Electronic device capable of preventing voice phishing

Abstract

An electronic device according to an embodiment disclosed in the present document may include: a communication module; a memory for storing reference terms related to voice phishing; and a processor functionally connected to the communication module and the memory, wherein the processor: when one call is connected through the communication module, classifies the one call as a suspected voice phishing call on the basis of the similarity between first terms used in the one call and the reference terms; and when the one call is classified as the suspected voice phishing call, further on the basis of the similarity between the reference terms and a second term included in another call connected through the communication module within a designated time from an end time point of the one call, identifies whether the one call and the other call are voice phishing calls.

Description

Electronic devices capable of preventing voice phishing

[0001] The various embodiments disclosed in this document relate to voice phishing prevention technology.

[0002] Voice phishing is a fraudulent practice where the caller provides false information to the recipient via phone or text message, leading the recipient to believe the false information and act in accordance with the caller's wishes. In the past, the caller would pretend to have kidnapped a family member to force them to comply with the caller's demands. However, more recently, voice phishing has been increasingly used to impersonate government agencies or family members or colleagues. Recently, the amount of damage has increased significantly due to its widespread use in financial fraud.

[0003] The most damaging form of voice phishing involves impersonating investigators or investigators. Callers impersonate investigative agencies (such as the police, prosecutors, or the Financial Supervisory Service) and demand remittances under the pretext of tax refunds, delinquent credit card payments, or summonses, or collects the recipient's personal or financial information.

[0004] Recently, various methods have been introduced to prevent voice phishing damage, such as notifying on mobile phones whether the sender's number is on a suspicious list, restricting withdrawals from accounts for a certain period of time after a transfer, or displaying a text explaining the voice phishing situation during the transfer process.

[0005] However, since fraudsters frequently change phone numbers using falsification devices, caller ID-based voice phishing detection may be largely ineffective. For example, restricting withdrawals for a certain period of time after a transfer or providing explanations of the voice phishing situation are limited in preventing voice phishing damage. Furthermore, when fraudsters elaborately create phishing scenarios and multiple people share roles while making calls, it can be difficult to determine whether a call is actually a voice phishing attack. The various embodiments disclosed in this document can provide an electronic device capable of preventing voice phishing based on voice analysis of calls.

[0006] An electronic device according to an embodiment disclosed in the present document comprises: a communication module; a memory storing reference terms related to voice phishing; and a processor functionally connected to the communication module and the memory, wherein the processor, when a call is connected through the communication module, classifies the call as a suspected voice phishing call based on a similarity between first terms used in the call and the reference terms, and when the call is classified as a suspected voice phishing call, determines whether the call and the other call are voice phishing calls based further on a similarity between second terms included in another call connected through the communication module within a specified time from the end of the call and the reference terms.

[0007] In addition, an electronic device according to an embodiment disclosed in the present document includes: a communication module; a memory storing reference terms related to voice phishing and voice related to contact information; and a processor functionally connected to the memory, wherein the processor, when a call is connected through the communication module, verifies a first similarity between terms used in the connected call and the reference terms, and when the calling number of the connected call is in the contact information, verifies a second similarity between the voice of the connected call and the voice related to the calling number in the contact information, and determines whether the connected call is a voice phishing call based on the first similarity and the second similarity.

[0008] According to the various embodiments disclosed in this document, voice phishing can be prevented based on voice analysis or voice feature analysis of connected calls. Furthermore, various benefits can be provided, directly or indirectly, through this document.

[0009] Figure 1 illustrates an implementation environment of an electronic device with a voice phishing blocking function added according to one embodiment.

[0010] Figure 2 shows a schematic diagram of an electronic device according to one embodiment.

[0011] Figure 3 shows a flowchart of a voice phishing detection method according to one embodiment.

[0012] In connection with the description of the drawings, the same or similar reference numerals may be used for identical or similar components.

[0013] Figure 1 illustrates an implementation environment of an electronic device with a voice phishing blocking function added according to one embodiment.

[0014] Referring to FIG. 1, an electronic device (120) according to one embodiment may be a computing terminal having a first app installed that can perform a voice phishing blocking function. The first app may include a telecommunications company-provided app, a social network app, or a dedicated app. The electronic device (120) may include a user terminal that provides voice call and text service functions, such as a mobile terminal, a smartphone, or a smart pad. The verification terminal (130) is a computing terminal that performs a three-way call with the electronic device (120) through the first app and can monitor voice phishing (suspected) calls. The other user terminal (110) may be a telephone terminal used by another user who makes a call with the electronic device (120).

[0015] An electronic device (120) according to one embodiment can determine whether a connected call is voice phishing based on at least one of the similarity between a term used in at least one call and a reference term and the similarity between a call voice and a pre-registered voice.

[0016] < Multi-Currency-Based Voice Phishing Detection - Example 1 >

[0017] According to one embodiment, when connected to a call, the electronic device (120) may classify the call as a suspected voice phishing call based on the similarity between the first terms used in the call and the reference terms. For example, if the similarity between the first terms and the reference terms meets a first criterion, the electronic device (120) may classify the call as a suspected voice phishing call.

[0018] According to one embodiment, when the electronic device (120) classifies a call as a suspected voice phishing call, it can further determine whether the call and the other call are voice phishing calls based on the similarity between the second term included in another call connected within a specified time from the end of the call and the reference terms. For example, the electronic device (120) can synthesize terms belonging to the reference terms among the first terms and the second terms. If the synthesized terms meet the second reference value, the electronic device (120) can determine the call and the other call as voice phishing calls. For another example, if a common term in the first terms and the second terms belongs to the reference terms, the electronic device (120) can determine the call and the other call as voice phishing calls.

