Method and apparatus for preventing voice phishing

Abstract

A method and apparatus for blocking voice phishing are disclosed. The method comprises, as an operation method of a voice phishing blocking apparatus, a step of determining whether voice phishing is suspected based on telephone number information registered in the name of a text message sender; a step of requesting a call connection to the sender's number of the text message before transmitting the text message to the recipient if voice phishing is suspected, a step of determining whether voice phishing is suspected based on the result of analyzing the other party's voice when the call is connected, and a step of discarding the text message if voice phishing is suspected.

Description

Technology Field

[0001] The present invention relates to a method for blocking voice phishing and an apparatus thereof. Background Technology

[0002] Voice phishing refers to a fraudulent scheme in which perpetrators impersonate relevant institutions over the phone to steal personal information or induce money transfers. As voice phishing has become a social issue and is widely known, people are somewhat aware of its dangers; however, as voice phishing methods continue to evolve to become more sophisticated, cases of damage continue to be reported even recently. Consequently, people are increasingly hesitant to answer calls from unknown numbers, and there is a growing trend of people who do not answer calls from contacts not registered in their address books at all.

[0003] Conventional technologies for preventing voice phishing include services that store phone numbers used for voice phishing on telecommunications carrier networks to block calls at the source or notify the receiving terminal; however, there is no way to deal with cases where a call is made using a different caller ID.

[0004] Furthermore, voice phishing has evolved to utilize text messages, leading to a surge in bait messages designed to induce customers to call phone numbers included in the text. Bait messages typically involve notifying recipients of high-value payments and instructing them to call if there are any issues, or providing information about loans and advising them to call to opt out. Currently, there is no way to block the receipt of such bait messages. The problem to be solved

[0005] The problem to be solved is to provide a voice phishing blocking method and device that determines whether predefined voice phishing suspicion conditions are met based on phone numbers registered under the name of a text message sender, and if the voice phishing suspicion conditions are met, automatically calls the text message sender's number to record the voice of the conversation to determine if the content of the conversation is voice phishing, and if it is determined to be voice phishing, discards the text message without delivering it to the recipient and suspends the use of the phone numbers registered under the name of the text message sender. means of solving the problem

[0006] According to one feature, a method of operation of a voice phishing blocking device comprises: a step of determining whether voice phishing is suspected based on phone number information registered under the name of the text message sender; a step of requesting a call connection to the sender's number of the text message before transmitting the text message to the recipient if voice phishing is suspected; a step of determining whether voice phishing is occurring based on the result of analyzing the other party's voice when the call is connected; and a step of discarding the text message if voice phishing is determined.

[0007] The step of determining whether voice phishing is suspected may determine that voice phishing is suspected if it corresponds to at least one of the cases where the number of activated phone numbers satisfies a threshold condition or the call forwarding registration rate of the activated phone numbers satisfies a threshold condition.

[0008] The step of requesting a call connection above may request a call connection to at least one of the opened phone number or the phone number to which the call is forwarded from the opened phone number.

[0009] After the step of determining whether voice phishing has occurred, if it is determined to be voice phishing, the method may further include a step of suspending the use of phone numbers registered under the name of the text message sender.

[0010] The step of determining whether there is suspicion of voice phishing can be performed when the text message sender is a subscriber to a multi-number service.

[0011] The step of determining whether voice phishing is suspected can determine whether voice phishing is suspected by adding the call rejection phone number included in the text message and the phone number of the registered owner of the call rejection phone number.

[0012] According to another feature, the voice phishing blocking device includes a voice phishing suspicion determination unit that extracts text data from traffic collected from a mobile communication system and determines the text as a suspected voice phishing text if the number of phone numbers registered under the name of the text sender identified from the extracted text data or the call forwarding rate of the said registered phone numbers satisfies a threshold condition, and a voice phishing action unit that discards the text without transmitting it to the recipient if it is determined to be a suspected voice phishing text.

[0013] The above voice phishing blocking device further includes a voice phishing confirmation determination unit that, when a call is connected by making a call to the activated phone number determined to be a voice phishing suspected text, converts the call content into text in real time and analyzes the converted content, and determines the voice phishing suspected text as a confirmed voice phishing text based on the analysis, and the voice phishing action unit may discard the text without transmitting it to the recipient if it is determined to be a confirmed voice phishing text.

