Fraudulent Number Identification Methods, Systems, Devices, and Storage Media Based on Call Forwarding Technology

Abstract

This invention discloses a method, system, device, and storage medium for identifying fraudulent numbers using call forwarding technology, relating to the field of communication technology. By monitoring SIP protocol signaling information of the IMS network Mw interface, it identifies notification response messages in the SIP protocol signaling information that contain a preset identifier indicating that the currently called party is being forwarded. Then, it parses out the calling number, the original called party number, and the actual called party number from the notification response message. Based on the parsing results, it determines a first number of times the same calling number or the original called party number has been forwarded to different actual called parties within a time threshold. Based on the first number exceeding the first threshold, it identifies fraudulent numbers, thereby effectively identifying fraudulent numbers utilizing 5G call forwarding technology.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method, system, device, and storage medium for identifying fraudulent numbers using call forwarding technology. Background Technology

[0002] With the development of mobile communications, traditional fraud has shifted from offline to online, with cases of fraud via telephone becoming increasingly common. Telecommunications fraud prevention has matured over the years, and a wide range of anti-fraud models have been developed based on operator network signaling data and billing detail records, taking into account characteristics such as call frequency, called party dispersion, call time, the proportion of out-of-province called numbers, and the number of days a number is active.

[0003] Telecommunications fraud and anti-fraud is a process of offense and defense. With the development of relatively mature and complete anti-fraud models and 5G networks, telecommunications fraud using 5G call forwarding technology is becoming increasingly popular. This means that, based on the 5G network, fraudsters turn on the corresponding call forwarding switch on their mobile phones and set the call forwarding number to achieve call forwarding of the called number. Then, they use one or more mobile phones to dial a specific called number B, and use call forwarding technology to frequently forward the calls to different final called numbers C, thus achieving a wide-net fraud.

[0004] Without call forwarding technology, refer to Figure 2 To conduct a widespread fraud, caller number A needs to dial 100 different victim numbers. The high dispersion of these calls (equal to 100 / 100 = 1) means the victims are often located in various places, resulting in a wide distribution of the called numbers' provinces and cities. Therefore, the fraudulent characteristics are obvious and easily identified by conventional anti-fraud models. However, when using call forwarding technology, referring to... Figure 3 To carry out a wide-net fraud scheme, caller number A only needs to dial the original called number B. Through call forwarding technology, the original called number B will transfer the voice to the actual called numbers of 100 different fraud targets. Since the operator's signaling monitoring system only records the signaling data from the caller number to the original called number, the calculated called dispersion is low (equal to 1 / 100 = 0.01). The called numbers are all B, the called city and county characteristics are not dispersed, and the fraud characteristics are not obvious, which often allows it to evade the identification of conventional anti-fraud models.

[0005] In summary, call forwarding technology can create the illusion that a single number or multiple numbers are calling a single called number B. The operator's signaling data records the called number as the original called number. The calling behavior is characterized by low caller-call dispersion, which is the opposite of the traditional communication behavior characteristic of high caller-call dispersion. This evades the identification of current conventional fraud models and has strong concealment, making it difficult to effectively identify fraudulent numbers using call forwarding technology. Summary of the Invention

[0006] This invention aims to at least solve one of the technical problems existing in the prior art. To this end, this invention proposes a method, system, device, and storage medium for identifying fraudulent numbers using call forwarding technology, which can effectively identify fraudulent numbers using call forwarding technology.

[0007] On one hand, embodiments of the present invention provide a method for identifying fraudulent numbers using call forwarding technology, comprising the following steps:

[0008] Monitor SIP protocol signaling information of the IMS network Mw interface;

[0009] Identify a notification response message with a preset identifier in the SIP protocol signaling information, wherein the preset identifier is used to indicate that the called party is currently being transferred;

[0010] The calling number and the actual called number are parsed from the notification response message, wherein the calling number is the calling number or the original called number;

[0011] Determine the first number of times the same calling number is forwarded to different actual called numbers within a time threshold;

[0012] Fraudulent numbers are determined based on the number of call numbers that exceeds the first threshold.

[0013] According to some embodiments of the present invention, the notification response message is a 181 call forwarding message, and the step of resolving the calling number and the actual called number based on the notification response message includes the following steps:

[0014] Extract the caller ID from the From header field of the message header;

[0015] Extract the original called number from the To header field of the message header;

[0016] Extract the actual called number from the History_Info header field of the message header.