[0019] Voice Phishing Detection Based on Registered Voice - Example 2

[0020] In one embodiment, the electronic device (120) can detect voice phishing in a call based on the terminology used in the call with other users and the voice of the other users.

[0021] According to one embodiment, when a call is connected, the electronic device (120) can determine whether the connected call is a suspected voice phishing call based on a first similarity between terms used in the call and the reference terms. If the caller ID of the call is in the contact information, the electronic device (120) can determine a second similarity between the voice of the call and the voice associated with the caller ID. The electronic device (120) can determine whether the call is a voice phishing call based on the first similarity and the second similarity. For example, if the similarity between the terms and the reference terms meets a first criterion, the electronic device (120) can classify the call as a suspected voice phishing call and determine a second similarity between the voice of the call and the voice associated with the caller ID. If the second similarity between the voice of the call and the voice is less than a specified threshold similarity, the electronic device (120) can classify the call as a voice phishing call. Alternatively, the electronic device (120) may use the first and second similarities together to determine whether a call is a voice phishing call.

[0022] According to one embodiment, if the electronic device (120) determines that a connected call in the first or second embodiment is a voice phishing call, it may send a confirmation text to the calling number of the connected call to inquire whether the caller is currently on the phone. If there is no response to the confirmation text from the other user within a specified time period, the electronic device (120) may block the connected call. Additionally or alternatively, the electronic device (120) may perform at least one of the following actions: terminating the call, adding the phone number of the connected call to a call blocking list, saving a recording of the call, or connecting a three-way call.

[0023] In this way, the electronic device (120) according to one embodiment can determine whether a call is voice phishing based on call terms and / or call voice, and if it is determined to be a voice phishing call, it can prevent damage caused by voice phishing through various means (e.g., three-way call, saving recording, terminating call, blocking subsequent calls).

[0024] Figure 2 shows a schematic diagram of an electronic device according to one embodiment.

[0025] Referring to FIG. 2, an electronic device (120) according to one embodiment may include an input device (121), an output device (123), a communication module (125), a memory (127), and a processor (129). In one embodiment, the electronic device (120) may omit some components or may further include additional components. In addition, some of the components of the electronic device (120) may be combined to form a single entity, but may perform the same functions of the corresponding components prior to combination.

[0026] The input device (121) can receive user input (e.g., voice call) using the electronic device (120). The input device (121) can include, for example, an input detection circuit of at least one of a button, a touch screen, and a microphone.

[0027] The output device (123) can output at least one data of symbols, numbers, or characters visually, audibly, or tactilely under the control of the processor (129). The output device (123) may include, for example, at least one output device of a liquid crystal display, an OLED, a touchscreen display, a vibration motor, or a speaker.

[0028] The communication module (125) can support the establishment of a communication channel or a wireless communication channel between the electronic device (120) and another device (e.g., the verification terminal (130)), and the performance of communication through the established communication channel. The communication channel can include, for example, at least one communication channel among LAN, FTTH, xDSL, Wibro, Wireless LAN, Wi-Fi, Bluetooth, Zigbee, Wi-Fi Direct (WFD), Ultrawideband (UWB), Infrared Data Association (IrDA), Bluetooth Low Energy (BLE), Near Field Communication (NFC), 3G, 4G, or 5G. The communication module (125) can communicate through known communication methods such as CDMA, GSM, W-CDMA, TD-SCDMA, WiBro, LTE, and EPC. In one embodiment, the communication module (125) can support multi-communication through a plurality of communication channels. For example, the communication module (125) may be configured to simultaneously establish a communication channel through a telecommunications company network (e.g., SKT) and a Wi-Fi network.

[0029] The memory (127) may include various forms of volatile memory or non-volatile memory. For example, the memory (127) may include read-only memory (ROM) and random access memory (RAM). In one embodiment, the memory (127) may be located inside or outside the processor, and the memory (127) may be connected to the processor (129) via various known means.

[0030] The memory (127) can store various data used by at least one component (e.g., the processor (129)) of the electronic device (120). The data can include, for example, input data or output data for software and commands related thereto. For example, the memory (127) can store at least one instruction for providing a voice phishing blocking function through a first app. The memory (127) can store a reference term, a first reference value, and a second reference value. The first app can include an app provided by a telecommunications company, a social network app, or a dedicated app.

