Abnormal virtual dialing device detection method, device and equipment

Abstract

The present disclosure provides an abnormal virtual dialing device detection method and device and an electronic device, and relates to the technical field of communication security. The method comprises the following steps: obtaining target network traffic data; analyzing the target network traffic data based on application layer features to obtain session initiation protocol (SIP) session data from the target network traffic data; obtaining user online bill data; associating and integrating the SIP session data and the user online bill data according to user identifiers to obtain a SIP user information list, wherein the SIP user information list comprises SIP session information and online bill information of each user to be tested; and identifying abnormal users in the multiple users to be tested based on the SIP session information and the online bill information of each user to be tested, so as to detect abnormal virtual dialing devices corresponding to the abnormal users.

Description

Technical Field

[0001] This disclosure relates to the field of communication security technology, and more specifically, to a method, apparatus, and electronic device for detecting abnormal virtual dialing devices. Background Technology

[0002] Virtual dial-up devices can be used for remote dial-up communication over a geographically dispersed network. Some virtual dial-up devices are used for illicit purposes and therefore require detection.

[0003] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] The purpose of this disclosure is to provide a method, apparatus, and electronic device for detecting abnormal virtual dialing devices.

[0005] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0006] According to one aspect of this disclosure, a method for detecting abnormal virtual dial-up devices is provided, comprising: acquiring target network traffic data; parsing the target network traffic data based on application layer features to obtain Session Initiation Protocol (SIP) session data from the target network traffic data; acquiring user internet access detail records (DDRs); associating and integrating the SIP session data and the user internet access detail records according to user identifiers to obtain a SIP user information list, the SIP user information list including SIP session information and internet access detail records of each user to be tested; identifying abnormal users among multiple users to be tested based on the SIP session information and internet access detail records of each user to be tested, so as to detect abnormal virtual dial-up devices corresponding to the abnormal users.

[0007] According to one embodiment of this disclosure, identifying abnormal users among multiple users under test based on the SIP session information and Internet access call detail records of each user under test includes: obtaining a feature set for each user under test based on the SIP session information and Internet access call detail records of each user under test, wherein the feature set includes multiple standardized features, including SIP session features, network speed features, and user type features; classifying each user under test based on the feature set of each user under test, and identifying abnormal users among the multiple users under test.

[0008] According to one embodiment of this disclosure, the method further includes: acquiring feature sets of historical normal users and feature sets of historical abnormal users; iteratively training an initial random forest classification model using the feature sets of historical normal users and the feature sets of historical abnormal users with the objective of minimizing the mean squared error, to obtain a trained random forest classification model; classifying each user to be tested based on the feature sets of each user to be tested, and identifying abnormal users among the multiple users to be tested, including: classifying each user to be tested based on the feature sets of each user to be tested using the trained random forest classification model, and identifying abnormal users among the multiple users to be tested.

[0009] According to one embodiment of this disclosure, the SIP session data includes a SIP user agent identifier and a server IP address; parsing the target network traffic data based on application layer features to obtain Session Initiation Protocol (SIP) session data from the target network traffic data includes: identifying SIP sessions from the target network traffic data based on application layer features; parsing the SIP header field corresponding to the identified SIP session to obtain the SIP user agent identifier and server IP address of the SIP session data; the SIP session information includes the SIP user agent identifier and server IP address; the multiple features also include SIP user agent comparison features and server IP address comparison features; obtaining the feature set of each user under test based on the SIP session information and internet access call detail records of each user under test includes: comparing the SIP user agent identifier of each user under test with a list of abnormal user agents to obtain the SIP user agent comparison features of each user under test; comparing the server IP address of each user under test with a list of abnormal server IP addresses to obtain the server IP address comparison features of each user under test.

[0010] According to one embodiment of this disclosure, the SIP session data includes called number type information; parsing the target network traffic data based on application layer features to obtain Session Initiation Protocol (SIP) session data from the target network traffic data includes: identifying SIP sessions from the target network traffic data based on application layer features; parsing the called number field corresponding to the identified SIP session to obtain called number type information of the SIP session data; the SIP session information includes called number type information; the multiple features also include called number dispersion features; obtaining the feature set of each test user based on the SIP session information and internet access call detail records of each test user includes: performing dictionary-type feature extraction processing on the called number type information of each test user to obtain the called number dispersion features of each test user.

[0011] According to one embodiment of this disclosure, the SIP session data includes SIP session time information and SIP session size information; parsing the target network traffic data based on application layer characteristics to obtain Session Initiation Protocol (SIP) session data from the target network traffic data includes: parsing the target network traffic data according to a preset SIP request message identification rule to obtain a SIP request message identification result; parsing the target network traffic data according to a preset SIP response message identification rule to obtain a SIP response message identification result; identifying the SIP session from the target network traffic data based on the SIP request message identification result and the SIP response message identification result; obtaining complete information of the identified SIP session according to a SIP session termination request identification rule; and parsing the complete information of the identified SIP session to obtain the SIP session time information and the SIP session size information.

[0012] According to one embodiment of this disclosure, obtaining target network traffic data includes: capturing full network traffic data using an anomaly monitoring system; removing the link layer header information from the full network traffic data, and extracting transport layer, network layer, and application layer protocol information data to obtain the target network traffic data.

[0013] According to one embodiment of this disclosure, the SIP session data includes SIP session time information, server IP, and port information; parsing the target network traffic data based on application layer characteristics to obtain Session Initiation Protocol (SIP) session data from the target network traffic data includes: identifying SIP sessions from the target network traffic data based on application layer characteristics; parsing the SIP header field corresponding to the identified SIP session to obtain the server IP of the SIP session data; parsing the identified SIP session to obtain the SIP session time information and the port information; the SIP session information includes server IP, SIP session time information, and port information; identifying abnormal users among multiple test users based on the SIP session information and internet access detail records of each test user to detect abnormal virtual dial-up devices corresponding to the abnormal users includes: identifying the abnormal users based on the SIP session information and internet access detail records of each test user; using a tracing system to associate the server IP, SIP session time information, and port information in the abnormal user's SIP session information with the broadband installation address and related user information to obtain the location information of the abnormal virtual dial-up device corresponding to the abnormal user.

