WO2023085491A1

WO2023085491A1 - Method and apparatus for determining malicious spam call based on artificial intelligence

Info

Publication number: WO2023085491A1
Application number: PCT/KR2021/017478
Authority: WO
Inventors: 강필상; 김지훈
Original assignee: 강필상
Priority date: 2021-11-10
Filing date: 2021-11-25
Publication date: 2023-05-19
Also published as: KR102558735B1; KR20230067903A

Abstract

A method for determining a malicious spam call based on artificial intelligence, according to an embodiment of the present invention, comprises the steps of: a collection unit collecting a sender's number and a receiver's number for spam determination; a phone control unit checking, via a user terminal, whether or not a user has taken a call made to the user; the phone control unit collecting a duration via the collection unit by setting a duration to 0 if having not taken the call and setting the duration to a call time if having taken the call; a training unit training an artificial intelligence learning-based spam determination model by using the collected sender's number, receiver's number, and duration as feature values; and a spam determination unit determining whether or not being spam, on the basis of a threshold value calculated by the training.

Description

Artificial intelligence-based malicious spam phone detection method and device

The present invention relates to a method and device for identifying malicious spam calls, and more particularly, to a method and device for identifying malicious spam calls based on artificial intelligence for determining spam through learning of a spam discrimination model.

Based on the current law, the Promotion of Information and Communications Network Utilization and Information Protection, etc., the Korea Internet & Security Agency prohibits advertising information for commercial purposes that is transmitted unilaterally through cell phones or landlines even though the recipient did not want it as spam. However, the amount of advertising spam is increasing every year.

Spam, that is, a method of sending product information through text messages or phone calls targeting mobile phones, is widely used as a means of advertising because it is cost-effective.

According to the prior art for preventing such spam calls, Korea Patent Publication No. 10-2009-91443 discloses a device and method for preventing spam calls, a list method of comparing in a database and the results thereof to the user. The main feature is a control unit that connects or blocks to, and Korea Patent Publication No. 10-2016-22154 discloses a spam suspected phone guidance device and a spam suspected phone guidance method based on call volume analysis. The index is evaluated, and the unit is analyzed by the number of outgoing calls and outgoing messages during a day, week, or month.

In this way, the prior art is made in a way to block numbers not included here by providing a white list, and once set in the spam list, it is permanently set in the black list, and normal phone numbers are misidentified and processed as spam. In the case of determining on a daily, weekly, or monthly basis, real-time data analysis was not performed, resulting in inaccurate spam judgment and processing.

Therefore, in order to solve the above-mentioned problem, spam discrimination is made by real-time data analysis, and an artificial intelligence-based malicious spam phone discrimination method that can increase spam discrimination accuracy through artificial intelligence-based learning on the number of abnormal outgoing calls and call duration is proposed. research became necessary.

An object of the present invention is an artificial intelligence-based malicious spam call identification method and an artificial intelligence-based malicious spam call detection method that can increase spam identification accuracy through artificial intelligence-based learning on the number of abnormal outgoing calls and call duration by real-time data analysis. It is to provide a spam call discrimination device.

A method for identifying malicious spam calls based on artificial intelligence according to an embodiment of the present invention includes the steps of collecting, by a collecting unit, a caller's number and a recipient's number for determining spam; Step, by the telephone control unit, checking whether the user has received a call received from the user through the user terminal; setting the duration time to 0 when the call is not received by the telephone control unit and collecting the duration time through the collecting unit by setting the duration time to call time when the call is received; In the artificial intelligence learning-based spam discrimination model, the learning unit performs learning using the collected caller ID, recipient ID, and duration as feature values; The spam determination unit includes a step of determining whether spam is present based on the threshold value calculated by the learning.

determining whether or not a registered spam number is pre-stored in a database by checking an incoming call when the phone control unit receives a call; If the phone control unit is a registered spam number, automatically determining it as a malicious spam number and sending a notification to the user after blocking; The telephone control unit may further include collecting the calling party number and the called party number by requesting the collecting unit when the number is not a registered spam number.

The spam discrimination model is characterized in that spam or not is determined based on the learning result of the learning unit and an outlier (threshold), but learning can be performed using CNN (Convolutional Neural Networks) for normal data.

The spam discrimination model is characterized by using a discriminator of a generative adversarial network (GAN) algorithm when discriminating whether spam is present using a threshold value obtained through CNN.

The discriminator is characterized in that it discriminates real data (normal data) and fake data generated by the generator (abnormal data as training data for discriminating spam).