[0017] According to some embodiments of the present invention, the method for identifying fraudulent numbers under call forwarding technology includes the following steps:

[0018] Based on the call number in the currently monitored notification response message, search the database for a set of data that matches the call number;

[0019] If no data set matching the called number is found, a data set named after the called number is created, and the actual called number and monitoring time in the currently monitored notification response message are stored in the created data set.

[0020] If no matching data set is found for the called number, the actual called number and monitoring time in the currently monitored notification response message are stored in the matched data set.

[0021] According to some embodiments of the present invention, the first threshold is determined in the following manner:

[0022] Based on historical data, the total number of calling numbers corresponding to different second-number actual called numbers during a preset historical time period is used to obtain a user call forwarding statistics table.

[0023] The number of numbers that can be shut down is determined based on the percentage of numbers that can be shut down and data from all called numbers.

[0024] Find the total number of multiple call numbers in the user call forwarding statistics table that is less than the allowed number of call numbers to be shut down, and take the second number corresponding to the largest total number of call numbers among the multiple total numbers found as the first threshold.

[0025] According to some embodiments of the present invention, the time threshold is determined in the following manner:

[0026] Based on historical data statistics, the total time taken to reach the first threshold is the number of actual called numbers transferred from multiple fraudulent numbers within a preset historical time period.

[0027] The time threshold is determined based on the total time.

[0028] According to some embodiments of the present invention, determining the fraudulent number based on the number of call numbers that is greater than a first threshold includes the following steps:

[0029] The calling numbers whose number exceeds the first threshold are identified as suspected numbers;

[0030] The communication behavior characteristics are determined based on the actual called numbers and monitoring times recorded in the dataset of the suspected numbers.

[0031] The communication behavior characteristics are input into the fraud model to identify the fraudulent number.

[0032] According to some embodiments of the present invention, the communication behavior characteristics include call strength, actual called number dispersion, and the number of provinces to which the actual called numbers belong.

[0033] On the other hand, embodiments of the present invention also provide a fraudulent number identification system based on call forwarding technology, comprising:

[0034] The first module is used to monitor SIP protocol signaling information of the IMS network Mw interface;

[0035] The second module is used to identify notification response messages with preset identifiers in the SIP protocol signaling information, wherein the preset identifiers are used to indicate that the called party is currently being transferred.

[0036] The third module is used to parse the calling number and the actual called number based on the notification response message, wherein the calling number is the calling number or the original called number;

[0037] The fourth module is used to determine the first number of times the same calling number is forwarded to different actual called numbers within a time threshold;

[0038] The fifth module is used to determine fraudulent numbers based on the number of call numbers that is greater than the first threshold.

[0039] On the other hand, embodiments of the present invention also provide a fraudulent number identification device under call forwarding technology, comprising:

[0040] At least one processor;

[0041] At least one memory for storing at least one program;

[0042] When the at least one program is executed by the at least one processor, the at least one processor implements the fraudulent number identification method under the call forwarding technology described above.

[0043] On the other hand, embodiments of the present invention also provide a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the fraudulent number identification method under the call forwarding technology described above.

[0044] The above-mentioned technical solution of the present invention has at least one of the following advantages or beneficial effects: by monitoring the SIP protocol signaling information of the IMS network Mw interface, identifying the notification response message in the SIP protocol signaling information that has a preset identifier indicating that the current called party is being transferred, and then parsing out the calling number, the original called party number and the actual called party number in the notification response message, determining the first number of times the same calling number or the original called party number is transferred to different actual called party numbers within a time threshold based on the parsing result, and determining the fraudulent number based on the calling number or the original called party number that the first number is greater than the first threshold, thereby effectively identifying fraudulent numbers using 5G call forwarding technology. Attached Figure Description

[0045] Figure 1 This is a flowchart of a method for identifying fraudulent numbers using call forwarding technology provided in an embodiment of the present invention;

[0046] Figure 2 This is a schematic diagram of fraudulent communication behavior without the use of call forwarding technology provided in an embodiment of the present invention;

[0047] Figure 3 This is a schematic diagram of fraudulent communication behavior using call forwarding technology provided in an embodiment of the present invention;

[0048] Figure 4 This is a schematic diagram of the call transfer process provided in an embodiment of the present invention;

[0049] Figure 5 This is a schematic diagram of a fraudulent number identification device based on call forwarding technology provided in an embodiment of the present invention. Detailed Implementation

[0050] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar originals or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0051] In the description of this invention, it should be understood that the orientation descriptions, such as up, down, left, right, etc., are based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention.