[0031] In one embodiment, the reference terms may include pressure terms related to investigations and threats, financial terms related to financial transactions, instruction terms related to action instructions, and computer terms related to installing smishing apps. In one embodiment, the pressure terms may include, for example, terms referring to institutions, terms referring to investigators, words, terms, phrases, and similar words included in investigation-related terms and intimidation terms. The agency-related terms may include, for example, courts, police, prosecutors, Financial Supervisory Service, and National Intelligence Service. The investigation-related terms may include, for example, prosecutors, investigators, investigators, lawyers, supervisors, perpetrators, victims, suspects, and accomplices. The investigation-related terms may include, for example, words, phrases, or phrases that are the same as or similar to at least one of investigation, evidence, cooperation, non-cooperation, investigation, crime, fraud, embezzlement, arrest, detention, warrant, funds, laundering, examination, principal, dummy account, civil law, criminal law, personal information, account tracking, freeze, suspect, compensation, name, theft, and proof. The above threatening terms may include kidnapping, murder, and family names (e.g., son, daughter, mother, father, brother, sister). In one embodiment, the financial terms may include words, phrases, or phrases that are the same as or similar to bank, savings, cash, money, check, deposit, stock, account, receipt / disbursement, passbook, password, full amount, authentication, OTP, withdrawal, deposit, savings, installment savings, stop, credit, and loan. In one embodiment, the directive terms may include words, phrases, or phrases that direct actions such as transfer, storage, delivery, leak, instruction, disclosure, and cooperation. For example, the directive term "delivery" may be modified to "please pass it on" and "please pass it on." Accordingly, the reference terms may be designed to include each reference term as well as words, phrases, and phrases that have the same or similar meaning as each reference term.The above computer term may include words, sentences or phrases having the same or similar meaning as at least one of, for example, app installation, download, and security.

[0032] According to one embodiment, the memory (127) may store at least one of instructions related to the execution of the first app and the AI ​​unit (129A), a prompt sequence to be input to the AI ​​unit (129A), contact information, or voice information (e.g., voice characteristics) related to the contact information. The AI ​​unit (129A) may be a software module or hardware module included in the processor (129), or at least a portion of which is included in the verification terminal (130). When the AI ​​unit (129A) is included in the verification terminal (130), the processor (129) may communicate with the AI ​​unit (129A) via the communication module (125). The voice information related to the contact information may include, for example, voice characteristic information of the owner of each contact.

[0033] Additionally, the AI ​​unit (129A) can perform tasks related to voice phishing verification using a cloud AI (e.g., ChatGPT, Bard) connected to a communication network. To this end, the AI ​​unit can be implemented by including an API (Application Program Interface) connected to the cloud AI, an AI adapter combined with the cloud AI, or an AI assistant function.

[0034] In one embodiment, the prompt sequence may be a meaningful (based on specified rules) arrangement of prompts input to the AI ​​unit (129A), for example, for requesting analysis of call history. The prompt sequence may include, for example, a first prompt that educates the AI ​​unit (129A) on a list of reference terms, a second prompt that provides the AI ​​unit (129A) with call content, and a third prompt that guides the AI ​​unit (129A) on call history-based analysis criteria. The specified rules may be determined by voice phishing detection based on the call history.

[0035] The processor (129) can control at least one other component (e.g., hardware or software component) of the electronic device (120) and perform various data processing or calculations. The processor (129) can include, for example, at least one of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor, an application processor, an application specific integrated circuit (ASIC), or a field programmable gate array (FPGA), and can have multiple cores. According to one embodiment, the processor (129) can detect voice phishing based on the similarity between a call term or a call voice and a registered voice through the first app.

[0036] <Multiple-Call-Based Voice Phishing Detection - Example 1>

[0037] According to one embodiment, when a call is connected via the communication module (125), the processor (129) may classify the call as a suspected voice phishing call based on the similarity between the first terms used in the call and the reference terms. For example, the processor (129) may classify the call as a suspected voice phishing call if the similarity between the first terms and the reference terms meets a first criterion. The first and second criterion may be determined based on the analysis results of the voice phishing call.

[0038] According to one embodiment, when the processor (129) classifies a call as a suspected voice phishing call, it can further determine whether the call and the other call are voice phishing calls based on the similarity between the second term included in another call connected through the communication module (125) within a specified time from the end of the call and the reference terms. For example, the processor (129) may synthesize terms belonging to the reference terms among the first terms and the second terms, and if the synthesized terms meet the second reference value, determine the call and the other call as voice phishing calls. For another example, the processor (129) may determine the call and the other call as voice phishing calls if at least one common term among the first terms and the second terms belongs to the reference terms. The prompt sequence may include a word, phrase, or sentence that is input to the AI ​​unit (129A) to classify the suspected voice phishing call or the voice phishing call.

[0039] According to one embodiment, the processor (129) may use the AI ​​unit (129A) to determine the similarity between at least one of the first term and the second term and the reference term. In this regard, the processor (129) may obtain a prompt sequence from the memory (127), generate at least one term-based query according to the obtained sequence, input (or transmit) the query to the AI ​​unit (129A), and determine one call and the other call as a general call, a suspected voice phishing call, or a voice phishing call based on the response of the AI ​​unit (129A).

[0040] In one embodiment, the prompt sequence may be a meaningful arrangement of prompts input to the AI ​​unit (129A), for example, to request analysis of call history. The prompt sequence may include, for example, prompts that educate the AI ​​unit (129A) on a list of reference terms, prompts that provide the AI ​​unit (129A) with call content, and prompts that guide call history-based analysis criteria.

[0041] The processor (129) (or the first app) can train the AI ​​unit (129A) to identify reference terms by inputting prompts #1 to 4 to the AI ​​unit (129A).

[0042] Prompt #1: The following are terms used to pressure people. Similar words should be classified as pressure terms. Financial Supervisory Service, prosecutors, investigators...

[0043] Prompt #2: The following are financial terms. Similar words should be categorized as financial terms. Bank, account, passbook, transfer...

[0044] Prompt #3: The following are terms that direct or control. Similar words should be classified as controlled terms: convey, transfer, withdraw, keep, hand over, give...

[0045] Prompt #4: Voice phishing calls often use these terms. Now, analyze the call history.

[0046] The processor (129) can use the AI ​​unit (129A) to check whether the first or second criterion is met through prompts #5 to 6.