The spam discrimination model is divided into a malicious index evaluation model that can determine spam based on call time and a malicious situation evaluation model that detects outliers by identifying call volume characteristics for duration and gives a warning to the recipient, and learns and discriminates them. It is characterized in that this is made.

The malicious situation evaluation model is a model for detecting the call volume characteristics of calls determined to be malicious when a call determined by the malicious index evaluation model cannot be blocked or received, and gives a warning to the recipient after detecting a threshold value. It is characterized in that it is used as a supplement to the evaluation model.

The learning DB of the malicious index evaluation model can be an open source-based non-relational database for storing and managing unstructured data with a key-value structure, and by using key-value, TTL when key is input By giving a (time to live) value, resetting whether a number is spam or not registering spam according to a certain period, it is characterized by reducing the consumption of resources that need to be managed by human resources and enabling automatic spam management. do.

The method for identifying malicious spam calls based on artificial intelligence may be performed by a computer program stored in a computer-readable recording medium.

An artificial intelligence-based malicious spam call detection device performing the artificial intelligence-based malicious spam call detection method, wherein the artificial intelligence-based malicious spam call detection device includes a memory for storing one or more instructions; and a processor executing the one or more instructions stored in the memory, wherein the processor executes the one or more instructions to perform the artificial intelligence-based malicious spam call identification method.

The artificial intelligence-based malicious spam call discrimination device may control a call received from a user terminal, and may include: a phone control unit that automatically determines whether to receive or reject a call according to a result of spam discrimination; a collection unit that collects data on the recipient's number, caller's number, and duration (call time) to be used as learning data; A learning unit that performs learning of a spam discrimination model based on the collected data; Spam discrimination unit for determining whether or not the incoming call is spam based on the threshold value obtained as a result of learning; Spam notification unit for sending a warning notification for the corresponding spam phone number to the user terminal, which is the receiver, when the result of the determination of the spam determination unit is spam; It includes a database for storing data necessary for learning the spam discrimination model.

The method for identifying malicious spam calls based on artificial intelligence of the present invention has the advantage of being able to determine whether or not spam is present through an artificial intelligence-based spam discrimination model by utilizing real-time data instead of conventional daily, weekly, and monthly data to quickly and accurately determine whether or not there is malicious spam. there is

In addition, in order to reduce resource consumption for data management for spam registered numbers, each data (number) can be spam managed periodically by the TTL value in real time without the need to determine spam for all (all) data at a certain period. There are advantages to being able to

1 is a flowchart of a method for identifying malicious spam calls based on artificial intelligence according to an embodiment of the present invention.

2 is a block diagram showing the configuration of an apparatus for identifying malicious spam calls based on artificial intelligence according to an embodiment of the present invention.

3 is a diagram showing an example of spam discrimination by comparing normal/abnormal number of calls based on a spam discrimination model.

Hereinafter, specific embodiments of the present invention will be described in detail with reference to the drawings. However, the spirit of the present invention is not limited to the presented embodiments, and those skilled in the art who understand the spirit of the present invention may add, change, delete, etc. other elements within the scope of the same spirit, through other degenerative inventions or the present invention. Other embodiments included within the scope of the inventive idea can be easily proposed, but it will also be said to be included within the scope of the inventive concept. In addition, components having the same function within the scope of the same idea appearing in the drawings of each embodiment are described using the same reference numerals.

First, in the artificial intelligence-based malicious spam phone detection method of the present invention, the phone control unit 110 checks the incoming call when receiving a call to determine whether or not a registered spam number is pre-stored in the database 170 (S100 and S102).

If the number is registered spam, the phone control unit 110 automatically determines it as a malicious spam/voice phishing number, blocks it, and then notifies the user (S104).

If the phone control unit 110 is not a registered spam number, as requested to the collection unit 120, the collection unit 120 collects the caller's number and the recipient's number (S106).

In addition, the phone control unit 110 checks whether the user has received a call from the user through the user terminal (S108).

The phone control unit 110 sets the duration to 0 when a call is not received, and sets the duration to a call time when a call is received and collects the call through the collection unit 120 (S110 and S112).

Here, the duration is a time interval from the time when the call is received to the time when the call is disconnected, that is, the time when the call is terminated.

Afterwards, in the artificial intelligence learning-based spam discrimination model of the learning unit 130, learning is performed using the collected sender number, recipient number, and duration as feature values, and the learning unit 130's learning performance result, spam discrimination The unit 140 continuously determines whether or not spam is spam based on a threshold value (S114).

That is, if the discrimination result of the spam discrimination model is out of the threshold value, it is determined as spam and a notification about malicious spam can be sent to the user by the spam notification unit 150 before receiving a call, during a call, or after a call is ended (S116). , S118).

