WO2016065908A1 - 一种欺诈用户的检测方法、装置和系统 - Google Patents

一种欺诈用户的检测方法、装置和系统 Download PDF

Info

Publication number
WO2016065908A1
WO2016065908A1 PCT/CN2015/081683 CN2015081683W WO2016065908A1 WO 2016065908 A1 WO2016065908 A1 WO 2016065908A1 CN 2015081683 W CN2015081683 W CN 2015081683W WO 2016065908 A1 WO2016065908 A1 WO 2016065908A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
fraudulent
short message
fraud
call
Prior art date
Application number
PCT/CN2015/081683
Other languages
English (en)
French (fr)
Inventor
谢连升
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP15856072.2A priority Critical patent/EP3214861B1/en
Publication of WO2016065908A1 publication Critical patent/WO2016065908A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
    • H04M15/47—Fraud detection or prevention means
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/24—Accounting or billing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Definitions

  • This paper relates to the field of communication technologies, and in particular, to a method, device and system for detecting fraudulent users.
  • the third generation mobile communication system described by the 3GPP is generally composed of a user equipment (User Equipment, UE for short), a UMTS terrestrial Radio Access Network (UTRAN), and a core network (Core Network, referred to as CN).
  • the UTRAN is divided into two parts: a base station (Node B) and a radio network controller (Radio Network Controller, RNC for short) to implement wireless access and radio resource management.
  • the core network is divided into a circuit switched domain (Circuit Switched Domain, referred to as The CS domain) and the Packet Switched Domain (PS Domain) are responsible for the connection with other external networks and the communication management of the UE.
  • the circuit switched domain is mainly composed of the MSC Server (Mobile Switching Centre Server).
  • MGW Media GateWay, Media Gateway
  • VLR Visitor Location Register
  • HLR Home Location Register
  • SGSN Server GPRS Support Node, Service GPRS. Node
  • GGSN Gateway GPRS Support Node, Gateway GPRS Support Node
  • the mobile voice service and the Short Message Service are two basic service functions.
  • the mobile voice service refers to the mobile call service and the voice message service.
  • the mobile call service is the most important service; the short message service is The earliest short message service is also the shortest message service with the highest penetration rate.
  • SMS is easy to use and function. The majority of users are welcome.
  • the basic process of the user initiating the voice service or the short message service is as shown in FIG.
  • the UE accesses the UTRAN through the air interface (ie, wireless mode), and the UTRAN accesses the core network circuit switching domain network entity MSC Server by wire, and the MSC Server controls the call.
  • Connect Continued and provide billing information, and format the billing information to form a Call Detailed Record (CDR) file, and deliver the CDR file to the Billing Domain (BD) through the Bc interface.
  • CDR Call Detailed Record
  • BD Billing Domain
  • the fraudulent users have a negative impact on the network security and service revenue of the operators.
  • the fraudulent users occupy a large amount of radio resources, which causes the normal users' connection rate indicators to decrease, and the traffic is likely to cause switch failures and affect the system. stability.
  • This document provides a method, apparatus and system for detecting fraudulent users to enable effective detection of fraudulent users.
  • a method for detecting fraudulent users including:
  • the data extracted from the user's test call list or the short message call list is analyzed during the detection period to identify the fraudulent user.
  • the fraud analysis is performed on the data extracted from the user's call CDR or the short message CDR in the detection period according to the set fraud identification rule, to identify the fraudulent user.
  • the fraud analysis is performed on the data extracted from the user's call CDR or the short message CDR in the detection period according to the set fraud identification rule, to identify the fraudulent user.
  • the detection data of each user in the current period is analyzed according to the set fraud identification rule to identify the fraudulent user.
  • the method further includes: after identifying the fraudulent user, setting a service restriction policy of the fraudulent user to limit the service usage of the user.
  • the service restriction policy includes one or more of the following restrictions: restricting user calls, false charging for fraudulent users, restricting user short message services, and restricting user location updates.
  • the parameters in the extracted call CDR include one or more of the following parameters: a calling number, a called number, a calling cell, a calling location area, and a call release reason;
  • the parameters in the extracted short message call list include one or more of the following parameters: a short message sender number, a short message receiver number, a short message sender cell, and a short message sender location area;
  • the set fraud identification rules include: a voice fraud identification rule and a short message fraud identification rule;
  • the voice fraud identification rule includes one or more of the following determining conditions: whether the number of trial calls in the detection period exceeds a set threshold, whether the called number belongs to the same number segment, and whether the call release reason is a ringing early release Whether the calling cell and the calling location area are the same;
  • the short message fraud identification rule includes one or more of the following determining conditions: whether the number of short message transmissions exceeds a set threshold in the detection period, whether the short message receiving party number belongs to the same number segment, the short message sender cell, and the short message sender location Whether the districts are the same.
  • a fraud detection device comprising:
  • the fraudulent user identification module is configured to: analyze the data extracted from the user's call CDR or the short message call CDR in the detection period according to the set fraud identification rule to identify the fraudulent user.
  • the fraudulent user identification module includes:
  • the data collection sub-module is configured to: collect a call CDR and a short message calling CDR;
  • the data processing sub-module is configured to: extract parameters in the bill, and form detection data corresponding to the user of the bill;
  • the fraud detection sub-module is configured to: when the set detection period arrives, analyze the detection data of each user in the current period according to the set fraud identification rule to identify the fraudulent user.
  • the fraudulent user identification module is further configured to: after identifying a fraudulent user, setting a service restriction policy of the fraudulent user to limit service usage of the user.
  • a detection system for a fraudulent user comprising: an MSC Server, and the fraud detection device;
  • the MSC Server is configured to: generate a call CDR and a short message calling CDR for the user, and send the call CDR and the short message CDR to the fraud detecting device.
  • the fraud detection apparatus is further configured to: send a number of the fraudulent user and a service restriction policy set for the fraudulent user to the MSC Server;
  • the MSC server is further configured to: add the number of the fraudulent user to the blacklist, and perform service restriction on the fraudulent user according to the service restriction policy corresponding to the fraudulent user.
  • a computer readable storage medium storing computer executable instructions for performing the method of any of the above.
  • the embodiment of the present invention detects fraudulent behaviors based on the call CDRs and the short message CDRs, and can detect fraudulent users in a timely and efficient manner.
  • the fraudulent users' service restriction policies can be set to limit the use of fraudulent users and reduce operators. Loss.
  • 1 is a schematic diagram of a mobile communication system network described by 3GPP;