[0047] Prompt #5: The difference is the call history. Call history----

[0048] Prompt #6: Tell me how often you use the terms pressure, financial, and control.

[0049] The processor (129) can obtain the number of times pressure terms, financial terms, and control terms are used from the AI ​​unit (129A), and based on the obtained number of times, can determine whether the connected call is voice phishing.

[0050] Alternatively, the processor (129) may pre-train the AI ​​unit (129A) with the first and second criteria, or classify voice phishing or suspected voice phishing calls based on the judgment of the AI ​​unit (129A). For example, the processor (129) may identify voice phishing calls among connected calls by inputting prompts #7 to #8 instead of prompts #5 to #6.

[0051] Prompt #7: Here's the call log. Call log ---

[0052] Prompt #8: Is this a voice phishing call?

[0053] Thereafter, the processor (129) can obtain a response to prompts #7 to 8 from the AI ​​unit (129A) and, based on the obtained response, determine whether the connected call is voice phishing.

[0054] In one embodiment, if at least one term contains personal information, the processor (129) may anonymize the personal information and transmit it to the AI ​​unit (129A). For example, if user information (e.g., phone number, name) of the electronic device (120) is included in terms used in a call and / or another call or in the recording thereof, the processor (129) may change at least some of the user information into any other information and anonymize it before transmitting it to the AI ​​unit (129A). Accordingly, according to one embodiment, even if at least a part of the AI ​​unit (129A) is included in the verification terminal (130) or the AI ​​unit (129A) transmits and receives data with the verification terminal (130), exposure / leakage of personal information included in the connected call content (e.g., the first term or the second term) can be prevented. For example, the processor (129) may change a person's name into a form combining a flower, tree, or animal name and a surname, and change a phone number into any number to anonymize it.

[0055] In one embodiment, if the processor (129) determines that one call and another call are suspected voice phishing calls or voice phishing calls, it may transmit a confirmation text to the phone number of the other call via the communication module (125) to inquire whether the other call is currently on the line. The processor (129) may monitor for receipt of a response to the confirmation text for at least another specified period of time and perform processing corresponding to the response. For example, if the one call and another call are determined to be suspected voice phishing calls, the processor (129) may determine the one call and another call as voice phishing calls if no response to the confirmation text is received within another specified period of time.

[0056] Voice Phishing Detection Based on Registered Voice - Example 2

[0057] According to one embodiment, when a call is connected through the communication module (125), the processor (129) can determine whether the connected call is voice phishing based on the terms and voice characteristics used in the connected call.

[0058] The processor (129) can verify a first similarity between terms used in a connected call and reference terms. If the calling number of the connected call is included in the contact information, the processor (129) can verify a second similarity between voices associated with the calling number in the contact information.

[0059] The processor (129) can determine whether a connected call is a voice phishing call based on the first similarity and the second similarity. For example, the processor (129) can classify the connected call as a voice phishing call if the similarity between the terms used in the connected call and the reference terms from the connected call audio file satisfies a first condition in which the similarity meets a first criterion and a second condition in which the second similarity is less than a specified threshold similarity. On the other hand, the processor (129) can classify the connected call as a suspected voice phishing call if only one of the first and second conditions is satisfied. For example, the processor (129) can classify the connected call as a suspected voice phishing call if the first similarity between the terms used in the connected call and the reference terms meets the first criterion, but the second similarity is greater than or equal to a specified threshold similarity. Alternatively, the processor (129) may classify the connected call as a suspected voice phishing call if the first similarity does not meet the first and second criteria, but the second similarity is below the threshold similarity. Alternatively, the processor (129) may classify the connected call as a suspected voice phishing call if the similarity between the terms used in the connected call and the reference terms meets the second criteria.

[0060] In one embodiment, if the processor (129) determines that a connected call is suspected of being a voice phishing call, it may transmit a confirmation text to the terminal associated with the connected call via the communication module (125) to inquire whether the terminal is currently on a call. For example, if the connected call is a voice call via the carrier network, the processor (129) may transmit the confirmation text via the carrier network or another network (e.g., a data network). If the connected call is a voice call via the carrier network, the processor (129) may transmit the confirmation text via a social network app.

[0061] The processor (129) may monitor whether a response to the confirmation text is received within a specified period of time after transmitting the confirmation text. If a response to the confirmation text is not received within a specified period of time after transmitting the confirmation text, the processor (129) may determine the connected call as a voice phishing call and terminate / block the connected call.

[0062] According to one embodiment, the processor (129) may obtain a prompt sequence related to the classification of a voice phishing call from the memory (127). The processor (129) may generate queries based on the terms used according to the prompt sequence and input them into the AI ​​unit (129A), thereby confirming the first similarity and the second similarity. Based on the confirmation results of the first similarity and the second similarity, the processor (129) may classify the connected call as a general call, a suspected voice phishing call, or a voice phishing call.

[0063] <Common Examples of Voice Phishing Detection>

[0064] According to one embodiment, when the processor (129) determines that a connected call is a voice phishing suspected call or a voice phishing call, it may store the connected call content (e.g., call terms, transcript) and analysis results (e.g., similarity analysis results, classification results).

[0065] According to one embodiment, if the processor (129) determines that a connected call (e.g., one call, another call) is a voice phishing call (or a suspected voice phishing call), the processor (129) may connect a three-way call with the verification terminal (130) via the communication module (125). For example, if the telecommunications network allows three-way calls, the processor (129) may connect the three-way call via the telecommunications network. Conversely, if the telecommunications network does not allow three-way calls, the processor (129) may connect the three-way call (voice call) via the VoIP network.

