, and then, when other monitoring rules exist, A monitoring rule is taken out again, and the number of short messages sent by the user is counted based on the monitoring rule.
  • This kind of statistical method is more orderly and easy to implement. It can be seen from the foregoing solution that the traffic monitoring in this embodiment monitors the short message volume in the rule duration, and uses the preset threshold of traffic monitoring as the monitoring basis, and is divided into simple traffic monitoring and composite traffic monitoring.
  • the simple traffic monitoring mainly refers to directly monitoring the pre-set threshold of the traffic monitoring as a suspicious threshold.
  • Composite traffic monitoring refers to the subsequent monitoring based on the simple traffic monitoring combined with the monitoring type, that is, it is first determined whether the short message sent by the user within the rule duration reaches the threshold of the traffic monitoring, and the threshold of the traffic monitoring is reached. On the basis of this, the short messages that have been monitored within the rule duration are subsequently monitored according to different monitoring types. The above-mentioned subsequent monitoring is relative to real-time traffic monitoring.
  • the subsequent monitoring is to further judge all the short messages sent by the user who violates the simple traffic monitoring within the time granularity before the end of a time granularity. analysis.
  • the type of monitoring is involved.
  • the monitoring type is one of the attributes in each monitoring rule. It indicates which type of setting the monitoring rule is based on.
  • the monitoring type included in the monitoring It can be monitored by the frequency of the calling, frequency monitoring by keyword, continuous monitoring by number, and so on.
  • the method further includes: acquiring association information of the short message sent by the user within the rule duration, where the association information includes at least one of the following: a frequency of the call, a content length consistency rate, and a key The frequency of occurrence of the word and the continuous rate of the destination number; wherein, the frequency of the call, the consistency of the content length, the frequency of occurrence of the keyword, and the continuous rate of the destination number are respectively configured with an associated threshold; if one of the acquired associated information meets the corresponding associated threshold, Then determine that the user is a blacklist user.
  • This monitoring method is more comprehensive and can accurately capture suspicious users, and the recall rate and precision rate can be guaranteed.
  • the monitoring rule may be set as follows: the rule corresponding to the relationship between the number of short messages sent by the user and the traffic threshold in the time period of the statistical rule in step S102 is used as the parent rule, and the above steps S104-S106 are performed.
  • the relationship between the failure rate of the first time that the user sends the short message and the ratio monitoring threshold is used as a sub-rule.
  • the parent rule refers to a rule cluster. If the rule A needs to be executed before the rule B, the rule A is called Is the parent rule of rule B. The above simple traffic monitoring rule is the parent rule of subsequent monitoring.
  • a sub-rule refers to a rule cluster. If rule A needs to be executed after rule B, then rule A is called a sub-rule of rule B.
  • the blacklist is defined as a blacklist user for a user whose number of times exceeds a certain threshold or the keyword exceeds the threshold. The user will be disabled. Compared with the blacklist, there is also a whitelist in the monitoring system. The users in the whitelist are unmonitored users, that is, no matter how the user sends short messages, they will not be monitored.
  • the method for determining the identity of the user can be applied to the short message monitoring method. First, the number of short messages sent by the user is counted according to the monitoring rule. In a time granularity, the number of short messages sent by the user reaches the rule duration and is monitored by the traffic.
  • the threshold After the threshold, at the end of the time granularity, all short messages sent by the user within the rule duration before the end of the granularity are recorded; secondly, each time a short message is sent by the user, the number of failed first time calls/the number of all short messages (equivalent The failure rate of the first user to deliver the short message is calculated. When the calculated ratio reaches the first failure rate monitoring threshold, the user is identified as a suspicious user. In turn, the suspicious user's sending behavior is restricted.
  • the first failure rate monitoring is performed on the basis of traffic monitoring and screening, when the lower traffic threshold is configured, the long-term continuous sending of spam messages at a lower frequency can be restricted, and the occurrence of false monitoring can be avoided. At the same time, improve recall and precision. In short, through the judgment of the first failure to deliver, this has achieved a more comprehensive monitoring of suspicious users, and also improved the overall performance of the short message monitoring system.
  • the embodiment further provides a device for determining the identity of the user.
  • 2 is a structural block diagram of a device for determining a user identity according to an embodiment of the present invention.
  • the device may be configured in a short message monitoring system, and the device includes: a traffic statistics module 22, a failure rate statistics module 24, and an identity determining module. 26.
  • the traffic statistics module 22 is configured to determine whether the number of short messages sent by the user within the duration of the statistical rule meets the traffic threshold; the failure rate statistics module 24 is connected to the traffic statistics module 22, and is set to the traffic statistics module.
  • the result of the statistics is that the number of short messages meets the traffic threshold, and the failure rate of the short message sent by the user for the first time in the statistical rule duration; the identity determining module 26 is connected to the failure rate statistics module 24, and is set to be the statistics of the failure rate statistics module 24.
  • the structure is that the failure rate satisfies the ratio monitoring threshold, and the user is determined to be a blacklist user.
  • the device in this embodiment combines the failure rate statistics module 24 to monitor the first failure rate based on the traffic monitoring module 22, and can limit the behavior of continuously sending spam messages at a lower frequency for a long time, and can avoid false monitoring.
  • a block diagram of a device for determining a preferred user identity may further include: a configuration module 32 connected to the traffic statistics module 22 and the identity determining module 26, configured to be configured The ratio of the first-time failure rate to the monitoring threshold and the at least one monitoring rule.
  • the monitoring rule includes the rule duration, the time granularity, and the traffic threshold monitored by the traffic within the rule duration.
  • the rule duration is an integer multiple of the time granularity.
  • the traffic statistics module 22 may include: a traffic statistics unit 222, connected to the configuration module 32, configured to be configured when the configuration module 32 is configured.
  • the failure rate statistics module 24 of the embodiment of the present invention may include: a short message number calculation unit 242, configured to set the number of all short messages sent by the user within the rule duration.
  • the failure number calculation unit 244 is configured to calculate the number of times that the user fails to deliver the short message for the first time in the rule duration;
  • the failure rate calculation unit 246 is connected to the short message number calculation unit 242 and the failure number calculation unit 244.
  • the ratio of the number of failures of the first delivery of the short message calculated by the calculation failure number calculation unit 244 to the number of all the short messages calculated by the short message number calculation unit 242 is set as the failure rate of the first time the user issues the short message within the rule duration. As shown in FIG.
  • the device may further include: an association information obtaining module 62 connected to the failure rate statistics module 24, configured to be a failure rate statistic
  • the failure rate of the statistics of the module 24 does not meet the ratio monitoring threshold, and the association information of the short message sent by the user within the rule duration is obtained.
  • the association information includes at least one of the following: the frequency of the call, the content length consistency rate, the keyword frequency and the purpose.
  • the number continuity rate wherein, the frequency of the call, the content length consistency ratio, the keyword occurrence frequency, and the destination number continuity rate are respectively configured with an association threshold;
  • the identity reconfirmation module 64 is connected to the association information acquisition module 62, and is set to if the associated information One of the association information obtained by the obtaining module 62 satisfies the corresponding association threshold, and determines that the user is a blacklist user.
  • DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following, a detailed description will be given in conjunction with a preferred embodiment which combines the above embodiments and preferred embodiments. In the preferred embodiment, another manner of dividing the foregoing user identity determining apparatus is provided. As shown in FIG.
  • a schematic diagram of a short message monitoring system includes: a configuration module 70, The preliminary analysis module 72, the subsequent analysis module 74, and the display module 76.
  • the configuration module 70 is configured to configure a first-time failure rate monitoring threshold and configure at least one monitoring rule, where the monitoring rule includes: a threshold, a rule duration, and a time granularity according to the traffic monitoring period, and the rule duration is time An integer multiple of the granularity, and the configured monitoring rule is sent to the preliminary analysis module 72, and the configured user level monitoring threshold is sent to the subsequent analysis module 76.
  • the preliminary analysis module 72 is connected to the configuration module 70 and is set to the user. The number of sent short messages is counted.
  • the subsequent analysis module 74 is connected to the configuration module 70 and the preliminary analysis module 72, and is configured to calculate all the short messages and the number of first-time terminal failures.
  • the display module 76 is connected to the subsequent analysis module 74 and is set to display the user information of the suspicious user.
  • the preferred embodiment adds a subsequent analysis module 74, that is, the subsequent first failure rate monitoring is introduced. Therefore, when the lower traffic threshold is configured, the long-time continuous sending of spam messages at a lower frequency can be restricted, and Avoid the occurrence of false monitoring, and at the same time improve the recall and precision, thus achieving the purpose of improving the reliability of the monitoring system.
  • the preliminary analysis module 72 is specifically configured to count the short messages sent by the user according to the configured monitoring rules, and more specifically, take out a monitoring rule, and separately use the monitoring rules based on the monitoring rules. The sent short message is counted.