  • FIG. 2 is a schematic diagram of a user initiating a voice call or using a short message service in a related art mobile network
  • FIG. 3 is a flowchart of a method for detecting a fraudulent user according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of a user initiating a voice call or using a short message service in a mobile network according to an embodiment of the present invention
  • FIG. 5 is a flowchart of determining a fraudulent user according to a voice fraud identification rule according to an embodiment of the present invention
  • FIG. 6 is a flowchart of determining a fraudulent user according to a short message fraud identification rule according to an embodiment of the present invention
  • FIG. 7 is a structural block diagram of a fraud detection apparatus according to an embodiment of the present invention.
  • FIG. 8 is a structural block diagram of a detection system for a fraudulent user according to an embodiment of the present invention.
  • an embodiment of the present invention provides a method, an apparatus, and a system for detecting a fraudulent user.
  • the technical solutions in the embodiments of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention.
  • An embodiment of the present invention provides a method for detecting a fraudulent user, which implements fraudulent user detection by extracting a call ticket or a short message from a user in a detection period according to a set fraud detection rule. The data is analyzed to identify fraudulent users.
  • the call attempt is a bill generated when the call ringing duration is less than a preset value and the call is not entered.
  • Step S301 collecting a call CDR or a short message CDR of the user
  • Step S302 extracting parameters in the bill, and forming detection data corresponding to the user of the bill;
  • Step S303 when the set detection period arrives, analyze the detection data of each user in the current period according to the set fraud identification rule to identify the fraudulent user.
  • the fraudulent user's service restriction policy is also set to limit the service usage of the user.
  • the service restriction policy includes, but is not limited to, the following restrictions: restricting user calls, false charging for fraudulent users, restricting user short message services, and restricting user location updates.
  • false accounting means that charging starts after the called party rings.
  • the embodiment of the present invention detects a fraudulent behavior based on a call CDR and a short message call CDR, and can detect fraudulent users in a timely and efficient manner.
  • a fraudulent user service restriction policy can be set to limit fraudulent user services. Use to reduce the loss of operators.
  • the embodiment of the invention provides a method for detecting a fraudulent user.
  • the mobile switching server MSC Server
  • the fraud detecting device analyzes the call CDR and the SMS calling CDR output by the MSC Server, and performs fraudulent user determination according to the CDR feature and the fraudulent user identification rule; the fraud detecting device transmits the fraudulent user number and its restriction policy to the MSC Server Form a blacklist that limits the use of fraudulent users by the MSC Server.
  • Step S1 The user (UE) initiates a voice call or uses a short message service request, and the UTRAN allocates a wireless channel;
  • Step S2 For the voice call, the MSC Server completes the call connection, resource allocation, routing, authentication, and encryption of the UE, and the UE establishes a signaling channel with the network.
  • the MSC Server For the SMS caller, the MSC Server completes the submission of the short message to the corresponding
  • the MSC Server formats the billing information to form a bill file; wherein the formed bill file is based on the user's service usage, including: a call CDR, a short message call CDR, and the like.
  • Step S3 The fraud detection device collects the call CDR and the SMS calling CDR file output by the MSC Server;
  • Step S4 The fraud detection device parses the call CDR and the SMS calling CDR file, and extracts the calling number, the called number, the calling location area, the calling cell, the call release reason information, and the short message from the call CDR.
  • the calling party CDR extracts the SMS sender number, the SMS receiver number, the SMS sender location area, and the SMS sender cell information to form detection data, and periodically (flexibly, for example, every 5 minutes) according to the fraudulent user identification rule. To determine fraudulent users.
  • the parameters that need to be detected by the voice fraud identification rule include, but are not limited to, the number of trial calls in the detection period, the called number, the reason for the call release, the calling cell and the location area, and the total number of 24-hour call attempts (this rule is independently detected, The total number of daily trial calls is counted. If the preset threshold is exceeded, it is considered as a fraudulent user.
  • the parameters to be detected by the SMS fraud identification rule include, but are not limited to, the number of short message transmissions during the detection period, the short message receiver number, the short message sender cell and the location area, and the total number of short messages sent in 24 hours. Quantity (This rule detects independently and counts the total number of daily SMS messages. If it exceeds the preset threshold, it is considered as a fraudulent user).
  • Step S5 The fraud detection apparatus sets a service restriction policy of the fraudulent user, and transmits the fraudulent subscriber number and its service restriction policy to the MSC Server to form a blacklist;
  • the restriction policy includes, but is not limited to, restricting user calls (proportional configurable, that is, the proportion of allowed call success is configurable), false accounting for fraudulent users (starting charging after the called party rings, the ratio is configurable) Limit user SMS service and limit user location update.
  • Step S6 The fraudulent user initiates a subsequent call or short message service request
  • Step S7 The MSC Server identifies the current user as a fraudulent user according to the blacklist list, and limits the service usage of the user according to the service restriction policy of the fraudulent user, so that the user fails to initiate a call or fails to send a short message.
  • the user can be detected within one detection period after the fraudulent service is used, and the subsequent service use will be restricted.
  • the fraudulent user is determined according to the fraud identification rule, and the determining manner is:
  • Step S501 Reaching the fraudulent user detection time (for example, detecting every 5 minutes), the fraud detection device performs fraud identification on a case by pair basis for each user based on the detection data collected by each user during the detection period;
  • Step S502 Select a user, match the identification rule 1: the number of trial calls in the statistical detection period, and determine whether the number of trial calls exceeds the threshold. If the threshold is not exceeded, the description is not a fraudulent user, and the detection ends; otherwise, execution is performed. Step S503;
  • Step S503 For this user, match identification rule two: determine whether the called number belongs to the same number segment, if not, the description is not a fraudulent user, the detection ends, otherwise, step S504 is performed;
  • Step S504 For this user, matching identification rule three: determining whether the call release reason is all ringing early release, if not, indicating that it is not a fraudulent user, the detection ends, otherwise, step S505 is performed;
  • Step S505 For this user, the matching identification rule four: determining whether the calling cell and the location area are All belong to the same cell and location area, if not, the description is not a fraudulent user, the detection ends, otherwise, step S506 is performed;
  • Step S506 detecting that the user is a fraudulent user, and transmitting the fraudulent subscriber number and its restriction policy to the MSC Server. Go back to step S502.
  • matching identification rules are only examples, and are not exhaustive. For different situations, the matching identification rules may not only increase but also decrease.