[0066] In this case, the processor (129) can transmit at least the content of another call to the verification terminal (130) connected to the three-party call. For example, if the processor (129) determines that another call connected through the first network (e.g., LTE network) of the electronic device (120) is a voice phishing call, the processor (129) can transmit the recording data of the other call or the second term used (e.g., included) in the other call to the verification terminal (130) through the first network or the second network (e.g., WiFi network). The verification terminal (130) can include, for example, at least one of a telecommunications company server providing a voice call service and a voice phishing blocking service server separate from the telecommunications company server.

[0067] According to one embodiment, when a three-way call is established with the verification terminal (130), the processor (129) may periodically monitor the communication connection status with the verification terminal (130). If the processor (129) determines that the communication connection with the verification terminal (130) is disconnected, the processor (129) may warn the user through the output device (123) of the electronic device (120). For example, the processor (129) may output a message notifying the possibility of a smishing app being installed through the display, and may output a warning sound and vibration through the speaker and vibration motor. In this case, the verification terminal (130) may also independently monitor the communication connection status with the electronic device (120) and, if the communication connection with the electronic device (120) is disconnected, may alert a designated verifier (e.g., family, friends, telecommunications company representative). For example, the processor (129) may communicate with the first app of the verification terminal (130) once every five minutes to check the communication connection status, and output a warning if the connection is disconnected for more than 30 minutes. The processor (129) can maintain a connection state by generating a random number in the first app of the electronic device (120) like a two-way handshake and transmitting the number to the verification terminal (130), and the verification terminal (130) increases it by 1 and transmits it back to the first app of the electronic device (120). If there is no response from the first app of the electronic device (120) for 30 minutes, the verification terminal (130) can display a warning sound and a warning message on the verification terminal (130) or another terminal of the verifier related to the verification terminal (130). If six handshake attempts at 5-minute intervals fail, the first app of the electronic device (120) can output a warning sound and a warning message (e.g., voice phishing is suspected) through the output device (123).

[0068] In one embodiment, the processor (129) may maintain a voice / data call state with the verification terminal (130) in case the connected call is determined to be a voice phishing call and is forcibly terminated in case the fraudster attempts to make a call from a different caller ID.

[0069] According to one embodiment, if the processor (129) determines that a connected call (one call and another call) is a voice phishing call, it may perform at least one of the following actions: forcibly ending the connected call (e.g., another call), adding the phone number of the connected call (e.g., one call and another call) to a call blocking list, making a confirmation call using the calling number, saving the call content (e.g., saving a recording), or outputting a warning. For example, if the processor (129) determines that the connected call is a voice phishing call, it may output a message in real time or immediately after the call, via sound or display, for the output device (123) and the calling number, that says, "This call is suspected to be voice phishing, so please stop the call immediately and notify the police or your family." The processor (129) may, for example, output the message as a call tone to warn the user and the fraudster.

[0070] According to various embodiments, when detecting voice phishing based on a plurality of calls connected within a specified period of time, the processor (129) may analyze background noise of the plurality of calls and detect voice phishing further based on the similarity to the background noise.

[0071] According to various embodiments, the processor (129) may determine whether a connected call is voice phishing based on at least one of the similarity between terms used in multiple calls and a reference term and the similarity between the call voice and a pre-registered voice (voice associated with contact information) (a combination of the first and second embodiments). For example, if the calling number of the connected call is in the contact information, the processor (129) may determine the similarity between the voice associated with the calling number and the voice features of the connected call, and may comprehensively utilize terms used in the connected call and terms included in other connected calls within a specified period from the call to determine whether the connected call is voice phishing.

[0072] According to the above-described embodiment, the processor (129) can analyze the current call in real time during a call connection and can also analyze the call content based on the call transcript after the call ends.

[0073] According to the above-described embodiment, when analyzing terms used in a voice call, the processor (129) can convert the user's voice into text using STT (speech to text) technology and then check the similarity between the text (e.g., first term, second term) and the reference term.

[0074] In this way, since the electronic device (120) according to one embodiment can analyze multiple calls by connecting them, even in cases of voice phishing that is divided into multiple calls, the call analysis results and voice can be stored and analyzed together with the real-time call. For example, even if one call is a call impersonating an investigator and another call is an impersonating a prosecutor, the calls can be analyzed by linking the previously stored call analysis results with the content of the current call. Specifically, the analysis result (e.g., the first term) of a call in which fraudster 1 said, "Our prosecutor Hong Gil-dong will call you later," can be stored, and fraudster 2 can attempt another call in which he said, "Our investigator called you earlier, right? This is prosecutor Hong Gil-dong." In this case, the electronic device (120) according to one embodiment can perform accurate analysis by utilizing the analysis results of the previous call in the analysis of the current call (real-time call).

[0075] Additionally, the electronic device (120) according to one embodiment can periodically check the connection status with the verification terminal (130) for voice phishing (suspected) calls and alert the verifier and user if the connection is lost. Therefore, in one embodiment, the electronic device (120) can prevent most of the security functions of the electronic device (120) from being disabled due to the installation of a smishing app, and can perform safe responses such as issuing a warning when a smishing app is installed.