In addition, the spam discrimination model continuously updates and stores the discrimination result in the database 170 and uses it as learning data during learning, thereby improving the discrimination accuracy of the model through periodic learning.

The spam discrimination model can determine whether or not it is spam based on the outlier (threshold value) based on the learning result. Learning can be performed using neural network algorithms such as CNN (Convolutional Neural Networks). That is, a process of extracting feature values through CNN may be performed.

Specifically, since only normal data is learned, all labels can be unified to 0, and since the label is a single label, the model is used for extraction of outliers (threshold values), not for classification purposes.

To obtain outliers, the activation function of the last output layer of the fully connected layer must be set to the default option, linear.

After learning, the normal data is given to the predict function in the model where the normal data was trained, and the outliers of each normal data are obtained, and the range of the outliers obtained from each normal data is obtained. The range of outliers obtained in this process becomes a threshold value for classifying normal and abnormal.

In addition, when determining spam using the obtained threshold, a discriminator of a generative adversarial network (GAN) algorithm can be used.

Unlike conventional deep learning networks, generative adversarial networks (GANs) are structured with multiple deep neural networks.

In addition, the generative adversarial neural network is an unsupervised learning-based generative model that adversarially trains two networks with a generator and discriminator. Input data is input to the generator to create fake images similar to real images. can be learned to

A noise value may be input as the input data. Noise values can follow any probability distribution. For example, it may be data generated with a zero-mean Gaussian.

The discriminator can learn to discriminate between real data (normal data) and fake data generated by the generator (training data for discriminating spam, abnormal data).

More specifically, it can learn to have a high probability when real data is input, and to have a low probability when fake data is input. That is, the discriminator can gradually learn to discriminate between real data and fake data.

In addition, the spam discrimination model may include a malicious index evaluation model and a malicious situation evaluation model in detail, and learning and discrimination can be performed by classifying into these models.

In the malicious index evaluation model, spam can be judged based on the number of transmissions, all sender numbers are replaced with x in the learning stage, and the number of recipients is counted regardless of the number and has the value of y.

In other words, the malicious index evaluation model is a model for determining the malicious index and turning it into a DB (170) and operating the blocking module, and is a model for determining the characteristics of malicious calls and text messages. It is not a specific phone number, but a model for measuring the rapid change in any phone number within a unit of time.

In addition, the malicious situation evaluation model can determine spam based on the call duration, all caller IDs are replaced with x in the learning step, and the call duration is converted into an integer in seconds.

Furthermore, the malicious situation evaluation model determines the threshold (outlier) by identifying the call volume characteristics of calls determined to be malicious rather than measuring the change in call volume generated from a specific number when a call judged in the malignancy index evaluation model is not blocked or received. As a model for giving a warning to the recipient after detection, it can contribute to improving the accuracy of spam identification in a situation where spam identification is ambiguous by being used as an aid to the malicious index evaluation model.

In addition, FIG. 3 shows an example of spam discrimination by comparing the number of normal/abnormal calls based on the malicious index evaluation model, which is a spam discrimination model, and the learning and discrimination results from the malicious index evaluation model are stored in the DB 170. By using it for additional blocking and warning of the source, the load of artificial intelligence can be reduced.

In addition, the learning DB 170 of the malignancy index evaluation model can be an open source-based non-relational database 170 for storing and managing unstructured data of the key-value structure of Redis, and key-value By using a TTL (time to live) value when entering a key, it breaks away from the conventional method in which a number once registered as malicious is blocked forever, and resets whether or not the number is spam or not registered as spam according to a certain period. In other words, spam can be managed automatically by reducing the consumption of resources that need to be managed by human resources.

This means that each data (number) can be periodically managed by the TTL value in real time without spam discrimination for all (all) data in a certain period.

A malicious situation evaluation model based on learning about call time is also a model of the same concept as the malicious index evaluation model, except that the input value is different.

Furthermore, the above-described artificial intelligence-based malicious spam phone detection method may be performed by a computer program (mobile application in the case of a mobile device) installed and executed in a user terminal.

2 is a block diagram showing the configuration of an apparatus 100 for identifying malicious spam calls based on artificial intelligence according to an embodiment of the present invention.

Referring to FIG. 2 , the AI-based malicious spam call discrimination device 100 includes a phone control unit 110, a collection unit 120, a learning unit 130, a spam determination unit 140, a spam notification unit 150, An information protection unit 160 and a database 170 may be further included.

The phone control unit 110 may control calls received from the user terminal, and may automatically determine whether or not to receive or reject calls according to spam determination results.

