WO2016034063A1 - 基于伪基站的恶意短信息处理方法及客户端 - Google Patents

基于伪基站的恶意短信息处理方法及客户端 Download PDF

Info

Publication number
WO2016034063A1
WO2016034063A1 PCT/CN2015/088189 CN2015088189W WO2016034063A1 WO 2016034063 A1 WO2016034063 A1 WO 2016034063A1 CN 2015088189 W CN2015088189 W CN 2015088189W WO 2016034063 A1 WO2016034063 A1 WO 2016034063A1
Authority
WO
WIPO (PCT)
Prior art keywords
short message
malicious
url
base station
pseudo base
Prior art date
Application number
PCT/CN2015/088189
Other languages
English (en)
French (fr)
Inventor
孟齐源
陈亮
高祎玮
Original Assignee
北京奇虎科技有限公司
奇智软件（北京）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司, 奇智软件（北京）有限公司 filed Critical 北京奇虎科技有限公司
Publication of WO2016034063A1 publication Critical patent/WO2016034063A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Definitions

  • the present invention relates to the field of short message processing, and in particular, to a malicious short message processing method and client based on a pseudo base station.
  • the present invention has been made in order to provide a pseudo base station based malicious short message processing method and corresponding client that overcomes the above problems or at least partially solves the above problems.
  • a method for processing a malicious short message based on a pseudo base station includes: determining whether a short base station received by the mobile terminal includes a pseudo base station feature; if yes, saving according to a database
  • the malicious pseudo base station list determines whether the pseudo base station feature is a malicious pseudo base station feature, wherein the database includes a local database and/or a cloud server database; and when the short message is determined to be malicious short message according to the determination result, Malicious short messages perform secure processing operations.
  • a malicious short message base based on a pseudo base station is also provided
  • the client is applied to the mobile terminal, and includes: a determining module, configured to determine whether the short message received by the mobile terminal includes a pseudo base station feature; and the determining module is adapted to: if the short message includes a pseudo base station feature, according to The list of malicious pseudo base stations stored in the database determines whether the pseudo base station feature is a malicious pseudo base station feature, wherein the database includes a local database and/or a cloud server database; and the processing module is adapted to determine the short message according to the determination result.
  • a security processing operation is performed on the malicious short message.
  • a computer program comprising computer readable code, when said computer readable code is run on a computing device, causing said computing device to perform a pseudo-based A malicious short message processing method for a base station.
  • a computer readable medium storing the above computer program is provided.
  • the method for processing a malicious short message based on a pseudo base station can determine whether a short base station received by the mobile terminal includes a pseudo base station feature, and according to the list of malicious pseudo base stations stored in the database when determining the feature including the pseudo base station Determining whether the pseudo base station feature is a malicious pseudo base station feature.
  • the short message is determined to be malicious short message according to the determination result, the security processing operation is performed on the malicious short message. Therefore, the method for processing a malicious short message based on a pseudo base station according to the embodiment of the present invention solves the problem in the prior art that when the short message is transmitted in combination with the pseudo base station, it is impossible to determine whether the short message is malicious short message and then perform corresponding processing.
  • the step of “determining whether the short information received by the mobile terminal includes the pseudo base station feature” is performed, and determining whether the short information itself carries the pseudo base station feature and determining the short Whether the pseudo base station carried in the information is a malicious pseudo base station. Therefore, when the short message is transmitted in combination with the pseudo base station, it can be determined whether the short message is malicious short message, and when determining that the short message is malicious short message, perform corresponding processing on the malicious short message (for example, directly intercepting the malicious short message or in the user pair When the malicious short message is viewed, the user is prompted to view the short message as a malicious short message.
  • the malicious short message transmitted by the pseudo base station can be determined in time, and the malicious short information is processed in time to avoid being unable to identify the malicious short message sent by the pseudo base station, causing the user to be deceived.
  • the adverse consequences of property losses have the beneficial effect of improving the security of mobile terminals receiving short messages and protecting users' information and property safely and effectively.
  • FIG. 1 shows a process flow diagram of a pseudo base station based malicious short message processing method according to an embodiment of the present invention
  • FIG. 2 illustrates a process flow diagram for determining whether a short message is a malicious short message based on content of a short message, in accordance with a preferred embodiment of the present invention
  • FIG. 3 is a schematic diagram showing an interface for prompting a user for short messages as malicious short messages according to a preferred embodiment of the present invention
  • FIG. 4 shows a process flow diagram for identifying a pseudo base station in accordance with a preferred embodiment of the present invention
  • FIG. 5 is a flowchart showing a process of a malicious base station-based malicious short message processing method according to a preferred embodiment of the present invention
  • FIG. 6 is a schematic structural diagram of a malicious short message processing client based on a pseudo base station according to an embodiment of the present invention
  • FIG. 7 is a schematic structural diagram of a malicious short message processing client based on a pseudo base station according to a preferred embodiment of the present invention.
  • Figure 8 is a block diagram schematically showing a computing device for performing a pseudo base station based malicious short message processing method according to the present invention
  • Fig. 9 schematically shows a storage unit for holding or carrying program code implementing the pseudo base station based malicious short message processing method according to the present invention.
  • the short message when the short message is transmitted in combination with the pseudo base station, it is impossible to determine whether the short message is malicious short information, and thus the malicious short message sent by the pseudo base station cannot be processed correspondingly to ensure the security of the user information and property.
  • an embodiment of the present invention provides a malicious short message processing method based on a pseudo base station, which is applied to a mobile terminal.
  • 1 shows a process flow diagram of a pseudo base station based malicious short message processing method in accordance with one embodiment of the present invention. Referring to FIG. 1, the flow includes at least steps S102 to S106.
  • Step S102 Determine whether the short message received by the mobile terminal includes a pseudo base station feature.
  • Step S104 If yes, determining the pseudo according to the list of malicious pseudo base stations stored in the database. Whether the base station feature is a malicious pseudo base station feature, wherein the database includes a local database and/or a cloud server database.
  • Step S106 Perform a security processing operation on the malicious short message when determining that the short message is malicious short message according to the determination result.
  • the method for processing a malicious short message based on a pseudo base station can determine whether a short base station received by the mobile terminal includes a pseudo base station feature, and according to the list of malicious pseudo base stations stored in the database when determining the feature including the pseudo base station Determining whether the pseudo base station feature is a malicious pseudo base station feature.
  • the short message is determined to be malicious short message according to the determination result, the security processing operation is performed on the malicious short message. Therefore, the method for processing a malicious short message based on a pseudo base station according to the embodiment of the present invention solves the problem in the prior art that when the short message is transmitted in combination with the pseudo base station, it is impossible to determine whether the short message is malicious short message and then perform corresponding processing.
  • the step of “determining whether the short information received by the mobile terminal includes the pseudo base station feature” is performed, and determining whether the short information itself carries the pseudo base station feature and determining the short Whether the pseudo base station carried in the information is a malicious pseudo base station. Therefore, when the short message is transmitted in combination with the pseudo base station, it can be determined whether the short message is malicious short message, and when determining that the short message is malicious short message, perform corresponding processing on the malicious short message (for example, directly intercepting the malicious short message or in the user pair When the malicious short message is viewed, the user is prompted to view the short message as a malicious short message.
  • the malicious short message transmitted by the pseudo base station can be determined in time, and the malicious short information is processed in time to avoid being unable to identify the malicious short message sent by the pseudo base station, causing the user to be deceived.
  • the adverse consequences of property losses have the beneficial effect of improving the security of mobile terminals receiving short messages and protecting users' information and property safely and effectively.
  • the embodiment of the present invention can determine whether the short information received by the mobile terminal includes the pseudo base station feature, and process the short information according to the judgment result of the pseudo base station feature.
  • the embodiment of the present invention may obtain the attribute information of the short message, and determine whether the short message is malicious short information according to the obtained attribute information. If yes, the malicious short message is directly processed for security processing, and if not, it is determined whether the short message received by the mobile terminal includes the pseudo base station feature.
  • the attribute information of the short message may include related information of any short message such as the sending time of the short message and the receiving time of the short message.
  • the attribute information of the short message in the embodiment of the present invention includes the content of the short message and/or the sending number of the short message. Now, it is judged whether the short message is a malicious short message according to the content of the short message and the transmission number of the short message.
  • the short message is a malicious short message according to the sending number of the short message, that is, whether the short message is a malicious short message according to whether the sending number of the short message exists in the white number of the sending number.
