Call detection method, apparatus, device, and readable storage medium

Abstract

The application discloses a call detection method and device, equipment and a readable storage medium. The method comprises: acquiring characteristic data and call behavior data of IMS call service corresponding to a VoIP device; generating access digital fingerprints corresponding to the VoIP device based on the line impedance data, the transmission attenuation data and the protocol characteristic data; comparing the access digital fingerprints with a verification baseline to obtain a characteristic deviation; and performing abnormal IMS call detection based on the characteristic deviation and the call behavior data. In this way, by acquiring the line impedance data, the transmission attenuation data and the protocol characteristic data of the fixed-line corresponding to the IMS call service, and combining the call behavior data to perform double determination logic, the abnormal IMS call can be detected, the omission rate can be reduced, and the identification accuracy of the abnormal IMS call can be improved.

Description

Technical Field

[0001] This application belongs to the field of IMS fixed-line anomaly detection technology, specifically relating to a call detection method, device, equipment, and readable storage medium. Background Technology

[0002] In recent years, due to its open access and standardized protocol, Internet Protocol (IP) Multimedia Subsystem (IMS) fixed-line telephone lines have become a high-incidence scenario for unauthorized Voice over Internet Protocol (VOIP) devices to make unauthorized calls and commit telecommunications fraud.

[0003] Currently, access security technologies for IMS fixed-line lines rely on a single feature dimension, such as line impedance or Session Initiation Protocol (SIP) signaling. In complex noise environments, these technologies are difficult to distinguish between normal line fluctuations and malicious access, and are easily circumvented by illegal VoIP devices that simulate features, resulting in low identification accuracy. Summary of the Invention

[0004] This application provides a call detection method, apparatus, device, and readable storage medium to solve the problem of low recognition accuracy.

[0005] In a first aspect, embodiments of this application provide a call detection method, the method comprising: Obtain feature data and call behavior data of the IMS call service corresponding to the VoIP device. The feature data includes line impedance data and transmission attenuation data of the fixed line corresponding to the IMS call service, as well as protocol feature data of the VoIP device. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated. The access digital fingerprint is compared with the verification baseline to obtain the feature deviation. The verification baseline is generated based on the standard fingerprint corresponding to the legally registered device. Abnormal IMS calls are detected based on the aforementioned feature deviations and the aforementioned call behavior data.

[0006] Optionally, the method further includes: The reflection characteristics of the fixed-line are collected, and the reflection characteristics are the pilot tone reflection characteristics collected in the extended bandwidth of the fixed-line. If the reflection characteristics are distorted, the VoIP device is determined to be an unauthorized access device.

[0007] Optionally, the method further includes: Based on a preset frequency, a double-ended loop test is performed on the verification baseline; If the feature deviation between the verification baseline and the historical verification baseline is less than or equal to a preset threshold, the verification baseline is automatically updated using an incremental learning algorithm.

[0008] Optionally, generating the access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data includes: Receive the registration request for the IMS call service; Based on the registration request, the line impedance data of the fixed-line corresponding to the IMS call service, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated.

[0009] Optionally, generating the access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data further includes: During the call, the data based on the line impedance, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected at intervals of a first preset time period. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint for the IMS calling device is generated.

[0010] Optionally, the abnormal IMS call detection based on the feature deviation and the call behavior data includes: If the feature deviation is greater than a preset threshold and the call behavior data indicates an abnormal call, the VoIP device is determined to be an unauthorized access device. The call behavior data indicating call abnormalities includes at least one of the following: The number of calls exceeded the preset number within the second preset time period; The call number corresponds to an area where overseas scams are occurring. The call duration is within the third preset time period.

[0011] Optionally, after determining that the VoIP device is an unauthorized access device, the method further includes: Based on the line blocking command issued by the core network, call privileges are frozen; An alarm message is pushed to the alarm platform. The alarm message includes at least the time of illegal access, line number, access location, characteristic deviation, and pilot reflection characteristics.

[0012] Secondly, embodiments of this application provide a call detection device, the device comprising: The acquisition module is used to acquire feature data and call behavior data of the IMS call service corresponding to the VoIP device. The feature data includes line impedance data and transmission attenuation data of the fixed line corresponding to the IMS call service, as well as protocol feature data of the VoIP device. The generation module is used to generate the access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data. The comparison module is used to compare the access digital fingerprint with the verification baseline to obtain the feature deviation. The verification baseline is generated based on the standard fingerprint corresponding to the legally registered device. The detection module is used to detect abnormal IMS calls based on the feature deviation and the call behavior data.

[0013] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps in the method described in the first aspect.