  • the fraudulent user determination is performed according to the short message fraud identification rule, as shown in FIG. 6, including the following steps:
  • Step S601 Reaching the fraudulent user detection time (for example, detecting every 5 minutes), the fraud detection device performs fraud identification on a case-by-case basis for each user based on the detection data collected by each user during the detection period;
  • Step S602 Select a user, match the identification rule 1: the number of times the short message is sent in the statistical detection period, and determine whether the number of times the short message is sent exceeds the threshold. If the threshold is not exceeded, the user is not a fraudulent user, and the detection ends. Otherwise, the steps are performed.
  • S603 Select a user, match the identification rule 1: the number of times the short message is sent in the statistical detection period, and determine whether the number of times the short message is sent exceeds the threshold. If the threshold is not exceeded, the user is not a fraudulent user, and the detection ends. Otherwise, the steps are performed.
  • S603 Select a user, match the identification rule 1: the number of times the short message is sent in the statistical detection period, and determine whether the number of times the short message is sent exceeds the threshold. If the threshold is not exceeded, the user is not a fraudulent user, and the detection ends. Otherwise, the steps are performed. S603;
  • Step S603 For this user, the matching identification rule two: determining whether the short message receiving party number belongs to the same number segment, if not, indicating that it is not a fraudulent user, the detection ends, otherwise, step S604 is performed;
  • Step S604 For this user, the matching identification rule three: determining whether the short message sender cell and the location area belong to the same cell and the location area, if not, the description is not a fraudulent user, the detection ends, otherwise, step S605 is performed;
  • Step S605 detecting that the user is a fraudulent user, and transmitting the fraudulent subscriber number and its restriction policy to the MSC Server. The process returns to step S602.
  • matching identification rules are only examples, and are not exhaustive. For different situations, the matching identification rules may not only increase but also decrease.
  • the method according to the embodiment of the present invention can timely discover and limit the use of the short message sender to send a fraudulent short message, or use the group call mode to harass the user of the entire number segment of the operator, and play the fraud to the user. Unlawful activities of messages, reduce the losses caused by fraud, improve the image of operators and user satisfaction.
  • the embodiment of the present invention provides a fraud detection apparatus, which may be an independent third-party device or a module integrated in the MSC Server.
  • the fraud detection apparatus of the embodiment of the present invention is an independent third party device, in consideration of not affecting the working efficiency of the MSC Server.
  • a communication interface is added to the fraud detecting device and the MSC Server, so that the fraud detecting device can receive the call CDR and the short message calling CDR sent by the MSC Server, and the detected CDR The fraudulent user is notified to the MSC Server, so that the MSC Server limits the call or short message service of the fraudulent user.
  • the fraud detection apparatus in this embodiment includes:
  • the fraudulent user identification module 710 is configured to analyze data extracted from the user's test call list or short message call list during the detection period according to the set fraud identification rule to identify the fraudulent user.
  • the fraudulent user identification module 710 includes:
  • the data collection sub-module 711 is configured to: collect a call CDR and a short message call CDR;
  • the data processing sub-module 712 is configured to: extract parameters in the bill, and form detection data corresponding to the user of the bill;
  • the fraud detection sub-module 713 is configured to: when the set detection period arrives, analyze the detection data of each user in the current period according to the set fraud identification rule to identify the fraudulent user.
  • the fraudulent user identification module 710 is further configured to: after identifying the fraudulent user, setting a business restriction policy of the fraudulent user to limit the service usage of the user.
  • the service restriction policy includes, but is not limited to, the following restrictions: restricting user calls, false charging for fraudulent users, restricting user short message services, and restricting user location updates.
  • the parameters in the trial call list extracted by the data processing sub-module 712 include one or more of the following parameters: the calling number, the called number, the calling cell, the calling location area, and the call release reason.
  • the parameters in the extracted short message call list include one or more of the following parameters: a short message sender number, a short message receiver number, a short message sender cell, and a short message sender location area.
  • the set fraud identification rules include: a voice fraud identification rule and a short message fraud identification rule; wherein:
  • the voice fraud identification rule includes, but is not limited to, the following determining conditions: whether the number of trial calls in the detection period exceeds a set threshold, whether the called number belongs to the same number segment, whether the call release reason is all ringing early release, the calling cell, the master Whether the location areas are the same;
  • the SMS fraud identification rule includes, but is not limited to, the following determination conditions: whether the number of short message transmissions exceeds a set threshold in the detection period, whether the short message recipient numbers belong to the same number segment, and whether the short message sender cell and the short message sender location area are the same.
  • the embodiment of the present invention detects a fraudulent behavior based on a call CDR and a short message call CDR, and can detect fraudulent users in a timely and efficient manner.
  • a fraudulent user service restriction policy can be set to limit fraudulent user services. Use to reduce the loss of operators.
  • the embodiment of the present invention provides a detection system for a fraudulent user, as shown in FIG. 8, including: a mobile switching server (MSC Server) 801 and a fraud detection apparatus 802 according to the second embodiment;
  • MSC Server mobile switching server
  • the MSC Server 801 is configured to: generate a call CDR and a short message calling CDR for the user, and send the CDR and the SMS calling CDR to the fraud detecting device 802.
  • the fraud detecting means 802 is further configured to: send the number of the fraudulent user and the service restriction policy set for the fraudulent user to the MSC Server 801;
  • the MSC Server 801 adds the number of the fraudulent user to the blacklist, and performs service restriction on the fraudulent user according to the corresponding service restriction policy.
  • the system according to the embodiment of the present invention can timely discover and limit the use of the short message sender to send a fraudulent short message, or use the group call mode to harass the user of the entire number segment of the operator, and play the fraud to the user. Unlawful activities of messages, reduce the losses caused by fraud, improve the image of operators and user satisfaction.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the embodiment of the present invention detects fraudulent behaviors based on the call CDRs and the short message CDRs, and can detect fraudulent users in a timely and efficient manner.
  • the fraudulent users' service restriction policies can be set to limit the use of fraudulent users and reduce operators. Loss.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种欺诈用户的检测方法、装置和系统，所述方法包括：根据设定的欺诈识别规则，对检测周期内从用户的试呼话单或短信主叫话单中提取的数据进行分析，以识别出欺诈用户。

