Patent Application
20230033572
The present invention relates to a call warning apparatus, a call warning system, a call warning method, and a call warning program.
In recent years, the number of special scam cases has increased greatly, and “It's me” telephone scams (which are scams in which scammers pretend to be a victim's son saying “It's me”) account for more than half of all scam tricks; therefore, there has been a demand for countermeasures against scams using a telephone. In addition, as IP networks have become widespread, there have been cases where call signals of special scams may sometimes be transmitted on the networks as Session Initiation Protocol (SIP) signals.
PTL 1 describes a method for a communication system that controls calls using SIPs in which guidance is provided to a user who receives a call before end-to-end media connection between a caller terminal and a callee terminal. This allows a callee to operate as requested by the guidance or the like to determine whether a connection is possible.
PTL 2 describes a telephone call system in which evaluation information of a caller terminal is provided to a callee terminal before the callee terminal responds to a call from the caller terminal, and then the callee terminal communicates with the caller terminal. In this way, the callee terminal can appropriately select scenarios to receive a call or disconnect a call according to an instruction of the callee, such as rejecting a call from a caller terminal having a poor evaluation, receiving a call from a caller terminal having a good evaluation.
In a method of registering attackers on a blacklist in the related art, caller numbers that are identified as having been used in special scams need to be registered in advance and the like. Thus, when an attacker frequently changes caller numbers, the blacklist may become obsolete, which may make it difficult to adequately cope with such special scams. Thus, using other approaches indicating the calling tendencies of special scams needs to be considered, rather than directly indicating the attacker, such as indicating the caller number.
An example in which an outgoing call from a caller side terminal 11z passes through four SIP servers (an SIP server 21z→an SIP server 22z→an SIP server 23z→an SIP server 24z) to reach the callee number “0422-88-8888” of the callee side terminal 31z is illustrated.
A caller side service provider 21Dz manages the SIP server 21z accommodating the caller side terminal 11z. A connection service provider 22Dz manages the SIP server 22z. A connection service provider 23Dz manages the SIP server 23z. A callee side service provider 24Dz manages the SIP server 24z accommodating the callee side terminal 31z. In addition, a callee number for transfer “03-1111-2222” is set for the SIP server 22z, and a callee number for transfer “03-1111-3333” is set for the SIP server 23z.
Here, attackers often abuse transfer services provided by the SIP servers 22z and 23z to delay identification (tracking) which reveals that the attacker is a special scam caller. In a transfer service, identifying a special scam is difficult because the callee number of a call signal switches from a transfer source number to a transfer destination number.
Thus, it is effective to use a number conversion history at the stage in which the call signal passes through each SIP server as a clue indicating the calling tendency of a special scam. However, such clues have not been used in the related art.
Thus, the present invention has the main task of issuing a suitable warning even when a special scam frequently changes call numbers.
In order to accomplish the task, a call warning apparatus of the present invention has the following features.
According to the present invention, when a call warning apparatus receives a call signal addressed to a callee side terminal, a number conversion history set by a transfer apparatus that has transferred the call signal in a transfer service involved with a number conversion is read from the call signal, and when the number conversion history meets a specific condition, a warning signal is transmitted to the callee side terminal before the call signal is transmitted to the callee side terminal.
According to the present invention, a suitable warning can be issued even when a special scam frequently changes the call numbers.
Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
An example in which an outgoing call from a caller side terminal 11 passes through four SIP servers 20 (an SIP server 21→an SIP server 22→an SIP server 23→an SIP server 24) to reach the callee number “0422-88-8888” of a callee side terminal 31 is illustrated, as in
The terms “transfer” and “relay” will be used differently in the present specification. For example, it is assumed that the SIP signal (call signal) passes through a first SIP server 20, a second SIP server 20, and a third SIP server 20 in this order. Here, the case in which the second SIP server 20 changes the callee number (destination) of the SIP signal will be referred to as “transfer”, and the case in which the second SIP server 20 does not change the callee number will be referred to as “relay”. For example, the following operation is performed in
Then, in a case in which each SIP server 20 transfers an SIP signal, the SIP server 20 sets the transfer source number and the transfer destination number in a number conversion history (History-Info) of the received SIP signal and transmits the SIP signal to the transfer destination. Further, each SIP server 20 is an apparatus that allows notification of the content of History-Info (i.e., a trustworthy apparatus) and is only required to register an SIP server 20 that is another apparatus in the Privacy header of the SIP signal (not illustrated).
