Information identification method, device, equipment and readable storage medium

Abstract

The present application discloses an information identification method, device, equipment and readable storage medium, the method includes: constructing a VOS system detection fingerprint library and a GOIP device traffic fingerprint library to obtain the transmission characteristics of the IMSI number; obtaining information of the fraudulent VOS system according to the detection fingerprint library, and obtaining the inflow and outflow traffic of the fraudulent VOS system according to the information; identifying the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library and the inflow and outflow traffic, extracting the IP address and original traffic of the GOIP device; obtaining the fraudulent IMSI number according to the original traffic and transmission characteristics, and locating the GOIP device according to the IP address and the fraudulent IMSI number. The technical solution disclosed in the present application adopts the traffic fingerprint method to effectively identify the GOIP device, and realizes the effective identification of the fraudulent SIM card, and realizes the positioning of the GOIP device based on the IP address and the fraudulent IMSI number.

Description

Technical Field

[0001] The present application relates to the field of information identification technology, and more specifically, to an information identification method, device, equipment and readable storage medium. Background Art

[0002] Telephone technology has developed to the "device-card separation" mode, that is, the target person uses technical means to split the functions of ordinary mobile phones into baseband and radio frequency parts. The baseband part is carried by SIMBANK (Subscriber Identity Module BANK) deployed abroad, a device that can centrally store and manage a large number of SIM cards, and the radio frequency part is carried by GOIP (GSM OVER IP, a virtual dialing device) devices deployed in various provinces across the country. Under this model, the target person can change the correspondence between SIM (Subscriber Identity Module) and GOIP at will when making a call, thereby circumventing operational big data analysis, evading crackdowns, and hiding high-value SIM cards.

[0003] At present, when performing identification, it is mainly implemented based on the operator's big data behavior analysis modeling method. Specifically, the number is modeled and analyzed by analyzing the call time, duration, roaming situation, called discrete situation, caller-called ratio, call interval and other network access information. The model is unstable due to the large amount of analysis data and impure samples. The behavioral rules summarized can only be applied to some scammers because the relevant units have few and difficult to obtain samples. Therefore, the accuracy of identification is relatively low and the fraudulent SIM card cannot be effectively identified. In addition, since the correspondence between SIM and GOIP can be arbitrarily modified in the machine-card separation mode, the existing method based on operator big data behavior analysis modeling cannot effectively identify and locate GOIP devices.

[0004] In summary, how to effectively identify fraudulent SIM cards and GOIP devices and locate GOIP devices is a technical problem that needs to be urgently solved by those skilled in the art. Summary of the invention

[0005] In view of this, the purpose of this application is to provide an information identification method, device, equipment and readable storage medium for effectively identifying fraudulent SIM cards and GOIP devices, and locating the GOIP devices.

[0006] In order to achieve the above objectives, this application provides the following technical solutions:

[0007] An information identification method, comprising:

[0008] By analyzing the VOS system and GOIP device involved in the case in advance, a VOS system detection fingerprint library and a GOIP device traffic fingerprint library are constructed, and the transmission characteristics of the IMSI number are obtained based on the traffic between the GOIP device and the SIMBANK device;

[0009] Acquire information of the fraudulent VOS system according to the VOS system detection fingerprint library, and acquire inflow and outflow traffic of the fraudulent VOS system according to the information of the fraudulent VOS system;

[0010] Identify the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and extract the IP address and original traffic of the GOIP device;

[0011] The fraudulent IMSI number is obtained according to the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and the GOIP device is located according to the IP address of the GOIP device and the fraudulent IMSI number.

[0012] Preferably, when the VOS system detection fingerprint library and the traffic fingerprint library of the GOIP device are constructed in advance by analyzing the VOS system involved in the case and the GOIP device involved in the case, it also includes:

[0013] By analyzing the SIMBANK devices involved in the case, a traffic fingerprint library of the SIMBANK devices is constructed;

[0014] When the GOIP device connected to the fraudulent VOS system is identified according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, the method further includes:

[0015] The SIMBANK device connected to the fraudulent VOS system is identified according to the traffic fingerprint library of the SIMBANK device and the inflow and outflow traffic of the fraudulent VOS system, and the IP address of the SIMBANK device is extracted.

[0016] Preferably, locating the GOIP device according to the IP address of the GOIP device and the fraudulent IMSI number includes:

[0017] Locate the rough location of the GOIP device according to the IP address of the GOIP device;

[0018] According to the fraudulent IMSI number, the network access information of the fraudulent IMSI number is obtained in combination with the operator signaling message, and the precise location of the GOIP device is located according to the network access information.

