WO2017107780A1 - 一种识别计费欺诈的非法代理的方法、设备及系统 - Google Patents

一种识别计费欺诈的非法代理的方法、设备及系统 Download PDF

Info

Publication number
WO2017107780A1
WO2017107780A1 PCT/CN2016/109060 CN2016109060W WO2017107780A1 WO 2017107780 A1 WO2017107780 A1 WO 2017107780A1 CN 2016109060 W CN2016109060 W CN 2016109060W WO 2017107780 A1 WO2017107780 A1 WO 2017107780A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
server
network device
core network
traffic
Prior art date
Application number
PCT/CN2016/109060
Other languages
English (en)
French (fr)
Inventor
王彩娟
朱璎
郑磊斌
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2017107780A1 publication Critical patent/WO2017107780A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4552—Lookup mechanisms between a plurality of directories; Synchronisation of directories, e.g. metadirectories
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies

Definitions

  • the present invention relates to the field of network security technologies, and in particular, to a method, device and system for identifying an illegal agent for charging fraud.
  • the filter condition (0.facebook.com) of the free package service is set on the Policy and Charging Enforcement Function (PCEF), and the user uses the free condition to access the paid service (www) At .test.com), the real-access service message (www.test.com) that needs to be paid for is disguised as a free service message (0.facebook.com/www.test.com). After the spoofed message passes the charging detection, the spoofed message is sent to the proxy server.
  • PCEF Policy and Charging Enforcement Function
  • the proxy server ignores the billing fraud and obtains the real-time URL of the user (Uniform Resource Locator, URL) (www.test.com) and forwards it to the service server. Similarly, the user downlink message is also processed by the proxy server and then forwarded to the PCEF, and then forwarded to the user equipment to achieve the swindle preferential rate to access the real service.
  • URL Uniform Resource Locator
  • the PCEF can obtain the Internet Protocol (IP) address of the fraudulent proxy server in advance, but the fraud industry chain can change the fraud at any time.
  • IP Internet Protocol
  • the embodiment of the present invention provides a method for identifying an illegal agent for charging fraud, which can accurately identify an illegal agent used for charging fraud, thereby effectively Blocking billing fraud.
  • the embodiments of the present invention also provide corresponding devices and systems.
  • a first aspect of the present invention provides a method for identifying a fraudulent agent of a charging fraud, the method being applied to a core network device of a communication system, an independent PCEF in a communication system, a GGSN/PGW embedded with a PCEF, a visualization device, and a DNS Server
  • the method belongs to: the core network device obtains the destination URL URL carried in the service packet and the IP address of the destination server; the core network device searches for the destination URL from the pre-established whitelist.
  • the whitelist includes a correspondence between the free URL and the IP address of the legal server; when the IP address of the server corresponding to the destination URL does not include the IP address of the destination server,
  • the core network device identifies the destination server as a suspected illegal proxy server.
  • the method for identifying the illegal agent of the charging fraud provided by the embodiment of the present invention can accurately identify the illegal agent used for the charging fraud, thereby Effectively block billing fraud.
  • the method further includes:
  • the core network device adds the IP address of the destination server to the graylist, and the graylist includes a correspondence between the free URL and the IP address of the suspected illegal proxy server.
  • the method further includes:
  • the core network device monitors a proportion of traffic of the suspected illegal proxy server in the graylist, and the ratio of the traffic is a ratio of free traffic to total traffic on the suspected illegal proxy server;
  • the core network device transfers, to the blacklist, the IP address of the suspected illegal proxy server whose traffic percentage is higher than the first preset threshold in the preset time period, where the blacklist includes the free URL and the illegal proxy.
  • the method further includes:
  • the core network device monitors a proportion of traffic of the suspected illegal proxy server in the graylist, and the ratio of the traffic is a ratio of free traffic to total traffic on the suspected illegal proxy server;
  • the core network device transfers the IP address of the suspected illegal proxy server whose traffic ratio is lower than the second preset threshold in the preset time period to the whitelist.
  • the method further includes
  • the core network device obtains a legal website address of the domain name packet
  • the core network device obtains an IP address of a legal server corresponding to the legal website from a domain name response message sent by the domain name server;
  • the core network device adds the legal website address and the IP address of the corresponding legal server to the white list.
  • the method further includes:
  • the core network device processes the service packet according to an anti-control policy for an illegal agent.
  • the second aspect of the present invention provides a core network device, which is applied to a communication system.
  • the independent PCEF in the communication system, the GGSN/PGW embedded in the PCEF, the visualization device, and the DNS server all belong to the core network device, and the core network device includes:
  • An obtaining unit configured to obtain a destination URL and a destination server's IP address carried in the service packet
  • a search unit configured to search, from a pre-established whitelist, an IP address of a server corresponding to the destination URL obtained by the obtaining unit, where the whitelist includes a correspondence between a free URL and an IP address of a legal server;
  • the identifying unit is configured to identify the destination server as a suspected illegal proxy server when the IP address of the server that does not include the destination URL that is searched by the searching unit does not include the IP address of the destination server.
  • the core network device provided by the embodiment of the present invention can accurately identify the illegal agent used for the charging fraud, thereby effectively blocking the charging. Fraud.
  • the core network device further includes:
  • a first adding unit configured to: after the identifying unit identifies that the destination server is a suspected illegal proxy server, add an IP address of the destination server to a graylist, where the graylist includes the free URL and the Describe the correspondence between the IP addresses of the suspected proxy servers.
  • the core network device further includes:
  • a first monitoring unit configured to monitor a proportion of traffic of the suspected illegal proxy server in the graylist, where the proportion of the traffic is a ratio of free traffic to total traffic on the suspected illegal proxy server;
  • a first transfer unit configured to transfer, to the blacklist, the IP address of the suspected illegal proxy server whose flow rate monitored by the first monitoring unit in the preset time period is higher than the first preset threshold, in the blacklist
  • the correspondence between the free URL and the IP address of the illegal proxy server is included.
  • the core network device further includes:
  • a second monitoring unit configured to monitor a proportion of traffic of the suspected illegal proxy server in the graylist, where the ratio of the traffic is a ratio of free traffic to total traffic on the suspected illegal proxy server;
  • a second transfer unit configured to transfer, to the whitelist, an IP address of the suspected illegal proxy server whose flow rate monitored by the second monitoring unit in the preset time period is lower than the second preset threshold.
  • the core network device further includes: a second adding unit,
  • the obtaining unit is further configured to obtain a legal website address of the domain name packet, and when the legal website address is a free website address, obtain the IP address of the legal server corresponding to the legal website address from the domain name response message sent by the domain name server;
  • the second adding unit is configured to add, by the obtaining unit, the legal website address and the IP address of the corresponding legal server acquired by the acquiring unit to the white list.
  • the core network device further includes:
  • the processing unit is configured to process the service packet according to the defense policy for the illegal agent after the identification unit identifies that the destination server is a suspected illegal proxy server.
  • the third aspect of the present invention provides a core network device, which is applied to a communication system.
  • the independent PCEF in the communication system, the GGSN/PGW embedded in the PCEF, the visualization device, and the DNS server all belong to the core network device, and the core network device includes: a transceiver, a processor, and a memory in which the processor executes a process of executing an illegal agent that identifies billing fraud sequence;
  • the processor is used to perform the following steps:
  • the destination server When the IP address of the destination server is not included in the IP address of the server corresponding to the destination URL, the destination server is identified as a suspected illegal proxy server.
  • the processor is further configured to add an IP address of the destination server to a graylist, where the graylist includes a correspondence between the free URL and an IP address of the suspected illegal proxy server. .
  • the processor is further configured to monitor a proportion of traffic of the suspected illegal proxy server in the graylist, where the ratio of the traffic is a ratio of free traffic to total traffic on the suspected illegal proxy server;
  • the IP address of the suspected illegal proxy server whose traffic percentage is higher than the first preset threshold is transferred to the blacklist, and the blacklist includes the free URL and the IP address of the illegal proxy server. Correspondence relationship.
  • the processor is further configured to monitor a proportion of traffic of the suspected illegal proxy server in the graylist, where the ratio of the traffic is a ratio of free traffic to total traffic on the suspected illegal proxy server;
  • the IP address of the suspected illegal proxy server whose traffic accounting ratio is lower than the second preset threshold is transferred to the whitelist.
  • the processor is further configured to obtain a legal website address of the domain name message; when the legal website address is a free website address, obtain a legal server corresponding to the legal website address from the domain name response message sent by the domain name server.
  • An IP address is added to the whitelist corresponding to the legal URL and the IP address of the corresponding legal server.
  • the processor is further configured to process the service packet according to an anti-control policy for the illegal agent.
  • a fourth aspect of the present invention provides a system for identifying an illegal agent for charging fraud, comprising: a charging execution function entity PCEF and a domain name server,
  • the PCEF is the core network device described in the foregoing second aspect or any optional implementation manner of the second aspect.
  • a fifth aspect of the present invention provides a system for identifying an illegal agent for charging fraud, comprising: a charging execution function entity PCEF, a visualization device, and a domain name server,
  • the visual network device is the core network device described in the foregoing second aspect or any optional implementation manner of the second aspect.
  • the system for identifying the illegal agent of the charging fraud provided by the embodiment of the present invention can accurately identify the illegal agent used for the charging fraud, thereby Effectively block billing fraud.
  • FIG. 1 is a schematic diagram of an embodiment of a communication system in an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of an embodiment of a system for identifying an illegal agent for charging fraud in an embodiment of the present invention
  • FIG. 3 is a schematic diagram of content transfer of gray, white, and black lists in an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of an embodiment of a process of establishing a whitelist in an embodiment of the present invention
  • FIG. 5 is a schematic diagram of another embodiment of a process for establishing a whitelist in an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of an embodiment of a method for identifying an illegal proxy for charging fraud in an embodiment of the present invention
  • FIG. 7 is a schematic diagram of an embodiment of a core network device according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of another embodiment of a core network device according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of another embodiment of a core network device according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of another embodiment of a core network device according to an embodiment of the present invention.
  • FIG. 11 is a schematic diagram of another embodiment of a core network device according to an embodiment of the present invention.
  • FIG. 12 is a schematic diagram of another embodiment of a core network device according to an embodiment of the present invention.
