WO2017079980A1

WO2017079980A1 - Charging fraud detection method and apparatus

Info

Publication number: WO2017079980A1
Application number: PCT/CN2015/094592
Authority: WO
Inventors: 郭�东; 王淑君; 赵文军
Original assignee: 华为技术有限公司
Priority date: 2015-11-13
Filing date: 2015-11-13
Publication date: 2017-05-18

Abstract

Disclosed are a charging fraud detection method and apparatus, the method comprising: when a charging strategy corresponding to a domain name to which a UE requests access is a preferential charging strategy, a charging fraud detection apparatus recording handshake information transmitted in the process of establishing a first TLS handshake between the UE and a server; the charging fraud detection apparatus establishing a second TLS handshake with the server by using the recorded handshake information; the charging fraud detection apparatus determining whether the second TLS handshake is successfully established; and if the second TLS handshake is successfully established, determining that there is no charging fraud, and if the second TLS handshake fails to be established, determining that there is charging fraud.

Description

Method and device for detecting billing fraud

Technical field

The embodiments of the present invention relate to the field of communications technologies, and in particular, to a method and an apparatus for detecting charging fraud.

Background technique

In order to attract users and improve user satisfaction, operators will formulate various free rates, unified payment and other preferential charging strategies. For the cryptographic service using ciphertext transmission, the charging method is usually adopted: before the service encryption transmission, that is, during the establishment of the handshake between the user equipment (User Equipment, UE) and the server, according to the transmission between the UE and the server. The packet obtains the domain name of the server to be accessed by the UE, and then obtains a pre-configured charging policy that matches the domain name. If the matching charging policy is a normal charging policy, the encrypted transmission service is normally charged after the handshake. If the matching charging policy is a preferential charging policy, the service preferentially charged for the encrypted transmission after the handshake is charged.

Currently, the cryptographic service generally performs the handshake of the Transport Layer Security (TLS) protocol to complete the authentication of the client and the server, and exchanges the key for encrypted transmission. In the TLS end-to-end negotiation process, if the client and the server are malicious. The process of falsifying the access to the preferential website will cause the gateway to consider the preferential charging of the subsequent encrypted transmission, resulting in billing fraud, which will bring serious economic losses to the operator. For the above-mentioned charging fraud, since the service adopts the encrypted transmission mode and the decryption is limited, the existing Deep Packet Inspection (DPI) technology cannot be used to identify the behavior characteristics of the service to identify the charging fraud. Therefore, there is It is necessary to propose a method to solve the above problem.

Summary of the invention

In view of this, the embodiments of the present invention provide a method and a device for detecting charging fraud, which can identify the charging fraud existing in the encrypted transmission service.

In a first aspect, a method for detecting a charging fraud provided by an embodiment of the present invention includes:

When the charging policy corresponding to the domain name requested by the user equipment UE is a preferential charging policy, the charging fraud detecting device records the first transport layer security TLS handshake process between the UE and the server. Handshake information transmitted in the middle;

The charging fraud detecting device establishes a second TLS handshake with the server by using the recorded handshake information;

The detecting device of the charging fraud determines whether the second TLS handshake is successfully established;

If the second TLS handshake is successfully established, the charging fraud detecting means determines that there is no charging fraud. If the second TLS handshake establishment fails, the charging fraud detecting means determines that there is charging fraud.

In conjunction with the first aspect, in a first implementation manner of the first aspect, the method further includes:

When it is determined that there is no billing fraud, the charging fraud detecting device stores the correspondence between the domain name requested by the UE and the Internet Protocol IP address in the trusted access set;

When it is determined that there is a charging fraud, the charging fraud detecting means stores the correspondence between the domain name and the IP address that the UE requests to access in the untrusted access set.

With reference to the first implementation manner of the first aspect, in a second implementation manner of the first aspect, before the handshake information transmitted during the first TLS handshake is established between the UE and the server, the method is Also includes:

The detecting device of the charging fraud determines whether the correspondence between the domain name and the IP address that the UE requests to access belongs to the trusted access set and/or the non-trusted access set;

If the correspondence between the domain name and the IP address that the UE requests to access does not belong to the trusted access set and does not belong to the non-trusted access set, the charging fraud detecting apparatus performs recording of the UE and the The step of establishing handshake information transmitted during the first TLS handshake between the servers.

