KR102416542B1 - Apparatus and method for detecting spam based on artificial intelligence - Google Patents

Abstract

A method for a spam detection apparatus to detect spam, the method comprising: collecting message information from a plurality of terminals; processing the message information to generate two-dimensional learning images; message information corresponding to the learning image in each learning image generating learning data corresponding to the spam determination result of , supervising and learning a spam index calculation model using the learning data. When new message information is collected from an arbitrary terminal, the new message information is processed and two-dimensional input A spam detection method comprising the steps of generating an image, calculating a spam index for the new message using the input image and the spam index calculation model, and transmitting the calculated spam index to the arbitrary terminal to be.

Description

AI-based spam detection device and method

The present invention relates to a spam detection technology based on artificial intelligence.

Based on the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. of the current corporation, the Korea Internet & Security Agency prohibits commercial advertisement information transmitted unilaterally through mobile phones or landlines, etc., even though the recipient did not want it, as spam. However, the amount of advertising spam is increasing every year.

Spam, that is, the method of sending product information to mobile phones through text messages or phone calls, is widely used as an advertising method because it is cost-effective. However, these spam messages tend to be sent in large quantities to unspecified people without the consent of the recipient, so it is becoming a social issue.

In order to prevent spam, various methods and systems have been implemented and operated. Most of them are rule-based, and a method of generating a rule set that can detect spam transmission characteristics and patterns, and detecting spam through periodic management is adopted.

The rules are set by experts in the field of spam detection based on their operational know-how, and as long as the rules are set correctly, spam matching the rule conditions can be detected quickly and accurately. In addition, the rule has the characteristic of deterministically determining whether or not it is spam for each message.

However, once a rule is set, only messages that match the rule condition can be filtered out, and even a slight modification of the message cannot be detected as spam. In addition, when hackers recognize that the spam detection rules are working, they immediately transform and use the spam attack method, so there is a problem that an expert needs to continuously manage the rule set.

The task to be solved is to provide a method and system for calculating the spam index using an AI-based algorithm for various spam text messages and phone calls, and using this to detect spam.

In addition, the task to be solved is to provide a method and system for detecting spam or similar spam without a specific form by using an artificial intelligence-based algorithm that is flexibly applied even when hackers transform spam.

A method for a spam detection apparatus according to an embodiment to detect spam, the method comprising: collecting message information from a plurality of terminals; processing the message information to generate two-dimensional learning images; and learning images corresponding to each learning image generating learning data corresponding to the spam determination result of message information corresponding to , supervising and learning a spam index calculation model using the learning data; generating a two-dimensional input image by processing, calculating the spam index for the new message using the input image and the spam index calculation model, and transmitting the calculated spam index to the arbitrary terminal include

The generating of the training images includes binarizing the sender-related information included in each message information, arranging the binarized information in two dimensions, and dividing the two-dimensionally arranged bits into arbitrary length units, dividing The method may include converting each of the bit units into integers, and generating a two-dimensional image by matching the converted integers to values representing gray scale or color.

The two-dimensional arranging may include two-dimensionally arranging messages corresponding to a specific item among the sender-related information, further including information on the number of accumulated messages for a reference time.

When a plurality of messages are received from a specific caller number within a predetermined time interval, the information on the accumulated number may include a time interval between each received message.

The information on the accumulated number of cases may include the accumulated number of messages received from a specific caller number during the reference time or the accumulated number of messages received from a sender of a specific address during the reference time.

The spam index calculation model uses a convolutional neural network, and the spam index may be a probability value calculated from a final node of the convolutional neural network included in the spam index calculation model.

After the step of calculating the spam index, confirming the calling number in the new message information, determining whether the calling number is a number included in a pre-stored black list or a pre-stored white list, and the calculation according to the determination result It may further include the step of correcting the spam index.

As a spam detection apparatus according to another embodiment, a preprocessor that processes message information collected from a plurality of terminals to generate two-dimensional learning images, and a spam determination result of message information corresponding to the learning image corresponds to each learning image and a model learning unit for supervising and learning the spam index calculation model by using the training data and generating the training data, wherein the pre-processing unit collects new message information from any terminal, processing the new message information to form a two-dimensional It generates an input image, and further includes a spam index calculator for calculating a spam index for the new message by using the input image and the spam index calculation model.

The spam detection device checks the caller number in the new message information, determines whether the caller number is a number included in a pre-stored black list or a pre-stored white list, and corrects the calculated spam index according to the determination result It may further include a post-processing unit.