  • the subsequent analysis module 76 specifically includes: a calculating unit, configured to calculate the number of all short messages sent by the user within one rule duration and the number of first terminal call failures; the comparison unit is set to the number of first terminal failures/all short messages Compared with the first-time failure rate monitoring threshold, when the calculated value reaches the first-time failure rate monitoring threshold, the user is identified as a suspicious user.
  • the preferred embodiment also provides a framework for a short message monitoring system.
  • FIG. 8 is a schematic structural diagram of a short message monitoring system according to a preferred embodiment of the present invention.
  • the system includes: a console (human-machine interface) 80, configured for data and displaying user information, that is, the console Combining the functions of the configuration module 70 and the display module 76 in the short message monitoring system shown in FIG.
  • the data can be configured, such as the monitoring rules, the configuration of the first failure rate monitoring threshold, and the user information of the suspicious users monitored by the monitoring system.
  • the analysis module 82 has the same function as the preliminary analysis module 72 in the short message monitoring system shown in FIG. 7 and is responsible for receiving the message of the short message center, and counting according to the monitoring rule configured by the console.
  • the user information of the user is sent to the database management operation module 84 to perform the operation of inserting the database 86, so as to record the user information.
  • the short message of the user sends all the short messages sent by the intercepting user within the rule duration to the database management operation module at the end of a time granularity, in order to record all the short messages.
  • the database management operation module 86, the function of the module is substantially the same as the function of the subsequent analysis module 74 in the short message monitoring system shown in FIG.
  • the preferred embodiment further provides a short message monitoring method.
  • Step S900 configuring a first delivery failure rate monitoring threshold, and configuring at least one monitoring rule, where the monitoring rule includes: The threshold, rule duration, and time granularity of traffic monitoring within the rule duration, and the rule duration is an integer multiple of the time granularity.
  • the monitoring rule includes: The threshold, rule duration, and time granularity of traffic monitoring within the rule duration, and the rule duration is an integer multiple of the time granularity.
  • the first-time failure rate monitoring threshold if multiple monitoring rules are configured, at least one of the traffic monitoring threshold, the rule duration, and the time granularity is different for different monitoring rules.
  • two different monitoring rules are configured.
  • the parameters configured for one monitoring rule are as follows: The threshold for traffic monitoring is 100 short messages, and the duration of the rule is 10 minutes.
  • the parameters for configuring another monitoring rule are: The threshold is 200 short messages, and the rule duration is 15 minutes.
  • Step S902 Extract a monitoring rule from the at least one monitoring rule configured above. The removal of this monitoring rule will provide the basis for the following counting process.
  • Step S904 counting the number of short messages sent by the user, and determining in real time whether the number of short messages sent by the user within a time granularity reaches the threshold of the traffic monitoring within the rule duration, and if yes, executing step S906; if not, then End.
  • Step S906 Record the user information of the user, and record all the short messages sent by the user within the rule duration before the granularity end time within the end of the time granularity.
  • the recording of the user information can be completed by inserting the user information into the database by using the database management module; the recording of the short message can also be completed by inserting all the short messages into the database by using the database management module.
  • the process can be considered as the simple traffic monitoring in the foregoing composite traffic monitoring, that is, it is only determined whether the number of short messages sent by the user within the rule duration has reached the threshold of the traffic monitoring.
  • the counting process of all users is performed in the flow counting memory library, that is, the user's counting record is stored in the flow memory library, so before the counting, the user's counting record is initialized, if The count record of the user does not exist in the flow count memory library.
  • Step S908 Calculate the number of first-time failures/all short messages recorded, and identify the user as a suspicious user when the calculated value reaches the first-time failure rate monitoring threshold.
  • the process can be considered as a follow-up monitoring, that is, based on the simple traffic monitoring, the short message that has been monitored within the rule duration is firstly sent for failure rate monitoring.
  • Step S910 displaying user information of the suspicious user. For suspicious users, the behavior of sending short messages will be restricted, and the user information of the suspicious users will be displayed.
  • the preferred embodiment introduces a subsequent first-time failure rate monitoring on the basis of traffic monitoring.
  • the long-term continuous sending of spam messages at a lower frequency can be restricted, and Avoid the occurrence of false monitoring, and at the same time improve the recall and precision, and thus more comprehensive capture of suspicious users.
  • the configured monitoring rule can be multiple.
  • the short messages sent by users are counted based on each monitoring rule.
  • FIG. 10 is a flowchart of counting short messages sent by a user according to a plurality of monitoring rules according to a preferred embodiment of the present invention.
  • Step S1002 Acquire a short message controlled structure from the short message center, and parse out the calling user number according to the short message controlled structure;
  • step S1004 the analysis module takes out a monitoring rule from the plurality of monitoring rules.
  • Step S1006 Counting, according to the monitoring rule, the short message sent by the calling user, that is, the counting value of the monitoring rule at the time granularity of the calling user.
  • Step S1008 determining whether the short message count value reaches the threshold for monitoring by the flow rate, if yes, proceeding to step S1010, if not, proceeding to step S1012; step S1010, recording The user number of the calling user, and within the end of the time granularity, all the short messages sent by the user within the rule duration before the granularity end time are recorded, and the user number and all the short messages may be sent to the database management operation module. It is implemented by completing the inserting operation of the database; in step S1012, it is judged whether there are other monitoring rules, and if so, the process returns to step S1004.
  • multiple monitoring rules can be configured to monitor the short messages sent by the user, which effectively improves the monitoring strength.
  • the short message monitoring method is further described by taking the monitoring type as the first delivery failure rate monitoring as an example, and the method includes: Step 1: First, the monitoring rule is performed on the human-computer interaction interface of the short message monitoring.
  • Step 2 Initialize the counting record of the user in the flow counting memory library. If there are different monitoring rules, the counting records based on each rule are initialized. Of course, if the traffic counting memory library does not exist, For the user's count record, a count record for the user is generated in the flow count memory bank prior to initialization.
  • Step 3 Obtain a message controlled structure to be monitored, and the user information of the calling user number, the message body, and the first terminal call failure must be included in the structure.
  • Step 4 Parse the calling user number according to the obtained short message controlled structure, and count the calling user number in the traffic counting memory library based on each monitoring rule in the time granularity.
  • Step 5 When the count value in the flow count memory library reaches the sub-rule within a time granularity - the parent rule for the first time the failure rate monitoring threshold is sent - after the threshold of the traffic monitoring, the user information of the user is sent to the database.
  • the management operation module performs physical database storage, and the purpose is to record the user information of the user.
  • Step 6 When the granularity end time of step 5 is reached, all the short messages sent by the user within the rule duration before the granularity end time are recorded, that is, the user is reversed forward by the granularity end time and the granularity end time. All the short messages sent within the time limit of the rule duration, that is, within one rule duration, notify the database management operation module, and the database management operation module inserts all short messages into the database.
  • Step 7 The database management operation module invokes the stored procedure to extract all the short messages sent by the user in a physical database for a period of time. For the first delivery failure rate monitoring, all the short messages need to be summed separately.
  • the sum of the number of first-time failures is summed, and the number of first-time failures/number of all short messages is determined to reach the first-time failure rate monitoring threshold. If so, the user is identified as a suspicious user, and the user is identified as The user information of the suspicious user is sent to the display module for display, and the behavior of sending the short message will be limited. If it is not reached, the corresponding user is not a suspicious user and will not be restricted from the behavior of sending short messages.
  • the first delivery failure rate monitoring involved in the preferred embodiment is the subsequent monitoring in the composite traffic monitoring, which is applicable not only to the monitoring type of the first delivery failure rate, but also to the monitoring type according to the content length consistency monitoring.
  • the present invention achieves the following technical effects: Introducing the judgment of the failure of the user to post the first time of the short message, which may be directed to the group sending, and there may be a part of the invalid number in the called number (downtime, no such number, etc.) The characteristics are effectively monitored. If the percentage of failures in the final call is high, it is considered to be suspected of spam messages. Since the first failure rate monitoring is performed on the basis of traffic monitoring and screening, when the lower traffic threshold is configured, the long-term continuous sending of spam messages at a lower frequency can be restricted, and the occurrence of false monitoring can be avoided.
  • the present embodiment solves the problem that the strategy for capturing suspicious users in the related technology is too simple, and the recall rate and the precision rate are contradictory, based on the monitoring of the traffic failure monitoring. Improve the overall performance of the short message monitoring system.
  • the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices.
  • the computing device may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from The steps shown or described are performed sequentially, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the above description is only a preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明公开了一种用户身份的确定方法和装置。其中，该方法包括：统计规则时长内用户发送的短消息个数是否满足流量门限（S102）；如果是，统计规则时长内该用户首次下发短消息的失败率（S104）；如果失败率满足比值监控门限，确定该用户为黑名单用户（S106）。本发明解决了捕获可疑用户的策略过于简单，查全率和查准率存在矛盾的问题，提高了短消息监控系统的整体性能。