[0014] The voice phishing countermeasure unit may, upon determining that the text message is confirmed to be voice phishing, suspend the use of at least one of the following: phone numbers opened under the name of the sender of the text message, call forwarding numbers of the opened phone numbers, phone numbers opened under the name of another subscriber related to the call forwarding numbers, and multi-number service subscribed phone numbers under the name of the sender of the text message or the name of the other subscriber.

[0015] The voice phishing blocking device may further include a voice phishing phone number configuration unit that, when the voice phishing suspicion determination unit requests a phone connection to the activated phone number, extracts a call forwarding phone number of the activated phone number from a signal message regarding the request for the phone connection from a mobile communication system, and generates and stores relationship information between the activated phone number and the extracted call forwarding phone number. Effects of the invention

[0016] According to an embodiment, voice phishing can be effectively blocked by discarding voice phishing text messages before sending them to the sender and suspending the use of phone numbers registered under the sender's name. Brief explanation of the drawing

[0017] Figure 1 shows the configuration of a voice phishing blocking system according to an embodiment. FIG. 2 is a block diagram showing the internal configuration of a voice phishing blocking device according to an embodiment. FIG. 3 is a flowchart illustrating a voice phishing blocking method according to one embodiment. Figure 4 is an example diagram of the configuration of a bait character according to an embodiment. FIG. 5 is a flowchart illustrating a voice phishing blocking method according to another embodiment. FIG. 6 is a flowchart illustrating a voice phishing blocking method according to another embodiment. Specific details for implementing the invention

[0018] Embodiments of the present invention are described below with reference to the attached drawings so that those skilled in the art can easily implement them. However, the present invention may be embodied in various different forms and is not limited to the embodiments described herein. Furthermore, in order to clearly explain the present invention in the drawings, parts unrelated to the explanation have been omitted, and similar parts throughout the specification are denoted by similar reference numerals.

[0019] Throughout the specification, when a part is described as "including" a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components.

[0020] Additionally, terms such as “…part,” “…unit,” and “…module” described in the specification refer to a unit that processes at least one function or operation, and this may be implemented in hardware, software, or a combination of hardware and software.

[0021] The devices described in the present invention are composed of hardware including at least one processor, a memory device, a communication device, etc., and a program that is executed in combination with the hardware is stored in a designated location. The hardware has a configuration and performance capable of executing the method of the present invention. The program includes instructions that implement the method of operation of the present invention described with reference to the drawings, and executes the present invention in combination with hardware such as a processor and a memory device.

[0022] In this specification, "transmission or provision" may include not only direct transmission or provision but also indirect transmission or provision through another device or by using an alternative route.

[0023] Expressions described in the singular in this specification may be interpreted as singular or plural unless explicit expressions such as "one" or "single" are used.

[0024] In this specification, the same reference numeral refers to the same component regardless of the drawing, and "and / or" includes each of the mentioned components and all combinations of one or more.

[0025] In this specification, terms including ordinal numbers, such as first, second, etc., may be used to describe various components, but said components are not limited by said terms. Such terms are used solely for the purpose of distinguishing one component from another. For example, without departing from the scope of the present disclosure, the first component may be named the second component, and similarly, the second component may be named the first component.

[0026] In the flowchart described with reference to the drawings in this specification, the order of operations may be changed, several operations may be merged or some operations may be divided, and certain operations may not be performed.

[0027] In the specification, the terminal (Terminal / User equipment) connects to a base station of the access network / radio access network (RAN) and utilizes the network functions (NFs) of the core network. Here, the base station may include eNBs, gNBs, APs, etc., depending on the access network. The terminal may be a terminal of various forms and uses, such as a mobile terminal, an IoT terminal, a vehicle terminal, a display terminal, a broadcast terminal, a game terminal, etc. The devices constituting the network may be implemented in hardware, software, or a combination of hardware and software.

