WO2021033851A1

WO2021033851A1 - Fraudulent call detection system based on machine learning and control method thereof

Info

Publication number: WO2021033851A1
Application number: PCT/KR2019/017932
Authority: WO
Inventors: 김종주
Original assignee: 주식회사 지니테크
Priority date: 2019-08-22
Filing date: 2019-12-18
Publication date: 2021-02-25
Also published as: KR20210023284A; KR102228021B1; CN112567720A

Abstract

Disclosed are a fraudulent call detection system based on machine learning and a control method thereof. The control method of the fraudulent call detection system of the present invention comprises the steps of: extracting or receiving pre-stored call processing data to perform normalization processing so as to have the same length according to a preset algorithm for each field; determining each parameter of an artificial intelligence system by performing machine learning utilizing the data normalized in the previous step as an input value; and determining a fraud call by applying at least one of real-time call connection data and call detail record (CDR) data to the artificial intelligence system.

Description

Illegal call detection system and control method based on machine learning

The present invention relates to an illegal call detection system and a control method thereof, and more particularly, to an illegal call detection system and a control method based on machine learning.

Recently, an increasing number of individuals or businesses are sending calls for malicious purposes through landline telephones or Internet telephones, and thereby taking illegal gains.

For example, by making a call from overseas to make the bell ring, and then terminating the call connection within a short period of time, induces the called party to make a call abroad in the reverse direction, and thus unfairly obtains a network connection fee. .

As such illegal calls cause various problems, telecommunication companies have been searching for various ways to detect such illegal calls.

However, in the past, illegal call detection has been performed based on rules set by administrators based on the illegal call pattern. In this case, even if the illegal call pattern changes slightly (for example, even if the caller country and area code changes). There is a problem that cannot be done.

Therefore, even if the illegal call pattern is changed, it is desired to propose a method for easily detecting it.

(Prior Patent Document 1) Korean Patent Publication No. 10-2011-0079044

The present invention has been devised to solve the above-described problems in the related art, and an object thereof is to provide a system and a control method for adaptively detecting illegal calls even if the illegal call pattern is changed.

In order to achieve the above object, the illegal call detection system according to the present invention includes: a data normalization processing unit for extracting or receiving pre-stored call processing data and performing normalization processing to have the same length according to a preset algorithm for each field; A machine learning processing unit that determines each parameter of an artificial intelligence system by performing machine learning using the data normalized by the data normalization processing unit as an input value; And a determination unit for determining an illegal call by applying at least one of real-time call connection data and call detail record (CDR) data to the artificial intelligence system.

In addition, in order to achieve the above object, the control method of the illegal call detection system according to the present invention includes the steps of extracting or receiving pre-stored call processing data and performing normalization processing to have the same length according to a preset algorithm for each field; ; Determining each parameter of the artificial intelligence system by performing machine learning using the normalized data as an input value; And determining an illegal call by applying at least one of real-time call connection data and CDR data to the artificial intelligence system.

1 is a schematic configuration diagram of an entire system including an illegal call detection system according to an embodiment of the present invention,

2 is a functional block diagram of the illegal call detection system of FIG. 1;

3 is a diagram showing an example of data that can be obtained in real time for an Internet call,

4 is a diagram showing an example of data in which statistical data generated by an illegal call detection system according to an embodiment of the present invention is additionally reflected in the data of FIG. 3;

5 is a diagram showing an example of data obtainable from a CDR stored as a result of a call through a PSTN,

6 is a view showing an example of data in which statistical data generated by an illegal call detection system according to an embodiment of the present invention is additionally reflected in the data of FIG. 5;

7 is a diagram showing a CNN processing structure,

8 is a diagram illustrating a process of accumulating and storing data that can be obtained in real time for Internet calls and performing machine learning based on the accumulated data.

9 is a diagram illustrating a process in which necessary data is accumulated and stored in CDR data stored after a PSTN call is made, and machine learning is performed based on the accumulated data.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

Hereinafter, each embodiment according to the present invention is only one example for aiding understanding of the present invention, and the present invention is not limited to these embodiments. In particular, the present invention may be configured with a combination of at least one or more of individual configurations, individual functions, or individual steps included in each embodiment.

In particular, for convenience, some claims in the claims include alphabets such as'(a)', but these alphabets do not prescribe the order of each step.

In addition, each signal mentioned in each embodiment according to the present invention may mean one signal transmitted by one connection or the like, but may also mean a series of signal groups transmitted for the purpose of performing a specific function to be described later. . That is, in each embodiment, a plurality of signals transmitted at a predetermined time interval or transmitted after receiving a response signal from a counterpart device may be expressed as one signal name for convenience.