With the second implementation of the first aspect, in a third implementation manner of the first aspect, before the establishing the second TLS handshake with the server by using the recorded handshake information, the method further includes:

The charging fraud detecting device determines whether the certificate returned by the server is valid;

If valid, the charging fraud detecting means performs the step of establishing the second TLS handshake with the server using the recorded handshake information, and if invalid, the charging fraud detecting means determines that there is a charging fraud.

With reference to the third implementation manner of the first aspect, in a fourth implementation manner of the first aspect, the certificate returned by the server is effective: the certificate returned by the server belongs to a trusted certificate set, and the server returns The domain name in the certificate is the same as the domain name requested by the UE.

In a second aspect, the apparatus for detecting a charge fraud provided by the embodiment of the present invention includes:

a recording unit, configured to record handshake information transmitted during the first transport layer secure TLS handshake process between the UE and the server, when the charging policy corresponding to the domain name requested by the user equipment UE is a preferential charging policy;

a handshake checking unit, configured to establish a second TLS handshake with the server by using the handshake information recorded by the recording unit;

a first determining unit, configured to determine whether the second TLS handshake is successfully established;

And a determining unit, configured to determine that there is no charging fraud when the second TLS handshake is successfully established, and determine that there is charging fraud when the second TLS handshake establishment fails.

In conjunction with the second aspect, in a first implementation of the second aspect, the apparatus further includes:

And a set maintenance unit, configured to: when the determining unit determines that there is no charging fraud, storing, in the trusted access set, a correspondence between the domain name requested by the UE and the Internet Protocol IP address; determining, by the determining unit, When the fee is fraudulent, the correspondence between the domain name requested by the UE and the IP address is stored in the untrusted access set.

With reference to the first embodiment of the second aspect, in a second implementation manner of the second aspect, the device further includes:

a second determining unit, configured to determine whether a correspondence between the domain name and the IP address that the UE requests to access belongs to the trusted access set and/or the non-trusted access set, if the domain name and IP that the UE requests to access The correspondence between the addresses does not belong to the trusted access set and does not belong to the non-trusted access set, and the recording unit records the handshake transmitted during the first TLS handshake between the UE and the server. information.

With reference to the second embodiment of the second aspect, in a third implementation manner of the second aspect, the device further includes:

a third determining unit, configured to determine whether the certificate returned by the server is valid, and if valid, the handshake checking unit establishes the second TLS handshake with the server by using the recorded handshake information, and if invalid, The determining unit determines that there is a billing fraud.

With reference to the third implementation manner of the second aspect, in a fourth implementation manner of the second aspect, the certificate returned by the server is effective: the certificate returned by the server belongs to a trusted certificate set, and the server returns The domain name in the certificate is the same as the domain name requested by the UE.

Combining the second aspect, or the first, or second, or third, or fourth of the second aspect The fifth embodiment of the second aspect, the detecting device for the charging fraud is a unified packet gateway UGW.

In a third aspect, a device for detecting a charge fraud according to an embodiment of the present invention includes a processor and a memory, where the processor and the memory are connected by using a communication bus, where the memory stores the first aspect or the first aspect. The instruction of the method for detecting a charge fraud according to any one of the embodiments, wherein the processor invokes an instruction in the memory, and may execute the meter according to any one of the first aspect or the first aspect Fee fraud detection method.

