WO2016195261A1 - Illegal traffic detection device and method - Google Patents

Abstract

Disclosed are an illegal traffic detection device and a method therefor. Here, an illegal traffic detection system comprises: a traffic collecting unit for collecting call traffic from an exchange, and parsing a call detail record (CDR) from the call traffic; a pattern detection unit for detecting, from the call traffic, whether pre-defined patterns appearing in illegal traffic occur for each type of pattern, on the basis of the call detail record; and an illegal traffic detection unit for determining whether the call traffic is illegal traffic, on the basis of the result of the pattern detection for each type of pattern, and transmitting the determination result to the exchange, wherein the illegal traffic is traffic that is fed into the exchange via an illegal traffic path instead of via a normal traffic path provided by a communication service provider.

Description

Illegal traffic detection device and method

The present invention relates to an illegal traffic detection apparatus and method thereof.

The Communications Fraud Control Association (CSCF) lost around $ 43B in 2013 in terms of fraudulent communications use worldwide, accounting for about 9% of the Top 5 Interconnect Bypass (SIM BOX) types. Announced. As such, the types of illegal calls and their occurrence forms are becoming more diverse.

This way of bypassing the channel not only reduces the service provider's profits, but also utilizes the public Internet network without any effort to secure service quality (equipment investment and line expansion, etc.), thereby increasing the quality Although it is causing problems, there is a limit to detecting and blocking it.

Conventionally, in order to block illegal international calls, a configuration exists in which a call pattern including call detail record (CDR) information is compared with a predetermined abnormal traffic to determine whether the abnormal traffic is present. However, there are limitations in detecting individual illegal traffic types when using only CDR information in the current environment that causes illegal traffic in various types and innumerable ways.

Therefore, the technical problem to be achieved by the present invention is to detect the intrinsic pattern of occurrence by type or type of illegal traffic, so that the telecommunications carrier network whose main revenue source is the unit price difference of usage fee, such as interconnect bypass. An apparatus and a method for detecting illegal traffic to bypass are provided.

According to one aspect of the present invention, the illegal traffic detection device is a traffic collecting unit for collecting call traffic from the exchange, and parses a call detail record (CDR) from the call traffic, based on the call detail record A pattern detector for detecting whether a pattern occurs in a predefined illegal traffic from call traffic, and determining whether the call traffic is illegal traffic based on a pattern detection result for each type, and transmitting the determination result to the exchange. Including an illegal traffic detection unit, the illegal traffic may be introduced to the exchange via an illegal traffic path without passing through a normal traffic path provided by a communication service provider.

The illegal traffic detection unit,

It may be determined whether the call traffic collected from the exchange is received from the illegal traffic path consisting of a source bypass gateway, an internet network and a destination bypass gateway.

Further comprising a database for storing the illegal traffic,

The traffic collector,

When the call traffic is collected, the database is queried to determine whether the call traffic exists in the database, and if present in the database, illegal traffic detection information indicating that the call traffic is illegal traffic is transmitted to the exchange,

The traffic collector,

If the call traffic does not exist in the database, the call detail record may be generated and transmitted to the pattern detection unit.

The illegal traffic detection unit,

The pattern detection unit may finally determine whether the call traffic is illegal traffic in consideration of the combination of the patterns, the weights predefined for each pattern, and the frequency of use.

The pattern detection unit,

On the basis of the call detail record, it is possible to detect whether the originating terminal of the call traffic is a wireless terminal and corresponds to a pattern for generating a call without regional movement.

The pattern detection unit,

On the basis of the call detail record, it may be detected whether the call traffic corresponds to a pattern using only voice calls.

The pattern detection unit,

Based on the call detail record, it may be detected whether the call traffic corresponds to a pattern in which the outgoing success call rate to the total call success rate exceeds a threshold.

The pattern detection unit,

Based on the call detail record, it may be detected whether the call traffic corresponds to a pattern in which the number of called numbers exceeds a threshold.

The pattern detection unit,

On the basis of the call detail record, it may be detected whether the call traffic corresponds to a pattern in which the number of voice call attempts compared to the number of use of each service exceeds a threshold.