Description

一种欺诈用户的检测方法、装置和系统 技术领域
本文涉及通信技术领域，尤其涉及一种欺诈用户的检测方法、装置和系统。
背景技术
3GPP描述的第三代移动通信系统，通常由用户终端(User Equipment，简称UE)、无线接入网络(UMTS terrestrial Radio Access Network，简称UTRAN)、核心网络(Core Network，简称CN)组成，如图1所示，UTRAN分为基站(Node B)和无线网络控制器(Radio Network Controller，简称RNC)两部分，实现无线接入和无线资源管理，核心网络分为电路交换域(Circuit Switched Domain，简称CS域)和分组交换域(Packet Switched Domain，简称PS域)两部分，负责与其他外部网络的连接和UE的通信管理，电路交换域主要由MSC Server(Mobile Switching Centre Server，移动交换服务器)、MGW(Media GateWay，媒体网关)、VLR(Visitor Location Register，拜访位置寄存器)、HLR(Home Location Register，归属位置寄存器)等网络实体组成，分组交换域主要由SGSN(Serving GPRS Support Node，服务GPRS支持节点)、GGSN(Gateway GPRS Support Node，网关GPRS支持节点)等网络实体组成。
在移动通信网络中，移动语音业务和短信服务SMS(Short Messaging Service)是两种基本业务功能，移动语音业务指移动通话业务、语音留言业务，其中移动通话业务是最主要的业务；短信服务是最早的短消息业务，也是现在普及率最高的一种短消息业务，通过它移动电话之间可以互相收发短信，内容以文本、数字或二进制非文本数据为主，SMS以简单方便的使用功能受到广大用户的欢迎。用户发起语音业务或者短信服务业务的基本流程如图2所示，UE通过空中接口(即无线方式)接入UTRAN，UTRAN通过有线方式接入核心网电路交换域网络实体MSC Server，MSC Server控制呼叫接 续，并提供计费信息，同时将计费信息进行格式化处理形成话单(Call Detailed Record，简称CDR)文件，并通过Bc接口将CDR文件输送到计费域(Billing Domain，简称BD)，由BD完成对用户的最终计费。
在语音呼叫或短信业务使用中，存在一些不良用户，业内称之为欺诈用户，这些用户通过使用短信群发器发送诈骗短信，或者使用群呼方式，对运营商整个号码段的用户进行骚扰，诱使用户回拨，给用户播放诈骗留言。欺诈用户发起群呼时，一般设定一个特定的号码段，然后从0000-9999连续拨号，等待被叫用户振铃后保持1至3秒后释放，不给被叫用户应答的时间，同时在上述MSC Server也不会产生话单，从而逃避收费。
这些用户一般是在各地批量购买低资费的手机卡，拿到手机卡后，使用短信群发器疯狂群发几千条短信欠费后就不再使用。欺诈用户发现号码一旦被限制，比如不能继续拨打外地号码后，就立即更换新的手机卡，因此对这部分用户呼叫行为监控的时效性要求较高。
欺诈用户对运营商的网络安全和业务收入都造成了负面的影响，欺诈用户占用大量的无线资源，导致正常用户的接通率指标降低，并且话务量大时容易导致交换机故障，影响系统的稳定性。
发明内容
本文提供一种欺诈用户的检测方法、装置和系统，以实现对欺诈用户的有效检测。
一种欺诈用户的检测方法，包括：
根据设定的欺诈识别规则，对检测周期内从用户的试呼话单或短信主叫话单中提取的数据进行分析，以识别出欺诈用户。
可选地，所述方法中，所述根据设定的欺诈识别规则，对检测周期内从用户的试呼话单或短信主叫话单中提取的数据进行欺诈分析，以识别出欺诈用户，包括：
收集用户的试呼话单或短信主叫话单；
提取话单中的参数，形成话单对应用户的检测数据；
在设定的检测周期到达时，根据设定的欺诈识别规则，对本周期内每个用户的检测数据进行分析，以识别出欺诈用户。
可选地，所述方法还包括：当识别出欺诈用户后，设置该欺诈用户的业务限制策略，以限制该用户的业务使用。
可选地，所述方法中：
所述业务限制策略包括下述限制条件中的一个或多个：限制用户呼叫、对欺诈用户虚假计费、限制用户短信业务、以及限制用户位置更新。
提取的试呼话单中的参数包括下述参数中的一个或多个：主叫号码、被叫号码、主叫小区、主叫位置区、呼叫释放原因；
提取的短信主叫话单中的参数包括下述参数中的一个或多个：短信发送方号码、短信接收方号码、短信发送方小区、短信发送方位置区；
所述设定的欺诈识别规则包括：语音欺诈识别规则和短信欺诈识别规则；
所述语音欺诈识别规则包括下述判定条件中的一个或多个：检测周期内试呼次数是否超过设定阈值，被叫号码是否均归属同一号段，呼叫释放原因是否均为振铃早释，主叫小区、主叫位置区是否均相同；
所述短信欺诈识别规则包括下述判定条件中的一个或多个：检测周期内短信发送数量是否超过设定阈值，短信接收方号码是否均归属同一号段，短信发送方小区、短信发送方位置区是否均相同。
一种欺诈检测装置，包括：
欺诈用户识别模块，设置为：根据设定的欺诈识别规则，对检测周期内从用户的试呼话单或短信主叫话单中提取的数据进行分析，以识别出欺诈用户。
可选的，所述装置中，所述欺诈用户识别模块，包括：
数据收集子模块，设置为：收集试呼话单和短信主叫话单；
数据处理子模块，设置为：提取话单中的参数，形成话单对应用户的检测数据；
欺诈检测子模块，设置为：在设定的检测周期到达时，根据设定的欺诈识别规则，对本周期内每个用户的检测数据进行分析，以识别出欺诈用户。
可选的，所述装置中，所述欺诈用户识别模块，还设置为：当识别出欺诈用户后，设置该欺诈用户的业务限制策略，以限制该用户的业务使用。
一种欺诈用户的检测系统，包括：MSC Server，以及所述欺诈检测装置；
