Detection system of outbound roaming fraud, method and computer readable medium thereof

Abstract

The present invention is a detection system of outbound roaming fraud and method thereof. The signaling and traffic information of mobile network users on local and roaming networks can be captured automatically and regularly to determine whether they meet the fraud attack model. Then, an outbound roaming fraud attack list is imported into an outbound roaming fraud attack risk rating formula method to complete the outbound roaming fraud attack risk assessment. According to the above, operators can take relevant network disconnection measures in a timely manner depending on the risk situation to immediately protect customer personal information and property security. The present invention also provides a computer-readable medium for executing the method of the present invention.

Description

[Technical Field]

[0001] This invention relates to mobile network technology, and more particularly to a detection system, method and computer-readable medium for overseas roaming fraud attacks. [Previous Technology]

[0002] In today's mobile networks, cybersecurity attacks on mobile users are becoming increasingly common, and the attack methods are also becoming more diversified with the evolution of the network. For example, the Signaling System Number 7 (SS7) attack often uses the spoofing of mobile users to steal sensitive user information, make fraudulent calls and send text messages, etc., which seriously affects the privacy of mobile users and the operation of mobile networks.

[0003] Therefore, how to find a technology to determine whether a user in a mobile network has been spoofed, especially to reduce the harm to real users caused by malicious spoofing from overseas roaming, has become an urgent goal pursued by people in this technical field. [Summary of the Invention]

[0004] To achieve the aforementioned objective, the present invention proposes a detection system for overseas roaming fraud attacks, comprising: a mobile network user information collection module, used to collect signaling and communication data of mobile network users on local networks and roaming networks, and after parsing and processing, to generate registration and internet access information of the mobile network users on mobile networks; and an overseas roaming fraud attack judgment module, connected to the mobile network user information collection module, used to receive the signaling and communication data from the mobile network user information collection module. By comparing the signaling obtained from the roaming network, the signaling obtained from the local network, and the registration and internet access information, the fraud attack patterns carried out by overseas roaming are determined, and an overseas roaming fraud attack list is generated accordingly. The overseas roaming fraud attack risk assessment module is connected to the overseas roaming fraud attack judgment module and is used to import the overseas roaming fraud attack list into the overseas roaming fraud attack risk assessment formula method to assess the fraud attack risk of the overseas roaming fraud attack list, so as to provide real-time information or issue alarms accordingly.

[0005] In one embodiment, the fraud attack pattern includes spoofing roaming, stealing information, fraudulent calls, or fraudulent text messages.

[0006] In one embodiment, when the overseas roaming fraud attack determination module determines the fraud attack mode, it immediately provides fraud-related signaling to the telecommunications operator to which the mobile network user belongs.

[0007] In one embodiment, the overseas roaming fraud attack risk assessment module establishes a risk threshold value based on the fraud attack risk, which serves as the judgment standard for issuing an alarm.

[0008] In one embodiment, the registration and internet access information includes time, phone number, base station information that the mobile network user has connected to on the local network, and information that the mobile network user has connected to on the roaming network.

[0009] In one embodiment, the assessment of the risk of fraud attack is based on the threat index of the types of fraud attack patterns and the number of users on the roaming network.

[0010] This invention further discloses a method for detecting overseas roaming fraud attacks, which is executed on a computer or server. The method for detecting overseas roaming fraud attacks includes the following steps: A mobile network user information collection module collects signaling and communication data of mobile network users on local and roaming networks, and after parsing and processing, generates registration and internet access information of the mobile network users on the mobile network; an overseas roaming fraud attack judgment module receives the signaling and communication data from the mobile network user information collection module, and by comparing the signaling obtained from the roaming network, the signaling obtained from the local network, and the registration and internet access information, determines the fraud attack pattern carried out by overseas roaming and generates an overseas roaming fraud attack list accordingly; and an overseas roaming fraud attack risk assessment module imports the overseas roaming fraud attack list into an overseas roaming fraud attack risk assessment formula to assess the fraud attack risk of the overseas roaming fraud attack list, so as to provide real-time information or issue alarms accordingly.

