An intelligent monitoring system for suspicious calls of mobile users

Abstract

The present invention belongs to the technical field of telephone monitoring, and specifically is an intelligent monitoring system for suspicious calls of mobile users, comprising a suspicious call monitoring reminder platform, wherein the suspicious call monitoring reminder platform comprises a suspicious call reminder service contract module, a user reminder strategy generation module, a suspicious number library, a user call behavior monitoring module, a real-time call authentication module and a reminder information push module; the present invention forwards calls based on an IP network of an IMS core network, does not require monitoring equipment deployment and link bypass construction, and has very low implementation costs; based on the contract triggering of service users, the monitored call signaling data volume is small; based on HSS contract processing, it does not involve processing of other core communication network elements, does not require supplementary implementation according to core network expansion, has strong adaptability, and combines user harassment supervision analysis, platform security supervision analysis and trust analysis to fully guarantee the prevention of suspicious performance.

Description

Technical Field

[0001] The invention relates to the technical field of telephone monitoring, in particular to an intelligent monitoring system for suspicious telephone calls of mobile users. Background Art

[0002] With the continuous development of communication technology, the problem of suspicious calls has become more and more prominent. These calls often pretend to be banks, public security, government and other institutions, and use various reasons to defraud users' personal information and property, which seriously endangers the personal safety and property safety of citizens. The existing technology often uses a suspicious phone monitoring platform to monitor calls, and monitors call events by bypassing the link to prevent suspicious calls. However, it needs to monitor many links, and needs to deploy various bypass devices and signaling collection devices accordingly. The project implementation is complicated, the project workload is very large, the implementation cost is high, and almost all call signaling data is collected, the data volume is large, and the resource requirements of the system are also relatively high. In addition, the link bypass collection construction that needs to be supplemented in time has a very large maintenance workload. Moreover, it is difficult for the existing phone monitoring platform to realize the combined analysis of platform security and platform user trust, and it is difficult to improve the platform in a timely and targeted manner, which is not conducive to ensuring the performance of the platform.

[0003] In view of the above technical defects, a solution is now proposed. Summary of the invention

[0004] The purpose of the present invention is to provide an intelligent monitoring system for suspicious calls of mobile users, which solves the problem that the prior art realizes call event monitoring by bypassing the link for collection, there are many links to be monitored, the project implementation is complex, the project workload is very large, the implementation cost is high, the data volume is large, the system resource requirements are high, and the link bypass collection construction needs to be supplemented in time, the maintenance workload is very large, and it is difficult to achieve a combined analysis of the platform security and the platform user trust, and it is difficult to make timely and targeted platform improvements.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] An intelligent monitoring system for suspicious calls of mobile users includes a suspicious call monitoring and reminding platform, which includes a suspicious call reminder service contracting module, a user reminder strategy generation module, a suspicious number library, a user call behavior monitoring module, a real-time call authentication module and a reminder information push module; the suspicious call reminder service contracting module is used to allocate corresponding service keys for suspicious call reminder services, collect user service handling requests, and sign service key contracts for users in HSS when users handle suspicious call reminder services, mark corresponding users as contracted users after corresponding users successfully sign suspicious call reminder services, and send contracted users to the user reminder strategy generation module via the suspicious call monitoring and reminding platform;

[0007] The user reminder policy generation module is used to generate a suspicious call reminder policy for the corresponding subscriber based on the suspicious call reminder policy model and the service requirements of the corresponding subscriber, and store the identity information of the subscriber and the corresponding suspicious call reminder policy, so as to flexibly adapt to the needs of different customers and quickly meet the service requirements of the corresponding customers; the user call behavior monitoring module is used to monitor the calls of the corresponding subscriber. When the corresponding subscriber makes a call, the S-CSCF routes the call to the suspicious call monitoring reminder platform according to the subscription information of the corresponding subscriber in the HSS. The suspicious call monitoring reminder platform triggers the suspicious call reminder service based on the call of the corresponding subscriber;

[0008] When the suspicious call reminder service is triggered, the real-time call authentication module authenticates the number called by the corresponding contracted user in real time based on the real-time call behavior of the corresponding contracted user and in combination with the suspicious number database. If the number of the other party of the call is determined to be a suspicious number, a harassment reminder signal is generated and sent to the reminder information push module through the suspicious call monitoring reminder platform; after receiving the harassment reminder signal, the reminder information push module generates corresponding suspicious reminder content based on the suspicious call reminder strategy of the corresponding contracted user, and pushes a pop-up flash message to the mobile phone of the corresponding contracted user to remind the corresponding contracted user to be vigilant.

[0009] Furthermore, the suspicious call reminder policy model based on the user reminder policy generation module involves triggering parties, receiving parties, triggering scenarios and push content, wherein the triggering parties include single numbers, number groups and call categories, and the call categories include international calls, IP calls and hidden number calls; the receiving parties include single numbers, number groups, regional users and affiliated operators, and the geographical locations involved in the regional users include provinces and cities; the triggering scenarios include triggering by answering suspicious calls and triggering by making harassing calls; the push content includes fixed content and dynamic templates.

[0010] Furthermore, the suspicious call monitoring and reminder platform also includes a number library analysis and update module, which is used to define a suspicious number analysis model, train and upgrade the suspicious number analysis model, and collect offline call record lists and perform suspicious number analysis in combination with the suspicious number analysis model. Suspicious numbers are captured through analysis, and the captured suspicious number information is sent to the suspicious number library for storage via the suspicious call monitoring and reminder platform.

[0011] Furthermore, the suspicious call monitoring and reminder platform also includes a user supervision and analysis module, which is used to set a supervision period, collect the call frequency of suspicious calls made by the corresponding contracted user within the supervision period and mark it as a harassment frequency, and collect the time interval between two adjacent calls and mark it as an interval duration, and sum up all the interval durations and take the average value to obtain the harassment interval duration;

[0012] The disturbance frequency and the duration between disturbances are numerically compared with the preset disturbance frequency threshold and the preset disturbance time threshold respectively; if the disturbance frequency exceeds the preset disturbance frequency threshold or the duration between disturbances exceeds the preset disturbance time threshold, a suspicious warning signal for the corresponding contracted user is generated, and the suspicious warning signal and related call information are sent to the mobile phone of the corresponding contracted user. After receiving the suspicious warning signal, the corresponding contracted user should increase vigilance and conduct source investigation as needed.

[0013] Furthermore, after generating a suspicious warning signal for the corresponding contracted user, the regional location involved in each harassing call during the supervision period is collected, and the number of calls in the corresponding area is obtained by statistics and marked as the regional frequency value of the corresponding area. The regional frequency value is compared with the preset regional frequency threshold. If the regional frequency value exceeds the preset regional frequency threshold, the corresponding area is marked as a suspicious source area, and all suspicious source areas are sent to the corresponding contracted user's mobile phone to remind the corresponding contracted user to be cautious in making subsequent calls in the corresponding area.

[0014] Furthermore, the suspicious call monitoring and reminder platform is communicatively connected with the platform management and control end. The suspicious call monitoring and reminder platform also includes a platform security supervision and analysis module and a platform trust supervision and analysis module. The platform security supervision and analysis module conducts platform security supervision and analysis on the suspicious call monitoring and reminder platform, generates a platform security early warning signal or a platform security qualified signal through analysis, and sends the platform security early warning signal or the platform security qualified signal to the platform management and control end via the suspicious call monitoring and reminder platform. After receiving the platform security early warning signal, the platform management and control end promptly conducts a cause investigation and strengthens platform security supervision measures; the platform trust supervision and analysis module is used to conduct a trust analysis on the suspicious call monitoring and reminder platform, generates a trust qualified signal or a trust early warning signal through analysis, and sends the trust qualified signal or the trust early warning signal to the platform management and control end via the suspicious call monitoring and reminder platform. After receiving the trust early warning signal, the platform management and control end promptly upgrades the platform prevention function to ensure the effectiveness of preventing suspiciousness.

[0015] Furthermore, the specific analysis process of platform security supervision analysis includes:

[0016] The network vulnerability growth rate and network virus growth rate of the suspicious phone monitoring and reminder platform within a unit time are collected, and the network vulnerability growth rate and network virus growth rate are numerically compared with the preset network vulnerability growth rate threshold and the preset network virus growth rate threshold respectively. If at least one of the network vulnerability growth rate and the network virus growth rate exceeds the corresponding preset threshold, a platform security warning signal is generated; if both the network vulnerability growth rate and the network virus growth rate do not exceed the corresponding preset threshold, the vulnerability repair rate and virus detection rate of the suspicious phone monitoring and reminder platform within a unit time are collected, and the vulnerability repair rate and virus detection rate are numerically compared with the preset vulnerability repair rate threshold and the preset virus detection rate threshold respectively. If at least one of the vulnerability repair rate and the virus detection rate exceeds the corresponding preset threshold, a platform security warning signal is generated.

[0017] Furthermore, if the vulnerability repair rate and the virus detection rate do not exceed the corresponding preset thresholds, the number of crashes and network attack defense parameters of the suspicious phone monitoring reminder platform per unit time are collected, and the number of crashes and the network attack defense parameters are numerically compared with the preset crash number threshold and the preset network attack defense parameter threshold, respectively. If the number of crashes exceeds the preset crash number threshold or the network attack defense parameter does not exceed the preset network attack defense parameter threshold, a platform security warning signal is generated, otherwise a platform security qualified signal is generated.

[0018] Furthermore, the specific analysis process of trust analysis is as follows:

[0019] A questionnaire is sent to the contracted users and the questionnaire survey results of the contracted users are collected; a survey evaluation score of the corresponding contracted users is obtained based on the questionnaire survey results; the survey evaluation score is numerically compared with a preset survey evaluation score threshold; if the survey evaluation score exceeds the preset survey evaluation score threshold, the corresponding contracted user is marked as a positive impact user; otherwise, the corresponding contracted user is marked as a negative impact user; a trust analysis value is obtained by calculating the ratio of the number of negative impact users to the number of positive impact users; the trust analysis value is numerically compared with the preset trust analysis threshold; if the trust analysis value exceeds the preset trust analysis threshold, a trust warning signal is generated; if the trust analysis value does not exceed the preset trust analysis threshold, a trust qualified signal is generated.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] 1. In the present invention, a suspicious call reminder service subscription module is used to sign a service key for a user in HSS, a user reminder policy generation module generates a suspicious call reminder policy for a corresponding subscriber to flexibly adapt to the needs of different customers, S-CSCF routes the call to a suspicious call monitoring reminder platform according to the subscription information of the corresponding subscriber in HSS, a real-time call authentication module authenticates the number called by the corresponding subscriber in real time based on the real-time call behavior of the corresponding subscriber and in combination with a suspicious number library, if the number of the other party of the call is determined to be a suspicious number, a reminder information push module pushes a pop-up flash message to the mobile phone of the corresponding subscriber to remind the corresponding subscriber to be vigilant; call forwarding is performed based on the IP network of the IMS core network, and there is no need to deploy monitoring equipment and link bypass construction, and the implementation cost is very low; based on the subscription trigger of the service user, only the call of the service user is monitored, the amount of call signaling data monitored is relatively small, and the resource demand for the system is also relatively small, which effectively reduces the system cost; and based on the HSS subscription processing, it does not involve the processing of other core communication network elements, and does not need to be supplemented according to the expansion of the core network, and has strong adaptability;

[0022] 2. In the present invention, the supervision cycle is set through the user supervision analysis module, and the harassment frequency and the time between harassment of the corresponding contracted user within the supervision cycle are analyzed, and it is determined whether to generate a suspicious warning signal for the corresponding contracted user and determine the suspicious source area when the suspicious warning signal is generated, which is helpful to protect the property safety of the contracted user; the suspicious phone monitoring reminder platform is subjected to platform security supervision analysis through the platform security supervision analysis module to generate a platform security warning signal or a platform security qualified signal, so as to conduct a cause investigation in time and strengthen the platform security supervision measures to ensure the security and stability of the platform; the suspicious phone monitoring reminder platform is subjected to trust analysis through the platform trust supervision analysis module to generate a trust qualified signal or a trust warning signal, so as to upgrade the platform prevention function in time and fully guarantee the prevention effect of suspicion. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;

[0024] Figure 1 is the overall system block diagram of the present invention;

[0025] Figure 2 It is a schematic diagram of the method flow of the present invention;

[0026] Figure 3 It is a diagram of a call event monitoring solution in the prior art;

[0027] Figure 4 It is a call event monitoring scheme diagram of the present invention;

[0028] Figure 5 It is a communication block diagram of the user supervision and analysis module in the present invention;

[0029] Figure 6 This is a system block diagram of Embodiment 2 and Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] like Figure 3 As shown, in the prior art, a bypass collection method is usually adopted for the link, and the link signal is bypassed to the signaling collection device through a high-impedance device or a switch port mirror, and the signaling collection device analyzes the link signal to extract the call event; by bypassing the link between the S-CSCF and the I-CSCF, the signaling collection device collects the link signaling data, and reports it to the suspicious call reminder platform in real time to trigger the suspicious call reminder service; this solution has the following disadvantages: there are many links to be monitored, and various bypass devices and signaling collection devices need to be deployed accordingly, the project implementation is relatively complicated, the project workload is very large, and the implementation cost is relatively high; this solution collects almost all call signaling data, the data volume is very large, and the resource requirements for the system are also relatively high; with the development of business, when the core network is expanded and new equipment and links are added, it is necessary to carry out supplementary link bypass collection construction in time, and the maintenance workload is very large.

[0032] Embodiment 1:

[0033] like Figure 1-2 and Figure 4 As shown, the present invention proposes an intelligent monitoring system for suspicious calls of mobile users, including a suspicious call monitoring and reminding platform, which includes a suspicious call reminder service contracting module, a user reminder strategy generation module, a suspicious number library, a user call behavior monitoring module, a real-time call authentication module and a reminder information push module; the suspicious call reminder service contracting module is used to allocate corresponding service keys for suspicious call reminder services, collect user service processing requests, and sign service key contracts for users in HSS when users handle suspicious call reminder services, mark the corresponding users as contracted users after the corresponding users successfully sign suspicious call reminder services, and send the contracted users to the user reminder strategy generation module via the suspicious call monitoring and reminding platform;

[0034] The user reminder policy generation module is used to generate a suspicious call reminder policy for the corresponding contracted user based on the suspicious call reminder policy model and the business needs of the corresponding contracted user, and store the identity information of the contracted user and the corresponding suspicious call reminder policy, so as to flexibly adapt to the needs of different customers and quickly meet the business needs of the corresponding customers; wherein, the suspicious call reminder policy model based on the user reminder policy generation module involves triggering parties, receiving parties, triggering scenarios and push content, wherein the triggering parties include single numbers, number groups and call categories, and the call categories include international calls, IP calls and hidden number calls; the receiving parties include single numbers, number groups, regional users and affiliated operators, and the geographical locations involved in the regional users include provinces and cities; the triggering scenarios include triggering by answering suspicious calls and triggering by making harassing calls; the push content includes fixed content and dynamic templates.

[0035] The user call behavior monitoring module is used to monitor calls of the corresponding contracted user. When the corresponding contracted user makes a call, the S-CSCF routes the call to the suspicious call monitoring and reminder platform according to the contract information of the corresponding contracted user in the HSS. The suspicious call monitoring and reminder platform triggers the suspicious call reminder service based on the call of the corresponding contracted user; the suspicious call monitoring and reminder platform also includes a number library analysis and update module. The number library analysis and update module is used to define a suspicious number analysis model, train and upgrade the suspicious number analysis model, collect an offline call record list and perform suspicious number analysis in combination with the suspicious number analysis model. Suspicious numbers are captured through analysis, and the captured suspicious number information is sent to the suspicious number library for storage via the suspicious call monitoring and reminder platform.

[0036] When the suspicious call reminder service is triggered, the real-time call authentication module authenticates the number called by the corresponding contracted user in real time based on the real-time call behavior of the corresponding contracted user and in combination with the suspicious number database. If the number of the other party of the call is determined to be a suspicious number, a harassment reminder signal is generated and sent to the reminder information push module through the suspicious call monitoring reminder platform; after receiving the harassment reminder signal, the reminder information push module generates corresponding suspicious reminder content based on the suspicious call reminder strategy of the corresponding contracted user, and pushes a pop-up flash message to the mobile phone of the corresponding contracted user to remind the corresponding contracted user to be vigilant.

[0037] Compared with the prior art, the present invention studies the IMS core network. The IMS network has a powerful service signing mechanism and supports service key signing in HSS, thereby triggering S-CSCF to route call conversations to various AS service platforms. By utilizing this functional feature of the IMS core network, a call event monitoring solution with less construction and low cost is constructed. The advantages of this solution over the traditional call event monitoring solution are as follows: the solution is completely based on the IP network of the IMS core network for call forwarding, and there is no need to deploy monitoring equipment and link bypass construction, and the implementation cost is very low; the solution is based on the signing trigger of the service user, and only monitors the calls of the service user. The amount of call signaling data monitored is relatively small, and the resource demand for the system is also relatively small, which effectively reduces the system cost; the solution is based on HSS signing processing, does not involve the processing of other core communication network elements, does not need to be supplemented according to the expansion of the core network, and has very strong adaptability.

[0038] Furthermore, if Figure 5 As shown, the suspicious call monitoring and reminder platform also includes a user supervision and analysis module, which is used to set a supervision cycle, collect the call frequency of suspicious calls made by the corresponding contracted user within the supervision cycle and mark it as a disturbance frequency, and collect the time interval between two adjacent calls and mark it as an interval duration, sum up all the interval durations and take the average to obtain the disturbance interval time value; compare the disturbance frequency and the disturbance interval time value with the preset disturbance frequency threshold and the preset disturbance interval time threshold respectively, if the disturbance frequency exceeds the preset disturbance frequency threshold or the disturbance interval time value exceeds the preset disturbance interval time threshold, then generate a suspicious warning signal for the corresponding contracted user, send the suspicious warning signal and related call information to the mobile phone of the corresponding contracted user, and the corresponding contracted user should be more vigilant after receiving the suspicious warning signal, and conduct a source investigation as needed, so as to further improve the performance of preventing suspiciousness, which is helpful to protect the property safety of the contracted user;

[0039] In addition, after generating a suspicious warning signal for the corresponding contracted user, the regional location involved in each harassing phone call during the supervision period is collected, and the number of calls in the corresponding area is obtained through statistics and marked as the regional frequency value of the corresponding area. The regional frequency value is compared with the preset regional frequency threshold. If the regional frequency value exceeds the preset regional frequency threshold, indicating that there is obvious suspicion of suspicious behavior in the corresponding area, the corresponding area will be marked as a suspicious source area, and all suspicious source areas will be sent to the mobile phones of the corresponding contracted users to remind the corresponding contracted users to be cautious in making subsequent calls in the corresponding area, so as to further protect the property safety of the contracted users.

[0040] Embodiment 2:

[0041] like Figure 6 As shown, the difference between this embodiment and embodiment 1 is that the suspicious call monitoring reminder platform is connected to the platform control end in communication, and the suspicious call monitoring reminder platform also includes a platform security supervision and analysis module. The platform security supervision and analysis module performs platform security supervision and analysis on the suspicious call monitoring reminder platform, generates a platform security warning signal or a platform security qualified signal through analysis, and sends the platform security warning signal or the platform security qualified signal to the platform control end through the suspicious call monitoring reminder platform. After receiving the platform security warning signal, the platform control end promptly conducts a cause investigation and strengthens the platform security supervision measures to ensure the platform security and stability, thereby fully guaranteeing the call security of all contracted users; the specific analysis process of the platform security supervision analysis is as follows:

[0042] The network vulnerability growth rate and network virus growth rate of the suspicious phone monitoring and reminder platform within a unit time are collected, and the network vulnerability growth rate and network virus growth rate are numerically compared with the preset network vulnerability growth rate threshold and the preset network virus growth rate threshold, respectively. If at least one of the network vulnerability growth rate and the network virus growth rate exceeds the corresponding preset threshold, it indicates that the platform has a large security risk, and a platform security warning signal is generated; if both the network vulnerability growth rate and the network virus growth rate do not exceed the corresponding preset threshold, the vulnerability repair rate and virus killing rate of the suspicious phone monitoring and reminder platform within a unit time are collected, and the vulnerability repair rate and virus killing rate are numerically compared with the preset vulnerability repair rate threshold and the preset virus killing rate threshold, respectively. If at least one of the vulnerability repair rate and the virus killing rate exceeds the corresponding preset threshold, it indicates that the vulnerability repair effect or the virus killing effect is poor, and a platform security warning signal is generated;

[0043] If the vulnerability repair rate and the virus detection rate do not exceed the corresponding preset thresholds, the number of crashes and network attack defense parameters of the suspicious phone monitoring and reminder platform per unit time are collected. The network attack defense parameters are data quantities that indicate the defense performance of the platform when it is attacked by a network. The larger the value of the network attack defense parameter, the stronger the defense performance of the suspicious phone monitoring and reminder platform and the better the platform security. The number of crashes and the network attack defense parameters are numerically compared with the preset crash number threshold and the preset network attack defense parameter threshold respectively. If the number of crashes exceeds the preset crash number threshold or the network attack defense parameter does not exceed the preset network attack defense parameter threshold, indicating that the platform stability or defense performance is poor, a platform security warning signal is generated, otherwise a platform security qualified signal is generated.

[0044] Embodiment three:

[0045] like Figure 6 As shown, the difference between this embodiment and embodiment 1 and embodiment 2 is that the suspicious phone monitoring reminder platform also includes a platform trust supervision and analysis module, which is used to perform trust analysis on the suspicious phone monitoring reminder platform, generate a trust qualified signal or a trust warning signal through analysis, and send the trust qualified signal or the trust warning signal to the platform management and control end through the suspicious phone monitoring reminder platform. After receiving the trust warning signal, the platform management and control end promptly upgrades the platform prevention function to ensure the prevention effect of suspicion; the specific analysis process of the trust analysis is as follows:

[0046] A questionnaire is sent to the contracted users and the questionnaire survey results of the contracted users are collected. The survey evaluation score of the corresponding contracted users is obtained based on the questionnaire survey results. The larger the survey evaluation score, the higher the satisfaction of the corresponding contracted users with the platform, that is, the more trust they have in the suspicious phone monitoring reminder platform. The survey evaluation score is numerically compared with a preset survey evaluation score threshold. If the survey evaluation score exceeds the preset survey evaluation score threshold, the corresponding contracted user is marked as a positively impacted user. Otherwise, the corresponding contracted user is marked as a negatively impacted user. The number of negatively impacted users is calculated as a ratio of the number of positively impacted users to obtain a trust analysis value. The trust analysis value is numerically compared with the preset trust analysis threshold. If the trust analysis value exceeds the preset trust analysis threshold, a trust warning signal is generated. If the trust analysis value does not exceed the preset trust analysis threshold, a trust qualified signal is generated.

[0047] The working principle of the present invention is as follows: when in use, the suspicious call reminder service contracting module is used to sign a service key for the user in the HSS when the user handles the suspicious call reminder service. After the corresponding user successfully signs the suspicious call reminder service, the corresponding user is marked as a contracted user. The user reminder policy generation module is based on the suspicious call reminder policy model and collects the service requirements of the corresponding contracted user to generate a suspicious call reminder policy for the corresponding contracted user, which flexibly adapts to the needs of different customers. When the corresponding contracted user makes a call, the user call behavior monitoring module routes the call to the suspicious call monitoring reminder platform according to the contract information of the corresponding contracted user in the HSS. The suspicious call monitoring reminder platform triggers the suspicious call reminder service based on the call of the corresponding contracted user. The real-time call authentication module generates a suspicious call reminder policy based on the corresponding contracted user. The real-time call behavior of the user is combined with the suspicious number database to authenticate the number called by the corresponding contracted user in real time; if the number of the other party of the call is determined to be a suspicious number, the reminder information push module pushes a pop-up flash message to the mobile phone of the corresponding contracted user to remind the corresponding contracted user to be vigilant; compared with the traditional call event monitoring solution, the present invention forwards calls based on the IP network of the IMS core network, does not require the deployment of monitoring equipment and link bypass construction, and has a very low implementation cost. It is triggered based on the contract of the service user and only monitors the calls of the service user. The amount of call signaling data monitored is relatively small, and the resource demand for the system is also relatively small, which effectively reduces the system cost. In addition, it is based on HSS contract processing and does not involve the processing of other core communication network elements. It does not need to be supplemented according to the expansion of the core network, and has strong adaptability.

[0048] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. An intelligent monitoring system for suspicious calls of mobile users, characterized in that: It includes a suspicious call monitoring and reminder platform, which includes a suspicious call reminder service contract module, a user reminder strategy generation module, a suspicious number library, a user call behavior monitoring module, a real-time call authentication module, and a reminder information push module; The suspicious call reminder service contracting module is used to assign corresponding service keys to the suspicious call reminder service, collect the service handling request of the user, and sign the service key for the user in the HSS when the user handles the suspicious call reminder service. After the corresponding user successfully signs the suspicious call reminder service, the corresponding user is marked as a contracted user, and the contracted user is sent to the user reminder strategy generation module via the suspicious call monitoring reminder platform; The user reminder policy generation module is used to generate suspicious call reminder policies for corresponding contracted users based on the suspicious call reminder policy model and the business needs of corresponding contracted users, and store the identity information of contracted users and the corresponding suspicious call reminder policies, so as to flexibly adapt to the needs of different customers and quickly meet the business needs of corresponding customers; The user call behavior monitoring module is used to monitor the calls of the corresponding subscribers. When the corresponding subscribers make a call, the S-CSCF routes the call to the suspicious call monitoring and reminder platform according to the subscription information of the corresponding subscribers in the HSS. The suspicious call monitoring and reminder platform triggers the suspicious call reminder service based on the calls of the corresponding subscribers. When the suspicious call reminder service is triggered, the real-time call authentication module authenticates the number called by the corresponding subscriber in real time based on the real-time call behavior of the corresponding subscriber and the suspicious number database. If the number of the other party is determined to be a suspicious number, a harassment reminder signal is generated and sent to the reminder information push module via the suspicious call monitoring reminder platform; After receiving the harassment reminder signal, the reminder information push module generates corresponding suspicious reminder content based on the suspicious call reminder strategy of the corresponding contracted user, and pushes a pop-up flash message to the mobile phone of the corresponding contracted user to remind the corresponding contracted user to be vigilant; The suspicious call monitoring and reminder platform also includes a number library analysis and update module, which is used to define a suspicious number analysis model, train and upgrade the suspicious number analysis model, collect offline call record lists and analyze suspicious numbers in combination with the suspicious number analysis model, capture suspicious numbers through analysis, and send the captured suspicious number information to the suspicious number library for storage via the suspicious call monitoring and reminder platform; The suspicious call monitoring and reminder platform also includes a user supervision and analysis module, which is used to set a supervision cycle, collect the call frequency of suspicious calls made by the corresponding contracted user within the supervision cycle and mark it as the harassment frequency, and collect the time interval between two adjacent calls and mark it as the interval duration, sum up all the interval durations and take the average to obtain the harassment interval time value; compare the harassment frequency and the harassment interval time value with the preset harassment frequency threshold and the preset harassment interval time threshold respectively, if the harassment frequency exceeds the preset harassment frequency threshold or the harassment interval time value exceeds the preset harassment interval time threshold, then generate a suspicious warning signal for the corresponding contracted user, send the suspicious warning signal and related call information to the mobile phone of the corresponding contracted user, and the corresponding contracted user should be more vigilant after receiving the suspicious warning signal, and conduct a source investigation as needed; After generating the suspicious warning signal of the corresponding contracted user, the regional location involved in each harassing call during the supervision period is collected, and the number of calls in the corresponding area is obtained by statistics and marked as the regional frequency value of the corresponding area. The regional frequency value is compared with the preset regional frequency threshold. If the regional frequency value exceeds the preset regional frequency threshold, the corresponding area is marked as a suspicious source area, and all suspicious source areas are sent to the mobile phone of the corresponding contracted user to remind the corresponding contracted user to be cautious in subsequent calls in the corresponding area; The suspicious call monitoring and reminder platform is connected to the platform control end in communication. The suspicious call monitoring and reminder platform also includes a platform security supervision and analysis module and a platform trust supervision and analysis module. The platform security supervision and analysis module conducts platform security supervision and analysis on the suspicious call monitoring and reminder platform, generates a platform security warning signal or a platform security qualified signal through analysis, and sends the platform security warning signal or the platform security qualified signal to the platform control end through the suspicious call monitoring and reminder platform. After receiving the platform security warning signal, the platform control end promptly conducts a cause investigation and strengthens platform security supervision measures; The platform trust supervision and analysis module is used to conduct trust analysis on the suspicious phone monitoring and reminder platform, generate a trust qualified signal or a trust warning signal through analysis, and send the trust qualified signal or the trust warning signal to the platform control end through the suspicious phone monitoring and reminder platform. After receiving the trust warning signal, the platform control end will promptly upgrade the platform prevention function to ensure the prevention effect of suspicion; The specific analysis process of the platform security supervision analysis includes: collecting the network vulnerability growth rate and network virus growth rate of the suspicious phone monitoring and reminder platform within a unit time, and numerically comparing the network vulnerability growth rate and network virus growth rate with the preset network vulnerability growth rate threshold and the preset network virus growth rate threshold, respectively; if at least one of the network vulnerability growth rate and the network virus growth rate exceeds the corresponding preset threshold, then generating a platform security warning signal; if both the network vulnerability growth rate and the network virus growth rate do not exceed the corresponding preset threshold, then collecting the vulnerability repair rate and virus detection rate of the suspicious phone monitoring and reminder platform within a unit time, and numerically comparing the vulnerability repair rate and the virus detection rate with the preset vulnerability repair rate threshold and the preset virus detection rate threshold, respectively; if at least one of the vulnerability repair rate and the virus detection rate exceeds the corresponding preset threshold, then generating a platform security warning signal; If the vulnerability repair rate and the virus killing rate do not exceed the corresponding preset thresholds, the number of crashes and network attack defense parameters of the suspicious phone monitoring reminder platform within a unit time are collected, and the number of crashes and the network attack defense parameters are numerically compared with the preset crash number threshold and the preset network attack defense parameter threshold, respectively. If the number of crashes exceeds the preset crash number threshold or the network attack defense parameter does not exceed the preset network attack defense parameter threshold, a platform security warning signal is generated, otherwise a platform security qualified signal is generated; The specific analysis process of trust analysis is as follows: send a questionnaire to the contracted users and collect the questionnaire survey results of the contracted users, obtain the survey evaluation score of the corresponding contracted users based on the questionnaire survey results, compare the survey evaluation score with the preset survey evaluation score threshold, if the survey evaluation score exceeds the preset survey evaluation score threshold, the corresponding contracted user is marked as a positive impact user, otherwise the corresponding contracted user is marked as a negative impact user, the ratio of the number of negative impact users to the number of positive impact users is calculated to obtain the trust analysis value, the trust analysis value is compared with the preset trust analysis threshold, if the trust analysis value exceeds the preset trust analysis threshold, a trust warning signal is generated, if the trust analysis value does not exceed the preset trust analysis threshold, a trust qualified signal is generated.

2. The intelligent monitoring system for suspicious calls of mobile users according to claim 1, characterized in that: The suspicious call reminder policy model based on the user reminder policy generation module involves triggers, receivers, trigger scenarios and push content, among which the triggers include single numbers, number groups and call categories, and the call categories include international calls, IP calls and hidden number calls; the receivers include single numbers, number groups, regional users and affiliated operators, and the geographical locations involved in the regional users include provinces and cities; the trigger scenarios include triggers for answering suspicious calls and triggers for making harassing calls; the push content includes fixed content and dynamic templates.

Images