  • FIG. 13 is a schematic diagram of another embodiment of a core network device according to an embodiment of the present invention.
  • Embodiments of the present invention provide a method for identifying an illegal proxy for charging fraud, which can accurately identify an illegal proxy for charging fraud, thereby effectively blocking charging fraud.
  • the embodiments of the present invention also provide corresponding devices and systems. The details are described below separately.
  • FIG. 1 is a schematic diagram of an embodiment of a communication system according to an embodiment of the present invention.
  • an embodiment of a communication system includes: a user equipment (User Equipment, UE), a residential access network (RAN), and a charging and charging function entity (Policy and Charging Enforcement Function). , PCEF), billing device (Billing), visualization device, domain name server (DNS), and service provider (SP) provided by the service provider (SP).
  • PCEF Policy and Charging Enforcement Function
  • billing device Billing
  • visualization device
  • DNS domain name server
  • SP service provider
  • the UE can be installed with a client that helps the user to obtain free traffic or preferential traffic in a fraudulent manner.
  • the RAN may include a wireless access device such as a base station or an evolved base station.
  • the PCEF can be embedded in the Gateway GPRS Support Node (GGSN) or the Packet Data Network Gateway (PGW) in a built-in form, or the PCEF can be set independently.
  • the operator implements the online/offline charging function by assigning the traffic service identifier, the service registration information and the charging identifier management of the user traffic through Billing.
  • the visualization device can display the data of the network for the operator to know the network data in time.
  • the DNS Server can translate the domain name into an IP address that the network can recognize. Among them, independent PCEF, GGSN/PGW embedded with PCEF, visualization device, DNS Server And so on belong to the core network equipment.
  • the core network device of the illegal agent for identifying the charging fraud mainly includes an independent PCEF, a GGSN/PGW embedded with the PCEF, or a visualization device having the illegal agent capability for identifying the charging fraud.
  • FIG. 2 is a schematic diagram of an embodiment of a system for identifying an illegal agent for charging fraud according to an embodiment of the present invention.
  • the PCEF receives the service packet sent by the user equipment transmitted by the RAN, and the destination URL and the IP address of the destination server carried in the service packet; for example, the destination URL is www.google.com, and the destination server has an IP address of 74.125. 71.120.
  • the PCEF obtains the URL from the network layer of the service packet, and obtains the IP address of the destination server from the IP layer.
  • the PCEF searches for the IP address of the server corresponding to the destination URL from the pre-established whitelist, and the whitelist includes the correspondence between the free URL and the IP address of the legal server.
  • the main function in the embodiment of the present invention is to prevent the proxy server with the traffic fraud function from obtaining the free traffic in a fraudulent manner, and of course, the preferential traffic may also be included, so the URLs in the whitelist are all free URLs or preferential URLs, when the PCEF is from If you find www.google.com in the whitelist, you can determine the IP address of the legitimate server corresponding to the www.google.com URL in the whitelist.
  • Table 1 as shown in Table 1:
  • IP address of the legitimate server corresponding to www.google.com can be determined.
  • the PCEF identifies the destination server as a suspected illegal proxy server.
  • the IP address of the legitimate server corresponding to www.google.com does not include the IP address 74.125.71.120 of the destination server.
  • the IP address corresponding to the unregistered IP address in the IP address corresponding to www.google.com in Table 1 does not include the destination IP address, and the server whose IP address is 74.125.71.120 can be determined to be a suspected illegal agent. server.
  • the identified proxy server will not be blacked out, but Defined as a suspected illegal proxy server, by further monitoring the observations to determine whether the suspected illegal proxy server is a genuine illegal proxy server.
  • the IP address of the destination server is added to the graylist, and the graylist includes the free URL and the IP address of the suspected illegal proxy server. Correspondence relationship.
  • PCEF continuously monitors suspected illegal proxy servers in the greylist to further characterize suspected illegal proxy servers.
  • the PCEF monitors the proportion of the traffic of the suspected illegal proxy server in the gray list, and the ratio of the traffic is the ratio of the free traffic to the total traffic on the suspected illegal proxy server, that is, the free traffic based on the suspected illegal proxy server IP Ratio of total flow;
  • the PCEF transfers the IP address of the suspected illegal proxy server whose traffic percentage is higher than the first preset threshold in the preset time period to the blacklist, where the blacklist includes the free URL and the IP address of the illegal proxy server. Correspondence between them.
  • the IP address of the suspected illegal proxy server whose traffic ratio is lower than the second preset threshold in the preset time period is transferred to the white list.
  • Both the first preset threshold and the second preset threshold may be preset values, and the first preset threshold and the second preset threshold may be dynamically adjusted according to requirements.
  • the PCEF continuously monitors the traffic of each IP address in the graylist and records the traffic ratio of the free traffic/total traffic. If the threshold is higher than the pre-configured blacklist threshold, such as 90%, that is, the first preset threshold, Transfer IP addresses with a traffic ratio higher than 90% to the blacklist. If it is lower than the pre-configured whitelist threshold, such as 50%, that is, the second preset threshold, the traffic ratio is lower than 50% and the IP address is transferred to the whitelist.
  • the pre-configured blacklist threshold such as 90%, that is, the first preset threshold
  • the PCEF monitors that the proportion of traffic under an IP address in the graylist is higher than the first preset threshold, indicating that the suspected illegal proxy server corresponding to the IP address is an illegal proxy server, and the IP is The address is transferred to the blacklist.
  • the IP address in the blacklist can be input into the billing anti-fraud system for processing.
  • the server corresponding to these IP addresses can be traced back to the source, and the legal responsibility of the person who sets these illegal proxy servers is investigated.
  • the PCEF monitors that the traffic ratio of an IP address in the graylist is lower than the second preset threshold, indicating that the suspected illegal proxy server corresponding to the IP address is a legitimate proxy server, and the IP address is transferred to the whitelist.
  • the first preset threshold and the second preset threshold may be adjusted according to requirements, and specific values are not limited.
  • an automatic blacklist switch can be configured.
  • the blacklist can be manually configured, and the blacklist is automatically converted into a blacklist.
  • the blacklist needs to be aged. If the illegal proxy server marked in the blacklist does not have a service packet within the predetermined time period, the IP address of the illegal proxy server is deleted from the blacklist, that is, the timer is refreshed. Blacklist, removes the expired IP address from the blacklist.
  • the embodiments described above can accurately identify illegal agents for billing fraud, thereby effectively blocking billing fraud.
  • the mapping between the pre-registered legal URL and the IP address of the legitimate server is stored in the domain name server.
  • the whitelist in the initial state is empty, including two columns of the free URL and the IP address of the legitimate server.
  • the PCEF obtains a legal URL (URL) from a domain name packet such as Get/POST/Connect, and then confirms whether the legal URL belongs to a free URL according to an existing free rate group (Rating Group, RG).
  • the free RG contains all the free URLs that have been registered.
  • the legal URL is confirmed to be a free URL, the legal URL is added to the whitelisted free URL column.
  • the URL is www.google.com, the resulting whitelist is shown in Table 2:
  • the PCEF obtains the correspondence between the IP address of the legitimate server by the domain name server through the domain name response message, and assumes that the IP address of the obtained legitimate server is 74.125.71.104, 173.194.64.199. , « Then add the corresponding IP address to the whitelist to get the whitelist as shown in Table 3.
  • the whitelist can be automatically established.
  • the IP is added to the graylist.
  • the previous content of this process has been described.
  • the process of transferring the content in the gray list to the white list or transferring to the blacklist has also been described in the foregoing process, and therefore will not be repeated here.
  • the visual device can also be notified to determine the black and white gray list of fraud:
  • the PCEF notifies the visualization platform whether each stream is black/white/grey, and a field is added to the source data.
  • the visualization platform performs statistics on graylists, and finds suspicious black agents based on the proportion of traffic and the proportion of users.
  • the professional service confirms the black agent through packet capture analysis, and the blacklist is input into the billing fraud prevention system.
  • the IP address of the legal server is removed, and the IP culling is performed when the WAPGW is deployed.
  • the normal WAPGW has free traffic and charging traffic.
  • the IP address of the DNS query is different from the actual destination IP address.
  • the WAPGW IP server enters the graylist and then determines the traffic threshold of the WAPGW IP. For normal WAPGW, there is charging traffic. Therefore, it can be judged whether the WAPGW is normal.
  • the cloud acceleration is enabled, and some services are accessed through the proxy server of the UC.
  • the HOST is different from the IP, and enters the gray list, and is determined by the IP global traffic ratio.
  • the URL will carry the CDN word from the existing packet capture, and the IP address of the DNS query is the IP of the CDN website.
  • PCEF configuration *facebook* is free.
  • users access facebook they carry a URL similar to *facebook.CDN.amazon.* (this URL can be recognized as free in PCEF), and the destination IP is also the IP address of CDN.
  • the CDN IP is added to the whitelist.
  • an IP can be used by multiple content. If the IP is not used by a free URL, the PCEF will be billed normally.
  • the server IP whitelist is collected through trusted DNS packets, and the Proxy agent is identified to prevent the fraud industry chain from tampering with the data by forging the DNS Server response message.
  • the fraudulent proxy server IP is accurately identified by collecting the free traffic and the total traffic ratio at a preset time, and the situation that the operator cannot obtain the information before is solved.
  • the PCEF can learn the anti-control action according to the PCEF self-learning fraud proxy server IP, such as blocking, return charging rate, bandwidth limitation, etc., to reduce the operator's loss.
  • the content described above is described by the PCEF as the execution subject or the core network device with the PCEF embedded as the execution subject.
  • the visualization device and the PCEF cooperate to complete the identification in the embodiment of the present invention.
  • the visual device can establish a whitelist, a graylist, and a blacklist.
  • the PCEF parses the destination URL and the destination server's IP address carried in the service packet from the service packet, and then the PCEF will use the destination URL.
  • the IP address of the destination server is sent to the visualization device, and the visualized device identifies the suspected illegal proxy server, and the visualized device further monitors the proportion of the traffic of the suspected malicious proxy server, and performs the graylist to the whitelist and the graylist to the blacklist.
  • the content transfer between the lists, the specific process is basically the same as the process performed by the above PCEF, and will not be introduced too much here.
  • the visualization device can also count the TOP N Server IP for free traffic based on the free RG.
  • the visualization platform supports configuring a free URL list, a list of trusted domain names, and learning a free IP whitelist through DNS. Free traffic TOP Server IP After removing the IP whitelist, the rest are treated as graylisted.
  • the visualization platform also collects the free traffic, total traffic, and free traffic ratio of each server IP. It supports the output of the blacklist of suspected frauds from the graylist based on the custom free traffic threshold and the free traffic percentage threshold. Of course, the graylist is included in the graylist.
  • the IP may be a normal Proxy, such as a UC browser, or it may be the IP address of the fraudulent Proxy.
  • the fraudulent IP can be initially determined from the free traffic ratio.
  • the fraudulent Top user can be further drilled.
