WO2007036400A1

WO2007036400A1 - Methods and devices for stopping the reception of undesirable messages in an ip communications network

Info

Publication number: WO2007036400A1
Application number: PCT/EP2006/065511
Authority: WO
Inventors: Norbert Huffschmid
Original assignee: Nokia Siemens Networks Gmbh & Co. Kg
Priority date: 2005-09-28
Filing date: 2006-08-21
Publication date: 2007-04-05
Also published as: DE102005046375B3

Abstract

Methods and devices are disclosed for stopping undesirable messages, in particular so-called spam over internet telephony messages, in short SPIT messages, in an IP communications network. An exchange (SG, PG, LE) sends a message, before processing in order to calculate a SPIT probability, to a server system (SDS). The server system (SDS) calculates the SPIT probability of the message based on protocol information. The server system (SDS) transmits the calculated SPIT probability to the exchange (SG, PG, LE). The exchange (SG, PG, LE) processes the message in view of a communication connection according to the calculated SPIT probability.

Description

description

Methods and apparatus for preventing the reception of unwanted messages in an IP communication network

The invention relates to a method and devices for preventing the reception of unwanted messages, in particular so-called spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network.

The term "spamming" refers to the mass sending of unwanted messages ("spam"). "Spamming" benefits from easy and affordable access to electronic media, which typically allows for the sending of messages to a large number of recipients at low cost and time, and the content of such "spam" messages is often of a commercial nature. "Spam" predominates over questionable content, and a very well-known form of "spam" is mass mailing of e-mails for advertising purposes. In addition to e-mail "spam" there are other forms such as "spam" regarding instant messaging, Usenet newsgroups, WWW search engines, weblogs or mobile communications.

As mentioned above, "spam" benefits from the fact that the causers, such as advertisers, almost no effective costs incurred in addition to the management of such e-mail address lists through the "spamming". In addition to the obvious drawbacks associated with sending unsolicited messages to recipients, spamming is now causing high costs to be borne by the general public, including indirect costs such as loss of productivity or overcrowded electronic resources

Mailboxes are created. Even more serious are the costs incurred by the respective infrastructure providers, such as Internet Service Providers (ISPs): Often is an increase in bandwidth capabilities necessary because the existing bandwidths are no longer sufficient to cope with the flood of "spams".

Although "spamming" is outlawed by the general public and the legal situation in Germany and other countries is currently being adjusted, "spamming" tends to increase as the hurdle for this type of messaging is very low.

With the increasing use of Internet telephony (Voice over IP, VoIP for short) is expected that VoIP subscribers will be increasingly exposed to so-called SPIT (SPAM over Internet Telephony). Currently, calls to conventional Public Switched Telephone Network (PSTN) subscribers are usually always at the expense of

Callers are charged. Calls to VoIP subscribers, on the other hand, can be conducted almost free of charge for the caller due to the deviating billing model, which can be expected to generate a massive amount of SPIT for the future. In particular, the ability to send recorded voice files in bulk, should be interesting for advertisers. It can be assumed that the affected VoIP subscribers will ask their respective VoIP provider for appropriate measures to be protected against unwanted calls.

While in the PSTN connections are circuit-switched or can be made in the mobile identification via the SIM card of the caller, an identification of a caller in the IP telephony is problematic: The communication between two participants takes place here only virtually from end to end, since these are packet-switched connections.

Thus, there is the problem of identifying and authenticating callers. It is still necessary to classify calls into legitimate and "SPAM" calls, which is especially important in this context Real-time classification to classify a call before the ringing at the called party.

The presented problems and goals are partly contradictory, since on the one hand a classification of a call should be made even before the ringing of the telephone, on the other hand a classification but partially only after answering the call is possible (for example, with respect to the distinction between a person as the caller and a machine) ,

The object of the invention is to design a method and devices such that the reception of unwanted messages in a communication network can be avoided.

This object is achieved by the features of claim 1 with regard to the method and by the features of claims 11 and 12 with respect to the devices. Further developments of the invention are specified in the subclaims.

