Device and method for preventing fraudulent calls

Abstract

The present disclosure relates to a method and device for preventing fraudulent calls. A device for preventing fraudulent calls includes: a control module configured to: receive data from a base station; determine that the data contains a call request; and send instructions to a calling terminal and a called terminal to interrupt the call, a storage module configured to store a first white list and a second white list, and an analysis module configured to: obtain a calling number and a called number according to the call request; determine that the calling number has not previously sent data via the base station according to the calling number; determine that the called number is not in the first white list; determine that the calling number initiates a call in a risk area; determine that the calling number is not in the second white list; determine that the calling number is not a local user; and send instructions to the control module to interrupt the call.

Description

Technical Field

[0001] The present invention relates to a device and method for preventing fraudulent calls. Background Art

[0002] At present, many criminals often use mobile phones to commit telecommunications fraud. In order to avoid high-pressure crackdowns from the issuing and calling places, criminals have begun to implement a new method of making fraudulent calls: after applying for a phone card in Province A, they initiate roaming calls to users in Province C from special areas in Province B (such as overseas areas covered by domestic signals at the border).

[0003] Although the calling and called users' home provinces can intercept users based on the base station cell numbers, the base station cell information in high-risk areas is managed by the roaming province, which requires coordinated processing by the home province and the roaming province, and even across operators.

[0004] Interception or shutdown based on the calling number blacklist will affect the normal business of users in non-high-risk areas and cause user complaints or disputes. Summary of the invention

[0005] According to one aspect of the present disclosure, a method for preventing fraudulent calls is provided, comprising:

[0006] receiving data from a base station;

[0007] determining that the data includes a call request;

[0008] Acquire the calling number and the called number according to the call request;

[0009] determining, according to the calling number, that the calling number has not previously sent data via the base station;

[0010] Determining that the called number is not in the first whitelist;

[0011] Determining calls initiated by the calling number in the risk area;

[0012] Determining that the calling number is not in the second whitelist;

[0013] Determining that the calling number is not a local user; and

[0014] Send instructions to the calling party and the called party to terminate the call.

[0015] According to another aspect of the present disclosure, a device for preventing fraudulent calls is provided, comprising:

[0016] The control module is configured as follows:

[0017] receiving data from a base station;

[0018] determining that the data comprises a call request; and

[0019] Send instructions to the calling terminal and the called terminal to interrupt the call

[0020] A storage module, configured to store a first whitelist and a second whitelist;

[0021] The analysis module is configured as follows:

[0022] Acquire the calling number and the called number according to the call request;

[0023] Determining, according to the calling number, that the calling number has not previously sent data via the base station;

[0024] Determining that the called number is not in the first whitelist;

[0025] Determining calls initiated by the calling number in the risk area;

[0026] Determining that the calling number is not in the second whitelist;

[0027] Determining that the calling number is not a local user; and

[0028] Send an instruction to the control module to interrupt the call.

[0029] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0031] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0032] Figure 1 A block diagram showing the structure of an apparatus for preventing fraudulent calls according to some embodiments of the present disclosure.

[0033] Figure 2 A schematic diagram of a telecommunication network using the apparatus for preventing fraudulent calls according to the present disclosure is shown.

[0034] Figure 3 A flow chart of a method for preventing fraudulent calls according to some embodiments of the present disclosure is shown.

[0035] Note that in the embodiments described below, the same reference numerals are sometimes used in common between different drawings to represent the same parts or parts with the same functions, and their repeated descriptions are omitted. In this specification, similar reference numerals and letters are used to represent similar items, so once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0036] For ease of understanding, the positions, sizes, and ranges of various structures shown in the drawings and the like may not represent actual positions, sizes, and ranges, etc. Therefore, the disclosed invention is not limited to the positions, sizes, and ranges disclosed in the drawings and the like. DETAILED DESCRIPTION

[0037] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless otherwise specifically stated.

[0038] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0039] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.

[0040] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0041] Figure 1 FIG. 1 is a block diagram of an apparatus 100 for preventing fraudulent calls according to some embodiments of the present disclosure. Figure 1 As shown, the device 100 for preventing fraudulent calls includes: a control module 101, a storage module 102 and an analysis module 103.