The collection unit 120 may collect data on a called party number, a calling party number, and duration (call duration) to be used as learning data.

The learning unit 130 may perform learning of a spam discrimination model based on the collected data.

The spam determination unit 140 may determine whether an incoming call is spam based on a threshold obtained as a result of learning.

Spam notification unit 150, if spam as a result of the determination of spam determination unit 140, a warning notification for the corresponding spam phone number is transmitted in the form of a message to the user terminal as a receiver, and depending on whether the user is set, the phone control unit 110 You can also block calls automatically by requesting .

The information protection unit 160 may perform encryption and decryption to prevent forgery and falsification of personal sensitive information such as the sender number and receiver number, which are collected personal information, from external hacking.

Specifically, a light-weight encryption algorithm is performed by giving identification information capable of identification to a user terminal receiving a number and utilizing the identification information as a private key.

The lightweight encryption algorithm is an encryption technology designed to be implemented in a limited environment such as a smart device, and includes symmetric key encryption algorithms such as HIGHT (HIGh security and light weight), LEA (Lightweight Encryption) and hash function LSH (Lightweight Secure Hash). can be utilized

By encrypting/decrypting the collected data using this lightweight encryption algorithm, it is possible to prevent illegal control due to external leakage or external hacking of the data. It is preferable to use a lightweight hash function suitable for such an embedded computing environment as a lightweight cryptographic algorithm.

A lightweight hash function is a hash function that consumes relatively low computing power designed to ensure the integrity of transmitted or received data, except for some features that require high computing power in standard cryptographic hash algorithms such as SHA-3. (one-way function).

More specifically, among these lightweight hash functions, it is preferable to use a sponge algorithm that enables permutation of unkeyed data.

More specifically, the sponge makes the original message (in this case, the original data of the random key) into a certain size (padding), and then creates it with a specific standard size known only to the generator of the key (for example, the original message divided into specific bit sizes). It is implemented to exchange random data at the rear of the divided data (divided original message) by using several update functions, and to decode using the already known standard size on the other side.

That is, by using such a lightweight hash function, while securing the security of the hash function, relatively less computing power is required than the use of a general hash function, resulting in less power consumption of the terminal and long-lasting use. .

The database 170 may continuously update and store data necessary for learning the spam discrimination model, that is, recipient number, sender number, and duration, and may also include necessary user personal information or event information.

The above-described device 100 for determining malicious spam calls based on artificial intelligence may be an artificial intelligence based malicious spam call determining server on a network or a computer program (mobile application in case of mobile) installed and executed in a user terminal.

In addition, the apparatus 100 for identifying malicious spam calls based on artificial intelligence may include a processor and a memory. In an embodiment, the computing device may further include a network interface (or communication interface) (not shown), a storage (not shown), and a bus (not shown).

In one embodiment, the processor may control the overall operation of each component of the computing device. The processor may include a central processing unit (CPU), a micro processor unit (MPU), a micro controller unit (MCU), or any type of processor well known in the art.

In an embodiment, the processor may perform an operation for at least one application or program for executing the artificial intelligence-based malicious spam call identification method according to an embodiment of the present invention. In an embodiment, the processor may include one or more cores (not shown) and a graphic processing unit (not shown) and/or a connection path (eg, a bus) for transmitting and receiving signals to and from other components.

In an embodiment, the processor includes a RAM (Random Access Memory, not shown) and a ROM (ROM: Read-Only Memory, not shown) that temporarily and/or permanently store signals (or data) processed inside the processor. may further include. Also, the processor may be implemented in the form of a system on chip (SoC) including at least one of a graphics processing unit, RAM, and ROM.

In an embodiment, the processor may perform the above-described method for identifying malicious spam calls based on artificial intelligence by executing one or more instructions stored in memory.

In this specification, a 'terminal' may be a wireless communication device that guarantees portability and mobility, and may be, for example, any type of handheld-based wireless communication device such as a smart phone, a tablet PC, or a laptop computer. In addition, the 'terminal' may also be a wired communication device such as a PC capable of accessing other terminals or servers through a network. In addition, a network refers to a connection structure capable of exchanging information between nodes such as terminals and servers, such as a local area network (LAN), a wide area network (WAN), and the Internet (WWW : World Wide Web), wired and wireless data communications network, telephone network, and wired and wireless television communications network.

Examples of wireless data communication networks include 3G, 4G, 5G, 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), World Interoperability for Microwave Access (WIMAX), Wi-Fi, Bluetooth communication, infrared communication, ultrasonic communication, visible light communication (VLC: Visible Light Communication), LiFi, and the like, but are not limited thereto.