[0019] Preferably, obtaining the network access information of the fraudulent IMSI number includes:

[0020] Obtain the TAC and ECGI of the fraudulent IMSI number.

[0021] Preferably, obtaining the information of the fraudulent VOS system according to the VOS system detection fingerprint library includes:

[0022] According to the VOS system detection fingerprint library, the information of the fraudulent VOS system is obtained by using a cyberspace mapping method.

[0023] Preferably, it also includes:

[0024] Output the fraudulent IMSI number and the location of the GOIP device.

[0025] An information identification device, comprising:

[0026] The first construction module is used for the first construction module to construct a VOS system detection fingerprint library and a GOIP device traffic fingerprint library in advance by analyzing the VOS system and the GOIP device involved in the case, and obtain the transmission characteristics of the IMSI number according to the traffic between the GOIP device and the SIMBANK device;

[0027] An acquisition module, configured to acquire information of a fraudulent VOS system according to the VOS system detection fingerprint library, and acquire inflow and outflow traffic of the fraudulent VOS system according to the information of the fraudulent VOS system;

[0028] A first identification module is used to identify the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and extract the IP address and original traffic of the GOIP device;

[0029] The positioning module is used to obtain the fraudulent IMSI number according to the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and locate the GOIP device according to the IP address of the GOIP device and the fraudulent IMSI number.

[0030] Preferably, it also includes:

[0031] The second construction module is used to construct the traffic fingerprint library of the SIMBANK device by analyzing the SIMBANK device involved in the case, when the VOS system detection fingerprint library and the traffic fingerprint library of the GOIP device are constructed in advance by analyzing the VOS system and the GOIP device involved in the case;

[0032] The second identification module is used to identify the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, identify the SIMBANK device connected to the fraudulent VOS system according to the traffic fingerprint library of the SIMBANK device and the inflow and outflow traffic of the fraudulent VOS system, and extract the IP address of the SIMBANK device.

[0033] An information recognition device, comprising:

[0034] Memory for storing computer programs;

[0035] A processor is used to implement the steps of the information identification method as described in any one of the above when executing the computer program.

[0036] A readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the information identification method as described in any one of the above items are implemented.

[0037] The present application provides an information identification method, apparatus, device and readable storage medium, wherein the method comprises: constructing a VOS system detection fingerprint library and a traffic fingerprint library of a GOIP device in advance by analyzing the VOS system involved in the case and the GOIP device involved in the case, and obtaining the transmission characteristics of the IMSI number according to the traffic between the GOIP device and the SIMBANK device; obtaining information of the fraudulent VOS system according to the fraudulent VOS system detection fingerprint library, and obtaining the inflow and outflow traffic of the fraudulent VOS system according to the information of the fraudulent VOS system; identifying the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and extracting the IP address and original traffic of the GOIP device; obtaining the fraudulent IMSI number according to the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and locating the GOIP device according to the IP address of the GOIP device and the fraudulent IMSI number.

[0038] The above technical scheme disclosed in the present application builds a VOS system detection fingerprint library by analyzing the VOS system involved in the case, and builds a traffic fingerprint library of the GOIP device by pre-analyzing the GOIP device involved in the case. Then, fingerprint identification is performed according to the constructed VOS system detection fingerprint library to obtain information of the fraudulent VOS system and further obtain the inflow and outflow traffic of the fraudulent VOS system. After that, the GOIP device connected to the fraudulent VOS system is identified and determined according to the traffic fingerprint library of the constructed GOIP device and the inflow and outflow traffic of the fraudulent VOS system, so as to achieve effective identification of the GOIP device by adopting the traffic fingerprint method, thereby avoiding the problems of large investment resources, large amount of analysis data and low identification accuracy in the existing big data analysis. And while performing traffic identification on the inflow and outflow traffic of the fraudulent VOS system, the IP address and original traffic of the GOIP device can also be extracted from it. Then, the fraudulent IMSI number (i.e., SIM card number) is obtained according to the original traffic of the GOIP device and the transmission characteristics of the IMSI number obtained in advance according to the traffic between the GOIP device and the SIMBANK device, thereby achieving effective identification of the fraudulent SIM card and providing a basis for the operator to shut down the fraudulent number. In addition, after extracting the IP address of the GOIP device and obtaining the fraudulent IMSI number associated with the GOIP device, the GOIP device is located based on the IP address of the GOIP device and the obtained fraudulent IMSI number, providing technical support for relevant units to confiscate the fraudulent devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0040] Figure 1 A schematic diagram of a telephone with an existing machine-card separation method;

[0041] Figure 2 This is a schematic diagram of machine-card separation deployment;

