WO2007039345A1 - Method and devices for avoiding the reception of undesired messages in an ip communications network - Google Patents

Abstract

The invention relates to a method and devices for avoiding the reception of undesired messages, especially so-called spam over Internet telephony messages (SPIT messages for short), in an IP communications network. According to said method, a pattern of features characteristic of a message is calculated and the pattern of features is saved in a network component. The characteristic pattern of features of the message is transmitted to other network components in the communications network. A SPIT probability is assigned to the message by comparing the pattern of features with previously known pattern of features that are saved on at least one network component. The message is treated as an undesired SPIT message if the assigned SPIT probability exceeds a previously set threshold value.

Description

description

Methods and apparatus for preventing the reception of unwanted messages in an IP communication network

The invention relates to a method and devices for avoiding the reception of unwanted messages, in particular so-called spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network.

The term "spamming" refers to the mass sending of unwanted messages ("spam"). "Spamming" benefits from easy and affordable access to electronic media, which generally allow for the delivery of messages to a large number of recipients at low cost and time, and the content of such "spam" messages is often more commercial "Spam" is the most prevalent type of "spam." A very well-known form of "spam" is mass mailing of e-mails for advertising purposes. In addition to e-mail "spam" there are other forms such as "spam" regarding instant messaging, Usenet newsgroups, WWW search engines, weblogs or mobile communications.

As already mentioned "spam" is favored by the fact that the

Cause "spamming" to almost no effective cost apart from managing email addresses by "spamming." In addition to the obvious disadvantages of sending unsolicited messages to recipients, "spamming" now high costs that are borne by the general public. These are, on the one hand, indirect costs, for example due to loss of productivity or overcrowded electronic mailboxes. Of greater importance are the costs of the affected ones

Infrastructure providers, such as Internet Service Providers (ISPs), are created: Often, an increase in the bandwidth Wide capacities are required, since the available bandwidths are no longer sufficient to cope with the flood of "spams".

Although "spamming" is outlawed by the general public and the legal situation in Germany and other countries is currently being adjusted, "spamming" tends to increase as the hurdle for this type of message delivery is very low.

With the increasing use of Internet telephony (Voice over IP, VoIP for short), it is expected that VoIP subscribers will increasingly be exposed to so-called SPIT (SPAM over Internet telephony). Currently, calls to conventional Public Switched Telephone Network (PSTN) subscribers are normally always charged to the caller. Calls to VoIP subscribers, on the other hand, can be conducted almost free of charge for the caller due to the deviating billing model, which can be expected to generate a massive amount of SPIT for the future. In particular, the ability to send recorded voice files in bulk, should be interesting for advertisers. It can be assumed that the affected VoIP subscribers will ask their respective VoIP provider for appropriate measures to be protected against unwanted calls.

While in the PSTN connections are circuit-switched or can be made in the mobile identification via the SIM card of the caller, an identification of a caller in the IP telephony is problematic: The communication between two participants takes place here only virtually from end to end, since these are packet-switched connections.

As a countermeasure against SPIT, so-called white lists and blacklists are used. A whitelist for a subscriber X contains subscriber-specific information on such other subscribers Y in the communication network that have been classified as trustworthy and are therefore entitled to Call subscriber X. A blacklist, on the other hand, contains subscriber-specific information about such other subscribers Y who have been classified as untrustworthy and who are therefore not authorized to call subscriber X.

However, SPIT protection using white and black lists is ineffective in the case of a first-time calling, unknown subscriber, since in this case the subscriber-specific data of the unknown subscriber can not be contained in a white or a black list of the called subscriber.

The object of the invention is to design a method and devices such that the reception of unwanted messages in a communication network can be avoided.

This object is achieved by the features of patent claim 1 with regard to the method and by the features of patent claims 12 and 19 with respect to the devices. Further developments of the invention are specified in the subclaims.

The invention relates to a method for preventing the reception of unwanted messages, in particular so-called spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network in which a characteristic feature pattern is calculated for a message and the feature pattern in a network component ge - is stored, and in which the characteristic feature pattern of the message is transmitted to other network components in the communication network. The message is assigned a SPIT probability by comparing the feature pattern with previously known feature patterns stored on at least one network component

SPIT probability depends on the frequency of occurrence of the feature pattern FP. The message is treated as an unwanted SPIT message if the assigned SPIT message Probability exceeds a predetermined limit. For example, a message evaluated as an unwanted SPIT message is deleted or moved to a separate SPIT message storage area.