[0076] Furthermore, even if the electronic device (120) according to one embodiment does not have its own voice recognition module, it can request an external AI to perform a call analysis based on voice recognition through the communication module (125) and obtain the result to detect voice phishing for voice calls.

[0077] Hereinafter, a specific example of voice phishing detection according to the first embodiment will be described. The following example will illustrate a case where the first criterion is the inclusion of at least five oppressive terms, at least two indicative terms, and at least two financial terms, and the second criterion is the inclusion of at least ten oppressive terms, at least seven financial terms, and at least five indicative terms, including at least one of "transfer," "storage," and "transfer."

[0078] First, the user can perform call 1 with scammer 1 as follows:

[0079] >>Contents of Call 1

[0080] Fraudster 1: Hello. This is investigator Kim Wolf from the Central District Prosecutors' Office. Are you Ms. Seo Yang-ran?

[0081] Western orchid: Yes

[0082] Fraudster 1: Do you know Lee Ga-myeong, born in 1988?

[0083] Western orchid: I don't know.

[0084] Fraudster 1: Are you aware that Mr. Lee Ga-myeong opened a Woori Bank account in Ms. Seo Yang-ran's name and used it for criminal purposes?

[0085] Western orchid: Yes?

[0086] Fraudster 1: We need to investigate whether you're a victim or an accomplice. If you cooperate, we'll conduct the investigation remotely. If you don't cooperate, we'll conduct a forced investigation. What will you do?

[0087] Seoyangran: I'll do it remotely.

[0088] Fraudster 1: Our inspector will call you soon. Please wait without telling anyone.

[0089] ===========================================================

[0090] In this regard, the electronic device (120) can generate the following analysis results of call 1 based on a transcript in real time during the performance of call 1 or after the end of call 1.

[0091] >>Analysis results for currency 1

[0092] Pressure terms: prosecutor, investigator Kim Wolf, investigator, crime, name, victim, accomplice, investigation, prosecutor

[0093] Financial terms: Woori Bank, bank, account

[0094] Instructions: Do not reveal, cooperate

[0095] Analysis results: Suspected voice phishing call

[0096] ===========================================================

[0097] As described above, if the electronic device (120) classifies call 1 that meets the first criterion as a suspected voice phishing call, it can store the analysis result of call 1 in the list of suspected calls in the memory (127). Additionally, the electronic device (120) can perform at least one of the following actions: storing a transcript of call 1, or outputting a warning message to the user ‘Seo Yang-ran’ via the output device (123): “As a result of analyzing the content of the call you just made, voice phishing is suspected, so please consult with your family.”

[0098] Next, user 'Seoyangran' may receive a second call from scammer 2 one hour later. The content of call 2 may be as follows:

[0099] >>Contents of Call 2

[0100] Fraudster 2: This is Prosecutor Park Yeo-woo, who's in charge of your case. If you follow my instructions, you'll have no trouble proving your identity. First, please register this number on KakaoTalk and follow the instructions. Most importantly, never reveal it to anyone.

[0101] Seoyangran: Yes, I understand.

[0102] Fraudster 2: It's been revealed that Ms. Seo Yang-ran's name has been used for another crime. This makes proving the victim's identity more difficult. To prevent further damage, all accounts under Ms. Seo Yang-ran's name have been suspended.

[0103] Seoyangran: Oh, so I can't use my account?

[0104] Fraudster 2: Yes, if a withdrawal occurs, it means that the account in question is also involved in the crime.

[0105] Seoyangran: Huh, then what should I do?

[0106] Fraudster 2: Go to the bank now and check if the withdrawal is possible. If so, withdraw the full amount. I'll give you two hours to cooperate with the investigation. Go to the location I mentioned and report it to the Financial Supervisory Service officer who is investigating with us.

[0107] Seo Yang-ran: Then what about my money?

[0108] Fraudster 2: Don't you trust the South Korean prosecution? Ms. Seo Yang-ran's money will be treated as administrative assets, and if there's no criminal connection, it will all be returned.

[0109] ===========================================================

[0110] In this regard, the electronic device (120) can generate the analysis results of call 2 as follows based on the transcript in real time during the performance of call 2 or after the end of call 2.

[0111] >>Analysis results for call 2

[0112] Pressure terms: Prosecutor Park Yeo-woo, prosecutor, victim, damage, proof, crime, prosecution, crime, involvement, name, Financial Supervisory Service

[0113] Financial terms: bank, account, withdrawal, money, full amount

[0114] Instructional terms: utterance, transmission, direction, cooperation

[0115] Analysis Results: Suspected Voice Phishing Call

[0116] ===========================================================

[0117] Since call 2 contains 11 pressure terms, 5 financial terms, and 3 instructional terms, the electronic device (120) can classify call 2 as a suspected voice phishing call that also meets the first criterion.

[0118] However, an electronic device (120) according to one embodiment may analyze a connected call 2 within a specified period (e.g., 24 hours) from call 1 (e.g., from the end of call 1) in relation to call 1 as follows.

[0119] >>Comprehensive analysis results for Call 1 and Call 2

[0120] Pressure terms: Prosecutor Park Yeo-woo, Investigator Kim Wolf, investigator, prosecutor, victim, damage, proof, crime, accomplice, prosecution, crime, involvement, name, Financial Supervisory Service

[0121] Financial terms: Woori Bank, bank, account, withdrawal, money, full amount

[0122] Instructional terms: Don't divulge, convey, do as directed, cooperate

[0123] Analysis Results: Voice Phishing Calls

[0124] ===========================================================

[0125] In this way, the electronic device (120) according to one embodiment can detect a voice phishing call based on a plurality of calls by comprehensively analyzing call 1 and call 2, each of which is classified as a suspected voice call.