[0042] The control module 101 may receive data from a base station; determine that the data includes a call request; and send instructions to a calling terminal and a called terminal to interrupt the call.

[0043] The storage module 102 can store various data and files required by the device 100. As will be described in detail later, the storage module 102 can store the first white list and the second white list. The storage module 102 can also store, for example, a risk area table, an H code, and the analysis results of the analysis module 103.

[0044] The analysis module 103 can obtain the calling number and the called number according to the call request; determine, based on the calling number, that the calling number has not sent data through the base station before; determine that the called number is not in the first whitelist; determine that the call is initiated by the calling number in the risk area; determine that the calling number is not in the second whitelist; determine that the calling number is not a local user; and send an instruction to the control module to interrupt the call.

[0045] Figure 2 A schematic diagram of a telecommunication network using the apparatus for preventing fraudulent calls according to the present disclosure is shown.

[0046] The calling device 201 (e.g., a mobile phone) can send data to the base station 202. The base station 202 can be, for example, a 4G or 5G base station, such as LTE / EPC, NR / 5GC, etc. The base station 202 can send the received data to the device 100 for preventing fraudulent calls. More specifically, the control module 101 in the device 100 for preventing fraudulent calls receives data from the base station. After processing by the device 100 for preventing fraudulent calls, it can be determined whether the call initiated by the calling device is a fraudulent call. If it is identified as a fraudulent call, the device 100 for preventing fraudulent calls can interrupt the call. If it is not considered a fraudulent call, the control module 101 in the device 100 for preventing fraudulent calls does not process it, and the data packet from the base station can be transparently transmitted to the proxy call service control function / session border controller (P-CSCF / SBC) 203 in the IP multimedia subsystem (IMS) 210 or the Internet. The subsequent processing of IMS 210 is similar to the prior art, and the present disclosure will not be described in detail.

[0047] When mobile devices such as mobile phones need to communicate, they need to access the operator network through the base station. In the embodiment of the present disclosure, the device 100 for preventing fraudulent calls is set between the base station and the P-CSCF / SBC 203 of the IMS 210. In this way, data transmitted via the base station must first be processed and filtered by the device 100 for preventing fraudulent calls before being allowed to access the IMS 210.

[0048] In the above embodiments of the present disclosure, the apparatus 100 for preventing fraudulent calls is shown as an independent device. However, it should be understood that the present disclosure is not limited thereto. One or more modules in the apparatus 100 for preventing fraudulent calls or the apparatus 100 for preventing fraudulent calls itself can be used as part of the IMS 210.

[0049] The functions of each module in the device 100 for preventing fraudulent calls are further described in detail below in conjunction with the method for preventing fraudulent calls.

[0050] Figure 3A flow chart of a method for preventing fraudulent calls according to some embodiments of the present disclosure is shown.

[0051] like Figure 3 As shown, first, in step 310, the control module 101 can receive data from the base station. Mobile devices such as mobile phones (i.e., calling devices 201) need to access the operator network through the base station 202 to make, for example, phone calls or access the Internet. The base station 202 can send the data received from the calling device 201 to the control module 101 in the device 100 for preventing fraudulent calls.

[0052] In step 311, the control module 101 can determine whether the data contains a call request based on the data from the base station. Among them, the control module 101 can analyze the data packet from the base station to determine the data flow direction. If the destination IP address of the data packet is the P-CSCF / SBC access side address, this indicates that the calling device 201 may initiate a phone call, and this data packet will be retained by the control module 101 for further analysis and processing. For example, the control module 101 can parse the data packet to obtain the INVITE message contained in the data packet. The INVITE message is a message in the SIP signaling. The INVITE message may contain a session type and some parameters necessary for the call.

[0053] The control module 101 may send the obtained INVITE message to the analysis module 103 .

[0054] If the destination IP address of the data packet is not the P-CSCF / SBC access side address, this means that the calling device 201 may implement other services via the base station 202, such as accessing the Internet. In this case, the control module 101 can directly determine that these data packets do not involve fraudulent calls, do not process them, and transparently transmit them to non-IMS210 networks such as the Internet.

[0055] In step 312, the analysis module 103 may obtain the calling number and the called number according to the call request. For example, the recipient's URI and the called number may be identified from the "To" header field of the INVITE message, and the calling number may be extracted from the "From" and / or "P-Preferred-Identity" header fields of the INVITE message.