Description

用户身份的确定方法和装置 技术领域 本发明涉及通信领域， 具体而言， 涉及一种用户身份的确定方法和装置。 背景技术 目前， 通讯领域的消息中心功能日臻壮大： 应用范围从短消息中心、 到多媒体消 息中心、 再到邮件中心； 并且用户也日益增多； 各个运营商、 盈利集团和个人利用消 息中心进行促销的手段也层出不穷； 各网络之间互联互通的活动如火如荼； 网上流动 的消息量也随之成几何级数增长。 在这种市场环境下， 不可避免的会出现大量的垃圾 消息、 恶意消息、 广告消息等， 而发出这些消息的集体或个人就被认为是可疑用户， 甚至是黑名单用户。 短时间内的大量垃圾消息能够导致运营商的运营环境瘫痪； 某些 恶意用户甚至利用运营商计费系统的延迟， 在接近欠费时发送大量短消息， 进而使运 营商蒙受巨额的经济损失。 不仅如此， 频繁的垃圾广告、 恶意消息也会使用户烦不胜 烦。 鉴于此， 垃圾短消息监控系统也就应运而生， 其功能主要是能根据大量的受监控 的短消息来自动地发现可疑用户， 进而限制可疑用户发送短消息的行为。 虽然目前市 场上有很多商用的垃圾短消息监控系统， 但就其核心功能"发现可疑用户"而言， 判断 的依据仍然比较简单， 通常都是基于监控规则来判断用户在单位时间内发送的消息量 是否达到了预设的监控门限， 如果是， 则认为该用户是可疑用户 （这里预设的监控门 限和单位时间的长度都是由监控规则来规定的），进而限制该可疑用户发送短消息的行 为。这种监控方法的缺陷在于，仅简单的对用户在单位时间内发送的消息量进行计数， 判断是否达到预设的门限值。 通常情况下， 为了满足正常用户的通信需求， 对于规则 中的流量违规门限通常不会设置太小， 这样就使得一些恶意用户， 利用系统的这种特 性， 长时间的以较低频率持续发送垃圾短信， 从而逃脱系统的监控， 相应垃圾监控的 查全率就会降低， 查准率相应提高； 同时为了应对用户的垃圾短信投诉， 对于规则中 的流量违规门限又要避免设置太大， 以确保监控到更多的可疑用户， 这样使得一些发 送正常短信的用户， 例如发送商贸往来、 换号、 出生祝福等短信的用户被误判为可疑 用户， 甚至黑名单用户， 从而被关停短信功能， 相应垃圾监控的查全率就会提高， 但 是查准率会相应降低。 针对相关技术中捕获可疑用户的策略过于简单，查全率和查准率存在矛盾的问题， 目前尚未提出有效的解决方案。 发明内容 本发明实施例提供了一种用户身份的确定方法和装置， 以至少解决捕获可疑用户 的策略过于简单， 查全率和查准率存在矛盾的问题。 根据本发明实施例的一个方面， 提供了一种用户身份的确定方法， 包括： 统计规 则时长内用户发送的短消息个数是否满足流量门限； 如果是， 统计规则时长内该用户 首次下发短消息的失败率； 如果失败率满足比值监控门限，确定该用户为黑名单用户。 优选地， 统计规则时长内上述用户发送的短消息个数是否满足流量门限之前， 上 述方法还包括： 配置首次下发失败率的比值监控门限和至少一条监控规则； 其中， 监 控规则包括规则时长、 时间粒度和规则时长内按流量监控的流量门限， 规则时长为时 间粒度的整数倍。 优选地， 统计规则时长内上述用户发送的短消息个数是否满足流量门限包括： 当 配置多条监控规则时， 基于配置的各个监控规则分别对该用户发送的短消息进行计数 统计。 优选地， 基于配置的各个监控规则分别对上述用户发送的短消息进行计数统计包 括： 逐一从多个监控规则中选取一个监控规则； 以时间粒度为单位， 对选取的监控规 则的规则时长内该用户发送的短消息个数进行计数； 如果当前时间粒度内该用户的计 数达到流量门限， 则确定规则时长内该用户的短消息个数满足流量门限； 继续选取下 一个监控规则进行计数， 直至多个监控规则选取完毕。 优选地， 统计规则时长内上述用户首次下发短消息的失败率包括： 对该用户在规 则时长内发送的所有短消息数进行计算； 对该用户在规则时长内所有首次下发短消息 失败的次数进行计算； 计算首次下发短消息失败的次数与所有短消息数的比值， 将比 值作为规则时长内该用户首次下发短消息的失败率。 优选地， 如果失败率不满足比值监控门限， 上述方法还包括： 获取规则时长内上 述用户发送的短消息的关联信息， 其中， 关联信息至少包括以下之一： 起呼频次、 内 容长度一致率、 关键字出现频率和目的号码连续率； 其中， 起呼频次、 内容长度一致 率、 关键字出现频率和目的号码连续率分别配置有一个关联门限； 如果关联信息中有 一个满足对应的关联门限， 确定该用户为黑名单用户。 根据本发明实施例的另一方面， 提供了一种用户身份的确定装置， 包括： 流量统 计模块， 设置为统计规则时长内用户发送的短消息个数是否满足流量门限； 失败率统 计模块， 设置为如果流量统计模块统计的结果为短消息个数满足流量门限， 统计规则 时长内该用户首次下发短消息的失败率； 身份确定模块， 设置为如果失败率统计模块 统计的结构为失败率满足比值监控门限， 确定该用户为黑名单用户。 优选地， 上述装置还包括： 配置模块， 设置为配置首次下发失败率的比值监控门 限和至少一条监控规则； 其中， 监控规则包括规则时长、 时间粒度和规则时长内按流 量监控的流量门限， 规则时长为时间粒度的整数倍。 优选地， 上述流量统计模块包括： 流量统计单元， 设置为当配置模块配置多条监 控规则时， 基于配置的各个监控规则分别对上述用户发送的短消息进行计数统计。 优选地， 上述失败率统计模块包括： 短消息数计算单元， 设置为对上述用户在规 则时长内发送的所有短消息数进行计算； 失败次数计算单元， 设置为对该用户在规则 时长内所有首次下发短消息失败的次数进行计算； 失败率计算单元， 设置为计算失败 次数计算单元计算的首次下发短消息失败的次数与短消息数计算单元计算的所有短消 息数的比值， 将比值作为规则时长内该用户首次下发短消息的失败率。 优选地， 上述装置还包括： 关联信息获取模块， 设置为如果失败率统计模块统计 的失败率不满足比值监控门限， 获取规则时长内上述用户发送的短消息的关联信息， 其中， 关联信息至少包括以下之一： 起呼频次、 内容长度一致率、 关键字出现频率和 目的号码连续率； 其中， 起呼频次、 内容长度一致率、 关键字出现频率和目的号码连 续率分别配置有一个关联门限； 身份再次确认模块， 设置为如果关联信息获取模块获 取的关联信息中有一个满足对应的关联门限， 确定该用户为黑名单用户。 