[0126] Figure 3 shows a flowchart of a voice phishing detection method according to one embodiment.

[0127] Referring to FIG. 3, in operation 310, when the electronic device (120) is connected to a first call, in operation 320, the electronic device (120) can check the similarity between the first terms included in the first call audio and the reference terms. For example, the electronic device (120) can extract terms that match the reference terms by a predetermined degree of similarity or more in the call audio.

[0128] In operation 330, the electronic device (120) can determine whether the similarity between the first terms and the reference terms meets a first criterion. For example, the first criterion may be that the first terms include a pressure term, a financial term, and an instruction term among the reference terms at least a first specified number of times (or number).

[0129] In operation 330, if the similarity between the first terms and the reference terms meets the first criterion, the electronic device (120) may determine the first call as a suspected voice phishing call in operation 340.

[0130] In operation 350, the electronic device (120) can check whether a second call is connected within a specified period (e.g., 24 hours) from the first call.

[0131] In operation 350, if a second call is connected within a specified period from the first call, the electronic device (120) can synthesize the first term and the second term (term used in the second call) and check the similarity between the synthesized term and the reference term in operation 360.

[0132] In operation 370, the electronic device (120) may classify the first and second calls as voice phishing calls (or suspected voice phishing calls) based on the similarity between the comprehensive term and the reference term.

[0133] If the electronic device (120) determines in operation 330 that the similarity between the first currency term and the reference term does not meet the first criterion, then in operation 380, it can determine whether the similarity meets the second criterion.

[0134] If the electronic device (120) determines in operation 380 that the similarity between the first call term and the reference term meets the second reference value, in operation 385, the electronic device can determine the first call to be a voice phishing call.

[0135] In operations 330 and 380, if it is determined that the similarity between the first currency term and the reference term does not meet the first and second criteria, the electronic device (120) may determine the first currency as a general currency in operation 390.

[0136] The various embodiments of this document and the terminology used herein are not intended to limit the technical features described in this document to specific embodiments, but should be understood to include various modifications, equivalents, or substitutes of the embodiments. In connection with the description of the drawings, similar reference numerals may be used for similar or related components. The singular form of a noun corresponding to an item may include one or more of the items, unless the context clearly indicates otherwise. In this document, phrases such as "A or B," "at least one of A and B," "at least one of A or B," "A, B, or C," "at least one of A, B, and C," and "at least one of A, B, or C" can each include any one of the items listed together in the corresponding phrase, or all possible combinations thereof. Terms such as "first," "second," or "first" or "second" may be used simply to distinguish the corresponding component from other corresponding components, and do not limit the corresponding components in any other respect (e.g., importance or order). When a component (e.g., a first component) is referred to as being “coupled” or “connected” to another component (e.g., a second component), with or without the terms “functionally” or “communicatively,” it means that the component can be connected to the other component directly (e.g., wired), wirelessly, or through a third component.

[0137] The term "module" as used herein may include a unit implemented in hardware, software, or firmware, and may be used interchangeably with terms such as logic, logic block, component, or circuit. A module may be an integral component, or a minimum unit or portion of such a component that performs one or more functions. For example, according to one embodiment, a module may be implemented in the form of an application-specific integrated circuit (ASIC).

[0138] Various embodiments of this document may be implemented as software (e.g., a program) including one or more instructions stored in a storage medium (e.g., memory (127)) (e.g., built-in memory or external memory) readable by a machine (e.g., an electronic device). For example, a processor (e.g., processor (129)) of a device (e.g., electronic device (120)) can call at least one command from among one or more commands stored from a storage medium and execute it. This enables the device to operate to perform at least one function according to the called at least one command. The one or more commands may include code generated by a compiler or code executable by an interpreter. A storage medium readable by the device may be provided in the form of a non-transitory storage medium. Here, 'non-transitory' only means that the storage medium is a tangible device and does not include a signal (e.g., electromagnetic waves), and this term does not distinguish between cases where data is stored semi-permanently and cases where it is stored temporarily in the storage medium.

[0139] According to one embodiment, the method according to various embodiments disclosed in the present document may be provided as a computer program product. The computer program product may be traded between sellers and buyers as a product. The computer program product may be distributed in the form of a device-readable storage medium (e.g., compact disc read-only memory (CD-ROM)) or may be provided through an application store (e.g., Play Store). TM ) or directly between two user devices (e.g., smartphones), online distribution (e.g., downloading or uploading). In the case of online distribution, at least a portion of the computer program product may be at least temporarily stored or temporarily created in a machine-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or an intermediary server.

[0140] Components according to various embodiments of this document may be implemented in the form of software or hardware such as a digital signal processor (DSP), a field programmable gate array (FPGA), or an application specific integrated circuit (ASIC), and may perform certain roles. The term "components" is not limited to software or hardware, and each component may be configured to be on an addressable storage medium or configured to play one or more processors. As examples, components may include components such as software components, object-oriented software components, class components, and task components, as well as processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables.

