[go: up one dir, main page]

WO2007039345A1 - Procede et dispositifs pour empecher la reception de messages indesirables dans un reseau de communication ip - Google Patents

Procede et dispositifs pour empecher la reception de messages indesirables dans un reseau de communication ip Download PDF

Info

Publication number
WO2007039345A1
WO2007039345A1 PCT/EP2006/065509 EP2006065509W WO2007039345A1 WO 2007039345 A1 WO2007039345 A1 WO 2007039345A1 EP 2006065509 W EP2006065509 W EP 2006065509W WO 2007039345 A1 WO2007039345 A1 WO 2007039345A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
spit
feature pattern
sss
messages
Prior art date
Application number
PCT/EP2006/065509
Other languages
German (de)
English (en)
Inventor
Joachim Charzinski
Bernhard Petri
Thomas Theimer
Original Assignee
Nokia Siemens Networks Gmbh & Co. Kg
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nokia Siemens Networks Gmbh & Co. Kg filed Critical Nokia Siemens Networks Gmbh & Co. Kg
Publication of WO2007039345A1 publication Critical patent/WO2007039345A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1076—Screening of IP real time communications, e.g. spam over Internet telephony [SPIT]
    • H04L65/1079—Screening of IP real time communications, e.g. spam over Internet telephony [SPIT] of unsolicited session attempts, e.g. SPIT
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/21—Monitoring or handling of messages
    • H04L51/212—Monitoring or handling of messages using filtering or selective blocking
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M3/00—Automatic or semi-automatic exchanges
    • H04M3/42—Systems providing special services or facilities to subscribers
    • H04M3/50—Centralised arrangements for answering calls; Centralised arrangements for recording messages for absent or busy subscribers ; Centralised arrangements for recording messages
    • H04M3/53—Centralised arrangements for recording incoming messages, i.e. mailbox systems
    • H04M3/533—Voice mail systems
    • H04M3/53333—Message receiving aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04M—TELEPHONIC COMMUNICATION
    • H04M7/00—Arrangements for interconnection between switching centres
    • H04M7/006—Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP), including next generation networks with a packet-switched transport layer