  • the sending number of the short message does not exist in the white list of the sending number, in order to prevent the newly generated number from being the sending number of the malicious short message, it is determined that the short message whose sending number does not exist in the white list of the sending number is malicious short message, and directly The malicious short message performs a security processing operation.
  • the transmission number of the short message exists in the white list of the transmission number, the short message may be the short message transmitted by the pseudo base station. Therefore, for the short message whose transmission number exists in the white list of the transmission number, it is determined whether or not the pseudo base station feature is included.
  • the sending number when the sending number of the short message is queried, the sending number may be queried in the sending number white list and/or the sending number black list.
  • the sent number white list stores the determined non-malicious sending number
  • the sending number black list stores the determined malicious sending number.
  • the sending number when the sending number is queried in the sending number white list, it can be determined that the sending number is a non-malicious sending number, and when the sending number is queried in the sending number blacklist, it can be determined that the sending number is a malicious sending number.
  • the sending number is not found in the whitelist of the sending number and the blacklist of the sending number, the sending number is unknown malicious or non-malicious. In order to avoid the update of the blacklist of the sending number is not timely, the sending number cannot be promptly followed to determine the malicious.
  • the problem with short messages in this case, sets the sending number of this class to be a malicious sending number.
  • the sending number of the short message is determined according to the white number of the sending number.
  • the result of the determination is that the sending number of the first short message exists in the white list, and the sending number of the second short message does not exist in the white list.
  • the second short message is directly determined to be a malicious short message, and the second short message is subjected to a security processing operation (for example, an intercepting operation), and for the first short message, the short message may be a sending number white. If the corresponding sending number in the list is sent, the malicious sending number may be sent by the pseudo base station to be the number in the white number of the sending number. Therefore, the method for processing the malicious short message based on the pseudo base station is determined according to the embodiment of the present invention. Whether the second short message contains pseudo base station features.
  • FIG. 2 is a process flow diagram for determining whether a short message is a malicious short message based on the content of the short message, in accordance with a preferred embodiment of the present invention. Referring to FIG. 2, the flow includes at least steps S202 to S210.
  • Step S202 Acquire the content of the short message.
  • Step S204 Determine whether the content of the short information acquired in step S202 carries a Uniform Resource Locator (URL). If yes, go to step S206, if no, go to step S208.
  • URL Uniform Resource Locator
  • Step S206 Query whether the URL included in the content of the short message is a malicious URL. If no, step S208 is performed, and if so, step S210 is performed.
  • the manner of querying whether the URL is a malicious URL may be any manner capable of determining whether the URL is a malicious URL.
  • two ways of querying whether a URL is a malicious URL are introduced.
  • the first way to query whether the URL is a malicious URL is to directly access the content corresponding to the URL, and determine whether the URL is a malicious URL according to the corresponding content. Since the URL is used to check whether the URL is a malicious URL, the content corresponding to the URL can be directly viewed. Therefore, the accuracy of the query result in this manner is high. However, because this method directly views the content corresponding to the URL, the query method takes a long time, and it is easy to cause the short message to be determined according to whether the URL is a malicious URL or not before the user views the short message. The problem of malicious short messages. Therefore, in this example, the second way of querying whether the URL is a malicious URL is also provided.
  • the second way to query whether the URL is a malicious URL is to determine whether the URL exists in the URL whitelist and/or blacklist.
  • the URL whitelist contains a URL that has been determined to be non-malicious
  • the URL blacklist contains a URL that has been determined to be malicious.
  • the URL can be determined to be a non-malicious URL.
  • the URL can be determined to be a malicious URL.
  • the user's information and the property may be threatened. By default this type of URL is a malicious URL.
  • Step S208 When the short message is not determined to be malicious short message, the short message is released, and the process ends.
  • Step S210 Perform a corresponding security processing operation on the malicious short message, and the process ends.
  • the short message can be determined as the malicious short message.
  • the malicious short message is processed accordingly. For example, when the malicious short message is intercepted, when the user views the intercepted short message, the user is prompted to use the short message as a malicious short message.
  • FIG. 3 is a schematic diagram showing an interface for prompting a user for short messages as malicious short messages according to a preferred embodiment of the present invention. Figure.
  • the short message After determining whether the short message is a malicious short message according to the content of the short message transmission number or the short message, if the short message is a malicious short message, perform a security processing operation on the malicious short message (for example, intercepting the short message) Or, the security message is prompted for the short message, and the current short message is prompted to be a malicious short message.
  • the attribute information of the short message is used, the content of the short message and the content of the short message are preferably introduced in the embodiment of the present invention. If it is not determined that the short message is malicious short message, it is determined whether the short message includes the pseudo base station feature.
  • the sending number of the short message may be combined with The content of the short message describes whether the short message is a malicious short message. For example, firstly, according to the sending number of the short message, it is determined whether the short message is malicious short message. If the short message is not determined as the malicious short message according to the sending number of the short message, according to whether the short message of the short message is malicious short message, when If the short message is still unable to determine that the short message is malicious short message according to the content of the short message, it is determined whether the short message includes the pseudo base station feature.
  • the short message may be determined as a malicious short message according to other methods or methods or means for judging whether the short message is malicious short message.
  • the description of the method for processing the malicious short message based on the pseudo base station provided by the embodiment of the present invention is highlighted.
  • the short message is determined to be non- Malicious short message.
  • a method for judging whether the received short message includes a pseudo base station feature is to identify whether the sender of the short message is a pseudo base station.
  • the process of identifying a pseudo base station is now described. 4 shows a process flow diagram for identifying a pseudo base station in accordance with a preferred embodiment of the present invention. Referring to FIG. 4, the flow includes at least steps S402 to S408.
  • Step S402 Monitor a handover event of a base station that communicates with the mobile terminal.
  • the short base station since the short base station is used to transmit the short message, it must be switched by the base station. Therefore, in this example, the handover event of the base station communicating with the mobile terminal is monitored.
  • base station handover events can be monitored by monitoring the operating system of the mobile terminal. For example, monitor the interface in the Android system related to the state of network communication.
  • Step S404 After detecting that the base station is handed over from the first base station to the second base station, detecting whether the mobile terminal receives the short message from the second base station.
  • a pseudo base station usually relies on instantaneous high-power radio transmission to forcibly occupy a mobile terminal and transmits a malicious short message to a mobile terminal in its coverage area within a short time (eg, 8 to 12 seconds) that can be maintained, this example is And setting a detection time, after detecting that the base station is handed over from the first base station to the second base station, detecting, in the detection time, whether the mobile terminal receives the short message from the second base station. If yes, the received short message is the short message sent by the pseudo base station.
  • a short time eg, 8 to 12 seconds
  • Step S406 If it is detected that the mobile terminal receives the short message, it is determined whether the short message meets the preset rule.
  • the preset rule in this step is a short message intelligent interception rule. For example, according to the short message sender number feature, whether the short message content includes keywords such as advertisements, fraud, or phishing website URL, whether the short message center number is legal, has been The user marks the information such as junk short messages for judgment.
  • Step S408 For the short message that meets the preset rule mentioned in step S406, query whether the call forwarding state of the short message center number corresponding to the short message is available on the operating system of the mobile terminal. If not available, the second base station is a pseudo base station, and the process ends.
  • the sender of the short message When the sender of the short message is identified as a pseudo base station, that is, the short message includes the pseudo base station feature, it can be determined according to the flow shown in FIG. 1 whether the short message is malicious short message, and the corresponding security processing operation is performed.
  • a preferred embodiment is provided to receive a method for processing a malicious short message based on a pseudo base station according to an embodiment of the present invention.
  • the mobile terminal is set as a mobile phone.
  • FIG. 5 shows a process flow diagram of a pseudo base station based malicious short message processing method in accordance with a preferred embodiment of the present invention. Referring to FIG. 5, the flow includes at least steps S502 to S516.
  • Step S502 Determine whether the sending number of the short message exists in the white list of the sending number. If yes, go to step S504, if no, go to step S516.
  • the accuracy of the determination is high, and the malicious short message cannot be processed in time due to the problem that the blacklist of the sending number is not updated in time
  • the sending number does not exist in the send
  • the number is whitelisted, it is determined that the sending number is a malicious sending number, and then the corresponding short message is determined to be malicious short message. Therefore, in this example, as shown in step S502 in FIG. 5, it is possible to query only whether the sending number exists in the sending number white list, and determine whether the short information is malicious short information according to the query result.
  • Step S504 Acquire the content of the received short message.