Furthermore, the invention relates to devices for carrying out the illustrated method.

The invention has the advantage that the reception of unwanted messages is considerably reduced.

An embodiment of the invention is illustrated in the drawings and will be described in more detail below.

Show it:

Fig. 1: Network architecture with distributed SPIT detector Fig. 2: Sequence of the calculation, distribution and use of feature patterns Fig. 3: Example of the calculation of feature patterns FP from received messages

Fig. 4: Network architecture with separate SPIT signature server Fig. 5: Sequence of the calculation, distribution and use of feature patterns with separate SPIT signature server

1 shows an embodiment of the network architecture according to the invention with a first network component S, preferably a voice memory device for storing messages M, and a second and third network component N2, N3 for calculating and storing message characteristic feature patterns FP (for fingerprint) in the communication network IN (for Internet ). Examples of network components include voice box servers, media servers, session border controllers, voice gateways, answering machines and end devices such as mobile telephones, PDAs or PCs with local voice mail devices and corresponding software. The speech storage device S and the second and third network components N2, N3 together form a distributed SPIT detector. According to the invention, the speech memory device S receives a message M in a first step 1. The speech memory device S analyzes the message M on the basis of suitable identifiers. The identifiers are such that the message M can not be recalculated from them.

FIG. 2 shows the sequence of calculation, distribution and use of feature patterns. In the following, the exchange of messages according to the invention between the network components S, N2 and N3 will be described. In a first step 1, the network component S receives the message M. Subsequently, the network component S performs an action Al consisting of the calculation of the feature pattern FP for the message M, the storage of the feature pattern FP and the detection of the frequency of the feature pattern FP in one Statistics exists. Subsequently, in a second step 2, the network component S forwards the feature pattern FP together with the frequency information to the second and third network components N2 and N3. The second and third network components N2 and N3 then each execute an action A2, which consists of storing the feature pattern FP and recording the frequency of the feature pattern FP in a statistic. At a later time, the network component N2 also receives the message M and then executes an action A3 consisting of the calculation of the feature pattern FP and the check of the frequency value for that feature pattern FP. If a predetermined limit value and / or the subscriber-definable limit frequency for the occurrence of the feature FP is exceeded, the message is classified as SPIT and rejected.

The feature pattern FP is calculated, for example, from simple digital features of the message M. Simple digital features of the message M are, for example, a check sum calculated via the received digital voice message M, preferably a CRC value or a hash value. Alternatively it is a calculation of a digital feature of the message M in the form of a series of hash values over successive subsections of the message M is conceivable: FIG. 3 shows the calculation of a feature pattern on the basis of a voice message received in the form of IP packets. The calculated feature pattern is composed of individual components Hl, H2 and H3. An IP packet received in a first step 1 consists of header headers of the IP, UDP and RTP protocol, followed by a first payload PLl. For the received IP packet, the first user data part PL1 is stored in a second step 2. In a third step 3, the user data portions PL2-PL9 of successive IP packets from a connection are stored one after the other. In each case a hash value H1, H2 and H3 is calculated via in each case three user data portions PL1, PL2, PL3, as well as PL4, PL5, PL6 and PL7, PL8, PL9. The sequence of these hash values represents the feature pattern FP.

Alternatively, the feature pattern FP is calculated in the course of an extensive analysis of the speech components of the message M. For example, first the encoding of message M is changed to a predetermined code. Subsequently, features are extracted which are independent of the exact timing of the beginning and end of the encoding of the message M. For this purpose, for example, a normalized histogram of the spectral components in the message M and / or activity / pause analyzes are suitable. The feature pattern FP calculated in this way is multi-dimensional. In a further embodiment of the invention, a quantization is additionally advantageously carried out so that the feature pattern FP becomes robust against small changes in the message content. In a further embodiment of the invention, additional features, for example, from the SIP headers of the message M and / or further protocol information of the signaling protocol are stored or transmitted together with the feature pattern FP in addition to the features mentioned. In this way, SPIT treatment is know SPIT-suspect header information already in the transmission of the message M durchfuhrbar.

