A method, a terminal and a server for blocking harmful text messages

Abstract

The present invention discloses a method, a terminal and a server for blocking harmful text messages, comprising the following steps: intercepting the data content of a sending network element, and extracting text message data from the data content; constructing a transport layer, replying a transport layer confirmation message to the sending network element, and transmitting the text message content to a backend device for processing; receiving the text message processing result of the backend device; when the text message processing result is a harmful text message, intercepting the data content of the sending network element, generating a service response message, and transmitting the service response message to the sending network element; when the text message processing result is a normal text message, releasing the data content of the sending network element, intercepting the transport layer confirmation message of a receiving network element, and transparently transmitting the service response message generated by the receiving network element to the sending network element. The present invention realizes seamless connection under IP lines and back-to-back connection under TDM lines, has better application affinity and adaptability, and is applicable to various text message service scenarios including MT processes.

Description

Technical Field

[0001] The present invention relates to the field of SMS information processing, and in particular to a method, a terminal and a server for blocking harmful SMS messages. Background Art

[0002] The Short Message Service (SMS) refers to a reliable and low-cost wireless data service provided through a store-and-forward mechanism. As a basic telecommunication service, it mainly transmits text information of limited length through a signaling channel, including point-to-point short message service and cell broadcast short message service, etc. The process of a user sending an SMS can be divided into the MO (Mobile Originated) process and the MT (Mobile Terminated) process. In the MO process, the sending terminal user sends the SMS to the SMS center, and in the MT process, the SMS center sends the SMS to the receiving terminal user.

[0003] The existing methods for blocking harmful SMS messages mostly rely on third-party APPs on the mobile terminal user side for detection and reminder, resulting in a large amount of spam or harmful information being transmitted on the telecommunications network; and for specific SMS service scenarios, such as the SMS service scenarios of inter-provincial roaming users and international roaming users, since the SMS message itself does not carry the number of the called user, it is impossible to effectively identify and block the receiving SMS process of the user, that is, the MT process. On the other hand, the templates, samples, etc. used in the existing spam or harmful SMS detection and identification systems cannot be adaptively adjusted dynamically in real time according to the changes in the forms of fraud, harmful data, etc., and must be manually intervened, increasing the operation complexity of the system. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method, a terminal and a server for blocking harmful SMS messages.

[0005] The first aspect of the present invention provides a method for blocking harmful SMS messages, including the following steps:

[0006] Intercept the data content of the sending network element, and extract SMS data from the data content;

[0007] Construct a transport layer, send a transport layer confirmation message to the sending network element, and transmit the SMS content to the backend device for processing;

[0008] Receive the SMS processing result of the backend device;

[0009] When the SMS processing result is a harmful SMS message, intercept the data content of the sending network element, generate a service response message, and transmit the service response message to the sending network element;

[0010] When the SMS processing result is a normal SMS, release the data content of the sending network element, intercept the transport layer acknowledgment message of the receiving network element, and transparently transmit the service response message generated by the receiving network element to the sending network element.

[0011] Further, when the data transmission line is an IP line, the extraction of SMS data includes the following steps:

[0012] Perform rule matching on the data content according to preset rules; the rule matching includes data source matching, destination IP matching, interface matching, and protocol type matching;

[0013] When the rule matching is successful, extract the SMS data from the data content;

[0014] When the rule matching fails, transparently transmit the data content to the receiving network element.

[0015] Further, when the data transmission line is a TDM line, the extraction of SMS data includes the following steps:

[0016] Establish protocol connections including the MTP protocol, MTP2 protocol, and MTP3 protocol with the sending network element and the receiving network element;

[0017] Parse the MAP message operation code in the data content;

[0018] Identify whether the data content contains SMS data according to the MAP message operation code,

[0019] When the SMS data is identified, extract the SMS data from the data content;

[0020] When the SMS data is not identified, use the transport layer link of the receiving network element to transparently transmit the data content to the receiving network element.