The pattern detection unit,

Based on the call detail record, it may be detected whether the call traffic corresponds to a pattern in which the number of voice channel allocation subscribers in a base station exceeds a threshold.

The pattern detection unit,

On the basis of the call detail record, it may be detected whether the call traffic corresponds to a pattern in which the number of night call occurrences exceeds a threshold.

The pattern detection unit,

On the basis of the call detail record, it is possible to detect whether the call traffic has an incoming successful call average call holding time below a threshold.

The pattern detection unit,

Based on the call detail record, it may be detected whether the call traffic corresponds to a pattern in which the utilization rate in the subscriber network exceeds a threshold.

The pattern detection unit,

Based on the call detail record, it may be detected whether the call traffic corresponds to a pattern in which the call amount of the subscriber exceeds a threshold.

The pattern detection unit,

Based on the call detail record, it may be detected whether the quality of the call traffic corresponds to a pattern below a threshold.

The pattern detection unit,

On the basis of the call detail record, it may be detected whether the calling number of the call traffic corresponds to a prepaid plan subscribed pattern.

According to another feature of the invention, the illegal traffic detection method comprises the steps of collecting call traffic from the exchange, determining whether the collected call traffic is a predefined illegal traffic, if the collected call traffic is not the illegal traffic, Parsing a call detail record (CDR) from the collected call traffic, detecting whether a pattern of occurrence of a pattern appearing in predefined illegal traffic is generated from the call traffic based on the call detail record, and the pattern Determining whether the collected call traffic is illegal traffic in consideration of the combination of the patterns, the weights defined in the pattern, and the frequency of use, and the information indicating whether the collected call traffic is illegal traffic to the exchange. Transmitting,

The illegal traffic may be introduced to the exchange via an illegal traffic path consisting of a source bypass gateway, an internet network, and a destination bypass gateway without passing through a normal traffic path provided by a communication provider.

Detecting whether the pattern occurs by type,

Determining whether the originating terminal of the call traffic is a wireless terminal based on the call detail record and corresponds to a pattern for generating a call without regional movement; and on the basis of the call detail record, the call traffic corresponds to a pattern using only a voice call Determining whether the call traffic corresponds to a pattern in which the outgoing success call rate to the total call success rate exceeds a threshold based on the call detail record; and the call traffic number is based on the call detail record. Determining whether the pattern corresponds to a pattern exceeding, determining whether the call traffic corresponds to a pattern in which the number of voice call attempts exceeds a threshold based on the total number of usages of each service, based on the call detail record. The voice traffic in the base station Determining whether the number of subscribers corresponds to a pattern exceeding a threshold; determining whether the call traffic corresponds to a pattern in which a night call occurrence number exceeds a threshold based on the call detail record; and based on the call detail record Determining whether the traffic corresponds to an incoming successful call average call holding time below a threshold; determining whether the call traffic corresponds to a pattern in which a utilization rate in a subscriber network exceeds a threshold based on the call detail record; and recording the call detail Determining whether the call traffic corresponds to a pattern in which a call amount of a subscriber exceeds a threshold; determining whether the call traffic quality corresponds to a pattern below a threshold, based on the call detail record. The caller ID of the call traffic is prepaid Determining whether the subscription corresponding to the pattern, and if the at least one of the patterns, the results and the call traffic determines the pattern may include the step of updating the database.

According to an embodiment of the present invention, by analyzing and detecting a pattern of illegal traffic bypassing a call path, when illegal traffic occurs, there is an effect of immediately detecting and performing an action such as blocking.

1 is a schematic network diagram for detecting illegal traffic according to an embodiment of the present invention.

2 is a block diagram showing a detailed configuration of an illegal traffic detection apparatus according to an embodiment of the present invention.

3 is a flowchart illustrating an illegal traffic detection process according to an embodiment of the present invention.

4 and 5 are flowcharts illustrating a pattern detection process according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, except to exclude other components unless specifically stated otherwise.

In addition, the terms "… unit", "... module" described in the specification means a unit for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software.