It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:

In the embodiment of the present invention, once the charging policy corresponding to the domain name requested by the UE is found to be a preferential charging policy, the handshake information transmitted during the first TLS handshake process between the UE and the server is recorded, and the UE establishes a handshake information between the UE and the server. After the first TSL handshake, the TLS handshake process is checked by using the recorded handshake information, that is, the detecting device initiates a second TLS handshake to the server by using the recorded handshake information, and if the second TLS handshake establishment fails, determining that there is a charging fraud, thereby Billing fraud existing in the encrypted transmission service can be identified.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a schematic flowchart of a method for detecting charging fraud according to an embodiment of the present invention;

2 is a schematic flowchart of another method for detecting a charging fraud according to an embodiment of the present invention;

3 is a schematic diagram of signaling interaction of a method for detecting charging fraud according to an embodiment of the present invention;

4 is a schematic structural diagram of a device for detecting a charge fraud according to an embodiment of the present invention;

FIG. 5 is another schematic structural diagram of a device for detecting charging fraud according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be described with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, those skilled in the art will be able to do without creative work. All other embodiments obtained are within the scope of the invention.

It can be seen from the description of the background art that for the encrypted transmission service, if there is a preferential charging policy at the same time, the behavior of charging fraud is prone to occur, and there is no effective solution in the prior art for such fraud, and thus the present invention Embodiments provide a method and apparatus for detecting billing fraud that can identify billing fraud.

Referring to FIG. 1, FIG. 1 is a schematic flowchart of a method for detecting a charging fraud according to an embodiment of the present invention. The method in this embodiment includes:

101. When the charging policy corresponding to the domain name requested by the UE is a preferential charging policy, record handshake information transmitted during the first TLS handshake process between the UE and the server.

In a specific implementation, the detecting device of the charging fraud may obtain the server that the UE requests to access during the process of the Transmission Control Protocol (TCP) handshake or the Transport Layer Security (TLS) handshake between the UE and the server. domain name. For example, the domain name corresponding to the destination IP address obtained by the domain name system (DNS) can be reversed according to the destination IP address carried in the TCP connection establishment request message sent by the UE; If the query is unsuccessful, the server name indication (SNI) parameter carried in the ClientHello message initiated by the UE may be identified, and the SNI parameter value is the domain name requested by the UE. If the SNI parameter fails to be obtained, the server response may be identified. The domain name in the certificate message, which is the domain name that the UE requests to access. The specific acquisition method is not limited here. The server in the embodiment of the present invention may be a Service Provider (SP) server.

The so-called preferential charging strategy can be a charging strategy such as free, unified payment, and low payment.

The recorded handshake information mainly includes the ClientHello message sent by the UE to the server, and may further include other messages sent by the UE to the server and messages returned by the server to the UE, which are not specifically limited herein.

102. Establish a second TLS handshake with the server by using the recorded handshake information.

That is, after the UE establishes the first TLS handshake with the server, the detecting device attempts to establish a second TLS handshake with the server by using the recorded handshake information.

The foregoing first and second are only used to distinguish the TLS handshake established between different objects, where the first TLS handshake is a TLS handshake established between the UE and the server, and the second TLS handshake is an TLS handshake established between the detection device and the server. The specific process of establishing two TLS handshakes can be considered the same.

103. Determine whether the second TLS handshake is successfully established. If not, perform step 104 to determine that there is a charging fraud. Otherwise, perform step 105 to determine that there is no charging fraud.

In this embodiment, after the UE establishes the first TLS handshake with the server, the detecting device checks the TLS handshake process by the recorded handshake information, thereby being able to identify the encrypted transmission service, the UE fraud, the server fraud, and the UE and the server. Cooperative fraud.

2 is a schematic flowchart of another method for detecting a charging fraud according to an embodiment of the present invention. The method in this embodiment includes:

201. When the charging policy corresponding to the domain name requested by the UE is a preferential charging policy, determine whether the correspondence between the domain name and the Internet Protocol (IP) address requested by the UE belongs to the trusted access set, if , step 209 is performed, if not, step 202 is performed;

In a specific implementation, the charging fraud detecting device may pre-configure or identify a server that does not perform charging fraud, and use such a server as a trusted server to save the correspondence between the domain name and the IP address of the trusted server. Trusted access collection. In addition, the identified server that performs the billing fraud is used as a non-trusted server, and the correspondence between the domain name and the IP address of the non-trusted server is saved to form an untrusted access set.

If the correspondence between the domain name and the IP address that the UE requests to access belongs to the trusted access set, it is considered that there is no charging fraud, and the service is preferentially charged for the subsequent transmission. If the correspondence between the domain name and the IP address requested by the UE does not belong to the The letter accesses the collection and continues to detect.