A schematic configuration of an entire system including an illegal call detection system according to an embodiment of the present invention is as shown in FIG. 1.

In the figure, the calling terminal is a terminal that makes a call to the other party, and the called terminal is a terminal that receives a call from the other party.

As such, there is a call processing system in the middle of the communication path between the calling terminal and the called terminal, and the function of the call processing system receives a call connection request from the calling terminal and performs verification processing and call connection processing to the called terminal. Furthermore, it performs a function of managing call connection between the calling terminal and the called terminal and information related to the call, that is, call processing data.

As described above, the process of storing origination, destination, call connection, and call processing data between the calling terminal, the called terminal, and the call processing system corresponds to a known technology, and thus a detailed description thereof will be omitted.

Meanwhile, the illegal call detection system communicates with the above-described call processing system to determine whether the call is illegal for each call after a call connection time point or a preset time elapses after the call connection is established.

In particular, for real-time illegal call detection, a device for packet mirroring or port mirroring between the call processing system and the illegal call detection system may be further provided. This also corresponds to a known technique, and thus a detailed description thereof will be omitted.

2 illustrates an example of a specific functional block of the illegal call detection system.

As shown in the figure, the illegal call detection system may include a data normalization processing unit, a machine learning processing unit, and a determination unit.

The data normalization processing unit performs a function of extracting or receiving previously stored call processing data and performing normalization processing to have the same length according to a preset algorithm for each field.

Here, the call processing data may be real-time data at the time when a call connection occurs, or may be a kind of call detail record (CDR) data stored after the call is terminated. The data normalization processing unit may extract the call processing data if it is stored itself, or may receive it from the external server 200.

In particular, the data normalization processing unit normalizes the call processing data for each field. For example, the normalization size for the outgoing telephone field is 15 digits, and the outgoing telephone number included in the call processing data is '010-5555-1111'. In the case of, it can be made into a form such as '000001055551111' by inserting an additional '0' to match 15 digits.

In particular, the data normalization processing unit does not normalize only the extracted/received call processing data, but generates predetermined statistical data based on the extracted/received call processing data, and then performs normalization processing on the generated statistical data. I can.

For example, the data normalization processing unit uses the extracted/received call processing data to use call time data for each call, 1 minute cumulative number of calls by calling number, 5 minutes cumulative number of calls by calling number, 60 minutes by calling number. Cumulative number of calls, cumulative sum of call time for 5 minutes for each calling number, 60 minutes cumulative sum of call time for each calling number, 1 minute cumulative number of calls for each called number, 5 minutes cumulative number of calls for each called number, 60 minutes cumulative call for each called number After extracting statistical data including the number of times, the cumulative sum of call time for 5 minutes for each called number, and the cumulative sum of call time for 60 minutes for each called number, normalization processing for the corresponding statistical data can be additionally performed.

3 to 6 illustrate examples of data processed by the data normalization processing unit.

First, FIGS. 3 and 4 show a case in which real-time call connection data can be obtained, such as an Internet phone, and FIGS. 5 and 6 show real-time call connection data as shown in (PSTN: Public Switched Telephone Network). It shows a case that cannot be obtained.

Specifically, FIG. 3 is call processing data that can be obtained in real time in the case of an Internet phone using a session initiation protocol (SIP), and FIG. 4 is a predetermined statistical data described above based on such call processing data. Indicates the added state.

In addition, FIG. 5 is an example of CDR data stored according to communication through the PSTN, and FIG. 6 shows a state in which predetermined statistical data described above is added based on the CDR data.

The machine learning processing unit determines and reflects each parameter of the artificial intelligence system by performing machine learning using the data normalized by the data normalization processing unit as an input value.

In other words, in the case of an artificial intelligence system, especially deep learning, which is a kind of machine learning, the result may vary depending on the parameter value of each layer constituting the neural network, and the machine learning processing unit determines the parameter value of each layer through machine learning. It performs the function of reflecting in the corresponding artificial intelligence system. Since the process of machine learning corresponds to the process of calculating parameter values (for example, matrix values) in each layer of the artificial intelligence system as described above, a more detailed description thereof will be omitted.

In this case, the machine learning processing unit may perform machine learning using all normalized data generated by the data normalization processing unit. In particular, the machine learning may also be performed by including normalized data based on the statistical data described above.