Hereinafter, an illegal traffic detection apparatus and method thereof according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a schematic network diagram for detecting illegal traffic according to an embodiment of the present invention.

Referring to FIG. 1, the calling terminal 100 may include a wired telephone or a mobile. The mobile of the calling terminal 100 wirelessly connects to the calling exchange 200 through the base station, or the wired telephone of the calling terminal 100 is connected to the calling exchange 200 by wire.

The originating exchange 200 is included in the communication provider network, and upon receiving a call connection request signal from the originating terminal 100, after checking the called party location information, calling call request signal to the destination exchange 300 that manages the checked location information. To pass.

The destination exchange 300 is included in the communication provider network, and when the call connection request signal is transmitted from the originating exchange 200, the destination exchange 300 transmits the call connection request signal to the corresponding destination terminal 400.

At this time, the source exchange 200 and the destination exchange 300 may be a network of operators in different countries. In addition, outgoing exchange 200 or destination exchange 300 may be an international telephone exchange.

In this case, the path consisting of the originating terminal 100 → the originating exchange 200 → the terminating exchange 300 → the terminating terminal 400 corresponds to the normal traffic path provided by the communication provider network. The normal traffic path is a normal telecommunication service provider that receives and receives the government's business license and pays the telecommunication fee, which is accompanied by the cost for securing the call quality as well as the tax payment according to the performance of the business.

On the other hand, the originating terminal 100 may be connected to the originating side bypass gateway 600 via the originating exchange 200.

The calling party bypass gateway 600 is connected to the called party bypass gateway 700 through the internet network 700.

When the originating terminal 100 transmits the call connection request signal, the originating exchange 200 transmits the call connection request signal to the originating side bypass gateway 500. The called party bypass gateway 700 receives a call connection request signal from the calling party bypass gateway 500 through the Internet network 600 and transmits the received call connection request signal to the called exchange 300 where the corresponding called party is located.

Here, the destination bypass gateway 7700 converts the call connection request signal, that is, the corresponding call traffic into a local call in the called party's own country, rather than an international call, and the corresponding traffic is the destination exchange 300 of the mobile communication service provider in the called country. Forwards call traffic). Then, the destination exchange 300 transfers the call connection request signal received from the destination side bypass gateway 700 to the destination terminal 400.

The called-bypass gateway 700 can be equipped with a large number of SIM (SIM) cards, mainly called SIM box, and acts as a voice telephone exchange equipment, thereby connecting to the called party.

At this time, when the originating terminal 100 is wireless, the path consisting of the base station → originating switch 200 → the originating side bypass gateway 600 → the Internet network 700 → the destination side bypass gateway 800 is illegal traffic path Corresponds to Here, the time point at which bypass traffic is divided, that is, the point at which bypass traffic starts unlike the normal traffic, becomes the originating exchange 200.

In addition, when the originating terminal 100 is a wired terminal, the originating terminal 100 → the originating exchange 200 200 → the originating bypass gateway 600 → the Internet network 700 → the called party bypass gateway 800 The path corresponds to an illegal traffic path. Here, the time point at which the bypass traffic is divided becomes the originating exchange 200.

The illegal traffic path is a path that bypasses a telecommunications carrier network whose main source of income is a unit price difference of a fee, such as interconnect bypass.

The illegal traffic route connects the sender country and the receiver country to the general Internet network 600, and installs bypass gateways 500 and 700 for connecting to separate wireless devices in the destination country. Not only does it impair the quality of using the Internet line but also provides an abnormal call path by switching to a domestic call rather than an international call through a bypass gateway 700, which is a wireless connection device installed on the called party's side. In other words, illegal call bypass illegal call (SIM Box), rather than the normal communication service provider's call path to create a separate call line to cause an illegal call to convert the difference of the fee to profit.

The illegal traffic detection device 800 collects call traffic in the section of the telephone service exchange equipment 200 and 300 to compare the patterns generated from the illegal traffic to determine whether the illegal traffic is notified and to inform the communication service provider of the illegal traffic, as well as to detect illegal traffic. Give results.