[0014] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0015] In this embodiment, feature data and call behavior data of the IMS call service corresponding to the VoIP device are obtained. The feature data includes line impedance data and transmission attenuation data of the fixed-line corresponding to the IMS call service, as well as protocol feature data of the VoIP device. Based on the line impedance data, transmission attenuation data, and protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated. The access digital fingerprint is compared with a verification baseline to obtain a feature deviation. The verification baseline is generated based on the standard fingerprint corresponding to a legally registered device. Abnormal IMS calls are detected based on the feature deviation and the call behavior data. Thus, by obtaining the line impedance data, transmission attenuation data, and protocol feature data of the fixed-line corresponding to the IMS call service, and combining this with call behavior data for dual-judgment logic to detect abnormal IMS calls, the false negative rate can be reduced, thereby improving the accuracy of abnormal IMS call identification. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the call detection method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the call detection device provided in the embodiments of this application. Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and are not used to describe a specified order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, not limited in number; for example, a first object can be one or more. Furthermore, in the specification and claims, "and" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0019] The related technologies have the following shortcomings in the storage and matching of target numbers: 1. The system only performs a single static verification during the access initialization phase, lacking dynamic updates throughout the entire session. This makes it vulnerable to hijacking and tampering, such as unauthorized gateways simulating line impedance and SIP header features to bypass verification. It lacks anti-circumvention measures like stealth pilot detection, resulting in weak resistance to advanced simulation attacks and an inability to identify forged line characteristics. Furthermore, its feature dimension is limited (impedance + SIP header only), leading to low matching accuracy and a high false alarm rate in complex line noise environments, making it difficult to distinguish between normal line fluctuations and malicious access.

[0020] 2. It lacks integration of physical line characteristics (such as impedance and transmission attenuation) with stealth pilot detection, relying solely on identity and device identifiers, making it vulnerable to identity spoofing and device cloning attacks. It lacks a dynamic verification mechanism throughout the entire session, and stops monitoring characteristic changes after access, failing to address hijacking and feature tampering during the session. It lacks a tiered response mechanism, employing a direct blocking strategy for all abnormal accesses, impacting the continuity of legitimate services and failing to balance security and service availability.

[0021] 3. Reliance on biometric fingerprint collection modules results in high terminal deployment costs, and biometric fingerprints are easily leaked and difficult to revoke, posing privacy and security risks. The lack of integration of physical line characteristics and protocol behavior characteristics makes it unable to handle unauthorized access attacks not related to biometric fingerprints, such as VoIP gateways simulating participant terminal access. It is only suitable for telephone conferencing scenarios, does not support dynamic verification of IMS fixed-line lines throughout the entire session, has poor scalability, and is difficult to adapt to general IMS fixed-line access security scenarios.

[0022] This application addresses the industry pain point of unauthorized access to VoIP devices via IMS fixed-line devices for telecommunications fraud, focusing on the core defects of related technologies and solving the following four categories of technical problems: 1. The existing verification mechanism is too simple and static, making it easy to circumvent. Current IMS fixed-line access verification mostly involves a single static comparison during the registration phase, failing to cover the entire call cycle. Unauthorized devices can bypass detection by forging protocol features or hijacking lines mid-call. This proposal addresses the vulnerability of static verification—"one-time pass, but complete loss of control"—through dynamic verification throughout the entire session (monitoring the entire process from registration to call to hang-up), enabling real-time tracking of access status.

[0023] 2. Insufficient feature dimensions lead to weak detection accuracy and resistance to attacks. Traditional technologies rely solely on single physical characteristics (such as line impedance) or protocol characteristics (such as SIP signaling), making it difficult to distinguish between normal line fluctuations and malicious access, and are easily circumvented by illegitimate VoIP devices simulating these characteristics. This proposal addresses the problem of high false alarm rates and poor anti-attack capabilities associated with single-feature verification by generating a unique access fingerprint through multi-dimensional fusion of line impedance, transmission attenuation, SIP protocol characteristics, and hidden pilot reflection characteristics, thereby improving the accuracy of illegitimate access identification.

[0024] 3. Lack of anti-evasion measures, making it unable to cope with advanced camouflage attacks. Existing solutions lack protection mechanisms against combined attacks involving "physical overlay + protocol forgery," allowing malicious devices to bypass verification by mimicking the characteristic parameters of legitimate devices. This proposal innovates with stealth pilot tone active detection technology, ensuring that even if malicious devices forge physical and protocol characteristics, the distortion of their pilot tone reflection characteristics can still be accurately identified, solving the technical challenge of detecting advanced spoofing attacks.

[0025] 4. The verification architecture suffers from poor adaptability to business scenarios, resulting in high implementation costs. On the one hand, traditional verification solutions mostly employ centralized cloud computing, which suffers from high latency and insufficient throughput in high-concurrency scenarios. On the other hand, they fail to set differentiated thresholds for different scenarios such as homes, enterprises, and governments, leading to false blocking of legitimate services or missed detection of unauthorized access. This proposal reduces latency through a distributed verification architecture at edge nodes, combined with a scenario-based dynamic threshold adjustment mechanism, to solve the problem of balancing verification performance and business continuity. Furthermore, it requires no additional hardware modifications, reducing the deployment cost of existing IMS lines.