[0014] According to another aspect of this disclosure, an abnormal virtual dial-up device detection device is provided, comprising: a first acquisition module for acquiring target network traffic data; a traffic parsing module for parsing the target network traffic data based on application layer characteristics to obtain Session Initiation Protocol (SIP) session data from the target network traffic data; a second acquisition module for acquiring user internet access call detail records (CDRs); an information processing module for associating and integrating the SIP session data and the user internet access CDRs according to user identifiers to obtain a SIP user information list, the SIP user information list including SIP session information and internet access CDR information of each user under test; and an anomaly identification module for identifying abnormal users among multiple users under test based on the SIP session information and internet access CDR information of each user under test, so as to detect abnormal virtual dial-up devices corresponding to the abnormal users.

[0015] According to another aspect of this disclosure, an electronic device is provided, comprising: a memory, a processor, and executable instructions stored in the memory and executable in the processor, wherein the processor, when executing the executable instructions, implements any of the methods described above.

[0016] According to another aspect of this disclosure, a computer-readable storage medium is provided that stores computer-executable instructions thereon, which, when executed by a processor, implement any of the methods described above.

[0017] The abnormal virtual dialing device detection method provided in the embodiments of this disclosure parses the acquired target network traffic data based on application layer features to obtain Session Initiation Protocol (SIP) session data from the target network traffic data. Then, the SIP session data and user Internet access call detail records (CDRs) are associated and integrated according to user identifiers to obtain a SIP user information list including SIP session information and Internet access call detail records of each user under test. Based on the SIP session information and Internet access call detail records of each user under test, abnormal users among multiple users under test are identified to detect abnormal virtual dialing devices corresponding to the abnormal users.

[0018] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this disclosure. Attached Figure Description

[0019] The above and other objects, features and advantages of this disclosure will become more apparent from a detailed description of exemplary embodiments thereof with reference to the accompanying drawings.

[0020] Figure 1 This is a typical networking configuration for GOIP communication according to an exemplary embodiment.

[0021] Figure 2A flowchart illustrating an abnormal virtual dialing device detection method according to an embodiment of this disclosure is shown.

[0022] Figure 3 It shows Figure 2 The step S202 shown is a schematic diagram of the processing procedure in one embodiment.

[0023] Figure 4 It shows Figure 2 The step S204 shown is a schematic diagram of the processing procedure in one embodiment.

[0024] Figure 5 It is based on Figure 3 and Figure 4 A schematic diagram of an exemplary live network monitoring program interface is shown.

[0025] Figure 6 It is based on Figures 3 to 5 The diagram shows a schematic of a SIP session data list output interface.

[0026] Figure 7 It shows Figure 2 The step S210 shown is a schematic diagram of the processing procedure in one embodiment.

[0027] Figure 8 It is based on Figure 7 The diagram illustrates a data processing procedure.

[0028] Figure 9 It shows Figure 2 The step S210 shown is a schematic diagram of the processing procedure in another embodiment.

[0029] Figure 10 It is based on Figures 7 to 9 This diagram illustrates a process for establishing an abnormal GOIP device detection model.

[0030] Figure 11 It shows Figure 2 The step S210 shown is a schematic diagram of the processing procedure in another embodiment.

[0031] Figure 12 It is based on Figure 2 , Figure 4 and Figure 11 The diagram illustrates a process for tracing the origin of an abnormal GOID device.

[0032] Figure 13 It is based on Figures 2 to 12 This diagram illustrates the overall process for detecting abnormal GOIP devices.

[0033] Figure 14 It is based on Figures 2 to 12The diagram shows a schematic of an abnormal GOIP device detection system.

[0034] Figure 15 A block diagram of an abnormal virtual dialing device detection device according to an embodiment of the present disclosure is shown.

[0035] Figure 16 A block diagram of another abnormal virtual dialing device detection device is shown in an embodiment of this disclosure.

[0036] Figure 17 A schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0037] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0038] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, apparatuses, steps, etc., can be employed. In other instances, well-known structures, methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0039] Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this disclosure, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified. The symbol " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0040] In this disclosure, unless otherwise expressly specified and limited, the term "connection" and similar terms should be interpreted broadly, for example, it can refer to an electrical connection or the ability to communicate with each other; it can refer to a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in this disclosure according to the specific circumstances.

[0041] GOIP technology is a technology that enables the conversion between mobile operator signals and Internet SIP (Session Initialization Protocol), and it is a technology commonly used in abnormal network communication. Figure 1 This is a typical GOIP communication network according to an exemplary embodiment. An unauthorized person 102 sends instructions to a GOIP device 106 via the SIP protocol through a GOIP platform 104. The GOIP device 106 controls the SIM card in the SIM card pool to transmit dialing data to a base station 108 to make a call, for example, to a mobile phone 110 or a landline 112. This method features SIM card separation, allows for remote calls, and supports more complex call control. This embodiment uses a GOIP device as an example for illustration, but is not limited to this.

[0042] In related technologies, methods for detecting abnormal virtual dialing devices rely on analysis of phone numbers and call detail records (CDRs) to determine anomalies. However, GOIP devices convert telephone signals into network signals and make calls over the internet. Furthermore, a single GOIP device can control multiple SIM cards, making it more difficult to detect GOIP anomalies using methods based on phone numbers and CDRs.

[0043] This disclosure provides a method for detecting abnormal virtual dial-up devices. By parsing the acquired target network traffic data based on application layer characteristics, SIP session data is obtained from the target network traffic data. Then, the SIP session data and user internet access detail records are associated and integrated according to user identifiers to obtain a SIP user information list including SIP session information and internet access detail records of each user under test. Based on the SIP session information and internet access detail records of each user under test, abnormal users among multiple users under test are identified to detect abnormal virtual dial-up devices corresponding to abnormal users. This method can effectively detect abnormal GOIP devices.