The model learning unit may modify the spam index calculation model by reflecting the determination result of the post-processing unit.

A method for a spam detection device to process message information collected from a terminal according to another embodiment, the method comprising: generating an outgoing information table including sender-related information among message information; Generating a cumulative information table including the cumulative number of messages corresponding to an arbitrary item, collecting new message information from an arbitrary terminal, and adding sender-related information included in the new message information to the new outgoing information table Recording in a row, recording the accumulated number of cases changed as the new message information is received in a new row of the accumulated information table, and a row added to the outgoing information table and a row added to the accumulated information table and binarizing the content and arranging it in two dimensions, and converting the two-dimensional array into an image.

The cumulative information table includes the number of messages received from a specific caller number accumulated during the reference time, the number of messages received from the sender of a specific address accumulated during the reference time, or a plurality of messages received from a specific caller number. It may include a reception time interval.

The converting to the image includes dividing the bits constituting the two-dimensional array into arbitrary length units, converting the divided bits into integers, and matching the converted integers to values representing gray scale or color may include steps.

According to the present invention, since spam probability is calculated rather than deterministic judgment, spam that is deformed without a specific format can be detected, and a more precise spam detection service can be provided to the recipient.

In addition, according to the present invention, since a model based on artificial intelligence is used instead of using a fixed rule, spam can be detected without an expert's continuous rule management, and thus management efficiency can be increased.

1 is a block diagram of a spam detection system according to an embodiment.
2 is a block diagram of an apparatus for detecting spam according to an embodiment.
3 is a flowchart of a method of operating a spam detection apparatus according to an embodiment.
4 is a flowchart illustrating a method of a preprocessor generating an image based on message information according to an exemplary embodiment.
5 is an exemplary diagram of a table in which message information is managed according to an embodiment.
6 is an exemplary diagram of a table in which message information is managed according to another embodiment.
7 is an explanatory diagram illustrating a method of arranging message information by a preprocessor according to an embodiment.
8 is an explanatory diagram illustrating a method of a preprocessor generating a two-dimensional image according to an exemplary embodiment.

Hereinafter, with reference to the accompanying drawings, the embodiments of the present invention will be described in detail so that those of ordinary skill in the art to which the present invention pertains can easily implement them. However, the present invention may be embodied in several different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part "includes" a certain element, it means that other elements may be further included, rather than excluding other elements, unless otherwise stated. In addition, terms such as “…unit”, “…group”, and “module” described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software. have.

In the present specification, a terminal is a user equipment, and includes a device, a user equipment (UE), a mobile equipment (ME), a mobile station (MS), a mobile terminal (MT), a subscriber station, SS), Portable Subscriber Station (PSS), User Equipment (UE), Access Terminal (AT), etc. may be referred to in terms such as mobile terminal, subscriber station, portable subscriber station, It may include all or part of the functionality of a user device or the like.

In addition, the terminal is a mobile communication terminal capable of processing SIP (Session Initiation Protocol) signaling, and may be any communication device capable of performing IP-based communication, such as a personal portable terminal as well as a mobile phone. For example, the terminal includes a cellular phone, a Personal Communication Service (PCS) phone, a Personal Digital Assistant (PDA) phone, a Global System for Mobile Communications (GSM) phone, a Wideband Code Division Multiple Access (WCDMA) phone, and a Code Division Multiple (CDMA) phone. Access)-2000 phone, DMB (Digital Multimedia Broadcasting) phone, LTE (Long Term Evolution) phone, etc. may be.

In this specification, spam refers to advertisement information that is unilaterally transmitted through an information and communications network despite the user's unwillingness to do so. It may be delivered in various forms, such as a message or a phone call, and in the present specification, a message will be described for convenience. The act of sending spam is called spamming, and the subject sending spam is called a spammer.

Fig. 1 is a block diagram of a spam detection system according to an embodiment.

Referring to FIG. 1 , a spam detection system 1000 includes a plurality of terminals 100 and a spam detection apparatus 200 . The terminal 100 is a device capable of communicating with a spam detection device. The spam detection apparatus is implemented to perform the operations described in the present invention.

The terminal 100 receives a message including spam, transmits the received message to the spam detection device 200 , and receives a probability that the message is spam from the spam detection device 200 .

The terminal 100 includes a spam monitoring unit 110 , the spam monitoring unit 110 intercepts a message received by the terminal 100 , extracts message information, and transmits it to the spam detection device 200 .