[0026] For ease of understanding, the call detection method, apparatus, device, and readable storage medium proposed in this application will be further described below with reference to the accompanying drawings.

[0027] Please see Figure 1 , Figure 1 A flowchart illustrating the call detection method provided in this application embodiment is shown in the figure. The method includes: Step 101: Obtain the feature data and call behavior data of the IMS call service corresponding to the VoIP device.

[0028] The feature data includes the line impedance data and transmission attenuation data of the fixed-line corresponding to the IMS call service, as well as the protocol feature data of the VoIP device.

[0029] It should be understood that line impedance data and transmission attenuation data can be obtained through the line detection unit, and the acquisition frequency can be preset, for example, the acquisition frequency can be set to once every 10 seconds.

[0030] Protocol feature data of VoIP devices can be extracted through the SIP signaling parsing unit. Specifically, features such as the User-Agent field, registration period, and signaling interaction sequence during the registration phase, as well as the RTP stream encoding format and port usage rules during the call phase, can be extracted to form protocol feature data.

[0031] In an optional embodiment, after obtaining the feature data and call behavior data of the IMS call service corresponding to the VoIP device, the feature data and call behavior data can be preprocessed. Specifically, the data can be deduplicated, noise reduced, and processed.

[0032] In this way, by eliminating abnormal data caused by line interference and network jitter, the stability and accuracy of the feature data are ensured.

[0033] Step 102: Based on the line impedance data, the transmission attenuation data, and the protocol feature data, generate the access digital fingerprint corresponding to the VoIP device.

[0034] After obtaining line impedance data, transmission attenuation data, and protocol feature data from 101, a weighted fusion algorithm can be used to fuse the line impedance data, transmission attenuation data, and protocol feature data with preset weights, and transform them into access digital fingerprints.

[0035] In an optional embodiment, the multidimensional features can be converted into a 64-bit unique digital fingerprint, i.e., the access digital fingerprint corresponding to the VoIP device, according to a preset weight of 45% for line impedance, 35% for transmission attenuation, and 20% for SIP protocol features.

[0036] In an optional embodiment, the preset weight settings can be adjusted based on the scenario, which can improve the accuracy of the access digital fingerprint corresponding to the generated VoIP device.

[0037] Optionally, after generating the access digital fingerprint corresponding to the VoIP device, encryption processing can be set. For example, the access digital fingerprint can be stored in encrypted form to protect it from tampering, thereby improving the security of call detection.

[0038] In an optional embodiment, fingerprint data can be stored using the AES-256 encryption algorithm, and a unique digital signature can be added to each fingerprint to prevent data from being tampered with or forged.

[0039] Step 103: Compare the access digital fingerprint with the verification baseline to obtain the feature deviation. The verification baseline is generated based on the standard fingerprint corresponding to the legally registered device.

[0040] It should be understood that the verification baseline is established based on the standard fingerprints corresponding to legally registered devices set historically. Legally registered devices may include IMS terminals, gateway devices, VoIP devices, etc., registered with the operator.

[0041] In an optional embodiment, the standard fingerprint corresponding to the legally registered device is stored in the fingerprint database in the background. Each standard fingerprint is labeled with associated information such as device model, line number, and usage scenario. Each standard fingerprint forms a unique verification baseline.

[0042] Step 104: Detect abnormal IMS calls based on the feature deviation and the call behavior data.

[0043] After comparing the access digital fingerprint with the verification baseline to obtain the feature deviation between the two, call detection is performed by combining the call behavior data of the IMS call service.

[0044] Call behavior data may include the region where the caller number is located, call duration, etc.

[0045] In this way, by acquiring the line impedance data, transmission attenuation data, and protocol characteristic data of the fixed-line corresponding to the IMS call service, and combining the call behavior data to perform a dual judgment logic, abnormal IMS calls can be detected, thereby reducing the false negative rate and improving the accuracy of identifying abnormal IMS calls.

[0046] Optionally, the method further includes: The reflection characteristics of the fixed-line are collected, and the reflection characteristics are the pilot tone reflection characteristics collected in the extended bandwidth of the fixed-line. If the reflection characteristics are distorted, the VoIP device is determined to be an unauthorized access device.

[0047] It should be understood that reflection characteristics can be obtained by implanting low-power (≤1mW) invisible pilot tones in the extended bandwidth of the IMS line (i.e., beyond the voice communication frequency band). It should be noted that when a legally registered device is connected, the implanted low-power (≤1mW) invisible pilot tones result in stable reflection characteristics, while the connection of an unauthorized VoIP device will lead to distortion of the reflection characteristics.