[0044] Figure 2 This is a flowchart illustrating an abnormal virtual dialer detection method according to an exemplary embodiment. Figure 2 The method shown can be applied, for example, to detect abnormal GOIP devices.

[0045] refer to Figure 2 The method 20 provided in this embodiment may include the following steps.

[0046] In step S202, target network traffic data is obtained.

[0047] In some embodiments, an anomaly monitoring system can be used to capture network traffic data, process it, and retain all necessary control information. Specific implementation details can be found in [reference needed]. Figure 3 .

[0048] In step S204, the target network traffic data is parsed based on application layer characteristics to obtain Session Initiation Protocol (SIP) session data from the target network traffic data.

[0049] In some embodiments, SIP session data may include SIP session time information, SIP session size information, called number type information, SIP user agent identifier, and server IP address. A SIP session identification module can be loaded to identify SIP sessions from target network traffic data based on application layer characteristics, and then the full SIP session data can be extracted and output. Specific implementation details can be found in [reference needed]. Figures 4 to 6 .

[0050] In step S206, the user's internet access call detail record (CDR) data is obtained.

[0051] In some embodiments, user internet access call detail records (DDRs) may include DDRs for both landline and mobile phone users. These DDRs may include DDR information corresponding to a user identifier, such as network speed, total session traffic and duration, etc.

[0052] In step S208, SIP session data and user internet access call detail records are associated and integrated according to user identifiers to obtain a SIP user information list. The SIP user information list includes SIP session information and internet access call detail records for each user under test.

[0053] In some embodiments, the obtained SIP session data can be combined and parsed with the user attributes of mobile network users' internet access call details and fixed network users' internet access call details to obtain a user information list including SIP session information and internet access call details of each user under test. User attribute features from the SIP session information monitored by the large network can be obtained, including the user's daily SIP session traffic, session duration, first session time, last session time, called number, device user agent information, and server IP. User attribute features from the internet access call details of mobile network users and fixed network users can be obtained, including user type, user IP, user port, user internet access time, user's total daily traffic, user uplink rate, and user downlink rate. The obtained SIP session data can then be combined and parsed with the user attributes of mobile network users' internet access call details and fixed network users' internet access call details.

[0054] For example, SIP session data, user data and service attributes (SIP session traffic, rate, SIP session time, called number, application layer User Agent, server IP) in mobile network and fixed network user internet access call details can be associated and integrated to form a SIP user information database. The obtained SIP session information may include SIP user agent identifier, server IP, called number type information, SIP session time information and port information, etc. Internet access call detail information may include network rate, all session traffic, session duration, etc.

[0055] In step S210, based on the SIP session information and Internet access call detail records of each user under test, abnormal users among multiple users under test are identified in order to detect abnormal virtual dialing devices corresponding to the abnormal users.

[0056] In some embodiments, the feature set of each user under test can be obtained based on the SIP session information and Internet access call detail records of each user under test. The feature set may include multiple standardized features, including SIP session features, network speed features, and user type features. Then, based on the feature set of each user under test, each user under test is classified to identify abnormal users among the multiple users under test.

[0057] In some embodiments, SIP session characteristics may include features such as SIP session traffic percentage, session duration, first session time, and last session time. Network rate characteristics may include features such as uplink rate and uplink / downlink rate comparison. Multiple features may also include SIP user agent comparison features and server IP comparison features. Multiple features may also include called number dispersion features. Specific implementation methods for obtaining each feature can be found in [reference needed]. Figure 7 and Figure 8 .

[0058] For example, the obtained SIP user information database can be extracted and cleaned to generate a training feature subset. Then, using the feature subset data and historical anomaly data, the model can be trained iteratively multiple times with the goal of minimizing the mean squared error, to obtain the final GOIP anomaly detection classification model, which can then be used to identify the SIP user information database updated in step S208. Specific implementation methods for training the classification model can be found in [reference needed]. Figure 9 and Figure 10 .

[0059] In some embodiments, abnormal GOIP devices can be traced based on the server IP, SIP session time information, and port information in the SIP session information of abnormal users. Specific implementation methods can be found in [reference needed]. Figure 11 and Figure 12 .

[0060] According to the abnormal virtual dialing device detection method provided in this disclosure, based on application layer protocol characteristics, it achieves accurate identification of SIP sessions across the entire network: by identifying application layer traffic characteristics at multiple points, a SIP session information identification model is established, and existing network monitoring systems are used to achieve near real-time monitoring capabilities of carrier-grade network-wide SIP traffic; multi-dimensional combination judgment improves the accuracy of GOIP abnormal device identification: by analyzing and identifying known normal and abnormal services, based on the correlation between multi-dimensional attributes such as SIP protocol traffic, session time, called number, User Agent information, and server IP and abnormal GOIP calls, a GOIP abnormal identification model is established, improving the ability to determine abnormalities and accurately identifying abnormal devices.

[0061] Figure 3 It shows Figure 2 The step S202 shown is a schematic diagram of the processing procedure in one embodiment. (See attached diagram.) Figure 3 As shown in the present embodiment, step S202 may further include steps S302 to S304.

[0062] Step S302: Use an anomaly monitoring system to capture network traffic data.

[0063] In some embodiments, monitoring data and logs from multiple systems may be received.

[0064] Step S304: Remove the header information of the link layer from the network traffic data, extract the protocol information data of the transport layer, network layer, and application layer, and obtain the target network traffic data.

[0065] In some embodiments, existing network traffic can be collected using a fixed network bot / worm monitoring system and / or a mobile network mobile malware monitoring system. Header information from the link layer and other layers can be removed, and transport layer, network layer, and application layer protocol information data packets can be extracted and their size limited to ensure that all necessary control information is retained.

[0066] Related technologies require the construction of dedicated detection systems, consuming significant computing resources and deploying multiple monitoring points, making large-scale deployment difficult. The method provided in this disclosure can be implemented lightweightly by leveraging the capabilities of existing network botnet / worm and mobile malware monitoring systems, resulting in lower overall costs. Monitoring points can be set up on the operator's egress network side to ensure full network coverage.