通过本发明实施例， 采用在流量监控的基础上结合首发失败率的监控， 解决了捕 获可疑用户的策略过于简单， 查全率和查准率存在矛盾的问题， 进而提高了短消息监 控系统的整体性能。 附图说明 此处所说明的附图用来提供对本发明的进一步理解， 构成本申请的一部分， 本发 明的示意性实施例及其说明用于解释本发明， 并不构成对本发明的不当限定。 在附图 中： 图 1是根据本发明实施例的用户身份的确定方法流程图; 图 2是根据本发明实施例的用户身份的确定装置的结构框图； 图 3是根据本发明实施例的优选用户身份的确定装置的结构框图； 图 4是根据本发明实施例的另一优选用户身份的确定装置的结构框图； 图 5是根据本发明实施例的失败率统计模块的结构框图； 图 6是根据本发明实施例的再一优选用户身份的确定装置的结构框图； 图 7是根据本发明优选实施例的短消息监控系统的示意图； 图 8是根据本发明优选实施例的短消息监控系统的架构示意图； 图 9是根据本发明优选实施例的短消息监控方法的流程图； 图 10 是根据本发明优选实施例的基于多条监控规则对用户发送的短消息进行计 数的流程图。 具体实施方式 下文中将参考附图并结合实施例来详细说明本发明。 需要说明的是， 在不冲突的 情况下， 本申请中的实施例及实施例中的特征可以相互组合。 本发明实施例针对垃圾短信群发的特征， 通常被叫号码中可能存在一部分无效号 码（停机、 无此号码等）， 发到这些号码的消息都会下发失败， 提供了一种用户身份的 确定方法和装置。 下面通过具体实施例进行说明。 如图 1所示的根据本发明实施例的用户身份的确定方法流程图， 该方法可以在短 消息监控系统中实现， 包括以下步骤： 步骤 S102， 统计规则时长内用户发送的短消息个数是否满足流量门限； 如果是， 执行步骤 S104; 如果否， 执行步骤 S108。 步骤 S104, 统计上述规则时长内该用户首次下发短消息的失败率。 步骤 S106, 如果上述失败率满足比值监控门限， 确定该用户为黑名单用户。 步骤 S108， 确定该用户为合法用户。 本实施例通过在流量监控的基础上结合首发失败率的监控， 可以限制长时间以较 低频率持续发送垃圾短信的行为， 又可以避免误监控的出现， 同时提高了查全率和查 准率， 解决了相关技术中捕获可疑用户的策略过于简单， 查全率和查准率存在矛盾的 问题， 提高了短消息监控系统的整体性能。 当统计规则时长内用户发送的短消息个数是否满足上述流量门限时， 可以暂时确 定该用户可能为可疑用户， 如果该可疑用户的上述首发的失败率也满足设定的比值监 控门限， 则可以确定该用户为可疑用户， 即该用户为上述黑名单用户。 上述规则时长指一条监控规则的监控时长， 本实施例的规则时长是时间粒度的倍 数， 它以时间粒度为计算单位。 例如 1个时间粒度、 2个时间粒度等。 因此一个规则 时长内可以包含有 1个或多个时间粒度。 而时间粒度用来表示设定的时间长度， 它是 监控时长的基本单位， 如 10分钟、 1小时等。 本实施例的时间粒度用粒度开始时间和 粒度结束时间界定， 粒度开始时间为时间粒度的起始时间； 粒度结束时间为时间粒度 的起始时间加上时间粒度。 在进行上述统计规则时长内用户发送的短消息个数是否满足流量门限之前， 可以 根据需要对系统进行配置， 例如： 配置首次下发失败率的比值监控门限和至少一条监 控规则； 其中， 监控规则包括规则时长、 时间粒度和规则时长内按流量监控的流量门 限， 该规则时长为时间粒度的整数倍。 这种配置方式可以根据系统的实际监控需要进 行配置， 使配置的参数更符合监控要求， 增加了系统的灵活性。 当然， 对于普遍适用 的场景， 也可以采用系统默认的配置进行， 即不需要单独进行上述配置。 当配置多条监控规则时， 可以基于配置的各个监控规则分别对用户发送的短消息 进行计数统计。例如： 逐一从多个监控规则中选取一个监控规则； 以时间粒度为单位， 对选取的监控规则的规则时长内用户发送的短消息个数进行计数； 如果当前时间粒度 内用户的计数达到流量门限， 则确定规则时长内用户的短消息个数满足流量门限； 继 续选取下一个监控规则进行计数， 直至多个监控规则选取完毕。 通过配置多条监控规 贝 1」， 可以更加准确地确定用户的身份。 本实施例可以通过短消息中心记录的用户的短消息发送情况， 统计规则时长内用 户首次下发短消息的失败率， 具体采用下述过程完成： 1 )对该用户在规则时长内发送 的所有短消息数进行计算； 2)对该用户在规则时长内所有首次下发短消息失败的次数 进行计算； 3 )计算首次下发短消息失败的次数与所有短消息数的比值， 将该比值作为 规则时长内用户首次下发短消息的失败率。 这种统计方式采用先取出一条监控规则， 基于该监控规则对用户发送的短消息进行计数， 然后， 确定还存在其他监控规则时， 再次取出一条监控规则， 再基于该监控规则对用户发送的短消息数进行计数。 这种统 计方式比较有序， 便于实现。 由上述方案可知， 本实施例的流量监控指对规则时长内的短消息量进行监控， 它 以预先设置的按流量监控的门限作为监控基础， 分为单纯流量监控和复合流量监控。 单纯流量监控主要是指直接将预先设置的按流量监控的门限作为可疑门限来进行监 控， 即当用户在规则时长内发送的短消息量大于或等于按流量监控的门限时， 就认为 相应用户为可疑用户， 进而限制可疑用户发送短消息的行为。 复合流量监控是指在单 纯流量监控的基础上结合监控类型进行后续监控， 即首先判断用户在规则时长内发送 的短消息量是否达到按流量监控的门限， 在达到了该按流量监控的门限的基础上， 再 根据不同的监控类型对已在规则时长内监控到的短消息进行后续监控。 上述后续监控是相对于实时的按流量监控来说， 后续监控是在一个时间粒度结束 时间之前， 对该时间粒度内违反单纯流量监控的用户在规则时长内发送的所有短消息 进行进一步地判断和分析。 在后续监控的过程中， 涉及到监控类型的问题， 监控类型 是每一条监控规则中的属性之一， 标志该监控规则是基于哪种类型设置的， 对于后续 监控而言， 其包括的监控类型可以为按起呼频次监控、 按关键字频次监控、 按号码连 续性监控等。 