所述MSC Server，设置为：为用户生成试呼话单和短信主叫话单，并将所述试呼话单和短信主叫话单发送至欺诈检测装置。
可选地，所述系统中，所述欺诈检测装置，还设置为：将欺诈用户的号码以及为该欺诈用户设置的业务限制策略发送至所述MSC Server；
所述MSC Server，还设置为：将所述欺诈用户的号码加入黑名单，并根据所述欺诈用户对应的业务限制策略，对欺诈用户进行业务限制。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述任一项的方法。
本发明实施例基于试呼话单和短信主叫话单检测欺诈行为，能够及时高效的检测出欺诈用户；另外，还可以设置这些欺诈用户的业务限制策略，限制欺诈用户业务使用，减少运营商的损失。
附图概述
图1为3GPP描述的移动通信系统网络示意图；
图2为相关技术移动网络中用户发起语音呼叫或使用短信业务示意图；
图3为本发明实施例提供的一种欺诈用户的检测方法的流程图；
图4为本发明实施例中移动网络中用户发起语音呼叫或使用短信业务示意图；
图5为本发明实施例中根据语音欺诈识别规则判定欺诈用户的流程图；
图6为本发明实施例中根据短信欺诈识别规则判定欺诈用户的流程图；
图7为本发明实施例提供的一种欺诈检测装置的结构框图；
图8为本发明实施例提供的一种欺诈用户的检测系统的结构框图。
本发明的实施方式
为了提高欺诈用户的检测效率，本发明实施例提供一种欺诈用户的检测方法、装置和系统。下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行描述。
实施例一
本发明实施例提供一种欺诈用户的检测方法，其实现欺诈用户检测的方式为：根据设定的欺诈识别规则，对检测周期内从用户的试呼话单或短信主叫话单中提取的数据进行分析，以识别出欺诈用户。
其中，试呼话单为呼叫振铃时长小于预设值、并且未进入通话状态产生的话单。
详细实施过程如图3所示，包括：
步骤S301，收集用户的试呼话单或短信主叫话单；
步骤S302，提取话单中的参数，形成话单对应用户的检测数据；
步骤S303，在设定的检测周期到达时，根据设定的欺诈识别规则，对本周期内每个用户的检测数据进行分析，以识别出欺诈用户。
优选的，本实施例中，当识别出欺诈用户后，还设置该欺诈用户的业务限制策略，以限制该用户的业务使用。
其中，业务限制策略包括但不限于如下限制条件：限制用户呼叫、对欺诈用户虚假计费、限制用户短信业务、以及限制用户位置更新。
其中，虚假计费指从被叫振铃后即开始计费。
综上所述，本发明实施例基于试呼话单和短信主叫话单检测欺诈行为，能够及时高效的检测出欺诈用户；另外，还可以设置这些欺诈用户的业务限制策略，限制欺诈用户业务使用，减少运营商的损失。
下面给出本发明一个实施例，并结合对实施例的描述，使其能够更好地 说明本发明实施例提供的方法的实现过程。
本发明实施例提供一种欺诈用户的检测方法，本方法中：移动交换服务器(MSC Server)增加输出试呼话单的功能；在已有网络基础上增加一个欺诈检测装置，如图4所示。欺诈检测装置分析MSC Server输出的试呼话单和短信主叫话单，根据话单特征以及欺诈用户识别规则，进行欺诈用户判定；欺诈检测装置将欺诈用户号码及其限制策略，传递到MSC Server，形成黑名单列表，由MSC Server限制欺诈用户的业务使用。
本发明实施例提供的欺诈用户的检测流程，包括如下处理步骤：
步骤S1：用户(UE)发起语音呼叫或使用短信业务请求，UTRAN分配无线信道；
步骤S2：对于语音呼叫，MSC Server完成对UE的呼叫接续、资源分配、路由选择、鉴权和加密等，UE与网络间建立信令通道，对于短信主叫，MSC Server完成将短信提交给对应的短信中心；同时，MSC Server将计费信息进行格式化处理形成话单文件；其中，形成的话单文件根据用户的业务使用情况，包括：试呼话单、短信主叫话单等。
步骤S3：欺诈检测装置收集MSC Server输出的试呼话单和短信主叫话单文件；
步骤S4：欺诈检测装置解析试呼话单、短信主叫话单文件，从试呼话单中提取主叫号码、被叫号码、主叫位置区、主叫小区、呼叫释放原因信息，从短信主叫话单中提取短信发送方号码、短信接收方号码、短信发送方位置区、短信发送方小区信息，形成检测数据，并定期(灵活可设，比如，每5分钟)根据欺诈用户识别规则，判定欺诈用户。
其中，语音欺诈识别规则需要检测的参数包括但不限于为：检测周期内试呼次数、被叫号码、呼叫释放原因、主叫小区和位置区、24小时试呼总数量(此规则独立检测，统计每日试呼总次数，如果超过预设的门限值，认定为欺诈用户)。
短信欺诈识别规则需要检测的参数包括但不限于为：检测周期内短信发送数量、短信接收方号码、短信发送方小区和位置区、24小时发送短信总数 量(此规则独立检测，统计每日短信发送总次数，如果超过预设的门限值，认定为欺诈用户)。
步骤S5：欺诈检测装置设置欺诈用户的业务限制策略，并将欺诈用户号码及其业务限制策略传递到MSC Server，形成黑名单列表；
其中，限制策略包括但不限于：限制用户呼叫(通过比例可配置，即允许呼叫成功的比例可配置)、对欺诈用户虚假计费(从被叫振铃后即开始计费，比例可配置)、限制用户短信业务、限制用户位置更新。
步骤S6：欺诈用户发起后续呼叫或短信业务请求；
步骤S7：MSC Server根据黑名单列表，识别出当前用户为欺诈用户，并根据该欺诈用户的业务限制策略，限制该用户的业务使用，使得该用户发起呼叫失败或者发送短信失败。
采用本发明实施例的方法，用户在欺诈业务使用后的一个检测周期内即可被检测出来，后续业务使用将受到限制。
本发明实施例中根据欺诈识别规则判定欺诈用户，判定方式为：
1，根据语音欺诈识别规则进行欺诈用户判定，如图5所示，包括如下步骤：
步骤S501：到达欺诈用户检测时间(比如每5分钟检测一次)，欺诈检测装置基于检测周期内收集到的每个用户的检测数据，逐一对每个用户进行欺诈识别；
步骤S502：选取一用户，匹配识别规则一：统计检测周期内的试呼次数，并判断试呼次数是否超过门限值，如果没有超过门限值，说明不是欺诈用户，检测结束，否则，执行步骤S503；
