KR101218253B1 - Fraud security detection system and method - Google Patents

Abstract

The present invention has various security and illegal call detection functions for intrusion detection, denial of service attack or distributed denial of service attack detection, spam detection, abnormal call detection, and the like. A system and a method thereof, and a security and illegal call detection system, by filtering at least one of a SIP port and an RTP port between at least one first terminal and at least one second terminal connected to a VoIP network, An interface unit for capturing an RTP signal, a call detail record (CDR) for parsing a SIP signal or an RTP signal delivered from the interface unit, and making a call to a SIP message generated by parsing, and generating a SIP message or The security detection unit which detects an intrusion by performing primary analysis of the call, and the security detection unit Proud detection unit for detecting illegal calls by secondary analysis of the SIP message, CDR, primary analysis results, or a combination thereof.

Description

Security and illegal call detection system and method {FRAUD SECURITY DETECTION SYSTEM AND METHOD}

The present invention relates to voice over internet protocol (VoIP) voice packet network security detection technology, and more particularly, to detect intrusion, denial of service (DoS) or distributed denial of service (DDoS). The present invention relates to a security and illegal call detection system and a method thereof, which have various built-in security and illegal call detection functions for detection, spam detection, abnormal call detection, and the like, and easy to match other detection services.

The current communication environment is rapidly evolving to the next generation communication environment based on All IP, in which various access networks are integrated around the IP (Internet Protocol) network. In the representative next-generation communication environment, IMS (IP Multimedia Subsystem) or Broadband Convergence Networks (BcN), it is defined on a text-based basis such as HTTP (HyperText Transfer Protocol) without any protocol stack. Session Initiation Protocol (SIP) is adopted as a core technology.

With the development of this IP-based network environment, Voice over Internet Protocol (VoIP) technology has emerged as a promising technology for service providers, equipment companies, and end users in an environment of improved performance, increased support, and reduced costs.

However, the service using the VoIP network is much more vulnerable to security threats than the Public Switched Telephone Network (PSTN) due to the characteristics of the IP network based on packet data transmission. In addition, due to the lack of SIP-based hacking attack analysis tools, it is difficult to determine whether to hack. Also, SIP / RTP (Intrusion Prevention System (IPS), Application Firewall (App F / W), etc. It is difficult to detect or defend against attacks in the application layer based on Real Time Protocol. As such, the current VoIP network does not effectively prepare for illegal activities such as invasion of privacy, attacks that cause deterioration of service quality, and use of illegal services.

As an example, a malicious user may access a network database or IP address to obtain a service right in an unauthorized manner, and use it without paying for it, or to be billed to another user. In addition, network hackers can cause equipment failures or service disruptions by accessing network equipment, changing databases, and duplicating equipment.

In addition, some malicious users can arbitrarily manipulate packet network protocols such as SIP, H.323, and Media Gateway Control Protocol (MGCP) by accessing packets, changing protocol information, changing packet destinations, or changing call connections in a VoIP network. Can be. In addition, hackers can eavesdrop on call details by eavesdropping on voice bearer channels or accessing call setup information. By extracting subscriber information, tracks, and the like, it is possible to steal personal information and perform illegal activities such as a copy telephone.

In order to prevent this, "SIP Intrusion Detection and Response Structure for Protection of SIP-based Services" of Korean Patent Publication No. 2010-0069410 discloses a SIP-aware IPS, an abnormal SIP traffic detection system, and other SIP servers through a management system. It operates a consistent operation and management to detect DDoS (Distributed Denial of Service) attack, and through the traffic detection sensor installed in a narrow point of the network to disclose the traffic analysis without burdening SIP-aware IPS.

However, the above-described existing technology is configured to detect only a specific attack type, so it is difficult to detect various types of illegal activities. In other words, while the above-described existing techniques can detect DDoS attacks, voice phishing detection, subscriber fraud detection, personal public service (PPS) illegal call detection, premium rate service (PRS) illegal call detection, and specific detection Proud detection services such as illegal call detection from the state cannot be provided, and in order to provide such illegal call detection services, an illegal call detection system must be established separately from the security detection system. Therefore, in order to provide both a security detection function and an illegal call detection function, an illegal call detection system must be built separately from the security detection system and managed separately or integratedly, so that the system is not easy to construct, difficult to maintain, and is difficult to maintain. There is a drawback of cost.

