Detecting fraudulent traffic in a telecommunications system

• US 10,015,676 B2
• Filed: 07/25/2013
• Issued: 07/03/2018
• Est. Priority Date: 07/25/2013
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Alvarez Dominguez, Rodrigo, Maldonado Martos, Francisco, Munoz de la Torre Alonso, Miguel Angel, Sanchez Vega, Veronica, Woods, John
• Primary Examiner(s): Arevalo, Joseph
• Application Number:
  US14/907,107
• Publication Number:
  US 20160192199A1
• Time in Patent Office: 1,804 Days
• Field of Search: 455410, 455 69, 455406, 4554563, 455423, 455411, 455466, 4554221, 370467
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Methods and apparatus for detecting fraudulent traffic associated with a user of a telecommunications system. A system comprises a monitoring network node comprising a traffic monitor configured to monitor traffic transmitted to or from a user in the telecommunications system, a fraud detector configured to apply to the monitored traffic a fraud profile associated with the user to determine whether the monitored traffic comprises fraudulent traffic, a transmitter configured to transmit data to a receiver of a profiling network node notifying whether the monitored traffic comprises fraudulent traffic. The profiling network node further comprises a fraud profiler configured to determine an updated fraud profile associated with the user based at least on the received data and a transmitter configured to transmit data identifying the updated fraud profile to one or both of a receiver of a subscription profile repository and a receiver of the monitoring network node.

Claims

1. A monitoring network node for detecting fraudulent traffic in a telecommunications system, the monitoring network node comprising:

one or more processors configured to;

monitor traffic to or from a user in the telecommunications system; and

apply to the monitored traffic a fraud profile associated with the user to determine whether the monitored traffic comprises fraudulent traffic, wherein the fraud profile comprises rules for monitoring the user for fraudulent traffic and/or detecting fraudulent traffic to or from the user;

a transmitter configured to transmit data notifying whether the monitored traffic comprises traffic determined to be fraudulent traffic, the data comprising an indication of a probability that the monitored traffic comprises fraudulent traffic; and

a receiver configured to receive data identifying an updated fraud profile for the user, wherein the updated fraud profile comprises updated rules for monitoring the user based on the indication of the probability that the monitored traffic comprises fraudulent traffic for fraudulent traffic and/or detecting fraudulent traffic to or from the user;

wherein the one or more processors are configured to apply the identified updated fraud profile to detect further fraudulent traffic in monitored traffic transmitted to or from the user.

2. A monitoring network node according to claim 1, wherein the traffic monitor is configured to monitor the traffic based on the fraud profile, and wherein the one or more processors are configured to apply the identified updated fraud profile to monitor further traffic transmitted to or from the user.

3. A monitoring network node according to claim 1, wherein the data notifying whether the monitored traffic comprises fraudulent traffic further comprises one or more of:

a service identifier identifying a service during which monitored traffic is determined to comprise fraudulent traffic and data identifying the user.

4. A monitoring network node according to claim 3, wherein the one or more processors are configured to determine the fraud probability based on one or more of:

a number of times that the monitored traffic has been identified as comprising fraudulent traffic in a user session;

a change in a ratio of free services to chargeable services compared to historical data for the user;

a change in a ratio of free services to chargeable services compared to other users.

5. A monitoring network node according to claim 1, wherein the one or more processors are configured to undertake one or more of the following, based on whether the monitored traffic is determined to comprise fraudulent traffic:

drop a service during which monitored traffic is determined to comprise fraudulent traffic;

limit the bandwidth of the user;

trigger a session disconnection for the user;

redirect the user to a fraudulent web portal;

obtain a trace of a current service;

mark the monitored traffic with a differentiated services code point code identifying that the traffic is fraudulent traffic;

write one or more charging data records comprising a fraudulent user field.

6. A monitoring network node according to claim 1, and further configured to undertake the function of a PCEF or a combined PCEF and TDF.

7. A method for detecting fraudulent traffic in a telecommunications system, the method comprising:

monitoring, by one or more processors, traffic to or from a user in the telecommunications system;

determining, by the one or more processors, whether the monitored traffic comprises fraudulent traffic by applying a fraud profile associated with the user to the monitored traffic, wherein the fraud profile comprises rules for monitoring the user for fraudulent traffic and/or detecting fraudulent traffic to or from the user;

transmitting, by a transmitter, data notifying whether the monitored traffic comprises traffic determined to be fraudulent traffic, the data comprising an indication of a probability that the monitored traffic comprises fraudulent traffic;

receiving, by a receiver, data identifying an updated fraud profile associated with the user, wherein the updated fraud profile comprises updated rules for monitoring the user based on the indication of the probability that the monitored traffic comprises fraudulent traffic for fraudulent traffic and/or detecting fraudulent traffic to or from the user; and

applying, by the one or more processors, the identified updated fraud profile to detect further fraudulent traffic transmitted to or from the user.

8. A non-transitory computer readable medium comprising computer readable code configured, when read and executed by a computer, to carry out the method according to claim 7.