The invention relates to a method for preventing the reception of unwanted messages, in particular so-called spam over Internet telephony messages, abbreviated SPIT

Messages, in an IP communication network, where an exchange sends a message to a server system for classification for classification and in which the server system classifies the message. The server system transmits the result of the classification to the central office. The central office assesses the result of the classification and treats the message regarding a communication connection according to the evaluation made.

Furthermore, the invention relates to devices for carrying out the illustrated method. The invention has the advantage that the reception of unwanted messages is considerably reduced.

An embodiment of the invention is illustrated in the drawing and will be described in more detail below.

It shows:

Fig. 1 network architecture with server system SDS

FIG. 1 shows the network architecture on which the invention is based with a server system SDS (for SPIT detection server). According to the invention, the server system SDS calculates for a connection attempt of a SPIT originator SO (for Spit Originator), based on signaling data as well as on calculated and / or administered data, a probability that the respective connection attempt is a SPIT connection. The calculation of a SPIT probability for a connection attempt corresponds to a classification of this connection attempt. In the following, the case is described that the probability calculation is performed in the server system SDS, while the calculated probability value of an exchange SG (for SIP Gateway), PG (for PSTN Gateway), LE (for Local Exchange) to handle the connection attempt, that is actual classification of the connection attempt, for example, into the classes "SPIT" or "non-SPIT" and either to a rejection or a forwarding serves. Other variants are conceivable. For example, in addition to computing the SPIT probability, the server system SDS could classify the connection attempt in question into, for example, the "SPIT" or "non-SPIT" classes. In the present case, however, the switching center SG, PG, LE leads this treatment of the connection attempt in the course of a classification based on of the SPIT probability value calculated by the server system SDS.

The exemplary embodiment represents an IP-based communication network, which contains both exchanges in the form of SIP gateways SG and conventional exchanges such as PSTN gateways PG and / or local exchanges LE. The idea underlying the application is not limited to the exemplary embodiment; rather, it is applicable in arbitrary architectures.

The server system SDS can be contacted by SIP gateways SG, but also by conventional exchanges PG, LE with regard to the classification of a connection attempt. The result returned by the server system SDS is interpreted by the requesting exchange SG, PG, LE and, depending on the classification of the connection attempt made, leads either to the establishment or rejection of the request

Connection attempt by the exchange SG, PG, LE.

As shown in FIG. 1, the structure of an SPIT connection attempt originating from an SPIT originator SO in the exemplary embodiment takes place, for example, via a SIP gateway SG. The SPIT originator may be, for example, a human or an automated compound-building computer.

Figure 1 further illustrates the signaling relationships between the network elements involved IP, SG, SDS, PG, LE, as well as the participants VS (for VoIP Subscriber) and PS (for Piain old telephony service subscriber). The so-called bearer connections for the transmission of the language are for the representation of the invention not relevant and are therefore not shown in Figure 1. In one embodiment of the invention, the connection attempt is a VoIP-to-VoIP connection attempt W between two VoIP subscribers VS. This case is shown on the left in FIG. 1 in the form of the VoIP-to-VoIP connection attempt W between the VoIP subscribers VS. In this case, the SIP gateway SG of the SPIT originator sends an INVITE message, which is routed through the IP network IP to the SIP gateway SG of the SPIT receiver VS. The SIP gateway SG of the receiver VS then sends a request Rl to the server system SDS and waits with the other one

Treatment of the connection attempt until there is a response Al of the server system SDS. In an advantageous embodiment of the invention, the request Rl via standardized mechanisms such as SOAP / XML. The request Rl may contain the entire INVITE message or alternatively certain parts of the INVITE message in the form of elements of the SIP protocol. The server system SDS computes from the data of the request Rl and / or its own existing and / or administered data a probability that the connection attempt in question is a SPIT connection attempt, the so-called SPIT probability.