Republic of Korea Patent Publication No. 10-2010-0069410 (2010.06.24)

The present invention is a security detection technology of Voice over Internet Protocol (VoIP) network, by incorporating a variety of illegal detection (Fraud) detection function with security (Security) function, intrusion detection, Denial of Service (DoS) denial of service attack ) Or various security and illegal call detection services such as DDoS (Distributed Denial of Service) detection, spam detection, abnormal call detection, illegal subscriber detection, illegal PPS detection, PRS illegal call detection, etc. The main purpose is to provide a security and illegal call detection system having a structure.

Another object of the present invention is to provide a security and illegal call detection method capable of effectively performing security and illegal call detection by using the analysis result of the security detection module in an illegal call detection module.

Security and illegal call detection system according to an aspect of the present invention in order to solve the above problems, is a security and illegal call detection system connected to a Voice over Internet Protocol (VoIP) network to detect illegal calls and intrusions, VoIP network An interface unit configured to filter at least one of a Session Initiation Protocol (SIP) port and a Real Time Protocol (RTP) port between at least one first terminal and at least one second terminal connected to each other to capture a SIP signal or an RTP signal; Intrusion by parsing a SIP signal or an RTP signal delivered from an interface unit, generating a call detail record (CDR) for making a call to a SIP message generated by the parsing, and analyzing the SIP message or the call first. A security detection unit detecting a; And a proud detector detecting the illegal call by performing secondary analysis on a SIP message, a CDR, a primary analysis result, or a combination thereof delivered from the security detector.

In one embodiment, the security detection unit comprises: a SIP parser for processing a SIP signal or an input stream delivered from the interface unit to form a SIP message; A call analyzer for generating a CDR based on the SIP message and analyzing the call based on the generated CDRs to generate a call for the SIP message from the SIP parser; And an abnormal analyzer or abnormal message analyzer for analyzing whether the SIP message is a normal message or an abnormal message by analyzing basic headers of the SIP message.

In one embodiment, the security detection unit, the rule management unit for managing the threshold for intrusion and blacklist or spam items; An environment setting unit for checking a change in setting of system node, blacklist, spam, and threshold management in a user interface of an operation client and informing the security detection unit; And at least one of a traffic analyzer configured to monitor a traffic amount and a packet amount of each device and generate an alarm when the amount of traffic is greater than a preset threshold.

In one embodiment, the security detection unit, the filter is located at the message entry point of the system, the filter for filtering a known abnormal message does not enter the system; An attack symptom detector for detecting abnormal traffic or an attack indication based on the SIP message passing through the filter; And an attack analysis unit for generating a rule by analyzing the attack pattern of the suspicious message transmitted from the attack symptom detection unit. Here, the attack analysis unit updates the filter with the created rule, and the filter filters the suspicious message according to the updated rule.

In one embodiment, the loudspeaker detection unit, voice phishing detection unit for detecting a large number of call generation and a large number of call generation for a specific call number at a specific time; A subscriber illegal call detection unit that analyzes CDR information for each subscriber group and detects illegal calls by comparing with a threshold; A PPS illegal call detection unit that detects an illegal call that causes a leak of revenue by using a call without a reduction in a prepaid amount of money by a PPS subscriber; A specific country illegal call detection unit for detecting an illegal call generating a large number of calls from or to a country designated as a specific country; A maximum call time illegal call detection unit configured to set a long duration as a pattern of fixed mobile substitution (FMS) to detect a corresponding call as an illegal call when a duration of talk time exceeding a threshold occurs; And a refilling illegal call detection unit that detects an illegal call generating a leak of profit by generating a charge below a normal charge through a call forwarding service using a specific Private Automatic Branch eXchange (PABX) system. It includes either.

Security and illegal call detection method according to another aspect of the present invention is a security and illegal call detection method for detecting illegal calls and intrusion through a system connected to a Voice over Internet Protocol (VoIP) network, at least one connected to the VoIP network A first step of filtering at least one of a Session Initiation Protocol (SIP) port and a Real Time Protocol (RTP) port between a first terminal and at least one second terminal of the second terminal to obtain a SIP signal or an RTP signal; Parsing the obtained SIP signal or RTP signal; Generating a call detail record (CDR) for making a call to the SIP message generated by parsing; A fourth step of primaryly analyzing the call or SIP message composed by the generated CDRs to detect the intrusion; And a fifth step of secondarily analyzing the SIP message, the CDR, the primary analysis result, or a combination thereof to detect the illegal call.

In one embodiment, a security and illegal call detection method includes storing and managing a threshold for intrusion and a blacklist or spam item in a predetermined storage; Checking a change in setting of a system node, a blacklist and spam, and a threshold management in a user interface of the operation client, and notifying the system of the change; And monitoring at least one traffic amount and a packet amount of each device, and generating an alarm when the amount of traffic is greater than a preset threshold.