  • Step S506 determining whether the content of the short message includes a URL. If yes, go to step S508, if no, go to step S510.
  • Step S508 When it is determined in step S506 that the content of the short message includes a URL, it is queried whether the URL is a malicious URL.
  • the first way to query whether the URL is a malicious URL is to directly access the content corresponding to the URL, and determine whether the URL is a malicious URL according to the corresponding content. Since the URL is used to check whether the URL is a malicious URL, the content corresponding to the URL can be directly viewed. Therefore, the accuracy of the query result in this manner is high. However, because this method directly views the content corresponding to the URL, the query method takes a long time, and it is easy to cause the short message to be determined according to whether the URL is a malicious URL or not before the user views the short message. The problem of malicious short messages. Therefore, in this example, the second way of querying whether the URL is a malicious URL is also provided.
  • the second way to query whether the URL is a malicious URL is to determine whether the URL exists in the URL whitelist and/or blacklist.
  • the URL whitelist contains a URL that has been determined to be non-malicious
  • the URL blacklist contains a URL that has been determined to be malicious.
  • the URL can be determined to be a non-malicious URL.
  • the URL can be determined to be a malicious URL.
  • the user's information and the property may be threatened. By default this type of URL is a malicious URL.
  • Step S510 Determine whether the pseudo base station feature is included in the short message received by the mobile phone. If yes, go to step S512, if no, go to step S514.
  • determining whether the short message received by the mobile phone includes the pseudo base station feature is determining whether the transmitting end of the received short message is a pseudo base station.
  • the process of determining whether the sender of the short message is a pseudo base station includes at least the following four steps: 1. monitoring a handover event of the base station communicating with the mobile phone; 2. detecting the mobile phone after detecting that the base station has switched to the second base station by the first base station Whether to receive the short message from the second base station; 3. If it detects that the mobile phone receives the short message, determine the phase of the short message Whether the information meets the preset rules; 4. For the short message that meets the preset rule, the call forwarding status of the short message center number corresponding to the short message is queried on the operating system of the mobile phone. If not available, the second base station is identified as a pseudo base station.
  • Step S512 Determine, according to the characteristics of the pseudo base station, whether the received short message is malicious short information. If it is determined that the received short message is non-malicious short message, step S514 is performed, and if it is determined that the received short message is malicious short message, step S516 is performed.
  • step S510 if it is determined according to step S510 that the short information received by the mobile phone includes the pseudo base station feature, whether the pseudo base station feature is a malicious pseudo base station feature is determined according to the malicious pseudo base station list stored in the database. If so, it can be determined that the short message is a malicious short message, and if not, the short message can be determined to be a non-malicious short message.
  • Step S514 When the short message non-malicious short message is determined, the short message is released, and the process ends.
  • Step S516 When it is determined that the short message is malicious short message, perform corresponding processing on the malicious short message, and the process ends.
  • the processing of the malicious short message may be directly intercepting the malicious short message, or may be, when the user clicks to view the malicious short message, prompting the user that the current short message is determined as a malicious short message, so that the user treats the short message with caution. To prevent users from being deceived.
  • the embodiment of the present invention provides a malicious short message processing client based on a pseudo base station, which is applied to a mobile terminal to implement A malicious short message processing method based on a pseudo base station.
  • FIG. 6 is a schematic structural diagram of a malicious short message processing client based on a pseudo base station according to an embodiment of the present invention.
  • the pseudo base station-based malicious short message processing client according to the embodiment of the present invention includes at least a determining module 610, a determining module 620, and a processing module 630.
  • the determining module 610 is adapted to determine whether the short message received by the mobile terminal includes a pseudo base station feature.
  • the determining module 620 is coupled to the determining module 610, and is adapted to: when the short information includes the pseudo base station feature, the list of malicious pseudo base stations stored in the database determines whether the pseudo base station feature is a malicious pseudo base station feature, wherein the database includes a local database and/or Or cloud server database.
  • the processing module 630 is coupled to the determining module 620, and is adapted to perform a security processing operation on the malicious short information when determining that the short information is malicious short message according to the determination result.
  • FIG. 7 illustrates a malicious base station based on a pseudo base station according to a preferred embodiment of the present invention. Handle the structure of the client.
  • the pseudo base station-based malicious short message processing client in the embodiment of the present invention further includes:
  • the obtaining module 640 is coupled to the processing module 630, and is adapted to obtain attribute information of the short message, and determine, according to the attribute information, whether the short message is malicious short information, wherein the attribute information includes the content of the short message and the sending number of the short message. ;
  • the processing module 630 is further adapted to process the short information according to the determination result.
  • processing module 630 is further adapted to:
  • the malicious short message is processed
  • the trigger judging module continues to determine whether the short message received by the mobile terminal includes the pseudo base station feature.
  • the determining module 610 is further adapted to:
  • the short message is a malicious short message.
  • the pseudo base station based malicious short message processing client in the embodiment of the present invention further includes:
  • the determining module 610 is further configured to determine whether the content of the short message carries the uniform resource locator URL;
  • the querying module 650 is coupled to the determining module 610, and is further configured to: if the URL is a malicious URL, and trigger the determining module to determine whether the short message is malicious short message according to the query result.
  • the determining module 610 is further adapted to:
  • the short message is determined to be a malicious short message.
  • the query module 650 is further adapted to query whether the URL is a malicious URL using at least one of the following:
  • Determining whether the URL exists in the URL whitelist and if so, determining that the URL is a non-malicious URL, and if not, determining that the URL is a malicious URL, wherein the URL whitelist stores a URL that has been determined to be non-malicious.
  • the security processing operation performed by the processing module 630 on the malicious short message includes at least one of the following: an intercepting operation; and a reminding short information generating operation.
  • the determining module 620 is further adapted to:
  • the embodiment of the present invention can achieve the following beneficial effects:
  • the method for processing a malicious short message based on a pseudo base station can determine whether a short base station received by the mobile terminal includes a pseudo base station feature, and according to the list of malicious pseudo base stations stored in the database when determining the feature including the pseudo base station It is determined whether the pseudo base station feature is a malicious pseudo base station feature. When it is determined that the short message is a malicious short message according to the first determination result, the processing operation is performed on the malicious short message. Therefore, the method for processing a malicious short message based on a pseudo base station according to the embodiment of the present invention solves the problem in the prior art that when the short message is transmitted in combination with the pseudo base station, it is impossible to determine whether the short message is malicious short message and then perform corresponding processing.
  • the step of “determining whether the short information received by the mobile terminal includes the pseudo base station feature” is performed, and determining whether the short information itself carries the pseudo base station feature and determining the short Whether the pseudo base station carried in the information is a malicious pseudo base station. Therefore, when the short message is transmitted in combination with the pseudo base station, it can be determined whether the short message is malicious short message, and when determining that the short message is malicious short message, perform corresponding processing on the malicious short message (for example, directly intercepting the malicious short message or in the user pair When the malicious short message is viewed, the user is prompted to view the short message as a malicious short message.
  • the malicious short message transmitted by the pseudo base station can be determined in time, and the malicious short information is processed in time to avoid being unable to identify the malicious short message sent by the pseudo base station, causing the user to be deceived.
  • the adverse consequences of property losses have the beneficial effect of improving the security of mobile terminals receiving short messages and protecting users' information and property safely and effectively.
  • modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. in.
  • the modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components.
  • any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined.
  • Each feature disclosed in this specification (including the accompanying claims, the abstract and the drawings) may be replaced by alternative features that provide the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of the functionality of some or all of the components of a browser device in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • FIG. 8 illustrates a computing device that can implement a pseudo base station based malicious short message processing method.
  • the computing device conventionally includes a processor 810 and a computer program product or computer readable medium in the form of a memory 820.
  • the memory 820 may be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 820 has a memory space 830 for program code 831 for performing any of the method steps described above.
  • storage space 830 for program code may include various program code 831 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • Such computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG.
  • the storage unit may have storage segments, storage spaces, and the like that are similar to the storage 820 in the computing device of FIG.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 831', code that can be read by a processor, such as 810, for example.
  • the computing device is caused to perform various steps in the methods described above.

