阅读说明：本技术 基于机器学习的欺诈呼叫检测系统及其控制方法 (Fraud call detection system based on machine learning and control method thereof ) 是由 金钟柱 于 2019-12-18 设计创作，主要内容包括：本发明公开一种基于机器学习的欺诈呼叫检测系统及其控制方法。本发明的欺诈呼叫检测系统的控制方法,包括如下步骤：提取或接收预存储的通话连接处理数据,按字段通过预设定的演算法进行正规化处理,以使形成相同的长度；将在上述步骤中正规化处理的数据作为输入值进行机器学习,而决定人工智能系统的各个参数；将实时通话连接数据和CDR(Call Detail Record)数据中至少一个适用于所述人工智能系统,而判断欺诈呼叫。(The invention discloses a fraud call detection system based on machine learning and a control method thereof. The control method of the fraudulent calling detection system of the present invention includes the following steps: extracting or receiving pre-stored call connection processing data, and performing normalization processing according to fields by a preset algorithm to form the same length; performing machine learning by using the normalized data as an input value to determine each parameter of the artificial intelligence system; at least one of real-time call connection data and CDR (Call Detail record) data is applied to the artificial intelligence system to determine fraudulent calls.)

1. A method for controlling a fraudulent call detection system, comprising the steps of:

(a) extracting or receiving pre-stored call connection processing data, and performing normalization processing according to fields by a preset algorithm to form the same length;

(b) performing machine learning by using the normalized data in the step (a) as an input value to determine each parameter of the artificial intelligence system;

(c) at least one of real-time call connection data and CDR (Call Detail record) data is applied to the artificial intelligence system to determine fraudulent calls.

2. The method of controlling a fraudulent call detection system according to claim 1,

in the step (a), the call connection processing data is used to extract call time data of each call connection (call), 1 minute cumulative number of call connections for each calling number, 5 minute cumulative number of call connections for each calling number, 60 minute cumulative number of call connections for each calling number, 5 minute sum of call times for each calling number, 60 minute sum of call times for each calling number, after statistical data of 1 minute accumulated call connection times of each called number, 5 minutes accumulated call connection times of each called number, 60 minutes accumulated call connection times of each called number, 5 minute-period call time accumulated sum of each called number, and 60 minute-period call time accumulated sum of each called number, normalization processing is additionally performed on the corresponding statistical data,

the step (b) includes performing machine learning on data obtained by normalizing the statistical data.

3. The method of controlling a fraudulent call detection system according to claim 2,

in the step (b), after the one-dimensional image data is formed from the data normalized in the step (a), the CNN (volumetric Neural network) performs machine learning on the corresponding one-dimensional image data, thereby determining each parameter of the CNN.

4. The method of controlling a fraudulent call detection system according to claim 1,

and (c) if the call connection is a connection through a Network, extracting call connection data in real time, then applying the corresponding call connection data to the artificial intelligence system to judge a fraudulent call, and if the call connection is a connection through a Public Switched Telephone Network (PSTN), applying CDR information stored after the corresponding call connection is ended to the artificial intelligence system to judge a fraudulent call.

5. A computer-readable recording medium storing a program for executing the method of any one of claims 1 to 4.

6. An application program stored on a computer-readable recording medium for executing the method of one of claims 1 to 4 in combination with hardware.

7. A fraudulent call detection system comprising:

a data normalization processing unit which extracts or receives pre-stored call connection processing data and normalizes the data by a predetermined algorithm for each field to have the same length;

a machine learning processing unit that performs machine learning using the data normalized by the data normalization processing unit as an input value, and determines each parameter of the artificial intelligence system;

and a judging unit for judging fraudulent calling by applying at least one of real-time call connection data and CDR (Call Detail record) data to the artificial intelligence system.

