WO2011069438A1 - Working method and system for self-learning intellectualized short message firewall of mobile terminal - Google Patents

Abstract

A working method and system for self-learning intellectualized short message firewall of mobile terminal are provided in the present invention. According to another embodiment of the present invention, a working method for self-learning intellectualized short message firewall of mobile terminal is provided, and includes the following steps: the transmission of the short message is monitored, the number and the corresponding process name or software name are matched by the client side when a short message is transmitted, and it is judged whether the process name or software name of the transmitted short message belongs to the local black list; if the process name or software name of the transmitted short message belongs to the local black list, the transmission of the short message is stopped. Furthermore, it can be judged that the process name or software name of the transmitted short message belong to one of the black list, the white list, the rascal software and the green software or the combination with the method of the present invention. The system and method of the present invention can solve the problem in a dilemma that both the behavior that the malicious and rascal software transmits short message automatically must be avoided and the behavior that the normal manufacturer and production transmit short message must be taken account of.

Description

 Self-learning mobile terminal intelligent SMS firewall working method and system

 The present invention relates to the field of mobile communications, and more particularly to an intelligent short message firewall system for a mobile terminal. Background technique

 With the increasing popularity of mobile terminals, the application software on mobile terminals is becoming more and more abundant, and the entire industry is booming. However, the security risks that come with it are also growing. Among them, malicious and rogue deductions through SMS billing have become a stumbling block to the healthy development of the wireless Internet.

 In response to this problem, some SMS firewall software has appeared on the market, the original intention is to avoid sneaking SMS and other rogue behaviors.

 However, in today's software, the implementation mechanism is very simple. The user either chooses to block all of them, or reminds the user to confirm the operation each time a text message is sent. All of these methods have a common drawback: not smart, can't distinguish scenes, User use is not convenient. Summary of the invention

 In order to better solve the problem of preventing the malicious texting of rogue software (trojans), it is also necessary to take into account the dilemma of sending SMS messages by regular manufacturers and products (accepted by users). A self-learning mobile terminal SMS firewall system is proposed. The system includes a smart SMS firewall and a high-intensity SMS firewall.

 According to an aspect of the present invention, a self-learning mobile terminal intelligent SMS firewall working method includes the following steps: monitoring the sending of a short message, when a short message is sent, the client matches the number with the corresponding process name or software name. And determine whether the process name or software name of the sent SMS belongs to the local "blacklist"; if the process name or software name of the sent SMS is in the local "blacklist", the short message is sent.

Further, if the process name or software name of the short message is not in the local "blacklist", the client determines whether it belongs to the local "whitelist"; if the process name or soft of the short message is sent The name of the item is in the local "white list", and the text message is allowed to be sent. In addition, if the process name or software name of the short message is not in the local "white list", the user may be reminded that a certain process or software is ready to send a text message, requesting the user to determine whether to allow the text message to be sent. After the user determines whether to allow the sending of the short message, the user may be prompted to classify the above-mentioned process or software for sending the short message that does not appear in the local "white list" or "black list".

 Further, if the process name or the software name of the short message is not in the local "white list", it is determined according to the classification of the SMS firewall knowledge base whether the process or software for sending the short message belongs to "rogue software"; if the process or software for sending the short message is "Rogue software" terminates the sending of text messages.

 Further, if the process or software for sending the short message is not "rogue software", it is judged whether the process or software for sending the short message belongs to "green software"; if the process or software for sending the short message is "green software", the short message is allowed to be sent.

 Further, if the process or software for sending the short message is not "green software", the user is reminded that a certain process or software is ready to send a text message, requesting the user to determine whether to allow the text message to be sent. In addition, after the user determines whether to allow the short message to be sent, the user enters the SMS firewall knowledge base establishment process to classify the unclassified process or software.

 According to another aspect of the present invention, the SMS firewall knowledge base establishing process includes: the short message monitoring sub-module of the client listens to all sent short messages; the client analyzes all the successfully sent short messages, and the client prompts the corresponding short messages. And matching the corresponding process name or software name to inform the user; the user makes a judgment on the process or software behavior of sending the short message, and sets the process or software to the "report" or "trust" type; after the setting is completed, Report the setting result to the server; the server stores the setting result reported by all users, and performs statistical calculation analysis periodically, when the process or software of the type of "report" or "trust" is set, the proportion or When the threshold meets a certain condition, it is arbitrarily determined by the system as "rogue software" or "green software"; the system stores or updates this result to the SMS firewall knowledge base of the server; the client periodically updates the client's SMS firewall with the server. The data in the knowledge base.