The message information extracted by the spam monitoring unit 110 is at least one of the information of the call history record (Call Detail Recording, CDR) related to the use of the phone, such as calling number, called number, call volume, call time, caller industry code, caller address code, etc. may include Thereafter, the terminal 100 receives the spam index calculated by the spam detection device 200 and delivers it to the user. In addition, by delivering the spam index to the manager (not shown), the accuracy of the spam index can be further verified, and the performance of the learning model can be adjusted based on the verification result.

The spam detection apparatus 200 collects message information received from the spam monitoring unit 110 of the user terminal 100 . Based on the collected information, pre-processing is performed to generate a learning image by processing it into the form required for deep learning model learning. After that, a learning model is created using artificial intelligence. Thereafter, when a message is transmitted from the spam monitoring unit 110 to the spam detection device 200 , the preprocessor 220 generates an input image, and the learning model calculates a spam probability for the input image. The post-processing unit 260 calculates the spam index through post-processing such as converting the spam probability into a standard value, and transmits it to the spam monitoring unit 110 of the terminal 100 .

2 is a block diagram of an apparatus for detecting spam according to an embodiment.

Referring to FIG. 2 , the spam detection apparatus 200 includes a data collection unit 210 , a preprocessor 220 , a model learning unit 230 , a storage unit 240 , a spam probability calculator 250 , and a postprocessor ( 260).

The data collection unit 210 collects message information transmitted from the spam monitoring unit 110 installed in each of the plurality of user terminals 100 for model learning, and delivers the collected message information to the preprocessor 220 . .

The pre-processing unit 220 processes the message information received from the data collection unit 210 into a form necessary for model learning and spam index calculation, and in the present invention, it processes it into a grayscale image form to form a model learning unit 230 and spam It is transmitted to the probability calculator 250 .

The model learning unit 230 generates training data using the images delivered by the preprocessor 220 and the administrator's spam determination result or the terminal user's spam report data, and calculates the spam probability using the generated training data. learn a deep learning model. The deep learning model used in the present invention may be a convolutional neural network (CNN), and is not necessarily limited to this algorithm.

The storage unit 240 accumulates message information, that is, data for model learning. The storage unit 240 manages message information input according to time and information that is accumulated and changed for each reference time in a table. These tables are referred to as a calling information table and a cumulative information table, respectively, and details will be described with reference to FIG. 5 .

In addition, the storage unit 240 stores the learning model generated by the model learning unit 230 and stores the spam probability data calculated by the spam probability calculation unit 250 . In addition, in order to adjust the performance of the learning model or to modify the model, the final decision result of the administrator may be additionally stored.

The spam probability calculation unit 250 calculates the spam probability in real time for the image transmitted from the preprocessor 220 . The spam probability calculation unit 250 primarily calculates the probability that the message is spam by using the learning model in the storage unit 240 .

The post-processing unit 260 performs additional determination to determine whether the originating number of the corresponding message is a number belonging to the black list or the white list with respect to the spam probability calculated by the spam probability calculation unit 250, or the spam probability calculation unit 250 ) can be standardized with a standard score (Z-score), etc., calculated from the spam probability. For example, even if a specific message is calculated as having a high probability of being spam, if the originating number of the message belongs to the white list, the post-processing unit 260 finally determines that the message is not spam.

The spam index finally calculated through this correction may be transmitted to the spam monitoring unit 110 of the user terminal 100 and displayed on the screen of the terminal 100 . In addition, the final determination and correction results made by the post-processing unit 260 may be stored again in the storage unit 240 to be utilized in the model learning process.

3 is a flowchart of a spam detection method according to an embodiment.

Referring to FIG. 3 , the terminal 100 transmits the received message information to the spam detection apparatus 200 ( S101 ). The spam monitoring unit 110 of the user terminal 100 intercepts the message received by the terminal 100 , extracts message related information such as sender information, and transmits it to the data collection unit 210 of the spam detection device 200 .

The data collection unit 210 of the spam detection apparatus 200 collects message information transmitted from the spam monitoring unit 110 of the plurality of terminals 100 (S102). The collected information is used as data to create a learning model.

The spam detection apparatus 200 pre-processes the collected message information to generate a training image (S103). Hereinafter, a message processed in the form of a two-dimensional grayscale image is collectively referred to as an image, and images used to create a learning model are collectively referred to as a learning image. The generated training images are stored in the storage unit 240 . Hereinafter, a detailed method of the preprocessor 220 processing the message information into an image will be described with reference to FIGS. 4 to 7 .