[0056] In step 313, the analysis module 103 can determine whether the calling number has previously sent data via the base station according to the calling number. In some embodiments according to the present disclosure, the analysis module 103 can determine whether the calling number has previously sent other call requests via the base station before sending the call request. That is, the analysis module 103 can determine whether the calling number sends a call request via the base station for the first time. If the calling number sends a call request via the base station for the first time, the call initiated by the calling number may be a fraudulent call, which requires further analysis and processing. If the calling number has previously successfully initiated a call through the same base station, which means that the call initiated by the calling number is not a fraudulent call, the analysis module 103 does not need further analysis and can directly instruct the control module 101 to allow the call initiated by the calling number to continue. After receiving the instruction of the analysis module 103, the control module 101 will forward the data from the base station to the P-CSCF / SBC203 of the IMS 210 so that the call can continue.

[0057] In addition, considering the storage of call records and other issues, the analysis module 103 can set a time range when determining whether the calling number sends a call request via the base station for the first time. That is, the calling number has not sent other call requests via the base station during the predetermined period before sending the call request. This predetermined period can be flexibly set according to the storage capacity of the storage module 102. For example, the predetermined period can be half a year, one year, two years or five years.

[0058] In step 314, the analysis module 103 may determine whether the called number is in the first whitelist. The first whitelist is a whitelist of called numbers, which contains a list of numbers allowed to be called. The first whitelist may be stored in the storage module 102. The analysis module 103 reads the first whitelist from the storage module 102, and compares the called number obtained from the INVITE message with the numbers in the first whitelist. If it is found that the called number is in the first whitelist, it indicates that the called number allows any number to initiate a call to it, for example, the called number is the customer service phone number of the operator. In this case, the analysis module 103 may instruct the control module 101 to allow the call initiated by the calling number to continue. After receiving the instruction of the analysis module 103, the control module 101 will forward the data from the base station to the P-CSCF / SBC 203 of the IMS 210 so that the call can continue.

[0059] If the analysis module 103 determines that the called number is not in the first whitelist, it may be necessary to further adopt other methods and conditions to determine whether the call request is suspected of being a fraudulent call.

[0060] In step 315, the analysis module 103 can determine whether the call originated from a risk area. A risk area table can be stored in the storage module 102. The risk area table records areas where fraudulent calls are prevalent. The operator can dynamically maintain the risk area table. For example, the operator can regularly add base station cells in newly added areas where fraudulent calls are prevalent to the risk area table, or can remove base station cells that are located in the risk area table but are re-identified as non-fraudulent call high-incidence areas from the risk area table. The analysis module 103 can obtain the cell ID or tracking area identifier (TAI) of the base station that sends the call request from the "P-Access-Network-Info" header field of the INVITE message to determine the location information of the base station cell. The location information can also be considered to be the approximate location of the calling user (or calling number).

[0061] If the analysis module 103 determines that the base station cell that issued the call request is not in the risk area, it can be determined that the call request is not a fraudulent call. The analysis module 103 can instruct the control module 101 to allow the call initiated by the calling number to continue. After receiving the instruction from the analysis module 103, the control module 101 will forward the data from the base station to the P-CSCF / SBC 203 of the IMS 210 so that the call can continue.

[0062] If the analysis module 103 determines that the base station cell that issues the call request is located in a risk area, it can be determined that the call request may be a fraudulent call, and other methods and conditions can be further used to make a judgment.

[0063] In step 316, the analysis module 103 may determine whether the calling number is in the second whitelist. The storage module 102 may store the second whitelist. The second whitelist is a list of calling numbers. The second whitelist may record calling numbers that have been determined not to be fraudulent calls. For example, the second whitelist may record mobile phone numbers used by police, emergency personnel, or public servants, and these phone numbers may be pre-registered with the operator and recorded in the second whitelist.

[0064] If the analysis module 103 determines that the calling number is in the second whitelist, the analysis module 103 can instruct the control module 101 to allow the call initiated by the calling number to continue. After receiving the instruction from the analysis module 103, the control module 101 forwards the data from the base station to the P-CSCF / SBC 203 of the IMS 210 so that the call can continue.