[0011] In the above method, the fraud attack mode includes spoofing roaming, stealing information, fraudulent calls or fraudulent text messages.

[0012] In the above method, when the overseas roaming fraud attack judgment module judges the fraud attack mode, it immediately provides fraud-related signaling to the telecommunications operator to which the mobile network user belongs.

[0013] In the above method, the overseas roaming fraud attack risk assessment module establishes a risk threshold value based on the fraud attack risk, which serves as the judgment standard for issuing an alarm.

[0014] In the above method, the registration and internet access information includes time, mobile number, base station information that the mobile network user has connected to on the local network, and information that the mobile network user has connected to on the roaming network.

[0015] In the above method, the assessment of the risk of fraud attack is based on the threat index of the types of fraud attack patterns and the number of users on the roaming network.

[0016] The present invention further discloses a computer-readable medium, which is applied in a computing device or computer and stores instructions to execute the aforementioned method for detecting overseas roaming fraud attacks.

[0017] In summary, the detection system, method and computer-readable medium for overseas roaming fraud attacks of the present invention differ from various existing mechanisms that can only detect and prevent online fraud within the territory. The present invention uses cross-comparison of signaling between the local network and the overseas network to determine whether a user has been subjected to an overseas roaming attack. Based on this overseas roaming fraud attack information, it can conduct real-time risk assessment of individual users and the overall roaming network fraud attack. Furthermore, the relevant data can be provided to operators to take relevant network disconnection measures in a timely manner according to the risk situation, so as to protect the personal information and property security of customers in a timely manner and effectively prevent overseas roaming fraud attacks from all over the world. [Simplified Explanation of the Diagram]

[0067] Figure 1 is a system architecture diagram of the detection system for overseas roaming fraud attacks of the present invention.

[0068] Figure 2 is a system architecture diagram of a specific embodiment of the overseas roaming fraud attack detection system of the present invention.

[0069] Figure 3 is a flowchart illustrating the steps of the method for detecting overseas roaming fraud attacks according to the present invention.

[0070] Figure 4 is a flowchart of the roaming fraud attack judgment of the present invention.

[0071] Figure 5 is a flowchart of the risk assessment of roaming fraud attacks related to the present invention.

Implementation Method

[0018] The technical content of the present invention is described below through specific embodiments. Those skilled in the art can easily understand the advantages and effects of the present invention from the content disclosed in this specification. However, the present invention can also be implemented or applied through other different embodiments.

[0019] Figure 1 is a system architecture diagram of the overseas roaming fraud attack detection system of the present invention. The purpose of the present invention is to propose an overseas roaming attack detection mechanism based on mobile core network signaling to detect cybersecurity attacks against mobile users in real time, thereby blocking attacks and ensuring network service quality.

[0020] As shown in the figure, the overseas roaming fraud attack detection system 1 includes a mobile network user information collection module 11, an overseas roaming fraud attack judgment module 12, and an overseas roaming fraud attack risk assessment module 13.

[0021] The mobile network user information collection module 11 is used to collect signaling and communication data of mobile network users on local networks and roaming networks. After parsing and processing, it generates the registration and internet access information of the mobile network user on the mobile network. In one embodiment, the mobile network user information collection module 11 can automatically and periodically collect signaling and communication information of mobile network users on the local network (i.e., the local mobile network) and the roaming network (i.e., the roaming mobile network) using a signal acquisition unit. Then, it parses and calculates to generate information on the mobile network user's registration and internet access on the mobile network, such as, but not limited to, time, SIM card number (e.g., International Mobile Subscriber Identity (IMSI) and Mobile Subscriber ISDN Number (MSISDN)), base station information connected to by the local network user, and information connected to by the roaming network user (e.g., roaming country, roaming network, switch, base station, etc.). The above information is stored in a database within the mobile network user information collection module 11 or in an independent database (not shown) to provide information for judging overseas roaming fraud attacks.