In one embodiment, the fourth step includes analyzing basic headers of the SIP message to determine whether it is a normal message or an abnormal message.

In one embodiment, the fourth step includes detecting an intrusion for a SIP port and an RTP random port, an intrusion detection based on a Uniform Resource Identifier (URI) address included in a SIP header field, and an abnormal RTP by analyzing an association of SIP and RTP. Performing at least one of media traffic detection.

In one embodiment, the fourth step comprises: detecting an attack indication for a flooding attack of the SIP message according to a preset threshold; Analyzing the attack pattern based on the detection of the attack indication and generating a rule from the analyzed information; And detecting an intrusion in the form of an abnormal message, a blacklist, spam, flooding, or a combination thereof according to the generated rule and filtering the SIP message corresponding to the detected intrusion.

In one embodiment, the fourth step includes configuring a detection rule according to the SIP method or status code, registering a blacklist according to the configured detection rule, and detecting an intrusion corresponding to the registered blacklist.

In one embodiment, the fourth step includes detecting that a packet with a specific service or pattern exceeds a certain amount of data for a unit time; And detecting an intrusion by monitoring at least one of a source and destination address, a byte number and a packet number of a unit data flow, a traffic inflow interface, and upstream peer information.

In an embodiment, the fourth step may include determining whether to spam by detecting a number of call requests or a call occurrence interval per unit time including a transmission amount or a reception amount.

In one embodiment, the fifth step is voice phishing detection, subscriber illegal call detection, personal protection specialist (PPS) illegal call detection, specific country illegal call detection, long duration illegal call detection, refiling ) Performing illegal call detection, pattern analysis illegal call detection, exception pattern detection, pattern analysis, blacklist detection, threshold detection, or a combination thereof.

In one embodiment, the fifth step is to analyze the requirements and requirements of at least one of the SIP message, the CDR and the primary analysis result and the required data including at least one of a pre-stored user profile or customer data and billing data. Defining; Selecting an analysis algorithm based on the requirement; Extracting data for each condition according to the selected analysis algorithm; Converting the extracted data for each condition and generating a derived variable; Selecting a significant variable among the derived variables according to the data analysis result by the transformation; Generating a model rule using the selected significant variable; And selecting an optimal model among preset models based on the generated model rule and calculating a second analysis result using the selected optimal model.

According to the present invention, it is possible to provide a security and illegal call detection system incorporating various illegal call detection functions together with a security detection function.

Through a security and illegal call detection system having a single system structure, it is possible to provide an improved structure for easily matching the security detection function with the illegal call detection function. In addition, since it is not necessary to build a separate equipment for the security detection service and illegal call detection service, it is possible to reduce the system construction and maintenance costs.

Furthermore, by configuring the illegal call detection module to use the analysis result in the security detection module, it is possible to greatly improve the efficiency and performance of the system in security detection and illegal call detection.

1 is a schematic configuration diagram of a VoIP voice packet network employing a security and illegal call detection system according to an embodiment of the present invention.
2 is a flowchart schematically illustrating a security and illegal call detection process that may be employed in the system of FIG. 1.
3 is a block diagram of an embodiment of a specific configuration that may be employed in the security and illegal call detection system of FIG.
4 is a block diagram illustrating an embodiment of a security and illegal call detection method employable in the system of FIG. 3.
5 is a schematic flowchart illustrating an illegal call detection process of a security and illegal call detection method employable in the system of FIG. 3.
6 is a diagram illustrating an intrusion detection function of the security and illegal call detection method according to an embodiment of the present invention.
7 is a diagram schematically illustrating a DoS / DDoS detection function of a security and illegal call detection method according to an embodiment of the present invention.
8 is a diagram schematically illustrating a spam detection function of a security and illegal call detection method according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a schematic configuration diagram of a VoIP voice packet network employing a security and illegal call detection system according to an embodiment of the present invention.

Referring to FIG. 1, the security and illegal call detection system 100 is connected to a Voice over Internet Protocol (VoIP) network to invade a service based on Session Initiation Protocol (SIP) call establishment and Real Time Protocol (RTP) media transmission. Security can be detected to maintain security, and Fraud can be detected to improve the stability and reliability of the service.

The security and illegal call detection system 100 includes an interface unit 110, a security detector 120, and a proud detector 130. In addition, the security and illegal call detection system 100 (hereinafter, referred to as “FSDS”) may include a database 140, a storage 150, and a switch hub 160.