8. The fraudulent call detection system of claim 7,

the data normalization processing unit extracts statistical data including call time data of each call connection (call), 1 minute cumulative call connection count of each calling number, 5 minute cumulative call connection count of each calling number, 60 minute cumulative call connection count of each calling number, 5 minute call time cumulative sum of each calling number, 60 minute call time cumulative sum of each calling number, 1 minute cumulative call connection count of each called number, 5 minute cumulative call connection count of each called number, 60 minute cumulative call connection count of each called number, 5 minute call time cumulative sum of each called number, 60 minute cumulative call time sum of each called number, 60 minute call time cumulative sum of each called number, and 60 minute call time cumulative sum of each called number, by using the call connection processing data, and additionally performs normalization processing on the corresponding statistical data,

the machine learning processing unit performs machine learning by including data for normalizing the statistical data.

9. The fraudulent call detection system of claim 8,

the machine learning processing unit forms the data normalized by the data normalization processing unit into one-dimensional image data, and then performs machine learning on the corresponding one-dimensional image data by a CNN (volumetric Neural network) to determine each parameter of the CNN.

10. The fraudulent call detection system of claim 7,

the judging part is used for judging a fraudulent call by applying the corresponding call connection data to the artificial intelligence system after extracting the call connection data in real time if the call connection is the connection through the Network, and is used for judging a fraudulent call by applying the CDR information stored after finishing the corresponding call connection to the artificial intelligence system if the call connection is the connection through a Public Switched Telephone Network (PSTN).

Technical Field

The present invention relates to a fraud call detection system and a control method thereof, and more particularly, to a fraud call detection system based on machine learning and a control method thereof.

Background

Recently, many individuals or businesses have gained illegal interest by making call connections through wired or internet phones with malicious intent.

For example, when a phone is called from overseas to abroad to ring, the call connection is quickly disconnected, and the called party is induced to make a call to overseas in reverse, whereby inappropriate network connection charges are acquired.

Such fraudulent calls pose various problems, and therefore, carriers have been researching various schemes for detecting such fraudulent calls.

However, conventionally, fraudulent call detection is performed based on a rule set by a manager according to a fraudulent call pattern, and in this case, there is a problem that the fraudulent call pattern is not detected even if it is slightly changed (for example, the country and area number of the caller are changed).

Therefore, it is desirable to provide a scheme that can be easily detected even if a fraudulent call pattern is changed.

(prior patent document 1) Korean patent laid-open publication No. 10-2011-

Disclosure of Invention

Technical problem to be solved by the invention

In order to solve the above-mentioned problems, an object of the present invention is to provide a system capable of adaptively detecting a fraudulent call even if a fraudulent call pattern is changed, and a control method thereof.

Technical scheme for solving problems

In order to achieve the above object, a fraudulent call detection system according to the present invention comprises: a data normalization processing unit which extracts or receives pre-stored call connection processing data and normalizes the data by a predetermined algorithm for each field to have the same length; a machine learning processing unit that performs machine learning using the data normalized by the data normalization processing unit as an input value, and determines each parameter of the artificial intelligence system; and a judging unit for judging fraudulent calling by applying at least one of real-time call connection data and CDR (Call Detail record) data to the artificial intelligence system.

In order to achieve the above object, a method for controlling a fraudulent call detection system according to the present invention includes the steps of: extracting or receiving pre-stored call connection processing data, and performing normalization processing according to fields by a preset algorithm to form the same length; performing machine learning by using the normalized data as an input value to determine each parameter of the artificial intelligence system; at least one of real-time call connection data and CDR data is applied to the artificial intelligence system to determine fraudulent calls.