Definitions

  • the invention relates to a method and devices for avoiding the reception of unwanted messages, in particular so-called spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network.
  • spammming refers to the mass sending of unwanted messages (“spam”).
  • spam benefits from easy and affordable access to electronic media, which generally allow for the delivery of messages to a large number of recipients at low cost and time, and the content of such "spam” messages is often more commercial "Spam” is the most prevalent type of "spam.”
  • a very well-known form of "spam” is mass mailing of e-mails for advertising purposes.
  • e-mail "spam” there are other forms such as "spam” regarding instant messaging, Usenet newsgroups, WWW search engines, weblogs or mobile communications.
  • ISPs Internet Service Providers
  • VoIP Voice over IP
  • SPIT Packet over Internet telephony
  • PSTN Public Switched Telephone Network
  • VoIP subscribers can be conducted almost free of charge for the caller due to the deviating billing model, which can be expected to generate a massive amount of SPIT for the future.
  • the ability to send recorded voice files in bulk should be interesting for advertisers. It can be assumed that the affected VoIP subscribers will ask their respective VoIP provider for appropriate measures to be protected against unwanted calls.
  • a whitelist for a subscriber X contains subscriber-specific information on such other subscribers Y in the communication network that have been classified as trustworthy and are therefore entitled to Call subscriber X.
  • a blacklist contains subscriber-specific information about such other subscribers Y who have been classified as untrustworthy and who are therefore not authorized to call subscriber X.
  • the object of the invention is to design a method and devices such that the reception of unwanted messages in a communication network can be avoided.
  • the invention relates to a method for preventing the reception of unwanted messages, in particular so-called spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network in which a characteristic feature pattern is calculated for a message and the feature pattern in a network component ge - is stored, and in which the characteristic feature pattern of the message is transmitted to other network components in the communication network.
  • the message is assigned a SPIT probability by comparing the feature pattern with previously known feature patterns stored on at least one network component
  • SPIT probability depends on the frequency of occurrence of the feature pattern FP.
  • the message is treated as an unwanted SPIT message if the assigned SPIT message Probability exceeds a predetermined limit. For example, a message evaluated as an unwanted SPIT message is deleted or moved to a separate SPIT message storage area.
  • the invention relates to devices for carrying out the illustrated method.
  • the invention has the advantage that the reception of unwanted messages is considerably reduced.
  • Fig. 1 Network architecture with distributed SPIT detector
  • Fig. 2 Sequence of the calculation, distribution and use of feature patterns
  • Fig. 3 Example of the calculation of feature patterns FP from received messages
  • Fig. 4 Network architecture with separate SPIT signature server
  • Fig. 5 Sequence of the calculation, distribution and use of feature patterns with separate SPIT signature server
  • FIG. 1 shows an embodiment of the network architecture according to the invention with a first network component S, preferably a voice memory device for storing messages M, and a second and third network component N2, N3 for calculating and storing message characteristic feature patterns FP (for fingerprint) in the communication network IN (for Internet ).
  • network components include voice box servers, media servers, session border controllers, voice gateways, answering machines and end devices such as mobile telephones, PDAs or PCs with local voice mail devices and corresponding software.
  • the speech storage device S and the second and third network components N2, N3 together form a distributed SPIT detector.
  • the speech memory device S receives a message M in a first step 1.
  • the speech memory device S analyzes the message M on the basis of suitable identifiers. The identifiers are such that the message M can not be recalculated from them.
  • FIG. 2 shows the sequence of calculation, distribution and use of feature patterns.
  • the exchange of messages according to the invention between the network components S, N2 and N3 will be described.
  • the network component S receives the message M.
  • the network component S performs an action Al consisting of the calculation of the feature pattern FP for the message M, the storage of the feature pattern FP and the detection of the frequency of the feature pattern FP in one Statistics exists.
  • the network component S forwards the feature pattern FP together with the frequency information to the second and third network components N2 and N3.
  • the second and third network components N2 and N3 then each execute an action A2, which consists of storing the feature pattern FP and recording the frequency of the feature pattern FP in a statistic.
  • the network component N2 also receives the message M and then executes an action A3 consisting of the calculation of the feature pattern FP and the check of the frequency value for that feature pattern FP. If a predetermined limit value and / or the subscriber-definable limit frequency for the occurrence of the feature FP is exceeded, the message is classified as SPIT and rejected.
  • the feature pattern FP is calculated, for example, from simple digital features of the message M.
  • Simple digital features of the message M are, for example, a check sum calculated via the received digital voice message M, preferably a CRC value or a hash value.
  • FIG. 3 shows the calculation of a feature pattern on the basis of a voice message received in the form of IP packets.
  • the calculated feature pattern is composed of individual components Hl, H2 and H3.
  • An IP packet received in a first step 1 consists of header headers of the IP, UDP and RTP protocol, followed by a first payload PLl.
  • the first user data part PL1 is stored in a second step 2.
  • the user data portions PL2-PL9 of successive IP packets from a connection are stored one after the other.
  • a hash value H1, H2 and H3 is calculated via in each case three user data portions PL1, PL2, PL3, as well as PL4, PL5, PL6 and PL7, PL8, PL9.
  • the sequence of these hash values represents the feature pattern FP.
  • the feature pattern FP is calculated in the course of an extensive analysis of the speech components of the message M. For example, first the encoding of message M is changed to a predetermined code. Subsequently, features are extracted which are independent of the exact timing of the beginning and end of the encoding of the message M. For this purpose, for example, a normalized histogram of the spectral components in the message M and / or activity / pause analyzes are suitable.
  • the feature pattern FP calculated in this way is multi-dimensional.
  • a quantization is additionally advantageously carried out so that the feature pattern FP becomes robust against small changes in the message content.
  • additional features for example, from the SIP headers of the message M and / or further protocol information of the signaling protocol are stored or transmitted together with the feature pattern FP in addition to the features mentioned.
  • SPIT treatment is know SPIT-suspect header information already in the transmission of the message M effetbowbar.
  • FIG. 1 and FIG. 2 show how the speech memory device S transmits the calculated feature pattern FP in a second step 2 to the second network component N2 and to the third network component N3.
  • the second step 2 represents the exchange of feature patterns FP between network components S, N2, N3 in the communication network IN.
  • the message M is assigned a SPIT probability SW by comparison of the feature pattern FP with previously known feature patterns FP stored on at least one network component S, N2, N3.
  • the message M is treated as an unwanted SPIT message if the assigned SPIT probability SW exceeds a predetermined threshold.
  • the treatment of a message M classified as a SPIT message corresponds, for example, to a deletion of the message M. Alternatively, the message M is moved to a separate memory area for SPIT messages.
  • Figure 4 shows a further embodiment of the invention in the form of a network architecture with network components S, N2 and AB (for a private answering machine) in the communication network IN and with an additional separate server system SSS (for SPIT signature server).
  • the network components S, N2, AB in the communication network IN report the feature patterns FP to at least one separate server system, for example in the second step 2 and a fifth step 5.
  • the separate server system SSS keeps statistics about the frequency of the individual feature patterns FP and delivers, for example, in a third step 3 and in a sixth step 6 on the basis of these statistics for each transmitted feature pattern FP back a SPIT probability SW for that it is in the associated message M For example, it is a mass message that is assigned to the SPIT area.
  • the SPIT probability SW is determined, for example, by means of the following table:
  • FIG. 5 shows the sequence of calculation, distribution and use of feature patterns FP with separate SPIT signature server SSS for the exemplary network architecture of FIG. 4.
  • FIG. 5 illustrates the flow of exchanging messages between network components S, N2 and the separate one SPIT signature server SSS.
  • the network component S receives the message M.
  • the network component S performs an action Al consisting of the calculation of the feature pattern FP for the message M.
  • the network component S forwards the feature pattern FP to the SPIT signature server SSS on.
  • the SPIT signature server SSS executes an action A2, which consists of storing the feature pattern FP, recording the frequency of the feature pattern FP in a statistic, and determining the SPIT probability SW.
  • the SPIT signature server SSS returns the value for the SPIT probability SW back to the network component S.
  • the network component N2 also receives the message M in a fourth step and then executes the action Al , which consists of the calculation of the feature pattern FP.
  • the network component N2 forwards the feature pattern FP to the SPIT signature server SSS.
  • the SPIT signature server SSS executes the action A2, which consists of storing the feature pattern FP, recording the frequency of the feature pattern FP in a statistic, and determining the SPIT probability SW.
  • the SPIT signature server SSS returns the value for the SPIT probability SW back to the network component N2.
  • the network component N2 then executes an action A3 which consists of the comparison of the value obtained for SW with a predetermined limit frequency for the occurrence of the feature FP and the treatment of the message M derived therefrom as SPIT.
  • a network component S only forwards a feature pattern FP to further network components N2, N3 and / or the separate SPIT signature server SSS, if identical feature patterns with the feature pattern FP are stored on the reporting network component S, N2, N3 and the number of identical feature patterns exceeds a limit.
  • the limit value is fixed or freely adjustable.
  • a feature pattern FP calculated and transmitted to the network components S, N2, N3, SSS.
  • a feature pattern FP for a desired mass message M is calculated and entered in a whitelist in which feature patterns for mass messages sent by authenticated providers are managed.
  • the feature pattern FP for the desired mass message M is then transmitted to the network components S, N2, N3, SSS.
  • desired mass messages such as football results or stock market prices can advantageously be transmitted without such desired mass messages being treated as SPIT.
  • feature patterns FP of .multidot.s are stored on the network components S, N2, N3, SSS
  • the long-term storage is outsourced to an archive server.