The result of the analysis is represented by the feature pattern FP characteristic of the analyzed message M. FIG. 1 and FIG. 2 show how the speech memory device S transmits the calculated feature pattern FP in a second step 2 to the second network component N2 and to the third network component N3. The second step 2 represents the exchange of feature patterns FP between network components S, N2, N3 in the communication network IN. Subsequently, the message M is assigned a SPIT probability SW by comparison of the feature pattern FP with previously known feature patterns FP stored on at least one network component S, N2, N3. The message M is treated as an unwanted SPIT message if the assigned SPIT probability SW exceeds a predetermined threshold. The treatment of a message M classified as a SPIT message corresponds, for example, to a deletion of the message M. Alternatively, the message M is moved to a separate memory area for SPIT messages.

Figure 4 shows a further embodiment of the invention in the form of a network architecture with network components S, N2 and AB (for a private answering machine) in the communication network IN and with an additional separate server system SSS (for SPIT signature server). The network components S, N2, AB in the communication network IN report the feature patterns FP to at least one separate server system, for example in the second step 2 and a fifth step 5. The separate server system SSS keeps statistics about the frequency of the individual feature patterns FP and delivers, for example, in a third step 3 and in a sixth step 6 on the basis of these statistics for each transmitted feature pattern FP back a SPIT probability SW for that it is in the associated message M For example, it is a mass message that is assigned to the SPIT area.

The SPIT probability SW is determined, for example, by means of the following table:

The more often a feature pattern FP is observed in the communication network IN, the greater the SPIT probability SW that the message M in question is SPIT.

The above table provides only one way to determine the SPIT probability SW da. Other variants, in particular other assignments of replication numbers of the same feature pattern FP to SPIT probability values SW, are conceivable.

FIG. 5 shows the sequence of calculation, distribution and use of feature patterns FP with separate SPIT signature server SSS for the exemplary network architecture of FIG. 4. FIG. 5 illustrates the flow of exchanging messages between network components S, N2 and the separate one SPIT signature server SSS. In a first step 1, the network component S receives the message M. Then it performs an action Al consisting of the calculation of the feature pattern FP for the message M. Subsequently, in a second step 2, the network component S forwards the feature pattern FP to the SPIT signature server SSS on. The SPIT signature server SSS then executes an action A2, which consists of storing the feature pattern FP, recording the frequency of the feature pattern FP in a statistic, and determining the SPIT probability SW. In a third step, the SPIT signature server SSS returns the value for the SPIT probability SW back to the network component S. At a later point in time, the network component N2 also receives the message M in a fourth step and then executes the action Al , which consists of the calculation of the feature pattern FP. Subsequently, in a fifth step 5, the network component N2 forwards the feature pattern FP to the SPIT signature server SSS. The SPIT signature server SSS then executes the action A2, which consists of storing the feature pattern FP, recording the frequency of the feature pattern FP in a statistic, and determining the SPIT probability SW. In a sixth step 6, the SPIT signature server SSS returns the value for the SPIT probability SW back to the network component N2. The network component N2 then executes an action A3 which consists of the comparison of the value obtained for SW with a predetermined limit frequency for the occurrence of the feature FP and the treatment of the message M derived therefrom as SPIT.

In a further embodiment of the invention, a network component S only forwards a feature pattern FP to further network components N2, N3 and / or the separate SPIT signature server SSS, if identical feature patterns with the feature pattern FP are stored on the reporting network component S, N2, N3 and the number of identical feature patterns exceeds a limit. The limit value is fixed or freely adjustable.

In a further embodiment of the invention is for a

Message M "on the fly", that is, during the transmission of the message M, a feature pattern FP calculated and transmitted to the network components S, N2, N3, SSS. In a further embodiment of the invention, a feature pattern FP for a desired mass message M is calculated and entered in a whitelist in which feature patterns for mass messages sent by authenticated providers are managed. The feature pattern FP for the desired mass message M is then transmitted to the network components S, N2, N3, SSS. In this way, for example, desired mass messages such as football results or stock market prices can advantageously be transmitted without such desired mass messages being treated as SPIT.

In a further embodiment of the invention, feature patterns FP of .multidot.s are stored on the network components S, N2, N3, SSS

SPIT messages stored for a longer period than feature pattern FP of messages that were not classified as SPIT. In an advantageous embodiment, the long-term storage is outsourced to an archive server.