Here, because It's me scams tend to abuse the transfer service, the SIP server 24 is designed to transmit guidance (a warning signal) to give a warning to the callee side terminal 31 before starting a call of the call signal 45a when the content of the number conversion history of the SIP signal 44a that has reached the SIP server 24 is unnatural.
Further, the number conversion history is information that is distributed to service providers and is information that cannot be removed by an attacker from outside of the service providers in order to spoil the evidence. Details of the process to determine whether to transmit a warning based on the content of the number conversion history are described below in the flowchart of
The SIP server 20 includes a call reception unit 51, an SIP reception unit 52, a call processing unit 53, an SIP processing unit 54, a call transmission unit 55, and an SIP transmission unit 56. Hereinafter, processing of the SIP server 20 will be described along the details of each signal (the call signals 41a and 45a, and the SIP signals 42a to 44a) in
First, the SIP server 21 of the caller side service provider 21D will be described. The call reception unit 51 of the SIP server 21 receives the call signal 41a from the caller side terminal 11. The call signal 41a includes the callee number “03-1111-2222” of the transfer service provided by the SIP server 22.
The call processing unit 53 recognizes that the callee number of the received call signal 41a is addressed to another service provider. The SIP processing unit 54 creates the SIP signal 42a including the callee number of the call signal 41a as INVITE. The SIP transmission unit 56 transmits the created SIP signal 42a to the SIP server 22.
Next, the SIP server 22 of the connection service provider 22D will be described. The SIP reception unit 52 of the SIP server 22 receives the SIP signal 42a from the SIP server 21. The SIP processing unit 54 acquires the new callee number “03-1111-3333” of the SIP server 23 which is another transfer destination of the received SIP signal 42a from set data of the transfer service based on the callee number “03-1111-2222” of the received SIP signal 42a. The SIP processing unit 54 creates the SIP signal 43a from the SIP signal 42a through the following processing.
The SIP transmission unit 56 transfers the created SIP signal 43a to the SIP server 23.
Further, although the content of the History-Info header in the SIP signal 43a are described in
Here, “cause=302” in the second row indicates the reason for the number conversion (here, a normal transfer), and “mp” indicates the serial number of the entry of the conversion source.
In addition, the SIP server 23 of the connection service provider 23D will be described. The SIP reception unit 52 of the SIP server 23 receives the SIP signal 43a from the SIP server 22. The SIP processing unit 54 acquires the new callee number “0422-88-8888” of the callee side terminal 31 that is the transfer destination of the received SIP signal 43a from set data of the transfer service based on the callee number “03-1111-3333” of the SIP signal 43a.
The SIP processing unit 54 creates the SIP signal 44a from the SIP signal 43a through the following processing.
Further, the following third row is added to the content of the History-Info header in the SIP signal 44a.
Next, the SIP server 24 will be described.
The SIP reception unit 52 of the SIP server 24 receives the SIP signal 44a from the SIP server 23. The SIP processing unit 54 recognizes that the callee number of the received SIP signal 44a is of the callee side terminal 31 covered by the SIP server 24.
Here, the SIP processing unit 54 performs the determination process of
The SIP server 20 is configured as a computer 900 including a CPU 901, a RAM 902, a ROM 903, an HDD 904, a communication I/F 905, an input/output I/F 906, and a medium I/F 907. The communication I/F 905 is connected to an external communication apparatus 915. The input/output I/F 906 is connected to an input/output apparatus 916. The medium I/F 907 reads and writes data from a recording medium 917. Further, the CPU 901 controls the processing units by executing a program (also referred to as an application or an app that is an abbreviation thereof) read into the RAM 902. In addition, the program can also be distributed through a communication line or recorded and distributed on the recording medium 917 such as a CD-ROM.
The SIP server 24 acquires the number conversion history from the received SIP signal (S101) and determines whether a transfer after a logical-physical conversion has been performed in the number conversion history (the particular condition) (S102). The logical-physical conversion is a process of converting a logical number into a physical number. When the answer is YES in S102, it is determined that a warning is needed before a call is made to the callee side terminal 31 (S112).
When the answer is NO in S102, the SIP server 24 counts the number of transfers from the number conversion history of S101 (S103). Here, the SIP server 24 may count the number of transfers as is, regardless of the conversion cause, or may count the number of transfers after weighting the conversion cause of each transfer.