Abstract

本发明提供了一种基于伪基站的恶意短信息处理方法及客户端。其中，该方法包括：判断移动终端接收的短信息中是否包含伪基站特征；若是，根据数据库中保存的恶意伪基站名单确定伪基站特征是否为恶意伪基站特征，其中，数据库包括本地数据库和/或云服务器数据库；根据确定结果确定短信息为恶意短信息时，对恶意短信息执行安全处理操作。依据本发明实施例，能够及时判断出结合伪基站进行发送的恶意短信息，并及时对恶意短信息进行处理，避免用户无法自行判断出结合伪基站发送的恶意短信息导致上当受骗，造成财产损失的不良后果。

Description

基于伪基站的恶意短信息处理方法及客户端 技术领域
本发明涉及短信息处理领域，特别是涉及一种基于伪基站的恶意短信息处理方法及客户端。
背景技术
随着移动终端的普及，以及移动终端智能化的发展，人们越来越习惯通过移动终端进行各种与生产生活相关的操作。例如，通过移动终端进行信用卡还款、购物支付款项等财务类操作。同理，商家们也越来越习惯通过移动终端通知或者发布活动信息或者重要通知等，以提高客户操作的便捷程度。例如，银行类商家定期发送短信息至对应用户的移动终端，提醒用户需要准时对信用卡还款，或者提示用户其信用卡积分能够兑换奖品等。
而伴随着人们对于移动终端依赖性的增加，各类通过发送短信息至移动终端进行诈骗或者盗取用户信息等非法操作也是层出不穷。例如，不法分子通过发送广告类信息或者冒充用户熟识的人群等手段骗取用户的财务类信息，导致用户财产的损失。现有技术中，仅能够根据判断短信息发送方是否为恶意短信息发送方确定移动终端接收的短信息是否为恶意短信息，而当短信息结合伪基站进行发送，则无法确定短信息是否为恶意短信息，进而无法对结合伪基站发送的恶意短信息进行相应处理以保证用户的信息及财产安全。
发明内容
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至少部分地解决上述问题的基于伪基站的恶意短信息处理方法和相应的客户端。
根据本发明的一方面，提供了一种基于伪基站的恶意短信息处理方法，应用于移动终端，包括：判断所述移动终端接收的短信息中是否包含伪基站特征；若是，根据数据库中保存的恶意伪基站名单确定所述伪基站特征是否为恶意伪基站特征，其中，所述数据库包括本地数据库和/或云服务器数据库；根据确定结果确定所述短信息为恶意短信息时，对所述恶意短信息执行安全处理操作。
根据本发明的另一方面，还提供了一种基于伪基站的恶意短信息处 理客户端，应用于移动终端，包括：判断模块，适于判断所述移动终端接收的短信息中是否包含伪基站特征；确定模块，适于若所述短信息中是否包含伪基站特征，根据数据库中保存的恶意伪基站名单确定所述伪基站特征是否为恶意伪基站特征，其中，所述数据库包括本地数据库和/或云服务器数据库；处理模块，适于根据确定结果确定所述短信息为恶意短信息时，对所述恶意短信息执行安全处理操作。
根据本发明的又一方面，提供了一种计算机程序，其包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据上文所述的基于伪基站的恶意短信息处理方法。
根据本发明的再一方面，提供了一种计算机可读介质，其中存储了上述的计算机程序。
本发明的有益效果为：
依据本发明实施例提供的基于伪基站的恶意短信息处理方法，能够判断移动终端接收的短信息中是否包含伪基站特征，并在确定包含伪基站特征时，根据数据库中保存的恶意伪基站名单确定所述伪基站特征是否为恶意伪基站特征。当根据确定结果确定短信息为恶意短信息时，对恶意短信息执行安全处理操作。因此，本发明实施例提供的基于伪基站的恶意短信息处理方法解决了现有技术中当短信息结合伪基站进行发送时，无法确定短信息是否为恶意短信息，进而进行相应处理的问题。依据本发明实施例提供的基于伪基站的恶意短信息处理方法，执行“判断移动终端接收的短信息中是否包含伪基站特征”步骤，判断出对短信息自身是否携带伪基站特征，并确定短信息中携带的伪基站是否为恶意伪基站的目的。因此当短信息结合伪基站进行发送时，能够确定短信息是否为恶意短信息，并在确定短信息为恶意短信息时，对恶意短信息执行相应处理(例如直接拦截恶意短信息或者在用户对恶意短信息进行查看时提示用户该短信息为恶意短信息)。综上，依据本发明实施例，能够及时判断出结合伪基站进行发送的恶意短信息，并及时对恶意短信息进行处理，避免无法识别出结合伪基站发送的恶意短信息导致用户上当受骗，造成财产损失的不良后果，达到提高移动终端接收短信息的安全性，合理有效保护用户信息及财产安全的有益效果。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。
附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：
图1示出了根据本发明一个实施例的基于伪基站的恶意短信息处理方法的处理流程图；
图2示出了根据本发明一个优选实施例的根据短信息的内容确定短信息是否为恶意短信息的处理流程图；
图3示出了根据本发明一个优选实施例的提示用户短信息为恶意短信息的界面示意图；
图4示出了根据本发明一个优选实施例的识别伪基站的处理流程图；
图5示出了根据本发明一个优选实施例的基于伪基站的恶意短信息处理方法的处理流程图；
图6示出了根据本发明一个实施例的基于伪基站的恶意短信息处理客户端的结构示意图；
图7示出了根据本发明一个优选实施例的基于伪基站的恶意短信息处理客户端的结构示意图；
图8示意性地示出了用于执行根据本发明的基于伪基站的恶意短信息处理方法的计算设备的框图；以及
图9示意性地示出了用于保持或者携带实现根据本发明的基于伪基站的恶意短信息处理方法的程序代码的存储单元。
具体实施方式
下面结合附图和具体的实施方式对本发明作进一步的描述。
相关技术中提及，当短信息结合伪基站进行发送，则无法确定短信息是否为恶意短信息，进而无法对结合伪基站发送的恶意短信息进行相应处理以保证用户的信息及财产安全。
为解决上述技术问题，本发明实施例提供了一种基于伪基站的恶意短信息处理方法，应用于移动终端。图1示出了根据本发明一个实施例的基于伪基站的恶意短信息处理方法的处理流程图。参见图1，该流程至少包括步骤S102至步骤S106。
步骤S102、判断移动终端接收的短信息中是否包含伪基站特征。
步骤S104、若是，根据数据库中保存的恶意伪基站名单确定所述伪 基站特征是否为恶意伪基站特征，其中，所述数据库包括本地数据库和/或云服务器数据库。
步骤S106、根据确定结果确定所述短信息为恶意短信息时，对所述恶意短信息执行安全处理操作。
依据本发明实施例提供的基于伪基站的恶意短信息处理方法，能够判断移动终端接收的短信息中是否包含伪基站特征，并在确定包含伪基站特征时，根据数据库中保存的恶意伪基站名单确定所述伪基站特征是否为恶意伪基站特征。当根据确定结果确定短信息为恶意短信息时，对恶意短信息执行安全处理操作。因此，本发明实施例提供的基于伪基站的恶意短信息处理方法解决了现有技术中当短信息结合伪基站进行发送时，无法确定短信息是否为恶意短信息，进而进行相应处理的问题。依据本发明实施例提供的基于伪基站的恶意短信息处理方法，执行“判断移动终端接收的短信息中是否包含伪基站特征”步骤，判断出对短信息自身是否携带伪基站特征，并确定短信息中携带的伪基站是否为恶意伪基站的目的。因此当短信息结合伪基站进行发送时，能够确定短信息是否为恶意短信息，并在确定短信息为恶意短信息时，对恶意短信息执行相应处理(例如直接拦截恶意短信息或者在用户对恶意短信息进行查看时提示用户该短信息为恶意短信息)。综上，依据本发明实施例，能够及时判断出结合伪基站进行发送的恶意短信息，并及时对恶意短信息进行处理，避免无法识别出结合伪基站发送的恶意短信息导致用户上当受骗，造成财产损失的不良后果，达到提高移动终端接收短信息的安全性，合理有效保护用户信息及财产安全的有益效果。
根据如图1所示的流程图，本发明实施例能够判断移动终端接收的短信息中是否包含伪基站特征，并根据对伪基站特征的判断结果对短信息进行处理。优选地，在根据短信息中的伪基站特征对短信息进行处理之前，本发明实施例可以获取短信息的属性信息，并根据获取到的属性信息判断短信息是否为恶意短信息。若是，则直接对恶意短信息进行安全处理操作，若否，则判断移动终端接收的短信息中是否包含伪基站特征。本发明实施例中，短信息的属性信息可以包括短信息的发送时间、短信息的接收时间等任意短信息的相关信息。优选地，本发明实施例中短信息的属性信息包括短信息的内容和/或短信息的发送号码。现分别对根据短信息的内容以及短信息的发送号码对短信息是否为恶意短信息进行判断。
首先介绍根据短信息的发送号码判断短信息是否为恶意短信息，即根据短信息的发送号码是否存在于发送号码白名单判断短信息是否为恶意短信息。当短信息的发送号码不存在于发送号码白名单，为避免新出现的号码为恶意短信息的发送号码，则确定发送号码不存在于发送号码白名单的短信息为恶意短信息，并直接对该恶意短信息进行安全处理操作。当短信息的发送号码存在于发送号码白名单，则短信息可能为通过伪基站发送的短信息，因此，对于发送号码存在于发送号码白名单的短信息，判断其是否包含伪基站特征。