Landscapes

  • Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente invention concerne un procédé et des dispositifs pour empêcher la réception de messages indésirables, notamment des messages indésirables utilisant la téléphonie sur IP, abrégés sous le nom de messages SPIT (SPam over Internet Telephony), dans un réseau de communication IP. Selon cette invention, un modèle d'attributs caractéristique est calculé pour un message et le modèle d'attributs est enregistré dans un composant du réseau. Le modèle d'attributs caractéristique du message est transmis à d'autres composants du réseau dans le réseau de communication. En comparant le modèle d'attributs à des modèles d'attributs préalablement connus et enregistrés sur au moins un composant du réseau, une probabilité de SPIT est établie. Le message est traité comme message SPIT indésirable lorsque la probabilité de SPIT établie dépasse une valeur limite préalablement déterminée.
PCT/EP2006/065509 2005-09-30 2006-08-21 Procede et dispositifs pour empecher la reception de messages indesirables dans un reseau de communication ip WO2007039345A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE102005046939A DE102005046939A1 (de) 2005-09-30 2005-09-30 Verfahren und Vorrichtungen zur Vermeidung des Empfangs unerwünschter Nachrichten in einem IP-Kommunikationsnetzwerk
DE102005046939.6 2005-09-30

Publications (1)

Publication Number Publication Date
WO2007039345A1 true WO2007039345A1 (fr) 2007-04-12

Family

ID=37398816

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/EP2006/065509 WO2007039345A1 (fr) 2005-09-30 2006-08-21 Procede et dispositifs pour empecher la reception de messages indesirables dans un reseau de communication ip