[0028] Embodiments of the present invention may be supported by standard documents related to at least one of the 3GPP (3rd Generation Partnership Project) 5G systems, such as 3GPP LTE (Long Term Evolution), LTE-A, 3GPP2, IEEE (Institute of Electrical and Electronics Engineers) systems, and FS_NextGen (Study on Architecture for Next Generation System). That is, steps or parts among the embodiments of the present invention that are not described in order to clearly reveal the technical concept of the present invention may be supported by said documents. Furthermore, all terms disclosed in this document may be explained by said standard documents.

[0030] FIG. 1 illustrates a network configuration for blocking voice phishing according to an embodiment.

[0031] Referring to FIG. 1, the voice phishing blocking device (100) operates in conjunction with a data collection device (200), a traffic collection device (300), and a mobile communication system (400).

[0032] Here, the mobile communication system (400) may include an LTE (Long-Term Evolution) system and an IMS (Internet Protocol Multimedia Subsystem) system. The LTE system may include an eNodeB (401), a message center (402), a Mobility Management Entity (MME) (403), a Home Subscriber Server (HSS) (404), a Serving Gateway (S-GW) (405), a Packet Gateway (P-GW) (406), and a Packet Data Network (PDN) (407). At this time, the LTE system is described as an example, but it may also be a 5G system. The IMS system may include a Call State Control Function (CSCF) / Session Border Controller (SBC) / Breakout Gateway Control Function (BGCF) (408) and a Telephony Application Server (TAS).

[0033] The voice phishing blocking device (100) can collect traffic collected by the traffic collection device (300) and internal data of the communication operator, external report data, etc. through the data collection device (200).

[0034] The data collection device (200) extracts phone numbers from external reporting data, such as the National Police Agency, and extracts terminal information and text / phone call history of the reported phone numbers by comparing them with phone numbers stored in the traffic collection device (300).

[0035] The traffic collection device (300) collects text and telephone call signal messages (packets, etc.) of a communication network and stores terminal information, such as IMEI (International Mobile Equipment Identity), IMSI (International Mobile Subscriber Identity), MSISDN (Mobile Station Integrated System Digital Network), phone number, etc., and call history.

[0036] The voice phishing blocking device (100) extracts text data from traffic collected from the data collection device (200) and identifies the subscriber of the text message sender number identified from the text data, i.e., the text message sender. The voice phishing blocking device (100) determines whether voice phishing is suspected based on phone number information registered under the name of the text message sender.

[0037] When the voice phishing blocking device (100) determines that the text message is suspected of being a voice phishing message, it determines that the message is a bait message intended to deceive the customer and requests an automatic call connection to the sender's number of the message before sending the bait message to the recipient. At this time, the phone numbers subject to the automatic call connection request may include not only the sender's number of the message but also call forwarding numbers and phone numbers included in the message.

[0038] When a call is connected, the voice phishing blocking device (100) determines whether it is voice phishing based on the result of analyzing the other party's voice.

[0039] If the voice phishing blocking device (100) determines that it is voice phishing, it discards the bait text message without sending it to the recipient.

[0040] Additionally, the voice phishing blocking device (100) suspends the use of phone numbers opened under the name of the sender of the bait text message and associated phone numbers related to these phone numbers.

[0041] The voice phishing blocking device (100) can request the suspension of phone number usage through the subscriber device HSS (404), the call processing device CSCF / SBC / BGCF (408), TAS (409), and the customer information management system (600).

[0043] FIG. 2 is a block diagram showing the internal configuration of a voice phishing blocking device according to an embodiment.

[0044] Referring to FIG. 2, the voice phishing blocking device (100) described in FIG. 1 is shown in a block diagram in terms of functional units, and the voice phishing blocking device (100) may include a voice phishing suspicion determination unit (110), a voice phishing confirmation determination unit (120), a voice phishing action unit (130), and a voice phishing phone number configuration unit (140).

[0045] The voice phishing suspicion determination unit (110) extracts text data from collected traffic and identifies the text sender confirmed from the text data. The voice phishing suspicion determination unit (110) determines whether voice phishing is suspected based on phone number information registered under the name of the text sender.

[0046] According to one embodiment, the voice phishing suspicion determination unit (110) can determine that voice phishing is suspected if at least one of the cases is met, such as when the number of phone numbers opened in the name of the text message sender satisfies a threshold condition or when the call forwarding registration rate of phone numbers opened in the name of the text message sender satisfies a threshold condition.