[0067] Figure 4 It shows Figure 2 The step S204 shown is a schematic diagram of the processing procedure in one embodiment. Figure 4 A SIP session information identification and analysis model can be established and loaded onto a large-scale network monitoring system for SIP session identification in live network traffic. For example... Figure 4As shown in the present embodiment, step S204 may further include steps S402 to S414.

[0068] Step S402: Parse the target network traffic data according to the preset SIP request message identification rules to obtain the SIP request message identification result.

[0069] Step S404: Parse the target network traffic data according to the preset SIP response message recognition rules to obtain the SIP response message recognition result.

[0070] Step S406: Identify the SIP session from the target network traffic data based on the SIP request message identification result and the SIP response message identification result.

[0071] In some embodiments, whether it is a SIP session can be determined by combining SIP request and response message rules. For example, SIP request message: SIP Request = Method + Request-URI + SIP-Version, the identification rule for creating a request message is: (invite|register|cancel)sip[\x09-\x0d-~]*sip / [0-2]\.[0-9]; SIP response message: SIPResponse = SIP-Version + Status-Code + Reason-Phrase, the identification rule for creating a response message is: sip / [0-2]\.[0-9][1-5][0-9][0-9][a-zA-Z]*.

[0072] Step S408: Obtain complete information about the identified SIP session according to the SIP session termination request identification rules.

[0073] In some embodiments, a complete SIP session can be identified by a bye request, and the from tag + to tag + call id can be used as the unique identifier of the session.

[0074] Step S410: Parse the called number field corresponding to the identified SIP session to obtain the called number type information of the SIP session data.

[0075] In some embodiments, the to tag field can be parsed to create called number identification rules, and the numbers can be identified and output according to type: mobile phone number, SIP sequence number + mobile phone number, mobile phone number + SIP sequence number, landline number, SIP sequence number + landline number, landline number + SIP sequence number, in order to exclude intranet calls.

[0076] Step S412: Parse the SIP header field corresponding to the identified SIP session to obtain the SIP user agent identifier and server IP of the SIP session data.

[0077] In some embodiments, the SIP header can be parsed to obtain the server IP (Internet Protocol) and user agent information.

[0078] Step S414: Parse the complete information of the identified SIP session to obtain SIP session time information, SIP session size information and port information.

[0079] In some embodiments, SIP session time (e.g., may include session start and end time), session size (bytes), client IP, and port information can be parsed and obtained.

[0080] In some embodiments, rules can be associated to form a SIP session identification model, which outputs complete SIP session information, including session identifier, session start and end time, called number, and other information.

[0081] For example, the output SIP session information can be shown in Table 1 below.

[0082] Table 1

[0083]

[0084] Among them, From_to_call id represents the session identifier, Start_time represents the session start time, End_time represents the session end time, Called_num represents the called number, and Diaglog_byte represents the session size.

[0085] Figure 5 It is based on Figure 3 and Figure 4 A schematic diagram of an exemplary live network monitoring program interface is shown. Figure 5 As shown, in the left column of the live network botnet worm program interface, you can select "Log Report" -> "Internet Behavior Log". Then, you can select the time, such as "Last 6 Hours", the threat level system, and load the SIP session identification model by selecting the application name "SIP". Then, by selecting the format type of the exported report in "Batch Operation", you can output full SIP session data on a daily basis, including time, local peer IP (source IP and destination IP), port, UA information, SIP session information, etc.

[0086] Figure 6 It is based on Figures 3 to 5This diagram illustrates a SIP session data list output interface. Figure 6 As shown, it can output full SIP session data on a daily basis, including time, source IP, destination IP, source port, destination port, protocol information, etc.

[0087] The SIP session identification method provided in this disclosure identifies SIP sessions through application layer information features. Compared with related technologies that rely on IP and port identification at the network and transport layers, this method avoids limitations in scenarios such as changing the default SIP port or using a proxy, thus improving the accuracy of SIP session identification. It solves the problem that related technologies based on internet data sampling, IP, and port analysis cannot effectively identify the voice SIP protocol. Furthermore, this method can be easily implemented by modifying existing application layer monitoring technologies.

[0088] Figure 7 It shows Figure 2 The step S210 shown is a schematic diagram of the processing procedure in one embodiment. (See attached diagram.) Figure 7 As shown in the present embodiment, step S210 may further include the following steps.

[0089] Step S702: Obtain the SIP session characteristics of each user under test based on their SIP session information and Internet access call detail records.

[0090] In some embodiments, SIP session characteristics may include features such as SIP session traffic percentage, session duration, first session time, and last session time.

[0091] Step S704: Obtain the network speed characteristics and user type characteristics of each user under test based on the internet access call detail records of each user under test.

[0092] In some embodiments, network rate characteristics may include features such as uplink rate and uplink / downlink rate comparison.

[0093] Step S706: Compare the SIP user agent identifier of each user under test with the list of abnormal user agents to obtain the SIP user agent comparison characteristics of each user under test.

[0094] In some embodiments, the application layer User Agent can be associated with a UA anomaly blacklist, and the characteristics of whether it hits the UA blacklist database can be output.

[0095] Step S708: Compare the server IP of each user under test with the list of abnormal server IPs to obtain the server IP comparison characteristics of each user under test.

[0096] In some embodiments, the server IP may include a source IP and a target IP. The server IP can be associated with an intelligence database of abnormal overseas GOIP platforms, and the system can output whether the database contains a match. Sources of this intelligence database may include, for example, information from public security case databases, historical blacklists, vendor intelligence, etc.

[0097] Step S710: Perform dictionary-type feature extraction processing on the called number type information of each user under test to obtain the called number dispersion features of each user under test.

[0098] In some embodiments, category attributes such as called numbers can be discretized using dictionary features.