具体地，本发明中，在对短信息的发送号码进行查询时，可以在发送号码白名单和/或发送号码黑名单中对发送号码进行查询。其中，发送号码白名单中保存有已确定的非恶意的发送号码，发送号码黑名单中保存有已确定的恶意的发送号码。当在发送号码白名单中查询到发送号码时，则能够确定发送号码为非恶意发送号码，当在发送号码黑名单中查询到发送号码时，则能够确定发送号码为恶意发送号码。当在发送号码白名单以及发送号码黑名单中均未查询到发送号码，即发送号码为未知恶意或者非恶意的，为避免发送号码黑名单更新不及时，导致未能够及时跟进发送号码确定恶意短信息的问题，本例中，设置该类发送号码为恶意发送号码。
例如，当手机(移动终端的一种)接收到两条短信息，根据发送号码白名单对短信息的发送号码进行确定。确定结果为，第一条短信息的发送号码存在于白名单，第二条短信息的发送号码不存在于白名单。根据确定结果，直接确定第二条短信息为恶意短信息，并对第二条短信息进行安全处理操作(例如拦截操作)，而对于第一条短信息，由于该短信息可能是发送号码白名单中相对应的发送号码发送的，还可能是恶意发送号码通过伪基站伪装成为发送号码白名单中的号码发送的，因此，依据本发明实施例提供的基于伪基站的恶意短信息处理方法判断第二条短信息中是否包含伪基站特征。
上文对“根据短信息的发送号码判断短信息是否为恶意短信息”的过程进行了介绍，现对“根据短信息的内容判断短信息是否为恶意短信息”的过程进行介绍。如图2示出了根据本发明一个优选实施例的根据短信息的内容确定短信息是否为恶意短信息的处理流程图。参见图2，该流程至少包括步骤S202至步骤S210。
步骤S202、获取短信息的内容。
步骤S204、判断步骤S202中获取到的短信息的内容中是否携带有统一资源定位符(Uniform Resource Locator，以下简称URL)。若是，执行步骤S206，若否，执行步骤S208。
步骤S206、查询短信息的内容中包含的URL是否为恶意URL。若否，执行步骤S208，若是，执行步骤S210。
具体地，本发明中，查询URL是否为恶意URL的方式可以是任意能够确定URL是否为恶意URL的方式。优选地，本例中介绍两种查询URL是否为恶意URL的方式。
第一种查询URL是否为恶意URL的方式为，直接访问URL对应的内容，并根据对应的内容确定URL是否为恶意URL。由于采用该种方式查询URL是否为恶意URL，能够直接对URL对应的内容进行查看，因此，该种方式查询结果的准确率高。但是，同样由于该种方式直接对URL对应的内容进行查看，因此，该种查询方式耗时较长，容易导致不能够在用户查看短信息之前，及时根据URL是否为恶意URL确定短信息是否为恶意短信息的问题。因此，本例中，还提供了第二种查询URL是否为恶意URL的方式。
第二种查询URL是否为恶意URL的方式为，确定URL是否存在于URL白名单和/或黑名单中。本例中，URL白名单中保存有已确定非恶意的URL，而URL黑名单中保存有已确定恶意的URL。该种方式中，若查询到URL存在于URL白名单中，则能够确定URL为非恶意URL，若查询到URL存在于黑名单中，则能够确定URL为恶意URL。另外，对于在黑名单以及白名单中均不存在的URL，本例中，为提高短信息的安全性，避免未能够及时更新至黑名单的恶意URL对用户的信息以及财产造成威胁，可以设置默认此类URL为恶意URL。
步骤S208、当未确定短信息为恶意短信息时，放行短信息，流程结束。
步骤S210、对恶意短信息执行相应安全处理操作，流程结束。
具体地，若对短信息的内容中包含的URL进行查询(步骤S206)，获取到查询结果后，根据查询结果确定URL为恶意URL，则能够确定短信息为恶意短信息。确定短信息为恶意短信息之后，本例中对恶意短信息执行相应的处理。例如，对恶意短信息进行拦截，当用户对已拦截的短信息进行查看时，提示用户当前短信息为恶意短信息。如图3示出了根据本发明一个优选实施例的提示用户短信息为恶意短信息的界面示意 图。如图3所示，当用户点击已拦截短信息，在已拦截短信息的显示界面提示用户“当前短信息来源不可信，存在诈骗风险，请您谨慎对待”，并在界面下方提示用户当前短信息被拦截的原因为：“短信息的内容中的网址为恶意网址(即恶意URL)”。
依据上文介绍的根据短信息的发送号码或者短信息的内容判断短信息是否为恶意短信息之后，若短信息为恶意短信息，则对该恶意短信息执行安全处理操作(例如拦截该短信息或者针对该短信息进行安全提示，提示用户当前短信息为恶意短信息)，另外，若根据短信息的属性信息(本发明实施例中优选上文介绍的短信息的发送号码、短信息的内容)未判断出短信息为恶意短信息，则判断短信息中是否包含伪基站特征。需要说明的是，本发明实施例中，仅对分别根据短信息的发送号码或者短信息的内容对判断短信息是否为恶意短信息进行介绍，实际运用中，还可以结合短信息的发送号码以及短信息的内容对短信息是否为恶意短信息进行介绍。例如，首先根据短信息的发送号码判断短信息是否为恶意短信息，若未能够根据短信息的发送号码确定短信息为恶意短信息，则根据短信息的内容短信息是否为恶意短信息，当根据短信息的内容依然未能够确定短信息为恶意短信息，则判断短信息中是否包含伪基站特征。实际操作中，可以根据其他的判断短信息是否为恶意短信息的方式或者方法或者手段对短信息是否为恶意短信息进行判断。本例中为简化对方法的介绍，突出对本发明实施例提供的基于伪基站的恶意短信息处理方法的介绍，当判断移动终端接收的短信息中未含有伪基站特征时，确定短信息为非恶意短信息。
由上文可知，本例中，在根据伪基站判断短信息是否为恶意短信息之前，需要首先判断移动终端接收的短信息中是否包含伪基站特征。而判断接收的短信息中是否包含伪基站特征的一个方法即为识别短信息的发送方是否为伪基站。现对识别伪基站的过程进行介绍。图4示出了根据本发明一个优选实施例的识别伪基站的处理流程图。参见图4，该流程至少包括步骤S402至步骤S408。
步骤S402、监测与移动终端通信的基站的切换事件。
具体地，由于利用伪基站发送短信息时，必须经过基站的切换，因此，本例中监测与移动终端通信的基站的切换事件。另外，可以通过监测移动终端的操作系统对基站切换事件进行监测。例如，监测安卓系统中与网络通信状态有关的接口。
步骤S404、在监测到基站由第一基站切换到第二基站后，检测移动终端是否接收到来自第二基站的短信息。
由于伪基站通常依靠瞬时的大功率无线电发射强制占用移动终端，并在能够维持的较短时间(如8到12秒)内，向其覆盖区域内的移动终端发送恶意短信息，因此，本例中，设置一个检测时间，在监测到基站由第一基站切换到第二基站后，在检测时间内检测移动终端是否接收到来自第二基站的短信息。若是，则接收到的短信息为通过伪基站发送的短信息。
步骤S406、若检测到移动终端接收到短信息，判断短信息是否符合预设规则。
该步骤中的预设规则为短信息智能拦截规则，例如，根据短信息发送方号码特征，短信息内容是否包含广告、诈骗等关键词或钓鱼网站URL，短信息中心号码是否合法，是否已被用户标记为垃圾短信息等信息进行判断。
步骤S408、对于符合步骤S406中提及的预设规则的短信息，在移动终端的操作系统上查询短信息对应的短信息中心号码的呼叫转移状态是否可用。若不可用，则是被第二基站为伪基站，流程结束。
当识别出短信息的发送方为伪基站，即判断出短信息中包含伪基站特征，则能够依据图1所示的流程确定短信息是否为恶意短信息，并进行相应安全处理操作。
实施例一
为将上文各实施例的基于伪基站的恶意短信息处理方法阐述得更加清楚明白，现提供一个优选实施例对本发明实施例提供的基于伪基站的恶意短信息处理方法进行接收。需要说明的是，为将本优选实施例阐述得更加清晰，本例中，设置移动终端为手机。
图5示出了根据本发明一个优选实施例的基于伪基站的恶意短信息处理方法的处理流程图。参见图5，该流程至少包括步骤S502至步骤S516。
步骤S502、判断短信息的发送号码是否存在于发送号码白名单。若是，执行步骤S504，若否，执行步骤S516。
具体地，为保证根据发送号码确定短信息是否为恶意短信息时，确定的准确度较高，避免由于发送号码黑名单更新不及时等问题导致未能够及时对恶意短信息进行处理，本例中，当确定发送号码不存在于发送 号码白名单，则确定发送号码为恶意发送号码，进而确定对应的短信息为恶意短信息。因此，本例中，如图5中的步骤S502所示，可以仅查询发送号码是否存在于发送号码白名单，并根据查询结果确定短信息是否为恶意短信息。
步骤S504、获取接收的短信息的内容。
步骤S506、判断短信息的内容中是否包含URL。若是，执行步骤S508，若否，执行步骤S510。
步骤S508、当步骤S506中判断短信息的内容中包含URL时，查询该URL是否为恶意URL。
具体地，本例中介绍两种查询URL是否为恶意URL的方式。
第一种查询URL是否为恶意URL的方式为，直接访问URL对应的内容，并根据对应的内容确定URL是否为恶意URL。由于采用该种方式查询URL是否为恶意URL，能够直接对URL对应的内容进行查看，因此，该种方式查询结果的准确率高。但是，同样由于该种方式直接对URL对应的内容进行查看，因此，该种查询方式耗时较长，容易导致不能够在用户查看短信息之前，及时根据URL是否为恶意URL确定短信息是否为恶意短信息的问题。因此，本例中，还提供了第二种查询URL是否为恶意URL的方式。