  • the report can perform instant query, scheduled task query and sending, and the service personnel can further specify blacklist/grey list IP based on the report to perform packet capture analysis to determine fraud and fraud.
  • the effects of identification and control on the PCEF can be presented to the operator on the visualization device.
  • the prior art is to reconfigure the anti-control action by manually identifying and manually configuring the fraud proxy server IP.
  • this embodiment introduces a new way of identifying the charging fraud----automatically identifying the fraudulent proxy server IP, and can realize the automatic closed loop of the billing fraud prevention and control.
  • the IP address of the trusted DNS server can be configured on the visualization device. It can be provided by the operator. You can also query the DNS configuration on the gateway and configure the free URL list. For example, if the current facebook is free, configure "*.facebook.*". .
  • IP whitelist is empty.
  • the IP list in the DNS TLV is saved to the IP white list
  • the server IP in the source data is the trusted DNS server IP
  • the protocol type is DNS
  • the DNS host and the free URL in the DNS TLV can match;
  • the visualization platform can directly configure the IP whitelist to adapt to the scenario where the gateway configures the L3/L4 layer free rules.
  • the server IP white list is collected through the trusted DNS packet, and the Proxy agent is identified, so as to prevent the fraud industry chain from falsifying the data by forging the DNS server response message.
  • the user and the server IP are given time-to-time statistics for free traffic and total traffic to accurately locate the fraud proxy server IP, which solves the problem that the operator cannot obtain information before.
  • the visualization platform may instruct the PCEF self-learning fraud proxy server IP list and configure the prevention action.
  • the original appeal of the visual platform to collect billing information on the PCEF is not derived from billing fraud prevention, but provides the operator with the distribution of user access services.
  • Billing fraud prevention relies on the original reported data and is processed through the visualization platform.
  • the closed-loop self-learning fraud proxy server maximizes the existing networking and service hierarchy and is easy to deploy.
  • This embodiment introduces a new way of identifying the charging fraud----automatically identifying the fraudulent proxy server IP, which can realize the automatic closed loop of the billing fraud prevention and control.
  • the system for identifying an illegal agent for charging fraud provided by the embodiment of the present invention has the following advantages:
  • the IP address of the fraudulent proxy server that matches the free RG is not It needs to be manually configured and obtained by the device itself. It adapts to the dynamic change of the IP address of the fraud proxy server and improves the maintainability.
  • an embodiment of a method for identifying a fraudulent agent for charging fraud includes:
  • the core network device obtains the destination URL URL carried in the service packet and the IP address of the destination server.
  • the core network device searches for an IP address of a server corresponding to the destination URL from a pre-established whitelist, where the whitelist includes a correspondence between the free URL and the IP address of the legal server.
  • the core network device identifies the destination server as a suspected illegal proxy server.
  • Embodiments of the present invention provide a method for identifying an illegal proxy for charging fraud, which can accurately identify an illegal proxy for charging fraud, thereby effectively blocking charging fraud.
  • the core network device identifies the destination.
  • the method may further include:
  • the core network device adds the IP address of the destination server to the graylist, and the graylist includes a correspondence between the free URL and the IP address of the suspected illegal proxy server.
  • the second optional embodiment of the method for identifying a fraudulent agent of the charging fraud provided by the embodiment of the present invention in,
  • the core network device monitors a proportion of traffic of the suspected illegal proxy server in the graylist, and the ratio of the traffic is a ratio of free traffic to total traffic on the suspected illegal proxy server;
  • the core network device transfers, to the blacklist, the IP address of the suspected illegal proxy server whose traffic percentage is higher than the first preset threshold in the preset time period, where the blacklist includes the free URL and the illegal proxy.
  • the third optional embodiment of the method for identifying a fraudulent agent of the charging fraud provided by the embodiment of the present invention in,
  • the core network device monitors a proportion of traffic of the suspected illegal proxy server in the graylist, and the ratio of the traffic is a ratio of free traffic to total traffic on the suspected illegal proxy server;
  • the core network device transfers the IP address of the suspected illegal proxy server whose traffic ratio is lower than the second preset threshold in the preset time period to the whitelist.
  • a fourth optional embodiment of the method for identifying a fraudulent agent for charging fraud according to any one of the foregoing methods for identifying a fraudulent agent of a billing fraud, the method also includes
  • the core network device obtains a legal website address of the domain name packet
  • the core network device obtains an IP address of a legal server corresponding to the legal website from a domain name response message sent by the domain name server;
  • the core network device adds the legal website address and the IP address of the corresponding legal server to the white list.
  • the method may further include:
  • the core network device processes the service packet according to an anti-control policy for an illegal agent.
  • FIG. 6 The corresponding embodiment or any optional embodiment of FIG. 6 can be understood by referring to the description in the parts of FIG. 1 to FIG. 5, and details are not repeated herein.
  • an embodiment of a core network device 30 includes:
  • the obtaining unit 301 is configured to obtain a destination URL carried in the service packet and an IP address of the destination server.
  • the searching unit 302 is configured to search for an IP address of a server corresponding to the destination URL obtained by the obtaining unit 301 from a pre-established whitelist, where the whitelist includes a correspondence between the free URL and the IP address of the legal server. ;
  • the identifying unit 303 is configured to identify that the destination server is a suspected illegal proxy server when the IP address of the destination server is not included in the IP address of the server corresponding to the destination URL found by the searching unit 302.
  • the obtaining unit 301 obtains the destination URL and the IP address of the destination server carried in the service packet, and the search unit 302 searches the pre-established whitelist for the destination URL that is obtained by the obtaining unit 301.
  • the IP address of the server, the whitelist includes a correspondence between the free URL and the IP address of the legal server; the identification unit 303 does not include the IP address of the server corresponding to the destination URL found by the searching unit 302.
  • the destination server is identified as a suspected illegal proxy server.
  • the core network device provided by the embodiment of the present invention can accurately identify an illegal proxy for charging fraud, thereby effectively blocking charging fraud.
  • the core network device 30 further includes:
  • a first adding unit 304 configured to add an IP address of the destination server to the graylist after the identifying unit 303 identifies that the destination server is a suspected illegal proxy server, where the graylist includes the free URL Correspondence with the IP address of the suspected illegal proxy server.
  • the core network device 30 further includes:
  • a first monitoring unit 305 configured to monitor, by the first adding unit 304, a traffic proportion of a suspected illegal proxy server added to the graylist, where the traffic ratio is free traffic and total traffic on the suspected illegal proxy server Ratio of flow;
  • the first transfer unit 306 is configured to transfer, to the blacklist, the IP address of the suspected illegal proxy server whose flow rate monitored by the first monitoring unit 305 in the preset time period is higher than the first preset threshold, the black The list contains the correspondence between the free URL and the IP address of the illegal proxy server.
  • the core network device 30 further includes:
  • a second monitoring unit 307 configured to monitor a traffic proportion of the suspected illegal proxy server added by the first adding unit 304 to the graylist, where the traffic ratio is free traffic and total traffic on the suspected illegal proxy server Ratio of flow;
  • the second transfer unit 308 is configured to transfer the IP address of the suspected illegal proxy server whose traffic volume ratio monitored by the second monitoring unit 307 in the preset time period is lower than the second preset threshold to the white list.
  • the core network device further includes: Add unit 309,
  • the obtaining unit 301 is further configured to obtain a legal website address of the domain name message.
  • the legal website address is a free website address
  • the domain name response message sent by the domain name server obtains the IP address of the legal server corresponding to the legal website address.
  • the second adding unit 309 is configured to add, by the obtaining unit 301, the legal website address and the IP address of the corresponding legal server acquired by the acquiring unit to the white list.
  • the core network device 30 further includes:
  • the processing unit 311 is configured to process the service packet according to the defense policy for the illegal agent after the identification unit 303 identifies that the destination server is a suspected illegal proxy server.
  • FIG. 13 is a schematic structural diagram of a core network device 30 according to an embodiment of the present invention.
  • the core network device 30 includes a processor 310, a memory 350, and an input/output I/O device 330.
  • the memory 350 can include read only memory and random access memory, and provides operational instructions and data to the processor 310.
  • a portion of memory 350 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the memory 350 stores elements, executable modules or data structures, or a subset thereof, or their extended set:
  • the operation instruction can be stored in the operating system
  • the destination server When the IP address of the destination server is not included in the IP address of the server corresponding to the destination URL, the destination server is identified as a suspected illegal proxy server.
  • the core network device provided by the embodiment of the present invention can accurately identify an illegal proxy for charging fraud, thereby effectively blocking charging fraud.
  • the processor 310 controls the operation of the core network device 30, which may also be referred to as a CPU (Central Processing Unit).
  • Memory 350 can include read only memory and random access memory and provides instructions and data to processor 310.
  • a portion of memory 350 may also include non-volatile random access memory (NVRAM).
  • NVRAM non-volatile random access memory
  • the components of the core network device 30 are coupled together by a bus system 320.
  • the bus system 320 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 320 in the figure.
  • Processor 310 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 310 or an instruction in a form of software.
  • the processor 310 described above may be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or discrete hardware. Component.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA off-the-shelf programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 350, and the processor 310 reads the information in the memory 350 and performs the steps of the above method in combination with its hardware.
  • the processor 310 is further configured to add an IP address of the destination server to a graylist, where the graylist includes a correspondence between the free URL and an IP address of the suspected illegal proxy server.
  • processor 310 is further configured to:
  • processor 310 is further configured to:
  • the IP address of the suspected illegal proxy server whose traffic ratio is lower than the second preset threshold in the preset time period is transferred to the white list.
  • processor 310 is further configured to:
  • the domain name response message sent by the domain name server obtains the IP address of the legal server corresponding to the legal website address;
  • the processor 310 is further configured to process the service packet according to an anti-control policy for the illegal agent.
  • the above core network device 30 can be understood by referring to the description in the parts of FIG. 1 to FIG. 6 , and no further description is made herein.
  • the program may be stored in a computer readable storage medium, and the storage medium may include: ROM, RAM, disk or CD.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种识别计费欺诈的非法代理的方法，包括：核心网设备获取业务报文中携带的目的网址URL和目的服务器的IP地址；所述核心网设备从预先建立的白名单中查找与所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系；当与所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，所述核心网设备识别所述目的服务器为疑似非法代理服务器。本发明实施例提供的识别计费欺诈的非法代理的方法，可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。