The interface unit 110 connects the network device for traffic monitoring with the FSDS 100 and processes a packet from the network device or filters a port connected to the network device. In this embodiment, the interface unit 110 may collect packets transmitted and received in the VoIP network through network taps (TAP) 10 installed in various places of the VoIP network. Signals input from the plurality of network taps 10 may be input to the interface unit 110 through an aggregator 20.

The security detector 120 has a message parsing function for analyzing a specific input message in the SIP signal or the RTP signal from the interface unit 110 according to a predetermined rule or a grammar in which a set of tokens are defined. . In addition, the security detection unit 120 is a means or component that performs a function of a security detection system (SDS), and detects an external intrusion or attack on the VoIP network-based communication service to maintain the security of the service. do.

The proud detector 130 is a means or component that performs a function of a proud detection system (FDS), and includes a message from the interface 110 and a primary analysis result from the security detector 120. On the basis of this, we detect the illegal call for the communication service based on VoIP network and secure the stability and reliability of the service. In the present exemplary embodiment, the probing detector 130 may generate an illegal call based on information data such as a call detail record (CDR), a subscriber or customer data, billing data, and the like generated by the security detector 120. Detect. For example, the loudspeaker detector 130 collects transaction data of a related user from a packet data service provider at a time when a user event occurs or according to an administrator's request, generates a subscriber profile, and performs proud analysis based on the subscriber profile. At the beginning of the analysis, Proud event analysis is performed based on empirical rules, and individual call pattern rules and models are generated through learning about accumulated subscriber profiles using neural network algorithms, etc. Scoring analysis can proceed.

The database 140 stores grammar rules required for SIP parsing and configuration information required for operating the system. In addition, the database 140 stores information data such as CDR, customer data, billing data, and the like.

The storage unit 150 stores information captured from the SIP stream and the RTP stream from the interface unit 110, the SIP message from the security detector 120, and the primary analysis result. In addition, the storage unit 150 stores information on field analysis and definition of SIP messages, information on existing analysis algorithms, and the like.

The switch hub (SW Hub) 160 connects the system 100 to an external operation client 170. The operation client 170 operates to change the environment setting of the system through the user interface provided by the security detector 120.

2 is a flowchart schematically illustrating a security and illegal call detection process that may be employed in the system of FIG. 1.

Referring to FIG. 2, first, raw data from a network tap connected to a VoIP network is captured by the interface unit 110, the interface unit 110 analyzes the captured signal and analyzes the captured SIP signal. The RTP signal is transmitted to the security detector 120 (S210).

The security detector 120 processes an SIP stream or an RTP stream input from the interface unit 110 through a built-in SIP parser to configure an appropriate SIP message (S220). For example, the headers in the incoming message are trimmed by the SIP parser to construct the SIP message. In this case, the SIP parser may read data from a predetermined buffer in which the input stream is stored or directly read data from the input stream. The SIP message configured in the SIP parser is transmitted to the security detection function unit and the loudness detection unit 130 in the security detector 120 for further processing.

The security detector 120 analyzes the SIP message through the security detection module installed on the device, and primarily detects an external intrusion or attack (S230). Externally detected intrusions or attacks are primarily unwanted from Black List users; DoS / DDoS attacks that cause anomalous messages, calls or media congestion resulting in outages, processing delays, service disruptions, equipment failures, etc .; Spam, which refers to communication sent by a person who does not want or has no commercial or non-commercial relationship; Snooping or tapping; And service misuse attacks, such as billing bypass.

The proud detector 130 secondly detects the illegal call based on the SIP message and the primary analysis result from the security detector 120 (S240). The second detected illegal call is Voice Phishing, Fraud Detection to disguise subscriber, Personal Public Service (PPS) illegal call detection, Specific country illegal call, Maximum call duration illegal call, PRS (Premium) Rate Service) or Refilling Illegal Calls.

The primary analysis result in the security detector 120 and the secondary analysis result in the proud detector 130 are output to the monitor of the operation client (S250). In addition, according to the results of the first analysis and the second analysis, the security of the system may be updated and measures to block illegal calls may be taken.

3 is a block diagram of an embodiment of a specific configuration that may be employed in the security and illegal call detection system of FIG.

Referring to FIG. 3, the security and illegal call detection system 300 includes a capture board 302, a signal interface module 310, a security detection module 320, and a proud detection module 330.