[0048] In this way, by detecting reflection characteristics, and in the case of distortion in the reflection characteristics, the VoIP device can be determined to be an unauthorized access device.

[0049] In this embodiment, by acquiring pilot tone reflection characteristics, it is possible to counter evasion methods such as high impedance spoofing and protocol fingerprint imitation by illegal VoIP devices, thereby improving verification accuracy.

[0050] Optionally, the method further includes: Based on a preset frequency, a double-ended loop test is performed on the verification baseline; If the feature deviation between the verification baseline and the historical verification baseline is less than or equal to a preset threshold, the verification baseline is automatically updated using an incremental learning algorithm.

[0051] It should be understood that both the preset frequency and the preset threshold can be pre-set values.

[0052] In an optional embodiment, a dual-loop test (DELT) can be automatically triggered every 72 hours. By collecting the fingerprint of the current line and comparing it with the historical baseline, if the deviation is within a reasonable range of ±5%, the baseline is updated through an incremental learning algorithm to adapt to feature drift caused by line aging and temperature and humidity changes.

[0053] Optionally, generating the access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data includes: Receive the registration request for the IMS call service; Based on the registration request, the line impedance data of the fixed-line corresponding to the IMS call service, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated.

[0054] It should be understood that when a VoIP device initiates a registration request, the current access device can be collected in real time to generate a real-time fingerprint, which is then quickly compared with the background verification baseline (response time ≤ 100ms) to directly determine whether the access device is legitimate or illegitimate.

[0055] Optionally, generating the access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data further includes: During the call, the data based on the line impedance, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected at intervals of a first preset time period. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated.

[0056] It should be understood that during a call, a segment of line characteristics can be extracted every 30 seconds for fingerprint comparison, without interrupting IP data packet transmission to avoid affecting call quality. If a sudden change in fingerprint is detected (deviation exceeding a preset threshold), the anomaly is immediately marked and the call recording is reviewed.

[0057] In an optional embodiment, after hanging up, a complete verification log is generated, integrating the fingerprint comparison results and call behavior data (call duration, call number, etc.) throughout the process, to provide a complete data chain for subsequent tracing.

[0058] Optionally, the abnormal IMS call detection based on the feature deviation and the call behavior data includes: If the feature deviation is greater than a preset threshold and the call behavior data indicates an abnormal call, the VoIP device is determined to be an unauthorized access device. The call behavior data indicating call abnormalities includes at least one of the following: The number of calls exceeded the preset number within the second preset time period; The call number corresponds to an area where overseas scams are occurring. The call duration is within the third preset time period.

[0059] It should be understood that if the feature deviation between the accessed digital fingerprint and the standard fingerprint is greater than a preset threshold, and if the number of calls in the current IMS call service exceeds a preset number within a second preset time period, or if the area corresponding to the number called by the current IMS call service is an overseas fraud area, or if the duration of each call in the current IMS call service is concentrated in a third preset time period, then the current IMS call can be determined to be an abnormal call, and the VoIP device can be determined to be an unauthorized access device.

[0060] The preset threshold can be calculated and obtained based on data related to line aging, temperature and humidity changes, etc.

[0061] In an alternative implementation, the call frequency can be set to more than 50 calls per hour.

[0062] In an alternative implementation, the call duration can be set to 30 seconds.

[0063] Optionally, after determining that the VoIP device is an unauthorized access device, the method further includes: Based on the line blocking command issued by the core network, call privileges are frozen; An alarm message is pushed to the alarm platform. The alarm message includes at least the time of illegal access, line number, access location, characteristic deviation, and pilot reflection characteristics.

[0064] It should be understood that when a VoIP device is determined to be an unauthorized access device, the core network sends a line blocking command to the relevant network elements of the IMS core network to freeze call permissions, retaining only the emergency call function. This can improve the security of IMS call services.

[0065] In addition, alerts can be pushed to operator maintenance personnel and local anti-fraud management systems via SMS and platform pop-ups. These alerts include the time of unauthorized access, line number, access location, fingerprint deviation value, and pilot reflection characteristics. Furthermore, the system can automatically link line registration information and access location topology maps to generate source tracing and verification work orders, assisting maintenance personnel in quickly locating the installation location of unauthorized devices, thereby improving the security of IMS call services.

[0066] In summary, the technical solution presented in this application addresses the industry pain point of unauthorized access to IMS fixed-line VoIP devices for fraudulent calls. It innovatively proposes an integrated solution combining "multi-dimensional feature fusion fingerprint + full-session-cycle dynamic verification + anti-evasion detection." By collecting the physical and protocol characteristics of the IMS fixed-line to generate a unique access fingerprint, and relying on a distributed verification architecture, it achieves real-time monitoring of the entire process from registration to call and hang-up. Combined with scenario-based threshold adjustment, dynamic fingerprint updates, and active pilot detection technology, it accurately identifies unauthorized VoIP device access behavior, achieving a closed-loop prevention and control system of "real-time detection - rapid blocking - accurate source tracing." This solution is compatible with existing IMS network deployments and effectively counters new evasion methods such as high-impedance spoofing and protocol imitation, ensuring the security of IMS fixed-line communication.