基于此， 如果失败率不满足比值监控门限， 上述方法还包括： 获取规则 时长内用户发送的短消息的关联信息， 其中， 关联信息至少包括以下之一： 起呼频次、 内容长度一致率、 关键字出现频率和目的号码连续率； 其中， 起呼频次、 内容长度一 致率、 关键字出现频率和目的号码连续率分别配置有一个关联门限； 如果获取的关联 信息中有一个满足对应的关联门限， 则确定该用户为黑名单用户。 这种监控方式更具 有综合性， 可以准确地捕获可疑用户， 查全率和查准率均可以得到保证。 在实际实现时，可以按照下述方式设置监控规则：将上述步骤 S102中的统计规则 时长内用户发送的短消息个数与流量门限的关系对应的规则作为父规则， 将上述步骤 S104-S106 中的统计上述规则时长内该用户首次下发短消息的失败率与比值监控门限 的关系作为子规则， 其中， 父规则指一个规则簇中， 如果规则 A需要在规则 B之前执 行， 则称规则 A是规则 B的父规则。 上述单纯流量监控规则就是后续监控的父规则。 子规则指一个规则簇中， 如果规则 A需要在规则 B之后执行， 则称规则 A是规则 B 的子规则。 后续监控就是单纯流量监控规则的子规则。 上述黑名单指对于在一定时间内发送次数超过一定门限或发送关键字超过门限的 用户定义为黑名单用户， 该用户将被关闭短消息发送功能。 相对于黑名单而言， 监控 系统中还有白名单， 该白名单中的用户为不被监控的用户， 即无论该用户如何发送短 消息都不会被监控。 上述用户身份的确定方法可以应用在短消息监控方法中， 首先， 基于监控规则对 用户发送的短消息数进行计数， 在一个时间粒度内， 用户发送的短消息数达到规则时 长内按流量监控的门限后， 在该时间粒度结束内， 记录该粒度结束时间之前的规则时 长内用户发送的所有短消息； 其次， 该用户每发一条短消息， 对首次终呼失败次数 / 所有短消息数 （相当于上述用户首次下发短消息的失败率） 进行计算， 当计算得到的 比值达到首次下发失败率监控门限时， 将该用户标识为可疑用户。 进而限制该可疑用 户的发送行为。 通过引入对用户短消息首次下发失败情况的判断， 可以针对群发， 被叫号码中可 能存在一部分无效号码 （停机、 无此号码等） 的特征进行有效地监控， 如果终呼失败 比例较高， 则认为有发垃圾短信的嫌疑。 由于首次下发失败率监控是在流量监控筛选 的基础上进行的， 因此配置较低流量门限时， 既可以限制长时间的以较低频率持续发 送垃圾短信的行为， 又可以避免误监控的出现， 同时提高查全率和查准率。 总之， 通 过首次下发失败情况的判断， 这样就达到了更全面的捕获可疑用户的监控效果， 同时 也提高了短消息监控系统的整体性能。 对应于上述用户身份的确定方法， 本实施例还提供了一种用户身份的确定装置。 如图 2所示的根据本发明实施例的用户身份的确定装置的结构框图， 该装置可以设置 在短消息监控系统中， 该装置包括： 流量统计模块 22、 失败率统计模块 24、 身份确定 模块 26。 下面具体介绍上述模块的结构： 流量统计模块 22， 设置为统计规则时长内用户发送的短消息个数是否满足流量门 限； 失败率统计模块 24， 与流量统计模块 22相连， 设置为如果流量统计模块 22统计 的结果为短消息个数满足流量门限， 统计规则时长内用户首次下发短消息的失败率； 身份确定模块 26， 与失败率统计模块 24相连， 设置为如果失败率统计模块 24统计的 结构为失败率满足比值监控门限， 确定用户为黑名单用户。 本实施例的装置通过在流量统计模块 22 进行流量监控的基础上结合失败率统计 模块 24对首发失败率的监控， 可以限制长时间以较低频率持续发送垃圾短信的行为， 又可以避免误监控的出现， 同时提高了查全率和查准率， 解决了相关技术中捕获可疑 用户的策略过于简单， 查全率和查准率存在矛盾的问题， 提高了短消息监控系统的整 体性能。 如图 3所示的根据本发明实施例的优选用户身份的确定装置的结构框图， 上述装 置还可以包括： 配置模块 32， 与流量统计模块 22和身份确定模块 26相连， 设置为配 置首次下发失败率的比值监控门限和至少一条监控规则； 其中， 监控规则包括规则时 长、 时间粒度和规则时长内按流量监控的流量门限， 规则时长为时间粒度的整数倍。 如图 4所示的根据本发明实施例的另一优选用户身份的确定装置的结构框图， 流 量统计模块 22可以包括： 流量统计单元 222， 与配置模块 32相连， 设置为当配置模 块 32配置多条监控规则时，基于配置的各个监控规则分别对用户发送的短消息进行计 数统计。 如图 5所示的根据本发明实施例的失败率统计模块 24的结构框图，失败率统计模 块 24可以包括： 短消息数计算单元 242， 设置为对用户在规则时长内发送的所有短消息数进行计 算； 失败次数计算单元 244， 设置为对用户在规则时长内所有首次下发短消息失败的 次数进行计算； 失败率计算单元 246， 与短消息数计算单元 242和失败次数计算单元 244相连， 设置为计算失败次数计算单元 244计算的首次下发短消息失败的次数与短消息数计算 单元 242计算的所有短消息数的比值， 将比值作为规则时长内用户首次下发短消息的 失败率。 如图 6所示的根据本发明实施例的再一优选用户身份的确定装置的结构框图， 上 述装置还可以包括： 关联信息获取模块 62， 与失败率统计模块 24相连， 设置为如果失败率统计模块 24 统计的失败率不满足比值监控门限， 获取规则时长内用户发送的短消息的关联信 息， 其中， 关联信息至少包括以下之一： 起呼频次、 内容长度一致率、 关键字出现频 率和目的号码连续率； 其中， 起呼频次、 内容长度一致率、 关键字出现频率和目的号 码连续率分别配置有一个关联门限； 身份再次确认模块 64， 与关联信息获取模块 62相连， 设置为如果关联信息获取 模块 62获取的关联信息中有一个满足对应的关联门限， 确定用户为黑名单用户。 下面将结合一个优选实施例进行详细说明， 该优选实施例结合了上述实施例及优 选实施方式。 在本优选实施例中， 提供了上述用户身份的确定装置的另一种划分方式， 如图 7 所示的根据本发明优选实施例的短消息监控系统的示意图，该系统包括：配置模块 70、 初步分析模块 72、 后续分析模块 74、 显示模块 76。 