The illegal traffic detection apparatus 800 is connected to the destination exchange 300 to collect call traffic from the destination exchange 300, and then determine whether the call traffic is received through an illegal traffic, i.e., an illegal traffic path. And illegal traffic detection information is delivered to the destination exchange 300 to perform a predetermined process such as call blocking.

The illegal traffic detection apparatus 800 may be configured as shown in FIG. 2.

2 is a block diagram showing a detailed configuration of an illegal traffic detection apparatus according to an embodiment of the present invention.

Referring to FIG. 2, the illegal traffic detection apparatus 800 includes a traffic collector 801, a database 803, a pattern detector 805, and an illegal traffic detector 807.

The traffic collector 801 collects call traffic from the exchange 300 and parses a call detail record (CDR) from the call traffic.

Here, the call detail record (CDR) is the telephone number of the call originating subscriber, the telephone number receiving the call, the start time of the call, the calling time, the telephone bill payment telephone number, the identification of the equipment making the record, the record unique number identification number , Type (voice, SMS, etc.), error status, call end time, and more.

The traffic collector 801 collects all the traffic flowing into the destination exchange 300. Collecting not only signal traffic but also media traffic information among the traffic flowing into the destination exchange 300, data processing for CDR (Call Detail Record) information and quality information of the media is performed.

When the call collecting unit 801 collects call traffic, the traffic collecting unit 801 queries the database 903 to determine whether the call traffic exists in the database 803. That is, it is determined whether it corresponds to illegal traffic stored in the database 803. If present in the database 803, illegal traffic detection information indicating that the call traffic is illegal traffic is transmitted to the exchange 300.

If the collected call traffic does not exist in the database 803, the traffic collector 801 generates a call detail record (CDR) and transmits the generated call detail record to the pattern detector 905.

The database 803 stores illegal traffic information and pattern information indicated by the illegal traffic. This database 903 includes the calling / calling number, the history of the detection of the bypass traffic, the details specified in Table 1, namely, [mobility, voice call only, call / call successful call rate,…]. . Pre-paid plan], etc. Bypass traffic detection history is used to manage the past occurrence history and re-occurrence, such as a black list, the rest stores the data for determining the detour traffic.

The pattern detector 805 detects whether a pattern is generated according to the type of a pattern that appears when a traffic bypass error occurs on the basis of the collected information transmitted from the traffic collector 801. Here, the type of pattern may be implemented as shown in Table 1.

Pattern type	Pattern Detection Method
Mobility	Whether to change base station / target call processing
Voice call only	Use of voice call (SMS, data, etc.)
Outgoing / incoming call success rate
Variety of called numbers	Called Party Number> Threshold
Voice service rate
Number of subscribers in base station	Voice channel allocation subscribers in base station> Threshold
Night call occurrences	Night Calls> Threshold
Incoming Successful Call Average Call Duration	Incoming Successful Call Average Call Duration> Threshold
Utilization rate in subscriber network
High currency volume (by subscriber)	Subscriber Call Volume (Trial)> Threshold
Congestion of corresponding base station call volume (based on base station)	Base Station / Target Call Processing Load Rate / Number of Channels Used (Voice Call)> Threshold
Call quality degraded	Delay, jitter, packet loss> threshold
Use Caller ID Prepaid Plan	Whether the calling number is on a prepaid plan

In Table 1, the thresholds are different values according to the characteristics of the patterns for each pattern.

Referring to Table 1, the pattern detector 805 detects whether or not a pattern occurs in the illegal traffic defined from the call traffic based on the call detail record (CDR) transmitted from the traffic collector 801.

In addition, the pattern detection unit 805 detects whether the originating terminal of call traffic is a wireless terminal based on the call detail record (CDR) and corresponds to a pattern for generating a call without regional movement.

Also, the pattern detector 805 detects whether call traffic corresponds to a pattern using only voice calls based on the call detail record (CDR).

In addition, the pattern detector 805 detects whether the call traffic corresponds to a pattern in which the outgoing success call rate to the total call success rate exceeds the threshold based on the call detail record (CDR).

In addition, the pattern detection unit 805 detects whether the call traffic corresponds to a pattern in which the number of called numbers exceeds a threshold based on the call detail record (CDR).