[0021] Further, when the operation duration of the backend device exceeds the preset threshold value, perform the following steps:

[0022] Intercept the data content of the sending network element, generate a service response message, and transmit the service response message to the sending network element;

[0023] After receiving the SMS processing result of the backend device, if the SMS processing result is a normal SMS, release the data content of the sending network element, and intercept the transport layer acknowledgment message and the service response message generated by the receiving network element.

[0024] The second aspect of the present invention discloses a method for blocking harmful SMSs, including the following steps:

[0025] Receive the SMS content sent by the front-end device;

[0026] Analyze the numbers in the SMS content and perform number matching according to the numbers;

[0027] When the number matching result is a whitelist number, the SMS content is determined as a normal SMS;

[0028] When the number matching result is a blacklist number, the SMS content is determined as a harmful SMS;

[0029] When the number matching fails, perform SMS content analysis, and determine the SMS processing result according to the SMS content analysis result;

[0030] Send the SMS processing result to the front-end device.

[0031] Further, the numbers in the SMS content include the calling number, the called number, and the SMS center number;

[0032] The called number is restored through the accumulation of MAP messages in the IMSI, specifically including:

[0033] Accumulation of the correspondence between the SMS de-routing message and the response message between the HLR and the VLR;

[0034] Accumulation of the correspondence between the roaming number request and the response message between the HLR and the VLR;

[0035] Accumulation of the correspondence between the location update message request and the response message between the HLR and the VLR.

[0036] Further, the SMS content analysis includes SMS signaling analysis, SMS text content analysis, SMS behavior analysis, url identification and matching, fraud model detection, and sensitive content judgment.

[0037] Further, it also includes the following steps;

[0038] Store the SMS content analysis result in the information database, and perform offline learning on the SMS content analysis result stored in the information database; the offline learning includes communication behavior analysis, deep learning, and sample clustering;

[0039] Optimize the fraud model through the offline learning.

[0040] The present invention also discloses a terminal, including:

[0041] At least one processor;

[0042] At least one memory for storing at least one instruction, at least one program, a code set, or an instruction set;

[0043] When the at least one instruction, at least one program, a code set, or an instruction set is executed by the at least one processor, the at least one processor implements a method for blocking harmful SMS in the first aspect of the present invention.

[0044] The present invention also discloses a server, including:

[0045] At least one processor;

[0046] At least one memory for storing at least one instruction, at least one program, a code set or an instruction set;

[0047] When the at least one instruction, at least one program, a code set or an instruction set is executed by the at least one processor, the at least one processor implements a method for blocking harmful text messages according to the second aspect of the present invention.

[0048] The embodiment of the present invention also discloses a computer program product or a computer program. The computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the foregoing method.

[0049] The present invention has the following beneficial effects: Through the seamless series connection under the IP line and the back-to-back series connection under the TDM line, the present invention realizes online detection of data, online identification, and online blocking of harmful information on the necessary channels for the transmission of harmful text messages in the 2 / 3G network of the telecommunications network. Since the present invention is transparent and seamless to the in-network devices of the telecommunications network, there is no need to adapt, upgrade or modify the in-network devices, so that the present invention has better application affinity and adaptability. Moreover, the present invention can extract the called numbers of text message messages, and is applicable to various text message service scenarios including the MT process compared with the prior art. The present invention also has an offline learning function, and continuously improves the ability to identify and judge harmful text messages through machine learning.

