Fraud detection in interactive voice response systems

• US 10,362,172 B2
• Filed: 01/25/2018
• Issued: 07/23/2019
• Est. Priority Date: 10/14/2015
• Status: Active Grant

• Current Assignee: Pindrop Security, Inc.
• Original Assignee: Pindrop Security, Inc.
• Inventors: Strong, Scott, Patil, Kailash, Dewey, David, Bandyopadhyay, Raj, Calhoun, Telvis, Balasubramaniyan, Vijay
• Primary Examiner(s): Gauthier, Gerald
• Application Number:
  US15/880,287
• Publication Number:
  US 20180152561A1
• Time in Patent Office: 544 Days
• Field of Search: 379 8818, 37911414, 37912702, 379188, 455406, 455411, 704236, 704243, 704246, 705 4, 705 18, 705 26, 705 35, 705 38, 705318
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 2203/551 Call history
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 3/493 Interactive information services, e.g. directory enquiries ; Arrangements therefor, e.g. interactive voice response [IVR] systems or voice portals
• CPC Class Codes: H04M 3/527 Centralised call answering arrangements not requiring operator intervention
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Systems and methods for call detail record (CDR) analysis to determine a risk score for a call and identify fraudulent activity and for fraud detection in Interactive Voice Response (IVR) systems. An example method may store information extracted from received calls. Queries of the stored information may be performed to select data using keys, wherein each key relates to one of the received calls, and wherein the queries are parallelized. The selected data may be transformed into feature vectors, wherein each feature vector relates to one of the received calls and includes a velocity feature and at least one of a behavior feature or a reputation feature. A risk score for the call may be generated during the call based on the feature vectors.

Claims

1. A computer-implemented method for determining a risk score of a call received by an Interactive Voice Response (IVR) system, the computer-implemented method comprising:

creating a feature vector based on an interaction with the IVR system during the call including a volume of at least one Dual-Tone Multi-Frequency (DTMF) tone or a duration of the at least one DTMF tone during the interaction with the IVR system; and

using a machine learning model to determine the risk score of the call based on the created feature vector.

2. The computer-implemented method of claim 1, further comprising:

representing prior calls as feature vectors;

labeling the feature vectors representing the prior calls; and

training the machine learning model using the labeled feature vectors.

3. The computer-implemented method of claim 1, wherein information regarding the call is stored in a database before the using a machine learning model to determine the risk score of the call based on the created feature vector.

4. The computer-implemented method of claim 3, wherein information regarding the call is retrieved from the database before the using a machine learning model to determine the risk score of the call based on the created feature vector.

5. The computer-implemented method of claim 1, wherein the created feature vector is based on a behavior feature of the call, and wherein the behavior feature of the call is a sequence of actions taken during interaction with the IVR system.

6. The computer-implemented method of claim 1, wherein the created feature vector is based on a behavior feature of the call;

and

wherein the behavior feature of the call is at least one of an action taken during interaction with the IVR system, an amount of time elapsed between actions taken during interaction with the IVR system, providing incorrect information to the IVR system, a number of times a specific activity in the IVR system was performed, a number of times the IVR system was called during a measure of time, an amount of time elapsed between DTMF tones, a use of voice during interaction with the IVR system, an amount of time elapsed between a beginning of an IVR prompt and a user'"'"'s spoken response to the IVR prompt, or an amount of time elapsed between an IVR prompt and an action taken during interaction with the IVR system.

7. The computer-implemented method of claim 2, wherein information regarding the prior calls is stored in a non-relational database.

8. The computer-implemented method of claim 2, wherein the prior calls are all from a same phone number.

9. The computer-implemented method of claim 2, wherein the prior calls are from a plurality of phone numbers, and wherein each of the labeled feature vectors used to train the machine learning model has a same label as each of the other labeled feature vectors used to train the machine learning model.

10. The computer-implemented method of claim 2, wherein the labeling the feature vectors representing the prior calls is done using a first label representing genuineness and a second label representing non-genuineness.

11. The computer-implemented method of claim 2, wherein the representing prior calls as feature vectors includes representing interaction with the IVR system using action words.

12. The computer-implemented method of claim 2, wherein the representing prior calls as feature vectors includes:

representing interaction with the IVR system using action words in a document; and

converting the document to a feature vector.

13. The computer-implemented method of claim 2, wherein the representing prior calls as feature vectors includes representing interaction with the IVR system using at least one of N-grams or skip N-grams.

14. The computer-implemented method of claim 2, wherein the representing prior calls as feature vectors includes determining an inverse document frequency.

15. The computer-implemented method of claim 1, further comprising taking an action based on the risk score of the call.

16. The computer-implemented method of claim 15, wherein the taking an action based on the risk score of the call includes at least one of displaying the risk score on a display during the call, storing the risk score in a database during the call, altering an IVR call flow during the call, notifying police, or notifying an owner of the IVR system.

17. The computer-implemented method of claim 15, wherein the taking an action based on the risk score of the call includes at least one of altering an IVR call flow during the call, disabling a feature in the IVR system during the call, locking down the IVR system, requiring alternative identification during the call, or requesting additional information during the call.

18. The computer-implemented method of claim 1, wherein the interaction with the IVR system includes responses to the IVR system represented using action words.

19. A computer-implemented method for determining a risk score for a call, the computer-implemented method comprising:

storing information extracted from received calls;

performing queries of the stored information to select data using keys, wherein each key relates to one of the received calls, and wherein the queries are parallelized;

transforming the selected data into feature vectors, wherein each feature vector relates to one of the received calls and includes a velocity feature and a behavior feature; and

generating, during the call, the risk score for the call based on the feature vectors.

20. The computer-implemented method of claim 19, wherein each feature vector includes a reputation feature.

21. The computer-implemented method of claim 19, further comprising:

training a machine learning model using the feature vectors;

using the machine learning model to generate the risk score for the call; and

displaying the risk score for the call on a display during the call,

wherein the queries are parallelized using a thread pool.

22. An apparatus that determines a risk score of a call received by an Interactive Voice Response (IVR) system, the apparatus comprising:

at least one processor; and

a non-transitory computer readable medium coupled to the at least one processor having instructions stored thereon that, when executed by the at least one processor, causes the at least one processor to;

create a feature vector based on an interaction with the IVR system during the call including an amount of time elapsed between Dual-Tone Multi-Frequency (DTMF) tones during the interaction with the IVR system; and

use a machine learning model to determine the risk score of the call based on the created feature vector.

23. The apparatus of claim 22, wherein the created feature vector is based on a behavior feature of the call, and wherein the behavior feature of the call is a sequence of actions taken during interaction with the IVR system.

24. An apparatus that determines a risk score for a call, the apparatus comprising:

at least one processor; and

a non-transitory computer readable medium coupled to the at least one processor having instructions stored thereon that, when executed by the at least one processor, causes the at least one processor to;

store information extracted from received calls;

perform queries of the stored information to select data using keys, wherein each key relates to one of the received calls, and wherein the queries are parallelized;

transform the selected data into feature vectors, wherein each feature vector relates to one of the received calls and includes a velocity feature and a behavior feature; and

generate, during the call, the risk score for the call based on the feature vectors.