[0067] It should be understood that the call detection method provided in this application can be applied to a call detection system, wherein the call detection system of this application mainly involves a multi-dimensional feature acquisition module, an access fingerprint generation and management module, a full session lifecycle verification module, an anti-evasion detection module, an anomaly handling and alarm module, and a distributed verification architecture support module.

[0068] The specific explanation is as follows: (I) Multidimensional Feature Acquisition Module Core function: Responsible for collecting the physical and protocol characteristics of IMS fixed-line telephone lines to provide basic data support for access fingerprint generation; Specific functional details: Physical feature acquisition: The line impedance and transmission attenuation data are acquired in real time through the line detection unit. The sampling frequency is once every 10 seconds, with an accuracy of ±0.1Ω (impedance) and ±0.5dB (attenuation). It is compatible with different line types such as RJ45 Ethernet cable and traditional telephone line. Protocol feature collection: Through the SIP signaling parsing unit, extract features such as the User-Agent field, registration period, and signaling interaction sequence during the device registration phase, as well as the RTP stream encoding format and port usage rules during the call phase, to form a protocol feature dataset; Data preprocessing: The collected feature data is deduplicated and noise-reduced to remove abnormal data caused by line interference and network jitter, ensuring the stability and accuracy of the feature data.

[0069] (ii) Accessing the fingerprint generation and management module Core functions: Generate a unique access digital fingerprint based on the collected multi-dimensional features, establish and dynamically update the verification baseline, and provide encrypted storage and anti-tamper protection for fingerprints; Specific functional details: Fingerprint generation: A weighted fusion algorithm is used to convert multi-dimensional features into a 64-bit unique digital fingerprint by using the default weights of "45% line impedance + 35% transmission attenuation + 20% SIP protocol features" (which can be adjusted according to the scenario). Baseline establishment: Store the access fingerprints of legitimate access devices (such as IMS terminals and gateway devices registered with operators) in the background fingerprint database, and mark the device model, line number, usage scenario and other related information to form a unique verification baseline; Dynamic update: Every 72 hours, a double-ended loop test (DELT) is automatically triggered to collect the current line characteristics and compare them with the historical baseline. If the deviation is within a reasonable range of ±5%, the baseline is updated through an incremental learning algorithm to adapt to feature drift caused by line aging and temperature and humidity changes. Fingerprint security management: Fingerprint data is stored using the AES-256 encryption algorithm, and a unique digital signature is added to each fingerprint to prevent data from being tampered with or forged.

[0070] (III) Full Session Lifecycle Verification Module Core function: Enables real-time fingerprint verification throughout the entire process of IMS fixed-line device registration, call, and hang-up to determine the legitimacy of access; Specific functional details: Registration phase verification: When a device initiates a registration request, it collects current access characteristics in real time to generate a real-time fingerprint, which is quickly compared with the background baseline (response time ≤ 100ms) to directly determine whether it is legal or illegal. Call phase verification: During the call, a line feature segment is extracted every 30 seconds for lightweight fingerprint comparison without interrupting IP data packet transmission, thus avoiding affecting call quality; if a fingerprint mutation is detected (deviation exceeds the threshold), the anomaly is immediately marked and the call recording is reviewed. Post-hang-up review: After hanging up, a complete verification log is generated, integrating fingerprint comparison results and call behavior data (call duration, call number, etc.) to provide a complete data chain for subsequent source tracing; Scenario-based threshold management: Built-in templates for three scenarios: home, enterprise, and government, with feature deviation thresholds of ±8%, ±15%, and ±6% respectively. The enterprise scenario is additionally associated with high-frequency outbound call monitoring (more than 50 calls per hour triggers secondary verification).

[0071] (iv) Anti-evasion detection module Core Function: To counter evasion techniques such as high impedance spoofing and protocol fingerprint imitation by illegal VoIP devices, thereby improving verification accuracy; Specific functional details: Stealth pilot detection: Low-power (≤1mW) stealth pilot tones are implanted in the extended bandwidth of the IMS line (beyond the voice communication frequency band), and the reflection characteristics of the pilot tones are collected; the reflection characteristics are stable when a legitimate device is connected, but the reflection characteristics will be distorted when an illegal VoIP device is connected, and manual verification will be triggered even if the fingerprint comparison passes. Abnormal behavior correlation analysis: By combining call behavior data (such as call numbers from overseas areas with high incidence of fraud and call durations concentrated in 10-30 seconds) with fingerprint verification results, a dual judgment logic of "feature deviation + abnormal behavior" is constructed to reduce the false negative rate.