[0042] Figure 3 A flowchart of an information identification method provided in an embodiment of the present application;

[0043] Figure 4 A schematic diagram of the structure of an information identification device provided in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of the structure of an information identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] At present, telephone technology has developed to the separation of machine and card, that is, by separating the baseband function and radio frequency function of the mobile phone, the baseband function is carried by SIMBANK, and the radio frequency function is carried by GOIP, that is, the SIM card and GOIP are separated, thus realizing the hiding of high-value SIM cards, and the call correspondence relationship can be changed arbitrarily, avoiding the measures of big data analysis and identification of telephones. For details, please refer to Figure 1 , which shows a schematic diagram of the existing phone with machine-card separation. Among them, the GOIP device is a hardware device for network communication, which supports mobile phone card access and can convert traditional telephone signals into network signals. One device can be used for hundreds of mobile phone SIM cards to operate at the same time, and can also remotely control SIM cards and GOIP devices in other places to make calls and send and receive text messages, realizing the separation of people and SIM cards, and achieving the purpose of hiding identities and evading attacks. At the same time, it can dial virtually and can switch mobile phone numbers at will to call the victim. It is extremely difficult for relevant units to counter-intercept and trace the signal. Therefore, it has gradually become a new means of analysis. The SIMBANK device is an upgraded version of GOIP. SIMBANK realizes the centralized management of mobile phone cards, and the GOIP device only realizes the function of accessing the network, thereby enhancing the means of evading attacks.

[0046] At present, the telephone identification solution based on operator big data mainly models telephone numbers through behavioral analysis. The modeling and analysis of numbers is carried out by analyzing telephone call time, duration, roaming status, called discrete status, caller-called ratio, call interval and other network access information. The method is as follows:

[0047] 1. Based on the number of cases reported by relevant units in the 12321 complaint data set, extract the call details of the fraudulent numbers on the day of the report and in the past N days, and clean the call details;

[0048] 2. Based on key data dimensions, including caller-caller ratio, caller dispersion, average call duration, caller location, dialing area dispersion, concentrated time points, repeated call ratio, and other call behavior characteristics of the statistical numbers;

[0049] 3. Compare the call behavior characteristics of normal users and numbers, and analyze the situations in different scenarios;

[0050] 4. Build models for known normal users and samples, evaluate the model’s performance in training and test sets, and test the model’s performance in detecting suspicious numbers in actual operation;

[0051] 5. Based on the feedback from operators and related units, analyze the model’s false alarms and continuously optimize it based on new samples.

[0052] However, the above technical solution has the following technical difficulties:

[0053] 1) It is difficult to clean the 12321 complaint samples: The 12321 complaint samples include false reports such as number changes, excessive marketing or harassment, which requires a lot of time to clean the data and proofread. How to choose the appropriate positive (numerator) and negative (normal users) is very challenging. The impure samples have a great impact on the modeling work and may cause the model to be unstable, resulting in low recognition accuracy.

[0054] 2) The samples of cases reported by relevant units are too few and difficult to obtain. Therefore, these samples may not be representative of the entire fraud period. The behavioral patterns summarized from these samples can only be applicable to some scammers, which leads to overfitting. Therefore, when applied to recognition, the accuracy of recognition will be reduced.

[0055] 3) The accuracy rate is getting higher and higher, the wide-net approach is becoming less and less effective, and behavior-based methods are becoming increasingly difficult to discover and identify fraudulent SIM cards.

[0056] 4) Techniques change quickly and model research often lags behind, resulting in inaccurate identification.

[0057] 5) The provincial operator company cannot obtain roaming details, thus missing a large amount of analyzable data. Currently, the provincial operator company cannot obtain roaming details. The existing operator's evaluation mechanism uses the SIM card issuing province as the responsible unit. In the "device-card separation" scenario, the crime analysis can change the GOIP device corresponding to the SIM card at will. Therefore, there will be a situation where one call is dialed from Province A and the next call is dialed from Province B. For details, please refer to Figure 2 , which shows a schematic diagram of the machine-card separation deployment. The above situation will cause the operator in Province A to be unable to know whether the issued phone card is used to make calls in Province B, resulting in a large amount of analyzable data being lost, which will in turn reduce the accuracy of recognition and make it impossible to effectively identify and locate the GOIP device.

[0058] To this end, the present application provides an information identification method, apparatus, device and readable storage medium for effectively identifying fraudulent SIM cards and GOIP devices, and locating the GOIP devices.