According to another aspect of the present invention, a self-learning mobile terminal intelligent short message firewall system is provided, including a client module and a server. The client module is responsible for monitoring the important events of the mobile terminal, and accumulating knowledge, communicating with the server, including: The stator module is used to set the working mode of the firewall; the short message monitoring sub-module monitors all sent and received short messages; the short message intercepting sub-module intercepts, judges, and reminds the short message; the client knowledge accumulation sub-module, operates on all users , setting data information, performing record buffering, and determining the processing method of the short message; the client communication sub-module is responsible for transmitting the knowledge data information with the server. The server is responsible for storing the data from the client, statistical calculation of the data, and communicating with the client, including: a server knowledge accumulation sub-module, storing knowledge data information from the client; a statistical calculation sub-module, responsible for calculating the knowledge data information , analysis; server communication sub-module, responsible for the transfer of knowledge data information with the client.

 The present invention essentially describes a method for establishing a short message firewall by means of human-computer interaction, relying on the knowledge accumulation of the server for statistical calculation, and for comprehensive conditions such as different user characteristics. This SMS firewall has a very important feature, which is self-learning. The system includes two modes of operation: intelligent SMS firewall and high-intensity SMS firewall, which can meet the needs of different users.

 The system and method of the invention well solves the problem of preventing automatic malicious texting of malicious and rogue software (trojan program), and also takes into consideration the dilemma of sending text messages by regular manufacturers and products (approved by users) in the market. problem.

 Moreover, the system of the present invention is a self-learning system that continuously improves the accuracy of the SMS firewall. DRAWINGS

 The technical scheme of the present invention can be better understood by reading the description of the present invention with reference to the accompanying drawings. The drawings of the present invention are only illustrative of a preferred embodiment of the present invention, wherein: FIG. 1 is a process for establishing a knowledge base of a short message firewall;

 Figure 2 is the workflow of the intelligent SMS firewall;

 Figure 3 is the workflow of the high-intensity SMS firewall;

 Figure 4 is a block diagram of the system module. detailed description

The invention essentially describes a method for establishing a short message by means of human-computer interaction, relying on the knowledge accumulation of the server for statistical calculation, and for comprehensive conditions such as different user characteristics. Firewall. This SMS firewall has a very important feature, which is self-learning. The short message firewall system of the invention comprises two working modes: an intelligent short message firewall and a high-intensity short message firewall, which can meet the demand scenarios of different users.

 The SMS firewall system of the present invention needs to establish a knowledge base of the SMS firewall, wherein the short message firewall system is composed of a client and a server, and a knowledge base of the SMS firewall is established in both the client and the server. The SMS firewall knowledge base is the most primitive in the server, and then synchronized to the client. The process of establishing the SMS firewall knowledge base will be described below with reference to FIG.

 As an example, the establishment process of the SMS firewall knowledge base of the present invention is as follows:

 Step S101: After the client is installed in the mobile terminal, the short message monitoring sub-module of the client starts working and listens to all sent short messages.

 Step S102: The client analyzes all the successfully sent short messages, including, for example, a number, content, and the like. For example, the number is a specific number segment (sp number starting with 106 in mainland China), and the content contains a typical string of the current industry standard ordering SMS format. Corresponding to these short messages, the client will prompt and match the corresponding process name or software name to inform the user.

 Step S103: The user makes a judgment on the process or software behavior of sending the short message, and sets the process or software to the "report" or "trust" type.

 Step S104: After the setting is completed, the setting result is reported to the server.

 Step S105: The server stores the setting result reported by all the users, and performs statistical calculation analysis periodically. When a process or software of the type set to "report" or "trust" is set to a certain ratio or threshold that satisfies a certain condition, it is arbitrated by the system as "rogue software (for example, Trojans)", "green" software". The system stores or updates this result to the SMS firewall knowledge base on the server side.