[0050] The additional aspects and advantages of the present invention will be given in the following description section, some of which will become obvious from the following description, or can be understood through the practice of the present invention. Description of the Drawings

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0052] Figure 1 It is a composition diagram of the front-end and back-end devices of a method for blocking harmful text messages, a terminal and a server according to the present invention;

[0053] Figure 2Flow chart of the steps executed by the front-end device for a method, a terminal, and a server for blocking harmful text messages according to the present invention;

[0054] Figure 3 Flow chart of the steps executed by the back-end device for a method, a terminal, and a server for blocking harmful text messages according to the present invention. Detailed implementation manners

[0055] In order to make the objectives, technical solutions, and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] The present invention mainly consists of front-end and back-end devices at two levels. The front-end devices are composed of dedicated devices distributed in series at the positions of SMS routing nodes in the 2 / 3G network of the telecommunication network in a distributed manner. They are responsible for back-to-back series connection of TDM (64K, 2Mbit / s) lines and seamless series connection of IP lines. They can operate in the 2 / 3G network and support protocols such as SIGTRAN protocol, No. 7 signaling protocol, and MAP protocol, and complete data access and data reinjection of the dedicated lines of the telecommunication network. The back-end devices are composed of general servers. By using clustered deployment, the high efficiency of data processing is fully utilized to achieve fast and reliable processing of massive traffic data, such as completing SMS content / behavior / frequency analysis, detection, judgment, data storage, and offline learning. By using the two-level method of the front-end and back-end, flexible deployment of access is realized, with telecom-level reliable access capabilities, and at the same time, fast analysis and detection of massive data are available. The two levels work together, and the back-end device notifies the front-end device of the results of data judgment and analysis.

[0057] Embodiment 1 describes the process of the front-end device for a method of blocking harmful text messages. The composition of the front-end device refers to the attached Figure 1 , and the steps for execution refer to the attached Figure 2 . The front-end device executes the following steps:

[0058] S1. Intercept the data content of the sending network element, and extract the SMS data from the data content;

[0059] In Embodiment 1, the front-end device is connected between the existing network sending network element (denoted as Network Element A) and the receiving network element (denoted as Network Element B), obtains the signaling in the line, and extracts the SMS data.

[0060] S2. Construct a transport layer, reply to the sending network element with a transport layer confirmation message, and transmit the SMS content to the back-end device for processing;

[0061] Since reliable transmission protocols are generally adopted for line data transmission (such as the SCTP transmission mode in the SIGTRAN protocol, the No. 7 signaling in the TDM line, etc.), such as the DATA message and the SACK message in the SCTP protocol, where the SACK is the confirmation message of the DATA message. After the line data is accessed, filtered, and extracted by the front-end device, to ensure reliable data transmission and avoid causing any perception in the network elements in the telecommunications network, resulting in data retransmission and network element alarms, the front-end device needs to reply with the confirmation message of the transport layer protocol, that is, the front-end device needs to generate the confirmation message of the current network line transport layer data.

[0062] In Embodiment 1, the data injection unit is used to reply with the confirmation message of the transport layer to Network Element A, preventing Network Element A from retransmitting due to not receiving the transport layer confirmation due to timeout.

[0063] S3. Receive the SMS processing result of the back-end device;

[0064] S3-A. When the SMS processing result is a harmful SMS, intercept the data content of the sending network element, generate a service response message, and transmit the service response message to the sending network element;

[0065] S3-B. When the SMS processing result is a normal SMS, release the data content of the sending network element, intercept the transport layer confirmation message of the receiving network element, and transparently transmit the service response message generated by the receiving network element to the sending network element.

[0066] In addition to the reliability requirements of the transport layer in the telecommunications network, the service layer also has service reliability requirements, that is, the service request message also requires the peer network element device to reply with a service confirmation message, such as the request and the corresponding Report message in the MAP message. Generally, the interval between the service request and confirmation messages in the telecommunications network is at the second level. After the tandem device extracts the SMS message that needs to be identified and detected, since the back-end analysis and detection take time, and at the same time, if the message processed by the front-end device is a harmful SMS, this message needs to be blocked and intercepted.

[0067] The front-end device in Embodiment 1 has the ability to generate a service confirmation message, and the data blocking unit generates a response message of this SMS service message to Network Element A, avoiding retransmission caused by service layer timeout, and Network Element B cannot receive this message, realizing the blocking of harmful messages during the transmission process in the telecommunications network.