[0022] The overseas roaming fraud attack determination module 12 is connected to the mobile network user information collection module 11 and is used to receive signaling and communication data from the mobile network user information collection module 11. By comparing the signaling obtained from the roaming network, the signaling obtained from the local network, and the registration and internet access information of the mobile network user, it determines the fraud attack pattern carried out by overseas roaming and generates an overseas roaming fraud attack list accordingly. In one embodiment, the overseas roaming fraud attack determination module 12 receives signaling and communication data from the mobile network user information collection module 11 to compare the user signaling of the overseas roaming network and the domestic local network. For example, a fraud group can forge a user registration overseas (e.g., in Europe) to generate overseas roaming signaling. If the user registers on the domestic local network during the travel period, generating domestic signaling, signaling comparison information that matches the fraud will be generated. Furthermore, by comparing and determining the fraud attack patterns carried out by overseas roaming, such as roaming fraud, information theft, fraudulent calls and / or fraudulent text messages, but not limited to these, the overseas roaming fraud attack determination module 12 can provide fraud-related signaling (time, user, roaming network, region) to the operator in real time.

[0023] For example, in the aforementioned attack mode, today a fraud attacker registers user A in a European country, but user A also registers on the local network during the travel period (10 hours), which constitutes a situation of fake roaming; in addition, when user A is sending an OTP authentication SMS on the local network, the SMS is intercepted by the fake roaming network, which constitutes a situation of information theft; or, when there is a situation of fake roaming, user A may also receive international calls and SMS on the local network, which constitutes fraudulent calls and SMS.

[0024] The overseas roaming fraud attack risk assessment module 13 is connected to the overseas roaming fraud attack judgment module 12. It is used to import the overseas roaming fraud attack list into the overseas roaming fraud attack risk assessment formula method or algorithm to assess the fraud attack risk of the overseas roaming fraud attack list and provide corresponding real-time information or issue alarms. In one embodiment, the overseas roaming fraud attack risk assessment module 13 is responsible for receiving the overseas roaming fraud attack list from the overseas roaming fraud attack judgment module 12, and then importing the overseas roaming fraud attack list into the overseas roaming fraud attack risk assessment formula method or algorithm for assessment, thereby identifying the overseas roaming fraud attack risks in the overseas roaming fraud attack list. Factors affecting the fraud attack risk may include the threat index of the type of fraud attack mode and / or the number of users roaming the network fraudulently, but are not limited to these.

[0025] In one embodiment, the formula parameters and user network signaling sources in the evaluation can be adjusted at any time from the signaling collection database built by the operator, and the evaluation score can be calculated accordingly. For example, if a user generates signaling simultaneously on an overseas roaming network and a domestic local network during their travels, the built signaling monitoring database will simultaneously collect fraud signaling comparison information of this user. The evaluation function will extract the threat index set in the database and calculate the evaluation score according to the formula.

[0026] In addition, the overseas roaming fraud attack risk assessment module 13 can establish a risk threshold value based on the risk of fraud attacks, which can be used as the judgment standard for issuing alarms. Accordingly, the overseas roaming fraud attack risk assessment module 13 can not only provide the fraud attack risk assessment results to the operator in real time, but also proactively issue alarms based on the established risk thresholds as appropriate.

[0027] In one embodiment, the aforementioned alarm standard can be configured by setting the threat index of attack mode types sequentially as follows: spoofing roaming is 0.1, information theft is 0.2, and fraudulent calls or text messages are 0.3, with a risk threshold index of 80 points. For example, if roaming network A spoofs roaming against 5 users and steals information from only 1 roaming user within the observation period, then the attack risk assessment score of roaming network A is (0.1*5+0.2*1)*100=70, and roaming network A has not yet reached the alarm standard; in addition, if roaming network B spoofs roaming against 3 users, steals information from 1 roaming user, and makes a roaming fraudulent call to 1 roaming user within the observation period, then the assessment score of roaming network B is (0.1*3+0.2*1+0.3*1)*100=80, and roaming network B has reached the alarm standard.

[0028] The mobile network user information collection module 11, the overseas roaming fraud attack judgment module 12, and the overseas roaming fraud attack risk assessment module 13 can be deployed on the same hardware platform, and communication between the modules is achieved through a program interface; they can also be deployed on different hardware platforms, and communication between the modules is achieved through IP-based communication protocols. The mobile network that this invention can implement can be Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Long Term Evolution (LTE), 5G mobile network, 6G mobile network, etc.