For example, the following data may be included in the SPIT probability calculation:

• Content of the SIP header "FROM"

Contents of the SIP header "VIA"

• Contents of the SIP header "CONTACT" • Structure of the SIP Call ID

• Structure of the SDP session such as session ID, IP addresses, codec selection or RTP port

Further data that can serve as the basis for calculating the SPIT probability are conceivable. If, for example, in a short time interval frequent attempts of connection of obviously the same caller SO to different participants VS, PS, it can be derived from an increased SPIT probability.

The SPIT probability is to be considered high if a) a subscriber is classified as a known SPIT originator SO and / or b) a high connection frequency is determined for a subscriber SO.

In case a) so-called blacklists, stored in the server system SDS and / or in the exchange SG, PG, LE, are used to classify connection attempts by certain subscribers known as SPIT originators SO. In this case, inquiries of the SIP gateway SG regarding

Connection attempts of these known SPIT originators SO answered by the server system SDS by a SPIT probability of 100% to the exchange SG, PG, LE is signaled. The blacklists can be centrally administered and stored for example on the server system SDS, or it can alternatively evaluated individual black lists of subscribers VS, PS and in determining an accumulation of certain numbers, which also appear in several blacklists, the relevant frequently occurring numbers can be set to a blacklist stored centrally, for example, on the server system SDS.

The case b) can be handled by the server system SDS on the basis of a statistical evaluation: the higher the

Call frequency of a subscriber SO, the higher is the SPIT probability calculated by the server system SDS.

In the event that the identity of a subscriber SO does not emerge unambiguously from the SIP signaling information such as FROM header or P-Asserted-Identity header (for example by falsifying the sender information by the subscriber SO), for example statistical Evaluations of the SIP signaling information to be made. By way of example, the server system SDS can statistically determine that certain patterns occur frequently in the Call-ID header or in the SDP session, although the purported origin for each of the respective connections is different from that specified. Furthermore, an evaluation of the VIA header can be made, for example, to check whether the relevant connections all come from a specific source network.

In one embodiment of the invention, a fingerprint of the SPIT originator SO can be generated from the abovementioned data for the calculation of the SPIT probability, which can be used in future connection attempts of a SPIT originator SO on which the fingerprint fits Classification by the server system SDS and / or an exchange SG, PG, LE allowed. Advantageously, such a fingerprint can be forwarded to other server systems and / or exchanges, in order to enable them likewise a simplified classification of messages.

As soon as the SIP gateway SG has a probability Al containing response Al of the server system SDS, the SIP gateway SG compares the calculated SPIT

Probability with a limit. This limit value can be preset by the network operator, for example, whereby the subscribers VS, PS have, for example, the possibility of setting a personal limit. For example, the network operator may have different

Provide protection levels (high, medium, low protection), whereby incoming connection attempts are filtered out more or less depending on the protection level. In this way, a finer gradation of the classification of a connection attempt can be achieved than only by the classes "SPIT" and "non-SPIT". For example, in the embodiment, the calculated SPIT probability is over the allowed limit, the INVITE message is rejected by the SIP gateway with a negative SIP response.

In a further embodiment of the invention, the connection duration is used to calculate the SPIT probability. If, for example, a SPIT originator SO repeatedly establishes connections which are terminated after a short connection time by the respective called user VS, PS, an increased SPIT probability is derived from this. In this case, the SIP gateway SG also informs the server system SDS about the fast termination of the connection in order to enable the server system SDS and / or the switching center SG, PG, LE to recognize future connection attempts of the SPIT originator SO in good time ,

In a further embodiment of the invention, the connection attempt is a SPIT connection attempt from the IP network into the public telephone network. This case is shown on the right in FIG. 1 in the form of the PSTN connection PV. In this case, the PSTN gateway PG shown in Figure 1 receives an INVITE message from the IP network IP. The PSTN gateway PG then sends a request R2 for classifying the connection attempt to the server system SDS. The server system SDS calculates a SPIT probability and sends a response A2 to the PSTN gateway PG. In the event of a SPIT probability exceeding the preset limit, the PSTN gateway PG rejects the connection attempt by a negative SIP response. In the case of falling below the preset limit, the connection is forwarded via the local exchange LE to the called party PS.