[0047] According to another embodiment, the voice phishing suspicion determination unit (110) may determine that voice phishing is suspected when, for a multi-number service subscriber, at least one of the cases is met, such that the number of phone numbers opened in the subscriber's name meets a threshold condition or the call forwarding registration rate of phone numbers opened in the text message sender's name meets a threshold condition.

[0048] According to another embodiment, the voice phishing suspicion determination unit (110) can determine that voice phishing is suspected if at least one of the cases is met, such that the number of phone numbers of the registered owner of the rejected phone number included in the text message satisfies a threshold condition or the call forwarding registration rate of the phone number registered under the name of the text message sender satisfies a threshold condition.

[0049] When the voice phishing confirmation judgment unit (120) determines that the text message is suspected of being a voice phishing message, it determines that the message is a bait message intended to deceive the customer and requests a call connection to the sender's number of the message before sending the bait message to the recipient.

[0050] The voice phishing confirmation unit (120) determines whether voice phishing is suspected based on the results of analyzing the other party's voice when a call is connected. If the voice phishing confirmation unit (120) determines that voice phishing is suspected, it requests a call connection to the sender's number of the text message before sending the text message to the recipient. The voice phishing confirmation unit (120) may include a call bot module that makes an automatic phone call.

[0051] The voice phishing confirmation determination unit (120) determines whether voice phishing is occurring based on the results of analyzing the other party's voice when a call is connected. The voice phishing confirmation determination unit (120) can convert the other party's voice into STT (Speech-to-Text) and analyze the converted call text to determine whether voice phishing is occurring.

[0052] According to one embodiment, the voice phishing confirmation determination unit (120) can determine that it is voice phishing if it satisfies the threshold condition of the frequency of occurrence of blacklist keywords extracted from the converted call text.

[0053] According to another embodiment, the voice phishing confirmation determination unit (120) classifies the risk level and industry from the converted call text and extracts the name information and registered industry information, and can determine it as voice phishing if the call content is in a high-risk industry under an individual's name or in a corporate / business name and is different from the registered industry. Here, the name information and registered industry information are registered in the customer information management system (600) along with the phone number when the phone number is activated.

[0054] The voice phishing action unit (130) discards the bait text message without sending it to the recipient when the voice phishing confirmation judgment unit (120) determines that it is voice phishing. Additionally, the voice phishing action unit (130) suspends the use of phone numbers opened under the name of the sender of the bait text message and related phone numbers associated with these phone numbers. For example, the voice phishing action unit (130) can suspend the use of phone numbers opened under the name of the text message sender, call forwarding phone numbers, phone numbers registered with the same call forwarding phone number, and all other multi-number service subscribed phone numbers of the owner of each phone number.

[0055] The voice phishing phone number configuration unit (140) can configure the voice phishing phone number based on the sender number of the bait text message, phone numbers registered under the name of the sender number of the bait text message, and phone numbers associated with the phone numbers registered under the name of the sender number of the bait text message.

[0056] Additionally, the voice phishing phone number configuration unit (140) can obtain a forwarding number from a network signal message regarding a call connection request message transmitted by the voice phishing confirmation determination unit (120) and add it to the voice phishing phone number. Here, the network signal message can be received from the CSCF (408).

[0058] FIG. 3 is a flowchart illustrating a voice phishing blocking method according to one embodiment, and FIG. 4 is an example diagram of the configuration of a bait text message according to an embodiment.

[0059] At this time, the descriptions of Figs. 3 and 4 will be explained in conjunction with the configuration of Fig. 2.

[0060] Referring to FIG. 3, the voice phishing suspicion determination unit (110) extracts text data from traffic collected from the mobile communication system (400) (S101).

[0061] The voice phishing suspicion judgment unit (110) extracts the sender number, text content, and phone number to refuse reception from the extracted text (S102).

[0062] Referring to FIG. 4, the voice phishing suspicion determination unit (110) can extract the sender number (601) of the text message (600), the content of the text message (602), and the free refusal phone number (603) included in the text message from the text message (600).