[0059] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0060] See also Figure 3, which shows a flow chart of an information identification method provided in an embodiment of the present application. An information identification method provided in an embodiment of the present application may include:

[0061] S11: Preliminarily build a VOS system detection fingerprint library and a GOIP device traffic fingerprint library by analyzing the VOS system and GOIP device involved in the case, and obtain the transmission characteristics of the IMSI number based on the traffic between the GOIP device and the SIMBANK device.

[0062] When performing information identification, a VOS system detection fingerprint library can be constructed in advance by analyzing the VOS (VOIP Operation Support Systems, VOIP (Voice over Internet Protocol, a voice call technology that uses the Internet Protocol (IP) to achieve voice calls and multimedia conferences, that is, to communicate via the Internet) operation support system) system involved in the case provided by relevant units, wherein the VOS system mentioned here is the VOS system involved in the case. Specifically, the VOS system detection fingerprint library can be constructed by analyzing the specific information such as the ports, protocols, services, and response packet characteristics opened by the VOS system involved in the case on the Internet public network. Among them, the constructed fraud VOS system detection fingerprint library is a data depiction that is difficult to completely disguise the VOS system and its homologous and homogeneous systems. Therefore, the constructed VOS system detection fingerprint library can be used to identify the fraud VOS system from various types of VOS systems such as marketing VOS systems, promotion VOS systems, credit card VOS systems, and fraud VOS systems.

[0063] Moreover, the traffic fingerprint library of the GOIP device (i.e. the GOIP device involved in the case) can be constructed in advance by analyzing the GOIP devices involved in the case provided by relevant units. Specifically, the traffic fingerprint library of the GOIP device can be constructed by disassembling the GOIP device involved in the case, analyzing the software code and device network behavior of the device, and extracting the interaction information of the device. Among them, the device network behavior and the interaction information of the device can be specifically analyzed and obtained by connecting the GOIP device involved in the case to the network. The traffic fingerprint library of the constructed GOIP device can be used as a universal feature to uniquely determine this type of device through Internet network traffic, so as to facilitate the identification and acquisition of relevant information of the fraudulent GOIP device based on this.

[0064] In addition, the traffic between the GOIP device and the SIMBANK device (i.e., the SIMBANK device involved in the case) can also be obtained, and the transmission characteristics of the IMSI (International Mobile Subscriber Identity, which is an identification code used to distinguish different users in a cellular network and is not repeated in all cellular networks) number can be extracted from the traffic between the two. The transmission characteristics indicate that the field to be transmitted later is the SIM card number (i.e., the IMSI number). That is, by obtaining the transmission characteristics of the IMSI number, the IMSI number can be determined from the traffic between the SIMBANK devices corresponding to the GOIP device.

[0065] It should be noted that since the GOIP device involved in the case is located in China and the SIMBANK device is generally located abroad, there is a large transmission delay between the two, and the operator's mobile communication network has restrictions on the maximum delay, so the two can only use UDP (User Datagram Protocol) with a smaller delay to transmit IMSI and authentication parameters. Based on this, it can be seen that this application can specifically obtain the UDP traffic between the GOIP device and the SIMBANK device, and extract the transmission characteristics of the IMSI number from the obtained UDP traffic.

[0066] It should also be noted that step S11 can be specifically performed before the first information identification is performed. When information identification is required again, the fraud VOS system detection fingerprint library and the traffic fingerprint library of the GOIP device constructed by step S11 and the transmission characteristics of the acquired IMSI number can be directly used, that is, there is no need to perform step S11 every time information identification is performed, so as to improve the efficiency of information identification. Of course, as the number of cases obtained by the relevant units increases, step S11 can also be performed regularly or according to actual needs, so as to enrich the constructed VOS system detection fingerprint library and the traffic fingerprint library of the GOIP device, so as to improve the accuracy of information identification when information identification is performed based on this.

[0067] S12: Obtain information about the fraudulent VOS system according to the VOS system detection fingerprint database, and obtain inflow and outflow traffic of the fraudulent VOS system according to the information about the fraudulent VOS system.

[0068] When performing information identification, the information of the fraudulent VOS system can be obtained according to the VOS system detection fingerprint library constructed in step S11, and specifically the IP (Internet Protocol) address, location, access service provider and other information of the fraudulent VOS system can be obtained. The access service provider specifically refers to the service provider deployed by the fraudulent VOS system. Among them, by obtaining the information of the fraudulent VOS system, it is convenient to accurately obtain the inflow and outflow traffic of the fraudulent VOS based on this information.

[0069] After obtaining the information of the fraudulent VOS system, the inflow and outflow traffic of the fraudulent VOS system (i.e., the inflow and outflow traffic of the fraudulent VOS system) can be obtained through linkage with the operator (specifically, the network service provider) based on the obtained information of the fraudulent VOS system, so as to identify the information based on the inflow and outflow traffic of the fraudulent VOS system.