[0029] In summary, the overseas roaming fraud attack detection system 1 of the present invention is based on mobile network signaling and communication to detect overseas roaming fraud attacks. By collecting mobile network user information from local networks and roaming networks, it compares the behavior of overseas roaming networks with that of domestic local networks to determine whether an overseas roaming fraud attack exists. Then, it uses this information to import overseas roaming fraud attack risk assessment formulas or algorithms to conduct fraud attack risk assessment. In this way, fraud attack information can be provided to operators in real time to block roaming services in a timely manner.

[0030] Figure 2 is a system architecture diagram of a specific embodiment of the detection system for overseas roaming fraud attacks of the present invention.

[0031] As shown in the figure, the detection system 1 for overseas roaming fraud attacks is the same as that shown in Figure 1. In this embodiment, the operation architecture of the detection system 1 for overseas roaming fraud attacks, the local network, and the roaming network is mainly described.

[0032] In Figure 2, local user 4 registers to access the Internet on the mobile communication network of local network 5, while overseas roaming 3 (fraud attacker) registers to access the Internet by forging an identity on the mobile communication network of roaming network 6. The overseas roaming fraud attack detection system 1 can execute the registration and Internet access information of mobile network users on local network 5 and roaming network 6 to determine whether an overseas roaming fraud attack has occurred. The overseas roaming fraud attack detection system 1 operates as follows.

[0033] The mobile network user information collection module 11 can automatically and periodically collect signaling and communication data of mobile network users on the local mobile network and external mobile networks through, for example, a signal acquisition unit. Then, it analyzes and processes the data to generate the mobile network user's internet registration and internet access information on the local mobile network and external mobile networks, such as time, mobile number (IMSI and MSISDN), base station information connected to by the local network user, and information connected to by roaming network users. The overseas roaming fraud attack judgment module 12 automatically and periodically collects mobile network user information. Module 11 obtains user information from the local mobile network and the external network (i.e., roaming network), compares user signaling between the overseas roaming network 6 and the domestic local network 5, and provides an overseas roaming fraud attack list 210 after determining the fraud attack pattern carried out by overseas roaming. After receiving the overseas roaming fraud attack list 210, the overseas roaming fraud attack risk assessment module 13 can conduct risk assessment based on fraud patterns and users, generate overseas roaming fraud attack risk assessment results 220, and use a world map-style webpage to present the attack status and alarms of roaming around the world.

[0034] The list of overseas roaming fraud attacks 210 may include the time, user, roaming network, region, and attack method of overseas roaming fraud, while the overseas roaming fraud attack risk assessment result 220 includes information such as user and roaming network, which can be provided to operators for alerting and prevention.

[0035] Each module of the present invention may be software, hardware or firmware; if it is hardware, it may be a processing unit, processor, computer or server with data processing and computing capabilities; if it is software or firmware, it may include instructions executable by the processing unit, processor, computer or server, and may be installed on the same hardware device or distributed on different multiple hardware devices.

[0036] Figure 3 is a flowchart of the detection method for overseas roaming fraud attacks of the present invention.

[0037] As shown in the figure, the purpose of the detection method for overseas roaming fraud attacks is to collect mobile network user information of local networks and roaming networks, and to determine whether it is an overseas roaming fraud attack by comparing the user behavior of overseas roaming networks and domestic local networks.

[0038] In step S301, the mobile network user information collection module collects signaling and communication data of the mobile network user on the local network and roaming network. After parsing and processing, it generates the mobile network user's registration and internet access information on the mobile network. This step explains that the mobile network user information collection module automatically and periodically collects the signaling and communication data of the mobile network user on the local network and roaming network, parses and processes the signaling and communication data of the mobile network user on the local network and roaming network, thereby obtaining the mobile network user's registration and internet access information on the mobile network, that is, obtaining information related to the mobile network user's internet access. This information will be used to determine whether the mobile network user has been impersonated, etc.

[0039] In one embodiment, the aforementioned registration and internet access information includes, but is not limited to, time, mobile number, base station information that the mobile network user has connected to on the local network, and information that the mobile network user has connected to on the roaming network.

