The present invention relates to a call warning device, a call warning method, and a call warning program.
In recent years, while the number of cases of special fraud has increased greatly, telephone calls of “it's me” scam (impersonation fraud telling “I'm your son”) account for more than half of the cases, and thus measures against fraud using telephone calls are required. In addition, with the spread of IP networks, a call signal of special fraud may flow into the network as a session initiation protocol (SIP) signal.
Patent Literature 1 describes a method of providing guidance to a call receiving user before an end-to-end media connection between a calling terminal and a call receiving terminal in a communication system that performs call control by SIP. Thus, the call receiving person can determine whether or not to connect by performing an operation required by the guidance or the like.
Patent Literature 2 describes a call system in which evaluation information (such as whether it is written on a blacklist) of the calling terminal is provided to the call receiving terminal before the call receiving terminal responds to a call from the calling terminal, and then the call receiving terminal engages in a call with the calling terminal. Thus, the call receiving terminal can appropriately select a scene to answer a call, such as rejecting a call from a calling terminal with poor evaluation and answering a call from a calling terminal with good evaluation, and can reject the call according to an instruction of the call receiving person.
In a method of registering an attacker in the blacklist in the conventional technology, registration or the like of calling numbers used for special fraud in advance is necessary. Therefore, if the attacker frequently changes the calling number, the blacklist becomes obsolete, and the measures against special fraud may not be sufficiently taken.
Further, in order to delay identification (tracking) that the attacker himself/herself is a caller of the special fraud, the attacker may use a method of passing through a plurality of service providers or a method of passing through a foreign service provider.
An example of a case where a call made from a calling side terminal 11z reaches a call receiving number “0422-88-8888” of a receiving side terminal 31z via four SIP servers (SIP server 24z→SIP server 23z→SIP server 22z→SIP server 21z) will be described.
A calling side service provider 24Dz manages the SIP server 24z that accommodates the calling side terminal 11z.
A connection service provider 23Dz manages the SIP server 23z in which a call receiving number [03-1111-2222] for transfer is set.
A connection service provider 22Dz manages the SIP server 22z in which a call receiving number [03-1111-3333] for transfer is set.
A receiving side service provider 21Dz manages the SIP server 21z accommodating the receiving side terminal 31z.
In such a transfer service, since the call receiving number of the call signal is switched from the number of the transfer source to the number of a transfer destination, it is difficult to identify the special fraud.
A case where a call made from a foreign calling side terminal 11z reaches a domestic receiving side terminal 31z via three SIP servers (SIP server 23z→SIP server 22z→SIP server 21z) will be exemplified.
The connection service provider 23Dz manages the SIP server 23z that accommodates the calling side terminal 11z.
The connection service provider 22Dz manages the SIP server 22z that relays a call across two countries.
The receiving side service provider 21Dz manages the SIP server 21z accommodating the receiving side terminal 31z.
With respect to the methods for laundering (hiding) information of the caller as described in
Accordingly, a main object of the present invention is to appropriately issue a warning even if information of a caller of special fraud is hidden.
In order to solve the above problem, a call warning device of the present invention has the following characteristics.
The present invention includes:
According to the present invention, even if information of a caller of a special fraud is hidden, a warning can be appropriately issued.
Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
As in
A calling side service provider 24D manages the SIP server 24 accommodating the calling side terminal 11.
A connection service provider 23D manages the SIP server 23 in which a call receiving number [050-1111-2222] for transfer is set.
A connection service provider 22D manages the SIP server 22 in which a call receiving number [03-1111-3333] for transfer is set.
A receiving side service provider 21D manages the SIP server 21 accommodating the receiving side terminal 31.
As terms in the present specification, “transfer” and “relay” are used separately. For example, it is assumed that an SIP signal (call signal) pass through the first SIP server 20→the second SIP server 20→the third SIP server 20 in this order. Here, when the second SIP server 20 changes the call receiving number (destination) of the SIP signal, “transfer” is set, and when the call receiving number is not changed, “relay” is set. For example,
Note that details of the call signals 40a and 44a and the SIP signals 41a to 43a will be clarified in the description of
Then, in a case where the SIP signal is transferred, each SIP server 20 sets the number of the transfer source and the number of the transfer destination in a number conversion history (History-Info) of the received SIP signal, and then transmits the SIP signal to the transfer destination. Note that each SIP server 20 may register the SIP server 20 of another device in the Privacy header of the SIP signal (not illustrated) as a device that permits notification of the content notification of History-Info (that is, a trusted device).