202, determining whether the correspondence between the domain name and the IP address that the UE requests to access belongs to the non-trusted access set, if yes, step 210 is performed, if not, step 203 is performed;

If the correspondence between the domain name and the IP address that the UE requests to access belongs to the non-trusted access set, the detecting device of the charging fraud considers that there is charging fraud, and the traffic that is subsequently transmitted is normally charged, and if the domain name and IP address that the UE requests to access The corresponding relationship does not belong to the trusted access set or the non-trusted access set, and the charging fraud detecting device continues to detect.

It should be noted that the execution sequence of step 201 and step 202 can be replaced, and the charging fraud can be quickly detected through

steps

201 and 202.

203. Record handshake information transmitted during the first TLS handshake between the UE and the server.

204, determining whether the certificate returned by the server is valid; if invalid, executing step 210, if valid, executing step 205;

In a specific implementation, the trusted device set may be pre-stored in the detecting device, and the trusted certificate set includes The certificate of the trusted server, the certificate of the trusted server may be provided by the cooperative OTT manufacturer, or may be extracted from the handshake message by visiting the website. If the certificate returned by the server belongs to the trusted certificate set, and the domain name in the certificate returned by the server is consistent with the domain name requested by the UE, the certificate returned by the server is considered valid. Certainly, the detection of whether the certificate returned by the server is valid may be other methods, for example, detecting whether the certificate returned by the server is issued by the trusted certificate issuer or the certificate returned by the third-party trusted system authentication server, which is not specifically limited herein.

205. Establish a TLS handshake with the server according to the recorded handshake information.

That is, after the UE establishes the first TLS handshake with the server, the detecting device may attempt to establish a second TLS handshake with the server by using the recorded handshake information at a timely time (for example, when the service transmission starts, during the transmission, during the service idle time, etc.).

206, determining whether the second TLS handshake is successfully established, if successful, executing step 207, otherwise performing step 208;

207. Determine that there is a charging fraud, normal charging, and store the correspondence between the domain name and the IP address that the UE requests to access in the non-trusted access set.

208. Determine that there is no charging fraud, preferential charging, and store the correspondence between the domain name and the IP address that the UE requests to access in the trusted access set.

209. Determine that there is no billing fraud, and preferential billing;

210. Determine that there is charging fraud and normal charging.

The above detection process may be initiated periodically or irregularly during the subsequent service transmission.

In this embodiment, by maintaining the trusted access set and the non-trusted access set, the charging fraud can be quickly identified. After the UE establishes the first TLS handshake with the server, the detecting device checks the TLS handshake process by the recorded handshake information, thereby enabling Identifying encrypted transmissions, UE fraud, server fraud, and UE-server cooperative fraud.

Referring to FIG. 3, FIG. 3 is a schematic diagram of a signaling interaction of a method for detecting a charging fraud according to an embodiment of the present invention. The method in this embodiment may be mainly divided into three phases. The first phase is a TCP handshake phase between the UE and the server. The second phase is the TLS handshake phase between the UE and the server, and the third phase is the handshake verification phase. The following details:

In the TCP handshake phase, the detecting device obtains the IP address of the server that the UE requests to access according to the TCP SYN request sent by the UE to the server, and queries the DNS record to obtain the domain name corresponding to the IP address, if the pre-configured charging policy corresponding to the domain name is configured. For the preferential billing strategy, you need to perform billing Fraud detection. In addition, the domain name that the UE requests to access may also be in the TLS handshake phase. FIG. 3 only takes the domain name that the UE requests to access in the TCP handshake phase as an example for description.

In the TLS handshake (ie, the first TLS handshake), when the detection of the charging fraud is required, the detecting device extracts the SNI parameter carried in the ClientHello message sent by the UE to the server to obtain the domain name requested by the UE, and determines that the UE requests the access. Whether the correspondence between the domain name and the IP address belongs to the trusted access set and/or the non-trusted access set. If the correspondence between the domain name and the IP address requested by the UE is neither belong to the trusted access set nor belong to the non-trusted access set. The TLS handshake information is recorded. After the server returns the certificate, it is determined whether the certificate returned by the server is valid. If the certificate returned by the server is valid, the handshake verification phase is entered.