其中， 配置模块 70， 设置为配置 首次下发失败率监控门限、 以及配置至少一条监控规则， 其中， 监控规则包括： 规则 时长内按流量监控的门限、规则时长和时间粒度， 并且规则时长为时间粒度的整数倍， 并且将配置好的监控规则发送给初步分析模块 72、 以及将配置好的用户级别监控门限 发送给后续分析模块 76; 初步分析模块 72， 与配置模块 70相连， 设置为对用户发送 的短消息数进行计数， 当在一个时间粒度内， 用户发送的短消息数达到规则时长内按 流量监控的门限后， 记录用户的用户信息， 并且在该时间粒度结束内， 记录粒度结束 时间之前的规则时长内用户发送的所有短消息并发送给后续分析模块 74; 后续分析模 块 74， 与配置模块 70和初步分析模块 72相连， 设置为对所有短消息和首次终呼失败 次数进行计算， 当计算首次终呼失败次数 /所有短消息数达到首次下发失败率监控门限 时， 将用户标识为可疑用户； 显示模块 76， 与后续分析模块 74相连， 设置为显示可 疑用户的用户信息。 该优选实施例增加了后续分析模块 74， 即引入了后续的首次下发失败率监控， 因 此配置较低流量门限时， 既可以限制长时间的以较低频率持续发送垃圾短信的行为， 又可以避免误监控的出现， 同时提高查全率和查准率， 这样就实现了提高监控系统可 靠性的目的。 配置模块 70配置了多条监控规则时， 初步分析模块 72具体用于基于配置的各监 控规则分别对用户发送的短消息进行计数， 更具体地， 取出一条监控规则， 基于该监 控规则分别对用户发送的短消息进行计数， 确定存在其他监控规则时， 再次取出一条 监控规则， 基于该监控规则对用户发送的短消息数进行计数。 后续分析模块 76具体包括： 计算单元， 设置为对用户在一个规则时长内发送的所 有短消息数和首次终呼失败次数进行计算； 比较单元， 设置为将首次终呼失败次数 / 所有短消息数与首次下发失败率监控门限进行比较， 当计算得到的值达到首次下发失 败率监控门限时， 将该用户标识为可疑用户。 对应于上述的短消息监控系统， 本优选实施例还提供了一种短消息监控系统的架 构。 如图 8所示的根据本发明优选实施例的短消息监控系统的架构示意图， 该系统包 括： 控制台 （人机交互界面） 80， 用于数据的配置以及用户信息的显示， 即该控制台 结合了如图 7所示的短消息监控系统中的配置模块 70和显示模块 76的功能， 在该控 制台上， 既可以进行数据的配置， 如监控规则、 首次下发失败率监控门限的配置， 又 可以将监控系统所监控到的可疑用户的用户信息进行显示。控制台的数据配置完成后， 将同步给分析模块和数据库管理操作模块。 分析模块 82， 其功能与如图 7所示的短消息监控系统中的初步分析模块 72的功 能基本相同，用于负责接收短消息中心的消息， 按照控制台配置的监控规则进行计数， 当达到控制台配置的父规则一达到按流量监控的门限时， 就将该用户的用户信息发送 给数据库管理操作模块 84进行插入数据库 86操作， 目的在于对用户信息进行记录。 用户的短消息在一个时间粒度结束内把在该时间粒度被拦截用户在规则时长内发送的 所有短消息发送给数据库管理操作模块， 目的在于对所有短消息进行记录。 数据库管理操作模块 86， 该模块的功能与如图 7所示的短消息监控系统中的后续 分析模块 74的功能基本相同， 主要用于接收到分析模块 82的数据后进行插入数据库 86操作， 并且进行后续分析， 后续分析包括调用存储过程取出数据库 86中该用户在 一个规则时长内的发送的短消息和首次终呼失败次数进行计算， 并判断首次终呼失败 次数 /所有短消息数是否达到首次下发失败率监控门限。 基于上述短消息监控系统及其架构，本优选实施例还提供了一种短消息监控方法。 如图 9所示的根据本发明优选实施例的短消息监控方法的流程图， 该方法包括： 步骤 S900, 配置首次下发失败率监控门限、 以及配置至少一条监控规则， 其中， 监控规则包括： 规则时长内按流量监控的门限、 规则时长和时间粒度， 并且规则时长 为时间粒度的整数倍。 对于首次下发失败率监控门限而言， 如果配置的监控规则为多条， 对于不同的监 控规则， 按流量监控的门限、 规则时长、 时间粒度三项中的至少一项是不同的。 例如， 配置有两条不同的监控规则， 其中一条监控规则配置的参数为： 按流量监控的门限是 100条短消息， 规则时长是 10分钟； 另一条监控规则配置的参数为： 按流量监控的门 限是 200条短消息， 规则时长是 15分钟。 步骤 S902, 从上述配置的至少一条监控规则中取出一条监控规则。 取出的该条监 控规则将为以下的计数过程提供依据。 步骤 S904, 对用户发送的短消息数进行计数， 并且实时判断在一个时间粒度内用 户发送的短消息数是否达到规则时长内按流量监控的门限，如果是，则执行步骤 S906; 如果否， 则结束。 步骤 S906， 记录该用户的用户信息， 并且在时间粒度结束内， 记录粒度结束时间 之前的规则时长内用户发送的所有短消息。 具体地， 可以通过将用户信息利用数据库管理模块插入数据库的方式来完成用户 信息的记录； 同样可以通过将所有短消息利用数据库管理模块插入数据库的方式来完 成短消息的记录。 该过程可以认为是前述复合流量监控中的单纯流量监控， 即只是判断用户在规则 时长内发送的短消息数是否达到了按流量监控的门限。 在该过程中， 所有用户的计数 过程都是在流量计数内存库中进行的， 即流量内存库中保存有用户的计数记录，所以， 在计数之前， 要对用户的计数记录进行初始化设置， 如果流量计数内存库中不存在该 用户的计数记录， 在初始化设置之前还需要在该流量计数内存库中生成一条该用户的 计数记录， 设置为之后对该用户发送的短消息数进行计数。 步骤 S908,对记录的首次终呼失败次数 /所有短消息数进行计算， 当计算得到的值 达到与首次下发失败率监控门限时， 将该用户标识为可疑用户。 该过程可以认为是后续监控， 即在单纯流量监控的基础上， 再对已在规则时长内 监控到的短消息进行首次下发失败率监控。 步骤 S910, 显示上述可疑用户的用户信息。 对于可疑用户， 其发送短消息的行为 将会受到限制， 并且该可疑用户的用户信息会被显示出来。 