[0065] If the analysis module 103 determines that the calling number is not in the second whitelist, the call initiated by the calling number is likely to be a fraudulent call.

[0066] In step 317, the analysis module 103 may determine whether the calling number is a local user. For example, the analysis module 103 may determine whether the calling number is a local user based on the H code. The H code refers to the first seven digits of the mobile phone number. For example, in the mobile phone number 13912345678, the H code is the first seven digits, i.e., 1391234. The storage module 102 may store an H code table, which records the correspondence between the H code and the mobile phone number's location. The analysis module 103 may search the H code table stored in the storage module 102 for the location corresponding to the H code of the calling number, thereby determining the location of the calling number.

[0067] The analysis module 103 can determine whether the user initiating the call is a local user according to the location of the calling number. For example, if the analysis module 103 can determine whether the base station is located at the location of the calling number according to the location information of the base station and the location of the calling number. If the base station is located at the location of the calling number, the analysis module 103 can determine that the user initiating the call (i.e., the calling number) is a local user, otherwise it is not a local user.

[0068] If the analysis module 103 determines that the calling number is a local user, it can be considered that the call is not a fraudulent call. The analysis module 103 can instruct the control module 101 to allow the call initiated by the calling number to continue. After receiving the instruction from the analysis module 103, the control module 101 will forward the data from the base station to the P-CSCF / SBC203 of the IMS 210 so that the call can continue. In this way, the call initiated by the local user will not be affected.

[0069] When the analysis module 103 determines that the calling number is not a local user, the call initiated by the calling number may be a fraudulent call.

[0070] Finally, if the call initiated by the calling number is considered to be a fraudulent call in the analysis and judgment of the above steps 313, 314, 315, 316, and 317, the analysis module 103 can determine that the call initiated by the calling number is a fraudulent call. The analysis module 103 can send an instruction to the control module 101 to inform the control module 101 that the call initiated by the calling number is a fraudulent call. In step 318, the control module 101 can send instructions to the calling terminal and the called terminal to interrupt the call.

[0071] The method and device for preventing fraudulent calls according to the embodiments of the present disclosure are described above in conjunction with the accompanying drawings. In the embodiments of the present disclosure, the calling location of the caller can be controlled without the cooperation of the calling number or the called number's location. It is suitable for 4G / 5G card users and is compatible with IMS-based voice services such as VOLTE, VONR, and EPS Fallback. It solves the problem that the existing network-side anti-fraud system is mainly controlled by the user's location, resulting in a large impact, especially cross-border, cross-provincial, and cross-operator processing delays, complex processes, and coordination difficulties.

[0072] As used herein, the word "exemplary" means "serving as an example, instance, or illustration," rather than as a "model" to be exactly copied. Any implementation described as an example herein is not necessarily to be construed as preferred or advantageous over other implementations. Furthermore, the present disclosure is not limited by any expressed or implied theory given in the above technical field, background technology, summary of the invention, or detailed description.

[0073] In addition, certain terms may be used in the following description for reference purposes only and are not intended to be limiting. For example, the words "first," "second," and other such numerical words referring to structures or elements do not imply a sequence or order unless the context clearly indicates otherwise.

[0074] It should also be understood that when the term “include / comprises” is used in this document, it indicates the presence of the specified features, integers, steps, operations, units and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, units and / or components and / or their combinations.

[0075] In this disclosure, the term "provide" is used in a broad sense to cover all ways of obtaining an object, and thus "providing an object" includes but is not limited to "purchasing", "preparing / manufacturing", "arranging / setting up", "installing / assembling", and / or "ordering" an object, etc.

[0076] Those skilled in the art will appreciate that the boundaries between the above operations are merely illustrative. Multiple operations can be combined into a single operation, a single operation can be distributed in additional operations, and operations can be performed at least partially overlapping in time. Moreover, alternative embodiments may include multiple instances of specific operations, and the order of operations may be changed in other various embodiments. However, other modifications, variations, and replacements are equally possible. Therefore, this specification and accompanying drawings should be considered illustrative, not restrictive.