Description

一种识别计费欺诈的非法代理的方法、设备及系统
本申请要求于2015年12月22日提交中国专利局、申请号为201510969780.5、发明名称为“一种识别计费欺诈的非法代理的方法、设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络安全技术领域，具体涉及一种识别计费欺诈的非法代理的方法、设备及系统。
背景技术
随着经济发展和移动通讯市场的大规模部署，传统语音和新型“流量”业务已经广泛被应用和推广。不过在一些地区，移动网络流量资费比较昂贵，在这种背景下，网络上就存在很多利用优惠计费策略漏洞进行计费欺诈的行为。例如：计费执行功能实体(Policy and Charging Enforcement Function，PCEF)上设置了免费套餐业务的过滤条件(0.facebook.com)，用户利用该免费过来条件，在用户想要访问付费的业务(www.test.com)时，将需要付费的真实访问业务报文(www.test.com)伪装成免费业务报文(0.facebook.com/www.test.com)。在伪装报文通过计费检测后，将伪装报文送到代理服务器上。代理服务器忽略计费欺诈，获取用户真实业务的网址(Uniform Resource Locator，URL)(www.test.com)，转发到业务服务器。同样，用户下行报文也会经代理服务器处理后转发到PCEF上，继而转发到用户设备上，实现诈取优惠费率访问真实业务。
对于这类伪装报文，真实业务的网址总是不停的更换隐藏的字段，导致开发人员总需要不停的升级，只要伪装报文中真实业务的网址字段稍有更改，就会检测不到。
对于网络中存在的上述超文本传送协议(Hypertext transfer protocol，HTTP)计费欺诈场景，PCEF可预先获取欺诈的代理服务器的互联网络协议(Internet Protocol，IP)地址，但欺诈产业链可以随时更换欺诈的代理服务器的IP地址，导致对欺诈的代理服务器的识别不准确。
发明内容
为了解决现有技术中对计费欺诈的识别效果很差的问题，本发明实施例提供一种识别计费欺诈的非法代理的方法，可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。本发明实施例还提供了相应的设备及系统。
本发明第一方面提供一种识别计费欺诈的非法代理的方法，该方法应用于通信系统的核心网设备，通信系统中独立的PCEF、内嵌有PCEF的GGSN/PGW、可视化设备、DNS Server 等都属于核心网设备，所述方法包括：核心网设备获取业务报文中携带的目的网址URL和目的服务器的IP地址；所述核心网设备从预先建立的白名单中查找与所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系；当与所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，所述核心网设备识别所述目的服务器为疑似非法代理服务器。与现有技术中对对计费欺诈的识别效果很差的问题相比，本发明实施例提供的识别计费欺诈的非法代理的方法，可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。
可选地，所述核心网设备识别所述目的服务器为疑似非法代理服务器之后，所述方法还包括：
所述核心网设备将所述目的服务器的IP地址添加到灰名单中，所述灰名单中包含所述免费网址与所述疑似非法代理服务器的IP地址之间的对应关系。
可选地，所述方法还包括：
所述核心网设备监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
所述核心网设备将预置时间段内所述流量占比高于第一预置阈值的疑似非法代理服务器的IP地址转移到黑名单中，所述黑名单中包含所述免费网址与非法代理服务器的IP地址之间的对应关系。
可选地，所述方法还包括：
所述核心网设备监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
所述核心网设备将预置时间段内所述流量占比低于第二预置阈值的疑似非法代理服务器的IP地址转移到所述白名单中。
可选地，所述方法还包括
所述核心网设备获取域名报文的合法网址；
当所述合法网址为免费网址时，所述核心网设备从域名服务器发送的域名响应报文中获取与所述合法网址对应的合法服务器的IP地址；
所述核心网设备将所述合法网址和所述对应的合法服务器的IP地址对应的添加到所述白名单中。
可选地，所述核心网设备识别所述目的服务器为疑似非法代理服务器之后，所述方法还包括：
所述核心网设备根据针对非法代理的防控策略，处理所述业务报文。
本发明第二方面提供一种核心网设备，应用于通信系统，通信系统中独立的PCEF、内嵌有PCEF的GGSN/PGW、可视化设备、DNS Server等都属于核心网设备，核心网设备包括：
获取单元，用于获取业务报文中携带的目的网址URL和目的服务器的IP地址；
查找单元，用于从预先建立的白名单中查找与所述获取单元获取的所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系；
识别单元，用于当与所述查找单元查找到的所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，识别所述目的服务器为疑似非法代理服务器。
与现有技术中对对计费欺诈的识别效果很差的问题相比，本发明实施例提供的核心网设备，可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。
可选地，所述核心网设备还包括：
第一添加单元，用于在所述识别单元识别所述目的服务器为疑似非法代理服务器之后，将所述目的服务器的IP地址添加到灰名单中，所述灰名单中包含所述免费网址与所述疑似非法代理服务器的IP地址之间的对应关系。
可选地，所述核心网设备还包括：
第一监控单元，用于监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
第一转移单元，用于将预置时间段内所述第一监控单元监控的流量占比高于第一预置阈值的疑似非法代理服务器的IP地址转移到黑名单中，所述黑名单中包含所述免费网址与非法代理服务器的IP地址之间的对应关系。
可选地，所述核心网设备还包括：
第二监控单元，用于监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
第二转移单元，用于将预置时间段内所述第二监控单元监控的流量占比低于第二预置阈值的疑似非法代理服务器的IP地址转移到所述白名单中。
可选地，所述核心网设备还包括：第二添加单元，
所述获取单元，还用于获取域名报文的合法网址，当所述合法网址为免费网址时，从域名服务器发送的域名响应报文中获取与所述合法网址对应的合法服务器的IP地址；
所述第二添加单元，用于将所述获取单元获取所述合法网址和所述获取单元获取的所述对应的合法服务器的IP地址对应的添加到所述白名单中。
可选地，所述核心网设备还包括：
处理单元，用于在所述识别单元识别出所述目的服务器为疑似非法代理服务器之后，根据针对非法代理的防控策略，处理所述业务报文。
本发明第三方面提供一种核心网设备，应用于通信系统，通信系统中独立的PCEF、内嵌有PCEF的GGSN/PGW、可视化设备、DNS Server等都属于核心网设备，核心网设备包括：收发器、处理器和存储器，所述存储器中存储有处理器执行识别计费欺诈的非法代理的程 序；
处理器用于执行如下步骤：
获取业务报文中携带的目的网址URL和目的服务器的IP地址；
从预先建立的白名单中查找与所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系；
当与所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，识别所述目的服务器为疑似非法代理服务器。
可选地，所述处理器还用于将所述目的服务器的IP地址添加到灰名单中，所述灰名单中包含所述免费网址与所述疑似非法代理服务器的IP地址之间的对应关系。
可选地，所述处理器还用于监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；将预置时间段内所述流量占比高于第一预置阈值的疑似非法代理服务器的IP地址转移到黑名单中，所述黑名单中包含所述免费网址与非法代理服务器的IP地址之间的对应关系。
可选地，所述处理器还用于监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；将预置时间段内所述流量占比低于第二预置阈值的疑似非法代理服务器的IP地址转移到所述白名单中。
可选地，所述处理器还用于获取域名报文的合法网址；当所述合法网址为免费网址时，从域名服务器发送的域名响应报文中获取与所述合法网址对应的合法服务器的IP地址；将所述合法网址和所述对应的合法服务器的IP地址对应的添加到所述白名单中。