Drawings

Fig. 1 is a schematic configuration diagram of an overall system including a fraudulent call detection system according to an embodiment of the present invention;

FIG. 2 is a functional block diagram of the fraudulent call detection system of FIG. 1;

fig. 3 is a diagram showing an example of data that can be acquired in real time for a network call;

FIG. 4 is a diagram illustrating an example of data in FIG. 3 additionally reflecting statistics generated by a fraudulent call detection system according to one embodiment of the present invention;

FIG. 5 is a diagram illustrating an example of data that may be obtained from a CDR stored as a result of a call over the PSTN;

FIG. 6 is a diagram illustrating an example of data in FIG. 5 additionally reflecting statistics generated by a fraudulent call detection system according to one embodiment of the present invention;

FIG. 7 is a diagram showing a CNN processing structure;

fig. 8 is a diagram showing a process of cumulatively storing data that can be acquired in real time for a network call, and performing machine learning based on the cumulatively stored data as described above;

fig. 9 is a diagram showing a procedure of accumulating necessary data in CDR data stored after a PSTN call is made, and performing machine learning based on the data accumulated and stored as described above.

Best mode for carrying out the invention

The present invention is described in detail below with reference to the accompanying drawings.

The following embodiments according to the present invention are merely examples to facilitate understanding of the present invention, and the present invention is not limited to the above-described embodiments. In particular, the present invention may be constituted by at least one of individual constitutions, individual functions, or a combination of at least one of individual steps included in each embodiment.

In particular, the use of the alphabet such as '(a)' in some portions of the claims is included for convenience, but such alphabet does not dictate the order of the various steps.

Also, each signal described in the following embodiments according to the present invention may mean one signal transmitted by one connection or the like, but may also mean a series of signal groups transmitted for the purpose of performing characteristic functions described later. That is, for convenience, a plurality of signals to be transmitted at a predetermined time interval in each embodiment or transmitted after receiving a response signal from a counterpart device may be represented by one signal name.

A schematic configuration of an overall system including a fraudulent call detection system according to an embodiment of the present invention is shown in fig. 1.

In this drawing, a calling terminal is a terminal that makes a call to an opposite party, and a called terminal is a terminal that receives a call from an opposite party.

As described above, there is a call connection processing system in the middle of the communication path between the calling terminal and the called terminal, and the call connection processing system has a function of receiving a call connection invitation from the calling terminal, performing authentication processing and call connection processing with the called terminal, and further performing a function of managing call connection between the calling terminal and the called terminal and information related to the call, that is, call connection processing data.

As described above, the procedure of calling, receiving, call connection, and storing call connection processing data among the calling terminal, the called terminal, and the call connection processing system corresponds to a known technique, and thus, detailed description thereof is omitted.

The fraudulent call detection system executes a function of judging whether each call connection is a fraudulent call after a preset time has elapsed from the start point of the call connection or after the call connection is made with the call connection processing system.

In particular, in order to perform fraudulent call detection in real time, a device for packet mirroring or port mirroring between the call connection processing system and the fraudulent call detection system may be formed, which is also a well-known technique, and thus, a detailed description thereof will be omitted.

Fig. 2 shows an example of detailed functional blocks of the fraudulent call detection system.

As shown in the drawing, the fraudulent call detection system is constituted by: a data normalization processing unit, a machine learning processing unit, and a determination unit.

The data normalization processing unit is configured to extract or receive pre-stored call connection processing data, and perform normalization processing by field by a preset algorithm so as to have the same length.

Here, the Call connection processing data may be real-time data of a starting point at which a Call connection occurs, or Call Detail Record (CDR) data stored after the Call connection is terminated. If the data normalization processing unit itself stores the call connection processing data, the data normalization processing unit extracts the data or receives the data from an external server (200).

In particular, the data normalization processing unit normalizes the call connection processing data by field, and for example, when the normalized size of the caller id field is 15 bits and the caller id included in the call connection processing data is' 010-.

In particular, the data normalization processing unit not only normalizes the extracted and received call connection processing data, but also normalizes the generated statistical data after generating predetermined statistical data based on the extracted and received call connection processing data.