In addition, the pattern detection unit 805 detects whether the call traffic corresponds to a pattern in which the number of voice call attempts exceeds a threshold value based on the call detail record (CDR).

In addition, the pattern detector 805 detects whether call traffic corresponds to a pattern in which the number of voice channel allocation subscribers in the base station exceeds a threshold based on the call detail record (CDR).

In addition, the pattern detection unit 805 detects whether the call traffic corresponds to a pattern in which the number of night call occurrences exceeds a threshold based on the call detail record (CDR).

In addition, the pattern detector 805 detects whether the call traffic corresponds to the incoming call success call average call holding time below the threshold based on the call detail record (CDR).

In addition, the pattern detector 805 detects whether call traffic corresponds to a pattern in which the utilization rate in the subscriber network exceeds a threshold based on the call detail record (CDR).

In addition, the pattern detector 805 detects whether the call traffic corresponds to a pattern in which the call amount of the subscriber exceeds a threshold based on the call detail record (CDR).

In addition, the pattern detector 805 detects whether the quality of the call traffic corresponds to a pattern below a threshold based on the call detail record (CDR).

In addition, the pattern detection unit 805 detects whether the calling number of the call traffic corresponds to the prepaid subscription pattern based on the call detail record (CDR).

The illegal traffic detector 807 determines whether the traffic is detoured by minimizing a false positive rate based on the information of the patterns detected by the pattern detector 805. In this case, the illegal traffic may be detected by a certain combination of the detected patterns as an embodiment for detecting the illegal traffic. At this time, the pattern is composed of unique and unique parameters for determining interconnect bypass traffic.

The illegal traffic detection unit 807 determines whether the call traffic is illegal traffic based on the pattern detection result for each pattern type, and transmits the determination result to the exchange 300.

The illegal traffic detection unit 807 includes an interconnect bypass in which call traffic collected from the exchange 300 is composed of an outgoing side bypass gateway 500 → an internet network 600 → a destination side bypass gateway 700. It is determined whether or not received from the illegal traffic path consisting of).

The illegal traffic detector 807 may finally determine whether the call traffic is illegal traffic in consideration of the combination of the patterns for each pattern detected by the pattern detector 805, the weights predefined for each pattern, and the frequency of use.

The illegal traffic detection unit 807 may calculate a final risk score by combining a risk score (weighted value) for each pattern as shown in Table 2, and detect the illegal traffic when the final risk score exceeds a predetermined threshold.

For example, it can be detected as illegal traffic when at least three or more levels are satisfied and the risk score is 17 or more.

Pattern type	Risk	Risk score
Mobility
Stage 1	4
Voice call only	Tier 2	3
Outgoing / incoming call success rate		Tier 2	3
Utilization rate in subscriber network		Tier 2	3
Variety of called numbers	Tier 3	2
Voice service rate	Tier 3	2
Number of subscribers in base station	Tier 3	2
Night call occurrences	Tier 3	2
Incoming Successful Call Average Call Duration	Tier 3	2
Low call quality	Tier 3	2
Use Prepaid Calling Plan	Tier 3	2
High currency volume (by subscriber)	4 steps	One
Congestion of corresponding base station call volume (based on base station)	4 steps	One

Then, the illegal traffic detection process and the pattern detection process for illegal traffic detection will be described in detail below. In this case, the same reference numerals are used in connection with the configuration of FIGS. 1 and 2.

3 is a flowchart illustrating an illegal traffic detection process according to an embodiment of the present invention.

Referring to FIG. 3, the traffic collector 801 collects call traffic from the exchange 300 (S101).

The traffic collector 801 performs data processing for analyzing CDR information and quality information of the media on the call traffic collected in step S101 to determine whether an illegal traffic pattern occurs.

The traffic collector 801 inquires (S105) the database 803 whether the CDR information processed in step S103 exists in the database 803 (S107) and receives a result (S107).

The traffic collector 801 is in step S101

The traffic collecting unit 801 determines whether the call traffic collected in step S101 corresponds to illegal traffic stored in the database 803 (S109).