[0099] In some embodiments, all features can be standardized to ensure that each feature is converted to a uniform specification, ultimately forming a feature subset: SIP session traffic share, uplink rate, uplink / downlink rate comparison, user type, session duration, first session time, last session time, called number dispersion, device UA hit UA blacklist, server IP hit intelligence database, etc. Table 2 below shows the fields, data format, meaning, and other information for each feature.

[0100] Table 2

[0101]

[0102] Figure 8 It is based on Figure 7 This diagram illustrates a data processing procedure. Figure 8 As shown, firstly, user data and service attributes (SIP session traffic, rate, SIP session time, called number, application layer User Agent, server IP, etc.) in SIP session data 802, mobile network user internet access call detail records 804, and fixed network user internet access call detail records 806 are extracted and cleaned (S8002). Then, the server IP is associated with the overseas abnormal GOIP platform intelligence database 808 (S8004), outputting the feature indicating whether it matches the abnormal platform intelligence database; and the application layer User Agent is associated with the UA abnormal blacklist 810 (S8004), outputting the feature indicating whether it matches the UA blacklist database. Then, the called number and other category attributes are discretized using dictionary features, and all features are standardized (S8006) to ensure that each feature is converted to a uniform specification, ultimately forming a feature subset.

[0103] Related technologies often rely on call detail records (CDRs) and phone number registration characteristics for analysis, which can lead to relatively large errors. The method provided in this disclosure adds multiple factors for judgment, including SIP session analysis, application-layer UserAgent information matching, and threat intelligence comparison, expanding the associated attributes and resulting in higher accuracy in identifying abnormal devices. Since mobile malware monitoring systems already cover 5G networks, the method provided in this disclosure can also be applied to SIP session monitoring on 5G networks to further determine whether GOIP anomalies are involved.

[0104] Figure 9 It shows Figure 2 The illustrated step S210 is a process diagram in another embodiment. (See diagram below.) Figure 9 As shown in the present embodiment, step S210 may further include the following steps.

[0105] Step S902: Obtain the feature sets of historical normal users and the feature sets of historical abnormal users.

[0106] Step S904: Using the feature sets of historical normal users and the feature sets of historical abnormal users, the initial random forest classification model is iteratively trained with the goal of minimizing the mean square error, to obtain the trained random forest classification model.

[0107] Step S906: Based on the feature set of each user to be tested, the trained random forest classification model is used to classify each user to be tested and identify abnormal users among the multiple users to be tested.

[0108] Figure 10 It is based on Figures 7 to 9 This diagram illustrates a process for establishing a detection model for abnormal GOIP devices. Figure 10 As shown, a decision tree can be constructed based on the random forest algorithm 1008 in ensemble learning for the feature set 1002 in Table 2. The normal business 1006 is assigned a value of 0, and the abnormal business 1004 is assigned a value of 1. According to the objective of minimizing the mean square error, the model is trained iteratively (S10002) to obtain the final classification model 1010 for GOIP anomaly detection. The classification model 1010 for GOIP anomaly detection can be represented as Y = f(a,b,c,d,e,f,g,h,i,j), that is, the feature set 1002 corresponds to the inputs a, b, ..., and the output is the anomaly value Y of the GOIP device (0 for normal, 1 for abnormal).

[0109] Figure 11 It shows Figure 2 The illustrated step S210 is a process diagram in another embodiment. (See diagram below.) Figure 11 As shown in the present embodiment, step S210 may further include the following steps.

[0110] Step S1102: Identify abnormal users based on the SIP session information and Internet access call detail records of each user under test.

[0111] Step S1104: Using the source tracing system, associate the server IP, SIP session time information, and port information in the SIP session information of the abnormal user with the broadband installation address and related user information to obtain the location information of the abnormal virtual dial-up device corresponding to the abnormal user.

[0112] In some embodiments, the obtained user's local IP address, port, and time information used for anomalies can be used to trace the user's phone number / broadband installation address and other information through tracing systems such as AAA (Authentication, Authorization, and Accounting) and CRM (Customer Relationship Management) to output the GOIP device location. This solves the technical problem in related technologies where methods based on phone numbers and call detail records to analyze abnormal behavior can only locate the base station and cannot accurately locate the GOIP device.

[0113] Figure 12 It is based on Figure 2 , Figure 4 and Figure 11 This diagram illustrates a process for tracing the origin of an abnormal GOID device. Figure 12 As shown, the SIP session list 1202 is associated with the GOIP anomaly detection model 1204 to output the abnormal user list 1206. Then, based on the time, local IP, port and other information in the abnormal user list 1206, the GOIP device location 1210 is output by using the tracing system 1208 such as AAA and CRM to trace the broadband installation address and user information.

[0114] Related technologies rely on monitoring point deployment methods to analyze GOIP probe traffic, but coverage cannot be guaranteed. The method provided in this disclosure achieves GOIP monitoring by utilizing a monitoring system on the network egress side, ensuring 100% coverage of carrier-grade networks. Currently, the three major domestic telecommunications operators are all integrated service operators, possessing both mobile and wired broadband networks; therefore, the method in this disclosure is applicable to all three operators.

[0115] Figure 13 It is based on Figures 2 to 12 This diagram illustrates the overall process for detecting abnormal GOIP devices. Figure 13 As shown, the overall process for detecting abnormal GOIP devices may include the following steps S1302 to S1308.

[0116] Step S1302: Establish a SIP session identification model.

[0117] 1) Analyze the application layer characteristics of the SIP protocol;

[0118] 2) Establish a SIP session identification model. For specific implementation details, please refer to... Figure 4 .

[0119] Step S1304: Live network traffic collection and analysis.

[0120] 1) Collect live network traffic using a fixed-line bot / worm monitoring system and a mobile network malware monitoring system; for specific implementation details, please refer to [link / reference]. Figure 3 ;

[0121] 2) Load the SIP session identification model to identify the entire SIP session information list. For detailed implementation instructions, please refer to... Figures 4 to 6 .

[0122] Step S1306: Establish the GOIP anomaly identification model.