In the handshake verification phase, the detecting device may use the recorded handshake information to initiate a TLS handshake (ie, a second TLS handshake) to the server, and if the second TLS handshake fails, determine that there is a charging fraud, subsequent normal charging, and the UE Corresponding relationship between the domain name and the IP address requested to be accessed is stored in the untrusted access set; if the second TLS handshake is successful, it is determined that there is no charging fraud, subsequent preferential charging, and the domain name and IP address corresponding to the UE requesting access The relationship is stored in a trusted access collection.

The following describes the charging fraud detecting apparatus provided by the embodiment of the present invention. The charging fraud detecting apparatus can be implemented on a unified packet gateway (UGW) or on other network devices having the UGW function. Referring to FIG. 4, the apparatus for detecting billing fraud in the embodiment of the present invention includes:

The recording unit 401 is configured to record handshake information transmitted during the first transport layer security TLS handshake process between the UE and the server, when the charging policy corresponding to the domain name requested by the user equipment UE is a preferential charging policy;

The handshake checking unit 402 is configured to establish a second TLS handshake with the server by using the handshake information recorded by the recording unit 401.

The first determining unit 403 is configured to determine whether the second TLS handshake is successfully established.

The determining unit 404 is configured to determine that there is no charging fraud when the second TLS handshake is successfully established, and determine that there is a charging fraud when the second TLS handshake establishment fails.

Further, the apparatus of this embodiment further includes:

The aggregation maintenance unit 405 is configured to: when the determining unit 404 determines that there is no charging fraud, store the correspondence between the domain name requested by the UE and the Internet Protocol IP address in the trusted access set; in the determining unit 404 Determining the domain name and IP that the UE requests to access when there is charging fraud The correspondence of addresses is stored in the untrusted access set.

Further, the apparatus of this embodiment further includes:

The second determining unit 406 is configured to determine whether the correspondence between the domain name and the IP address that the UE requests to access belongs to the trusted access set and/or the non-trusted access set, if the domain name requested by the UE is The mapping of the IP address does not belong to the trusted access set and does not belong to the non-trusted access set, and the recording unit 401 records the transmission during the first TLS handshake between the UE and the server. Handshake information.

Further, the apparatus of this embodiment further includes:

The third determining unit 407 is configured to determine whether the certificate returned by the server is valid, and if valid, the handshake checking unit 402 establishes the second TLS handshake with the server by using the recorded handshake information, if invalid The determining unit 404 determines that there is a billing fraud.

Further, the valid certificate returned by the server includes: the certificate returned by the server belongs to a trusted certificate set, and the domain name in the certificate returned by the server is consistent with the domain name requested by the UE.

The device described in the embodiment of the present invention may perform the method described in the embodiment shown in FIG. 2, and the technical implementation process and technical effects may be referred to the detailed description of the embodiment shown in FIG. 2, and details are not described herein again.

FIG. 5 is a schematic diagram of another structure of a charging fraud detecting apparatus according to an embodiment of the present invention. The charging fraud detecting apparatus of this embodiment includes a processor 501 and a memory 502, and the processor 501 and the memory 502 are connected by using a communication bus. The memory 502 stores an instruction for implementing the method for detecting the charging fraud shown in FIG. 2, and the processor 501 retrieves the instruction in the memory 502, and can perform the charging as described in the embodiment shown in FIG. Fraud detection method.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit. It can be electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the embodiments are modified, or the equivalents of the technical features are replaced by the equivalents of the technical solutions of the embodiments of the present invention.

