METHOD FOR AUTOMATED SUPPRESSION OF SPAM PHONE CALLS

Description

[0001] The present invention relates to a method and a system in the technical field of automated suppression of unwanted telephone calls, so-called spam telephone calls.

[0002] The term "spamming" refers to the mass distribution of unsolicited messages ("spam"). "Spamming" is facilitated by easy and inexpensive access to electronic media, which generally allow messages to be sent to a large number of recipients with minimal time and cost. The content of such "spam" messages is often commercial or even criminal in nature. Spam messages with criminal content can, for example, send viruses or ask users to enter their account information into online forms, which are then intercepted by criminals to harm the users. A very common form of spam is the mass distribution of emails. In addition to email spam, other forms exist, such as spam via instant messaging, newsgroups, internet search engines, blogs, or mobile communications.

[0003] Due to the predominant importance of email spam, technical defense measures, so-called spam filters, have been developed in this area in particular to effectively protect users from such emails. For example, the so-called blacklist method is used, which examines the content of the email for certain expressions or keywords, or the sender for entries from a negative list (blacklist). If such an expression or sender is found, the email is filtered out. However, such filters can often be easily circumvented by slightly modifying the keywords. Creating appropriate filter patterns can be very time-consuming. Another option for filtering spam emails is the so-called Bayesian classifier method, which is based on a self-learning Bayesian spam filter and uses Bayesian probability. A user orA system administrator must manually classify approximately the first 1,000 emails as spam or non-spam. After that, the system detects spam emails almost automatically, with a hit rate usually exceeding 95%.

[0004] There is now reason to fear that the problem of spam will increasingly shift to unsolicited phone calls in the near future. Spam in this area has so far been limited because, firstly, each phone call was usually associated with a call charge, which can add up to a significant sum for a large number of calls. Secondly, each unsolicited phone call required a person to make the call. The cost-to-benefit ratio for unsolicited phone calls was therefore significantly lower than for unsolicited emails, for example.

[0005] This could change, however, as there are now many flat-rate plans available that do not incur any additional costs for the caller. Furthermore, there are now intelligent voice-based systems that can imitate real people on the phone with astonishing realism, so that the person being called does not immediately realize they are talking to a machine. This development will continue in this direction. However, this now makes it possible to effectively make unwanted phone calls in large numbers without incurring significant costs. Therefore, it remains to be feared that users will be bothered by such unwanted phone calls on a large scale in the future.

[0006] EP 1 628 448 B1 describes a spam filter system for a wireless network that allows the filtering of spam intended for a mobile device in the form of an SMS. The SMS is analyzed using a spam filter system, similar to a conventional email. The disadvantage of this method is that it is not suitable for analyzing telephone calls for their spam characteristics and protecting the user.

[0007] US 2017 / 163803 A1 describes methods, systems, and computer-readable media for managing nuisance calls. In one example, a method includes receiving, at a telecommunications signaling computer system for forwarding telecommunications signaling messages in a core network of a telecommunications signaling network, a message to a user equipment (UE) of a subscriber indicating that the subscriber has flagged a first call as a spam call. The method includes blocking the second call at the telecommunications signaling computer system.

[0008] EP 2 332 311 B1 describes a PUCI system comprising a user equipment (UE) and a PUCI application server containing user policies in conjunction with a home subscriber server (HSS) containing operator policies. A policy manager correlates the user policies with the operator policies and thus determines whether an incoming call originating from a trusted / untrusted source network should be rejected or forwarded according to prescribed rules / logic.

[0009] US 2009 / 106318 A1 describes a method and system for detecting spam via Internet telephony (SPIT). Incoming call requests are received and analyzed using heuristic algorithms. A runtime action is performed based on the analysis using the heuristic algorithms. The heuristic algorithms include zero-touch heuristic algorithms, which require no human intervention, one-touch heuristic algorithms, which require a single human intervention, and multi-touch heuristic algorithms, which require more than one human intervention. The cumulative probability is calculated for each incoming call request, and the incoming call request is classified as spam if the cumulative probability exceeds a threshold.

[0010] DE 10 2006 023 759 A1 relates to a method for warding off unwanted telephone calls transmitted via an Internet protocol-based network, comprising the following steps: a) analysis and checking of an incoming telephone call for a subscriber connection by an automated detector device using preset criteria for connecting the telephone call (S1); b) classification of the incoming telephone call into a group of i) unwanted telephone calls or into a group of ii) desired telephone calls on the basis of the check carried out in step a) (S2); and c) different further processing of the incoming telephone call depending on the classification carried out in step b) (S3-S6).