该优选实施例在按流量监控的基础上， 引入了后续的首次下发失败率监控， 因此 配置较低流量门限时， 既可以限制长时间的以较低频率持续发送垃圾短信的行为， 又 可以避免误监控的出现， 同时提高查全率和查准率，进而可以更全面的捕获可疑用户。 从上述的短消息监控方法的步骤 S900可以看出，配置的监控规则可以为多条。配 置了多条监控规则时， 将基于各监控规则分别对用户发送的短消息进行计数。 对于存 在多条监控规则的情况， 该短消息监控方法对某个用户进行流量计数的过程， 将在以 下结合图 10做进一步的描述。 如图 10 所示的根据本发明优选实施例的基于多条监控规则对用户发送的短消息 进行计数的流程图， 当存在多条监控规则时， 对用户发送的短消息进行计数的过程包 括： 步骤 S1002, 从短消息中心获取短消息受控结构体， 根据该短消息受控结构体解 析出起呼用户号码； 步骤 S1004, 分析模块从多条监控规则中取出一条监控规则； 步骤 S1006, 基于监控规则对该起呼用户发送的短消息进行计数， 即在该起呼用 户该时间粒度的该监控规则的计数数值加一 （正常情况下计数器没有溢出）； 步骤 S1008, 判断短消息计数数值是否达到按流量监控的门限， 如果达到， 则继 续执行步骤 S1010, 如果未达到， 则继续执行步骤 S1012; 步骤 S1010, 记录该起呼用户的用户号码， 并且在该时间粒度结束内， 记录粒度 结束时间之前的规则时长内用户发送的所有短消息， 具体可以采取将该用户号码以及 所有短消息发送给数据库管理操作模块由其完成插入数据库操作的方式来实现； 步骤 S1012, 判断是否存在其他监控规则， 如果是， 则返回到步骤 S1004。 通过该优选实施例， 实现了在按流量监控的过程中， 可以配置多条监控规则对用 户发送的短消息进行监控， 这样就有效地提高了监控的力度。 从前面的描述可以知道， 后续监控包括的监控类型有多种， 可以为按内容长度一 致性监控、 按关键字频次监控、 按号码连续性监控等。 所以， 下面将以监控类型为按 首次下发失败率监控为例， 对短消息监控方法做进一步的描述， 该方法包括： 步骤 1， 首先， 在短消息监控的人机交互界面上进行监控规则的配置， 包括配置 父规则-按流量监控的门限， 即当某一号码在规则时长内发送的短消息达到该值后才进 行后续监控； 接着配置子规则-首次下发失败率监控门限。 配置完成后， 将配置好的上 述参数同步给分析模块和数据库管理操作模块。 步骤 2， 对流量计数内存库中用户的计数记录进行初始化设置， 如果存在不同的 监控规则， 基于每个规则进行计数的计数记录都要进行初始化设置， 当然， 如果流量 计数内存库中不存在该用户的计数记录， 则要在初始化之前在流量计数内存库中生成 一条该用户的计数记录。 步骤 3， 获取待监控的短信受控结构体， 在该结构体中必须包含起呼用户号码、 消息体、 首次终呼是否失败等用户信息。 步骤 4， 根据获取的短信受控结构体， 解析出起呼用户号码， 并且在时间粒度内 在流量计数内存库中基于各监控规则针对该起呼用户号码进行计数。 步骤 5， 当在一个时间粒度内， 流量计数内存库中的计数值达到子规则-首次下发 失败率监控门限的父规则-按流量监控的门限后， 即把该用户的用户信息发送给数据库 管理操作模块进行物理数据库入库， 目的在于记录该用户的用户信息。 步骤 6， 当到达步骤 5上述的粒度结束时间内， 将该粒度结束时间之前的规则时 长内用户发送的所有短消息进行记录， 即将该用户在该粒度结束时间和该粒度结束时 间向前倒退一个规则时长的时间范围内即一个规则时长内发送的所有短消息通知数据 库管理操作模块， 数据库管理操作模块会将所有短消息插入数据库。 步骤 7， 数据库管理操作模块调用存储过程取出物理数据库中该用户在一个规则 时长内发送的所有短消息进行计算， 对于首次下发失败率监控而言， 此处需要分别对 所有短消息进行求和、 首次终呼失败次数进行求和计算， 并且判断首次终呼失败次数 / 所有短消息数得到的值是否达到首次下发失败率监控门限， 如果达到则将该用户标识 为可疑用户， 并且将该可疑用户的用户信息发送给显示模块进行显示， 其发送短消息 的行为将会受到限制。 如果未达到， 则表明相应用户不是可疑用户， 不会对其发送短 消息的行为进行限制。 该优选实施例中所涉及的首次下发失败率监控是复合流量监控中的后续监控， 其 不仅适用于监控类型为首次下发失败率的监控， 同样适用于监控类型为按内容长度一 致性监控、 按关键字频次监控、 按号码连续性监控等其他复合流量监控， 在此我们不 再 进行描述。 从以上的描述中可以看出， 本发明实现了如下技术效果： 引入对用户短消息首次 下发失败情况的判断， 可以针对群发， 被叫号码中可能存在一部分无效号码 （停机、 无此号码等） 的特征进行有效地监控， 如果终呼失败比例较高， 则认为有发垃圾短信 的嫌疑。 由于首次下发失败率监控是在流量监控筛选的基础上进行的， 因此配置较低 流量门限时， 既可以限制长时间的以较低频率持续发送垃圾短信的行为， 又可以避免 误监控的出现， 同时提高查全率和查准率， 进而提高系统的可靠性。 综上所述可以看出， 本实施例通过在流量监控的基础上结合首发失败率的监控， 解决了相关技术中捕获可疑用户的策略过于简单， 查全率和查准率存在矛盾的问题， 提高了短消息监控系统的整体性能。 显然， 本领域的技术人员应该明白， 上述的本发明的各模块或各步骤可以用通用 的计算装置来实现， 它们可以集中在单个的计算装置上， 或者分布在多个计算装置所 组成的网络上， 可选地， 它们可以用计算装置可执行的程序代码来实现， 从而， 可以 将它们存储在存储装置中由计算装置来执行， 并且在某些情况下， 可以以不同于此处 的顺序执行所示出或描述的步骤， 或者将它们分别制作成各个集成电路模块， 或者将 它们中的多个模块或步骤制作成单个集成电路模块来实现。 这样， 本发明不限制于任 何特定的硬件和软件结合。 以上所述仅为本发明的优选实施例而已， 并不用于限制本发明， 对于本领域的技 术人员来说， 本发明可以有各种更改和变化。 凡在本发明的精神和原则之内， 所作的 任何修改、 等同替换、 改进等， 均应包含在本发明的保护范围之内。