[0070] S13: Identify the GOIP device connected to the fraudulent VOS system based on the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and extract the IP address and original traffic of the GOIP device.

[0071] After obtaining the inflow and outflow traffic of the fraudulent VOS system, the inflow and outflow traffic of the fraudulent VOS system obtained in step S12 can be matched based on the traffic fingerprint library of the fraudulent GOIP device constructed in step S11 to identify the GOIP device connected to the fraudulent VOS system, and extract the IP address and original traffic of the GOIP device connected to the fraudulent VOS system from the inflow and outflow traffic of the fraudulent VOS system.

[0072] S14: Obtain the fraudulent IMSI number according to the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and locate the GOIP device according to the IP address of the GOIP device and the fraudulent IMSI number.

[0073] After obtaining the original traffic of the GOIP device connected to the VOS system, the fraudulent IMSI number can be obtained from the original traffic of the GOIP device connected to the VOS system through the original traffic of the GOIP device connected to the VOS system and the transmission characteristics of the IMSI number obtained in step S11, thereby identifying the fraudulent SIM card.

[0074] In addition, the GOIP device connected to the VOS system can be located according to the IP address of the GOIP device connected to the VOS system and the obtained fraudulent IMSI number to determine the location information of the GOIP device.

[0075] Through the above process, it can be seen that this application uses traffic fingerprints to identify the GOIP device connected to the fraudulent VOS system, and identifies the ISMI number in the original traffic of the GOIP connected to the fraudulent VOS system by analyzing the traffic between GOIP and SIMBANK, avoiding the problems of large investment resources, large amount of analysis data and low accuracy in existing big data analysis, and the identification of ISMI numbers can provide a basis for operators to shut down fraudulent numbers. In addition, this application can also accurately locate the GOIP device through the IP address of the GOIP device and the fraudulent IMSI number, thereby providing technical support for relevant units to confiscate fraudulent devices.

[0076] The above technical scheme disclosed in the present application builds a VOS system detection fingerprint library by analyzing the VOS system involved in the case, and builds a traffic fingerprint library of the GOIP device by pre-analyzing the GOIP device involved in the case. Then, fingerprint identification is performed according to the constructed VOS system detection fingerprint library to obtain information of the fraudulent VOS system and further obtain the inflow and outflow traffic of the fraudulent VOS system. After that, the GOIP device connected to the fraudulent VOS system is identified and determined according to the traffic fingerprint library of the constructed GOIP device and the inflow and outflow traffic of the fraudulent VOS system, so as to achieve effective identification of the GOIP device by adopting the traffic fingerprint method, thereby avoiding the problems of large investment resources, large amount of analysis data and low identification accuracy in the existing big data analysis. And while performing traffic identification on the inflow and outflow traffic of the fraudulent VOS system, the IP address and original traffic of the GOIP device can also be extracted from it. Then, the fraudulent IMSI number (i.e., SIM card number) is obtained according to the original traffic of the GOIP device and the transmission characteristics of the IMSI number obtained in advance according to the traffic between the GOIP device and the SIMBANK device, thereby achieving effective identification of the fraudulent SIM card and providing a basis for the operator to shut down the fraudulent number. In addition, after extracting the IP address of the GOIP device and obtaining the fraudulent IMSI number associated with the GOIP device, the GOIP device is located based on the IP address of the GOIP device and the obtained fraudulent IMSI number, providing technical support for relevant units to confiscate the fraudulent devices.

[0077] An information identification method provided in an embodiment of the present application may further include:

[0078] By analyzing the SIMBANK devices involved in the case, a traffic fingerprint library of SIMBANK devices was constructed;

[0079] When the GOIP device connected to the fraudulent VOS system is identified based on the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, the following may also be included:

[0080] According to the traffic fingerprint library of SIMBANK devices and the inflow and outflow traffic of the fraudulent VOS system, the SIMBANK devices connected to the fraudulent VOS system are identified, and the IP addresses of the SIMBANK devices are extracted.

[0081] In the present application, while constructing the VOS system detection fingerprint library and the traffic fingerprint library of the GOIP device in advance by analyzing the VOS system involved in the case and the GOIP device involved in the case, it is also possible to construct the traffic fingerprint library of the SIMBANK device by analyzing the SIMBANK device involved in the case provided by the relevant units. Specifically, the traffic fingerprint library of the SIMBANK device can be constructed by disassembling the SIMBANK device involved in the case, analyzing the software code and device network access behavior of the device, and extracting the interactive information of the device. Among them, the device network access behavior and the interactive information of the device can be specifically analyzed and obtained by connecting the SIMBANK device involved in the case to the network. It should be noted that the traffic fingerprint library of the constructed SIMBANK device can be used as a universal feature of this type of device through Internet network traffic, so as to facilitate the identification and acquisition of fraud-related SIMBANK information based on this.