Here, since the transfer service tends to be abused in the “it's me” scam, when the content of the number conversion history of the SIP signal 41a that has arrived at the SIP server 21 is unnatural, the SIP server 21 sends out guidance (warning signal) for warning before starting a call of the call signal 40a to the receiving side terminal 31.
Note that, since the number conversion history is information distributed among the service providers, the number conversion history is information that cannot be deleted by an attacker from the outside of the service provider for the purpose of hiding evidence. Details of the determination processing as to whether or not to send the warning on the basis of the content of the number conversion history will be described later with reference to a flowchart of
The SIP server 20 includes a call reception unit 51, an SIP reception unit (call signal reception unit) 52, a call processing unit (warning processing unit) 53, an SIP processing unit (call signal processing unit) 54, a call transmission unit 55, and an SIP transmission unit 56. Hereinafter, processes of the SIP server 20 will be described along the contents of respective signals (call signals 40a, 44a and SIP signals 41a to 43a) in
First, the SIP server 24 of the calling side service provider 24D will be described.
The call reception unit 51 of the SIP server 24 receives the call signal 44a from the calling side terminal 11. The call signal 44a includes a calling number “090-1111-1111” of the calling side terminal 11 and the call receiving number “050-1111-2222” of the transfer service provided by the SIP server 23.
Note that “@24D” after the calling number “090-1111-1111” is an ID of the calling side service provider 24D specified from a number band of the calling number “090-1111-1111”. Hereinafter, the reference sign “24D” of the calling side service provider 24D is described after the @ mark, thereby indicating the ID of the service provider specified from the telephone number.
Here, a service provider is assigned to a calling number type (0AJ/0A0) in each number band by an administrative agency. For example, “0AJ” indicates an area code (for example, A=4 and J=2) of a fixed-line phone. “0A0” indicates a mobile number (A=8, 9), a PHS number (A=7), and an IP telephone (A=5).
Thus, from the combination of the calling number type and the service provider domain, the SIP server 20 can specify that each received signal has passed through a predetermined service provider. Further, the call processing unit 53 recognizes that the call is addressed to another service provider (connection service provider 23D) from the call receiving number of the received call signal 44a. The SIP processing unit 54 creates the SIP signal 43a including the call receiving number of the call signal 44a as INVITE. The SIP transmission unit 56 transmits the created SIP signal 43a to the SIP server 23.
Next, the SIP server 23 of the connection service provider 23D will be described.
The SIP reception unit 52 of the SIP server 23 receives the SIP signal 43a from the SIP server 24. The SIP processing unit 54 acquires the new call receiving number “03-1111-3333” of the SIP server 22 as the transfer destination from setting data of the transfer service according to the call receiving number “050-1111-2222” of the received SIP signal 43a.
The SIP processing unit 54 creates the SIP signal 42a from the SIP signal 43a by the following processing.
The SIP transmission unit 56 transfers the created SIP signal 42a to the SIP server 22.
Then, the SIP server 22 of the connection service provider 22D will be described.
The SIP reception unit 52 of the SIP server 22 receives the SIP signal 42a from the SIP server 23. The SIP processing unit 54 acquires the new call receiving number “0422-88-8888” of the receiving side terminal 31 as a transfer destination from the setting data of the transfer service according to the call receiving number “03-1111-3333” of the received SIP signal 42a.
When the SIP signal 42a is created from the SIP signal 41a, the SIP processing unit 54 replaces the call receiving number (INVITE) from “03-1111-3333” of the transfer source with “0422-88-8888” of the transfer destination, and adds “0422-88-8888” of the transfer destination to the History-Info header.