Claims

权 利 要 求 书
1. 一种用户身份的确定方法， 包括：
统计规则时长内用户发送的短消息个数是否满足流量门限； 如果是， 统计所述规则时长内所述用户首次下发短消息的失败率； 如果所述失败率满足比值监控门限， 确定所述用户为黑名单用户。
2. 根据权利要求 1所述的方法， 其中， 统计规则时长内用户发送的短消息个数是 否满足流量门限之前， 所述方法还包括：
配置首次下发失败率的比值监控门限和至少一条监控规则； 其中， 所述监 控规则包括规则时长、 时间粒度和所述规则时长内按流量监控的流量门限， 所 述规则时长为所述时间粒度的整数倍。
3. 根据权利要求 2所述的方法， 其中， 统计规则时长内用户发送的短消息个数是 否满足流量门限包括：
当配置多条监控规则时， 基于配置的各个监控规则分别对用户发送的短消 息进行计数统计。
4. 根据权利要求 3所述的方法， 其中， 基于配置的各个监控规则分别对用户发送 的短消息进行计数统计包括：
逐一从所述多个监控规则中选取一个监控规则；
以时间粒度为单位， 对选取的所述监控规则的规则时长内用户发送的短消 息个数进行计数；
如果当前时间粒度内所述用户的计数达到所述流量门限， 则确定所述规则 时长内所述用户的短消息个数满足流量门限；
继续选取下一个监控规则进行计数， 直至所述多个监控规则选取完毕。
5. 根据权利要求 1所述的方法， 其中， 统计所述规则时长内所述用户首次下发短 消息的失败率包括：
对所述用户在所述规则时长内发送的所有短消息数进行计算； 对所述用户在所述规则时长内所有首次下发短消息失败的次数进行计算； 计算所述首次下发短消息失败的次数与所述所有短消息数的比值， 将所述 比值作为所述规则时长内所述用户首次下发短消息的失败率。
6. 根据权利要求 1-5任一项所述的方法， 其中， 如果所述失败率不满足比值监控 门限， 所述方法还包括：
获取所述规则时长内所述用户发送的短消息的关联信息， 其中， 所述关联 信息至少包括以下之一： 起呼频次、 内容长度一致率、 关键字出现频率和目的 号码连续率； 其中， 所述起呼频次、 所述内容长度一致率、 所述关键字出现频 率和所述目的号码连续率分别配置有一个关联门限；
如果所述关联信息中有一个满足对应的关联门限， 确定所述用户为黑名单 用户。
7. 一种用户身份的确定装置， 包括：
流量统计模块， 设置为统计规则时长内用户发送的短消息个数是否满足流 量门限；
失败率统计模块， 设置为如果所述流量统计模块统计的结果为所述短消息 个数满足所述流量门限， 统计所述规则时长内所述用户首次下发短消息的失败 率； 身份确定模块， 设置为如果所述失败率统计模块统计的结构为所述失败率 满足所述比值监控门限， 确定所述用户为黑名单用户。
8. 根据权利要求 7所述的装置， 其中， 所述装置还包括： 配置模块， 设置为配置首次下发失败率的比值监控门限和至少一条监控规 贝 U; 其中， 所述监控规则包括规则时长、 时间粒度和所述规则时长内按流量监 控的流量门限， 所述规则时长为所述时间粒度的整数倍。
9. 根据权利要求 8所述的装置， 其中， 所述流量统计模块包括： 流量统计单元， 设置为当所述配置模块配置多条监控规则时， 基于配置的 各个监控规则分别对用户发送的短消息进行计数统计。
10. 根据权利要求 7所述的装置， 其中， 所述失败率统计模块包括：
短消息数计算单元， 设置为对所述用户在所述规则时长内发送的所有短消 息数进行计算； 失败次数计算单元， 设置为对所述用户在所述规则时长内所有首次下发短 消息失败的次数进行计算；
失败率计算单元， 设置为计算所述失败次数计算单元计算的所述首次下发 短消息失败的次数与所述短消息数计算单元计算的所述所有短消息数的比值， 将所述比值作为所述规则时长内所述用户首次下发短消息的失败率。
11. 根据权利要求 7-10任一项所述的装置， 其中， 所述装置还包括： 关联信息获取模块， 设置为如果所述失败率统计模块统计的所述失败率不 满足比值监控门限， 获取所述规则时长内所述用户发送的短消息的关联信息， 其中， 所述关联信息至少包括以下之一： 起呼频次、 内容长度一致率、 关键字 出现频率和目的号码连续率； 其中， 所述起呼频次、 所述内容长度一致率、 所 述关键字出现频率和所述目的号码连续率分别配置有一个关联门限；
身份再次确认模块， 设置为如果所述关联信息获取模块获取的所述关联信 息中有一个满足对应的关联门限， 确定所述用户为黑名单用户。
PCT/CN2012/074640 2011-11-24 2012-04-25 用户身份的确定方法和装置 WO2013075462A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2011103780497A CN102378180A (zh) 2011-11-24 2011-11-24 用户身份的确定方法和装置
CN201110378049.7 2011-11-24

Publications (1)

Publication Number Publication Date
WO2013075462A1 true WO2013075462A1 (zh) 2013-05-30

Family

ID=45796002

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/074640 WO2013075462A1 (zh) 2011-11-24 2012-04-25 用户身份的确定方法和装置

Country Status (2)

Country Link
CN (1) CN102378180A (zh)
WO (1) WO2013075462A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105512094A (zh) * 2015-12-04 2016-04-20 小米科技有限责任公司 异常短信模板确定方法及装置

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102378180A (zh) * 2011-11-24 2012-03-14 中兴通讯股份有限公司 用户身份的确定方法和装置
CN103634797A (zh) * 2013-12-06 2014-03-12 中国联合网络通信集团有限公司 一种垃圾短信识别方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101043656A (zh) * 2007-04-29 2007-09-26 中兴通讯股份有限公司 一种垃圾短信可疑用户监控方法和系统
CN101321070A (zh) * 2008-07-16 2008-12-10 中兴通讯股份有限公司 一种可疑用户的监控系统及方法
CN102378180A (zh) * 2011-11-24 2012-03-14 中兴通讯股份有限公司 用户身份的确定方法和装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7706263B2 (en) * 2005-12-15 2010-04-27 Yahoo! Inc. Tracking and blocking of spam directed to clipping services
CN101702801A (zh) * 2009-10-30 2010-05-05 中兴通讯股份有限公司 短消息监控方法和系统
CN102231888A (zh) * 2011-06-24 2011-11-02 中兴通讯股份有限公司 一种监控方法和装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101043656A (zh) * 2007-04-29 2007-09-26 中兴通讯股份有限公司 一种垃圾短信可疑用户监控方法和系统
CN101321070A (zh) * 2008-07-16 2008-12-10 中兴通讯股份有限公司 一种可疑用户的监控系统及方法
CN102378180A (zh) * 2011-11-24 2012-03-14 中兴通讯股份有限公司 用户身份的确定方法和装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105512094A (zh) * 2015-12-04 2016-04-20 小米科技有限责任公司 异常短信模板确定方法及装置

Also Published As

Publication number Publication date
CN102378180A (zh) 2012-03-14

Similar Documents

Publication Publication Date Title
US10884844B2 (en) Data stream processor and method to counteract anomalies in data streams transiting a distributed computing system
CN105490862B (zh) 一种高效的故障诊断引擎
RU2582573C2 (ru) Способ уведомления о полосе пропускания пользователя
EP2656543B1 (en) Method of and device for service monitoring and service monitoring management
US10333724B2 (en) Method and system for low-overhead latency profiling
WO2021227785A1 (zh) 流媒体的指标采集处理方法、装置、计算机及存储介质
CN108616429A (zh) 一种推送服务的重连方法及设备
WO2011143847A1 (zh) 一种短消息监控系统和方法
CN103914321B (zh) 一种调用系统的消息处理能力的方法和移动终端
CA2945384A1 (en) Wi-fi radio health score
WO2014176991A1 (zh) 多媒体业务处理装置、方法及系统
GB2594107A (en) Network analytics
EP2656544B1 (en) Method of and device for service monitoring and service monitoring management
WO2013075462A1 (zh) 用户身份的确定方法和装置
US11930499B2 (en) Network monitoring in service enabler architecture layer (SEAL)
WO2019242467A1 (zh) 一种防止流量欺诈的方法及装置
CN108039956A (zh) 应用监控方法、系统和计算机可读存储介质
CN101420336A (zh) 在网络中识别网络电话流量的方法及其系统
WO2011127692A1 (zh) 一种短消息监控装置及方法
US8762520B2 (en) Method and system to detect a predictive network signature
CN108646956A (zh) 一种视联网的数据处理方法和装置
CN109361546A (zh) 一种基于视联网的程序预警方法和装置
CN112217944B (zh) 在线话单处理方法、装置、设备以及存储介质
WO2017193798A1 (zh) 一种垃圾信息监控方法、装置及通信系统
WO2020164457A1 (zh) 处理异常的方法、装置与设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12851202

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12851202

Country of ref document: EP

Kind code of ref document: A1