For example, when a process or software is set to a "report" type ratio that exceeds a predetermined ratio, the predetermined ratio may be 50%, preferably 30%, more preferably 10%, then the process or software is determined by the server as " Rogue software", for example, Trojans. Alternatively, when the number of times a process or software is set to the "report" type exceeds a set threshold, the threshold may be 20 times, preferably 10 times, more preferably 5 times, then the process or software is ruled by the server as " Rogue software". The predetermined ratio and the predetermined threshold may be set according to specific conditions such as the security level. Set.

 Similarly, when a process or software is set to a "trust" type ratio exceeding a predetermined ratio, the predetermined ratio may be 60%, preferably 80%, more preferably 90%, then the process or software is determined by the server as "green software". Alternatively, when the number of times a process or software is set to the "trust" type exceeds a set threshold, the threshold may be 100 times, preferably 150 times, more preferably 200 times, then the process or software is ruled by the server as " green software". The predetermined ratio and the predetermined threshold may be set according to specific conditions such as the security level.

 Step S106: The client periodically updates the data in the client's SMS firewall knowledge base with the server. The method of synchronization includes a method such as client active network acquisition, server sending SMS instruction, and the like.

 Step S107: This process ends.

 The short message firewall knowledge base of the invention can continuously self-learn, update knowledge, and constantly approach the real industrial environment.

 Specifically, an example of self-learning is exemplified as follows:

 When a software A is "reported" by 50% of users due to some malicious behavior, then software A is rated as rogue software, and all text messages sent by software A will be intercepted.

 However, as service providers continue to improve the software and are recognized by users. After a period of time, software A is "trusted" by 60% of users. Then, software A is no longer rogue software, it becomes green software, and all text messages sent by software A will be issued normally.

 In this way, the SMS firewall knowledge base continuously learns according to the judgment of the user, updates the knowledge, and constantly approaches the real industrial environment.

 The SMS Firewall Knowledge Base is a classification database of processes/software that divides processes/software into trusted and untrusted categories. For example, "green software" is trusted and "rogue software" is untrusted. When these processes/software send SMS messages, the system will process them according to the type, such as allowing sending and terminating sending.

The process/software of the mobile terminal can be included in the process/software "blacklist" and the process/software "whitelist" respectively. Among them, "blacklist" and "whitelist" can be manually edited by the user. A list of processes/software that can be maintained locally on the client. When the process/software in the process/software "blacklist" sends a text message, the system terminates the transmission. When the process/software in the process/software "whitelist" sends a text message, the system will allow the transmission. Can also initialize or preset some "white name" For example, the "blacklist" and "whitelist" can be set in the following ways:

 Method 1: The server sends the settings. Specifically, the "blacklist" and "whitelist" set by the server can be synchronized by the client network; or the server can send a short message instruction to the client to complete the setting of "blacklist" and "whitelist". Update.

 Method 2: The user manually enters the settings in the client.

 According to an embodiment of the present invention, the "blacklist" and "whitelist" can be used together with the SMS firewall knowledge base to complete the interception and release of the sent SMS.

 According to an embodiment of the present invention, the workflow of the intelligent short message firewall mode is as follows: When a short message is sent, the client matches the number with the corresponding process name or software name, and determines whether the process name or software name of the sent short message belongs to the local "blacklist"? If the process name or software name of the sent SMS is in the local "blacklist", the SMS transmission is terminated and the process ends. If the process name or software name of the sent SMS is not in the local "blacklist", the short message is allowed to be sent and the process ends. This mode of operation has a lower security level, as long as processes or software that are not part of the "blacklist" are sending text messages, they are usually allowed to be sent.

 Preferably, if the process name or software name of the short message is not in the local "blacklist", the client further determines whether the process name or software name of the sent short message belongs to the local "white list"? If the process name or software name of the text message is in the local "white list", the short message is allowed to be sent, and the process ends. If the process name or software name of the sent SMS is not in the local "white list", the user is reminded which process or software is ready to send a text message, requesting the user to determine whether to allow the text message to be sent. You can then enter the local "whitelist" and "blacklist" settings interface to classify processes or software that do not appear in the local "whitelist" or "blacklist". This mode of operation is more secure than the previous mode, and processes or software that are not in the "blacklist" and in the "whitelist" can automatically send text messages. For processes or software that do not appear in the local "whitelist" or "blacklist", customers can confirm and categorize them.