In this case, if the traffic is not illegal, the data processed in step S103 is transferred to the pattern detector 805 (S111).

The pattern detector 805 analyzes a pattern for call traffic based on the data (including the CDR) received in step S111 (S113). The analysis result is then transmitted to the illegal traffic detection unit 807 (S115).

The illegal traffic detection unit 807 determines whether the call traffic collected in step S101 is illegal traffic based on the pattern analysis information received in step S115 (S117). The determination information is then transferred to the traffic collecting unit 801 (S119).

The traffic collector 801 checks whether the call traffic is illegal traffic based on the determination information received in step S119 (S121).

In this case, if it is determined as illegal traffic in step S121 or is determined as illegal traffic previously stored in step S109, the illegal traffic detection information is transmitted to the exchange 300 (S123) to be used for blocking and managing illegal traffic. That is, when data managed by the database 803 and incoming traffic are collected or traffic matching the illegal traffic pattern is collected, the illegal traffic detection information is transmitted to the exchange 300.

In addition, the pattern analysis information and the illegal traffic determination information determined in steps S113 and S117 are stored in the database 803.

Meanwhile, the step S113 will be described in detail with reference to FIGS. 4 and 5.

4 and 5 are flowcharts illustrating a pattern detection process according to an embodiment of the present invention.

First, referring to FIG. 4, the CDRs are parsed from the traffic collected by the traffic collector 901 (S201).

The pattern detector 805 determines whether the calling terminal is mobile based on the CDR information parsed in step S201 (S203). That is, even if the terminal (SIM) used in the destination bypass gateway (Bypass Gateway) 600 is a wireless terminal, it is checked whether the call is continuously generated without local movement.

At this time, if the mobility is not confirmed, the pattern detector 805 determines whether the pattern uses only a voice call (S205). That is, a pattern according to the role of the bypass gateways 500 and 700 for relaying a voice call is used to check whether a text message or the Internet is used in addition to the voice call.

At this time, if the pattern is not only using the voice call, the pattern detector 805 checks the ratio of the outgoing / incoming successful call (S207). That is, it is detected whether traffic is generated in a single direction according to the direction in which a call bypass is generated. In the case of illegal traffic, the detection pattern is confirmed because only a call signal is generated based on the called party's direction.

At this time, if it does not occur in a single direction, the pattern detection unit 805 checks whether the incoming number is diversity (S209). That is, the detection pattern checks whether the call is sent to a plurality of numbers out of the general user's usage pattern. For example, it is determined whether the number of called party numbers is a pattern exceeding a threshold.

In this case, when the called number does not vary, the pattern detector 805 checks whether the voice service rate, that is, the number of voice call attempts exceeds the threshold (S211). That is, the rate of use of the voice service compared to the total service use rate is determined by checking the use rate of the text service compared to the voice call or other data such as the Internet.

At this time, if the number of voice call attempts does not exceed the threshold, the pattern detector 805 determines whether the number of subscribers in the base station exceeds the threshold (S213). In general, the number of subscribers in the base station is determined by the detection pattern because the destination bypass gateway, which is installed at the destination side, is operated with a plurality of SIM cards ranging from tens to hundreds.

Next, referring to FIG. 5, if the number of subscribers does not exceed the threshold in step S213, the pattern detector 805 determines whether the number of night call occurrences is greater than or equal to the threshold (S215). The traffic pattern bypass abnormal traffic is confirmed by the detection pattern that the caller generates more night calls than the general user in consideration of the unspecified majority point.

At this time, when the number of night calls is less than the threshold, the pattern detector 805 determines whether the incoming call success call average duration is less than the threshold (S217). In most cases, traffic detour abnormalities occur in one direction and generate an incoming call to avoid detection by such detection. Therefore, the ratio of incoming call to incoming call is so low that the average talk time is checked and the ratio is compared to check the detection pattern.

At this time, if the incoming call success average call holding time is more than the threshold value, the pattern detector 805 determines whether the utilization rate in the subscriber network exceeds the threshold (S219). In the case of illegal traffic, even if the bypass gateways 500 and 700 generate local calls, the rate of calls within the same communication service provider is significantly lower than that of the third party network. Check.