[0011] The object of the invention is therefore to provide a method and a system for the automated identification and defense against unwanted telephone calls.

[0012] This problem is solved by the independent claims 1 and 10.

[0013] According to the invention, a method for the automated identification and defense against unwanted telephone calls is specified, which comprises the following steps: If a user is called, who is also referred to below as the person being called, the telephone connection of the caller, who is also referred to below as the spammer in the case of an unwanted call, is registered by the telephone exchange when the caller makes the call.

[0014] Before the call is connected to the user, an algorithm assigned to the switchboard is launched. This algorithm accesses a database containing information about telephone connections, particularly spam identification data. Using the information stored in the database, the algorithm analyzes the caller's telephone connection for potential unwanted calls and, if a threshold is exceeded, marks the call as unwanted.

[0015] If the telephone call is marked as an unwanted call, i.e. a spam call, the telephone switchboard will initiate technical defense measures, whereby the defense measures protect the user from the unwanted call.

[0016] The invention thus provides effective protection for users against spam calls. These are filtered out in advance by the switchboard, and the user is not bothered in the traditional way by having to first answer the call in order to possibly recognize that it is a spam call. Furthermore, the risk of users, especially older users, not realizing that the call is spam can be prevented. This advantageously prevents these users from being spied on and potentially disclosing security-relevant data, such as their account details. Unwanted advertising calls can also be filtered out in this way before the call is connected.

[0017] Preferably, a trained database or a trained machine with a learning algorithm is used, which can be generated in advance and whose spam identification data is information from telephone calls made to a caller's telephone lines that can be evaluated for unsolicited calls. The database then contains information about "who" made calls and "how" they were made. Within the scope of this invention, spam identification data refers to data whose evaluation can provide clues as to whether the call is a so-called spam call. The database trained in this way is expediently stored in a telephone exchange.

[0018] Preferably, the user, as a customer, can activate or deactivate the technical defense measures service. This can be achieved, for example, by the user clicking the corresponding checkboxes on an online platform assigned to the switchboard or by instructing a switchboard or telephone service employee accordingly. This ensures that all calls are forwarded to the user who they request. This allows the user to consciously select this option, for example, if they expect a very important call in the near future that absolutely needs to be forwarded to them.

[0019] Technical defense measures that can be applied within the scope of this invention in the event of an unwanted call include, for example, a warning message from the switchboard to the user before the call is connected. This warning message can provide the user with further information about the call, allowing them to decide whether or not to connect the call. A warning message definitely increases the user's awareness and makes them more sensitive to potential spam calls. As a defense measure, it can also be provided that the caller must identify themselves to the switchboard as a human. This identification should be adapted so that artificial intelligence can be detected. In some cases, this means that the corresponding algorithms must be updated regularly.This can also be done automatically, with the switchboard giving the caller "tasks" that are difficult for a robot, for example, to answer. If identification fails, the call is not connected to the user, thus preventing them from being bothered. The caller can also be forwarded to a call center, which can verify the caller's identity. Furthermore, the call can be blocked or redirected to a spam mailbox. In the "normal" mailbox, detected spam voice messages can also be moved to a "spam folder" or marked as spam. These defensive measures are initiated, as mentioned above, when the threshold that marks the call as an unsolicited call is exceeded. This threshold indicates the probability that a call is spam and is calculated using the algorithm.The threshold can be set variably, also at the user's request, so that the technical defense measures intervene with more or less sensitive filtering.

[0020] In a preferred embodiment of the invention, the trained database is automatically updated in real time using the algorithm. This advantageously enables new unwanted phone numbers to be identified and added to the database, so that user protection is dynamically adapted and updated. User feedback can be used to train a local and / or global dataset, which can then be part of the overall dataset on which the machine learning algorithm is trained.

[0021] In an advantageous embodiment of the invention, the spam identification data comprises a number of calls from telephone connections to other telephone numbers in a defined unit of time. This makes it possible to determine how often a specific telephone connection has dialed other telephone numbers. If, for example, it is determined that this telephone connection makes several hundred calls a day, this is an indication of a spam call (whereby the numbers are only exemplary and should be adapted to the respective situation). The duration of telephone calls from the telephone connections can also be determined. The shorter this duration, the higher the probability that the call is a spam call. Information as to whether the user or the caller has hung up can also be an indicator of spam calls. If the called user usually hangs up, this indicates a spam call.Furthermore, the spam identification data can include the country the call is coming from, with each country being assigned a certain probability of being a spam call. Furthermore, it can be recorded whether the caller called with a withheld number, which also increases the probability of being a spam call.