[0072] (v) Anomaly Handling and Alarm Module Core functions: Receive the judgment result from the verification module, execute the unauthorized access blocking operation, and push alarm information to the relevant management party; Specific functional details: Blocking control: Upon determining unauthorized access, a line blocking command is sent to the relevant network elements of the IMS core network within 3 seconds to freeze call permissions, retaining only the emergency call function; Alarm push notification: Alarm information is pushed to operator maintenance personnel and local anti-fraud management system via SMS, platform pop-up, etc. The content includes the time of illegal access, line number, access location, fingerprint deviation value, pilot reflection characteristics, etc. Source tracing support: Automatically associates line registration information and access location topology map to generate source tracing verification work orders, assisting operation and maintenance personnel in quickly locating the installation location of illegal equipment.

[0073] (vi) Distributed verification architecture support module Core function: Provide computing power and data transmission support for the entire verification process, balancing verification speed and system stability; Specific functional details: Edge node deployment: Deploy a lightweight verification engine on the operator's edge nodes (such as SBC session boundary controllers) to cache frequently used legitimate device fingerprints locally, achieving millisecond-level comparison response; Cloud-based collaboration: Edge nodes synchronize abnormal fingerprints and updated baseline data to the cloud database in real time, supporting cross-regional joint tracing of fraud clues; Load balancing: Dynamically allocate computing power to edge nodes based on the number of line connections to avoid verification delays in high-concurrency scenarios and ensure system stability.

[0074] To better understand the call detection method provided in the embodiments of this application, the following describes in detail the steps of blocking unauthorized access to VoIP devices and fraudulent calls in this application, with reference to an embodiment: Step 1: Multidimensional Feature Acquisition (led by the multidimensional feature acquisition module) The process includes: after an unauthorized person accesses the VoIP device, the device initiates an IMS registration request; the multi-dimensional feature acquisition module collects the impedance (measured value 120Ω) and transmission attenuation (measured value 3.2dB) of the line in real time through the line detection unit, and at the same time extracts protocol features such as the User-Agent field of the VoIP device (forged as a legitimate terminal identifier) ​​and registration period (20 seconds / time) through the SIP signaling parsing unit; after the acquisition is completed, the data is deduplicated and noise-reduced, and a standardized feature dataset is output.

[0075] Module function: To provide accurate and stable basic data for subsequent fingerprint generation, ensuring that the feature data can truly reflect the attributes of the accessed device.

[0076] Step 2: Access fingerprint generation and baseline comparison (led by the access fingerprint generation and management module) The process includes: the access fingerprint generation and management module receives the feature dataset, generates a real-time access fingerprint (64-bit number: 0x7E2F9A...) according to the enterprise scenario weight (line impedance 45% + transmission attenuation 35% + SIP protocol feature 20%); retrieves the legal device verification baseline of the enterprise line (original legal terminal fingerprint: 0x5D8B3C...) from the fingerprint database, compares the real-time fingerprint with the baseline, and calculates that the feature deviation is 18%, which exceeds the preset threshold of ±15% for the enterprise scenario.

[0077] Module function: Generate a unique fingerprint through multi-dimensional feature fusion to realize the "digital identification" of access devices, while relying on dynamically updated baselines to ensure the accuracy of comparison benchmarks.

[0078] Step 3: Full Session Lifecycle Verification and Anti-Evasion Detection (Full Session Lifecycle Verification Module + Anti-Evasion Detection Module Working Together) The process includes: the full session lifecycle verification module determines that the feature deviation exceeds the threshold and triggers secondary verification; the anti-evasion detection module starts the stealth pilot tone detection and finds that the pilot tone reflection feature has obvious distortion (the difference from the reflection feature of legitimate devices is up to 40%), confirming that the device is an illegal VoIP device; at the same time, the full session lifecycle verification module detects that the device initiated 30 overseas calls within 10 minutes after registration, which is consistent with the characteristics of fraudulent behavior, and is finally determined to be illegal access.

[0079] Module function: By combining full-process verification with anti-circumvention detection, it avoids missed judgments caused by protocol forgery and ensures the accuracy of judgment results.

[0080] Step 4: Anomaly Handling and Alarms (led by the Anomaly Handling and Alarms module) The process includes: the anomaly handling and alarm module receives the "illegal access" judgment result, sends a blocking command to the IMS core network within 3 seconds, and freezes the call permissions of the line; at the same time, it pushes an alarm SMS to the operator's operation and maintenance personnel (including line number, access location: 3rd floor weak current well of XX building, fingerprint deviation 18%), and synchronizes it to the local anti-fraud system; and generates a source tracing and verification work order, marking key data such as line registration information and illegal device characteristics.

[0081] Module Function: Quickly block illegal calls, provide accurate tracing clues for maintenance personnel and anti-fraud departments, and reduce losses caused by fraud.