Furthermore, the SIP processing unit 54 adds “calling number: 090-1111-1111@24D” and “calling number setting: notification/non-notification” to the SIP signal 41a as setting information of the calling side terminal 11. The “calling number setting: notification/non-notification” is a setting as to whether or not to notify of the calling number. The setting information of the calling side terminal 11 is included not only in the SIP signal 41a but also in the SIP signal 42a and the SIP signal 43a (not illustrated).
The SIP transmission unit 56 transmits the created SIP signal 41a to the SIP server 21 directed to the receiving side terminal 31 of the transfer destination.
Then, the SIP server 21 will be described.
The SIP reception unit 52 of the SIP server 21 receives the SIP signal 41a from the SIP server 22. The SIP processing unit 54 recognizes that the call receiving number of the received SIP signal 41a is the receiving side terminal 31 in which it is accommodated.
Here, by executing the determination processing of
The call processing unit 53 creates the call signal 40a obtained by extracting a call receiving number “0422-88-8888” described in INVITE of the received SIP signal 41a. Then, the call transmission unit 55 sends a guidance for warning before the call of the call signal 40a is started to the receiving side terminal 31.
The SIP server 20 is configured as a computer 900 including a CPU 901, a RAM 902, a ROM 903, an HDD 904, a communication I/F 905, an input/output I/F 906, and a media I/F 907.
The communication I/F 905 is connected to an external communication device 915. The input/output I/F 906 is connected to an input/output device 916. The media I/F 907 reads and writes data from and to a recording medium 917. Moreover, the CPU 901 controls each processing unit by executing a program (also referred to as an application or an app for abbreviation thereof) read into the RAM 902. Then, the program can be distributed via a communication line or recorded in a recording medium 917 such as a CD-ROM and distributed.
The SIP server 21 acquires the number conversion history from the received SIP signal and calculates parameters i, j, and k to be used in an evaluation expression of a warning (S101). The larger the numerical values of these parameters i, j, and k are, the more suspicious they are as the caller of the special fraud, and consequently, guidance for warning before the start of a call of the call signal 40a is also more likely to be sent to the receiving side terminal 31.
The SIP server 21 determines whether or not the SIP signal 41a in
The SIP server 21 determines whether or not a determination expression “j≥Th1” (Th1 is a first threshold serving as a reference value for a case of a foreign call) is satisfied (S103). If Yes in S103, the SIP server 21 determines that a warning is necessary before calling the receiving side terminal 31 (S112), and if No in S103, the SIP server 21 determines that a warning is unnecessary (S111).
The SIP server 21 calculates a warning score p=i×j×k in a case of a domestic call (S104). The larger the warning score, the more suspicious it is as the caller of the special fraud.
The SIP server 21 determines whether or not a determination expression “p≥Th2” (Th2 is a second threshold that is a reference value for domestic call) in a case of a domestic call is satisfied (S105). If Yes in S105, the SIP server 21 determines that a warning is necessary before calling the receiving side terminal 31 (S112), and if No in S105, the SIP server 21 determines that a warning is unnecessary (S111).
In
Then, the SIP server 21 calculates a warning score p2=(α×m)+(β×n)+(γ×k) (instead of S104), and determines whether or not the determination expression “p2≥Th3” (third threshold) is satisfied (instead of S105). Here, by setting the weight α>β>γ, it is assumed that the transmission source opposition of the calling side information of the calling side terminal 11 is prioritized, the calling number type is prioritized next, and the calling number setting is not prioritized over them.
In addition, the SIP server 21 may combine the determination processing illustrated in
(Determination processing 1) A method of warning of a call from a calling number listed in a black list by collating the calling number of the call with a black list registered in advance as described in Patent Literature 2.
(Determination processing 2) A method of warning of a keyword extracted from call content by voice recognition is collated with problem words registered in a database in advance, so that a call that has uttered a problem word is warned through another route (by e-mail or the like to a subscriber or a relative). Note that, like a spam mail filter, a combination of the problem word spoken on the phone and the determination result of the special fraud may be used as correct answer data, and the content of the database may be learned by the analysis AI (Artificial Intelligence) of the special fraud.