第二种查询URL是否为恶意URL的方式为，确定URL是否存在于URL白名单和/或黑名单中。本例中，URL白名单中保存有已确定非恶意的URL，而URL黑名单中保存有已确定恶意的URL。该种方式中，若查询到URL存在于URL白名单中，则能够确定URL为非恶意URL，若查询到URL存在于黑名单中，则能够确定URL为恶意URL。另外，对于在黑名单以及白名单中均不存在的URL，本例中，为提高短信息的安全性，避免未能够及时更新至黑名单的恶意URL对用户的信息以及财产造成威胁，可以设置默认此类URL为恶意URL。
步骤S510、判断手机接收的短信息中是否包含伪基站特征。若是，执行步骤S512，若否，执行步骤S514。
具体地，在判断手机接收的短信息是否包含伪基站特征即为判断接收到的短信息的发送端是否为伪基站。判断短信息的发送方是否为伪基站的过程至少包括如下四个步骤：1、监测与手机通信的基站的切换事件；2、在监测到基站有第一基站切换到第二基站后，检测手机是否接收到来自第二基站的短信息；3、若检测到手机接收到短信息，判断短信息的相 关信息是否符合预设规则；4、对于符合预设规则的短信息，在手机的操作系统上查询短信息对应的短信息中心号码的呼叫转移状态是否可用。若不可用，则识别第二基站为伪基站。
步骤S512、根据伪基站特征确定接收的短信息是否为恶意短信息。若确定接收的短信息为非恶意短信息，执行步骤S514，若确定接收的短信息为恶意短信息，执行步骤S516。
具体地，本发明实施例中，若根据步骤S510确定手机接收的短信息中包含伪基站特征，则根据数据库中保存的恶意伪基站名单确定伪基站特征是否为恶意伪基站特征。若是，则能够确定短信息为恶意短信息，若否，则能够确定短信息为非恶意短信息。
步骤S514、当确定短信息非恶意短信息，放行短信息，流程结束。
步骤S516、当确定短信息为恶意短信息时，对恶意短信息执行相应处理，流程结束。
具体地，对恶意短信息的处理可以是直接对恶意短信息进行拦截，还可以是在用户点击查看恶意短信息时，提示用户当前短信息被判定为恶意短信息，以便用户谨慎对待该短信息，防止用户上当受骗。
基于上文各优选实施例提供的基于伪基站的恶意短信息处理方法，基于同一发明构思，本发明实施例提供了一种基于伪基站的恶意短信息处理客户端，应用于移动终端，以实现基于伪基站的恶意短信息处理方法。
图6示出了根据本发明一个实施例的基于伪基站的恶意短信息处理客户端的结构示意图。参见图6，本发明实施例的基于伪基站的恶意短信息处理客户端至少包括：判断模块610、确定模块620以及处理模块630。
现介绍本发明实施例的基于伪基站的恶意短信息处理客户端的各器件或组成的功能以及各部分间的连接关系：
判断模块610，适于判断移动终端接收的短信息中是否包含伪基站特征。
确定模块620，与判断模块610相耦合，适于当短信息中包含伪基站特征时，数据库中保存的恶意伪基站名单确定伪基站特征是否为恶意伪基站特征，其中，数据库包括本地数据库和/或云服务器数据库。
处理模块630，与确定模块620相耦合，适于根据确定结果确定所述短信息为恶意短信息时，对所述恶意短信息执行安全处理操作。
图7示出了根据本发明一个优选实施例的基于伪基站的恶意短信息 处理客户端的结构示意图。参见图7，本发明实施例的基于伪基站的恶意短信息处理客户端还包括：
获取模块640，与处理模块630相耦合，适于获取短信息的属性信息，并根据属性信息判断短信息是否为恶意短信息，其中，属性信息包括短信息的内容以及所示短信息的发送号码；
处理模块630，还适于根据判断结果对短信息进行处理。
在一个优选的实施例中，处理模块630还适于：
若确定短信息为恶意短信息，对恶意短信息进行处理；
若未确定短信息为恶意短信息，触发判断模块继续判断移动终端接收的短信息中是否包含伪基站特征。
在一个优选实施例中，判断模块610还适于：
判断短信息的发送号码是否存在于发送号码白名单，其中，发送号码白名单中存储有已确定非恶意的发送号码；
若否，则判断短信息为恶意短信息。
在一个优选实施例中，本发明实施例的基于伪基站的恶意短信息处理客户端还包括：
判断模块610，还适于判断短信息的内容中是否携带有统一资源定位符URL；
查询模块650，与判断模块610相耦合，还适于若是，查询URL是否为恶意URL，并触发判断模块根据查询结果判断短信息是否为恶意短信息。
在一个优选实施例中，判断模块610还适于：
若查询结果为URL为恶意URL，则判断短信息为恶意短信息。
在一个优选实施例中，查询模块650还适于利用至少以下方式任意之一查询URL是否为恶意URL：
访问URL对应的内容，并根据对应的内容确定URL是否为恶意URL；
确定URL是否存在于URL白名单中，若是，则确定URL为非恶意URL，若否，则确定URL为恶意URL，其中，URL白名单中保存有已确定非恶意的URL。
在一个优选实施例中，处理模块630对恶意短信息执行的安全处理操作至少包括以下任意之一：拦截操作；提醒短信息生成操作。
在一个优选实施例中，确定模块620还适于：
若确定结果为否，则确定短信息为非恶意短信息。
根据上述任意一个优选实施例或多个优选实施例的组合，本发明实施例能够达到如下有益效果：
依据本发明实施例提供的基于伪基站的恶意短信息处理方法，能够判断移动终端接收的短信息中是否包含伪基站特征，并在确定包含伪基站特征时，根据数据库中保存的恶意伪基站名单确定伪基站特征是否为恶意伪基站特征。当根据第一确定结果确定短信息为恶意短信息时，对恶意短信息执行处理操作。因此，本发明实施例提供的基于伪基站的恶意短信息处理方法解决了现有技术中当短信息结合伪基站进行发送时，无法确定短信息是否为恶意短信息，进而进行相应处理的问题。依据本发明实施例提供的基于伪基站的恶意短信息处理方法，执行“判断移动终端接收的短信息中是否包含伪基站特征”步骤，判断出对短信息自身是否携带伪基站特征，并确定短信息中携带的伪基站是否为恶意伪基站的目的。因此当短信息结合伪基站进行发送时，能够确定短信息是否为恶意短信息，并在确定短信息为恶意短信息时，对恶意短信息执行相应处理(例如直接拦截恶意短信息或者在用户对恶意短信息进行查看时提示用户该短信息为恶意短信息)。综上，依据本发明实施例，能够及时判断出结合伪基站进行发送的恶意短信息，并及时对恶意短信息进行处理，避免无法识别出结合伪基站发送的恶意短信息导致用户上当受骗，造成财产损失的不良后果，达到提高移动终端接收短信息的安全性，合理有效保护用户信息及财产安全的有益效果。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备 中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的浏览器装置中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。
例如，图8示出了可以实现基于伪基站的恶意短信息处理方法的计算设备。该计算设备传统上包括处理器810和以存储器820形式的计算机程序产品或者计算机可读介质。存储器820可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。存储器820具有用于执行上述方法中的任何方法步骤的程序代码831的存储空间830。例如，用于程序代码的存储空间830可以包括分别用于实现上面的方法中的各种步骤的各个程序代码831。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。这些计算机程序产品包括诸如硬盘，紧致盘(CD)、存储卡或者软盘之类的程序代码载体。这样的计算机程序产品通常为如参考图9所述的便携式或者固定存储单元。该存储单元可以具有与图8的计算设备中的存储器820类似布置的存储段、存储空间等。程序代码可以例如以适当形式进行压缩。通常，存储单元包括计算机可读代码831’，即可以由例如诸如810之类的处理器读取的代码，这些代码当由 计算设备运行时，导致该计算设备执行上面所描述的方法中的各个步骤。
本文中所称的“一个实施例”、“实施例”或者“一个或者多个实施例”意味着，结合实施例描述的特定特征、结构或者特性包括在本发明的至少一个实施例中。此外，请注意，这里“在一个实施例中”的词语例子不一定全指同一个实施例。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。
此外，还应当注意，本说明书中使用的语言主要是为了可读性和教导的目的而选择的，而不是为了解释或者限定本发明的主题而选择的。因此，在不偏离所附权利要求书的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。对于本发明的范围，对本发明所做的公开是说明性的，而非限制性的，本发明的范围由所附权利要求书限定。

