The invention provides a method for identifying novel malicious soon back imprest call by using a signaling monitoring technology. The method is characterized by comprising the following steps of: searching features of the soon back imprest call in general packet radio service (GPRS); retrieving feature codes of the soon back imprest call according to the searched features of a soon back imprest platform in the GPRS; matching suspected feature codes according to a discrimination policy of black list feature codes, and taking the feature codes in accordance with the matching policy as the black list feature codes; and tracking the suspected feature codes, obtaining evidence, and submitting and intercepting the suspected feature codes which are in accordance with the preset policy features. According to the invention, through correlation analysis of GPRS network online records and calling records of an interface A, signaling behavior features in accordance with the soon back imprest can be found; and the problem that the novel soon back imprest cannot be identified in the prior art can be solved.