 In addition, when the client is working, it will combine the data of the client's SMS firewall knowledge base, process/software "blacklist", and process/software "whitelist" to make a comprehensive judgment and process the sent SMS.

According to another embodiment of the present invention, the workflow of the intelligent SMS firewall mode is as follows: Monitoring the sending of a short message, when a short message is sent, the client will number and the corresponding process Does the name or software name match, and determine whether the process name or software name of the sent SMS belongs to the local "blacklist"? If the process name or software name of the short message is in the local "blacklist", the short message is sent, and the process ends. If the process name or software name of the sent SMS is not in the local "blacklist", does the client determine whether it belongs to the local "whitelist"? If the process name or software name of the text message is in the local "white list", the text message is allowed to be sent, and the process ends. If the process name or software name of the short message is not in the local "white list", according to the classification of the SMS firewall knowledge base, it is judged whether the process or software for sending the short message belongs to "rogue software"? If it is "rogue software", the SMS is terminated and the process ends. If it is not "rogue software", it is judged whether it belongs to "green software". If it is "green software", SMS is allowed to be sent, and the process ends. If it is not "green software", it reminds the user which process or software is ready to send a text message, asks the user to judge whether to allow the text message to be sent, and then enters the SMS firewall knowledge base establishment process to classify the unclassified process or software. This mode of operation has the highest level of security and requires simultaneous processing of processes or software that are not in the "blacklist" and in the "whitelist", and that belong to "greenware" that does not belong to "rogue software" to automatically send text messages. For the unclassified process or software in the SMS firewall knowledge base, the customer needs to be confirmed and classified.

 Certainly, the workflow of the intelligent short message firewall mode of the present invention is not limited to the above manner, and may determine whether it belongs to one of "blacklist", "whitelist", "rogue software" and "green software" according to the security level requirement or Its combination. For example, a process or software belonging to a "blacklist" or "rogue software" does not allow automatic sending of text messages; processes or software belonging to "whitelisting" or "greenware" allow automatic sending of text messages. It can also be set as needed. Only processes or software that are both "whitelisted" and "greenware" are allowed to automatically send text messages. In addition, for processes or software that are not in the "blacklist", "whitelist", "rogue software" and "greenware", the user can set or not allow automatic sending of text messages depending on the situation.

In addition, the order of the workflow of the intelligent short message firewall mode of the present invention is not limited to the above manner, and may also be determined according to the classification of the SMS firewall knowledge base to determine whether it belongs to "rogue software". If it is "rogue software", the SMS is terminated and the process ends. If it is not "rogue software", it is judged whether it belongs to "green software". If it is "green software", SMS is allowed to be sent, and the process ends. If it is not "green software", the client matches the number with the corresponding process name or software name and determines whether it is a local "blacklist"? If in this In the "blacklist", the SMS is terminated and the process ends. If it is not in the local "blacklist", does the client determine whether it belongs to the local "whitelist"? If it is in the local "white list", SMS is allowed to be sent, and the process ends. If it is not in the local "white list", the user is reminded which process or software is ready to send a text message, requesting the user to determine whether to allow the text message to be sent. You can then enter the local "whitelist" and "blacklist" settings interface to classify processes or software that do not appear in the local "whitelist" or "blacklist".

 The workflow of the intelligent SMS firewall mode will be described below with reference to FIG. According to an embodiment of the present invention, the workflow of the intelligent SMS firewall mode is as follows:

 Step S201: Monitoring has a short message sent.

 Step S202: The client matches the number with the corresponding process name or software name, and determines whether it belongs to the local "blacklist"? If it is a local "blacklist", the short message transmission is terminated, and the process goes to step S206; otherwise, the process goes to step S203.

 Step S203: The client matches the number with the corresponding process name or software name, and determines whether it belongs to the local "white list"? If it is a local "white list", the short message transmission is allowed, and the process goes to step S206; otherwise, the process goes to step S204.