Claims (20)

  1. 一种基于伪基站的恶意短信息处理方法，应用于移动终端，包括：
    判断所述移动终端接收的短信息中是否包含伪基站特征；
    若是，根据数据库中保存的恶意伪基站名单确定所述伪基站特征是否为恶意伪基站特征，其中，所述数据库包括本地数据库和/或云服务器数据库；
    根据确定结果确定所述短信息为恶意短信息时，对所述恶意短信息执行安全处理操作。
  2. 根据权利要求1所述的方法，其中，判断所述移动终端接收的短信息中是否包含伪基站特征之前，还包括：
    获取所述短信息的属性信息，并根据所述属性信息判断所述短信息是否为恶意短信息，其中，所述属性信息包括所述短信息的内容和/或所述短信息的发送号码；
    根据判断结果对所述短信息进行处理。
  3. 根据权利要求2所述的方法，其中，所述根据判断结果对所述短信息进行处理，包括：
    若是，对所述恶意短信息进行安全处理操作；
    若否，判断所述移动终端接收的短信息中是否包含伪基站特征。
  4. 根据权利要求2或3所述的方法，其中，根据所述短信息的发送号码判断所述短信息是否为恶意短信息，包括：
    判断所述短信息的发送号码是否存在于发送号码白名单，其中，所述发送号码白名单中存储有已确定非恶意的发送号码；
    若否，则判断所述短信息为恶意短信息。
  5. 根据权利要求2至4任一项所述的方法，其中，根据所述短信息的内容判断所述短信息是否为恶意短信息，包括：
    判断所述短信息的内容中是否携带有统一资源定位符URL；
    若是，查询所述URL是否为恶意URL，并根据查询结果判断所述短信息是否为恶意短信息。
  6. 根据权利要求5所述的方法，其中，根据查询结果确定所述短信息是否为恶意短信息，包括：
    若所述查询结果为所述URL为恶意URL，则所述短信息为恶意短信息。
  7. 根据权利要求5或6所述的方法，其中，查询所述URL是否为恶意URL的方式至少包括以下任意之一：
    访问所述URL对应的内容，并根据所述对应的内容确定所述URL是否为恶意URL；
    确定所述URL是否存在于URL白名单中，若是，则确定所述URL为非恶意URL，若否，则确定所述URL为恶意URL，其中，所述URL白名单中保存有已确定非恶意的URL。
  8. 根据权利要求1至7任一项所述的方法，其中，对所述恶意短信息执行的安全处理操作至少包括以下任意之一：
    拦截操作；
    提醒短信息生成操作。
  9. 根据权利要求1至8任一项所述的方法，其中，判断所述移动终端接收的短信息中是否包含伪基站特征之后，还包括：
    若否，则确定所述短信息为非恶意短信息。
  10. 一种基于伪基站的恶意短信息处理客户端，应用于移动终端，包括：
    判断模块，适于判断所述移动终端接收的短信息中是否包含伪基站特征；
    确定模块，适于若所述短信息中是否包含伪基站特征，根据数据库中保存的恶意伪基站名单确定所述伪基站特征是否为恶意伪基站特征，其中，所述数据库包括本地数据库和/或云服务器数据库；
    处理模块，适于根据确定结果确定所述短信息为恶意短信息时，对所述恶意短信息执行安全处理操作。
  11. 根据权利要求10所述的客户端，其中，还包括：
    获取模块，适于获取所述短信息的属性信息，并根据所述属性信息判断所述短信息是否为恶意短信息，其中，所述属性信息包括所述短信息的内容以及所示短信息的发送号码；
    所述处理模块，还适于根据判断结果对所述短信息进行处理。
  12. 根据权利要求11所述的客户端，其中，所述处理模块还适于：
    若确定所述短信息为恶意短信息，对所述恶意短信息进行处理；
    若未确定所述短信息为恶意短信息，触发所述判断模块继续判断所述移动终端接收的短信息中是否包含伪基站特征。
  13. 根据权利要求11或12所述的客户端，其中，所述判断模块还适于：
    判断所述短信息的发送号码是否存在于发送号码白名单，其中，所述发送号码白名单中存储有已确定非恶意的发送号码；
    若否，则判断所述短信息为恶意短信息。
  14. 根据权利要求11至13任一项所述的客户端，其中，还包括：
    所述判断模块，还适于判断所述短信息的内容中是否携带有统一资源定位符URL；
    查询模块，还适于若是，查询所述URL是否为恶意URL，并触发所 述判断模块根据查询结果判断所述短信息是否为恶意短信息。
  15. 根据权利要求14所述的客户端，其中，所述判断模块还适于：
    若所述查询结果为所述URL为恶意URL，则判断所述短信息为恶意短信息。
  16. 根据权利要求14或15所述的客户端，其中，所述查询模块还适于利用至少以下方式任意之一查询所述URL是否为恶意URL：
    访问所述URL对应的内容，并根据所述对应的内容确定所述URL是否为恶意URL；
    确定所述URL是否存在于URL白名单中，若是，则确定所述URL为非恶意URL，若否，则确定所述URL为恶意URL，其中，所述URL白名单中保存有已确定非恶意的URL。
  17. 根据权利要求10至16任一项所述的客户端，其中，所述处理模块对所述恶意短信息执行的安全处理操作至少包括以下任意之一：
    拦截操作；
    提醒短信息生成操作。
  18. 根据权利要求10至17任一项所述的客户端，其中，所述确定模块还适于：
    若所述确定结果为否，则确定所述短信息为非恶意短信息。
  19. 一种计算机程序，包括计算机可读代码，当所述计算机可读代码在计算设备上运行时，导致所述计算设备执行根据权利要求1至9任一项所述的基于伪基站的恶意短信息处理方法。
  20. 一种计算机可读介质，其中存储了如权利要求19所述的计算机程序。
PCT/CN2015/088189 2014-09-01 2015-08-26 基于伪基站的恶意短信息处理方法及客户端 WO2016034063A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410440247.5 2014-09-01
CN201410440247.5A CN104185158A (zh) 2014-09-01 2014-09-01 基于伪基站的恶意短信息处理方法及客户端