For example, the data normalization processing section extracts data including call time data of each call connection (call), 1 minute cumulative call connection count of each calling number, 5 minute cumulative call connection count of each calling number, 60 minute cumulative call connection count of each calling number, call time cumulative sum during 5 minutes of each calling number, 60 minute call time cumulative sum of each calling number, using the extracted/received call connection processing data, and (3) additionally carrying out normalization processing on corresponding statistical data after statistical data of 1-minute accumulated call connection times of all called numbers, 5-minute accumulated call connection times of all called numbers, 60-minute accumulated call connection times of all called numbers, 5-minute-period call time accumulated sums of all called numbers and 60-minute call time accumulated sums of all called numbers.

Fig. 3 to 6 show an example of data processed by the data normalization processing unit.

First, fig. 3 and 4 show a case where call connection data can be acquired in real time as in a Network Telephone, and fig. 5 and 6 show a case where call connection data cannot be acquired in real time as in a (Public Switched Telephone Network).

In detail, fig. 3 shows call connection processing data that can be acquired in real time in the past when a network telephone using a Session Initiation Protocol (SIP); fig. 4 shows a state in which the predetermined statistical data is added based on the call connection processing data.

Fig. 5 shows an example of CDR data stored in communication via the PSTN; fig. 6 shows a state in which the predetermined statistical data is added based on the CDR data.

The machine learning processing unit has a function of performing machine learning in which data normalized by the data normalization processing unit is used as an input value, and determining and reflecting each parameter of the artificial intelligence system.

That is, the artificial intelligence system, particularly, deep learning which is a kind of machine learning, can differ in the result according to the parameter value of each layer forming the neural network, and the function of the machine learning processing unit is to determine the parameter value of each layer by machine learning and reflect it to the corresponding artificial intelligence system. The process of machine learning corresponds to the process of calculating the parameter values (for example, row and column values) of each layer of the artificial intelligence system as described above, and is a known technique, and therefore, a detailed description thereof will be omitted.

In this case, the machine learning processing unit may perform machine learning using all normalized data generated by the data normalization processing unit, and may perform machine learning including data normalized based on the statistical data described above.

The machine learning processing unit executes a function unique to the processing of machine learning, that is, forms data normalized by the data normalization processing unit into one-dimensional image data, performs machine learning on the corresponding one-dimensional image data by a Convolutional Neural Network (CNN), determines each parameter of the CNN, and reflects the parameter.

As an example of a process of forming a one-dimensional image, a case of using a part of the data of fig. 3(b) will be described, in which the data normalization processing section generates normalized data of '121111000001', '212000000112', '004', and '015', respectively, when the CALLER IP (CALLER _ IP), the called IP (CALLER _ IP), the 1-minute accumulated number of CALL connections (EXT _ CALL _ COUNT _1MIN) of the corresponding CALLER IP, and the 5-minute accumulated number of CALL connections (EXT _ CALL _ COUNT _5MIN) of the corresponding CALLER IP are '121.111.0.1', '212.0.0.112', '4', '15', respectively, and then generates data '121111000001212000000112004015' connecting the normalized data in a row, and forms the data into one-dimensional image data.

Here, the one-dimensional image is an image in which pixels are connected to each other only in one direction (for example, in the horizontal direction) and are not connected to each other in the other direction (for example, in the vertical direction).

As described above, the machine learning processing unit that performs the one-dimensional imaging process performs machine learning on the corresponding one-dimensional image by the CNN, determines and reflects each parameter of the CNN.

Fig. 5 shows a process of processing a one-dimensional image having n pixels by applying the one-dimensional image to the CNN algorithm.

Referring to fig. 7, as a model of AI (artificial intelligence), a neural network is configured by an Input (Input) which inputs data encoded in a normalized manner with respect to the real-time data and CDR data described above, a Layer (Layer), a prediction (Predict Result), an actual value (Target), a Loss Function (Loss Function), and an Optimizer (Optimizer).