[0040] In step S302, the overseas roaming fraud attack determination module receives the signaling and communication data from the mobile network user information collection module. By comparing the signaling obtained from the roaming network, the signaling obtained from the local network, and the registration and internet access information, it determines the fraud attack pattern carried out by the overseas roaming and generates an overseas roaming fraud attack list accordingly. This step explains that the overseas roaming fraud attack determination module automatically and periodically obtains registration and internet access data provided by the mobile network user information collection module related to the local network and roaming network, and performs signaling comparison on this data to determine the overseas roaming fraud attack pattern, such as information theft, roaming spoofing, fraudulent calls, and fraudulent text messages.

[0041] In one embodiment, when the overseas roaming fraud attack judgment module determines the fraud attack mode, it can immediately provide fraud-related signaling to the telecommunications operator to which the mobile network user belongs, so that the telecommunications operator can respond.

[0042] In step S303, the overseas roaming fraud attack risk assessment module imports the overseas roaming fraud attack list into the overseas roaming fraud attack risk assessment formula method to assess the fraud attack risk of the overseas roaming fraud attack list, so as to provide real-time information or issue alarms accordingly. This step explains that the overseas roaming fraud attack risk assessment module uses the overseas roaming fraud attack risk assessment real-time assessment mechanism to assess the fraud attack risk, such as considering the threat index of the types of fraud attack patterns and the number of users on the roaming network as assessment criteria.

[0043] In one embodiment, the scores for individual user fraud attack risk assessment and overseas roaming network fraud attack risk assessment can be calculated using the following two formulas. The calculated results can be used by operators to assess the overall overseas roaming network fraud attacks suffered by local network users, serving as a basis for roaming service blocking prevention measures. The overseas roaming fraud attack risk assessment formula is shown below.

[0044] Overseas roaming network fraud attack risk assessment Score S=[α1*N*n+α2*N*n+...+αt*N*n]* 100,0α1。

[0045] Risk assessment of individual users being scammed: Score = S1 * [α1 * n + α2 * n + … + αt * n] * 100 + S2 * [α1 * n + α2 * n + … + αt * n] * 100 + … + SR * [α1 * n + α2 * n + … + αt * n] * 100.

[0046] Where N is the number of users attacked by fraud, n is the number of times the user was attacked by fraud, α is the index of the fraud attack mode, t is the type of fraud attack mode (spoofing roaming, stealing information, fraudulent calls and fraudulent text messages, etc.), R is the roaming network of the user who committed the fraud attack, and S is the roaming network risk assessment score of the user who committed the attack.

[0047] As shown above, based on the fraud attack pattern determined by the signaling comparison mechanism between overseas roaming networks and domestic local networks, the attack risk assessment score S of the roaming network that carried out the attack can be estimated by using the number of users N who were fraudulently attacked, the number of times n were fraudulently attacked, and the index α of the fraud attack pattern. In addition, the risk assessment of individual users being fraudulently attacked is estimated based on the assessment score S of the roaming network suffered by the user and the number and index of fraudulent attacks that occurred.

[0048] In addition, in other embodiments, the overseas roaming fraud attack risk assessment module can establish a risk threshold value based on the fraud attack risk, which can be used as the judgment standard for issuing an alarm.

[0049] In summary, after the mobile network user information collection module obtains the registration and internet access information of mobile users on the local network and roaming network, the overseas roaming fraud attack judgment module compares the user signaling of the overseas roaming network and the domestic local network to determine the fraud attack pattern carried out by overseas roaming. The overseas roaming fraud attack risk assessment module performs risk assessment and presents relevant alarms based on the fraud pattern and users.

[0050] Figure 4 is a flowchart of the roaming fraud attack judgment of the present invention, illustrating how the overseas roaming fraud attack judgment module performs the judgment of roaming fraud attacks.

[0051] In process 401, the overseas roaming fraud attack judgment mechanism is initiated.

[0052] In process 402, the mobile network user information collection module periodically obtains mobile network data from roaming networks. This process describes the collection of mobile network data from mobile network users roaming networks, including signaling and communication information.