可选地，所述处理器还用于根据针对非法代理的防控策略，处理所述业务报文。
本发明第四方面提供一种识别计费欺诈的非法代理的系统，包括：计费执行功能实体PCEF和域名服务器，
所述PCEF为上述第二方面或第二方面任一可选实现方式所述的核心网设备。
本发明第五方面提供一种识别计费欺诈的非法代理的系统，包括：计费执行功能实体PCEF、可视化设备和域名服务器，
所述可视化设备上述第二方面或第二方面任一可选实现方式所述的核心网设备。
与现有技术中对对计费欺诈的识别效果很差的问题相比，本发明实施例提供的识别计费欺诈的非法代理的系统，可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例中通信系统的一实施例示意图；
图2是本发明实施例中识别计费欺诈的非法代理的系统的一实施例示意图；
图3是本发明实施例中灰、白、黑名单内容转移示意图；
图4是本发明实施例中建立白名单的过程的一实施例示意图；
图5是本发明实施例中建立白名单的过程的另一实施例示意图；
图6是本发明实施例中识别计费欺诈的非法代理的方法的一实施例示意图；
图7是本发明实施例中核心网设备的一实施例示意图；
图8是本发明实施例中核心网设备的另一实施例示意图；
图9是本发明实施例中核心网设备的另一实施例示意图；
图10是本发明实施例中核心网设备的另一实施例示意图；
图11是本发明实施例中核心网设备的另一实施例示意图；
图12是本发明实施例中核心网设备的另一实施例示意图；
图13是本发明实施例中核心网设备的另一实施例示意图。
具体实施方式
本发明实施例提供一种识别计费欺诈的非法代理的方法，可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。本发明实施例还提供了相应的设备及系统。以下分别进行详细说明。
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1为本发明实施例中通信系统的一实施例示意图。
参阅图1，本发明实施例提供的通信系统的一实施例包括：用户设备(User Equipment，UE)、居民接入网(Residential Access Network，RAN)、计费执行功能实体(Policy and Charging Enforcement Function，PCEF)、话单计费设备(Billing)、可视化设备、域名服务器(Domain Name System Server，DNS Server)和业务提供商(Service Provider，SP)所提供的业务服务器。其中，UE上可以安装有帮助用户以欺诈的方式获取免费流量或者优惠流量的客户端。RAN中可以包括基站或者演进基站等无线接入设备。PCEF可以以内置形式嵌入网关GPRS支持节点(Gateway GPRS Support Node，GGSN)或者分组交换网关(Packet Data Network Gateway，PGW)，也可以独立设置PCEF。运营商通过Billing分配流量业务标识，以及用户流量的业务注册信息及计费标识管理，实施在线/离线计费功能。可视化设备可以展示网络的数据情况，供运营商及时了解网络数据。DNS Server可以将域名转换成网络可以识别的IP地址。其中，独立的PCEF、内嵌有PCEF的GGSN/PGW、可视化设备、DNS Server 等都属于核心网设备。
本发明实施例所提供的识别计费欺诈的非法代理的核心网络设备主要包括独立的PCEF、内嵌有PCEF的GGSN/PGW，或者具有识别计费欺诈的非法代理能力的可视化设备。
图2为本发明实施例中识别计费欺诈的非法代理的系统的一实施例示意图。
下面结合图2，说明本发明实施例中依靠独立的PCEF(当然，也可以是内嵌有PCEF的GGSN/PGW)识别计费欺诈的非法代理的过程：
PCEF接收RAN传输过来的用户设备发出的业务报文，该业务报文中携带的目的网址URL和目的服务器的IP地址；例如：目的网址为www.google.com，目的服务器的IP地址为74.125.71.120。
PCEF从业务报文的网络层获取URL，从IP层获取目的服务器的IP地址。
PCEF从预先建立的白名单中查找与所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系。
因为本发明实施例中主要的功能是防止具有流量欺诈功能的代理服务器以欺诈的方式获取免费流量，当然也可以包括优惠流量，所以白名单中的网址都是免费网址或者优惠网址，当PCEF从白名单中查找到www.google.com，则可以确定白名单中与www.google.com网址对应的合法服务器的IP地址，具体过程可以参阅表1进行理解：如表1所示：
表1：白名单
Figure PCTCN2016109060-appb-000001
从表1中可以确定www.google.com所对应的合法服务器的IP地址。
当与所述目的网址URL对应的服务器的IP地址中不包含所述目的服务器的IP地址时，PCEF识别所述目的服务器为疑似非法代理服务器。
从表1中可以确定www.google.com所对应的合法服务器的IP地址中不包含目的服务器的IP地址74.125.71.120。当然，此处是假设表1中www.google.com所对应的IP地址中省略未写出的IP地址中不包括该目的IP地址，则可以确定IP地址为74.125.71.120的服务器为疑似非法代理服务器。考虑到可能会有识别失误，所以不将识别出的代理服务器拉黑，而是 定义为疑似非法代理服务器，通过进一步监控观测再确定疑似非法代理服务器是否为真正的非法代理服务器。
识别出疑似非法代理服务器后，可以通过防控策略，如阻塞、回归收费费率和带宽限制等方式来降低运营商损失。
PCEF识别所述目的服务器为疑似非法代理服务器后，将所述目的服务器的IP地址添加到灰名单中，所述灰名单中包含所述免费网址与所述疑似非法代理服务器的IP地址之间的对应关系。
PCEF会对灰名单中的疑似非法代理服务器进行持续监控，从而进一步定性疑似非法代理服务器。
PCEF监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值，也就是基于疑似非法代理服务器IP的免费流量与总流量的比值；
PCEF将预置时间段内所述流量占比高于第一预置阈值的疑似非法代理服务器的IP地址转移到黑名单中，所述黑名单中包含所述免费网址与非法代理服务器的IP地址之间的对应关系。
将预置时间段内所述流量占比低于第二预置阈值的疑似非法代理服务器的IP地址转移到所述白名单中。
第一预置阈值和第二预置阈值都可以是预先设置的值，第一预置阈值和第二预置阈值可以根据需求动态调整。
PCEF持续监测灰名单中的各IP地址下的流量，记录免费流量/总流量的流量占比，若高于预先配置的黑名单阈值，如90％，也就是第一预置阈值，则将则将流量占比高于90％的IP地址转移到黑名单列表中。若低于预先配置的白名单阈值，如50％，也就是第二预置阈值，则将流量占比低于50％IP地址转移到白名单列表中。
例如：如图3所示，PCEF监控到灰名单中某个IP地址下的流量占比高于第一预置阈值，说明该IP地址对应的疑似非法代理服务器为非法代理服务器，则将该IP地址转移到黑名单中，针对黑名单中的IP地址可以输入计费防欺诈系统进行处理，还可以针对这些IP地址对应的服务器进行追根溯源，追究设置这些非法代理服务器的人员的法律责任。PCEF监控到灰名单中某个IP地址下流量占比低于第二预置阈值，说明该IP地址对应的疑似非法代理服务器为合法的代理服务器，则将该IP地址转移到白名单中。
其中，第一预置阈值和第二预置阈值可以根据需求进行调整，对具体数值不做限定。
本发明实施例中可以存在一个自动黑名单的开关，黑名单可以手工配置，也需支持从灰名单自动转化为黑名单。黑名单需要老化，如果预定时间段内黑名单中所标记的非法代理服务器没有业务报文，则从黑名单中删除该非法代理服务器的IP地址，也就是定时刷新 黑名单，从黑名单中删除已经失效的IP地址。
以上所描述的实施例都可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。
以上所描述的都是对白名单、灰名单和黑名单的使用，下面介绍白名单、灰名单和黑名单的自适应建立过程：
域名服务器中会存储有预先注册的合法网址和合法服务器的IP地址的对应关系。在自学习建立白名单的过程中，初始状态时白名单列表为空，包括免费网址和合法服务器的IP地址两列。
如图4所示，PCEF从Get/POST/Connect等域名报文中获取合法的网址(URL)，然后根据已存在的免费费率组(Rating Group，RG)确认该合法网址是否属于免费网址，免费RG中包含已注册的所有免费网址。当确认该合法网址为免费网址时，则将该合法网址添加到白名单的免费网址列中。当URL为www.google.com时，得到的白名单如表2所示：
表2：白名单
免费(优惠)网址 合法服务器的IP地址
www.google.com  
   