[0082] Step 5: Subsequent baseline update (led by the fingerprint generation and management module) The process includes: after the maintenance personnel remove the illegal VoIP equipment on site, the system automatically triggers a two-end ring test, collects the line characteristics after the legitimate terminal reconnects, updates the verification baseline through an incremental learning algorithm, adapts to slight changes in the characteristics of the line after disassembly and reassembly, and avoids subsequent misjudgments.

[0083] Module function: To ensure the dynamic adaptability of the baseline and guarantee the accuracy of the system for long-term use.

[0084] Please see Figure 2 , Figure 2 This is a schematic diagram of a call detection device provided in an embodiment of this application. The device 200 includes: The acquisition module 201 is used to acquire feature data and call behavior data of the IMS call service corresponding to the VoIP device. The feature data includes line impedance data and transmission attenuation data of the fixed line corresponding to the IMS call service, as well as protocol feature data of the VoIP device. The generation module 202 is used to generate an access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data. The comparison module 203 is used to compare the access digital fingerprint with the verification baseline to obtain the feature deviation. The verification baseline is generated based on the standard fingerprint corresponding to the legally registered device. The detection module 204 is used to detect abnormal IMS calls based on the feature deviation and the call behavior data.

[0085] Optionally, the device 200 further includes: The reflection characteristics of the fixed-line are collected, and the reflection characteristics are the pilot tone reflection characteristics collected in the extended bandwidth of the fixed-line. If the reflection characteristics are distorted, the VoIP device is determined to be an unauthorized access device.

[0086] Optionally, the device 200 further includes: Based on a preset frequency, a double-ended loop test is performed on the verification baseline; If the feature deviation between the verification baseline and the historical verification baseline is less than or equal to a preset threshold, the verification baseline is automatically updated using an incremental learning algorithm.

[0087] Optionally, generating the access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data includes: Receive the registration request for the IMS call service; Based on the registration request, the line impedance data of the fixed-line corresponding to the IMS call service, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated.

[0088] Optionally, generating the access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data further includes: During the call, the data based on the line impedance, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected at intervals of a first preset time period. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint for the IMS calling device is generated.

[0089] Optionally, the abnormal IMS call detection based on the feature deviation and the call behavior data includes: If the feature deviation is greater than a preset threshold and the call behavior data indicates an abnormal call, the VoIP device is determined to be an unauthorized access device. The call behavior data indicating call abnormalities includes at least one of the following: The number of calls exceeded the preset number within the second preset time period; The call number corresponds to an area where overseas scams are occurring. The call duration is within the third preset time period.

[0090] Optionally, after determining that the VoIP device is an unauthorized access device, the method further includes: Based on the line blocking command issued by the core network, call privileges are frozen; An alarm message is pushed to the alarm platform. The alarm message includes at least the time of illegal access, line number, access location, characteristic deviation, and pilot reflection characteristics.

[0091] It should be noted that the call detection device provided in this application is a device capable of executing the above-described call detection method. Therefore, all implementation methods in the above-described call detection method embodiments are applicable to this device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further. The call detection device provided in this application can be the above-described call detection system.

[0092] See Figure 3 As shown in the figure, this application embodiment also provides an electronic device, including a bus 301, a transceiver 302, an antenna 303, a bus interface 304, a processor 305, and a memory 306.

[0093] Processor 305, used for: Obtain feature data and call behavior data of the IMS call service corresponding to the VoIP device. The feature data includes line impedance data and transmission attenuation data of the fixed line corresponding to the IMS call service, as well as protocol feature data of the VoIP device. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated. The access digital fingerprint is compared with the verification baseline to obtain the feature deviation. The verification baseline is generated based on the standard fingerprint corresponding to the legally registered device. Abnormal IMS calls are detected based on the aforementioned feature deviations and the aforementioned call behavior data.

[0094] exist Figure 3 In this document, a bus architecture (represented by bus 301) is used. Bus 301 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 305 and memory represented by memory 306. Bus 301 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 304 provides an interface between bus 301 and transceiver 302. Transceiver 302 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 305 is transmitted over a wireless medium via antenna 403, which further receives data and transmits it to processor 305.

[0095] Processor 305 manages bus 301 and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory 406 can be used to store data used by processor 305 during operation.

[0096] Alternatively, the processor 305 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).

[0097] Optionally, the processor 305 is further configured to: The reflection characteristics of the fixed-line are collected, and the reflection characteristics are the pilot tone reflection characteristics collected in the extended bandwidth of the fixed-line. If the reflection characteristics are distorted, the VoIP device is determined to be an unauthorized access device.

[0098] Optionally, the processor 305 is further configured to: Based on a preset frequency, a double-ended loop test is performed on the verification baseline; If the feature deviation between the verification baseline and the historical verification baseline is less than or equal to a preset threshold, the verification baseline is automatically updated using an incremental learning algorithm.