The Layer (Layer) is a Layer constituting a neural network, and is modeled in a manner most suitable for a one-dimensional convolution Layer (Layer1Dimension CNN) algorithm in order to be suitable for real-time data processing and CDR data processing.

A Loss Function (Loss Function) is an important component defining a feedback signal used in learning, and according to a deep learning guideline, Binary Cross entropy (Binary Cross entropy) is applied if classified into two categories, category Cross entropy (category Cross entropy) is applied if classified into various categories, mean square error is applied if regression is applied, Connection Temporal Classification (CTC) is applied if sequence is applied, and there are many categories, and thus category Cross entropy (category Cross entropy) is applied.

An Optimizer (Optimizer) is a component for determining a learning progression method, determines a weight update (update) of a neural network based on a loss function, and applies a Stochastic Gradient Descent (SGD).

In order to make the CNN model, data subjected to the normalization operation as described above is arranged in a one-dimensional image, and an optimum value for the layer parameter is derived by machine learning of repeatedly performing convolution operation on the image.

In the case of the configuration shown in fig. 7, the machine learning process by the CNN algorithm corresponds to a known technique, and therefore, a more detailed description thereof will be omitted.

The judging unit is configured to apply at least one of the real-time call connection data and the CDR data to an artificial intelligence system to judge fraudulent calling.

That is, as described above, after determining each parameter of the artificial intelligence system through machine learning, the determination unit can determine whether or not the call is a fraudulent call by transmitting the real-time call connection data or CDR data as an input value to the corresponding artificial intelligence system.

In particular, the judging section may perform a distinguishing process according to a process of a call connection manner, extract call connection data in real time if the call connection is a connection through a Network, apply the corresponding call connection data to the artificial intelligence system to judge a fraudulent call, and apply the stored CDR information to the artificial intelligence system to judge a fraudulent call if the call connection is a connection through a Public Switched Telephone Network (PSTN).

Fig. 8 and 9 show the overall processing method according to the above-described call connection method.

Fig. 8 shows a process when a SIP call connection occurs through the network.

Referring to the drawing, if a packet transmitted to and received from the call connection processing system is received through a packet mirror, the fraudulent call detection system extracts real-time call connection related information from the real-time extraction module of the real-time data extraction block and transmits it to the AI detection block, and the AI detection block applies it to a constructed AI model (i.e., an artificial intelligence system that determines and reflects the above parameters) to detect a fraudulent call, and additionally performs machine learning processing for the corresponding real-time data.

The additional execution of the machine learning process described above implies an upgrade of the parameters of the artificial intelligence system, thus enabling continuous tracking management even if fraudulent call patterns change.

Fig. 9 shows a process when a call connection occurs through the PSTN.

Referring to the drawing, a CDR collecting block of the fraudulent call detection system periodically collects the CDR data accumulatively stored after the occurrence of PSTN call connection and transfers it to an AI detecting block, and the AI detecting block applies the above CDR data to a constructed AI model to detect a fraudulent call, and at the same time, additionally performs machine learning processing for the corresponding CDR data.

It is to be understood that the processes of the above-described embodiments may be executed by a program or an application program stored in a predetermined recording medium (for example, a computer-readable medium). The recording medium includes all of electronic recording media such as ram (random Access memory), magnetic recording media such as hard disks, and optical recording media such as cd (compact disk).

In this case, the program stored in the recording medium may be executed by hardware such as a computer or a smart phone to execute the above-described embodiments. In particular, at least one of the functional blocks of the fraudulent call detection system of the present invention described above may be implemented by a program or application as described above.

The present invention is not limited to the specific embodiments described above, and various modifications and alterations may be made without departing from the scope of the present invention. It goes without saying that the above-described variations and modifications also belong to the scope of the claims.

Industrial applicability of the invention

As described above, according to the present invention, it is possible to improve the accuracy of fraudulent call detection and automate machine learning for fraudulent call patterns, thereby enabling fraudulent call detection even if the form of a fraudulent call changes.