Furthermore, the method for identifying malicious spam calls based on artificial intelligence of the present invention can be implemented as a computer program stored in a storage medium for execution through combination with a computer, or as a module mounted on computer hardware on which the computer program operates. .

In addition, the operation method of the method for identifying malicious spam calls based on artificial intelligence according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the medium may be those specially designed and configured for the present invention or those known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, SSD (Solid State Drive), and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler.

[Description of code]

100: AI-based malicious spam call discrimination device

110: telephone control unit

120: collection unit

130: learning unit

140: spam detection unit

150: spam notification unit

160: Information Protection Department

170: database

Claims

Collecting, by the collecting unit, the sender's number and the recipient's number for determining spam;

Step, by the telephone control unit, checking whether the user has received a call received from the user through the user terminal;

setting the duration time to 0 when the call is not received by the telephone control unit and collecting the duration time through the collecting unit by setting the duration time to call time when the call is received;

In the artificial intelligence learning-based spam discrimination model, the learning unit performs learning using the collected caller ID, recipient ID, and duration as feature values; and

An artificial intelligence-based malicious spam call identification method comprising the step of determining whether a spam determination unit is spam based on the threshold value calculated by the learning.
The method of claim 1,

determining whether or not a registered spam number is pre-stored in a database by checking an incoming call when the phone control unit receives a call;

If the phone control unit is a registered spam number, automatically determining it as a malicious spam number and sending a notification to the user after blocking; and

and collecting, by the phone control unit, the calling party number and the called party number by making a request to the collecting unit when the number is not a registered spam number.
The method of claim 1,

The spam discrimination model determines whether or not spam is based on the learning result of the learning unit and the outlier (threshold), but artificial intelligence-based learning can be performed using CNN (Convolutional Neural Networks) for normal data. How to identify malicious spam calls.
in claim 3

Wherein the spam discrimination model uses a discriminator of a generative adversarial network (GAN) algorithm when discriminating whether or not spam is obtained using a threshold value obtained through CNN.
The method of claim 4,

The method of identifying malicious spam calls based on artificial intelligence, characterized in that the discriminator discriminates between real data (normal data) and fake data generated by the generator (abnormal data as training data for spam discrimination).
The method of claim 1,

The spam discrimination model is divided into a malicious index evaluation model that can determine spam based on call time and a malicious situation evaluation model that detects outliers by identifying call volume characteristics for duration and gives a warning to the recipient, and learns and discriminates them. An artificial intelligence-based malicious spam call discrimination method, characterized in that this is made.
The method of claim 6,

The malicious situation evaluation model is a model for detecting the call volume characteristics of calls determined to be malicious when a call determined by the malicious index evaluation model cannot be blocked or received, and gives a warning to the recipient after detecting a threshold value. A method for identifying malicious spam calls based on artificial intelligence, characterized in that it is used as an aid to the evaluation model.
The method of claim 6,

The learning DB of the malicious index evaluation model can be an open source-based non-relational database for storing and managing unstructured data with a key-value structure, and by using key-value, TTL when key is input By giving a (time to live) value, resetting whether a number is spam or not registering spam according to a certain period, it is characterized by reducing the consumption of resources that need to be managed by human resources and enabling automatic spam management. A method for identifying malicious spam calls based on artificial intelligence.
A computer program stored in a computer-readable recording medium that performs the artificial intelligence-based malicious spam call discrimination method according to any one of claims 1 to 8.
An artificial intelligence-based malicious spam call discrimination apparatus for performing the artificial intelligence-based malicious spam call discrimination method according to any one of claims 1 to 8, comprising:

The artificial intelligence-based malicious spam call discrimination device

a memory that stores one or more instructions; and

a processor to execute the one or more instructions stored in the memory;

The artificial intelligence-based malicious spam call discrimination device according to claim 1 , wherein the processor performs the artificial intelligence-based malicious spam call discrimination method by executing the one or more instructions.
The method of claim 10,

The artificial intelligence-based malicious spam call discrimination device

A telephone control unit capable of controlling a call received from a user terminal, and specifically determining whether to receive or reject a call automatically according to a spam determination result;

a collection unit that collects data on the recipient's number, caller's number, and duration (call time) to be used as learning data;

A learning unit that performs learning of a spam discrimination model based on the collected data;

Spam discrimination unit for determining whether or not the incoming call is spam based on the threshold value obtained as a result of learning;

Spam notification unit for sending a warning notification for the corresponding spam phone number to the user terminal, which is the receiver, when the result of the determination of the spam determination unit is spam; and

An artificial intelligence-based malicious spam phone discrimination device that includes a database storing data necessary for learning a spam discrimination model.