[0099] Optionally, the processor 305 is specifically used for: Receive the registration request for the IMS call service; Based on the registration request, the line impedance data of the fixed-line corresponding to the IMS call service, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated.

[0100] Optionally, the processor 305 is further configured to: During the call, the data based on the line impedance, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected at intervals of a first preset time period. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint for the IMS calling device is generated.

[0101] Optionally, the processor 305 is specifically used for: If the feature deviation is greater than a preset threshold and the call behavior data indicates an abnormal call, the VoIP device is determined to be an unauthorized access device. The call behavior data indicating call abnormalities includes at least one of the following: The number of calls exceeded the preset number within the second preset time period; The call number corresponds to an area where overseas scams are occurring. The call duration is within the third preset time period.

[0102] Optionally, the processor 305 is further configured to: Based on the line blocking command issued by the core network, call privileges are frozen; An alarm message is pushed to the alarm platform. The alarm message includes at least the time of illegal access, line number, access location, characteristic deviation, and pilot reflection characteristics.

[0103] It should be noted that the electronic device provided in this application embodiment is a device capable of executing the above-described call detection method. Therefore, all implementation methods in the above-described call detection method embodiments are applicable to this electronic device and can achieve the same or similar beneficial effects. To avoid repetition, this embodiment will not elaborate further.

[0104] This invention also provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described call detection method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0105] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described call detection method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0106] This application also provides a computer program product, including computer instructions. When executed by a processor, the computer instructions implement the various processes of the above-described call detection method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0107] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0108] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0109] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A call detection method, characterized in that, The method includes: Obtain feature data and call behavior data of the IMS call service corresponding to the VoIP device. The feature data includes line impedance data and transmission attenuation data of the fixed line corresponding to the IMS call service, as well as protocol feature data of the VoIP device. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated. The access digital fingerprint is compared with the verification baseline to obtain the feature deviation. The verification baseline is generated based on the standard fingerprint corresponding to the legally registered device. Abnormal IMS calls are detected based on the aforementioned feature deviations and the aforementioned call behavior data.

2. The method according to claim 1, characterized in that, The method further includes: The reflection characteristics of the fixed-line are collected, wherein the reflection characteristics are pilot tone reflection characteristics collected in the extended bandwidth of the fixed-line. If the reflection characteristics are distorted, the VoIP device is determined to be an unauthorized access device.

3. The method according to claim 1, characterized in that, The method further includes: Based on a preset frequency, a double-ended loop test is performed on the verification baseline; If the feature deviation between the verification baseline and the historical verification baseline is less than or equal to a preset threshold, the verification baseline is automatically updated using an incremental learning algorithm.

4. The method according to claim 1, characterized in that, The step of generating an access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data includes: Receive the registration request for the IMS call service; Based on the registration request, the line impedance data of the fixed-line corresponding to the IMS call service, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated.

5. The method according to claim 4, characterized in that, The step of generating the access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data further includes: During the call, the data based on the line impedance, the transmission attenuation data, and the protocol characteristic data of the VoIP device are collected at intervals of a first preset time period. Based on the line impedance data, the transmission attenuation data, and the protocol feature data, an access digital fingerprint corresponding to the VoIP device is generated.

6. The method according to claim 2, characterized in that, The abnormal IMS call detection based on the feature deviation and the call behavior data includes: If the feature deviation is greater than a preset threshold and the call behavior data indicates an abnormal call, the VoIP device is determined to be an unauthorized access device. The call behavior data indicating call abnormalities includes at least one of the following: The number of calls exceeded the preset number within the second preset time period; The call number corresponds to an area where overseas scams are occurring. The call duration is within the third preset time period.

7. The method according to claim 6, characterized in that, After determining that the VoIP device is an unauthorized access device, the method further includes: Based on the line blocking command issued by the core network, call privileges are frozen; An alarm message is pushed to the alarm platform. The alarm message includes at least the time of illegal access, line number, access location, the characteristic deviation, and the reflection characteristic.

8. A call detection device, characterized in that, The device includes: The acquisition module is used to acquire feature data and call behavior data of the IMS call service corresponding to the VoIP device. The feature data includes line impedance data and transmission attenuation data of the fixed line corresponding to the IMS call service, as well as protocol feature data of the VoIP device. The generation module is used to generate the access digital fingerprint corresponding to the VoIP device based on the line impedance data, the transmission attenuation data, and the protocol feature data. The comparison module is used to compare the access digital fingerprint with the verification baseline to obtain the feature deviation. The verification baseline is generated based on the standard fingerprint corresponding to the legally registered device. The detection module is used to detect abnormal IMS calls based on the feature deviation and the call behavior data.

9. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the call detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the call detection method as described in any one of claims 1 to 7.

Images