Claims

claims 1) A method for preventing the reception of unwanted messages, in particular so-called spam over Internet Telephony messages, abbreviated SPIT messages, in an IP communication network (IN), therefore a. for a message (M) a characteristic feature pattern (FP) is calculated and the feature pattern (FP) is stored in a network component (S, N2, N3, AB, SSS), b. the characteristic feature pattern (FP) of the message (M) is transmitted to further network components (S, N2, N3, AB, SSS) in the communication network (IN), c. the message (M) is assigned a SPIT probability (SW) by comparison of the feature pattern (FP) with previously known feature patterns (FP) stored on at least one network component (S, N2, N3, AB, SSS); SPIT probability (SW) of the frequency of the Occurrence of the feature pattern FP depends, d. the message (M) is treated as an unwanted SPIT message if the assigned SPIT probability (SW) exceeds a predetermined limit. 2). The method according to claim 1, characterized in that the feature pattern (FP) is transmitted to at least one separate server system (SSS) and the separate server system (SSS) carries out a statistical evaluation of the frequency of individual feature patterns (FP) and based on this statistical frequency of the Message (M) assigns the SPIT probability (SW). 3) Method according to claim 1 or 2, characterized in that the transmission of the feature pattern (FP) to the separate server system (SSS) only takes place if with the feature pattern (FP) identical feature pattern on the reporting network component (S, N2, N3, AB) are stored and the number of identical feature patterns exceeds a limit value, wherein the limit value is predetermined and / or freely adjustable. 4) Method according to claim 1 to 3, characterized in that the treatment of the unwanted SPIT message is given by a deletion. 5) The method of claim 1 to 3, characterized in that the treatment of the unwanted SPIT message is given by a shift into a separate memory area for SPIT messages. 6) Method according to one of the preceding claims, characterized in that the message (M) prior to the calculation of the feature pattern (FP) on a network component (S, N2, N3, AB, SSS) is stored. 7) Method according to claim 1 to 5, characterized in that the feature pattern (FP) for the message (M) during the transmission of the message (M) on the fly, English calculated on the fly, and to the network components (S, N2 , N3, SSS, AB, SSS). 8) Method according to one of the preceding claims, characterized in that a feature pattern (FP) for a desired mass message (M) is calculated and stored in a whitelist in which feature patterns for mass messages sent by authenticated providers are entered, and the feature pattern (FP) for the desired mass message is subsequently transmitted to the network components (S, N2, N3, SSS). 9) Method according to one of the preceding claims, characterized in that belonging to SPIT messages (M) feature pattern (FP) are stored on the network components (S, N2, N3, SSS) for a longer period as a feature pattern (FP) of messages (M) that have not been classified as SPIT. 10) Method according to one of the preceding claims, characterized in that the feature pattern (FP) as a result of hash values from digital voice data of the message (M) is determined. 11) A device for preventing the reception of unwanted messages, in particular so-called spam over Internet telephony messages, abbreviated SPIT messages, in an IP communication network (IN), a. with means for calculating and storing a characteristic feature pattern (FP) for a message (M), b. with means for transmitting the characteristic feature pattern (FP) of the message to further network components (S, N2, N3, SSS) in the communication network (IN), c. with funds for the allocation of a SPIT Probability (SW) to the message (M) by comparison of the feature pattern (FP) with previously known and stored on at least one network component (S, N2, N3, SSS) feature patterns (FP), d. with means for handling the message (M) as an unwanted SPIT message when a predetermined threshold is exceeded by the assigned SPIT probability (SW). 12) Device according to claim 11, characterized in that it is the device to a voice memory device (S). 13) Device according to claim 11, characterized in that the device is an exchange. 14) Apparatus according to claim 11, characterized in that it is a terminal in the device. 15) Apparatus according to claim 11, characterized in that it is the device is a mobile phone. 16) Apparatus according to claim 11, characterized in that it is an answering machine (AB) in the device. 17. Device according to claim 11, characterized in that the device is a software answering machine (AB) installed on a personal computer. 18. Device according to claim 11, characterized in that the device is a mobile voice box. 19) server system (SSS) with means for calculating statistics on the frequency of individual feature patterns (FP) and with means for determining the SPIT probability (SW) for the associated message (M) and means for transmitting the SPIT probability ( SW) to network components (S, N2, N3) in the communication network (IN). 20) Apparatus according to claim 11 to 19 with means for contacting the server system.