Claims

A method for detecting billing fraud, characterized in that it comprises:

When the charging policy corresponding to the domain name requested by the user equipment UE is a preferential charging policy, the charging fraud detecting device records the handshake information transmitted during the establishment of the first transport layer secure TLS handshake between the UE and the server;

The charging fraud detecting device establishes a second TLS handshake with the server by using the recorded handshake information;

The charging fraud detecting device determines whether the second TLS handshake is successfully established;

If the second TLS handshake is successfully established, the charging fraud detecting means determines that there is no charging fraud, and if the second TLS handshake establishment fails, the charging fraud detecting means determines that there is charging fraud .
The method of claim 1 further comprising:

When it is determined that there is no billing fraud, the charging fraud detecting device stores the correspondence between the domain name requested by the UE and the Internet Protocol IP address in the trusted access set;

When it is determined that there is a charging fraud, the charging fraud detecting means stores the correspondence between the domain name and the IP address that the UE requests to access in the non-trusted access set.
The method according to claim 2, wherein before the handshake information transmitted during the first TLS handshake is established between the UE and the server, the method further includes:

The charging fraud detecting device determines whether the correspondence between the domain name and the IP address that the UE requests to access belongs to the trusted access set and/or the non-trusted access set;

If the correspondence between the domain name and the IP address that the UE requests to access does not belong to the trusted access set and does not belong to the non-trusted access set, the charging fraud detecting apparatus performs recording of the UE and The step of establishing handshake information transmitted during the first TLS handshake process between the servers.
The method according to claim 3, wherein before the establishing the second TLS handshake with the server by using the recorded handshake information, the method further comprises:

The charging fraud detecting device determines whether the certificate returned by the server is valid;

If valid, the charging fraud detecting means performs the step of establishing the second TLS handshake with the server by using the recorded handshake information, and if invalid, the charging fraud detecting means determines that there is charging Fraud.
The method according to claim 4, wherein the certificate returned by the server is effective: the certificate returned by the server belongs to a trusted certificate set, and the domain name in the certificate returned by the server is requested by the UE. The domain name is the same.
A device for detecting billing fraud, comprising:

a recording unit, configured to record handshake information transmitted during the first transport layer secure TLS handshake process between the UE and the server, when the charging policy corresponding to the domain name requested by the user equipment UE is a preferential charging policy;

a handshake checking unit, configured to establish a second TLS handshake with the server by using the handshake information recorded by the recording unit;

a first determining unit, configured to determine whether the second TLS handshake is successfully established;

And a determining unit, configured to determine that there is no charging fraud when the second TLS handshake is successfully established, and determine that there is charging fraud when the second TLS handshake establishment fails.
The device according to claim 6, wherein the device further comprises:

And a set maintenance unit, configured to: when the determining unit determines that there is no charging fraud, storing, in the trusted access set, a correspondence between the domain name requested by the UE and the Internet Protocol IP address; determining, by the determining unit, When the fee is fraudulent, the correspondence between the domain name requested by the UE and the IP address is stored in the untrusted access set.
The device according to claim 7, wherein the device further comprises:

a second determining unit, configured to determine whether a correspondence between the domain name and the IP address that the UE requests to access belongs to the trusted access set and/or the non-trusted access set, if the domain name and IP that the UE requests to access The correspondence between the addresses does not belong to the trusted access set and does not belong to the non-trusted access set, and the recording unit records the handshake transmitted during the first TLS handshake between the UE and the server. information.
The device according to claim 8, wherein the device further comprises:

a third determining unit, configured to determine whether the certificate returned by the server is valid, and if valid, the handshake checking unit establishes the second TLS handshake with the server by using the recorded handshake information, and if invalid, The determining unit determines that there is a billing fraud.
The device according to claim 9, wherein the certificate returned by the server is effective: the certificate returned by the server belongs to a trusted certificate set, and the domain name in the certificate returned by the server and the UE request access The domain name is the same.
The apparatus according to any one of claims 6 to 10, characterized in that the means for detecting fraudulent fraud is a unified packet gateway UGW.
A device for detecting fraudulent fraud, comprising: a processor and a memory, wherein the processor and the memory are connected by a communication bus, wherein the memory stores the implementation of any one of claims 1 to 5 The instruction of the method for detecting the billing fraud, the processor retrieving the instruction in the memory, and performing the method for detecting the billing fraud according to any one of claims 1 to 5.