然后，如图5所示，PCEF通过域名响应报文从域名服务器获取www.google.com与合法服务器的IP地址的对应关系，假设获取到的合法服务器的IP地址为74.125.71.104、173.194.64.199、……。则再将对应的IP地址添加到白名单中，得到如表3所示的白名单。
表3：白名单
Figure PCTCN2016109060-appb-000002
这样，重复图4和图5所对应的过程以及表2和表3的添加过程，就可以自动建立白名单。
如果某次请求的URL在免费URL列表中但是对应的IP地址不在IP白名单中，则该IP加入到灰名单。这个过程前面的内容已经有描述，关于灰名单中的内容转移到白名单或者转移到黑名单的过程在前述过程也已经有描述，因此在此处不再重复赘述。
建立黑、白、灰名单后，还可以通知可视化设备判断欺诈的黑白灰名单：
PCEF通知可视化平台每个流是否黑/白/灰名单，源数据中增加一个字段即可。
可视化平台针对灰名单进行统计，基于流量占比和用户占比等找出可疑黑代理。
专业服务通过抓包分析等确认黑代理，把黑名单输入计费防欺诈系统进行处理。
特殊场景下剔除合法服务器IP，部署WAPGW时的IP剔除，正常WAPGW，有免费流量，也有收费流量。通过DNS查询的IP地址与实际目的IP不同，WAPGW IP server进入灰名单，然后判断WAPGW IP的流量占比阈值，对正常WAPGW来说，会有收费流量，因此可以判断是否正常WAPGW。
当用户采用UC、Operamini浏览器访问业务时，用户使用UC浏览有几种情况：
1、不开启云加速，浏览器直接访问ISP；
2、开启云加速，部分业务通过UC的代理服务器进行访问，此时，HOST与IP不同，进入灰名单，通过IP全局流量占比判定。
用户部署了CDN、云端加速等cache类业务，当部署CDN或者云加速，从已有抓包来看，网址就会带有CDN字样，去DNS查询的IP也就是CDN网站的IP。
比如PCEF配置*facebook*免费，用户访问facebook时，携带类似*facebook.CDN.amazon.*的网址(此网址在PCEF可以被识别为免费)，目的IP也就是CDN的IP地址。此时，CDN IP被加入白名单。
对cache类网站，一个IP可以被多个内容使用，若非免费URL使用此IP，在PCEF会被正常计费。
通过可信的DNS报文收集Server IP白名单，识别Proxy代理，避免欺诈产业链通过伪造DNS Server响应报文篡改数据。
本发明实施例中，在配置免费RG列表后，通过在预设时间统计免费流量和总流量占比进行精确定位识别欺诈代理服务器IP，解决了之前运营商不能获取信息的情况。可以根据PCEF自学习的欺诈代理服务器IP在PCEF配置防控动作，如阻塞、回归收费费率、带宽限制等，减低运营商损失。
以上所描述的内容都是以PCEF作为执行主体，或者是以内嵌有PCEF的核心网设备作为执行主体来描述的，实际上，还可以是可视化设备与PCEF配合来完成本发明实施例中的识别计费欺诈的非法代理的过程：
可以是可视化设备建立白名单、灰名单和黑名单，然后PCEF接收到业务报文后，从业务报文中解析出业务报文中携带的目的网址和目的服务器的IP地址，然后PCEF将目的网址和目的服务器的IP地址发送给可视化设备，由可视化设备来识别疑似非法代理服务器，并由可视化设备来进一步监控灰名单疑似非法代理服务器的流量占比，执行灰名单到白名单、灰名单到黑名单之间的内容转移，具体过程和上述PCEF所执行的过程基本相同，此处不再做过多的介绍。
可视化设备还可以根据免费RG，统计免费流量的TOP N Server IP。可视化平台支持配置免费网址列表、可信域名列表，通过DNS学习免费IP白名单。免费流量的TOP Server IP 除去IP白名单后，其余视为灰名单。可视化平台同时统计每个Server IP的免费流量、总流量、免费流量占比，支持根据自定义免费流量阈值、免费流量占比阈值从灰名单中输出疑似欺诈的IP黑名单列表，当然灰名单中的IP，可能是正常Proxy，比如UC浏览器，也可能是欺诈Proxy的IP地址。对于欺诈Proxy，其绝大部分流量都是免费流量，可以从免费流量占比初步判断欺诈IP，对于欺诈Proxy IP，可以进一步钻取欺诈的Top用户。该报表可以进行即时查询、定时任务查询和发送，服务人员可以基于该报表进一步指定黑名单/灰名单IP进行抓包分析，以确定欺诈行为和欺诈手段。
在可视化设备上可以展现PCEF上识别和控制的效果给运营商。
现有技术是通过人工识别、手动配置欺诈代理服务器IP再配置防控动作。与现有技术相比，本实施例引入了新的识别计费欺诈的方式----自动识别欺诈的代理服务器IP，可实现计费欺诈防控的自动化闭环。
可视化设备上可以配置可信DNS服务器的IP地址，可以是运营商提供，也可以在网关上查询DNS配置，配置免费网址URL列表，比如现网facebook为免费，则配置“*.facebook.*”。
初始，IP白名单为空。
源数据中满足以下3个条件：则将DNS TLV中的IP列表保存到IP白名单中；
a、源数据中Server IP是可信DNS服务器IP；
b、协议类型是DNS；
c、DNS TLV中DNS host和免费URL能够匹配；
另外可视化平台可以直接配置IP白名单，以适应网关配置L3/L4层免费规则的场景。
本发明实施例中，通过可信的DNS报文收集Server IP白名单，识别Proxy代理，避免欺诈产业链通过伪造DNS Server响应报文篡改数据。
在配置免费RG列表后，通过分流用户和server IP给定时间统计免费流量和总流量占比进行精确定位识别欺诈代理服务器IP，解决了之前运营商不能获取信息的情况。
可视化平台可指示PCEF自学习的欺诈代理服务器IP列表，并且配置防控动作。
可视化平台在PCEF上采集计费信息的原始诉求并不是来源于计费防欺诈，而是给运营商提供用户访问业务的分布情况，计费防欺诈依赖于原有上报数据，通过可视化平台的处理闭环自学习欺诈代理服务器，最大程度的利用了已有组网和业务层次架构，易于部署。
本实施例引入了新的识别计费欺诈的方式----自动识别欺诈的代理服务器IP，可实现计费欺诈防控的自动化闭环。而且本发明实施例提供的识别计费欺诈的非法代理的系统还具有以下优点：
适用广：不管真实业务数据隐藏在什么位置，都不会影响欺诈服务器IP的判断和识别，适用范围较广。
自动学习：在配置免费业务RG列表后，通过匹配免费RG的欺诈代理服务器的IP地址不 需要手工配置，由设备自学习获得，适应欺诈代理服务器IP动态变化的特点，提升了可维护性。
参阅图6，本发明实施例提供的识别计费欺诈的非法代理的方法的一实施例包括：
101、核心网设备获取业务报文中携带的目的网址URL和目的服务器的IP地址。
102、所述核心网设备从预先建立的白名单中查找与所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系。
103、当与所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，所述核心网设备识别所述目的服务器为疑似非法代理服务器。
本发明实施例提供一种识别计费欺诈的非法代理的方法，可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。
可选地，在上述图6对应的实施例的基础上，本发明实施例提供的识别计费欺诈的非法代理的方法的第一个可选实施例中，所述核心网设备识别所述目的服务器为疑似非法代理服务器之后，所述方法还可以包括：
所述核心网设备将所述目的服务器的IP地址添加到灰名单中，所述灰名单中包含所述免费网址与所述疑似非法代理服务器的IP地址之间的对应关系。
可选地，在上述识别计费欺诈的非法代理的方法的第一个可选实施例的基础上，本发明实施例提供的识别计费欺诈的非法代理的方法的第二个可选实施例中，
所述核心网设备监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
所述核心网设备将预置时间段内所述流量占比高于第一预置阈值的疑似非法代理服务器的IP地址转移到黑名单中，所述黑名单中包含所述免费网址与非法代理服务器的IP地址之间的对应关系。
可选地，在上述识别计费欺诈的非法代理的方法的第一个可选实施例的基础上，本发明实施例提供的识别计费欺诈的非法代理的方法的第三个可选实施例中，
所述核心网设备监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
所述核心网设备将预置时间段内所述流量占比低于第二预置阈值的疑似非法代理服务器的IP地址转移到所述白名单中。
可选地，在上述识别计费欺诈的非法代理的方法的任一实施例的基础上，本发明实施例提供的识别计费欺诈的非法代理的方法的第四个可选实施例中，所述方法还包括
所述核心网设备获取域名报文的合法网址；
当所述合法网址为免费网址时，所述核心网设备从域名服务器发送的域名响应报文中获取与所述合法网址对应的合法服务器的IP地址；
所述核心网设备将所述合法网址和所述对应的合法服务器的IP地址对应的添加到所述白名单中。
可选地，在上述识别计费欺诈的非法代理的方法的任一实施例的基础上，本发明实施例提供的识别计费欺诈的非法代理的方法的第五个可选实施例中，所述核心网设备识别所述目的服务器为疑似非法代理服务器之后，所述方法还可以包括：
所述核心网设备根据针对非法代理的防控策略，处理所述业务报文。
图6对应的实施例或任一可选实施例可以参阅图1至图5部分的描述进行理解，此处不再重复赘述。
参阅图7，本发明实施例提供的核心网设备30的一实施例包括：
获取单元301，用于获取业务报文中携带的目的网址和目的服务器的IP地址；
查找单元302，用于从预先建立的白名单中查找与所述获取单元301获取的所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系；
识别单元303，用于当与所述查找单元302查找到的所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，识别所述目的服务器为疑似非法代理服务器。
本发明实施例中，获取单元301获取业务报文中携带的目的网址和目的服务器的IP地址；查找单元302从预先建立的白名单中查找与所述获取单元301获取的所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系；识别单元303当与所述查找单元302查找到的所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，识别所述目的服务器为疑似非法代理服务器。本发明实施例提供的核心网设备可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。
可选地，在上述图7对应的实施例的基础上，参阅图8，本发明实施例提供的核心网设备30的第一个可选实施例中，所述核心网设备30还包括：
第一添加单元304，用于在所述识别单元303识别所述目的服务器为疑似非法代理服务器之后，将所述目的服务器的IP地址添加到灰名单中，所述灰名单中包含所述免费网址与所述疑似非法代理服务器的IP地址之间的对应关系。
可选地，在上述图8对应的实施例的基础上，参阅图9，本发明实施例提供的核心网设备30的第二个可选实施例中，所述核心网设备30还包括：
第一监控单元305，用于监控所述第一添加单元304添加到所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
第一转移单元306，用于将预置时间段内所述第一监控单元305监控的流量占比高于第一预置阈值的疑似非法代理服务器的IP地址转移到黑名单中，所述黑名单中包含所述免费网址与非法代理服务器的IP地址之间的对应关系。
可选地，在上述图8对应的实施例的基础上，参阅图10，本发明实施例提供的核心网设备30的第三个可选实施例中，所述核心网设备30还包括：
第二监控单元307，用于监控所述第一添加单元304添加到所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
第二转移单元308，用于将预置时间段内所述第二监控单元307监控的流量占比低于第二预置阈值的疑似非法代理服务器的IP地址转移到所述白名单中。
可选地，在上述图7对应的实施例的基础上，参阅图11，本发明实施例提供的核心网设备30的第四个可选实施例中，所述核心网设备还包括：第二添加单元309，
所述获取单元301，还用于获取域名报文的合法网址，当所述合法网址为免费网址时，从域名服务器发送的域名响应报文中获取与所述合法网址对应的合法服务器的IP地址；
所述第二添加单元309，用于将所述获取单元301获取所述合法网址和所述获取单元获取的所述对应的合法服务器的IP地址对应的添加到所述白名单中。
可选地，在上述图7对应的实施例的基础上，参阅图12，本发明实施例提供的核心网设备30的第五个可选实施例中，所述核心网设备30还包括：
处理单元311，用于在所述识别单元303识别出所述目的服务器为疑似非法代理服务器之后，根据针对非法代理的防控策略，处理所述业务报文。
图13是本发明实施例提供的核心网设备30的结构示意图。所述核心网设备30包括处理器310、存储器350和输入/输出I/O设备330，存储器350可以包括只读存储器和随机存取存储器，并向处理器310提供操作指令和数据。存储器350的一部分还可以包括非易失性随机存取存储器(NVRAM)。
在一些实施方式中，存储器350存储了如下的元素，可执行模块或者数据结构，或者他们的子集，或者他们的扩展集:
在本发明实施例中，通过调用存储器350存储的操作指令(该操作指令可存储在操作系统中)，
获取业务报文中携带的目的网址和目的服务器的IP地址；
从预先建立的白名单中查找与所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系；
当与所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，识别所述目的服务器为疑似非法代理服务器。
本发明实施例提供的核心网设备，可以准确的识别用于计费欺诈的非法代理，从而有效的阻断计费欺诈。
处理器310控制核心网设备30的操作，处理器310还可以称为CPU(Central Processing Unit，中央处理单元)。存储器350可以包括只读存储器和随机存取存储器，并向处理器310提供指令和数据。存储器350的一部分还可以包括非易失性随机存取存储器(NVRAM)。具体的应用中核心网设备30的各个组件通过总线系统320耦合在一起，其中总线系统320除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统320。
上述本发明实施例揭示的方法可以应用于处理器310中，或者由处理器310实现。处理器310可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器310中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器310可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现成可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器350，处理器310读取存储器350中的信息，结合其硬件完成上述方法的步骤。
可选地，处理器310还用于将所述目的服务器的IP地址添加到灰名单中，所述灰名单中包含所述免费网址与所述疑似非法代理服务器的IP地址之间的对应关系。
可选地，处理器310还用于：
监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
将预置时间段内所述流量占比高于第一预置阈值的疑似非法代理服务器的IP地址转移到黑名单中，所述黑名单中包含所述免费网址与非法代理服务器的IP地址之间的对应关系。
可选地，处理器310还用于：
监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
将预置时间段内所述流量占比低于第二预置阈值的疑似非法代理服务器的IP地址转移到所述白名单中。
可选地，处理器310还用于：
获取域名报文的合法网址；
当所述合法网址为免费网址时，从域名服务器发送的域名响应报文中获取与所述合法网址对应的合法服务器的IP地址；
将所述合法网址和所述对应的合法服务器的IP地址对应的添加到所述白名单中。
可选地，处理器310还用于根据针对非法代理的防控策略，处理所述业务报文。
以上的核心网设备30可以参阅图1至图6部分的描述进行理解，本处不做过多赘述。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：ROM、RAM、磁盘或光盘等。
以上对本发明实施例所提供的识别计费欺诈的非法代理的方法、设备以及系统进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (14)