[0052] In the description of this invention, the use of terms such as "first," "second," etc., is merely for the purpose of distinguishing technical features and should not be construed as indicating or implying relative importance, or implicitly indicating the number of technical features indicated, or implicitly indicating the order of the technical features indicated.

[0053] This invention provides a method for identifying fraudulent numbers using call forwarding technology, referring to... Figure 1 The fraudulent number identification method under the call forwarding technology in this embodiment of the invention includes, but is not limited to, steps S110, S120, S130, S140 and S150.

[0054] Step S110: Monitor the SIP protocol signaling information of the IMS network Mw interface.

[0055] In this embodiment, IMS (IP Multimedia Subsystem) is an IP multimedia system, a brand-new form of multimedia service that can meet the needs of end customers for newer and more diversified multimedia services. IMS is essentially a network architecture; the IMS network is deployed in the core network (VoLTE), and in line with the trend of network IP-ization, the IMS system uses the SIP protocol for end-to-end call control.

[0056] Currently, there are two main ways to implement voice calls in 5G SA networking: EPS Fallback and VoNR.

[0057] VoNR is a 5G NR voice solution based on the IMS network. Built on a 5G NR network and operating under an all-IP architecture, it implements end-to-end voice communication based on an IMS server. By deploying IMS, VoNR enables concurrent voice and data services, all carried over the 5G network, but voice services require IMS for service control.

[0058] EPS Fallback 5G NR does not support voice services. When a UE initiates or receives a voice call in 5G NR, it falls back to the 4G network through redirection or handover, and VoLTE provides the voice service. After the voice call ends, the UE returns to the 5G network.

[0059] Both of the above schemes are carried out through the IMS network on the core network side. Therefore, in this embodiment, signaling collection is performed on the 5G voice core network side, and SIP protocol signaling information can be collected at the Mw interface between the two network elements PCSCF and SSCF.

[0060] Step S120: Identify a notification response message with a preset identifier in the SIP protocol signaling information, wherein the preset identifier is used to indicate that the currently called party is being transferred.

[0061] In this embodiment, the VoLTE call is based on the SIP protocol, referring to... Figure 4 When a call forwarding occurs, the signaling process based on the SIP protocol is as follows:

[0062] S1. Terminal B Service Activation: Terminal B activates the unconditional forwarding service and configures the forwarding number C, activating unconditional forwarding of calls to terminal C;

[0063] S2, Terminal A calls the number of Terminal B;

[0064] S3. Terminal A sends an INVITE message to Terminal B's number to the S-CSCF network element where Terminal B's number is located, and then forwards it to the AS where Terminal B's number is located to trigger the service.

[0065] S4. When the AS where terminal B's number is located receives the INVITE message and confirms that terminal B's number has signed up for unconditional forwarding, it sends an INVITE message to the forwarding terminal C.

[0066] S5. The AS where terminal B's number is located sends a 181 response message to terminal A, which carries a History-Info header field to notify terminal A that a call forwarding has occurred.

[0067] As can be seen from the above call forwarding process, by monitoring the 181 call is being forwarded message and its contents, the call forwarding event occurring under the 5G network can be identified.

[0068] Specifically, the From, To, and History_Info header fields in the detected 181 call forwarding message contain relevant number information. Therefore, regular expressions can be used to extract the calling number from the From header field, the original called number from the To header field, and the actual called number from the History_Info header field.

[0069] Step S130: Parse the calling number and the actual called number based on the notification response message, wherein the calling number is the calling number or the original called number.

[0070] In this implementation, in fraud scenarios based on call forwarding technology, both the calling number and the original called number are numbers used by the fraudsters. In most cases, a single host number forwards calls to different actual called numbers only through one original called number, thus concealing the fraud. For the actual called number, both the calling number and the original called number are the numbers that initiated the call; therefore, further analysis of the calling number or the original called number can help identify fraudulent activity.

[0071] Step S140: Determine the first number of times the same calling number is forwarded to different actual called numbers within a time threshold.

[0072] Step S150: Determine the fraudulent number based on the number of call numbers that is greater than the first threshold.

[0073] In this embodiment, there are often a large number of users who normally use the call forwarding service. In order to avoid harming normal users, after identifying the numbers using the call forwarding service, it is necessary to further distinguish all the numbers using the call forwarding service that exhibit abnormal behavior in order to identify fraudulent numbers.