The machine learning processing unit performs a unique function in processing machine learning, that is, after forming the data normalized by the data normalization processing unit into 1D image data, CNN (Convolutional Neural Network) for the corresponding 1D image data By performing machine learning, each parameter of the CNN can be determined and reflected.

For the process of forming a one-dimensional image, when some of the data in Fig. 3(b) is used as an example, the data normalization processing unit is a calling IP (CALLER_IP), a called IP (CALLEE_IP), and one minute of the calling IP. If the cumulative number of calls (EXT_CALL_COUNT_1MIN) and the cumulative number of calls for 5 minutes of the outgoing IP (EXT_CALL_COUNT_5MIN) are '121.111.0.1', '212.0.0.112', '4', and '15', respectively, the normalized data is set to '15'. After creating 121111000001', '212000000112', '004', and '015', the data '121111000001212000000112004015' is created by attaching the normalized data in a row, and this is converted into one-dimensional image data.

Here, the one-dimensional image refers to an image in which pixels are connected to each other in only one direction (for example, in a horizontal direction) and pixels are not connected in the other direction (for example, in a vertical direction).

In this way, the machine learning processing unit that has performed the one-dimensional imaging process determines and reflects each parameter of the CNN by performing machine learning using the CNN.

A process of processing a 1-dimensional image having n pixels by applying it to the CNN algorithm is shown in FIG. 5.

Referring to FIG. 7, the configuration of a neural network that is an AI (artificial intelligence) model is an input, a layer, a prediction result, an actual value, a loss function, and an optimizer. ), where input means inputting data encoded in a normalized manner for real-time data and CDR data described above.

In addition, a layer is a layer that composes a neural network, and can be modeled to optimize the Layer 1 Dimension CNN algorithm to suit real-time data processing and CDR data processing.

The loss function is an important component that defines the feedback signal to be used for learning, and according to the deep learning guideline, binary crossentropy for two class classifications, and categorical crossentropy for multiple class classifications. ), in the case of regression, a mean square error, in the case of a sequence, CTC (connection Temporl Classification) is applied, and since multiple classes exist, categorical crossentropy may be applied.

The optimizer is a component that determines how to proceed with learning, and determines the weight update of the neural network based on the loss function, and may be applied to the stochastic gradient decent (SGD) method.

As described above, the normalized data is composed of a one-dimensional image array to enable CNN modeling, and an optimal value for the layer parameter can be derived by machine learning through repetitive convolution operations on the image.

When the configuration as shown in FIG. 7 is made, the process in which machine learning is performed according to the CNN algorithm itself corresponds to a known technique, and thus a more detailed description thereof will be omitted.

Meanwhile, the determination unit applies at least one of real-time call connection data and CDR data to the artificial intelligence system to determine an illegal call.

That is, as described above, after each parameter of the artificial intelligence system is determined by machine learning, the determination unit transmits real-time call connection data or CDR data as an input value to the artificial intelligence system to determine whether or not there is an illegal call.

In particular, the determination unit can classify and process the processing according to the call connection method. If the call connection is through the Internet, it extracts real-time call connection data and applies the call connection data to the artificial intelligence system to determine illegal calls. If the call connection is through a public switched telephone network (PSTN), the CDR information stored after the call connection is terminated can be applied to the artificial intelligence system to determine an illegal call.

As described above, the overall processing method according to the call connection method is illustrated in FIGS. 8 and 9.

8 shows a processing procedure when a SIP call is generated through the Internet.

Referring to the figure, when a packet transmitted/received to the call processing system is received through packet mirroring, the illegal call detection system extracts real-time call-related information from the real-time extraction module of the real-time data extraction block and delivers it to the AI detection block. In the AI detection block, this is applied to a pre-built AI model (i.e., corresponding to the artificial intelligence system in which the above-described parameters are determined and reflected) to detect illegal calls and additionally perform machine learning processing on the real-time data. .

The additional progress of this machine learning process means updating the parameters of the artificial intelligence system, and accordingly, tracking management is possible even when the illegal call pattern is changed.

9 shows a processing procedure when a call is generated through the PSTN.

Referring to the figure, the CDR collection block of the illegal call detection system periodically collects and stores CDR data accumulated after the PSTN call is generated, and transmits it to the AI detection block.The AI detection block stores these CDR data. In addition to detecting illegal calls by applying it to the model, machine learning processing for the corresponding CDR data is additionally performed.

Meanwhile, it goes without saying that the process of performing each of the above-described embodiments may be performed by a program or application stored in a predetermined recording medium (eg, computer-readable). Here, the recording medium includes all of an electronic recording medium such as a random access memory (RAM), a magnetic recording medium such as a hard disk, and an optical recording medium such as a compact disk (CD).