[0063] The voice phishing suspicion judgment unit (110) checks the phone numbers registered under the caller ID (S103).

[0064] The voice phishing suspicion judgment unit (110) can determine whether the number of phone numbers opened with the caller ID exceeds a threshold number condition, for example, a threshold number, or whether the call forwarding registration rate of phone numbers opened with the caller ID exceeds a threshold rate condition, for example, a threshold rate (S104).

[0065] If the voice phishing suspicion determination unit (110) does not satisfy the threshold number condition or threshold rate condition in S104, it considers the corresponding character as a normal character and terminates the step.

[0066] However, if the threshold number condition or threshold rate condition is satisfied in S104, the voice phishing suspicion determination unit (110) determines the text as a bait text and determines the text sender number as a voice phishing suspected phone number (S105).

[0067] The voice phishing confirmation unit (120) automatically calls the suspected voice phishing phone number or the forwarding number of the suspected voice phishing phone number (S106).

[0068] When a call is connected, the voice phishing confirmation unit (120) performs STT conversion while recording the voice of the call (S107).

[0069] The voice phishing confirmation unit (120) extracts blacklisted keywords from the call text (S108).

[0070] The voice phishing confirmation unit (120) determines whether the frequency of occurrence of blacklist keywords satisfies a threshold condition (S109).

[0071] The voice phishing confirmation unit (120) terminates the step if the frequency of blacklist keyword appearance does not satisfy the threshold condition.

[0072] The voice phishing confirmation unit (120) can store the text message sender number, the call forwarding number for the text message sender number, and the call rejection number in a spam DB when the frequency of blacklist keyword appearance satisfies a threshold condition (S110).

[0073] The voice phishing action unit (130) performs a suspension of use for all phone numbers registered under the caller ID and the phone numbers associated therewith (S111). In S111, the voice phishing action unit (130) can transmit a request for suspension of use to the customer information management system (600).

[0074] The voice phishing countermeasure unit (130) does not send a text message to the recipient and discards it (S112).

[0076] FIG. 5 is a flowchart illustrating a voice phishing blocking method according to another embodiment.

[0077] At this time, the explanation of Fig. 5 will be explained in conjunction with the configuration of Fig. 2.

[0078] The steps of FIG. 5 may be added after S107 in FIG. 3 as another embodiment of S108 to S109 in FIG. 3.

[0079] Referring to FIG. 5, the voice phishing confirmation unit (120) classifies the risk level and industry from the call text (S201). According to one embodiment, the risk level and industry can be classified using deep learning technology. For example, a model for classifying the risk level and industry can be trained based on the occurrence of specific keywords, frequency of occurrence, etc., and the risk level and industry can be classified using the trained model. According to another embodiment, the risk level and industry can be classified using a rule base. The rule base can be defined to classify the risk level and industry based on the existence of predefined keywords, frequency of occurrence, etc.

[0080] The voice phishing confirmation unit (120) extracts the name information and registered business information of the caller ID holder (S202). In S202, the name information and registered business information can be extracted from the customer information management system (600).

[0081] The voice phishing confirmation judgment unit (120) determines whether the call text content is different from the registered business category under the name of an individual or business owner (S203).

[0082] The voice phishing confirmation unit (120) terminates the step in S203 if it is not a risk industry or if the call text content is identical to the registered industry.

[0083] The voice phishing confirmation unit (120) can store the text message sender number, the call forwarding number for the text message sender number, and the call rejection number in the spam DB if, in S203, the industry is a risk industry or the call text content is different from the registered industry (S204).

[0084] The voice phishing countermeasure unit (130) performs suspension of use for all phone numbers registered under the caller ID number and the phone numbers associated therewith (S205).

[0085] The voice phishing countermeasure unit (130) does not send a text message to the recipient and discards it (S206).

[0087] FIG. 6 is a flowchart illustrating a voice phishing blocking method according to another embodiment.

[0088] At this time, the explanation of Fig. 6 will be explained in conjunction with the configuration of Fig. 2.

[0089] In addition, the steps of Fig. 6 may be steps added after S106 of Fig. 3.