[0074] Generally, normal users use call forwarding services when their phones are off (e.g., on a plane, when the phone is dead), or when they are in class, in a meeting, or driving and cannot answer calls. There are two ways to trigger call forwarding: one is when the user sets up call forwarding on their phone in advance, and the other is when the user has activated a certain communication assistant service. Once activated, such services will automatically forward unanswered calls (e.g., no answer, airplane mode, phone off) to a specific called party platform for AI answering or voicemail recording. Normal numbers using call forwarding technology typically only have one final called party number set and do not frequently change the final called party number within a short period.

[0075] Based on this, a key characteristic for determining whether a call forwarding record is fraudulent is whether the original called number or the calling number frequently forwards calls to different actual called numbers. This involves determining the first number of times the same calling number forwards calls to different actual called numbers within a time threshold, and identifying fraudulent numbers based on the number of times this first number exceeds the first threshold. For example, if the original called number B forwards calls to different actual called numbers C a total of 6 times within 10 minutes, exceeding the first threshold of 5 times, then the original called number B can be identified as a fraudulent number. Alternatively, the original called number B can be further analyzed as a suspected fraudulent number to determine whether it is indeed a fraudulent number.

[0076] According to some specific embodiments of the present invention, the fraudulent number identification method under the call forwarding technology of the present invention also includes, but is not limited to, steps S210 to S230.

[0077] Step S210: Search the database for a set of data that matches the call number in the currently monitored notification response message;

[0078] Step S220: If no data set matching the call number is found, a data set named after the call number is created, and the actual called number and monitoring time in the currently monitored notification response message are stored in the created data set;

[0079] Step S230: If no data set matching the calling number can be found, the actual called number and monitoring time in the currently monitored notification response message are stored in the matched data set.

[0080] In this embodiment, a data set named based on the call number is created in the database. The actual called number and monitoring time in the notification response message are stored in the data set according to the call number in the notification response message. Subsequently, by analyzing the number of actual called numbers and the monitoring time of the actual called numbers stored in the data set, the outbound calling situation of the call number can be determined, thereby determining whether the call number may be a fraudulent number.

[0081] According to some specific embodiments of the present invention, the first threshold in step S150 is determined by the following steps:

[0082] Step S310: Based on historical data, the total number of calling numbers corresponding to different second-number actual called numbers in the historical preset time period is statistically analyzed to obtain the user call forwarding statistics table;

[0083] Step S320: Determine the number of numbers that can be shut down based on the allowed shutdown ratio and the data of all called numbers;

[0084] Step S330: Find the total number of multiple call numbers in the user call forwarding statistics table that is less than the allowed number of call numbers to be shut down, and take the second number corresponding to the total number of the call numbers with the largest value among the multiple call numbers found as the first threshold.

[0085] Specifically, to prevent too many users from being identified as suspected fraudulent numbers and having their numbers shut down, it is necessary to set a percentage of numbers that can be shut down based on historical experience. For example, the number of numbers shut down should not exceed 30 per million users.

[0086] Based on historical data, the total number of calling numbers corresponding to different second-number actual called numbers during a certain day is statistically analyzed to obtain a user call forwarding statistics table, as shown in Table 1:

[0087] Table 1. Call forwarding statistics for a certain province's telecom operators.

[0088] Second quantity Total number of numbers 1 3 million 2 4500 3 2000 4 200 5 70 5～10 28 10 or more 15

[0089] As shown in Table 1, 3 million users forwarded their calls to at least one actual called number on the same day. Among them, 4,500 users forwarded their calls to at least two actual called numbers, and 2,000 users forwarded their calls to at least three actual called numbers, and so on. Based on the allowable shutdown ratio of no more than 30 numbers per million users, the number of numbers allowed to be shut down out of 3 million numbers is no more than 90. By consulting the user call forwarding statistics table, we find that the total number of numbers with fewer than 90 is 70, 28, and 15. Taking the second number corresponding to the largest total number of numbers, i.e., the second number corresponding to the total number of numbers of 70, which is 5, we finally determine that the first threshold can be set to 5.

[0090] According to some specific embodiments of the present invention, the time threshold in step S140 is determined in the following manner:

[0091] Step S410: Based on historical data, the total time taken for the number of actual called numbers forwarded by multiple fraudulent numbers within a preset historical time period to reach the first threshold.

[0092] Step S420: Determine the time threshold based on multiple total times.

[0093] Specifically, based on historical experience, the total time taken by three fraudulent numbers to forward calls to different numbers on a certain day is shown in Tables 2, 3, and 4.