[0082] On the basis of constructing the traffic fingerprint library of SIMBANK devices, the GOIP devices connected to the fraudulent VOS system can be identified based on the traffic fingerprint library of the GOIP devices and the inflow and outflow of the fraudulent VOS system, while the SIMBANK devices connected to the fraudulent VOS system can be identified based on the traffic fingerprint library of the SIMBANK devices and the inflow and outflow of the fraudulent VOS system, and the IP address of the SIMBANK devices can be extracted. Specifically, based on the traffic fingerprint library of the SIMBANK devices constructed above, matching can be performed in the inflow and outflow of the fraudulent VOS system to identify the SIMBANK devices connected to the fraudulent VOS system, and the IP address of the SIMBANK devices connected to the fraudulent VOS system can be extracted from the inflow and outflow of the fraudulent VOS system, so that the SIMBANK devices can be located based on the IP address in the future.

[0083] In addition, when extracting the IP address of the SIMBANK device, the original traffic of the SIMBANK device can also be extracted.

[0084] An information identification method provided in an embodiment of the present application locates a GOIP device according to the IP address of the GOIP device and the fraudulent IMSI number, which may include:

[0085] Locate the approximate location of the GOIP device based on its IP address;

[0086] Based on the fraudulent IMSI number and the operator's signaling message, the network access information of the fraudulent IMSI number is obtained, and the precise location of the GOIP device is located based on the network access information.

[0087] In this application, when locating the GOIP device according to the IP address of the GOIP device and the fraudulent IMSI number, the IP address of the GOIP device can be used to locate the rough position of the GOIP device, where the rough position mentioned here can refer to the district and county level, that is, the GOIP device can be located at the district and county level by locating the IP address of the GOIP device. Then, the network access information of the fraudulent IMSI number can be obtained based on the fraudulent IMSI number and the operator's signaling message, and the fine position of the GOIP device can be located based on the network access information (specifically based on the base station information included at the time of network access) and the determined rough position, and the GOIP device can be located within a few hundred meters (or even within tens of meters).

[0088] The above method can achieve high-precision positioning of GOIP devices, thereby providing better technical support for relevant units to confiscate GOIP devices.

[0089] An information identification method provided in an embodiment of the present application, for obtaining network access information of a fraudulent IMSI number, may include:

[0090] Obtain the TAC and ECGI of the fraudulent IMSI number.

[0091] In the present application, when obtaining the network access information of the fraudulent IMSI number, the TAC (Tracking Area Code) and ECGI (E-UTRAN Cell Global Identifier) ​​of the fraudulent IMSI number can be specifically obtained, wherein the tracking area code is an area used for paging and location updates, and by combining with ECGI, the call behavior can be located; ECGI is used to uniquely mark an operator cell, and by combining with TAC, the call behavior can be located, wherein ECGI is the base station to which the fraudulent IMSI number belongs when the business occurs, and the longitude and latitude of ECGI are the location of the base station to which the fraudulent IMSI number belongs when the business occurs.

[0092] By obtaining the TAC and ECGI of the fraudulent IMSI number when it accesses the network, high-precision positioning of the GOIP device can be achieved, so that the GOIP device can be positioned within a range of about 200 meters (or even smaller).

[0093] An information identification method provided in an embodiment of the present application, which obtains information of a fraudulent VOS system according to a VOS system detection fingerprint library, may include:

[0094] Based on the VOS system detection fingerprint database, the information of the fraudulent VOS system is obtained using cyberspace mapping methods.

[0095] In this application, when obtaining information about a fraudulent VOS system based on a VOS system detection fingerprint library, the information about the fraudulent VOS system can be obtained using a cyberspace mapping method based on the VOS system detection fingerprint library. The cyberspace mapping method mainly refers to a method of using some technical methods to detect the node distribution and network relationship index in the global Internet space and construct a global Internet map.

[0096] Identifying fraud-related resources through cyberspace mapping can avoid problems such as large amounts of analysis data, rapid model changes, and low accuracy caused by big data modeling.

[0097] An information identification method provided in an embodiment of the present application may further include:

[0098] Output the fraudulent IMSI number and the location of the GOIP device.