At this time, the program stored in the recording medium may be executed on hardware such as a computer or a smart phone to perform each of the above-described embodiments. In particular, at least one of the functional blocks of the illegal call detection system according to the present invention described above may be implemented by such a program or application.

In addition, the present invention is not limited to the specific embodiments described above, but can be implemented by various modifications and modifications without departing from the gist of the present invention. It will be apparent that such modifications and modifications are included in the present invention if they fall within the appended claims.

As described above, according to the present invention, not only can the accuracy of illegal call detection be improved, but also the illegal call pattern can be detected even when the illegal call pattern changes as automation is performed through machine learning about the illegal call pattern.

Claims

(a) extracting or receiving previously stored call processing data and performing normalization processing to have the same length according to a preset algorithm for each field;

(b) determining each parameter of the artificial intelligence system by performing machine learning using the data normalized in step (a) as an input value;

(c) applying at least one of real-time call connection data and call detail record (CDR) data to the artificial intelligence system to determine an illegal call.
The method of claim 1,

In step (a), using the call processing data, call time data for each call, cumulative number of calls for 1 minute for each calling number, 5 minutes cumulative number of calls for each calling number, and 60 minutes cumulative number of calls for each calling number, Cumulative sum of call time for 5 minutes for each calling number, 60 minutes of call time for each calling number, 1 minute cumulative number of calls for each called number, 5 minutes cumulative number of calls for each called number, 60 minutes cumulative number of calls for each called number, called number After extracting statistical data including the cumulative sum of call time for 5 minutes per star and the cumulative sum of call time for 60 minutes for each called party number, normalization processing is additionally performed on the statistical data,

The control method of the illegal call detection system, characterized in that in step (b), machine learning is performed including normalized data on the statistical data.
The method of claim 2,

In the step (b), after forming the normalized data in step (a) as one-dimensional image data, machine learning is performed on the corresponding one-dimensional image data using a convolutional neural network (CNN) to each of the CNNs. A control method of an illegal call detection system, characterized in that determining a parameter.
The method of claim 1,

In step (c), when the call connection is through the Internet, real-time call connection data is extracted, and the call connection data is applied to the artificial intelligence system to determine an illegal call, and the call connection is a public telephone network (PSTN: In the case of a connection through a Public Switched Telephone Network), an illegal call detection system control method, characterized in that the CDR information stored after the call connection is terminated is applied to the artificial intelligence system to determine an illegal call.
A computer-readable recording medium on which a program for executing the method of any one of claims 1 to 4 is recorded.
An application program stored in a computer-readable recording medium to execute the method of any one of claims 1 to 4 in combination with hardware.
A data normalization processing unit that extracts or receives the previously stored call processing data and performs normalization processing to have the same length according to a preset algorithm for each field;

A machine learning processing unit that determines each parameter of an artificial intelligence system by performing machine learning using the data normalized by the data normalization processing unit as an input value;

And a determination unit for determining an illegal call by applying at least one of real-time call connection data and call detail record (CDR) data to the artificial intelligence system.
The method of claim 7,

The data normalization processing unit uses the call processing data to call time data for each call, the cumulative number of calls for 1 minute for each calling number, the cumulative number of calls for 5 minutes for each calling number, and the number of calls for 60 minutes for each calling number. Cumulative sum of call time for 5 minutes per number, cumulative sum of call time for 60 minutes for each calling number, 1 minute cumulative number of calls for each called number, 5 minutes cumulative number of calls for each called number, 60 minutes cumulative number of calls for each called number, each called number After extracting statistical data including the cumulative sum of call time for 5 minutes and the cumulative sum of call time for 60 minutes for each called party number, normalization processing is additionally performed on the statistical data,

And the machine learning processing unit performs machine learning including normalized data on the statistical data.
The method of claim 8,

The machine learning processing unit forms the data normalized by the data normalization processing unit into 1D image data, and then performs machine learning using a convolutional neural network (CNN) on the corresponding 1D image data to each parameter of the CNN. Illegal call detection system, characterized in that to determine the.
The method of claim 7,

When the call connection is through the Internet, the determination unit extracts real-time call connection data and applies the call connection data to the artificial intelligence system to determine an illegal call, and the call connection is a public switched telephone network (PSTN). Network), the illegal call detection system, characterized in that the illegal call is determined by applying the CDR information stored after the call connection is terminated to the artificial intelligence system.