[0141] According to various embodiments, each component (e.g., a module or a program) of the above-described components may include a single or multiple entities. According to various embodiments, one or more components or operations of the aforementioned components may be omitted, or one or more other components or operations may be added. Alternatively or additionally, a plurality of components (e.g., a module or a program) may be integrated into a single component. In such a case, the integrated component may perform one or more functions of each of the plurality of components identically or similarly to those performed by the corresponding component among the plurality of components prior to the integration. According to various embodiments, the operations performed by a module, program, or other component may be executed sequentially, in parallel, iteratively, or heuristically, or one or more of the operations may be executed in a different order, omitted, or one or more other operations may be added.

Claims

1. In electronic devices, Communication module; A memory that stores reference terms related to voice phishing; and A processor functionally connected to the above communication module and the above memory, wherein the processor comprises: When a call is connected through the above communication module, the call is classified as a suspected voice phishing call based on the similarity between the first terms used in the call and the above reference terms. An electronic device that, if the above-mentioned one-call call is classified as a suspected voice phishing call, determines whether the one-call call and the other call are voice phishing calls based further on the similarity between the second term included in another call connected through the communication module within a specified time from the end time of the one-call call and the reference terms.

2. In claim 1, the processor, An electronic device that classifies a call as a suspected voice phishing call if the similarity between the first terms and the reference terms meets the first reference value.

3. In claim 2, the processor, Among the above first terms and the above second terms, terms corresponding to the above standard terms are combined, An electronic device that determines said one call and said other call as voice phishing calls if said combined terms meet said second criterion.

4. In claim 1, the processor, An electronic device that determines the one call and the other call as voice phishing calls if a common term in the first terms and the second terms belongs to the reference terms.

5. In claim 1, the above criteria terms are: An electronic device containing terms of pressure related to investigation and intimidation, financial terms related to financial transactions, and instructional terms related to instructions for action.

6. In claim 1, the above criteria terms are: An electronic device that further includes computer terms related to installing smishing apps.

7. In claim 1, Further comprising an AI unit, wherein the processor, An electronic device that uses the AI ​​unit to check the similarity between at least one of the first term and the second term and the reference term.

8. In claim 7, The above memory stores a prompt sequence related to the classification of the voice phishing suspected call or the voice phishing call, An electronic device wherein the processor determines the one call and the other call as a regular call, a suspected voice phishing call, or a voice phishing call by generating at least one term-based query according to the prompt sequence and inputting the query into the AI ​​unit.

9. In claim 7, the processor, An electronic device that anonymizes and transmits personal information to the AI ​​unit when at least one of the above terms includes personal information.

10. In claim 7, the AI ​​unit, An API that connects to a cloud AI, comprising at least one of the cloud-coupled AI adapter or AI assistant function module, An electronic device that determines the above-mentioned call and the above-mentioned other call as a general call, a suspected voice phishing call, or a voice phishing call by using the above-mentioned cloud AI through the above-mentioned communication module.

11. In claim 1, the processor, An electronic device that, when determining the above-mentioned one call and the other call as the voice phishing calls, performs at least one of the following actions: forcibly ending the other call, adding the caller numbers of the above-mentioned one call and the other call to a call blocking list, and saving the contents of the above-mentioned one call and the other call.

12. In claim 1, the processor, An electronic device that determines the above-mentioned call and the other call as the voice phishing call or the suspected voice phishing call, and transmits a confirmation text to inquire whether the other call is currently on a call through the communication module.

13. In claim 1, the processor, An electronic device that, when determining the above-mentioned call and the other call as the voice phishing call, connects a three-way call with an external electronic device and transmits at least the contents of the other call to the external electronic device.

14. In claim 13, Further comprising an output device, wherein the processor, Periodically check the status of communication connection with the above external electronic devices, An electronic device that, when confirming a disconnection of communication with said external electronic device, warns of the disconnection of communication through said external electronic device and said output device.

15. In electronic devices, Communication module; Reference terms related to voice phishing, memory that stores voices related to contact information; and A processor functionally connected to said memory, said processor comprising: When a call is connected through the above communication module, the first similarity between the terms used in the connected call and the above reference terms is checked, If the calling number of the above-mentioned connected call is in the above-mentioned contact information, the second similarity between the voice of the above-mentioned connected call and the voice related to the calling number in the above-mentioned contact information is checked, An electronic device that determines whether the connected call is a voice phishing call based on the first similarity and the second similarity.

16. In claim 14, the processor, An electronic device that classifies the connected call as a voice phishing call if the first similarity meets a first criterion and the second similarity is less than a specified threshold similarity.

17. In claim 14, the processor, An electronic device that, when determining that the above-mentioned connected call is a suspected voice phishing call, transmits a confirmation text message to the user terminal related to the above-mentioned connected call through the above-mentioned communication module to inquire whether the user is currently on a call.

18. In claim 17, the processor, An electronic device that determines and blocks the connected call as a voice phishing call if no response to the above verification text is received within a specified period of time.

19. In claim 14, The above memory stores a prompt sequence related to classification of the voice phishing call, and the processor, By generating queries based on the terms used according to the above prompt sequence and inputting them into the AI ​​unit, the first similarity and the second similarity are checked, An electronic device that classifies the connected call as a general call, a suspected voice phishing call, or a voice phishing call based on the verification results of the first and second similarities.

20. In claim 19, the processor, An electronic device that anonymizes and transmits personal information to the AI ​​unit when the terms used in the above-mentioned connected call include personal information.

21. In claim 14, the processor, An electronic device that, when determining that the connected call is a voice phishing call, performs at least one of the following actions: terminating the connected call, saving the recording of the connected call, or transmitting the recording to an external electronic device.

Images