[0053] In process 403, the mobile network user information collection module periodically obtains mobile network data from the local network. This process describes the collection of mobile network data from mobile network users on the local network, including signaling and communication information.

[0054] In process 404, the signaling of users roaming overseas and within the local network is compared. This process describes the comparison of user signaling between the overseas roaming network and the local network. This comparison mechanism can identify the fraud attack patterns carried out by the overseas roaming network, such as roaming fraud, information theft, fraudulent calls and fraudulent text messages, etc. Roaming fraud may be, for example, a roaming user generating registration signaling or communication on the local network during their travel period. Information theft may be, for example, a fake overseas roaming user receiving an OTP text message. Fraudulent calls and fraudulent text messages may be, for example, a call or text message with a fake local phone number generated by the overseas roaming network, or a local network user receiving the aforementioned abnormal international call.

[0055] At process 405, the characteristics of a fraud attack pattern are determined. This process describes whether the fraudulent behavior conforms to an attack pattern. If not, return to process 404; if yes, proceed to process 406.

[0056] In process 406, a list of overseas roaming fraud attacks is generated. This process explains that after the fraud attack pattern is determined above, a list of overseas roaming fraud attacks can be generated, and fraud-related signaling (time, user, roaming network, region, fraud pattern) can be provided to the operator in real time.

[0057] Figure 5 is a flowchart of the risk assessment of roaming fraud attacks in this invention, illustrating how the overseas roaming fraud attack risk assessment module performs the risk assessment of roaming fraud attacks.

[0058] In process 501, the evaluation of overseas roaming fraud attacks begins.

[0059] In process 502, the list of overseas roaming fraud attacks is obtained. This process describes how, after the overseas roaming fraud attack judgment module generates the list of overseas roaming fraud attacks and related signaling, it is imported into the overseas roaming fraud attack risk assessment formula or algorithm for estimation.

[0060] In process 503, a risk assessment of overseas roaming fraud attacks is performed. In one embodiment, the fraud attack pattern suffered by an individual user will affect their risk index (for example, the risk index of information theft is the highest), and the risk assessment of overseas roaming fraud attacks is estimated based on the aggregation of all attacked individual users.

[0061] In process 504, the results are displayed on the world map-style alert system. This process explains that the results of the fraud attack risk assessment (users, roaming networks) will be provided to the operator in real time, and abnormal situations and alerts of overseas fraud in various countries will be presented on the world map.

[0062] Furthermore, the present invention discloses a computer-readable medium applied in a computing device or computer having a processor (e.g., CPU, GPU, etc.) and / or memory, and storing instructions, which can be executed by the computing device or computer through the processor and / or memory to perform the above-described methods and steps when the computer-readable medium is executed. In one embodiment, the computer-readable medium is a non-transitory computer-readable storage medium.

[0063] As can be seen from the above, the detection system, method, and computer-readable medium for overseas roaming fraud attacks of the present invention automatically and periodically captures signaling and communication information of mobile users on local and roaming networks, then determines whether it conforms to a fraud attack pattern, and finally imports the overseas roaming fraud attack list into the overseas roaming fraud attack risk assessment formula to complete the overseas roaming fraud attack risk assessment. Therefore, telecommunications operators can take relevant network disconnection measures in a timely manner according to the risk situation to protect customers' personal data and property security. Based on the above, the present invention has the following advantages.

[0064] First, the present invention can collect various information on the registration and Internet access of all 3G / 4G / 5G and other mobile network users (including roaming), and cross-compare the signaling of the local network and the roaming network to determine the situation of overseas roaming attacks.

[0065] Second, the present invention can conduct real-time risk assessment of individual users and the overall roaming network fraud attacks based on overseas roaming attack signaling. In addition to providing relevant data from operators to provide alerts based on the risk situation, it can also take relevant network disconnection measures in a timely manner to protect the personal information and property security of customers in real time.

[0066] The above detailed description is a specific description of one feasible embodiment of the present invention. However, the embodiment is not intended to limit the patent scope of the present invention. All equivalent implementations or modifications that do not depart from the spirit of the present invention should be included in the patent scope of the present invention.