In the FSDS 300 of the present embodiment, the capture board 302 and the signal interface module 310 are connected to the interface unit 110 of FIG. 1, the security detection module 320 is connected to the security detector 120, and the loudness detection. The module 330 may correspond to the proud detector 130, respectively.

The capture board 302 includes an Ethernet capture interface module and physically connects a network tap or aggregator tap on the VoIP network with the SIP and RTP ports of the signal interface module 310.

The signal interface module 310 includes a packet processing and port filtering engine and a protocol process, and filters SIP and RTP ports to capture corresponding protocol signals in streams or packets input to the ports.

The security detection module 320 may include a SIP parser, a rule manager, a call analyzer, a config set, an attack filter, and an attack symptom detection unit. , ASD), an attack analyzer, a malformed analyzer, and a traffic analyzer.

The security detection module 320 parses the SIP input stream and the RTP input stream from the signal interface module 310 through the SIP parser according to a predetermined grammar rule, and creates a CDR from the parsed SIP message to analyze the call. Is generated through the call analysis unit. The SIP parser may include a parser for Transmission Control Protocol (TCP) and a parser for User Datagram Protocol (UDP).

In the security detection module 320, the traffic analysis unit monitors the traffic amount and the packet amount for each device, and generates an alarm when it exceeds a predetermined threshold. The anomaly analyzer analyzes basic headers of parsed SIP messages to determine whether the message is a normal message or an abnormal message. The rule manager manages at least one of a threshold for detection, a blacklist, and a spam item. The attack symptom detection unit determines a flood attack indication of INVITE, BYE, CANCEL, or a combination message thereof, and generates an alarm according to a threshold. The attack analysis unit analyzes the attack pattern of the message sent by the attack symptom detection unit (ASD) to generate a rule, and sends the generated rule to the attack filter. When the attack filter is determined to be an attack based on an abnormal message, a blacklist, spam, or a flooding rule, the attack filter filters the message and generates an alarm according to a threshold or a predetermined setting. The configuration unit provides a graphical user interface (GUI) to the operation client, and transmits the change to the security detection module 320 when the GUI changes the configuration of the system node, blacklist, spam, and threshold management. .

A summary of the main functions of the security detection module 320 is shown in Table 1 below.

The proud detection module 330 includes a proud detection engine and a proud analysis unit. Proud detection engine includes voice phishing detection unit, illegal subscriber detection unit, personal public service (PPS) illegal call detection unit, specific national illegal call detection unit, long duration fraud detection unit, refilling Or PRS (Premium Rate Service) illegal call detection unit, and Pattern Analysis (Pattern Analysis) illegal call detection unit, and perform voice phishing or various illegal call processing. In addition, the Proud Analysis unit is an exception pattern detection unit (Anomaly Detection), call pattern analysis unit (Pattern Analysis), blacklist detection unit (Blacklist Detect), threshold detection unit (Threshold Detect), traffic monitor function unit, status / statistics (Status / Statistics) function unit and Alert Control function unit, and performs pattern analysis, malicious user detection on a blacklist, threshold detection, area detection, and various statistical processes.

A summary of the main functions of the proud detection module 330 is shown in Table 2 below.

In addition, the subscriber fraud is a form of new personal information continuously, in the form of stealing the other's personal information and signing up, and then selling the call to a third party or receiving PRS service and billing the service provider. It can appear in the form of resubscribing using. Proud detection module 330 of the present embodiment analyzes a communication pattern of a previous illegal user, for example, CDR, call time, access number, call type, etc. using an analysis engine operating according to the procedure of FIG. Minimize damage by detecting calls.

PPS illegal calls are represented as illegal recharge, prepaid card duplication, illegally charged prepaid cards by insiders, illegal use by hacking of the system for reuse and resale, and in the proud detection module 330 of the present embodiment, a prepaid platform, Patterns are recognized by collecting CDR, billing, subscriber information, etc., Proud rules are generated based on the recognized patterns, and the illegal call is detected based on the generated rules. At this time, the system 300 may detect illegal use through a rule-based engine having a date, time, subscriber number or caller number, charge amount, transaction type, prepaid card number, etc. when the prepaid card is charged. Can be.

Refiling or illegal PRS is a form in which a PRS company is established outside or in Korea, and faked through a registered terminal or auto dialer to receive payment from a telecommunications provider. When accessing the site that provides the service, the subscriber does not know about the international call through the international PRS service provider, and then intercepts the cost of the international PRS service. In the system 300, the rule-based engine is used to detect the illegal call through CDR, PRS operator call analysis, call pattern detection, call amount detection, call time detection, and the like.