Publications (1)

Publication Number Publication Date
WO2016034063A1 true WO2016034063A1 (zh) 2016-03-10

Family

ID=51965834

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/088189 WO2016034063A1 (zh) 2014-09-01 2015-08-26 基于伪基站的恶意短信息处理方法及客户端

Country Status (2)

Country Link
CN (1) CN104185158A (zh)
WO (1) WO2016034063A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106304088A (zh) * 2016-09-05 2017-01-04 努比亚技术有限公司 终端及信息处理方法
CN106454844A (zh) * 2016-09-05 2017-02-22 努比亚技术有限公司 终端及信息处理方法
US11625729B2 (en) * 2015-07-20 2023-04-11 Alibaba Group Holding Limited Data processing method, apparatus, and system

Families Citing this family (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104185158A (zh) * 2014-09-01 2014-12-03 北京奇虎科技有限公司 基于伪基站的恶意短信息处理方法及客户端
CN104640116B (zh) * 2014-12-31 2018-05-29 广东欧珀移动通信有限公司 一种诈骗短信防护方法和通信终端
CN104822145B (zh) * 2015-04-22 2016-10-26 北京奇虎科技有限公司 一种识别伪基站短信的方法、装置和系统
CN105025002A (zh) * 2015-06-05 2015-11-04 重庆智韬信息技术中心 通过认证代码实现对通信数据的安全审计
CN106507319A (zh) * 2015-08-04 2017-03-15 北京壹人壹本信息科技有限公司 一种恶意短信息的识别方法及装置
CN105246058B (zh) * 2015-09-01 2019-08-06 中国联合网络通信集团有限公司 短信的验证方法和短信服务器
CN106912032B (zh) * 2015-12-23 2020-02-14 中国移动通信集团公司 一种信息处理方法、系统、客户端和服务器
CN107018500A (zh) * 2016-01-28 2017-08-04 中国移动通信集团河南有限公司 一种信息处理方法及终端、短消息处理装置
CN105813085A (zh) * 2016-03-08 2016-07-27 联想(北京)有限公司 一种信息处理方法及电子设备
CN107241722A (zh) * 2016-03-29 2017-10-10 努比亚技术有限公司 网络通信处理方法及装置
CN107241732A (zh) * 2016-03-29 2017-10-10 努比亚技术有限公司 移动终端开机注册网络的控制方法及装置
CN106028334A (zh) * 2016-04-28 2016-10-12 北京小米移动软件有限公司 信息的识别方法、装置及终端
CN106028297B (zh) * 2016-04-28 2019-11-08 北京小米移动软件有限公司 携带网址的短信处理方法及装置
CN107466019A (zh) * 2016-06-03 2017-12-12 中兴通讯股份有限公司 一种短信识别方法及装置
CN106126707A (zh) * 2016-06-30 2016-11-16 北京奇虎科技有限公司 信息识别方法和信息识别装置
CN106255114A (zh) * 2016-07-27 2016-12-21 努比亚技术有限公司 一种终端及其识别伪基站的方法
CN106304083A (zh) * 2016-08-05 2017-01-04 努比亚技术有限公司 一种确定伪基站的方法及设备
CN108235310A (zh) * 2016-12-14 2018-06-29 中国电信股份有限公司 识别伪装电话号码的方法、服务器以及系统
CN108271159A (zh) * 2017-01-04 2018-07-10 中国移动通信集团四川有限公司 通信处理方法、装置及系统、安全通信方法及装置
CN107155186B (zh) * 2017-04-10 2020-02-14 中国移动通信集团江苏有限公司 一种伪基站定位方法和装置
CN107018152A (zh) * 2017-05-27 2017-08-04 北京奇虎科技有限公司 消息拦截方法、装置和电子设备
CN109548028B (zh) * 2017-09-21 2021-05-14 腾讯科技（深圳）有限公司 基站类型识别方法、装置、终端和计算机可读存储介质
CN109600751B (zh) * 2018-11-19 2020-09-18 华中科技大学 一种基于网络侧用户数据的伪基站检测方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101257652A (zh) * 2007-12-28 2008-09-03 深圳市戴文科技有限公司 一种手机恶意来电与恶意短信的预警方法和系统
CN103607705A (zh) * 2013-12-04 2014-02-26 北京网秦天下科技有限公司 垃圾短信过滤方法及引擎
CN103763690A (zh) * 2014-01-28 2014-04-30 北京奇虎科技有限公司 检测伪基站向移动终端发送短信息的方法和装置
CN103796241A (zh) * 2014-01-28 2014-05-14 工业和信息化部电信研究院 一种基于终端上报信息判断和定位伪基站的方法
CN104185158A (zh) * 2014-09-01 2014-12-03 北京奇虎科技有限公司 基于伪基站的恶意短信息处理方法及客户端

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050020289A1 (en) * 2003-07-24 2005-01-27 Samsung Electronics Co., Ltd. Method for blocking spam messages in a mobile communication terminal
CN102638778A (zh) * 2011-02-15 2012-08-15 上海粱江通信系统股份有限公司 一种监控网间垃圾短消息的系统及方法
CN103037339B (zh) * 2012-12-28 2017-11-17 彩讯科技股份有限公司 一种基于“用户信誉度和短信垃圾度”的短信息过滤方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101257652A (zh) * 2007-12-28 2008-09-03 深圳市戴文科技有限公司 一种手机恶意来电与恶意短信的预警方法和系统
CN103607705A (zh) * 2013-12-04 2014-02-26 北京网秦天下科技有限公司 垃圾短信过滤方法及引擎
CN103763690A (zh) * 2014-01-28 2014-04-30 北京奇虎科技有限公司 检测伪基站向移动终端发送短信息的方法和装置
CN103796241A (zh) * 2014-01-28 2014-05-14 工业和信息化部电信研究院 一种基于终端上报信息判断和定位伪基站的方法
CN104185158A (zh) * 2014-09-01 2014-12-03 北京奇虎科技有限公司 基于伪基站的恶意短信息处理方法及客户端

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11625729B2 (en) * 2015-07-20 2023-04-11 Alibaba Group Holding Limited Data processing method, apparatus, and system
CN106304088A (zh) * 2016-09-05 2017-01-04 努比亚技术有限公司 终端及信息处理方法
CN106454844A (zh) * 2016-09-05 2017-02-22 努比亚技术有限公司 终端及信息处理方法

Also Published As

Publication number Publication date
CN104185158A (zh) 2014-12-03

Similar Documents

Publication Publication Date Title
WO2016034063A1 (zh) 基于伪基站的恶意短信息处理方法及客户端
US20210089644A1 (en) Method, means, system, processor, and memory for intercepting malicious websites
US9277378B2 (en) Short message service validation engine
US8666894B1 (en) Systems and methods for remotely authenticating credit card transactions
US9769688B2 (en) Device and method for prompting information about Wi-Fi signal
US10237272B2 (en) Methods, apparatus, and systems for identity authentication
KR102355973B1 (ko) 스미싱 메시지 판별장치 및 스미싱 메시지 판별방법
CN111031035B (zh) 一种敏感数据访问行为监控方法及装置
WO2018099219A1 (zh) 一种钓鱼网站检测方法和装置
WO2015188739A1 (zh) 消息处理方法及装置
US20180324152A1 (en) Securely recognizing mobile devices
JP2012515956A5 (zh)
WO2015011502A1 (en) Processing electronic tokens
US20160021534A1 (en) Legal authentication message confirmation system and method
CN105320885A (zh) 恶意网站检测方法及装置
WO2018121536A1 (zh) 一种信息安全验证方法以及终端
WO2018201745A1 (zh) 无线接入点的风险提示方法及设备
CN104980420A (zh) 一种业务处理方法、装置、终端及服务器
CN104349318A (zh) 无线局域网的自动认证方法、装置和系统
JP5727991B2 (ja) ユーザ端末、不正サイト情報管理サーバ、不正リクエスト遮断方法、及び不正リクエスト遮断プログラム
US10079856B2 (en) Rotation of web site content to prevent e-mail spam/phishing attacks
CN109688096B (zh) Ip地址的识别方法、装置、设备及计算机可读存储介质
EP3424005A1 (en) Counterfeit electronic device detection
CN113709136B (zh) 一种访问请求验证方法和装置
EP2749097B1 (en) Authenticating a user's location in a femtocell-based network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15838421

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15838421

Country of ref document: EP

Kind code of ref document: A1