For example, the SIP server 21 determines that a warning is necessary in a case where any one of the determination processing in
Hereinafter, specific cases in which the determination processing of
In a case of relaying a call across two countries, the SIP server 23 sets an international call identifier in the received SIP signal 43a and then relays the received SIP signal 43a to the SIP server 22. The international call identifier is set, for example, as “verstat=No-TN-Validation” in a P-Asserted-Identity header (hereinafter referred to as a PAID header) indicating calling number information of the SIP signal 43a.
Since the international call identifier is information distributed between the service providers of the connection service provider 23D and the connection service provider 22D, the international call identifier is not affected even if information (calling number) outside the service provider is frequently changed.
Note that the “verstat=No-TN-Validation” is an identifier indicating that the calling number is not validated. This identifier is specified to be assigned to the calling number given by a foreign telecommunications carrier in the standardization document JJ-90.30 (common interconnection interface between IMS business networks) of the Association of General Corporate Members Information Communication Technology (The Telecommunication Technology Committee).
That is, when relaying a call across two countries, the SIP server 23 of the connection service provider 23D is required to give “verstat=No-TN-Validation”.
Since the calling number is a foreign number (+663-2222-2222), the international call identifier is included in the History-Info header of the SIP signal 41a received by the SIP server 21. Accordingly, the SIP server 21 satisfies the determination expression “j≥Th1” (Th1=1) in a case of a foreign call (S103, Yes), and thus it is determined that a warning is necessary (S112).
Therefore, the History-Info header of the SIP signal 41a received by the SIP server 21 includes “calling number setting: non-notification”. Accordingly, the SIP server 21 calculates the parameters i, j, and k from the received SIP signal as follows (S101).
Then, the SIP server 21 calculates a warning score p=i×j×k=8 in a case of a domestic call (S104). Since the SIP server 21 satisfies the determination expression “p≥Th2” (Th2=5) in a case of a domestic call (S105, Yes), it determines that a warning is necessary (S112).
The SIP server 21 calculates the parameters i, j, and k from the received SIP signal 41a as follows (S101).
Then, the SIP server 21 calculates a warning score p=i×j×k=2 in a case of a domestic call (S104). The SIP server 21 does not satisfy the determination expression “p≥Th2” (Th2=5) in a case of a domestic call (S105, No), and thus determines that the warning is unnecessary (S111).
As described above, as compared with the comparative example in which the necessity of the warning is determined only by the number i of times of transfer, in the present embodiment that comprehensively refers to the “the number i of times of transfer, the number of passed service providers j, and the calling number setting k”, it is possible to rescue a normal call and suppress an excessive warning even if the number i of times of transfer is large.
The SIP server 21 of the present invention includes:
Thus, even if the specific information (such as the calling number) of the caller of the special fraud is hidden along with the transfer of the call signal, it is possible to appropriately issue a warning with respect to a suspicious call signal from the transfer situation.
In the present invention, as the specific condition, the SIP processing unit 54
Accordingly, when the calling side terminal 11 is in a foreign country, the necessity of the warning signal is determined without referring to the number of times of transfer of the call signal. Thus, it is possible to frequently warn of a call signal having a high possibility of special fraud in which the calling side terminal 11 is in a foreign country.
Furthermore, since a comprehensive evaluation is performed with not only the number of times of transfer but also other indexes for a call signal of which the calling side terminal 11 is domestic, it is possible to rescue a normal call and suppress an excessive warning even if the number of times of transfer is large.
In the present invention, as the specific condition, the SIP processing unit 54
Thus, it is possible to determine the necessity of the warning signal with emphasis on the calling side information of the calling side terminal 11.
The present invention is characterized in that, in addition to a case where the specific condition is met, the SIP processing unit 54 determines that the warning signal is necessary when the calling number of a call is a calling number listed in a black list registered in advance.
Accordingly, it is possible to appropriately issue a warning even with respect to a call signal whose calling number is suspicious.
The present invention is characterized in that, in addition to a case where the specific condition is met, the SIP processing unit 54 determines that the warning signal is necessary when a keyword extracted from call content of the call signal by voice recognition matches a problem word registered in a database in advance.
Accordingly, it is possible to appropriately issue a warning even with respect to a call signal whose call content is suspicious.
Filing Document | Filing Date | Country | Kind |
---|---|---|---|
PCT/JP2021/005834 | 2/17/2021 | WO |