[0022] In a preferred embodiment of the invention, the algorithm training the database is based on mathematical models of a decision tree, a Forest tree, or a neural network. Neural networks, in particular, have proven to be extremely flexible and effective in training databases. In a particularly advantageous embodiment of the invention, a deep neural network is used, the structure of which can be optimally adapted to the task at hand.

[0023] According to the invention, the database is automatically enriched with information from the Internet.

[0024] The algorithm regularly searches internet forums for keywords that report spam calls. Suspicious phone numbers are extracted and added to the database. Such extracted phone numbers are then considered "presumed" within the scope of the invention.

[0025] The method can also preferably enable a telephone line owner to identify themselves as a "non-spammer," for example, to the telephone exchange or a government agency, and to prevent a telephone call from the "non-spammer" from being marked as an unsolicited call. This advantageously ensures that, for example, telephone lines assigned to customer service departments are specifically not considered unsolicited calls, even if they would otherwise meet the criteria for marking as spam. For example, a customer service center frequently calls many different numbers, which the algorithm would consider potentially suspicious for other telephone lines that are not explicitly listed as "non-spammers" in the telephone exchange's database.

[0026] In a preferred embodiment, the algorithm can unmark marked telephone numbers according to certain criteria so that the calls are put through again. One possible such criterion is time: If a telephone line is marked as spam once, the corresponding telephone number would be blocked by the telephone exchange essentially forever. After a certain period of time, however, it can happen that the telephone number changes owner and the new owner is not a spammer. Their calls would then still not reach their destination. However, if, for example, the telephone line is unmarked again after a set period of time, at least as a test, this telephone number can be used normally again. This is especially true since it cannot be assumed that a spammer will continue to use a particular line for long after discovering that their telephone line is on a spam list.It might be a good idea to unmark the phone number after a month, for example. If it's still being used as a spam phone number, this isn't a big problem, as the algorithm will add it back to the spam list after a short time and mark it as an unwanted call.

[0027] According to a further aspect of the invention, a system is provided which is suitable for carrying out the method described above.

[0028] In the following, preferred embodiments of the present invention are explained with reference to the accompanying figure: Fig. 1: shows the inventive method for suppressing spam calls.

[0029] Numerous features of the present invention are explained in detail below using preferred embodiments. The present disclosure is not limited to the specifically mentioned feature combinations. Rather, the features mentioned here can be combined in any desired way to form embodiments of the invention, unless expressly excluded below.

[0030] Fig. 1shows a recording of the raw data of the telephone calls 1, which are combined with data from other data sources 2, including from the Internet, to form a raw database 3. The initial focus is therefore on collecting analyzable data, with the raw database 3 containing, among other things, spam identification data. In a next step, a machine learning method (e.g. neural network, decision tree, etc.) is used to obtain a trained database 5 as output. The result of the trained database 5 can be verified in order to estimate the quality of the prediction and to make corrections if necessary. Based on the trained database 5, a self-learning algorithm in a telephone exchange is able to recognize a telephone call as a spam call and initiate suitable technical defense measures.This is achieved by passing the trained database as input to Algorithm 8. This algorithm can then predict the likelihood of spam for an incoming call based on the trained model, virtually in real time. The algorithm can then generate a number blacklist with various levels. Examples of these levels include blocking calls, rerouting to call centers, warnings, and / or requiring the caller to identify themselves as a human.

[0031] By continuously capturing additional raw data from telephone calls 6 and entering it into another or the same raw database 7, the system can be updated during operation and detect new spam calls. The results of the inventive method are applied to the telephony backbone 9 (IMS, TAS, call handling).

[0032] The following section will discuss in more detail the information that can be extracted from the calls and used as spam identification data. This spam identification data is used to enrich the databases, enabling the algorithm to make decisions. A telephone number or a telephone connection calls different target numbers more than n times per day and hangs up within a time t: The higher the number n and the shorter the time t, the higher the probability that the call is a spam call.

[0033] A phone number only calls primary numbers: Since primary numbers are easier to extract automatically than extension numbers, this also indicates an increased likelihood of spam.

[0034] A telephone number is calling from abroad: Here, it is primarily possible to mark calls from certain countries as having an increased probability of being spam.

[0035] The proportion of unique phone numbers among the total number of called numbers can be analyzed. The higher this proportion, the higher the probability of a spam call.

[0036] The length of the calls: The shorter the duration of the calls, the higher the probability of a spam call.

[0037] It is possible to extract the time after which the called party hangs up: the shorter this time is, the higher the probability of a spam call.

[0038] A sharp increase in the number of telephone calls to a telephone number within a certain time interval can also indicate an increased likelihood of spam.