[0123] 1) Collect normal GOIP services and historically known abnormal services to form a sample set;

[0124] 2) Perform feature engineering on the sample set, extracting features including: SIP protocol traffic percentage, application layer UserAgent, called number dispersion, usage time period, and whether threat intelligence is matched; for specific implementation methods, please refer to Figure 7 and Table 2;

[0125] 3) A random forest is used to train the sample to form a classification and recognition model. For specific implementation details, please refer to [link / reference needed]. Figure 9 .

[0126] Step S1308: Output a list of abnormal users.

[0127] 1) Associate the SIP session information list collected from the existing network with the GOIP anomaly identification model to obtain the final list of abnormal users; for specific implementation details, please refer to... Figure 10 .

[0128] 2) Based on the list of abnormal users, locate the device using systems such as AAA and CRM.

[0129] For detailed implementation methods, please refer to... Figure 11 .

[0130] Figure 14 It is based on Figures 2 to 12 A schematic diagram of an abnormal GOIP device detection system is shown. Figure 14As shown, the system may include a session data acquisition module 1402, a user information module 1404, an intelligence module 1406, an anomaly judgment module 1408, and a device traceability module 1410.

[0131] The session data acquisition module 1402 can be used to identify and distinguish different types of user session data for SIP sessions based on application layer characteristics. For specific implementation details, please refer to [reference needed]. Figure 4 .

[0132] User information module 1404 can be used to integrate user information data based on SIP session data, fixed network and mobile network user internet access call detail records. For specific implementation, please refer to step S208.

[0133] Intelligence module 1406 contains a UA blacklist database, information on abnormal overseas GOIP platforms, and historical abnormal business information, and can be used in steps S706, S708, and S902.

[0134] The anomaly detection module 1408 can be used to implement the above-mentioned trained random forest classification model, and to calculate the probability of anomalies based on user session and business attribute information.

[0135] Device tracing module 1410 is used to trace and locate the IP addresses of abnormal services. For specific implementation details, please refer to [reference needed]. Figure 11 and Figure 12 .

[0136] The technical solutions of the embodiments of this disclosure will be further described below in conjunction with specific application scenarios.

[0137] Example: Using 10,000 recent abnormal business flows for verification, the confusion matrix and accuracy and recall data obtained after classification and identification by the random forest classification model provided in this embodiment are shown in Table 3 below.

[0138] Table 3

[0139]

[0140] Wherein, TP represents the number of correctly predicted as anomalous, TN represents the number of correctly predicted as normal, FN represents the number of incorrectly predicted as normal, and FP represents the number of incorrectly predicted as anomalous.

[0141] Accuracy: The percentage of all correct predictions.

[0142]

[0143] Precision: The percentage of correctly predicted anomalies out of all correctly predicted anomalies.

[0144]

[0145] Recall rate: The proportion of correctly predicted anomalies out of all actual anomalies.

[0146]

[0147] This model balances both classification precision and recall.

[0148]

[0149] As can be seen, the model has high precision and recall, therefore the model is highly accurate.

[0150] Figure 15 This is a block diagram illustrating an abnormal virtual dialer detection device according to an exemplary embodiment. (Reference) Figure 15 The apparatus 150 provided in this embodiment may include a first acquisition module 1502, a traffic parsing module 1504, a second acquisition module 1506, an information processing module 1508, and an anomaly identification module 1510.

[0151] The first acquisition module 1502 can be used to acquire target network traffic data.

[0152] The traffic parsing module 1504 can be used to parse target network traffic data based on application layer characteristics and obtain Session Initiation Protocol (SIP) session data from the target network traffic data.

[0153] The second acquisition module 1506 can be used to acquire user internet access call detail records (CDRs).

[0154] The information processing module 1508 can be used to associate and integrate SIP session data and user internet access call detail records according to user identifiers to obtain a SIP user information list, which includes SIP session information and internet access call detail records of each user under test.

[0155] The anomaly identification module 1510 can be used to identify abnormal users among multiple users under test based on the SIP session information and Internet access call detail records of each user under test, so as to detect abnormal virtual dialing devices corresponding to abnormal users.

[0156] Figure 16 This is a block diagram illustrating another abnormal virtual dialer detection device according to an exemplary embodiment. (Reference) Figure 16 The apparatus 160 provided in this embodiment may include a first acquisition module 1602, a traffic parsing module 1604, a second acquisition module 1606, an information processing module 1608, a model building module 1609, and an anomaly identification module 1610.

[0157] The first acquisition module 1602 can be used to acquire target network traffic data.

[0158] The first acquisition module 1602 can also be used to capture network traffic data using an anomaly monitoring system; remove the header information of the link layer from the network traffic data, extract the protocol information data of the transport layer, network layer, and application layer, and obtain the target network traffic data.

[0159] The traffic parsing module 1604 can be used to parse target network traffic data based on application layer characteristics and obtain Session Initiation Protocol (SIP) session data from the target network traffic data.

[0160] SIP session data may include SIP user agent identifier, server IP, and port information.

[0161] SIP session data can also include called number type information.

[0162] SIP session data can also include SIP session time information and SIP session size information.

[0163] The traffic parsing module 1604 can also be used to identify SIP sessions from target network traffic data based on application layer characteristics; and to parse the SIP header field corresponding to the identified SIP session to obtain the SIP user agent identifier and server IP of the SIP session data.

[0164] The traffic parsing module 1604 can also be used to identify SIP sessions from target network traffic data based on application layer features; and to parse the called number field corresponding to the identified SIP session to obtain the called number type information of the SIP session data.

[0165] The traffic parsing module 1604 can also be used to parse target network traffic data according to preset SIP request message identification rules to obtain SIP request message identification results; parse target network traffic data according to preset SIP response message identification rules to obtain SIP response message identification results; identify SIP sessions from target network traffic data based on SIP request message identification results and SIP response message identification results; obtain complete information of the identified SIP sessions according to SIP session termination request identification rules; and parse the complete information of the identified SIP sessions to obtain SIP session time information, SIP session size information, and port information.