4 is a block diagram illustrating a specific embodiment of a security and illegal call detection method employable in the system of FIG. 3.

This embodiment is an example of a security detection function. Referring to FIG. 4, first, when a SIP message is delivered to a SIP proxy server through a filter 410, the attack symptom detection unit 420 analyzes the SIP message to detect abnormal traffic or detect abnormal traffic signs. Then, the detected or detected suspicious message is transmitted to the analyzer 430. Here, the filter 410 is located at the message entry point of the security detection module 320 and corresponds to the attack filter of FIG. 3, and the analyzer 430 is the call analyzer, the traffic analyzer, the abnormal analyzer of FIG. 3. , Attack analysis unit, or a combination thereof.

The analysis unit 430 analyzes the message suspected of an attack, extracts a rule so that the filter 410 can filter a future attack when it is determined to be an attack, and passes the extracted rule to the filter 410 to filter the filter. Update The updated filter 410 operates to prevent known attack messages from entering a system such as a SIP proxy server according to a predetermined rule.

A traffic volume manager such as SIP Message Random Early Drop (SMRED) may be provided between the filter 410 and the SIP proxy server to prevent a plurality of messages from being temporarily delivered to the SIP proxy server.

In the present embodiment, call information from the SIP proxy server may be provided to the attack symptom detector 420 and the analyzer 430.

5 is a schematic flowchart illustrating an illegal call detection process of a security and illegal call detection method employable in the system of FIG. 3.

This embodiment is an example of a procedure for detecting at least one illegal call among various illegal calls in FIG. 3.

Referring to FIG. 5, when a CDR, customer data, billing data, and the like are input (S510), the proud detection module 330 first performs field analysis and definition (S520). In this step (S520), the requirements for illegal call detection are defined and analysis and direction are set by creating an analysis scenario.

Next, an analysis algorithm is selected based on the defined requirements or the set analysis scenario (S530). In the step S530, a suitable analysis technique is selected from existing analysis algorithms such as a decision tree, a neural network, and anomaly detection.

Next, data for each condition is extracted based on the selected analysis algorithm (S540). In this step, the required data is checked and the source data is extracted. At this time, the period data can be checked and extracted.

Next, the extracted data for each condition is converted (S550). In this step, data for analysis is generated by converting the data. You can also create derived variables when converting data.

Next, a variable is selected based on the analysis data (S560). In this step, we select meaningful variables from the variables obtained as a result of data analysis.

Next, a model rule is created using the selected variables (S570). In this step, we develop a model for scoring by creating model rules using selected variables.

Next, the optimal model is selected from the developed models and the detection result is calculated using the selected model (S580). In this step, an analysis result for abnormal or exception pattern detection, pattern analysis, illegal call detection, etc. is calculated using an optimal model.

6 is a diagram illustrating an intrusion detection function of the security and illegal call detection method according to an embodiment of the present invention.

Referring to FIG. 6, the system 300 is disposed between an IPS or firewall 610 and SIP servers to detect an intrusion into a SIP port and an RTP port. The SIP port may be a 5060 port and the RTP port may be a random port. The system 300 may detect an intrusion based on a Unified Resource Indentify (URI) address contained in a SIP header field such as To, From, Via, or the like. In addition, the system 300 may detect the intrusion by analyzing the RTP stream or the media traffic through the association between the SIP and the RTP. Here, the system 300 analyzes the RDP port by analyzing the Session Description Protocol (SDP) carried in the SIP message.

In addition, the system 300 configures various detection rules according to SIP methods, status codes, and the like, automatically registers a blacklist according to the detection rule, and detects illegal or illegal actors corresponding to the blacklist. At this time, the system 300 may query and delete the blacklist.

7 is a diagram schematically illustrating a DoS / DDoS detection function of a security and illegal call detection method according to an embodiment of the present invention.

Referring to FIG. 7, the system 300 detects a DoS / DDoS attack through a bandwidth detection function in addition to the intrusion detection function of FIG. 6 described above. The bandwidth detection function may be configured to detect when a packet having a specific service or pattern has exceeded a certain amount or more during a unit time.

The system 300 may detect a corresponding attack by monitoring a source address and a destination address, a byte number and a packet number of each flow, a traffic inflow interface, and an upstream peer information through traffic flow analysis. In this case, the system 300 may classify VoIP-related traffic on the network and monitor the flow of VoIP traffic.