  1. 一种识别计费欺诈的非法代理的方法，其特征在于，包括：
    核心网设备获取业务报文中携带的目的网址URL和目的服务器的IP地址；
    所述核心网设备从预先建立的白名单中查找与所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系；
    当与所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，所述核心网设备识别所述目的服务器为疑似非法代理服务器。
  2. 根据权利要求1所述的方法，其特征在于，所述核心网设备识别所述目的服务器为疑似非法代理服务器之后，所述方法还包括：
    所述核心网设备将所述目的服务器的IP地址添加到灰名单中，所述灰名单中包含所述免费网址与所述疑似非法代理服务器的IP地址之间的对应关系。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    所述核心网设备监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
    所述核心网设备将预置时间段内所述流量占比高于第一预置阈值的疑似非法代理服务器的IP地址转移到黑名单中，所述黑名单中包含所述免费网址与非法代理服务器的IP地址之间的对应关系。
  4. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    所述核心网设备监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
    所述核心网设备将预置时间段内所述流量占比低于第二预置阈值的疑似非法代理服务器的IP地址转移到所述白名单中。
  5. 根据权利要求1-4任一所述的方法，其特征在于，所述方法还包括
    所述核心网设备获取域名报文的合法网址；
    当所述合法网址为免费网址时，所述核心网设备从域名服务器发送的域名响应报文中获取与所述合法网址对应的合法服务器的IP地址；
    所述核心网设备将所述合法网址和所述对应的合法服务器的IP地址对应的添加到所述白名单中。
  6. 根据权利要求1-4任一所述的方法，其特征在于，所述核心网设备识别所述目的服务器为疑似非法代理服务器之后，所述方法还包括：
    所述核心网设备根据针对非法代理的防控策略，处理所述业务报文。
  7. 一种核心网设备，其特征在于，包括：
    获取单元，用于获取业务报文中携带的目的网址URL和目的服务器的IP地址；
    查找单元，用于从预先建立的白名单中查找与所述获取单元获取的所述目的网址对应的服务器的IP地址，所述白名单中包含免费网址与合法服务器的IP地址的对应关系；
    识别单元，用于当与所述查找单元查找到的所述目的网址对应的服务器的IP地址中不包含所述目的服务器的IP地址时，识别所述目的服务器为疑似非法代理服务器。
  8. 根据权利要求7所述的核心网设备，其特征在于，所述核心网设备还包括：
    第一添加单元，用于在所述识别单元识别所述目的服务器为疑似非法代理服务器之后，将所述目的服务器的IP地址添加到灰名单中，所述灰名单中包含所述免费网址与所述疑似非法代理服务器的IP地址之间的对应关系。
  9. 根据权利要求8所述的核心网设备，其特征在于，所述核心网设备还包括：
    第一监控单元，用于监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
    第一转移单元，用于将预置时间段内所述第一监控单元监控的流量占比高于第一预置阈值的疑似非法代理服务器的IP地址转移到黑名单中，所述黑名单中包含所述免费网址与非法代理服务器的IP地址之间的对应关系。
  10. 根据权利要求8所述的核心网设备，其特征在于，所述核心网设备还包括：
    第二监控单元，用于监控所述灰名单中的疑似非法代理服务器的流量占比，所述流量占比为所述疑似非法代理服务器上免费流量与总流量的比值；
    第二转移单元，用于将预置时间段内所述第二监控单元监控的流量占比低于第二预置阈值的疑似非法代理服务器的IP地址转移到所述白名单中。
  11. 根据权利要求7-10任一所述的核心网设备，其特征在于，所述核心网设备还包括：第二添加单元，
    所述获取单元，还用于获取域名报文的合法网址，当所述合法网址为免费网址时，从域名服务器发送的域名响应报文中获取与所述合法网址对应的合法服务器的IP地址；
    所述第二添加单元，用于将所述获取单元获取所述合法网址和所述获取单元获取的所述对应的合法服务器的IP地址对应的添加到所述白名单中。
  12. 根据权利要求7-10任一所述的核心网设备，其特征在于，所述核心网设备还包括：
    处理单元，用于在所述识别单元识别出所述目的服务器为疑似非法代理服务器之后，根据针对非法代理的防控策略，处理所述业务报文。
  13. 一种识别计费欺诈的非法代理的系统，其特征在于，包括：计费执行功能实体PCEF和域名服务器，
    所述PCEF为上述权利要求7-12任一所述的核心网设备。
  14. 一种识别计费欺诈的非法代理的系统，其特征在于，包括：计费执行功能实体PCEF、可视化设备和域名服务器，
    所述可视化设备上述权利要求7-12任一所述的核心网设备。
PCT/CN2016/109060 2015-12-22 2016-12-08 一种识别计费欺诈的非法代理的方法、设备及系统 WO2017107780A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510969780.5A CN105516165B (zh) 2015-12-22 2015-12-22 一种识别计费欺诈的非法代理的方法、设备及系统
CN201510969780.5 2015-12-22