[0094] Table 2. Statistics on the number of calls forwarded and the time taken for fraudulent number A

[0095]

[0096]

[0097] Table 3. Statistics on the number of forwarded calls and the time taken for fraudulent number b

[0098]

[0099] Table 4. Statistics on the number of calls forwarded from fraudulent number C and the time taken.

[0100]

[0101]

[0102] The statistics table of the three fraudulent numbers above shows that the time taken to forward calls to five different actual called numbers was 10, 8, and 11 minutes, respectively. Therefore, the time threshold can be max(10,8,11) minutes + 1 minute = 12 minutes, which can cover the three sample fraudulent numbers and achieve a fraud sample coverage rate of 100%.

[0103] According to some specific embodiments of the present invention, in step S150, determining the fraudulent number based on the number of calling numbers that is greater than a first threshold includes the following steps:

[0104] Step S510: Identify the first number of calling numbers that is greater than the first threshold as suspected numbers;

[0105] Step S520: Determine communication behavior characteristics based on the actual called numbers and monitoring time recorded in the suspected number data set;

[0106] Step S530: Input the communication behavior characteristics into the fraud model to identify the fraudulent number.

[0107] For example, after identifying call numbers that use call forwarding technology, call numbers that are forwarded to more than 5 actual called numbers within 12 minutes are identified as suspected numbers. By further analyzing the communication behavior characteristics of suspected numbers and inputting the communication behavior characteristics into a fraud model, it is determined whether the suspected numbers are fraudulent numbers.

[0108] Communication behavior characteristics include, but are not limited to:

[0109] User call intensity: If the number of calls exceeds the normal value in a short period of time, it is highly likely to be a scam call.

[0110] User outgoing call percentage: The ratio of the number of outgoing calls to the number of incoming and outgoing calls. Fraudulent numbers generally have a higher outgoing call percentage than legitimate numbers.

[0111] Caller hang-up rate: The percentage of calls that are hung up on. Scam numbers generally have a higher hang-up rate than legitimate numbers.

[0112] Actual called number dispersion: For normal users, the actual called number dispersion is usually not very high, while for fraudulent calls that cast a wide net, the dispersion of called numbers is usually very high.

[0113] Active days: Fraudulent numbers have a shorter active days compared to normal users.

[0114] The actual number of provinces to which the called numbers belong: Because fraudulent numbers cast a wide net, the actual number of provinces to which the called numbers belong is often abnormally higher than that of legitimate numbers.

[0115] This invention also provides a fraudulent number identification system based on call forwarding technology, comprising:

[0116] The first module is used to monitor SIP protocol signaling information of the IMS network Mw interface;

[0117] The second module is used to identify notification response messages with preset identifiers in SIP protocol signaling information, wherein the preset identifiers are used to indicate that the called party is currently being transferred.

[0118] The third module is used to parse the calling number and the actual called number based on the notification response message, wherein the calling number is the calling number or the original called number;

[0119] The fourth module is used to determine the first number of times the same calling number is forwarded to different actual called numbers within a time threshold;

[0120] The fifth module is used to identify fraudulent numbers based on the number of calling numbers that exceeds a first threshold.

[0121] It is understood that the content of the above-described fraudulent number identification method embodiments under call forwarding technology is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above-described fraudulent number identification method embodiments under call forwarding technology, and the beneficial effects achieved are also the same as those achieved in the above-described fraudulent number identification method embodiments under call forwarding technology.

[0122] Reference Figure 5 , Figure 5This is a schematic diagram of a fraudulent number identification device based on call forwarding technology according to an embodiment of the present invention. The fraudulent number identification device based on call forwarding technology according to this embodiment of the present invention includes one or more control processors and a memory. Figure 5 The example consists of a control processor and a memory.

[0123] The control processor and memory can be connected via a bus or other means. Figure 5 Taking the example of a connection between China and Israel via a bus.

[0124] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the control processor, and these remote memories can be connected to the fraudulent number identification device under the call forwarding technology via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0125] Those skilled in the art will understand that Figure 5 The device structure shown does not constitute a limitation on fraud number identification devices under call forwarding technology, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0126] The non-transient software program and instructions required to implement the fraudulent number identification method under call forwarding technology of the fraudulent number identification device applied under call forwarding technology in the above embodiments are stored in the memory. When executed by the controlled processor, the fraudulent number identification method under call forwarding technology of the fraudulent number identification device applied under call forwarding technology in the above embodiments is executed.