At this time, if the utilization rate of the childbearer network does not exceed the threshold, the pattern detector 805 determines whether the call amount of the subscriber exceeds the threshold (S221). That is, the detection pattern is confirmed in consideration of the fact that the call usage is much higher than that of the general user.

At this time, if the call amount of the subscriber does not exceed the threshold, the pattern detector 805 detects whether the base station call amount is determined to be congested (S223). The base station call volume is mainly used by several tens to hundreds of SIM cards at the same time, which is confirmed by the detection pattern considering that the call volume in the base station coverage is much higher than that of the neighboring base stations.

At this time, if the base station call amount does not exceed the threshold, the pattern detector 805 determines whether the call quality is deteriorated (S225). The lower part of the call quality usually uses a less expensive Internet public network between the source and destination countries. As a result, latency, jitter, and packet loss rate increase significantly during times of high traffic, resulting in poor quality. This quality deterioration phenomenon is confirmed by a detection pattern.

If it is not confirmed whether the call quality is deteriorated, the pattern detector 805 determines whether the call origination number is a prepaid fee subscription (S227). SIM cards that generate detour traffic confirm this detection pattern by using a prepaid plan, which tends to minimize the leakage of subscriptions and user information.

The pattern detection unit 805 updates the pattern detection results determined in steps S203 to S227 in the database 803, respectively (S229). The pattern detection result is then transmitted to the illegal traffic detection unit 807.

Then, the illegal traffic detection unit 807 performs a final illegal traffic detection process based on the pattern detection result.

The embodiments of the present invention described above are not only implemented through the apparatus and the method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiments of the present invention or a recording medium on which the program is recorded.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

Claims (18)

1. A traffic collector for collecting call traffic from an exchange and parsing a call detail record (CDR) from the call traffic;

   A pattern detector for detecting whether a pattern for each type of pattern appearing in predefined illegal traffic is generated from the call traffic based on the call detail record; and

   A illegal traffic detection unit for determining whether the call traffic is illegal traffic based on the pattern detection result for each type, and transmitting the determination result to the exchange;

   The illegal traffic is an illegal traffic detection apparatus that flows into the exchange via an illegal traffic path without passing through a normal traffic path provided by a communication provider.
2. The method of claim 1,

   The illegal traffic detection unit,

   And an illegal traffic detection apparatus for determining whether the call traffic collected from the exchange is received from the illegal traffic path including an originating bypass gateway, an internet network, and a destination bypass gateway.
3. The method of claim 1,

   Further comprising a database for storing the illegal traffic,

   The traffic collector,

   When the call traffic is collected, the database is queried to determine whether the call traffic exists in the database, and if present in the database, illegal traffic detection information indicating that the call traffic is illegal traffic is transmitted to the exchange,

   The traffic collector,

   And generating the call detail record and transmitting the generated call detail record to the pattern detection unit if the call traffic does not exist in the database.
4. The method of claim 3,

   The illegal traffic detection unit,

   And an illegal traffic detection device for finally determining whether the call traffic is illegal traffic in consideration of the combination of the patterns for each of the patterns detected by the pattern detection unit, a weight predefined for each pattern, and the frequency of use.
5. The method of claim 4, wherein

   The pattern detection unit,

   And an illegal traffic detection device detecting whether the originating terminal of the call traffic is a wireless terminal based on the call detail record and corresponds to a pattern for generating a call without local movement.
6. The method of claim 4, wherein

   The pattern detection unit,

   And illegal traffic detection device based on the call detail record to detect whether the call traffic corresponds to a pattern using only voice calls.
7. The method of claim 4, wherein

   The pattern detection unit,

   And illegal traffic detection device based on the call detail record to detect whether the call traffic corresponds to a pattern in which the outgoing success call rate to the total call success rate exceeds a threshold.
8. The method of claim 4, wherein

   The pattern detection unit,

   And illegal traffic detection device based on the call detail record to detect whether the call traffic corresponds to a pattern in which the number of called numbers exceeds a threshold.
9. The method of claim 4, wherein