The spam detection apparatus 200 generates training data using the processed pre-processing training images and the administrator's spam determination result, and generates a training model using the generated training data (S104). The deep learning model used at this time is not specific to any one algorithm, but in the present specification, a method using a convolutional neural network model is assumed.

Meanwhile, the performance of the learned model may be adjusted according to the judgment of the post-processing unit 260 , and the final model in which the correction result of the post-processing unit 260 is reflected is stored in the storage unit 240 .

Thereafter, the spam message created by the spammer 300 is transmitted to the user terminal 100 (S105). In the present specification, the type of spam received by the user terminal 100 is not limited to text messages, and any form capable of spam work may be possible along with phone calls and mail.

The spam monitoring unit 110 installed in the terminal 100 intercepts and analyzes the received message, extracts message-related information such as sender information, and transmits it to the spam detection device 200 (S106).

The preprocessor 220 of the spam detection apparatus 200 preprocesses the message information transmitted from the terminal 100 and processes it into an input image in the form of a two-dimensional grayscale image (S107).

The spam probability calculation unit 250 of the spam detection device 200 primarily calculates the spam probability by inputting the processed input image to the learning model (S108).

The convolutional neural network model used in this specification is one of deep learning algorithms that combines a convolution function and a neural network. Hereinafter, the convolutional neural network model will be briefly described. The convolutional neural network model is largely divided into a feature learning stage and a classification stage.

In the feature learning step, a convolution process for generating a feature map using a plurality of convolution kernels or filters in an input image, subsampling or pooling to reduce the size or spatial resolution of the feature map ) process to extract various features of the input image. The convolution process and subsampling process may be repeated several times depending on the size and characteristics of the input image.

In the subsequent classification step, the input image can be classified by constructing a fully connected layer using the extracted features, and in the last output layer, it can be classified into two classes using logistic regression, or a soft max function (Softmax). Function) can be used to classify into three or more classes.

For example, the result calculated by the spam probability calculation unit 250 is a spam probability and a non-spam probability, so it is a problem of classifying it into two classes. Therefore, the last layer of the classification step consists of two nodes, and all nodes of the fully connected layer are connected to these two nodes respectively to calculate the spam probability. The final calculated values are the probability of being spam and the probability of not being spam.

The post-processing unit 260 of the spam detection device 200 calculates a final spam index by correcting the spam probability based on the additional information (S109). The post-processing unit 260 may generate a spam index by increasing the spam probability in the case of spam by a caller number included in the black list with respect to the spam probability calculated by the spam probability calculation unit 250, and may generate a spam index included in the white list. In the case of spam by the sender number, the spam index can be created by lowering the spam probability. The algorithm can be modified by reflecting this in the learning model. In addition, for the convenience of the user, the probability of spam may be converted into a standardized score and provided.

The spam detection device 200 transmits the calculated spam index to the spam monitoring unit 110 of the terminal 100 (S110). In this case, the spam detection apparatus 200 may transmit the spam index to the administrator, and the administrator may adjust the performance of the model according to the relationship between the spam index and the spam message.

Thereafter, the terminal 100 notifies the user of the spam index by displaying the spam index on the screen of the terminal 100 (S111). For example, the terminal 100 may display the spam index on the screen at the same time as the message, or may display the spam index on the number from which the spam message is transmitted.

Hereinafter, a method in which the preprocessor 220 generates a training image and an input image based on the message information and the generated image will be described as an example.

4 is a flowchart illustrating a method for a preprocessor to generate an image based on message information according to an embodiment, FIG. 5 is an exemplary diagram of a table in which message information is managed according to an embodiment, and FIG. 6 is another embodiment It is an exemplary diagram of a table in which message information is managed according to It is an explanatory diagram showing how to do it.

Referring to FIG. 4 , the preprocessor 220 processes the message information to generate an outgoing information table including sender-related information (S210). The sender information table arranges information related to a sender among message information delivered from the spam monitoring unit 110 installed in the user terminal 100 to the spam detection device 200 in a table.

Referring to FIG. 5 , fields included in the originating information table may include a message originating number, message transmission time, sender information, sender's industry type, sender's address, and the like. On the other hand, when the information received by the terminal 100 is not in the form of a message, a field for inputting a transmission type may be included.

The preprocessor 220 generates an accumulated information table including the accumulated number of messages corresponding to any item of outgoing information during the reference time (S220). The cumulative information table is an arrangement of cumulative values in a table by accumulating events occurring in chronological order in each terminal 100 , and may be used to increase the accuracy of the model by including more various information in the input image.