[0068] In Embodiment 1, when Network Element A sends a service request message to Network Element B, the data content will enter the online access module of the front-end device, and the data processing unit extracts the data containing the SMS message from the line.

[0069] When the data transmission line is an IP line, the extraction of SMS data includes the following steps:

[0070] S1-A1. Match the data content according to the preset rules; the rule matching includes data source matching, destination IP matching, interface matching, and protocol type matching;

[0071] When the rule matching is successful, extract the short message data from the data content;

[0072] When the rule matching fails, transparently transmit the data content to the receiving network element.

[0073] In Embodiment 1, according to the configured data, the IP access unit of the front-end device performs five-tuple matching on the data entering the front-end device based on the data source, destination IP, interface, and protocol type as a five-tuple, forwards the data that meets the five-tuple rules to the inside of the front-end device by the line access unit, and directly transparently transmits the unmatched data to the line.

[0074] When the data transmission line is a TDM line, the extraction of the short message data includes the following steps:

[0075] S1-B1. Establish protocol connections including the MTP protocol, MTP2 protocol, and MTP3 protocol with the sending network element and the receiving network element;

[0076] S1-B2. Analyze the MAP message operation code in the data content;

[0077] S1-B3. Identify whether the data content contains short message data according to the MAP message operation code,

[0078] When the short message data is recognized, extract the short message data from the data content;

[0079] When the short message data is not recognized, use the transport layer link of the receiving network element to transparently transmit the data content to the receiving network element.

[0080] When the transmission line is a TDM line, the front-end device is mainly responsible for maintaining the transport layer links with both ends, so it can directly use the transport layer link with the B network element to send to the A network element.

[0081] In Embodiment 1, when the operation duration of the back-end device exceeds the preset threshold value, the front-end device further performs the following steps:

[0082] S3-C1. Intercept the data content of the sending network element, generate a service response message, and transmit the service response message to the sending network element;

[0083] S3-C2. After receiving the short message processing result of the back-end device, if the short message processing result is a normal short message, release the data content of the sending network element, and intercept the transport layer confirmation message of the receiving network element and the service response message generated by the receiving network element.

[0084] In Embodiment 1, by filtering text messages, non-text message content and text message data that do not need to be processed are directly passed through to the line, and text messages that need to be processed directly construct transport layer confirmation messages. When the access mode is an IP line, the front-end device is responsible for maintaining the transport layer sequence numbers of both parties. Therefore, when the front-end device exits the line, NE B does not generate abnormal alarms. When the access mode is a TDM line, since the front-end device works in the form of a back-to-back network element, when the TDM line is accessed and then exited, NE B will experience an alarm and then quickly restore the normal transmission channel. The front-end device in Embodiment 1 has the function of seamlessly connecting IP lines between telecom network elements and connecting in a back-to-back manner for TDM lines.

[0085] Embodiment 2 describes the back-end device process of a harmful text message blocking method. The composition of the back-end device refers to Appendix Figure 1 , and the execution steps refer to Appendix Figure 3 . The back-end service analysis in Embodiment 2 adopts cluster deployment, using high-performance servers to ensure the timeliness of data processing. Harmful text messages are identified through text message signaling analysis, content analysis, frequency, behavior, etc. The back-end device executes the following steps:

[0086] S1. Receive the text message content sent by the front-end device.

[0087] S2. Analyze the numbers in the text message content and perform number matching based on the numbers.

[0088] Step S2 is mainly completed by the online analysis module of the back-end device.

[0089] In step S2, the numbers in the text message content include the calling number, the called number, and the SMS center number; in the MT process of the text message, that is, when the user is the recipient and receives the text message, since the called number is not carried in the message, the called number needs to be restored according to the IMSI.