 Step S204: The client matches the number with the corresponding process name or software name, and determines whether it belongs to "rogue software (trojan program)"? If so, the short message transmission is terminated, and the process goes to step S206; otherwise, the process goes to step S205.

 Step S205: The client matches the number with the corresponding process name or software name, and determines whether it belongs to "green software". If yes, the message is allowed to be sent, and the process proceeds to step S206; otherwise, the message is allowed to be sent, and after successful transmission, the reminder The user then enters the SMS firewall knowledge base to establish the process.

 Step S206: The process ends.

 In addition, the system provides a high-intensity firewall mode that intercepts all software to send text messages. The workflow of the high-intensity firewall mode is described with reference to FIG. 3.

 Step S301: A short message is about to be sent.

 Step S302: The client matches the number with the corresponding process name or software name, and interrupts the sending of the short message;

Step S303: Prompt the user to allow the process to send a short message? If the user allows, continue to send text messages; if the user does not allow, stop sending text messages. Step S304: The process ends.

 The high-intensity firewall mode actively intercepts all software to send text messages to remind users that the user is allowed to send text messages.

 The intelligent short message firewall system of the mobile terminal of the present invention comprises a client module M100 and a server M200. Referring to Fig. 4, a mobile terminal intelligent short message firewall system of the present invention will be described.

 The client module M100 of the mobile terminal intelligent SMS firewall system is responsible for monitoring the important events of the mobile terminal, and accumulating knowledge, and communicating with the server, including: a mode setting sub-module M101, which is used to set the working mode of the firewall, the user can Manually set the working mode of the firewall as needed, for example: high-intensity firewall mode, intelligent SMS mode that determines whether it is one of "blacklist", "whitelist", "rogue software" and "green software" or a combination thereof; The short message monitoring sub-module M102 listens to all sent and received short messages; the short message intercepting sub-module M104 intercepts, judges, and reminds the short message; the client knowledge accumulation sub-module M103 performs recording and buffering on all user operations and setting data information. And decide on the processing method of the short message; the client communication sub-module M105 is responsible for the transfer of the knowledge data information with the server.

 The mode setting sub-module M101 informs the short message intercepting sub-module M104 which working mode is enabled; the client knowledge accumulation sub-module M103 notifies the user setting information of the software to the client communication sub-module M105; the client communication sub-module M105, the user's setting information of the software is notified to the server communication sub-module M201. Similarly, the client communication sub-module M105 also receives the SMS firewall knowledge base information transmitted from the server communication sub-module M201, and transmits it to the client knowledge accumulation sub-module M103 to update the SMS firewall knowledge base.

 The SMS monitoring sub-module M102, to know the short message sending event, immediately informs the short message intercepting sub-module M104. The SMS interception sub-module M104, according to the client knowledge accumulation sub-module M103, the SMS firewall knowledge base and/or the local "blacklist" and "whitelist", performs corresponding interception, judgment, prohibition or release processing.

The server M200 of the mobile terminal intelligent SMS firewall system is responsible for storing the data from the client, the statistical calculation of the data, and communicating with the client, including: the server knowledge accumulation sub-module M203, storing the knowledge data information from the client; The operator module M202 is responsible for the calculation and analysis of the knowledge data information; the server communication sub-module M201 is responsible for the transfer of the knowledge data information with the client.

 The communication sub-module M201 receives the setting information of the software of the user of the communication sub-module M105, and transmits it to the statistical calculation sub-module M202. The statistical calculation sub-module M202 performs statistical calculation on all user setting information, updates the result to the server knowledge accumulation sub-module M203, and the server knowledge accumulation sub-module M203 updates the SMS firewall knowledge base. The server knowledge accumulation sub-module M203 transmits the latest SMS firewall knowledge base to the client communication sub-module M105 through the server communication sub-module M201.

 It can be seen from the above description that the present invention substantially describes a method for human-computer interaction, relies on the knowledge accumulation of the server for statistical calculation, and establishes a short message firewall for different user characteristics and other comprehensive conditions. This SMS firewall has a very important feature, which is self-learning. The system includes multiple working modes such as intelligent SMS firewall and high-intensity SMS firewall, which can meet the needs of different users.