[0099] In the present application, after obtaining the fraudulent IMSI number based on the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and locating the GOIP device based on the IP address of the GOIP device and the fraudulent IMSI number, the location of the fraudulent IMSI number and the GOIP device can also be output. Specifically, the location of the fraudulent IMSI number and the GOIP device can be output to the system of the relevant unit, so that the relevant unit can obtain the location of the fraudulent IMSI number and the GOIP device, and facilitate the relevant unit to perform subsequent processing.

[0100] The present application also provides an information identification device. Figure 4 , which shows a schematic diagram of the structure of an information identification device provided in an embodiment of the present application, which may include:

[0101] The first construction module 41 is used to construct a VOS system detection fingerprint library and a GOIP device traffic fingerprint library in advance by analyzing the VOS system and the GOIP device involved in the case, and obtain the transmission characteristics of the IMSI number according to the traffic between the GOIP device and the SIMBANK device;

[0102] An acquisition module 42 is used to acquire information of a fraudulent VOS system according to a VOS system detection fingerprint library, and acquire inflow and outflow traffic of the fraudulent VOS system according to the information of the fraudulent VOS system;

[0103] The first identification module 43 is used to identify the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and extract the IP address and original traffic of the GOIP device;

[0104] The positioning module 44 is used to obtain the fraudulent IMSI number according to the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and locate the GOIP device according to the IP address of the GOIP device and the fraudulent IMSI number.

[0105] An information identification device provided in an embodiment of the present application may further include:

[0106] The second construction module is used to build a traffic fingerprint library of SIMBANK devices by analyzing the SIMBANK devices involved in the case, while building a VOS system detection fingerprint library and a traffic fingerprint library of GOIP devices by analyzing the VOS system and the GOIP devices involved in the case in advance;

[0107] The second identification module is used to identify the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and to identify the SIMBANK device connected to the fraudulent VOS system according to the traffic fingerprint library of the SIMBANK device and the inflow and outflow traffic of the fraudulent VOS system, and extract the IP address of the SIMBANK device.

[0108] An information identification device provided in an embodiment of the present application, the positioning module 44 may include:

[0109] A first positioning unit, used to locate the rough position of the GOIP device according to the IP address of the GOIP device;

[0110] The second positioning unit is used to obtain the network access information of the fraudulent IMSI number based on the fraudulent IMSI number and the operator's signaling message, and locate the precise position of the GOIP device based on the network access information.

[0111] An information identification device provided in an embodiment of the present application, the second positioning unit may include:

[0112] The acquisition subunit is used to obtain the TAC and ECGI of the fraudulent IMSI number.

[0113] An information identification device provided in an embodiment of the present application, the acquisition module 42 may include:

[0114] The acquisition unit is used to acquire the information of the fraudulent VOS system by using the network space mapping method according to the VOS system detection fingerprint library.

[0115] An information identification device provided in an embodiment of the present application may further include:

[0116] The output module is used to output the fraudulent IMSI number and the location of the GOIP device.

[0117] The present application also provides an information recognition device. Figure 5 , which shows a schematic diagram of the structure of an information identification device provided in an embodiment of the present application, which may include:

[0118] A memory 51, used for storing computer programs;

[0119] The processor 52, when used to execute the computer program stored in the memory 51, can implement the following steps:

[0120] By analyzing the VOS system and GOIP devices involved in the case in advance, a VOS system detection fingerprint library and a GOIP device traffic fingerprint library are constructed, and the transmission characteristics of the IMSI number are obtained based on the traffic between the GOIP device and the SIMBANK device; the information of the fraudulent VOS system is obtained based on the VOS system detection fingerprint library, and the inflow and outflow traffic of the fraudulent VOS system is obtained based on the information of the fraudulent VOS system; the GOIP device connected to the fraudulent VOS system is identified based on the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and the IP address and original traffic of the GOIP device are extracted; the fraudulent IMSI number is obtained based on the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and the GOIP device is located based on the IP address of the GOIP device and the fraudulent IMSI number.

[0121] The present application also provides a readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the following steps can be implemented:

[0122] By analyzing the VOS system and GOIP devices involved in the case in advance, a VOS system detection fingerprint library and a GOIP device traffic fingerprint library are constructed, and the transmission characteristics of the IMSI number are obtained based on the traffic between the GOIP device and the SIMBANK device; the information of the fraudulent VOS system is obtained based on the VOS system detection fingerprint library, and the inflow and outflow traffic of the fraudulent VOS system is obtained based on the information of the fraudulent VOS system; the GOIP device connected to the fraudulent VOS system is identified based on the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and the IP address and original traffic of the GOIP device are extracted; the fraudulent IMSI number is obtained based on the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and the GOIP device is located based on the IP address of the GOIP device and the fraudulent IMSI number.