Country Status (2)

Country Link
DE (1) DE102005046939A1 (fr)
WO (1) WO2007039345A1 (fr)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040148330A1 (en) * 2003-01-24 2004-07-29 Joshua Alspector Group based spam classification
WO2004068288A2 (fr) * 2003-01-24 2004-08-12 America Online Inc. Ajustage de systemes de classification en fonction de similitides entre donnees
EP1675332A1 (fr) * 2004-12-21 2006-06-28 Lucent Technologies Inc. Serveur anti-spam

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040148330A1 (en) * 2003-01-24 2004-07-29 Joshua Alspector Group based spam classification
WO2004068288A2 (fr) * 2003-01-24 2004-08-12 America Online Inc. Ajustage de systemes de classification en fonction de similitides entre donnees
EP1675332A1 (fr) * 2004-12-21 2006-06-28 Lucent Technologies Inc. Serveur anti-spam

Also Published As

Publication number Publication date
DE102005046939A1 (de) 2007-04-12

Similar Documents

Publication Publication Date Title
DE602005003409T2 (de) Ausfiltern unerwünschter Nachrichten (Spam) für Mobilfunkgeräte
DE60220004T2 (de) System und Verfahren zur Verhinderung unverlangter elektronischer Post
CN114339639B (zh) 通话识别方法、装置、存储介质和电子设备
DE10021686A1 (de) Verfahren zur Reduktion der Verbreitung von Computerviren in einem elektronischen Mail-Netzwerk
EP1935151A1 (fr) Procede et dispositif pour verifier une adresse d'expediteur transmise au cours d'une demande de liaison pour etablir une liaison de communication dans un reseau de communication ip
EP2621146A1 (fr) Système et procédé automatique de hiérarchisation de sessions de communication
EP2053783A1 (fr) Procédé et système pour l'identification de trafic VoIP dans des réseaux
DE102006012439B4 (de) Verfahren und Vorrichtungen zur Vermeidung einer fehlerhaften Klassifizierung von erwünschten Nachrichten als Spam over Internet Telephony-Nachrichten, abgekürzt SPIT-Nachrichten, in einem Kommunikationsnetzwerk
CN110445944B (zh) 呼叫中心防止电话骚扰的方法及系统
WO2005096572A1 (fr) Procede pour surveiller la transmission de messages electroniques
WO2007036400A1 (fr) Procede et dispositifs pour empecher la reception de messages indesirables dans un reseau de communication sur ip
CN108347359B (zh) 一种大型网络地址转换出口判断方法及装置
WO2007039345A1 (fr) Procede et dispositifs pour empecher la reception de messages indesirables dans un reseau de communication ip
DE102006032543A1 (de) Verfahren und System zur Reduzierung des Empfangs unerwünschter Nachrichten
CN116684527A (zh) 模型训练方法、装置及电子设备
DE102006012658A1 (de) Verfahren und Vorrichtung zur Erkennung von Spam over Internet Telephony-Nachrichten versendenden Teilnehmern, abgekürzt SPIT-Versender, in einem IP-Kommunikationsnetzwerk
WO2007039350A1 (fr) Procede et dispositifs pour empecher la reception de messages indesirables dans un reseau de communication ip
WO2007036399A1 (fr) Procede et dispositif pour empecher la reception de messages indesirables dans un reseau de communication sur ip
Husna et al. Traffic shaping of spam botnets
DE102005046377B3 (de) Verfahren und Vorrichtung zur Vermeidung des Empfangs unerwünschter Nachrichten in einem IP-Kommunikationsnetzwerk
Bai et al. Detection and filtering spam over internet telephony—a user-behavior-aware intermediate-network-based approach
DE102006010538A1 (de) Verfahren und Vorrichtungen zu einer selektiven Behandlung unerwünschter Nachrichten, insbesondere sogenannter Spam over Internet Telephony-Nachrichten, abgekürzt SPIT-Nachrichten, in einem Kommunikationsnetzwerk
CN112422756A (zh) 自动化智能拨打方法、装置及计算机可读存储介质
EP3226527B1 (fr) Système de communication par téléphone destiné à détecter l'utilisation abusive dans un réseau téléphonique public
WO2007113106A1 (fr) Procédé et dispositifs permettant de réduire la réception de messages indésirables, en particulier de spams, de messages abrégés sous le nom de spit, utilisant la téléphonie sur ip, dans un réseau de communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 06778297

Country of ref document: EP

Kind code of ref document: A1