Publications (1)

Publication Number Publication Date
WO2017107780A1 true WO2017107780A1 (zh) 2017-06-29

Family

ID=55723801

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/109060 WO2017107780A1 (zh) 2015-12-22 2016-12-08 一种识别计费欺诈的非法代理的方法、设备及系统

Country Status (2)

Country Link
CN (1) CN105516165B (zh)
WO (1) WO2017107780A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108347443A (zh) * 2018-02-11 2018-07-31 中国联合网络通信集团有限公司 恶意免流量服务器的发现方法和系统
CN111814643A (zh) * 2020-06-30 2020-10-23 杭州科度科技有限公司 黑灰url识别方法、装置、电子设备及介质
CN114091014A (zh) * 2021-10-29 2022-02-25 珠海大横琴科技发展有限公司 一种数据处理的方法和装置
CN115002203A (zh) * 2021-03-02 2022-09-02 京东科技信息技术有限公司 数据包抓取方法、装置、设备及计算机可读介质

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105516165B (zh) * 2015-12-22 2019-05-28 华为技术有限公司 一种识别计费欺诈的非法代理的方法、设备及系统
CN108337652B (zh) * 2017-01-20 2020-12-01 中国移动通信集团河南有限公司 一种检测流量欺诈的方法及装置
CN108809891B (zh) * 2017-04-27 2019-12-20 贵州白山云科技股份有限公司 一种服务器入侵检测方法和装置
CN108933867B (zh) * 2017-05-27 2021-04-13 中国移动通信集团公司 一种防控信息诈骗的方法及其装置、设备、存储介质
CN109525682B (zh) * 2017-09-19 2021-08-06 中国移动通信有限公司研究院 业务处理方法、装置、网元实体及计算机可读存储介质
CN107809752B (zh) * 2017-10-16 2020-08-21 南京网元通信技术有限公司 一种基于软件仿真的移动网流量欺诈验证方法
CN107896232B (zh) * 2017-12-27 2020-04-03 北京奇艺世纪科技有限公司 一种ip地址评估方法及装置
CN109996201B (zh) * 2018-01-02 2021-01-15 中国移动通信有限公司研究院 一种网络访问方法及网络设备
CN110198248B (zh) * 2018-02-26 2022-04-26 北京京东尚科信息技术有限公司 检测ip地址的方法和装置
CN108846096B (zh) * 2018-06-15 2021-04-13 中国联合网络通信集团有限公司 网页的提示方法、终端、网关设备及用户边缘设备
CN111294311B (zh) * 2018-12-06 2022-05-13 中国移动通信集团河南有限公司 一种防止流量欺诈的流量计费方法及系统
CN109831461B (zh) * 2019-03-29 2021-10-26 新华三信息安全技术有限公司 一种分布式拒绝服务DDoS攻击防御方法及装置
CN112256308A (zh) * 2020-11-12 2021-01-22 腾讯科技（深圳）有限公司 一种目标应用更新方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101795272A (zh) * 2010-01-22 2010-08-04 联想网御科技(北京)有限公司 非法网站过滤方法及装置
CN102891794A (zh) * 2011-07-22 2013-01-23 华为技术有限公司 一种数据包传输控制的方法及网关
CN103139205A (zh) * 2013-01-30 2013-06-05 华为技术有限公司 报文处理方法、装置及网络服务器
CN103220296A (zh) * 2013-04-26 2013-07-24 腾讯科技（深圳）有限公司 一种数据交互的方法、设备及系统
CN105516165A (zh) * 2015-12-22 2016-04-20 华为技术有限公司 一种识别计费欺诈的非法代理的方法、设备及系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102130791B (zh) * 2010-01-14 2013-02-13 深圳市深信服电子科技有限公司 一种在网关上检测代理的方法、装置及网关服务器
WO2013167178A1 (en) * 2012-05-09 2013-11-14 Telefonaktiebolaget L M Ericsson (Publ) Handling communication sessions in a communications network
CN104486091A (zh) * 2014-12-05 2015-04-01 中国联合网络通信集团有限公司 一种计费方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101795272A (zh) * 2010-01-22 2010-08-04 联想网御科技(北京)有限公司 非法网站过滤方法及装置
CN102891794A (zh) * 2011-07-22 2013-01-23 华为技术有限公司 一种数据包传输控制的方法及网关
CN103139205A (zh) * 2013-01-30 2013-06-05 华为技术有限公司 报文处理方法、装置及网络服务器
CN103220296A (zh) * 2013-04-26 2013-07-24 腾讯科技（深圳）有限公司 一种数据交互的方法、设备及系统
CN105516165A (zh) * 2015-12-22 2016-04-20 华为技术有限公司 一种识别计费欺诈的非法代理的方法、设备及系统

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108347443A (zh) * 2018-02-11 2018-07-31 中国联合网络通信集团有限公司 恶意免流量服务器的发现方法和系统
CN108347443B (zh) * 2018-02-11 2021-02-02 中国联合网络通信集团有限公司 恶意免流量服务器的发现方法和系统
CN111814643A (zh) * 2020-06-30 2020-10-23 杭州科度科技有限公司 黑灰url识别方法、装置、电子设备及介质
CN115002203A (zh) * 2021-03-02 2022-09-02 京东科技信息技术有限公司 数据包抓取方法、装置、设备及计算机可读介质
CN114091014A (zh) * 2021-10-29 2022-02-25 珠海大横琴科技发展有限公司 一种数据处理的方法和装置

Also Published As

Publication number Publication date
CN105516165B (zh) 2019-05-28
CN105516165A (zh) 2016-04-20

Similar Documents

Publication Publication Date Title
WO2017107780A1 (zh) 一种识别计费欺诈的非法代理的方法、设备及系统
US11997111B1 (en) Attribute-controlled malware detection
US11863581B1 (en) Subscription-based malware detection
KR101662605B1 (ko) 모바일 네트워크 환경에서 네트워크 정보를 가입자 정보와 상관시키는 시스템 및 방법
US9755919B2 (en) Traffic analysis for HTTP user agent based device category mapping
CN107241186B (zh) 网络设备和用于网络通信的方法
Li et al. A large-scale analysis of deployed traffic differentiation practices
US20190173904A1 (en) Entity Group Behavior Profiling
WO2018121331A1 (zh) 攻击请求的确定方法、装置及服务器
US20170134957A1 (en) System and method for correlating network information with subscriber information in a mobile network environment
US20190028508A1 (en) Gateway apparatus, detecting method of malicious domain and hacked host thereof, and non-transitory computer readable medium
US10257213B2 (en) Extraction criterion determination method, communication monitoring system, extraction criterion determination apparatus and extraction criterion determination program
WO2016025081A1 (en) Collaborative and adaptive threat intelligence for computer security
WO2014000303A1 (zh) 一种报文接收方法、深度包检测设备及系统
JP2019522920A (ja) ボットマスター発見システムおよび方法
CN108322354B (zh) 一种偷跑流量账户识别方法及装置
CN106411819A (zh) 一种识别代理互联网协议地址的方法及装置
US11394687B2 (en) Fully qualified domain name (FQDN) determination
US20230254281A1 (en) Local network device connection control
CN109995731B (zh) 提高缓存吐出流量的方法、装置、计算设备及存储介质
Heuer et al. Recognizing Time-Efficiently Local Botnet Infections-A Case Study
Ghanti et al. Efficient data transfer rate and speed of secured ethernet interface system
CN117278253A (zh) 一种基于dns进程特征和流量特征的恶意软件检测装置及方法
CN114154149A (zh) 一种恶意软件处理方法、装置、计算设备和存储介质
WO2021130573A1 (en) Human activity detection

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16877591

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16877591

Country of ref document: EP

Kind code of ref document: A1