Referring to FIG. 6 , the accumulated information table may be generated based on information recorded in the outgoing information table or newly collected message information. For example, create a field indicating how many messages were received from a specific caller number during a reference time (1 minute, 3 minutes, or 60 minutes, etc.), and display 0 or 1 in the corresponding cell, or O or X, Yes Alternatively, it may be indicated as No, and the displayed symbol may be a predefined letter, number, or symbol.

For example, in FIG. 6(a), the terminal 100 fielded the accumulated number of messages received from a specific caller number for a certain period of time, and FIG. 6(b) shows that the terminal 100 is the sender of a specific address. The accumulated number of messages received over a certain period of time from Although the reference time is divided into 1 minute, 3 minutes, and 60 minutes, this may be changed according to a user or an administrator, and the number of standards for dividing a column may also be changed.

Also, (c) of FIG. 6 is a format in which time intervals of messages previously collected from the same caller number are fielded. When a plurality of messages are received from a specific caller number, the time difference at which the messages are received is used as learning data. Through this, it is possible to determine whether or not spam is spam in a shorter time compared to a rule-based or deep learning-based spam detection method that detects spam based on the accumulated number of cases. Therefore, it is possible to reduce the damage caused by spam by quickly blocking spam.

In (c) of FIG. 6, the time interval is set to 1 second, 5 seconds, 10 seconds, and 60 seconds for three messages, but the number of messages for calculating the time interval or the time interval between messages is set differently or dynamically can be set.

Meanwhile, since spam collected in the present invention is not limited to messages, in the case of spam calls, FIG. 6(c) may be changed to mean a time interval between calls received from the same caller number.

When the preprocessor 220 receives new message information from the data collection unit 210, it extracts sender-related information and records it in the outgoing information table (S230). The pre-processing unit 220 manages each message information received from the terminal 100 by inputting it into the outgoing information table in chronological order. Therefore, the most recently received message information will be entered in the lowest row of the outgoing information table.

When the preprocessor 220 receives new message information from the data collection unit 210, the changed accumulated number is recorded in the accumulated information table (S240). For example, when a total of 70 messages are received for 3 minutes from a specific caller number as new message information is collected, “60~ You can enter 1 or any mark in the cell marked with the 89" key.

As another example, when three messages are received from the same caller number, and the time interval with the message received immediately before the current message is 0.7 seconds, and the time interval with the message received before, 4 seconds, FIG. 6 In the cumulative information table shown in (c) of (c), the cell marked “less than ~1 second” among “interval with the n-1th message” and “less than 1-5 seconds” among “the interval between the n-2th message” You can enter 1 or any mark in the cell marked with .

The preprocessor 220 binarizes the content added to the outgoing information table and the accumulated information table and arranges them in two dimensions (S250).

Since the information included in the outgoing information table is in the form of numbers or letters, and the purpose of the information included in the cumulative information table is to indicate whether or not it corresponds to a specific cell, the binarized content of each information in the calling information table is The bit length will be longer than the binarized information. Accordingly, the items of the outgoing information table having a long bit length are first arranged, and the items of the accumulated information table having a short bit length are arranged to generate a rectangular shape.

Meanwhile, although it is assumed in FIG. 7 that one originating information table and one cumulative information table are used, the number of used cumulative information tables is not necessarily one. Both the calling information table shown in FIG. 5 and the cumulative information table shown in FIG. 6 may be used.

The preprocessor 220 divides the bits constituting the two-dimensional array into preset length units, and converts each bit unit into an integer (S260). Each piece of information arranged in a rectangle is expressed as a binary number of 0 or 1, and the arranged bits are divided into specific length units. After that, the divided bits are converted into decimal integers.

The preprocessor 220 generates a two-dimensional image by matching the number converted into an integer to a value representing color information (S250). A value representing color information may be a gray scale representing brightness or a value of RGB.

For example, the two-dimensional array generated in step S250 is composed of 0 or 1. At this time, if the arranged bits are divided into units with a size of 1 and the divided bits are converted into integers, the 0 bit is 0 even when converted to a decimal number, and the 1 bit is 1 when converted to a decimal number. Therefore, it is possible to generate a black-and-white image having two levels of contrast by matching 0 to black and 1 to white.