[0166] The second acquisition module 1606 can be used to acquire user internet access call detail records (CDRs).

[0167] The information processing module 1608 can be used to associate and integrate SIP session data and user internet access call detail records according to user identifiers to obtain a SIP user information list, which includes SIP session information and internet access call detail records of each user under test.

[0168] SIP session information may include the SIP user agent identifier and the server IP.

[0169] SIP session information can also include called number type information.

[0170] The model building module 1609 can be used to obtain the feature sets of historical normal users and historical abnormal users; using the feature sets of historical normal users and historical abnormal users, the initial random forest classification model is iteratively trained with the goal of minimizing the mean square error, to obtain the trained random forest classification model.

[0171] The anomaly identification module 1610 can be used to identify abnormal users among multiple users under test based on the SIP session information and Internet access call detail records of each user under test, so as to detect abnormal virtual dialing devices corresponding to abnormal users.

[0172] The anomaly identification module 1610 can also be used to obtain the feature set of each user under test based on the SIP session information and Internet access call detail records of each user under test. The feature set includes multiple standardized features, including SIP session features, network speed features, and user type features. Based on the feature set of each user under test, the module classifies each user under test and identifies abnormal users among the multiple users under test.

[0173] Multiple features may also include SIP user agent matching features and server IP matching features.

[0174] Multiple features may also include the called number dispersion feature.

[0175] The anomaly identification module 1610 can also be used to compare the SIP user agent identifier of each user under test with the list of abnormal user agents to obtain the SIP user agent comparison characteristics of each user under test; and to compare the server IP of each user under test with the list of abnormal server IPs to obtain the server IP comparison characteristics of each user under test.

[0176] The anomaly detection module 1610 can also be used to classify each user under test using a trained random forest classification model based on the feature set of each user under test, and identify abnormal users among multiple users under test.

[0177] The anomaly identification module 1610 can also be used to perform dictionary-type feature extraction processing on the called number type information of each user under test to obtain the called number dispersion features of each user under test.

[0178] The anomaly identification module 1610 can also be used to identify abnormal users based on the SIP session information and Internet access call detail records of each user under test; and use the tracing system to associate the server IP, SIP session time information and port information in the SIP session information of the abnormal user with the broadband installation address and related user information to obtain the location information of the abnormal virtual dial-up device corresponding to the abnormal user.

[0179] The specific implementation of each module in the device provided in this embodiment can be referred to the content of the above method, and will not be repeated here.

[0180] Figure 17 A schematic diagram of the structure of an electronic device according to an embodiment of this disclosure is shown. It should be noted that... Figure 17 The devices shown are merely examples of computer systems and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0181] like Figure 17 As shown, device 1700 includes a central processing unit (CPU) 1701, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1702 or a program loaded from storage section 1708 into random access memory (RAM) 1703. RAM 1703 also stores various programs and data required for the operation of device 1700. CPU 1701, ROM 1702, and RAM 1703 are interconnected via bus 1704. Input / output (I / O) interface 1705 is also connected to bus 1704.

[0182] The following components are connected to I / O interface 1705: an input section 1706 including a keyboard, mouse, etc.; an output section 1707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1708 including a hard disk, etc.; and a communication section 1709 including a network interface card such as a LAN card, modem, etc. The communication section 1709 performs communication processing via a network such as the Internet. A drive 1710 is also connected to I / O interface 1705 as needed. Removable media 1711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1710 as needed so that computer programs read from them can be installed into storage section 1708 as needed.

[0183] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1709, and / or installed from removable medium 1711. When the computer program is executed by central processing unit (CPU) 1701, it performs the functions defined above in the system of this disclosure.

[0184] It should be noted that the computer-readable medium disclosed herein may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0185] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0186] The modules described in the embodiments of this disclosure can be implemented in software or hardware. The described modules can also be housed in a processor; for example, a processor may be described as including a first acquisition module, a traffic parsing module, a second acquisition module, an information processing module, and an anomaly identification module. The names of these modules do not necessarily limit the module itself; for example, the first acquisition module may also be described as a "module for collecting network traffic".

[0187] In another aspect, this disclosure also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to include:

[0188] Acquire target network traffic data; parse the target network traffic data based on application layer characteristics to obtain SIP session initiation protocol data; acquire user internet access detail records (DDRs); associate and integrate the SIP session data and user internet access detail records according to user identifiers to obtain a SIP user information list, which includes SIP session information and internet access detail records for each user under test; identify abnormal users among multiple users under test based on the SIP session information and internet access detail records for each user under test, in order to detect abnormal virtual dial-up devices corresponding to the abnormal users.

[0189] Exemplary embodiments of this disclosure have been specifically shown and described above. It should be understood that this disclosure is not limited to the detailed structures, arrangements, or implementations described herein; rather, this disclosure is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A method for detecting abnormal virtual dialing devices, characterized in that, include: An anomaly monitoring system is used to capture network traffic data, and the monitoring points of the anomaly monitoring system are set on the operator's egress network side. Remove the header information of the link layer from the entire network traffic data, and extract the protocol information data of the transport layer, network layer, and application layer to obtain the target network traffic data. Based on application layer characteristics, the target network traffic data is parsed to obtain Session Initiation Protocol (SIP) session data, which includes SIP session time information, server IP, and port information. Obtain user internet access call detail records; The SIP session data and the user's internet access call detail data are associated and integrated according to the user identifier to obtain a SIP user information list, which includes the SIP session information and internet access call detail information of each user under test. Based on the SIP session information and Internet access call detail records of each user under test, abnormal users among multiple users under test are identified in order to detect abnormal virtual dialing devices corresponding to the abnormal users. The SIP session data and the user's internet access detail record data are associated and integrated according to the user identifier, including: Obtain user attribute features from the SIP session data, which include the user's daily SIP session traffic, session duration, first session time, last session time, called number, device user agent information, and server IP. The user attribute features in the Internet access call detail records are obtained, including user type, user IP, user port, user Internet access time, user's total daily traffic, user's uplink speed, and user's downlink speed. The user attribute features of the SIP session data are combined and parsed; Based on the SIP session information and internet access call detail records of each user under test, abnormal users are identified among multiple users under test, and abnormal virtual dial-up devices corresponding to the abnormal users are detected, including: The abnormal users were identified based on the SIP session information and Internet access call detail records of each user under test. By using the tracing system, the server IP, SIP session time information, and port information in the SIP session information of the abnormal user are associated with the broadband installation address and related user information to obtain the location information of the abnormal virtual dial-up device corresponding to the abnormal user.

