Network assurance analytic system

• US 20070036309A1
• Filed: 06/01/2006
• