A detection method and system for a voice gateway device

Abstract

The present application relates to the field of voice gateway detection technology, and specifically to a detection method and system for a voice gateway device, the method comprising: obtaining the calling number, called number, call duration, and calling location area code of each call; obtaining the calling frequency of each call number; obtaining the calling call abnormality value of each call number based on the calling location change and call duration of each call number; obtaining the malicious call weight between a single called number and a single calling number, and then obtaining the malicious call suspicion value of each call number; obtaining the malicious call score of each call number, and then dividing the call numbers into abnormal call numbers, normal call numbers, and risky call numbers; obtaining the potential risk increment of abnormal call numbers, normal call numbers, and risky call numbers; classifying each call number and detecting call numbers with malicious call behavior. The present application evaluates call numbers from multiple dimensions, thereby improving the detection accuracy of malicious call behavior.

Description

Technical Field

[0001] The present application relates to the field of voice gateway detection technology, and in particular to a detection method and system for a voice gateway device. Background Art

[0002] The core function of the voice gateway device is to realize the conversion of voice and data signals between different networks. It can connect the public switched telephone network (PSTN) with the IP network, allowing ordinary telephones, fax machines and other devices to make voice calls through the Internet; at the same time, it supports mobile Internet devices to access external networks through the intelligent voice gateway, avoiding direct dependence on the operator's mobile network and realizing flexible communication link selection.

[0003] When assuming the role of communication forwarding, intelligent voice gateways typically lack the ability to record calls and store batch communication logs. This makes it difficult to identify abnormal behaviors such as fraudulent calls and excessive usage in real time. Furthermore, voice gateway devices can be exploited maliciously, making it difficult to accurately intercept and intelligently manage numbers suspected of fraud, harassment, and other illegal activities. Existing voice gateway device security detection systems generally focus on a single dimension, such as monitoring only network connection status or voice encoding quality. They lack comprehensive analysis of call records, number behavior, and log files, and lack multi-dimensional data fusion, making it difficult to meet the growing demand for abnormal call behavior management. Therefore, there is an urgent need for a security detection method that covers call records, number behavior, and log files to achieve full-link security monitoring of voice gateways and abnormal number identification. Summary of the Invention

[0004] In order to solve the above technical problems, the purpose of this application is to provide a detection method and system for a voice gateway device. The technical solutions adopted are as follows:

[0005] In a first aspect, an embodiment of the present application provides a method for detecting a voice gateway device, the method comprising the following steps:

[0006] Obtain the calling number, called number, call duration, and calling location area code of each call made by the voice gateway device within a historical time period;

[0007] Obtain the calling frequency of each call number; obtain the calling call abnormality value of each call number based on the degree of dispersion of the longitude and latitude corresponding to the calling location area code of each call number when it is the calling number, and the proportion of call records with call duration less than the preset short call threshold in all call records when each call number is the calling number; obtain the malicious call weight between a single called number and a single calling number based on the difference between the calling frequency of a single calling number and the frequency of calls between it and a single called number, and the difference between the preset short call threshold and the call duration of each call between a single calling number and a single called number, and obtain the malicious call suspicion value of each calling number based on the calling and called relationship of the calling numbers in all call records;

[0008] Obtain a malicious call score for each call number based on the call frequency, call anomaly value, and malicious call suspicion value of each call number; cluster the malicious call scores of all call numbers and divide the call numbers into abnormal call numbers, normal call numbers, and risky call numbers; obtain high-risk victim numbers based on the frequency of each number among all numbers dialed by abnormal call numbers; obtain the potential risk increment of a single risky call number based on the proportion and frequency of high-risk victim numbers among the numbers dialed by a single risky call number; and use a preset first constant and a preset second constant as the potential risk increments of abnormal call numbers and normal call numbers, respectively;

[0009] Based on the call frequency, call anomaly value, malicious call suspicion value, malicious call score and potential risk increment of each call number, each call number is classified to detect call numbers with malicious call behavior.

[0010] Preferably, the calculation formula for the outgoing call abnormal value of each call number is: Where, The outlier value of the main call of a single call number. are the standard deviations of the longitude and latitude of all the calling location codes when a single call number is used as the calling number, is the ratio of the number of short call records to the total number of call records in all call records when a single call number is used as the primary caller number, where exp( ) is an exponential function with the natural constant e as its base. Short call records are those whose call duration is less than the preset short call threshold.

[0011] Preferably, the calculation formula for the malicious call weight between the single called number and the single calling number is: Where, Indicates the weight of malicious calls between called number a and calling number b. is the calling frequency of calling number b, is the frequency of calls between the called number a and the calling number b, is the duration of the xth call between the called number a and the calling number b, To preset the short call threshold, Norm[ ] is the normalization function.

[0012] Preferably, the specific process of obtaining the malicious call suspicion value of each call number is as follows:

[0013] Use each call number as a node, and make the called number node in the call record point to the calling number node to establish a directional connection;

[0014] The malicious call weight between a single called number and a single calling number is used as the weight of the connection between the called number and the calling number. Similarly, the weights of all connections are obtained to obtain a call relationship graph composed of all call number nodes;

[0015] The call relationship graph is used as the input of the PageRank algorithm, and the PageRank value of each call number node is output. The PageRank value of each call number node is used as the malicious call suspicion value of each call number.

[0016] Preferably, the process of obtaining the malicious call score of each call number is: taking the normalized main call frequency, main call abnormality value, and malicious call suspicion value of all call numbers as the input of the Topsis algorithm, and outputting the malicious call score of each call number.

[0017] Preferably, the specific process of classifying call numbers into abnormal call numbers, normal call numbers and risky call numbers is: clustering the malicious call scores of all call numbers to obtain three clusters; recording the call numbers corresponding to the cluster with the highest mean malicious call score as abnormal call numbers; recording the call numbers corresponding to the cluster with the lowest mean malicious call score as normal call numbers; and recording the call numbers corresponding to the remaining clusters as risky call numbers.

[0018] Preferably, the specific process of obtaining high-risk victim numbers is: obtaining all called numbers corresponding to call records when all abnormal call numbers are used as the calling number, and forming a first call table; inputting the first call table into the Apriori algorithm as a transaction, obtaining the frequent items of all single data elements in the output results, and the support of all frequent items, and recording the call numbers corresponding to the frequent items of the single data elements as high-risk victim numbers.

[0019] Preferably, the calculation formula for the potential risk increment of the single risky call number is: Where, The potential risk increment for a single risky call number. It is the ratio of high-risk victim numbers in the second call table of a single risky call number. is the call risk score of the yth high-risk victim number in the second call table of a single risky call number, is the total number of call numbers that are high-risk victim numbers in the second call table of a single risk call number, and Norm() is a normalization function; wherein the second call table of a single risk call number refers to all called numbers in the call records corresponding to the single risk call number as the calling number; the calculation formula for the call risk score of the high-risk victim number is: Where, The call risk score for a single high-risk victim number. is the support of the frequent item corresponding to a single high-risk victim number, It is the minimum support among all frequent items in the Apriori algorithm.

[0020] Preferably, the specific process of classifying each call number and detecting call numbers with malicious call behavior is: taking the normalized main call frequency, main call call abnormality value, malicious call suspicion value, malicious call score and potential risk increment of each call number as the number portrait of each call number; normalizing the sum of the malicious call score and the potential risk increment of each call number, and taking the normalized result as the initial correction weight of each call number; taking the number portrait and initial correction weight of each call number as the input of the AdaBoost algorithm to obtain a malicious call identification model, and then detecting call numbers with malicious call behavior.

[0021] In the second aspect, an embodiment of the present application also provides a detection system for a voice gateway device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, the steps of a detection method for a voice gateway device described in any one of the above items are implemented.

[0022] This application has at least the following beneficial effects:

[0023] 1. This application improves the detection accuracy of scenarios such as express delivery, logistics, and food delivery by constructing abnormal values ​​for main calls and suspected malicious calls. It also assists in identifying malicious behaviors such as harassment and fraud based on the call relationship map between call numbers, reducing false positives and missed calls.

[0024] 2. This application uses the Apriori algorithm to mine high-risk victim numbers and calculate the potential risk increment of risky call numbers, thereby enhancing the ability to identify early malicious call behaviors and enabling timely and effective interception to prevent malicious call behaviors from worsening.

[0025] 3. This application normalizes the multiple feature values ​​of the call number to form a number portrait, which solves the problem of insufficient multi-dimensional data fusion in the existing voice gateway security detection system. In order to address the problem of unbalanced sample distribution in the voice gateway, the AdaBoost algorithm is combined with multiple weak classifiers to improve the detection accuracy of the malicious call identification model through adaptive initial sample weights, effectively solving the problem of classifier training result deviation caused by data imbalance, so that the voice gateway can more accurately detect malicious call behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0027] Figure 1 A flowchart of a detection method for a voice gateway device provided in one embodiment of the present application;

[0028] Figure 2 A flowchart for obtaining the potential risk increment of a single risky call number provided in one embodiment of the present application. DETAILED DESCRIPTION

[0029] To further illustrate the technical means and effects employed by this application to achieve the intended invention objectives, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail a detection method and system for a voice gateway device proposed in this application, including its specific implementation, structure, features, and effects. In the following description, different references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0030] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0031] The following describes in detail a detection method and system for a voice gateway device provided by this application with reference to the accompanying drawings.

[0032] See also Figure 1 , which shows a flowchart of a detection method for a voice gateway device provided by an embodiment of the present application, the method comprising the following steps:

[0033] Step 1: Obtain the calling number, called number, call duration, and calling location area code of each call made by the voice gateway device during a historical period.

[0034] The server retrieves call log information and log files from the voice gateway device over the network for every call over the past three months. The call log information includes the calling number, called number, call start time, call end time, and call duration. The log files include the calling location area code and called location area code of both parties in the call log.

[0035] Step 2: Obtain the calling frequency of each call number; obtain the calling call abnormality value of each call number based on the discrete degree of the longitude and latitude corresponding to the calling location area code of each call number when it is the calling number, and the proportion of call records with call duration less than the preset short call threshold in all call records when each call number is the calling number; obtain the malicious call weight between a single called number and a single calling number based on the difference between the calling frequency of a single calling number and the frequency of calls between it and a single called number, and the difference between the preset short call threshold and the call duration of each call between a single calling number and a single called number, and obtain the malicious call suspicion value of each calling number based on the calling and called relationship of the calling numbers in all call records.

[0036] During the operation of a voice gateway, attackers may use illegal calls, fraudulent calls, or harassing marketing to transmit commercial advertisements, fraudulent information, and spam messages to the called party through the calling number, disrupting the called party's normal life. This type of call behavior is called malicious calling. Malicious calling behavior is characterized by high call frequency, short average call duration, and easily changing the location of the calling number.

[0037] The frequency of call records with any number as the calling number is counted, and the frequency of calls with any number as the called number is counted. In massive amounts of real-world telecom data, users with malicious calling behavior often control the number of calls and mix in some normal calls to evade regulation. This makes it difficult to accurately identify the average call duration, resulting in poor robustness and classification accuracy of the malicious call identification model.

[0038] Taking any call number in the voice gateway as an example, when obtaining the call number as the main call number, the call duration of all call records will be less than the preset short call threshold The purpose of classifying call records into short call categories is to eliminate the problem of reduced average call time caused by normal calls and low accuracy in identifying malicious call users; the short call threshold is preset. It is used to reflect the call duration when the called user finds that the call is malicious and hangs up in time. In this embodiment, it is 15s.

[0039] In scenarios such as express delivery, logistics, and food delivery, voice gateways also have high call frequencies and short average call durations. However, the geographic location of the caller numbers in these scenarios is typically relatively fixed. Abnormal call numbers may frequently change locations to evade regulatory authorities. This embodiment converts the caller location area code into actual latitude and longitude coordinates and calculates the standard deviation of the longitude and latitude of the call number across all call records.

[0040] As a preferred implementation, based on the degree of dispersion of the longitude and latitude corresponding to the main call location area code of each call number when it is used as the main call number, and the proportion of call records with call duration less than a preset short call threshold in all call records when each call number is used as the main call number, the main call abnormality value of each call number is obtained to characterize the possibility of malicious main call behavior of each call number.

[0041] In this embodiment, the outlier value of the main call of a single call number is recorded as : Where, The outlier value of the main call of a single call number. are the standard deviations of the longitude and latitude of all the calling location codes when a single call number is used as the calling number, is the ratio of the number of short call records to the total number of call records in all call records when a single call number is used as the main call number. exp( ) is an exponential function with the natural constant e as the base.

[0042] It is used to reflect the degree of change in the location of the calling number when it is used as the main call number. It is used to distinguish normal call behaviors such as express delivery, logistics, and food delivery from malicious call behaviors. Used to reflect the proportion of short call frequency of the call number. The larger the value, the more likely the call behavior is to be regarded as malicious call behavior and be hung up in a short time. In this case, the possibility that the call number has malicious call behavior is higher, and the abnormal value of the call is higher. The bigger.

[0043] For each calling number user, there are two identities: one is the calling number to make calls to other users, and the other is the called number to answer calls. In order to better explore the relationship between call contacts and call behavior information, this application uses the call records of the voice gateway device to treat each call number as a node. Since malicious call behavior is usually only found in the calling number, the node representing the called number in the call record is pointed to the calling number node, a directional connection is established, and the malicious call weight between the called number node a and the calling number node b is calculated using the following formula: Where, Indicates the weight of malicious calls between called number a and calling number b. is the calling frequency of calling number b, is the frequency of calls between the called number a and the calling number b, is the duration of the xth call between the called number a and the calling number b, To preset the short call threshold, Norm[ ] is the normalization function.

[0044] It is used to reflect the sparseness of calls between called number a and calling number b. The larger the value is, the less likely it is that the called number a and the calling number b have a stable call relationship. The calling number may not be the normal call contact of the called number. Used to assess the possibility of malicious call behavior between the called number a and the calling number b. The larger the value, the higher the possibility that the calling number b will make a harassing call. The bigger.

[0045] Weighting of malicious calls As the edge weight of the connection between the called number node a and the calling number node b, the edge weights of the connections between all nodes are similarly obtained to obtain the call relationship graph composed of all calling number nodes. This application uses the call relationship graph as the input of the PageRank algorithm, where the damping factor of the PageRank algorithm is set to 0.85, and outputs the PageRank value of each calling number node. During the operation of the voice gateway device, there are a large number of normal call records and a small number of call records with malicious call behavior, which has a serious data imbalance characteristic. This application uses the global call relationship characteristics and random walk model of the PageRank algorithm to mine the suspicion of malicious calls by the calling number from the perspective of the called number. That is, the more times a calling number dials different called numbers as the calling number and the greater the malicious call weight between it and all called numbers, the greater the probability of the calling number node being visited and the greater the PageRank value of the calling number node. This application uses the PageRank value of each calling number node as the malicious call suspicion value of the calling number. The larger the PageRank value of each calling number node, the greater the malicious call suspicion value of the calling number. Based on the call relationship map between call numbers, the accuracy of identifying malicious call behaviors is improved, assisting in the accurate identification of malicious behaviors such as harassment and fraud, and reducing misjudgments and missed judgments.

[0046] At this point, this application can obtain the main call frequency, main call abnormality value, and malicious call suspicion value of each call number.

[0047] Step 3: Obtain the malicious call score of each call number based on the main call frequency, main call abnormality value and malicious call suspicion value of each call number; cluster the malicious call scores of all call numbers and divide the call numbers into abnormal call numbers, normal call numbers and risky call numbers; obtain high-risk victim numbers based on the frequency of each number among all numbers dialed by abnormal call numbers; obtain the potential risk increment of a single risk call number based on the proportion and frequency of high-risk victim numbers among the numbers dialed by a single risk call number; use the preset first constant and the preset second constant as the potential risk increment of abnormal call numbers and normal call numbers respectively.

[0048] To reduce the dimensionality of malicious call analysis, the call frequency, call anomaly value, and malicious call suspicion value of all call numbers are normalized and standardized. These normalized call frequency, call anomaly value, and malicious call suspicion value are used as input to the Topsis algorithm, which outputs a malicious call score for each call number to assess whether the call number is suspected of malicious calling. The Topsis algorithm is well-known technology, and the specific process is not detailed here.

[0049] The malicious call score for each call number is used as input to the K-means clustering algorithm. In this embodiment, the K value is 3, and three clusters are output. The call numbers corresponding to the cluster with the highest mean malicious call score are recorded as abnormal call numbers, which are highly likely to have committed malicious call behavior. The call numbers corresponding to the cluster with the lowest mean malicious call score are recorded as normal call numbers, which have normal call behavior and are highly likely to be normal call users. The call numbers corresponding to the remaining clusters are recorded as risky call numbers, which contain both normal and malicious call users. These malicious call users are very likely to have taken anti-regulatory measures, resulting in low accuracy in identifying malicious call behavior.

[0050] Malicious callers among risky numbers are typically in the early stages of malicious calling activity, resulting in fewer samples. Due to the vast amount of real-world call data and its complexity, accurate identification is difficult in the early stages, leading to lower levels of prevention. Malicious callers often obtain a large number of called numbers through illegal intrusion or purchase, and there is a high probability of overlap between the called numbers dialed by different malicious callers.

[0051] Obtain all called numbers from call records where the abnormal call number is the calling number, and form a first call table. This first call table is used as a transaction input to the Apriori algorithm. The algorithm obtains the frequent items of all single data elements in the output, along with the support of all these frequent items. The call numbers corresponding to the frequent items of single data elements are designated as high-risk victim numbers.

[0052] In this embodiment, the call risk score of a single high-risk victim number is recorded as , whose expression is: Where, The call risk score for a single high-risk victim number. is the support of the frequent item corresponding to a single high-risk victim number, It is the minimum support among all frequent items in the Apriori algorithm. The larger the value, the easier it is for the high-risk victim number to be obtained by malicious call users, and the higher the risk of malicious call behavior. The call risk score of the high-risk victim number is The bigger.

[0053] Furthermore, taking any risk call number as an example, all called numbers of the call records corresponding to the risk call number as the main calling number are obtained to form a second call table for the risk call number.

[0054] As a preferred embodiment, the potential risk increment of a single risk call number is obtained based on the proportion of high-risk victim numbers in the numbers dialed by the single risk call number and the call risk score, which is used to characterize the potential risk level of malicious call behavior of the single risk call number. The flowchart for obtaining the potential risk increment of a single risk call number is shown as follows: Figure 2 shown.

[0055] In this embodiment, the potential risk increment of a single risky call number is recorded as , its specific expression is: Where, The potential risk increment for a single risky call number. It is the ratio of high-risk victim numbers in the second call table of a single risky call number. is the call risk score of the yth high-risk victim number in the second call table of a single risky call number, is the total number of call numbers belonging to high-risk victim numbers in the second call table of a single risky call number, and Norm() is a normalization function.

[0056] It should be noted that the normalization function includes but is not limited to the sigmoid function, the tanh function, and the Z-score normalization. In this embodiment, the sigmoid function is used for normalization.

[0057] According to the risk value of the called number being illegally obtained, different score weights are given to high-risk victim numbers in the second call table to increase attention to the leaked call numbers of high-risk numbers; The second call table used to reflect the overlap between risky call numbers and high-risk victim numbers. The higher the potential risk increment of malicious call behavior in risky call numbers, the more accurate the malicious call identification model is in identifying early malicious call behavior, and timely and effective interception can be carried out to prevent the malicious call behavior from worsening.

[0058] This embodiment obtains the potential risk increment of any call number in the following manner: when the call number is an abnormal call number, the potential risk increment is a preset first constant; when the call number is a risk call number, the potential risk increment is a preset first constant. When the call number is a normal call number, the potential risk increment is a preset second constant. In this embodiment, the preset first constant and the preset second constant are 1 and 0, respectively. The preset first constant is greater than the maximum potential risk increment of all risky call numbers, and the preset second constant is less than the minimum potential risk increment of all risky call numbers.

[0059] Step 4: Classify each call number based on its call frequency, call anomaly value, malicious call suspicion value, malicious call score, and potential risk increment, and detect call numbers with malicious call behavior.

[0060] Each call number's call frequency, call anomaly value, malicious call suspicion value, malicious call score, and potential risk increment are normalized. The normalized result is used as the call number's profile, which comprehensively reflects the call behavior characteristics of the call number. Because voice gateway devices contain a large number of normal call records and a small number of call records with malicious call behavior, the profiles of normal call numbers are recorded as positive samples, and the profiles of numbers with malicious call behavior are recorded as negative samples. When training the AdaBoost algorithm classifier, if there are too few negative samples, the negative samples provide relatively little information, and the classifier training results will be biased towards the positive class, significantly affecting the accuracy of voice gateway device security detection.

[0061] The number profile of each call number is used as a sample for classification training. The sum of the malicious call score and the potential risk increment of the call number is calculated, and the above sum of all call numbers is normalized using the Softmax function. The normalized result is used as the initial correction weight of the sample. The purpose of using the Softmax function is to ensure that the sum of the initial correction weights of all samples is 1.

[0062] The AdaBoost algorithm uses the number profile of each call number as input and sets up six weak classifier models, such as SVM, decision tree, random forest, Bayesian classifier, nearest neighbor classifier, and logistic regression. Initial correction weights are adaptively obtained to increase the contribution of negative samples to call classification, addressing the issue of unbalanced data sample distribution. The AdaBoost algorithm is then used to establish a malicious call identification model, effectively detecting call numbers associated with malicious call activity. The AdaBoost algorithm is well known, and the detailed process is omitted here.

[0063] Based on the same inventive concept as the above method, an embodiment of the present application also provides a detection system for a voice gateway device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, the steps of any one of the above-mentioned detection methods for a voice gateway device are implemented.

[0064] It should be noted that the order in which the embodiments of the present application are presented is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the foregoing descriptions of specific embodiments of this specification are provided. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0065] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0066] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A detection method for a voice gateway device, characterized in that: The method comprises the following steps: Obtain the calling number, called number, call duration, and calling location area code of each call made by the voice gateway device within a historical time period; Obtain the calling frequency of each call number; obtain the calling call abnormality value of each call number based on the degree of dispersion of the longitude and latitude corresponding to the calling location area code of each call number when it is the calling number, and the proportion of call records with call duration less than the preset short call threshold in all call records when each call number is the calling number; obtain the malicious call weight between a single called number and a single calling number based on the difference between the calling frequency of a single calling number and the frequency of calls between it and a single called number, and the difference between the preset short call threshold and the call duration of each call between a single calling number and a single called number, and obtain the malicious call suspicion value of each calling number based on the calling and called relationship of the calling numbers in all call records; Obtain a malicious call score for each call number based on the call frequency, call anomaly value, and malicious call suspicion value of each call number; cluster the malicious call scores of all call numbers and divide the call numbers into abnormal call numbers, normal call numbers, and risky call numbers; obtain high-risk victim numbers based on the frequency of each number among all numbers dialed by abnormal call numbers; obtain the potential risk increment of a single risky call number based on the proportion and frequency of high-risk victim numbers among the numbers dialed by a single risky call number; and use a preset first constant and a preset second constant as the potential risk increments of abnormal call numbers and normal call numbers, respectively; Based on the call frequency, call anomaly value, malicious call suspicion value, malicious call score and potential risk increment of each call number, each call number is classified to detect call numbers with malicious call behavior.