[0090] The called number is restored through the accumulation of MAP messages in the IMSI, specifically including:

[0091] The accumulation of the correspondence between the SMS de-routing message and the response message between the HLR and the VLR;

[0092] The accumulation of the correspondence between the roaming number request and the response message between the HLR and the VLR;

[0093] The accumulation of the correspondence between the location update message request and the response message between the HLR and the VLR.

[0094] In Embodiment 2, the back-end device can restore the called IMSI in the MT process message to the real called user's mobile phone number for subsequent service analysis and processing. The MAP message used is the message in the inter-provincial line.

[0095] S2-A. When the number matching result is a whitelist number, determine the SMS content as a normal SMS;

[0096] S2-B. When the number matching result is a blacklist number, determine the SMS content as a harmful SMS;

[0097] In Embodiment 2, the backend device is provided with a number database, which stores whitelist numbers and blacklist numbers to complete the determination of SMS content.

[0098] S2-C. When the number matching fails, perform SMS content analysis, and determine the SMS processing result according to the SMS content analysis result;

[0099] In Embodiment 2, the SMS content analysis includes SMS signaling analysis, SMS text content analysis, SMS behavior analysis, url identification and matching, fraud model detection, and sensitive content judgment. In Embodiment 2, the backend device is provided with a harmful information database, which includes a sample database and a model database, and completes the SMS content analysis by comparing the SMS content with the existing data in the sample database and the model database.

[0100] S3. Send the SMS processing result to the front-end device.

[0101] In Embodiment 2, the backend device also performs the following steps;

[0102] Store the SMS content analysis result in the information database, and perform offline learning on the SMS content analysis result stored in the information database; Offline learning includes communication behavior analysis, deep learning, and sample clustering;

[0103] Optimize the fraud model through offline learning.

[0104] In Embodiment 2, the backend device is provided with an offline learning module, and completes offline learning through the communication behavior analysis unit, sample clustering unit, and deep learning unit in the offline learning module; Generate a fraud model through the model generation unit; Update the sample database, model database, and number database in the harmful information database through the harmful information database update unit. In Embodiment 2, through means such as offline data analysis, data mining, and machine learning, the system model, samples, etc. are adaptively optimized and updated, and the self-learning ability of models and samples for harmful SMS such as spam, fraud, and anti-propaganda can be realized, enabling the backend device to have the ability to detect and block immediately.

[0105] In some alternative embodiments, the functions / operations recited in the block diagrams may not occur in the order presented in the operational illustrations. For example, depending on the functions / operations involved, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in reverse order. Further, the embodiments presented and described in the flowcharts of the present invention are provided by way of example in order to provide a more thorough understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is altered and in which sub-operations described as part of a larger operation are performed independently.

[0106] Furthermore, although the present invention has been described in the context of functional modules, it should be understood that unless otherwise stated to the contrary, one or more of the described functions and / or features may be integrated in a single physical device and / or software module, or one or more functions and / or features may be implemented in separate physical devices or software modules. It should also be understood that a detailed discussion of the actual implementation of each module is not necessary for an understanding of the present invention. Rather, given the attributes, functions, and internal relationships of the various functional modules in the devices disclosed herein, the actual implementation of the modules will be apparent to those of ordinary skill in the art. Accordingly, those skilled in the art can implement the present invention as set forth in the claims without undue experimentation. It should also be understood that the particular concepts disclosed are illustrative only and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0107] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a list of executable instructions for implementing logical functions and can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other systems that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. As used in this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

[0108] Although embodiments of the present invention have been shown and described, those of ordinary skill in the art can understand that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the claims and their equivalents.

[0109] The above is a specific description of the preferred embodiment of the present invention. However, the present invention is not limited to the described embodiment. Those skilled in the art can make various equivalent deformations or substitutions without departing from the spirit of the present invention, and these equivalent deformations or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A method for blocking harmful text messages, which is applied to front-end devices of a telecommunications network, is characterized in that It includes the following steps: Intercept the data content of the sending network element, and extract the short message data from the data content; Construct a transport layer, reply to the sending network element with a transport layer confirmation message, and transmit the short message content to the backend device for processing; Receive the short message processing result of the backend device; When the short message processing result is a harmful short message, intercept the data content of the sending network element, generate a service response message, and transmit the service response message to the sending network element; When the short message processing result is a normal short message, release the data content of the sending network element, intercept the transport layer confirmation message of the receiving network element, and transparently transmit the service response message generated by the receiving network element to the sending network element.