   The pattern detection unit,

   And illegal traffic detection apparatus based on the call detail record to detect whether the call traffic corresponds to a pattern in which the number of voice call attempts compared to the number of use of each service exceeds a threshold.
10. The method of claim 4, wherein

    The pattern detection unit,

    And illegal traffic detection device based on the call detail record to detect whether the call traffic corresponds to a pattern in which the number of voice channel allocation subscribers in a base station exceeds a threshold.
11. The method of claim 4, wherein

    The pattern detection unit,

    And illegal traffic detection device based on the call detail record to detect whether the call traffic corresponds to a pattern in which the number of nighttime calls occurs exceeds a threshold.
12. The method of claim 4, wherein

    The pattern detection unit,

    And illegal traffic detection device based on the call detail record to detect whether the call traffic corresponds to an incoming successful call average call holding time below a threshold.
13. The method of claim 4, wherein

    The pattern detection unit,

    And illegal traffic detection device based on the call detail record to detect whether the call traffic corresponds to a pattern in which the utilization rate in a subscriber network exceeds a threshold.
14. The method of claim 4, wherein

    The pattern detection unit,

    And illegal traffic detection device based on the call detail record to detect whether the call traffic corresponds to a pattern in which a call amount of a subscriber exceeds a threshold.
15. The method of claim 4, wherein

    The pattern detection unit,

    And an illegal traffic detection device detecting whether the quality of the call traffic corresponds to a pattern below a threshold based on the call detail record.
16. The method of claim 4, wherein

    The pattern detection unit,

    And an illegal traffic detection device detecting whether the calling number of the call traffic corresponds to a prepaid subscription pattern based on the call detail record.
17. Collecting call traffic from the exchange,

    Determining whether the collected call traffic is a predefined illegal traffic,

    Parsing a call detail record (CDR) from the collected call traffic, if the collected call traffic is not the illegal traffic;

    Detecting whether or not a pattern occurs in the predefined illegal traffic from the call traffic based on the call detail record;

    Determining whether the collected call traffic is illegal traffic in consideration of the combination of the patterns for each of the patterns, the weights predefined for each pattern, and the frequency of use; and

    Transmitting information indicating whether the collected call traffic is illegal traffic to the exchange,

    The illegal traffic is an illegal traffic detection method that flows to the exchange via an illegal traffic path consisting of a source bypass gateway, an internet network, and a destination bypass gateway without passing through a normal traffic path provided by a communication provider.
18. The method of claim 17,

    Detecting whether the pattern occurs by type,

    Determining whether the originating terminal of the call traffic is a wireless terminal based on the call detail record and corresponds to a pattern for generating a call without regional movement;

    Determining whether the call traffic corresponds to a pattern using only a voice call based on the call detail record;

    Determining whether the call traffic corresponds to a pattern in which the outgoing success call rate to the total call success rate exceeds a threshold based on the call detail record;

    Determining whether the call traffic corresponds to a pattern in which the called number exceeds a threshold, based on the call detail record;

    Determining whether the call traffic corresponds to a pattern in which the number of voice call attempts exceeds a threshold based on the call detail record;

    Determining whether the call traffic corresponds to a pattern in which the number of voice channel allocation subscribers in a base station exceeds a threshold based on the call detail record;

    Determining whether the call traffic corresponds to a pattern in which a night call occurrence number exceeds a threshold based on the call detail record;

    Determining whether the call traffic corresponds to an incoming call success call average call duration time less than a threshold based on the call detail record;

    Determining whether the call traffic corresponds to a pattern in which a utilization rate in a subscriber network exceeds a threshold based on the call detail record;

    Determining whether the call traffic corresponds to a pattern in which a call amount of a subscriber exceeds a threshold, based on the call detail record;

    Determining whether the quality of the call traffic corresponds to a pattern below a threshold based on the call detail record;

    Determining whether the calling number of the call traffic corresponds to a prepaid plan subscribed pattern based on the call detail record; and

    If it corresponds to at least one of the patterns, updating the result of determining the pattern and the corresponding call traffic in a database

    Illegal traffic detection method comprising a.

Images