2. The method according to claim 1, characterized in that, Based on the SIP session information and internet access call detail records of each user under test, several abnormal users were identified, including: The feature set of each user under test is obtained based on the SIP session information and Internet access call detail records of each user under test. The feature set includes multiple standardized features, including SIP session features, network speed features, and user type features. Based on the feature sets of each user under test, each user under test is classified, and abnormal users are identified among the multiple users under test.

3. The method according to claim 2, characterized in that, Also includes: Obtain the feature sets of historical normal users and historical abnormal users; The initial random forest classification model is iteratively trained using the feature sets of historical normal users and the feature sets of historical abnormal users with the goal of minimizing the mean squared error, to obtain the trained random forest classification model. Based on the feature sets of each user under test, the users are classified to identify abnormal users among the multiple users under test, including: Based on the feature sets of each user under test, the trained random forest classification model is used to classify each user under test and identify abnormal users among the multiple users under test.

4. The method according to claim 2, characterized in that, The SIP session data includes the SIP user agent identifier and the server IP; The target network traffic data is parsed based on application layer characteristics to obtain Session Initiation Protocol (SIP) session data, including: SIP sessions are identified from the target network traffic data based on application layer characteristics; The SIP header field corresponding to the identified SIP session is parsed to obtain the SIP user agent identifier and server IP of the SIP session data. The SIP session information includes the SIP user agent identifier and the server IP; The multiple features also include SIP user agent comparison features and server IP comparison features; Based on the SIP session information and internet access call detail records of each user under test, a feature set for each user under test is obtained, including: The SIP user agent identifier of each user under test is compared with the list of abnormal user agents to obtain the SIP user agent comparison characteristics of each user under test. The server IP of each user under test is compared with the list of abnormal server IPs to obtain the server IP comparison characteristics of each user under test.

5. The method according to claim 2, characterized in that, The SIP session data includes called number type information; The target network traffic data is parsed based on application layer characteristics to obtain Session Initiation Protocol (SIP) session data, including: SIP sessions are identified from the target network traffic data based on application layer characteristics; The called number field corresponding to the identified SIP session is parsed to obtain the called number type information of the SIP session data. The SIP session information includes called number type information; The multiple features also include the called number dispersion feature; Based on the SIP session information and internet access call detail records of each user under test, a feature set for each user under test is obtained, including: Dictionary-type feature extraction is performed on the called number type information of each user under test to obtain the called number dispersion feature of each user under test.

6. The method according to claim 1, characterized in that, The SIP session data includes SIP session time information and SIP session size information; The target network traffic data is parsed based on application layer characteristics to obtain Session Initiation Protocol (SIP) session data, including: The target network traffic data is parsed according to the preset SIP request message identification rules to obtain the SIP request message identification result; The target network traffic data is parsed according to the preset SIP response message recognition rules to obtain the SIP response message recognition result; SIP sessions are identified from the target network traffic data based on the SIP request message identification results and the SIP response message identification results; Obtain complete information about the identified SIP session according to the SIP session termination request identification rules; The complete information of the identified SIP session is parsed to obtain the SIP session time information and the SIP session size information.

7. The method according to claim 1, characterized in that, The target network traffic data is parsed based on application layer characteristics to obtain Session Initiation Protocol (SIP) session data, including: SIP sessions are identified from the target network traffic data based on application layer characteristics; The SIP header field corresponding to the identified SIP session is parsed to obtain the server IP of the SIP session data. The identified SIP sessions are parsed to obtain the SIP session time information and the port information; The SIP session information includes the server IP, SIP session time information, and port information.

8. A device for detecting abnormal virtual dialing devices, characterized in that, include: The first acquisition module is used to capture network traffic data using an anomaly monitoring system, wherein the monitoring points of the anomaly monitoring system are set on the operator's egress network side. Remove the header information of the link layer from the entire network traffic data, and extract the protocol information data of the transport layer, network layer, and application layer to obtain the target network traffic data. The traffic parsing module is used to parse the target network traffic data based on application layer characteristics and obtain Session Initiation Protocol (SIP) session data from the target network traffic data. The SIP session data includes SIP session time information, server IP, and port information. The second acquisition module is used to acquire user internet access call detail records (CDRs). The information processing module is used to associate and integrate the SIP session data and the user's Internet access call detail record data according to the user identifier to obtain a SIP user information list, which includes the SIP session information and Internet access call detail record information of each user under test. The information processing module is further configured to: acquire user attribute features from the SIP session data, including user's daily SIP session traffic, session duration, first session time, last session time, called number, device user agent information, and server IP; acquire user attribute features from the internet access call detail records, including user type, user IP, user port, user internet access time, user's total daily traffic, user uplink rate, and user downlink rate; and combine and parse the user attribute features from the SIP session data. An anomaly identification module is used to identify abnormal users among multiple users under test based on the SIP session information and Internet access call detail records of each user under test, so as to detect abnormal virtual dialing devices corresponding to the abnormal users. The anomaly identification module is also used to identify the abnormal user based on the SIP session information and Internet access call detail records of each user under test; and to use the source tracing system to associate the server IP, SIP session time information and port information in the SIP session information of the abnormal user with the broadband installation address and related user information to obtain the location information of the abnormal virtual dial-up device corresponding to the abnormal user.

9. An electronic device, comprising: A memory, a processor, and executable instructions stored in the memory and executable in the processor, characterized in that the processor, when executing the executable instructions, implements the method as described in any one of claims 1-7.

Images