Then, the SIP server 24 determines that a warning is needed (S112) before a call is made to the callee side terminal 31 when the number of transfers of S103 is equal to or greater than a predetermined number of times (n times, for example, n=2) (the particular condition) (YES in S104). The SIP server 24 determines that no warning is needed if the answer in S104 is NO (S111).
A specific case in which the determination process shown in
Although the system configuration is roughly the same in
Furthermore, regarding the signal flowing from the caller side terminal 11 (upstream side) to the callee side terminal 31 (downstream side), “the call signal 41a→the SIP signal 42a→the SIP signal 43a→the SIP signal 44a→the call signal 45a” of
Further, the content of the History-Info header in the SIP signal 43b created by the SIP server 28 is text data as follows.
Here, “cause=408” in the second row indicates the reason for the number conversion (here, a transfer in a case of no response).
The History-Info header of the SIP signal 44b received by the SIP server 24 includes one normal transfer (counted as one in S103 of
Although the system configuration is roughly the same in
Furthermore, regarding the signal flowing from the caller side terminal 11 (upstream side) to the callee side terminal 31 (downstream side), “the call signal 41a→the SIP signal 42a→the SIP signal 43a→the SIP signal 44a→the call signal 45a” of
Further, the content of the History-Info header in the SIP signal 43c created by the SIP server 29 is text data as follows.
Here, “cause=380” in the second row indicates the reason for the number conversion (here, the logical-physical conversion).
In this way, the SIP server 24 determines that a warning is needed before a call is made to the callee side terminal 31 (S112) because the History-Info header of the SIP signal 44c includes “0422-88-8888 (transfer)” subsequent to “03-1111-3333 (logical-physical conversion)” (YES in S102 of
Further, a case in which a call is made to a reception desk such as a terminal 12 directly connected to the SIP server 29 and transferred immediately after the logical-physical conversion in the collect call service provided by the SIP server 29, or the like, is rare. Thus, it is assumed that the case of a call transferred after the logical-physical conversion is likely to be of an ill-intended transfer and a warning will be given.
In addition, a warning issued due to “a transfer after a logical-physical conversion” is an example of a policy that defines whether a warning is to be issued when the order of reasons for the number conversion matches a particular pattern. Thus, the administrator of the SIP server 24 may register a new specific pattern representing the tendency of special scam attacks in the SIP server 24 when a new specific pattern is discovered by analyzing traffic, or the like, in order to improve the warning accuracy.
Effects
According to the present invention, when the SIP server 24 receives a call signal addressed to the callee side terminal 31 as a transmission destination, a number conversion history set by the SIP server 22 that has transferred the call signal in the transfer service involved with a number conversion is read from the call signal, and if the number conversion history meets a specific condition, a warning signal is transmitted to the callee side terminal 31 before the call signal is transmitted to the callee side terminal 31.
This allows a warning to be given to a callee without using previously obtained attacker information (blacklist), and thus countermeasures can be taken against a trick of frequently changing numbers by giving a warning in real time.
According to the present invention, the SIP server 24 transmits a warning signal to the callee side terminal 31 if the number of times of number conversion is equal to or greater than a predetermined number as a specific condition.
Thus, ill-intention can be assumed when a transfer service is excessively used even though it is a normal service, and a suitable warning can be issued.
According to the present invention, the SIP server 24 counts the number of times of number conversion based on the weight associated with each conversion cause.
Thus, it is possible to avoid excessively issuing warnings to call signals that are less likely to be used in scams, by counting the number of transfers as 0.5 when, for example, the reason for the number conversion is a transfer in a case of no response (cause=408).
According to the present invention, the SIP server 24 transmits a warning signal to the callee side terminal 31 when another transfer occurs after the conversion from the logical number into the physical number takes place as a specific condition.
This allows a suitable warning to be issued to a call signal for unauthorized use of a collect call service such as toll-free numbers. Further, normal call signals tend to be used to make a call to a reception desk of the terminal 12 or the like directly connected to the SIP server 29 immediately after the logical-physical conversion of toll-free numbers.
The present invention is a call warning system including the SIP server 24 and the SIP servers 22 and 23 in which, when a callee number of a received call signal is a callee number of the transfer service provided by the SIP servers 22 and 23, the servers convert the number into the callee number of the transfer destination, and transfer a call signal in which the converted callee number has been added to a number conversion history to the transfer destination.
Thus, the SIP server 24 can trust the number conversion history from the SIP servers 22 and 23 that the call signal has passed through and issue a suitable warning.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2020/000033 | 1/6/2020 | WO |