[0127] Furthermore, one embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions that are executed by one or more control processors, causing the one or more control processors to perform the fraudulent number identification method under call forwarding technology in the above method embodiment.

[0128] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0129] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A method for identifying fraudulent numbers using call forwarding technology, characterized in that, Includes the following steps: Monitor SIP protocol signaling information of the IMS network Mw interface; Identify a notification response message with a preset identifier in the SIP protocol signaling information, wherein the preset identifier is used to indicate that the called party is currently being transferred; The calling number and the actual called number are parsed from the notification response message, wherein the calling number is the calling number or the original called number; Determine the first number of times the same calling number is forwarded to different actual called numbers within a time threshold; Fraudulent numbers are determined based on the number of call numbers that is greater than the first threshold. The first threshold is determined in the following way: Based on historical data, the total number of calling numbers corresponding to different second-number actual called numbers during a preset historical time period is used to obtain a user call forwarding statistics table. The number of numbers that can be shut down is determined based on the percentage of numbers that can be shut down and the total number of numbers that have been forwarded. Find the total number of multiple call numbers in the user call forwarding statistics table that is less than the allowed number of call numbers to be shut down, and take the second number corresponding to the largest total number of call numbers among the multiple total numbers found as the first threshold.

2. The method for identifying fraudulent numbers using call forwarding technology according to claim 1, characterized in that, The notification response message is a 181 call forwarding message. The process of resolving the calling number and the actual called number based on the notification response message includes the following steps: Extract the caller ID from the From header field of the message header; Extract the original called number from the To header field of the message header; Extract the actual called number from the History_Info header field of the message header.

3. The method for identifying fraudulent numbers using call forwarding technology according to claim 1, characterized in that, The method for identifying fraudulent numbers using call forwarding technology also includes the following steps: Based on the call number in the currently monitored notification response message, search the database for a set of data that matches the call number; If no data set matching the called number is found, a data set named after the called number is created, and the actual called number and monitoring time in the currently monitored notification response message are stored in the created data set. When a data set matching the called number is found, the actual called number and monitoring time in the currently monitored notification response message are stored in the matched data set.

4. The method for identifying fraudulent numbers using call forwarding technology according to claim 1, characterized in that, The time threshold is determined in the following way: Based on historical data statistics, the total time taken to reach the first threshold is the number of actual called numbers transferred from multiple fraudulent numbers within a preset historical time period. The time threshold is determined based on the total time.

5. The method for identifying fraudulent numbers using call forwarding technology according to claim 3, characterized in that, The step of determining fraudulent numbers based on the number of call numbers that is greater than the first threshold includes the following steps: The calling numbers whose number exceeds the first threshold are identified as suspected numbers; The communication behavior characteristics are determined based on the actual called numbers and monitoring times recorded in the dataset of the suspected numbers. The communication behavior characteristics are input into the fraud model to identify the fraudulent number.

6. The method for identifying fraudulent numbers using call forwarding technology according to claim 5, characterized in that, The communication behavior characteristics include call strength, actual called number dispersion, and the number of provinces to which the actual called numbers belong.

7. A fraudulent number identification system based on call forwarding technology, characterized in that, include: The first module is used to monitor SIP protocol signaling information of the IMS network Mw interface; The second module is used to identify notification response messages with preset identifiers in the SIP protocol signaling information, wherein the preset identifiers are used to indicate that the called party is currently being transferred. The third module is used to parse the calling number and the actual called number based on the notification response message, wherein the calling number is the calling number or the original called number; The fourth module is used to determine the first number of times the same calling number is forwarded to different actual called numbers within a time threshold; The fifth module is used to determine fraudulent numbers based on the number of call numbers that is greater than the first threshold. The first threshold is determined in the following way: Based on historical data, the total number of calling numbers corresponding to different second-number actual called numbers during a preset historical time period is used to obtain a user call forwarding statistics table. The number of numbers that can be shut down is determined based on the percentage of numbers that can be shut down and the total number of numbers that have been forwarded. Find the total number of multiple call numbers in the user call forwarding statistics table that is less than the allowed number of call numbers to be shut down, and take the second number corresponding to the largest total number of call numbers among the multiple total numbers found as the first threshold.

8. A fraudulent number identification device based on call forwarding technology, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the fraud number identification method under the call forwarding technology as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a processor-executable program, characterized in that, When the processor executes the program, it is used to implement the fraud number identification method under the call forwarding technology as described in any one of claims 1 to 6.

Images