[0013] Below in conjunction with accompanying drawing, the present invention is introduced in further detail:
[0014] As shown in Figure 1, a method for locating an illegal wireless traffic source of the present invention includes the following steps:
[0015] S1: Data analysis, preliminary determination of illegal traffic source number;
[0016] Through user feedback or the network monitoring system to find out whether there is illegal traffic on the existing network, the network monitoring system will pay attention to the cells where the number of call congestion increases significantly, for example, the traffic volume of CELL cells in the system from 2:00 to 4:00 at night Sorting is carried out, and the cells with the average busy hour traffic volume>10ERL are selected. After observation and analysis, the source of illegal traffic often has "the dialed phone number has a regular pattern to follow, which is shown as "the non-digit number is continuously added with "1"; the physical location of the number is generally fixed; the number only dialed out access, and the number of calling contacts is abnormally large, generally reaching thousands per day, etc., as shown in Figure 2. According to the characteristics of illegal traffic sources, three algorithms of clusterer, decision tree and neural network are used. Generate a classifier decision-making system for judgment (including the number of calling contacts, the number of calling attempts, the number of calling connections, the number of early release calls, the number of called attempts, and the number of called connections as parameters), and ultimately not only can determine the illegal Traffic source number, and after three algorithms, a batch of mobile phone numbers that generate illegal traffic is obtained.
[0017] We use a hierarchical clustering algorithm to generalize the user group characteristics.
[0018] The selected input statistics are:
[0019] (1) The number of calling contacts (MOSMS_ContactorCount);
[0020] (2) The number of calling attempts (MOC);
[0021] (3) Number of calls connected (Connected_MOC);
[0022] (4) The number of calls for early release (Release Earlier_MOC);
[0023] (5) The number of called attempts (MTC);
[0024] (6) The number of called connections (Connected_MTC);
[0025] From the perspective of the importance of the input factors, the number of calling attempts, the number of call connections, the number of early release calls, and the number of calling contacts are all important characteristics of the partition class.
[0026] S2: Preliminary positioning, determining the cell where the illegal traffic source is located;
[0027] Through the analysis of the associated attributes and active locations of illegal traffic, it is found that a large number of numbers have continuous IMSIs, and then a location positioning method is determined by three cells, which can directly locate the location of the illegal traffic source number on the system, and determine the illegal traffic. the district in which it is located. Finally, verify with the cell location where the traffic volume of the system is above 10ERL from 2:00 to 4:00 at night.
[0028] S3: Determine the location of the illegal information source, and determine the more specific physical location of the illegal service information source;
[0029] After the illegal traffic source is initially located, it is necessary to perform precise on-site positioning. The process mainly includes two steps: the first step is to use the YBT250 frequency scanner combined with the small Yagi antenna to conduct a drive test on the target area where the illegal number is located. The antenna is directional, and the basic range has been determined, so as long as the illegal number has a considerable amount of traffic and the terrain is not too complicated, the physical address of the illegal number, that is, the specific building location, can basically be searched. The second step is to locate the illegal traffic dens whose physical locations have been locked. Enter the building, and then use the ICOM-R20 frequency sweeper combined with the whip-shaped flexible antenna, and at the same time, test the signal field strength layer by layer in the form of FSH3 assistance, and find the specific floor and unit where the traffic mouse is located. In this step , other instruments can also be used to determine the location of illegal sources.
[0030] It should be pointed out that the above-mentioned embodiments are only preferred embodiments of the present invention, and equivalent changes made according to the claims of the present invention still belong to the protection scope of the present invention.