Claims

1. A detection system for overseas roaming fraud attacks, comprising: The mobile network user information collection module is used to collect signaling and communication data of mobile network users on local networks and roaming networks. After analysis and processing, it generates the registration and internet access information of the mobile network user on the mobile network. The overseas roaming fraud attack detection module is connected to the mobile network user information collection module. It receives signaling and communication data from the mobile network user information collection module and, by comparing the signaling obtained from the roaming network, the signaling obtained from the local network, and the registration and internet access information, determines the fraud attack pattern carried out during overseas roaming and generates an overseas roaming fraud attack list accordingly. The overseas roaming fraud attack risk assessment module is connected to the overseas roaming fraud attack judgment module. It is used to import the overseas roaming fraud attack list into the overseas roaming fraud attack risk assessment formula method to assess the fraud attack risk of the overseas roaming fraud attack list, so as to provide real-time information or issue alarms accordingly.

2. The detection system for overseas roaming fraud attacks as described in Request 1, wherein, This fraudulent attack pattern includes spoofing roaming, stealing information, making fraudulent calls, or sending fraudulent text messages.

3. The detection system for overseas roaming fraud attacks as described in Request 1, wherein, When the overseas roaming fraud attack detection module identifies the fraud attack pattern, it immediately provides fraud-related signaling to the telecommunications operator to which the mobile network user belongs.

4. The detection system for overseas roaming fraud attacks as described in Request 1, wherein, The overseas roaming fraud attack risk assessment module establishes a risk threshold based on the risk of such fraud attacks, which serves as the criterion for issuing alerts.

5. The detection system for overseas roaming fraud attacks as described in Request 1, wherein, The registration and internet access information includes the time, mobile number, base station information that the mobile network user has connected to on the local network, and information that the mobile network user has connected to on the roaming network.

6. The detection system for overseas roaming fraud attacks as described in Request 1, wherein, The assessment of the risk of fraud attacks takes into account the threat level of the types of fraud attack patterns and the number of users on the roaming network.

7. A method for detecting overseas roaming fraud attacks, comprising the following steps: The mobile network user information collection module collects signaling and communication data of mobile network users on local networks and roaming networks, and after parsing and processing, generates the registration and internet access information of the mobile network user on the mobile network; The overseas roaming fraud attack detection module receives signaling and communication data from the mobile network user information collection module. By comparing the signaling obtained from the roaming network, the signaling obtained from the local network, and the registration and internet access information, it determines the fraud attack patterns carried out by overseas roaming and generates a list of overseas roaming fraud attackers. The overseas roaming fraud attack risk assessment module imports the overseas roaming fraud attack list into the overseas roaming fraud attack risk assessment formula method to assess the fraud attack risk of the overseas roaming fraud attack list, so as to provide real-time information or issue alerts accordingly.

8. The method for detecting overseas roaming fraud attacks as described in claim 7, wherein, This fraudulent attack pattern includes spoofing roaming, stealing information, making fraudulent calls, or sending fraudulent text messages.

9. The method for detecting overseas roaming fraud attacks as described in claim 7, wherein, When the overseas roaming fraud attack detection module identifies the fraud attack pattern, it immediately provides fraud-related signaling to the telecommunications operator to which the mobile network user belongs.

10. The method for detecting overseas roaming fraud attacks as described in claim 7, wherein, The overseas roaming fraud attack risk assessment module establishes a risk threshold based on the risk of such fraud attacks, which serves as the criterion for issuing alerts.

11. The method for detecting overseas roaming fraud attacks as described in claim 7, wherein, The registration and internet access information includes the time, mobile number, base station information that the mobile network user has connected to on the local network, and information that the mobile network user has connected to on the roaming network.

12. The method for detecting overseas roaming fraud attacks as described in claim 7, wherein, The assessment of the risk of fraud attacks takes into account the threat level of the types of fraud attack patterns and the number of users on the roaming network.

13. A computer-readable medium, applied in a computing device or computer, storing instructions for performing a method for detecting overseas roaming fraud attacks as described in any one of claims 7 to 12.

Images