 The working method and system of the intelligent self-learning mobile terminal intelligent SMS firewall solve the problem of preventing automatic malicious texting of malicious and rogue software (trojan program), and also taking into consideration the regular manufacturers and products in the market ( The majority of users recognize the dilemma of sending text messages. Moreover, the system is a self-learning system that continuously improves the accuracy of the SMS firewall.

 The above description of the specific illustrative embodiments of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention. The illustrative embodiments have been chosen and described in order to explain the embodiments of the invention and the embodiments of the invention The scope of the invention is defined by the appended claims and their equivalents.

Claims

Claims: 1. A self-learning mobile terminal intelligent SMS firewall working method, comprising the following steps:  Monitoring the sending of the short message, when a short message is sent, the client matches the number with the corresponding process name or software name, and determines whether the process name or software name of the sent short message belongs to the local "black list";  If the process name or software name of the sent SMS is in the local "blacklist", the short message is sent. 2. The method of claim 1 further comprising:  If the process name or software name of the sent SMS message is not in the local "blacklist", the client determines whether it belongs to the local "whitelist";  If the process name or software name of the text message is in the local "white list", the short message is allowed to be sent. 3. The method of claim 2, further comprising:  If the process name or software name of the short message is not in the local "white list", it is judged according to the classification of the SMS firewall knowledge base whether the process or software for sending the short message belongs to "rogue software";  If the process or software that sends the SMS is "rogue software", the SMS transmission is terminated. 4. The method of claim 3, further comprising:  If the process or software that sends the SMS is not "rogue software", it is determined whether the process or software that sent the SMS belongs to "green software";  If the process or software that sends the SMS is "green software", SMS is allowed to be sent. 5. The method of claim 4, further comprising: If the process or software that sends the SMS is not "green software", the user is reminded that a certain process or software is ready to send a text message, requesting the user to determine whether to allow the text message to be sent. 6. The method of claim 5, further comprising:  After the user determines whether to allow the sending of the short message, the user enters the SMS firewall knowledge base to establish a process for classifying the unclassified process or software. 7. The method of claim 6, wherein the SMS firewall knowledge base establishment process comprises:  The short message monitoring submodule of the client listens to all sent short messages;  The client analyzes all the successfully sent SMS messages. Corresponding to these SMS messages, the client will prompt and match the corresponding process name or software name to inform the user;  The user makes a judgment on the process or software behavior of the outgoing SMS and sets these processes or software to the "report" or "trust" type;  After the setting is completed, the setting result is reported to the server;  The server stores the setting results reported by all users, and performs statistical calculation analysis periodically. When a process or software of the type of "reporting" or "trust" is set, the set ratio or threshold meets a certain condition, Ruling by the system as "rogue software" or "green software";  The system stores or updates this result to the SMS firewall knowledge base on the server side; the client periodically updates the data in the client's SMS firewall knowledge base with the server. 8. The method of claim 2, further comprising:  If the process name or software name of the short message is not in the local "white list", the user is reminded that a certain process or software is ready to send a text message, requesting the user to determine whether to allow the text message to be sent. 9. The method of claim 3, further comprising:  After the user determines whether to allow the sending of the short message, the user is prompted to classify the above-mentioned process or software for sending the short message that does not appear in the local "white list" or "black list". 10. A self-learning mobile terminal intelligent SMS firewall system, including a client module and a server, The client module is responsible for monitoring the important events of the mobile terminal, and accumulating knowledge, communicating with the server, including:  a mode setting sub-module for setting a working mode of the firewall;  The SMS monitoring sub-module monitors all sent and received short messages;  The SMS interception sub-module intercepts, judges, and reminds the short message; the client knowledge accumulation sub-module performs recording and buffering on all user operations and setting data information, and determines the processing method of the short message;  The client communication sub-module is responsible for transmitting the knowledge data information with the server;  The server is responsible for storing data from the client, statistical calculation of the data, and communicating with the client, including:  a server knowledge accumulation sub-module for storing knowledge data information from the client;  Statistical calculation sub-module, responsible for the calculation and analysis of knowledge data information; server communication sub-module, responsible for the transmission of knowledge data information with the client