[0123] The readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0124] The description of the relevant parts of an information identification device, equipment and readable storage medium provided in the present application can be found in the detailed description of the corresponding parts of an information identification method provided in an embodiment of the present application, and will not be repeated here.

[0125] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or equipment that includes a series of elements are inherent to the elements. In the absence of more restrictions, the elements limited by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or equipment that includes the elements. In addition, the above-mentioned technical solution provided in the embodiment of the present application is consistent with the corresponding technical solution in the prior art in principle, and the part is not described in detail, so as not to repeat too much.

[0126] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An information identification method, characterized in that: include: By analyzing the VOS system and the GOIP device involved in the case in advance, a VOS system detection fingerprint library and a GOIP device traffic fingerprint library are constructed, and the transmission characteristics of the IMSI number are obtained based on the traffic between the GOIP device and the SIMBANK device; Acquire information of the fraudulent VOS system according to the VOS system detection fingerprint library, and acquire inflow and outflow traffic of the fraudulent VOS system according to the information of the fraudulent VOS system; Identify the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and extract the IP address and original traffic of the GOIP device; The fraudulent IMSI number is obtained according to the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and the GOIP device is located according to the IP address of the GOIP device and the fraudulent IMSI number.

2. The information identification method according to claim 1, characterized in that: When constructing the VOS system detection fingerprint library and the GOIP device traffic fingerprint library by analyzing the VOS system and GOIP device involved in the case in advance, it also includes: By analyzing the SIMBANK devices involved in the case, a traffic fingerprint library of the SIMBANK devices is constructed; When the GOIP device connected to the fraudulent VOS system is identified according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, the method further includes: The SIMBANK device connected to the fraudulent VOS system is identified according to the traffic fingerprint library of the SIMBANK device and the inflow and outflow traffic of the fraudulent VOS system, and the IP address of the SIMBANK device is extracted.

3. The information identification method according to claim 1, characterized in that: The GOIP device is located according to the IP address of the GOIP device and the fraudulent IMSI number, including: Locate the rough location of the GOIP device according to the IP address of the GOIP device; According to the fraudulent IMSI number, the network access information of the fraudulent IMSI number is obtained in combination with the operator signaling message, and the fine position of the GOIP device is located according to the network access information and the rough position of the GOIP device.

4. The information identification method according to claim 3, characterized in that: Obtain the network access information of the fraudulent IMSI number, including: Obtain the TAC and ECGI of the fraudulent IMSI number.

5. The information identification method according to claim 1, characterized in that: The information of the fraudulent VOS system is obtained according to the VOS system detection fingerprint database, including: According to the VOS system detection fingerprint library, the information of the fraudulent VOS system is obtained by using a cyberspace mapping method.

6. The information identification method according to claim 1, characterized in that: Also includes: Output the fraudulent IMSI number and the location of the GOIP device.

7. An information recognition device, characterized in that: include: The first construction module is used to construct a VOS system detection fingerprint library and a GOIP device traffic fingerprint library in advance by analyzing the VOS system and the GOIP device involved in the case, and obtain the transmission characteristics of the IMSI number according to the traffic between the GOIP device and the SIMBANK device; An acquisition module, configured to acquire information of a fraudulent VOS system according to the VOS system detection fingerprint library, and acquire inflow and outflow traffic of the fraudulent VOS system according to the information of the fraudulent VOS system; A first identification module is used to identify the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, and extract the IP address and original traffic of the GOIP device; The positioning module is used to obtain the fraudulent IMSI number according to the original traffic of the GOIP device and the transmission characteristics of the IMSI number, and locate the GOIP device according to the IP address of the GOIP device and the fraudulent IMSI number.

8. The information recognition device according to claim 7, characterized in that: Also includes: The second construction module is used to construct the traffic fingerprint library of the SIMBANK device by analyzing the SIMBANK device involved in the case, when the VOS system detection fingerprint library and the traffic fingerprint library of the GOIP device are constructed in advance by analyzing the VOS system and the GOIP device involved in the case; The second identification module is used to identify the GOIP device connected to the fraudulent VOS system according to the traffic fingerprint library of the GOIP device and the inflow and outflow traffic of the fraudulent VOS system, identify the SIMBANK device connected to the fraudulent VOS system according to the traffic fingerprint library of the SIMBANK device and the inflow and outflow traffic of the fraudulent VOS system, and extract the IP address of the SIMBANK device.

9. An information recognition device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the information identification method according to any one of claims 1 to 6 when executing the computer program.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the information identification method according to any one of claims 1 to 6 are implemented.

Images