2. The blocking method for harmful text messages according to claim 1, characterized in that, When the data transmission line is an IP line, the extraction of short message data includes the following steps: Perform rule matching on the data content according to preset rules; the rule matching includes data source matching, destination IP matching, interface matching, and protocol type matching; When the rule matching is successful, extract the short message data from the data content; When the rule matching fails, transparently transmit the data content to the receiving network element.

3. The blocking method for harmful text messages according to claim 1, wherein, When the data transmission line is a TDM line, the extraction of short message data includes the following steps: Establish protocol connections including the MTP protocol, MTP2 protocol, and MTP3 protocol with the sending network element and the receiving network element; Parse the MAP message operation code in the data content; Identify whether the data content contains short message data according to the MAP message operation code, When short message data is identified, extract the short message data from the data content; When short message data is not identified, use the transport layer link of the receiving network element to transparently transmit the data content to the receiving network element.

4. A method for blocking harmful text messages according to claim 1, characterized in that, When the operation duration of the backend device exceeds the preset threshold value, perform the following steps: Intercept the data content of the sending network element, generate a service response message, and transmit the service response message to the sending network element; After receiving the short message processing result of the backend device, if the short message processing result is a normal short message, release the data content of the sending network element, and intercept the transport layer confirmation message and the service response message generated by the receiving network element.

5. A method for blocking harmful text messages, which is applied to the backend device of a telecommunications network, and the corresponding frontend device executes a method for blocking harmful text messages according to any one of claims 1-4, characterized in that It includes the following steps: Receive the short message content sent by the front-end device; Analyze the numbers in the short message content and perform number matching according to the numbers; When the number matching result is a whitelist number, determine the short message content as a normal short message; When the number matching result is a blacklist number, determine the short message content as a harmful short message; When the number matching fails, perform short message content analysis, and determine the short message processing result according to the short message content analysis result; Send the short message processing result to the front-end device.

6. A method for blocking harmful text messages according to claim 5, characterized in that, The numbers in the short message content include the calling number, the called number, and the short message center number; The called number is restored through the accumulation of MAP messages in the IMSI, and specifically includes: Accumulation of the corresponding relationship between the short message de-routing message and the response message between the HLR and the VLR; Accumulation of the corresponding relationship between the roaming number request and the response message between the HLR and the VLR; Accumulation of the corresponding relationship between the location update message request and the response message between the HLR and the VLR.

7. A method for blocking harmful text messages according to claim 5, characterized in that, The short message content analysis includes short message signaling analysis, short message text content analysis, short message behavior analysis, url identification and matching, fraud model detection, and sensitive content research and judgment.

8. The blocking method for harmful text messages according to claim 7, characterized in that, It also includes the following steps; Store the analysis result of the SMS content in the information database, and perform offline learning on the analysis result of the SMS content stored in the information database; the offline learning includes communication behavior analysis, deep learning, and sample clustering; Optimize the fraud model through the offline learning.

9. A terminal, characterized in that, Comprising: At least one processor; At least one memory for storing at least one instruction, at least one program, a code set or an instruction set; When the at least one instruction, at least one program, the code set or the instruction set is executed by the at least one processor, enabling the at least one processor to implement the method according to any one of claims 1-4.

10. A server, characterized in that, Comprising: At least one processor; At least one memory for storing at least one instruction, at least one program, a code set or an instruction set; When the at least one instruction, at least one program, the code set or the instruction set is executed by the at least one processor, enabling the at least one processor to implement the method according to any one of claims 5-8.

Images