The aforementioned types of DoS / DDoS attacks include the following types of DOS, DOS flooding, DOS purging, spam, and the like. Denial of Service (DoS) is a resource of exchange equipment by sending an abnormal message to a specific destination or generating SID or RTP floating through a communication terminal stealed by a malicious user such as a zombie PC (Personal Computers). It causes problems such as exhaustion (e.g. central processing unit or memory), line resource depletion (e.g. degradation of quality), malfunction of the terminal or exchange equipment (e.g. equipment failure), processing delays, out of service (e.g. outage). Let's do it. DoS-Flooding causes malicious users, such as hackers, to send large amounts of messages to specific destinations, causing problems such as noise generation, busy status, increased call charges, call termination, poor call quality, and poor reliability. DoS-Fuzzing allows malicious users such as hackers to send abnormal call request (INVITE) messages, causing VoIP solution equipment to fail, causing VoIP solutions to have buffer overflows during SIP parsing. It may cause problems such as malfunction of terminal or exchange equipment or out of service.

8 is a diagram schematically illustrating a spam detection function of a security and illegal call detection method according to an embodiment of the present invention.

Referring to FIG. 8, the system 300 may detect malicious spam and block or filter the spam. Here, spam is an automated, tool-based, mass-broadcast email, call spam containing advertisements or promotional media delivered to media sessions at call setup, and promotional textual text in SIP messages. To indicate the form of instant message spam that automatically displays the ad text even if the call is not connected, and the location spam that inserts the ad text through the location information providing message, and sends the ad. It refers to illegal issues that cause social problems such as extortion of money.

When the number of call requests per unit time exceeds a certain amount, the system 300 of the present embodiment is based on detection of outbound or inbound call requests, analysis of outgoing / received call patterns, or inspection of INVITE / SUBSCRIBE message fields. Call Spam is detected. For example, the system 300 may detect spam by applying keyword-based content filtering on a specific field (eg, From, Subject, etc.) whether an advertisement segment is included in an INVITE message or a SUBSCRIBE message.

In addition, the system 300 applies a spam response policy by accessing or registering a spam signal or applying a blacklist through interworking with the terminal. Here, the administrator can manage the blacklists associated with malicious users or the whitelists associated with normal users and receive spam reports.

In the above, the present invention has been described with reference to preferred embodiments, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains have various modifications and variations from this description. It will be possible. Therefore, the present invention should be construed with reference to the overall description of the appended claims and drawings, and all equivalent or equivalent modifications thereof will belong to the scope of the present invention.

100: security and illegal call detection system
110:
120: security detector
130: Proud detector

Claims (15)