[0077] Although some specific embodiments of the present disclosure have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present disclosure. The various embodiments disclosed herein may be combined in any manner without departing from the spirit and scope of the present disclosure. It should also be understood by those skilled in the art that various modifications may be made to the embodiments without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A method for preventing fraudulent calls, comprising: receiving data from a base station; determining whether the data includes a call request; In response to the data including a call request, obtaining a calling number and a called number according to the call request; determining, according to the calling number, whether the calling number has previously sent data via the base station; In response to determining that the calling number has not previously sent data via the base station, determining whether the called number is in a first whitelist; In response to determining that the called number is not in the first whitelist, determining whether the call originated from the calling number in a risk area; In response to determining that the call originated from the calling number in the risk area, determining whether the calling number is in a second whitelist; In response to determining that the calling number is not in the second whitelist, determining whether the calling number is a local user; as well as In response to determining that the calling number is not a local user, sending instructions to the calling terminal and the called terminal to interrupt the call, Wherein, the method further comprises: In response to any one of the following: the data does not contain a call request, it is determined that the calling number has previously sent data via the base station, it is determined that the called number is in the first whitelist, it is determined that the call is not initiated in a risk area, the calling number is in the second whitelist, and it is determined that the calling number is a local user, it is determined that the data does not involve a fraudulent call, the data is not processed, and is transmitted transparently to the network.

2. The method according to claim 1, wherein: Determining that the data includes a call request includes: It is determined that the destination IP address included in the data is an access side address of a proxy call service control function or a session border controller.

3. The method according to claim 1, wherein: Determining, according to the calling number, that the calling number has not previously sent other call requests via the base station comprises: It is determined that the calling number has not sent other call requests via the base station within a predetermined period of time before sending the call request.

4. The method according to claim 3, wherein: The predetermined period is six months, one year, two years or five years.

5. The method according to claim 1, wherein: Determining that the call originated from the calling number in the risk area includes: Acquire location information of a base station cell from the call request; The call initiated by the calling number in the risk area is determined according to the location information and the risk area table.

6. The method according to claim 1, wherein: Determining that the calling number is not a local user includes: It is determined according to the H code in the calling number that the calling number is not a local user.

7. A device for preventing fraudulent calls, comprising: The control module is configured as follows: receiving data from a base station; determining whether the data includes a call request; as well as In response to receiving an instruction from the analysis module, sending an instruction to the calling terminal and the called terminal to interrupt the call; In response to not receiving the instruction from the analysis module, not processing the data and transparently transmitting it to the network; a storage module configured to store a first whitelist and a second whitelist, The analysis module is configured as follows: In response to the data including a call request, obtaining a calling number and a called number according to the call request; determining, according to the calling number, whether the calling number has previously sent data via the base station; In response to determining that the calling number has not previously sent data via the base station, determining whether the called number is in a first whitelist; In response to determining that the called number is not in the first whitelist, determining whether the call originated from the calling number in a risk area; In response to determining that the call originated from the calling number in the risk area, determining whether the calling number is in a second whitelist; In response to determining that the calling number is not in the second whitelist, determining whether the calling number is a local user; In response to determining that the calling number is not a local user, sending an instruction to a control module to interrupt the call; as well as In response to any one of the following: the data does not contain a call request, it is determined that the calling number has previously sent data via the base station, it is determined that the called number is in the first whitelist, it is determined that the call is not initiated in a risk area, the calling number is in the second whitelist, and it is determined that the calling number is a local user, it is determined that the data does not involve a fraudulent call, and no instructions are sent to the control module.

8. The device according to claim 7, wherein: The analysis module is further configured to: It is determined that the destination IP address included in the data is an access side address of a proxy call service control function or a session border controller.

9. The device according to claim 7, wherein: The analysis module is further configured to: It is determined that the calling number has not sent other call requests via the base station within a predetermined period of time before sending the call request.

10. The device according to claim 9, wherein: The predetermined period is six months, one year, two years or five years.

11. The device according to claim 7, wherein: The storage module is further configured to: Storage risk area table, The analysis module is further configured to: Acquire location information of a base station cell from the call request; A call initiated by the calling number in the risk area is determined according to the location information and the risk area table.

12. The device according to claim 7, wherein: The analysis module is further configured to: It is determined according to the H code in the calling number that the calling number is not a local user.

Images