步骤S503：对于此用户，匹配识别规则二：判断被叫号码是否归属同一号段，如果不是，说明不是欺诈用户，检测结束，否则，执行步骤S504；
步骤S504：对于此用户，匹配识别规则三：判断通话释放原因是否均为振铃早释，如果不是，说明不是欺诈用户，检测结束，否则，执行步骤S505；
步骤S505：对于此用户，匹配识别规则四：判断主叫小区和位置区是否 均属于同一小区和位置区，如果不是，说明不是欺诈用户，检测结束，否则，执行步骤S506；
步骤S506：检测出此用户为欺诈用户，将该欺诈用户号码及其限制策略，传递到MSC Server。返回步骤S502。
需要说明的是：上述列举的匹配识别规则只是举例说明，并非穷举，针对不同情况，匹配识别规则不但可以增加，还可以减少。
2，根据短信欺诈识别规则进行欺诈用户判定，如图6所示，包括如下步骤：
步骤S601：到达欺诈用户检测时间(比如每5分钟检测一次)，欺诈检测装置基于检测周期内收集到的每个用户的检测数据，逐一对每个用户进行欺诈识别；
步骤S602：选取一用户，匹配识别规则一：统计检测周期内的短信发送次数，并判断短信发送次数是否超过门限值，如果没有超过门限值，说明不是欺诈用户，检测结束，否则执行步骤S603；
步骤S603：对于此用户，匹配识别规则二：判断短信接收方号码是否归属同一号段，如果不是，说明不是欺诈用户，检测结束，否则，执行步骤S604；
步骤S604：对于此用户，匹配识别规则三：判断短息发送方小区和位置区是否均属于同一小区和位置区，如果不是，说明不是欺诈用户，检测结束，否则，执行步骤S605；
步骤S605：检测出此用户为欺诈用户，将该欺诈用户号码及其限制策略，传递到MSC Server。返回步骤S602。
需要说明的是：上述列举的匹配识别规则只是举例说明，并非穷举，针对不同情况，匹配识别规则不但可以增加，还可以减少。
综上所述，采用本发明实施例所述方法，能够及时地发现并限制通过使用短信群发器发送诈骗短信，或使用群呼方式，对运营商整个号码段的用户进行骚扰，给用户播放诈骗留言的不法活动，减少欺诈带来的损失，提高运营商形象和用户的满意度。
实施例二
本发明实施例提供一种欺诈检测装置，该欺诈检测装置可以为独立的第三方设备，也可以是集成于MSC Server内的模块。考虑到不影响MSC Server的工作效率，本发明实施例欺诈检测装置为独立的第三方设备。当其属于独立的第三方设备时，在该欺诈检测装置和MSC Server上增设通信接口，以使得欺诈检测装置可以接收MSC Server发送的试呼话单和短信主叫话单，以及将检测到的欺诈用户通知于MSC Server，使得MSC Server对欺诈用户的呼叫或短信业务进行限制。
如图7所示，本实施例所述欺诈检测装置包括：
欺诈用户识别模块710，设置为：根据设定的欺诈识别规则，对检测周期内从用户的试呼话单或短信主叫话单中提取的数据进行分析，以识别出欺诈用户。
欺诈用户识别模块710，包括：
数据收集子模块711，设置为：收集试呼话单和短信主叫话单；
数据处理子模块712，设置为：提取话单中的参数，形成话单对应用户的检测数据；
欺诈检测子模块713，设置为：在设定的检测周期到达时，根据设定的欺诈识别规则，对本周期内每个用户的检测数据进行分析，以识别出欺诈用户。
欺诈用户识别模块710，还设置为：当识别出欺诈用户后，设置该欺诈用户的业务限制策略，以限制该用户的业务使用。
其中，业务限制策略包括但不限于如下限制条件：限制用户呼叫、对欺诈用户虚假计费、限制用户短信业务、以及限制用户位置更新。
本实施例中：数据处理子模块712提取的试呼话单中的参数包括下述参数中的一个或多个：主叫号码、被叫号码、主叫小区、主叫位置区、呼叫释放原因；提取的短信主叫话单中的参数包括下述参数中的一个或多个：短信发送方号码、短信接收方号码、短信发送方小区、短信发送方位置区。
本实施例中，设定的欺诈识别规则包括：语音欺诈识别规则和短信欺诈识别规则；其中：
语音欺诈识别规则包括但不限于如下判定条件：检测周期内试呼次数是否超过设定阈值，被叫号码是否均归属同一号段，呼叫释放原因是否均为振铃早释，主叫小区、主叫位置区是否均相同；
短信欺诈识别规则包括但不限于如下判定条件：检测周期内短信发送数量是否超过设定阈值，短信接收方号码是否均归属同一号段，短信发送方小区、短信发送方位置区是否均相同。
综上所述，本发明实施例基于试呼话单和短信主叫话单检测欺诈行为，能够及时高效的检测出欺诈用户；另外，还可以设置这些欺诈用户的业务限制策略，限制欺诈用户业务使用，减少运营商的损失。
实施例三
本发明实施例提供一种欺诈用户的检测系统，如图8所示，包括：移动交换服务器(MSC Server)801和实施例二所述的欺诈检测装置802；
MSC Server801，设置为：为用户生成试呼话单和短信主叫话单，并将所述试呼话单和短信主叫话单发送至欺诈检测装置802。
所述欺诈检测装置802，还设置为：将欺诈用户的号码以及为该欺诈用户设置的业务限制策略发送至所述MSC Server801；
MSC Server801，将所述欺诈用户的号码加入黑名单，并根据其对应的业务限制策略，对欺诈用户进行业务限制。
综上所述，采用本发明实施例所述系统，能够及时地发现并限制通过使用短信群发器发送诈骗短信，或使用群呼方式，对运营商整个号码段的用户进行骚扰，给用户播放诈骗留言的不法活动，减少欺诈带来的损失，提高运营商形象和用户的满意度。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行， 在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
工业实用性
本发明实施例基于试呼话单和短信主叫话单检测欺诈行为，能够及时高效的检测出欺诈用户；另外，还可以设置这些欺诈用户的业务限制策略，限制欺诈用户业务使用，减少运营商的损失。