In the security and illegal call detection system connected to the VoIP (Voice over Internet Protocol) network to detect illegal calls and intrusions,
Capturing at least one of a Session Initiation Protocol (SIP) port and a Real Time Protocol (RTP) port between at least one first terminal and at least one second terminal connected to the VoIP network to capture a SIP signal or an RTP signal An interface unit;
Parse the SIP signal or the RTP signal delivered from the interface unit, generate a call detail record (CDR) for making a call (Call) to the SIP message generated by parsing, and the SIP message or the call is primary A security detector for detecting an intrusion by analyzing; And
Proud detection unit for detecting illegal calls by secondary analysis of the SIP message, CDR, primary analysis result, or a combination thereof delivered from the security detection unit
Including but not limited to:
The security detector,
A SIP parser for processing a SIP signal or an input stream delivered from the interface unit to construct a SIP message; A call analyzer for generating a CDR based on the SIP message and analyzing a call based on the generated CDRs to generate a call for a SIP message received from the SIP parser; And an abnormal message analyzer for analyzing whether the SIP message is a normal message or an abnormal message by analyzing basic headers of the SIP message.
The security detector,
A rule manager which manages a threshold for the intrusion and a blacklist or spam item; An environment setting unit for checking a change in setting of system node, blacklist, spam, and threshold management in a user interface of an operation client and informing the security detection unit; And at least one of a traffic analyzer configured to monitor a traffic amount and a packet amount of each device, and generate an alarm when the amount of traffic and the packet amount are preset.
delete delete The method of claim 1,
The security detector,
A filter located at a message entry point of the system and filtering out known abnormal messages from entering the system;
An attack symptom detection unit for detecting abnormal traffic or an attack indication based on the SIP message passing through the filter; And
Attack analysis unit for generating a rule by analyzing the attack pattern of the suspicious message transmitted from the attack symptom detection unit
Further comprising:
The attack analysis unit updates the filter with the generated rule, and the filter filters the suspicious message according to the rule.
The method of claim 1,
The proud detection unit may include: a voice phishing detection unit detecting a large number of call occurrences and a large number of call generations for a specific calling number at a specific time; A subscriber illegal call detection unit that analyzes CDR information for each subscriber group and detects illegal calls by comparing with a threshold; A PPS illegal call detection unit that detects an illegal call that causes a leak of revenue by using a call without a reduction in a prepaid amount of money by a PPS subscriber; A specific country illegal call detection unit for detecting an illegal call generating a large number of calls from or to a country designated as a specific country; A maximum call time illegal call detection unit configured to set a long duration as a pattern of fixed mobile substitution (FMS) to detect a corresponding call as an illegal call when a duration of talk time exceeding a threshold occurs; And a refilling illegal call detection unit that detects an illegal call generating a leak of profit by generating a charge below a normal charge through a call forwarding service using a specific Private Automatic Branch eXchange (PABX) system. Security and illegal call detection system comprising any one.
A security and illegal call detection method for detecting illegal calls and intrusions through a system connected to a VoIP (Voice over Internet Protocol) network,
Obtaining a SIP signal or an RTP signal by filtering at least one of a Session Initiation Protocol (SIP) port and a Real Time Protocol (RTP) port between at least one first terminal and at least one second terminal connected to the VoIP network First step;
Parsing the obtained SIP signal or RTP signal;
A third step of generating a call detail record (CDR) for making a call to the SIP message generated by the parsing;
A fourth step of detecting an intrusion by first analyzing the call or the SIP message constituted by the generated CDR; And
A fifth step of detecting an illegal call by performing secondary analysis on the SIP message, CDR, primary analysis result, or a combination thereof
Including but not limited to:
Storing and managing a threshold for the intrusion and a blacklist or spam item in a predetermined storage unit; Checking a change in setting of a system node, a blacklist and spam, and a threshold management in a user interface of the operation client, and notifying the system of the change; And monitoring at least a traffic amount and a packet amount of each device, and generating an alarm when the amount of traffic is equal to or greater than a preset threshold.
delete The method according to claim 6,
The fourth step may include analyzing basic headers of the SIP message to determine whether the message is a normal message or an abnormal message.
The method according to claim 6,
The fourth step includes detecting an intrusion on a SIP port and an RTP random port, detecting an intrusion based on a Uniform Resource Identifier (URI) address included in a SIP header field, and detecting abnormal RTP media traffic by analyzing an association between SIP and RTP. Security and illegal call detection method comprising the step of performing at least one.
The method according to claim 6,
In the fourth step,
Detecting an attack indication for a flooding attack of the SIP message according to a preset threshold;
Analyzing the attack pattern based on the detection of the attack indication and generating a rule from the analyzed information; And
Detecting an intrusion in the form of an abnormal message, a blacklist, spam, flooding, or a combination thereof according to the generated rule and filtering a SIP message corresponding to the detected intrusion.
The method according to claim 6,
The fourth step includes configuring a detection rule according to a SIP method or status code, registering a blacklist according to the configured detection rule, and detecting an intrusion corresponding to the registered blacklist. Way.
The method according to claim 6,
The fourth step may include detecting that a packet having a specific service or pattern exceeds a certain amount of data for a unit time; And detecting at least one of the source and destination addresses, the byte number and packet number of the unit data flow, the traffic inflow interface, and the upstream peer information to detect the intrusion.
The method according to claim 6,
The fourth step may include detecting a spam or not by detecting a number of call requests or a call occurrence interval per unit time including a transmission amount or a reception amount.
The method according to claim 6,
In the fifth step, voice phishing detection, illegal subscriber detection, personal protection specialist (PPS) illegal call detection, specific country illegal call detection, long duration illegal call detection, refilling illegal call detection And performing pattern analysis illegal call detection, exception pattern detection, pattern analysis, blacklist detection, threshold detection, or a combination thereof.
The method according to claim 6,
The fifth step,
Analyzing a field of necessary data including at least one of the SIP message, the CDR, and the primary analysis result and at least one of a pre-stored user profile or customer data and billing data;
Selecting an analysis algorithm based on the requirement;
Extracting data for each condition according to the selected analysis algorithm;
Converting the extracted conditional data and generating a derived variable;
Selecting a significant variable among the derived variables according to the data analysis result by the transformation;
Generating a model rule using the selected significant variable; And
Selecting an optimal model among preset models based on the generated model rule and calculating a second analysis result using the selected optimal model
Security and illegal call detection method comprising a.

Images