9. A profiling network node for determining a fraud profile associated with a user of a telecommunications system, the profiling network node comprising:

a receiver configured to receive data notifying whether monitored traffic transmitted to or from a user in the telecommunications system is determined to comprise fraudulent traffic, the data comprising an indication of a probability that the monitored traffic comprises fraudulent traffic;

one or more processors configured to determine a fraud profile associated with the user based at least on the received data, wherein the fraud profile is for use detecting further fraudulent traffic and the fraud profile comprises updated rules for monitoring the user based on the indication of the probability that the monitored traffic comprises fraudulent traffic for fraudulent traffic and/or detecting fraudulent traffic to or from the user; and

a transmitter configured to in response to the notification that the user has logged onto the telecommunications system, transmit a request for data identifying the fraud profile associated with the user to a subscription profile repository;

wherein;

the receiver is further configured to receive the data identifying the fraud profile from the subscription profile repository; and

the transmitter is further configured to transmit the data identifying the fraud profile to a monitoring network node.

10. A profiling network node according to claim 9, wherein the one or more processors are further configured to determine the fraud profile based on a previous fraud profile.

11. A profiling network node according to claim 9, wherein the transmitter is configured to transmit data identifying the fraud profile to a subscription profile repository for storage.

12. A profiling network node according to claim 9, further configured to undertake the function of a PCRF.

13. A method for determining a fraud profile for a user of a telecommunications system, the method comprising:

receiving, by a receiver, data notifying whether monitored traffic transmitted to or from a user in the telecommunications system is determined to comprise fraudulent traffic, the data comprising an indication of a probability that the monitored traffic comprises fraudulent traffic;

determining, by one or more processors, a fraud profile associated with the user based at least on the received data, wherein the fraud profile is for use detecting further fraudulent traffic and the fraud profile comprises updated rules for monitoring the user based on the indication of the probability that the monitored traffic comprises fraudulent traffic for fraudulent traffic and/or detecting fraudulent traffic to or from the user;

transmitting, in response to the notification that the user has logged onto the telecommunications system, a request for data identifying the fraud profile associated with the user to a subscription profile repository by a transmitter;

receiving, by a receiver, the data identifying the fraud profile from the subscription profile repository; and

transmitting the data identifying the fraud profile to a monitoring network node.

14. A non-transitory computer readable medium comprising computer readable code configured, when read and executed by a computer, to carry out the method according to claim 13.

15. A telecommunications system for detecting fraudulent traffic, the system comprising:

a monitoring network node comprising one or more processors configured to monitor traffic transmitted to or from a user in the telecommunications system;

the one or more processors configured to apply to the monitored traffic a fraud profile associated with the user to determine whether the monitored traffic comprises fraudulent traffic, wherein the fraud profile comprises rules for monitoring the user for fraudulent traffic and/or detecting fraudulent traffic to or from the user;

a transmitter configured to transmit data to a receiver of a profiling network node notifying whether the monitored traffic comprises fraudulent traffic, the data comprising an indication of a probability that the monitored traffic comprises fraudulent traffic;

wherein the one or more processors are further configured to determine an updated fraud profile associated with the user based at least on the received data, wherein the updated fraud profile comprises updated rules for monitoring the user based on the indication of the probability that the monitored traffic comprises fraudulent traffic for fraudulent traffic and/or detecting fraudulent traffic to or from the user; and

a transmitter configured to transmit data identifying the updated fraud profile to one or both of a receiver of a subscription profile repository and a receiver of the monitoring network node.

16. A telecommunications system according to claim 15, wherein the data identifying the updated fraud profile is transmitted to the subscription profile repository, and wherein the subscription profile repository further comprises a fraud profile data recorder configured to store the received data identifying the updated fraud profile in a memory.

17. A telecommunications system according to claim 15, wherein the receiver of the profiling network node is configured to receive notification from the network monitoring node that a user has logged on to the telecommunications system, and wherein the transmitter of the profiling network node is configured to transmit the data identifying the updated fraud profile associated with the monitoring network node.

18. A telecommunications system according to claim 16, wherein the transmitter of the profiling network node is further configured to transmit a request for data identifying the updated fraud profile associated with the user to the receiver of the subscription profile repository,

wherein the profile data recorder is configured to retrieve the data identifying the updated fraud profile from the memory, the subscription profile repository further comprising a transmitter configured to transmit the retrieved data identifying the updated fraud profile to the receiver of the profiling network node.

19. A method for operating a telecommunications system, the method comprising:

monitoring, by one or more processors of a monitoring network node, traffic transmitted to or from a user in the telecommunications system;

applying, by the one or more processors of the monitoring network node, a fraud profile associated with the user to the monitored traffic to determine whether the monitored traffic comprises fraudulent traffic, wherein the fraud profile comprises rules for monitoring the user for fraudulent traffic and/or detecting fraudulent traffic to or from the user;

transmitting, by a transmitter of the monitoring network node, data to a receiver of a profiling network node notifying whether the monitored traffic comprises fraudulent traffic, the data comprising an indication of a probability that the monitored traffic comprises fraudulent traffic;

determining, by the one or more processors of the profiling network node, an updated fraud profile associated with the user based at least on the received data, wherein the updated fraud profile comprises updated rules for monitoring the user based on the indication of the probability that the monitored traffic comprises fraudulent traffic for fraudulent traffic and/or detecting fraudulent traffic to or from the user;

transmitting, by a transmitter of the profiling network node, the data identifying the updated fraud profile to one or both of a receiver of a subscription profile repository and a receiver of the monitoring network node.

20. A non-transitory computer readable medium comprising computer readable code configured, when read and executed by a computer, to carry out the method according to claim 19.