Claims (11)

  1. 一种欺诈用户的检测方法，包括：
    根据设定的欺诈识别规则，对检测周期内从用户的试呼话单或短信主叫话单中提取的数据进行分析，以识别出欺诈用户。
  2. 如权利要求1所述的方法，其中，所述根据设定的欺诈识别规则，对检测周期内从用户的试呼话单或短信主叫话单中提取的数据进行欺诈分析，以识别出欺诈用户，包括：
    收集用户的试呼话单或短信主叫话单；
    提取话单中的参数，形成话单对应用户的检测数据；
    在设定的检测周期到达时，根据设定的欺诈识别规则，对本周期内每个用户的检测数据进行分析，以识别出欺诈用户。
  3. 如权利要求1或2所述的方法，还包括：当识别出欺诈用户后，设置该欺诈用户的业务限制策略，以限制该用户的业务使用。
  4. 如权利要求3所述的方法，其中，所述业务限制策略包括下述限制条件中的一个或多个：限制用户呼叫、对欺诈用户虚假计费、限制用户短信业务、以及限制用户位置更新。
  5. 如权利要求2所述的方法，其中，
    提取的试呼话单中的参数包括下述参数中的一个或多个：主叫号码、被叫号码、主叫小区、主叫位置区、呼叫释放原因；
    提取的短信主叫话单中的参数包括下述参数中的一个或多个：短信发送方号码、短信接收方号码、短信发送方小区、短信发送方位置区；
    所述设定的欺诈识别规则包括：语音欺诈识别规则和短信欺诈识别规则；
    所述语音欺诈识别规则包括下述判定条件中的一个或多个：检测周期内试呼次数是否超过设定阈值，被叫号码是否均归属同一号段，呼叫释放原因是否均为振铃早释，主叫小区、主叫位置区是否均相同；
    所述短信欺诈识别规则包括下述判定条件中的一个或多个：检测周期内 短信发送数量是否超过设定阈值，短信接收方号码是否均归属同一号段，短信发送方小区、短信发送方位置区是否均相同。
  6. 一种欺诈检测装置，包括：
    欺诈用户识别模块，设置为：根据设定的欺诈识别规则，对检测周期内从用户的试呼话单或短信主叫话单中提取的数据进行分析，以识别出欺诈用户。
  7. 如权利要求6所述的欺诈检测装置，其中，所述欺诈用户识别模块，包括：
    数据收集子模块，设置为：收集试呼话单和短信主叫话单；
    数据处理子模块，设置为：提取话单中的参数，形成话单对应用户的检测数据；
    欺诈检测子模块，设置为：在设定的检测周期到达时，根据设定的欺诈识别规则，对本周期内每个用户的检测数据进行分析，以识别出欺诈用户。
  8. 如权利要求6或7所述的欺诈检测装置，其中，所述欺诈用户识别模块，还设置为：当识别出欺诈用户后，设置该欺诈用户的业务限制策略，以限制该用户的业务使用。
  9. 一种欺诈用户的检测系统，包括：移动交换服务器MSC Server，以及权利要求6至8任意一项所述的欺诈检测装置；
    所述MSC Server，设置为：为用户生成试呼话单和短信主叫话单，并将所述试呼话单和短信主叫话单发送至欺诈检测装置。
  10. 如权利要求9所述的系统，其中，所述欺诈检测装置，还设置为：将欺诈用户的号码以及为该欺诈用户设置的业务限制策略发送至所述MSC Server；
    所述MSC Server，还设置为：将所述欺诈用户的号码加入黑名单，并根据所述欺诈用户对应的业务限制策略，对所述欺诈用户进行业务限制。
  11. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-5任一项的方法。
PCT/CN2015/081683 2014-10-29 2015-06-17 一种欺诈用户的检测方法、装置和系统 WO2016065908A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP15856072.2A EP3214861B1 (en) 2014-10-29 2015-06-17 Method, device and system for detecting fraudulent user

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410591870.0A CN105636047A (zh) 2014-10-29 2014-10-29 一种欺诈用户的检测方法、装置和系统
CN201410591870.0 2014-10-29

Publications (1)

Publication Number Publication Date
WO2016065908A1 true WO2016065908A1 (zh) 2016-05-06

Family

ID=55856528

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/081683 WO2016065908A1 (zh) 2014-10-29 2015-06-17 一种欺诈用户的检测方法、装置和系统

Country Status (3)

Country Link
EP (1) EP3214861B1 (zh)
CN (1) CN105636047A (zh)
WO (1) WO2016065908A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106331390A (zh) * 2016-11-23 2017-01-11 杭州东信北邮信息技术有限公司 一种基于通话数据来识别诈骗号码的方法和系统
CN108366173A (zh) * 2018-01-05 2018-08-03 腾讯科技（深圳）有限公司 一种电话识别方法、相关设备及系统
CN110830999A (zh) * 2019-10-18 2020-02-21 国家计算机网络与信息安全管理中心 一种呼叫处置策略的加密方法
CN111182533A (zh) * 2019-12-06 2020-05-19 武汉极意网络科技有限公司 一种互联网攻击团伙的定位方法及系统
CN114285929A (zh) * 2021-12-27 2022-04-05 中国联合网络通信集团有限公司 恶意反催收用户的识别方法、设备及存储介质
CN114285929B (zh) * 2021-12-27 2024-05-28 中国联合网络通信集团有限公司 恶意反催收用户的识别方法、设备及存储介质