[0039] The daily variance of calls can also provide an indication of spam probability. It is expected that spam calls are more evenly distributed throughout the day than regular calls.

[0040] Other data that can be used as spam identification data includes, for example, the proportion of primary destination numbers in the total number of calls, the proportion of TOP 5 or TOP 10 destination number calls in the total number of calls, the distribution of unsuccessful SIP codes, the use of the voicemail functionality (if the called party did not manually answer the call), the duration of the calls to the voicemail, the delay of the VoIP voice connection between the called party and the caller, a deviation from "User Provided Number to Network Provided Number" (the caller sends a different telephone number), the caller's telephone number is suppressed, the transition point of the voice connection into the provider's network, the number of missed calls to the selected connection and / or the caller is not calling from the national mobile network.

[0041] Depending on your needs, all of this information can be used either individually or in combination to create a database that is as optimally adapted or enriched as possible.

[0042] Verified spam or abuse calls serve as another data source. As mentioned above, this list can be sourced from internet portals dedicated to spam calls, but also from official bodies or network operators' internal databases. Customers participating in the process can also report spam or abuse calls directly via various channels.

[0043] When processing the raw database 3 so that machine learning methods can be applied, it is advantageous for statistical reasons if data sets containing spam calls and those not containing spam calls are distributed approximately equally.

[0044] The method according to the invention is, as already explained above, integrated into the telephony backbone 9, for example, the telephone exchange, of a telephone service provider and can then be used to effectively protect the user from spam calls. For each incoming telephone call, the probability that it is a spam call is then determined. (Quasi) real-time capable big data systems such as Hadoop SPARK are used for this purpose. The incoming telephone calls can then be processed according to a tiered procedure: 1. The phone call is classified as harmless and connected normally. 2. A warning message is played to the called party before or after the call is established. 3. The caller must identify themselves as a human. 4. The call is forwarded to a call center to identify the caller. If the caller is identified as a non-spammer, the call is connected normally. 5. The phone call is blocked or redirected to a spam mailbox.

[0045] Of course, the user or customer is free to participate in the process or can withdraw at any time. If necessary, the customer may be required to pay a corresponding fee. An intelligent voice mailbox can function in a similar way, automatically placing spam calls in a spam folder or deleting them.

[0046] Subscribers have the option of identifying themselves as non-spammers to the telephone service. Furthermore, neural networks or self-learning systems can be trained on identified spammers, and further spammers can then be detected by these systems without the need to develop a model as described above.

[0047] The customer or user receives a list of spam calls at intervals of their choosing and can decide whether the calls were truly spam or not. This result is then incorporated into the models used to calculate spam probability. The customer is provided with an online portal where they can configure the service. The customer can then block phone numbers, unblock blocked phone numbers, change the security level, listen to their spam voicemail, and / or mark calls in the spam voicemail as spam.

[0048] It is understood that the invention is not limited to conventional telephony, but also includes, for example, video telephony, in which spam calls can be detected analogously to the above-described method.

Claims

1. A method for the automated identification and rejection of unwanted telephone calls comprising the following steps: • registering a telephone connection of a caller to a person to be called by a switchboard when a call is made, • starting an algorithm in the switchboard before the call is put through to the person to be called, - wherein the algorithm accesses a database of the switchboard which contains information about telephone connections, in particular spam identification data, - wherein the algorithm uses the information stored in the database to analyse the caller's telephone connection regarding the possibility that it may be an unwanted call, and flags it as an unwanted call if a threshold value is exceeded, • initiating technical countermeasures by the switchboard when the call is an unwanted call, wherein the countermeasures protect the person to be called from the unwanted call, characterized in that the database is automatically augmented with information from the internet, wherein the algorithm regularly searches internet forums for keywords that report on spam calls and extracts suspicious telephone numbers and includes them in the database.

2. The method according to Claim 1, characterized in that a trained database is used as the database, wherein the spam identification data contained therein is information from telephone calls made from telephone connections by callers which can be evaluated with regard to unwanted calls.

3. The method according to one of the preceding claims, characterized in that the trained database is automatically updated in real time.

4. The method according to one of the preceding claims, characterized in that the algorithm that trains the database is based on mathematical models of a decision tree, a forest tree, or a neural network, and is self-learning.

5. The method according to one of the preceding claims, characterized in that an owner of a telephone connection can identify himself as "non-spammer", and that a telephone call from the "non-spammer" is not flagged as an unwanted call.

6. The method according to one of the preceding claims, characterized in that the algorithm removes the flag from telephone numbers flagged as unwanted calls in accordance with certain criteria.

7. A telephone switchboard with a processor unit that is suitable for performing a method according to any one of Claims 1 to 6.