In another embodiment of the invention (not shown in FIG. 1), both the SPIT originator and the called party are in the public PSTN domain. Telephone network. The inventive method is analogous to the method described above with the difference that in this case selected exchanges of public PSTN telephone network communicate with the server system SDS. Instead of the SIP INVITE protocol elements used in the case of the IP network, in the case of the PSTN telephone network, selected protocol elements are forwarded from the received SS7 signaling messages to the server system SDS for SPIT probability calculation. A suppression of, for example, the A-

Phone number by the ISDN feature CLIR (Calling Line Identification Restriction) on the part of the SPIT originator would be ineffective in this case, since in the SS7 network, the origin identifier is independent of the A-number known and can be used to identify participants.

In a further embodiment of the invention, the server system SDS is centrally located in a communication network. In the event that a caller in a first

Communication network is classified as SPIT originator SO, further connection attempts by the SPIT causer SO can be prevented in a second communication network, provided that the network operator of the second communication network uses the same server system SDS for the classification of connection attempts.

In a further embodiment of the invention, the server system SDS is represented by a stand-alone server which uses standardized IP interfaces, preferably SOAP / XML. Advantage is a simple connection to existing telecommunications networks regardless of the surrounding network architecture.

Claims

claims

1) A method for preventing the reception of unwanted messages, in particular so-called spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network, a. wherein a central office (SG, PG, LE) sends a message to a server system (SDS) prior to handling, b. where the server system (SDS) a

Probability of determining that the message is an unwanted message c. in which the server system (SDS) sends the determined probability to the exchange (SG,

PG, LE), d. in which the switching center (SG, PG, LE) treats the message with regard to a communication connection in accordance with the probability determined by the server system (SDS).

2) Method according to claim 1, characterized in that the probability is determined on the basis of at least one blacklist, wherein

Signaling information regarding the message sent to be compared with existing entries in the at least one blacklist and at least one match between components of the signaling information and entering the

Blacklist a rejection of the message takes place.

3) Method according to claim 2, characterized in that the at least one black list is stored and administered centrally on the server system (SDS).

4) Method according to claim 1, characterized in that the probability on the basis of a statistical An analysis is made of the frequency of messages sent by a subscriber (SO).

5) Method according to claim 1 or 4, characterized in that the probability is determined on the basis of a statistical analysis with regard to the frequency of messages sent by a subscriber (SO) with respect to signaling data.

6) Method according to claim 1, characterized in that the probability is determined on the basis of a similarity between a pattern of signaling information of the message and the server system (SDS) known patterns of signaling information previously known cause unwanted messages (SO).

7) Method according to one of the preceding claims, characterized in that the treatment of the message in

Dependence on a limit occurs.

8) The method of claim 1, 3, 4, 5, 6 or 7, characterized in that the treatment of the message corresponds to either a forwarding or a rejection.

9) The method of claim 1, 4, 5, 6, 7 or 8, characterized in that the forwarded message receives a mark.

10) A method according to claim 9, characterized in that the mark marks the message as undesirable.

11) Server system (SDS) to prevent the reception of unwanted messages, especially so-called spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network, a. means for receiving a message sent by a central office (SG, PG, LE), b. means for determining a probability that the message is an unwanted message, c. with means for transmitting the determined SPIT probability to the exchange (SG,

PG, LE).

12) Exchange (SG, PG, LE) a. with means for handling the message depending on the message

Probability that the message is an unwanted message b. with means for forwarding to one or more receivers (VS, PS), c. with means for rejecting the message, and d. with means for marking the message as "desirable" or "undesirable".

13) Arrangement according to claims 11 to 12, characterized in that it is the switching center (SG) is a SIP gateway.

14) Arrangement according to claims 11 to 13, characterized in that it is the switching center (PG) is a PSTN gateway.

15) Arrangement according to claims 11 to 14, characterized in that it is at the exchange

(LE) is a local exchange.