가지, 즉 256 단계의 명암을 갖는 그레이 스케일 이미지를 생성할 수 있다.As another example, referring to FIG. 8 , it is assumed that the rectangle generated through FIG. 7 is divided into 8-bit units. In this case, each divided bit unit may correspond to cases from '00000000' to '11111111'. If each divided bit unit is converted to a decimal number, a bit unit of '0000000' will be converted to 0, a bit unit of '11111111' will be converted into 255, and a bit unit of '01010101' will be converted into 85. That is, one bit unit can correspond to a number from 0 to 255, and if the 0 part corresponds to black and the 255 part to white

It is possible to generate a gray-scale image having 256 levels of light and dark.

According to the present invention, since spam probability is calculated rather than deterministic judgment, spam that is deformed without a specific format can be detected, and a more precise spam detection service can be provided to the recipient.

In addition, according to the present invention, since a model based on artificial intelligence is used instead of using a fixed rule, spam can be detected without an expert's continuous rule management, and thus management efficiency can be increased.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto. is within the scope of the right.

Claims (13)

A method for a spam detection device to detect spam, comprising:
collecting message information from a plurality of terminals;
generating two-dimensional learning images by processing the message information;
Generating training data corresponding to spam judgment results in each training image;
Supervised learning of a spam index calculation model using the learning data;
When new message information is collected from an arbitrary terminal, generating a two-dimensional input image by processing the new message information;
calculating a spam index for the new message using the input image and the spam index calculation model;
Checking the calling number in the new message information, and determining whether the calling number is a number included in a black list or a white list;
Correcting the spam index calculated according to the determination result, and
Comprising the step of transmitting the corrected spam index to the arbitrary terminal,
The step of correcting the spam index
When the caller number is included in the black list, it is corrected to a higher spam index than the spam index calculated using the spam index calculation model, and when the caller number is included in the white list, using the spam index calculation model A spam detection method that calibrates the spam index to a lower spam index than the calculated spam index. In claim 1,
The step of generating the learning images,
binarizing the sender-related information included in each message information, and arranging the binarized information in two dimensions; and
Splitting the two-dimensionally arranged bits into arbitrary length units, converting the divided bit units into integers, and
generating a two-dimensional image by matching the converted integer to a value representing a gray scale or color;
Including, spam detection method. In claim 2,
The step of arranging in two dimensions,
A spam detection method for arranging messages corresponding to a specific item among the sender-related information in two dimensions, further including information on the number of accumulated messages for a reference time. In claim 3,
Information on the accumulated number of cases,
When a plurality of messages are received within a predetermined time interval from a specific caller number, a spam detection method comprising a time interval between each received message. In claim 3,
Information on the accumulated number of cases,
A spam detection method comprising the number of accumulated messages received from a specific caller number during the reference time or the number of messages received from a sender of a specific address accumulated during the reference time. In claim 1,
The spam index calculation model uses a convolutional neural network,
The spam index is a probability value calculated in the final node of the convolutional neural network included in the spam index calculation model, the spam detection method. delete A pre-processing unit that generates two-dimensional images by processing the message information collected from a plurality of terminals;
Receive training images for learning the spam index calculation model from the preprocessor, generate training data corresponding to the spam determination result in each training image, and learn a model to supervise and learn the spam index calculation model using the training data wealth,
A spam index calculator that receives the two-dimensional input image generated for the new message information from the preprocessor, and calculates the spam index for the new message by using the input image and the spam index calculation model; and
When the caller number is included in the black list in the new message information, the spam index calculation model is corrected to a higher spam index than the spam index calculated using the spam index calculation model, and when the caller number is included in the white list, the spam index calculation model After correcting the spam index to a lower spam index than the calculated spam index using
Including, spam detection device. delete In claim 8,
The model learning unit,
A spam detection device that modifies the spam index calculation model by reflecting the determination result of the post-processing unit. As a method of processing the message information collected from the terminal by the spam detection device,
generating an accumulated information table of the specific caller number by using message information sent from the specific caller number;
Collecting new message information from any terminal;
Recording the sender-related information included in the new message information in a calling information table, and updating the accumulated information table corresponding to the calling number of the new message information;
arranging the cells of the origination information table of the new message information and the cumulative information table updated by the new message information in two dimensions, and converting the two-dimensional array into an image;
Including, message information processing method. In claim 11,
The cumulative information table is
Including the number of accumulated messages received from a specific caller number for a reference time, the number of messages received from a sender of a specific address accumulated during the reference time, or a reception time interval of a plurality of messages received from a specific caller number, How message information is processed. In claim 11,
The step of converting to the image is,
dividing the bits constituting the two-dimensional array into arbitrary length units, and converting the divided bits into integers; and
Corresponding the converted integer to a value representing a gray scale or color
A message information processing method comprising a.

Images