2. A detection method for a voice gateway device according to claim 1, characterized in that: The calculation formula for the outlier value of the call number is: Where, The outlier value of the main call of a single call number. are the standard deviations of the longitude and latitude of all the calling location codes when a single call number is used as the calling number, is the ratio of the number of short call records to the total number of call records in all call records when a single call number is used as the primary caller number, where exp( ) is an exponential function with the natural constant e as its base. Short call records are those whose call duration is less than the preset short call threshold.

3. The detection method of a voice gateway device according to claim 1, wherein: The calculation formula for the malicious call weight between a single called number and a single calling number is: Where, Indicates the weight of malicious calls between called number a and calling number b. is the calling frequency of calling number b, is the frequency of calls between the called number a and the calling number b, is the duration of the xth call between the called number a and the calling number b, To preset the short call threshold, Norm[ ] is the normalization function.

4. The detection method of a voice gateway device according to claim 1, wherein: The specific process of obtaining the malicious call suspicion value of each call number is as follows: Use each call number as a node, and make the called number node in the call record point to the calling number node to establish a directional connection; The malicious call weight between a single called number and a single calling number is used as the weight of the connection between the called number and the calling number. Similarly, the weights of all connections are obtained to obtain a call relationship graph composed of all call number nodes; The call relationship graph is used as the input of the PageRank algorithm, and the PageRank value of each call number node is output. The PageRank value of each call number node is used as the malicious call suspicion value of each call number.

5. The detection method of a voice gateway device according to claim 1, characterized in that: The process of obtaining the malicious call score of each call number is as follows: the normalized main call frequency, main call abnormality value, and malicious call suspicion value of all call numbers are used as inputs of the Topsis algorithm, and the malicious call score of each call number is output.

6. A detection method for a voice gateway device according to claim 1, characterized in that: The specific process of classifying call numbers into abnormal call numbers, normal call numbers and risky call numbers is as follows: clustering the malicious call scores of all call numbers to obtain three clusters; The call number corresponding to the cluster with the highest malicious call score mean is recorded as an abnormal call number; The call number corresponding to the cluster with the lowest malicious call score mean is recorded as a normal call number; The call numbers corresponding to the remaining clusters are recorded as risky call numbers.

7. A detection method for a voice gateway device according to claim 1, characterized in that: The specific process of obtaining high-risk victim numbers is as follows: obtaining all called numbers corresponding to call records when all abnormal call numbers are used as the calling number, and forming a first call table; inputting the first call table into the Apriori algorithm as a transaction, obtaining the frequent items of all single data elements in the output results, and the support of all frequent items, and recording the call numbers corresponding to the frequent items of single data elements as high-risk victim numbers.

8. A detection method for a voice gateway device according to claim 7, characterized in that: The calculation formula for the potential risk increment of a single risky call number is: Where, The potential risk increment for a single risky call number. It is the ratio of high-risk victim numbers in the second call table of a single risky call number. is the call risk score of the yth high-risk victim number in the second call table of a single risky call number, is the total number of call numbers that are high-risk victim numbers in the second call table of a single risk call number, and Norm() is a normalization function; wherein the second call table of a single risk call number refers to all called numbers in the call records corresponding to the single risk call number as the calling number; the calculation formula for the call risk score of the high-risk victim number is: Where, The call risk score for a single high-risk victim number. is the support of the frequent item corresponding to a single high-risk victim number, It is the minimum support among all frequent items in the Apriori algorithm.

9. The detection method of a voice gateway device according to claim 1, wherein: The specific process of classifying each call number and detecting call numbers with malicious call behavior is as follows: the normalized call frequency, call abnormality value, malicious call suspicion value, malicious call score and potential risk increment of each call number are used as the number profile of each call number; Normalize the sum of the malicious call score and the potential risk increment of each call number, and use the normalized result as the initial correction weight of each call number; The number profile and initial correction weight of each call number are used as the input of the AdaBoost algorithm to obtain a malicious call identification model, and then the call numbers with malicious call behavior are detected.

10. A detection system for a voice gateway device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the detection method of a voice gateway device as described in any one of claims 1-9 are implemented.

Images