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108259688A (zh) * 2016-12-28 2018-07-06 广东世纪网通信设备股份有限公司 VoIP平台电话诈骗行为检测方法、装置以及检测系统
CN108337652B (zh) * 2017-01-20 2020-12-01 中国移动通信集团河南有限公司 一种检测流量欺诈的方法及装置
US11095664B2 (en) 2017-04-05 2021-08-17 Apple Inc. Detection of spoofed call information
CN108966158B (zh) * 2018-08-21 2022-04-12 平安科技（深圳）有限公司 短信发送方法、系统、计算机设备和存储介质
KR20200034020A (ko) 2018-09-12 2020-03-31 삼성전자주식회사 전자 장치 및 그의 제어 방법
CN110213448B (zh) * 2018-09-13 2021-08-24 腾讯科技（深圳）有限公司 恶意号码识别方法、装置、存储介质和计算机设备
WO2020085989A1 (en) * 2018-10-26 2020-04-30 Telefonaktiebolaget Lm Ericsson (Publ) Method and user equipment for detecting a potentially fraudulent call
CN111385420B (zh) * 2018-12-29 2022-04-29 中兴通讯股份有限公司 用户的识别方法、装置、存储介质及电子装置
CN110062096A (zh) * 2019-04-23 2019-07-26 贵阳朗玛通信科技有限公司 一种筛选违规用户的方法及装置
CN110856115B (zh) * 2019-11-28 2021-02-12 北京明略软件系统有限公司 一种诈骗组织犯案区域的识别方法、识别装置及电子设备
CN113727351B (zh) * 2020-05-12 2024-03-19 中国移动通信集团广东有限公司 一种通信欺诈识别方法、装置及电子设备
CN111356097B (zh) * 2020-05-24 2020-09-04 深圳市卡牛科技有限公司 一种短信解析方法、装置以及可读存储介质
CN112331230A (zh) * 2020-11-17 2021-02-05 平安科技（深圳）有限公司 一种欺诈行为识别方法、装置、计算机设备及存储介质
US11611655B2 (en) 2021-07-08 2023-03-21 Comcast Cable Communications, Llc Systems and methods for processing calls
CN114971642A (zh) * 2022-05-30 2022-08-30 平安科技（深圳）有限公司 基于知识图谱的异常识别方法、装置、设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101137085A (zh) * 2007-03-20 2008-03-05 中国移动通信集团江苏有限公司 垃圾短信彩信封堵方法
CN101572890A (zh) * 2009-06-15 2009-11-04 华为技术有限公司 一种检测非法群呼用户的方法和装置
CN101730091A (zh) * 2008-10-28 2010-06-09 中国移动通信集团湖南有限公司 限制非法通信业务的方法及装置
KR101033870B1 (ko) * 2011-01-19 2011-05-11 (주)지란지교소프트 스팸 전화 처리 방법 및 장치
CN102572746A (zh) * 2010-12-28 2012-07-11 上海粱江通信系统股份有限公司 一种基于频次和用户发送行为特征识别垃圾短信源的方法
CN103412940A (zh) * 2013-08-22 2013-11-27 清华大学 检测欺诈电话的方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB9606792D0 (en) * 1996-03-29 1996-06-05 British Telecomm A telecommunications network
US6188753B1 (en) * 1997-06-30 2001-02-13 Sprint Communications Co. L.P. Method and apparatus for detection and prevention of calling card fraud
US6636592B2 (en) * 2001-09-28 2003-10-21 Dean C. Marchand Method and system for using bad billed number records to prevent fraud in a telecommunication system
US9445245B2 (en) * 2012-07-02 2016-09-13 At&T Intellectual Property I, L.P. Short message service spam data analysis and detection

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101137085A (zh) * 2007-03-20 2008-03-05 中国移动通信集团江苏有限公司 垃圾短信彩信封堵方法
CN101730091A (zh) * 2008-10-28 2010-06-09 中国移动通信集团湖南有限公司 限制非法通信业务的方法及装置
CN101572890A (zh) * 2009-06-15 2009-11-04 华为技术有限公司 一种检测非法群呼用户的方法和装置
CN102572746A (zh) * 2010-12-28 2012-07-11 上海粱江通信系统股份有限公司 一种基于频次和用户发送行为特征识别垃圾短信源的方法
KR101033870B1 (ko) * 2011-01-19 2011-05-11 (주)지란지교소프트 스팸 전화 처리 방법 및 장치
CN103412940A (zh) * 2013-08-22 2013-11-27 清华大学 检测欺诈电话的方法

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106331390A (zh) * 2016-11-23 2017-01-11 杭州东信北邮信息技术有限公司 一种基于通话数据来识别诈骗号码的方法和系统
CN106331390B (zh) * 2016-11-23 2019-04-30 杭州东信北邮信息技术有限公司 一种基于通话数据来识别诈骗号码的方法和系统
CN108366173A (zh) * 2018-01-05 2018-08-03 腾讯科技（深圳）有限公司 一种电话识别方法、相关设备及系统
CN110830999A (zh) * 2019-10-18 2020-02-21 国家计算机网络与信息安全管理中心 一种呼叫处置策略的加密方法
CN110830999B (zh) * 2019-10-18 2023-04-07 国家计算机网络与信息安全管理中心 一种呼叫处置策略的加密方法
CN111182533A (zh) * 2019-12-06 2020-05-19 武汉极意网络科技有限公司 一种互联网攻击团伙的定位方法及系统
CN111182533B (zh) * 2019-12-06 2023-09-08 武汉极意网络科技有限公司 一种互联网攻击团伙的定位方法及系统
CN114285929A (zh) * 2021-12-27 2022-04-05 中国联合网络通信集团有限公司 恶意反催收用户的识别方法、设备及存储介质
CN114285929B (zh) * 2021-12-27 2024-05-28 中国联合网络通信集团有限公司 恶意反催收用户的识别方法、设备及存储介质

Also Published As

Publication number Publication date
EP3214861A4 (en) 2017-10-18
EP3214861B1 (en) 2019-07-31
CN105636047A (zh) 2016-06-01
EP3214861A1 (en) 2017-09-06

Similar Documents

Publication Publication Date Title
WO2016065908A1 (zh) 一种欺诈用户的检测方法、装置和系统
US9015808B1 (en) Restricting mobile device services between an occurrence of an account change and acquisition of a security code
CN101479989B (zh) 通过在用户终端实施通信量计数对漫游移动物体进行gprs通信量计费
US9936081B2 (en) Determining telecommunication subscriber metrics
EP3068114A1 (en) Method for measuring and displaying internet traffic of mobile phone and mobile phone
CN109698885B (zh) 一种呼叫请求的处理方法、装置、网络侧服务器和计算机存储介质
WO2010031294A1 (zh) 基于区域策略的位置广告业务分众方法及其系统
US20160198341A1 (en) Communication Between a Mobile Device and Telecommunications Network
CN111130855B (zh) 一种问题定位方法和装置
CN108391223B (zh) 一种确定失联用户的方法及装置
WO2019128709A1 (zh) 流量计费控制方法、装置和系统、计算机可读存储介质
KR20170006158A (ko) 문자 메시지 부정 사용 탐지 방법 및 시스템
CN103167502B (zh) 基于ota技术整治非法呼叫的方法
KR100946983B1 (ko) 스팸 처리 방법 및 시스템
EP3871435B1 (en) Method and user equipment for detecting a potentially fraudulent call
CN109428870A (zh) 基于物联网的网络攻击处理方法、装置及系统
US11108914B2 (en) Method and system for revenue maximization in a communication network
CN110858957A (zh) 一种信息推送系统、方法、装置、介质和设备
CN109309905A (zh) 一种伪基站短信识别和拦截方法及装置
CN102958055A (zh) 一种非法回拨业务的鉴别方法和系统
US9942767B2 (en) Reducing fraudulent activity associated with mobile networks
US9924339B2 (en) Real-time notification of toll-free data service usage
CN104982059B (zh) 检测电信网络中的行为的系统
KR20220067498A (ko) 보이스 피싱 차단 방법 및 그 장치
KR102459421B1 (ko) 스팸 처리를 위한 장치, 방법과, 응용 프로그램

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15856072

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2015856072

Country of ref document: EP