[0090] Referring to FIG. 6, when the voice phishing confirmation unit (120) automatically calls a suspected voice phishing phone number (S301), the voice phishing phone number configuration unit (140) extracts a forwarding number from a signal message for call connection (S302). In S302, the signal message for call connection can be received from the CSCF (408).

[0091] The voice phishing phone number configuration unit (140) can configure relationship information between the extracted call forwarding number and the voice phishing suspected phone number (S303). Therefore, voice phishing can be blocked even if the call forwarding number is a phone number subscribed to a different telecommunications carrier than the voice phishing suspected phone number.

[0093] The embodiments of the present invention described above are not implemented only through devices and methods, but may also be implemented through a program that realizes a function corresponding to the configuration of the embodiments of the present invention or a recording medium on which such program is recorded.

[0094] Although embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements by those skilled in the art using the basic concept of the present invention as defined in the following claims also fall within the scope of the present invention.

Claims

Claim 1 A method of operation for a voice phishing blocking device comprising: a step of determining whether voice phishing is suspected based on phone number information registered under the name of the text message sender; a step of, if voice phishing is suspected, requesting a call connection to the sender's number of the text message by linking with a call processing device of a mobile communication network before transmitting the text message to the recipient; a step of determining whether voice phishing is suspected based on the result of analyzing the other party's voice when the call is connected; and a step of discarding the text message if voice phishing is suspected. Claim 2 A method of operation according to claim 1, wherein the step of determining whether voice phishing is suspected is determined to be suspected if at least one of the cases where the number of activated phone numbers satisfies a threshold condition or the call forwarding registration rate of the activated phone numbers satisfies a threshold condition. Claim 3 In paragraph 2, the step of requesting a call connection is a method of operation in which a call connection is requested to at least one of the opened phone number or the phone number to which the call is forwarded from the opened phone number. Claim 4 A method of operation according to claim 1, further comprising, after the step of determining whether voice phishing is present, a step of suspending the use of phone numbers opened in the name of the text message sender if it is determined to be voice phishing. Claim 5 In claim 1, the step of determining whether voice phishing is suspected is performed when the text message sender is a subscriber to a multi-number service. Claim 6 In claim 1, the step of determining whether voice phishing is suspected is a method of operation in which the phone number of the caller who opened the caller ID is added to the phone number of the caller who opened the caller ID to determine whether voice phishing is suspected. Claim 7 A voice phishing blocking device comprising: a voice phishing suspicion determination unit that extracts text data from traffic collected from a mobile communication system and determines that the text is a suspected voice phishing text if the number of phone numbers registered under the name of the text sender confirmed from the extracted text data or the call forwarding rate of the registered phone numbers satisfies a threshold condition; a voice phishing confirmation determination unit that, if determined to be suspected of voice phishing, requests a call connection to the sender number of the suspected voice phishing text in conjunction with a call processing unit of the mobile communication system before transmitting the suspected voice phishing text to a recipient, and if the call is connected, determines that the suspected voice phishing text is a confirmed voice phishing text based on the result of analyzing the other party's voice; and a voice phishing action unit that discards the text without transmitting it to the recipient if it is determined to be the suspected voice phishing text or the confirmed voice phishing text. Claim 8 In claim 7, the voice phishing confirmation determination unit analyzes the converted content while converting the content of the call into text in real time, and determines the suspected voice phishing text as a confirmed voice phishing text based on the analysis, a voice phishing blocking device. Claim 9 In paragraph 8, the voice phishing blocking device, wherein the voice phishing countermeasure unit suspends the use of at least one of the following when the voice phishing confirmed text message is determined to be a voice phishing text message: phone numbers opened in the name of the sender of the text message, call forwarding numbers of the opened phone numbers, phone numbers opened in the name of another subscriber related to the call forwarding numbers, and multi-number service subscribed phone numbers in the name of the sender of the text message or the name of the other subscriber. Claim 10 A voice phishing blocking device according to claim 8, further comprising a voice phishing phone number configuration unit that, when the voice phishing suspicion determination unit requests a phone connection to the activated phone number, extracts a call forwarding phone number of the activated phone number from a signal message regarding the request for the phone connection from a mobile communication system, and generates and stores relationship information between the activated phone number and the extracted call forwarding phone number.

Images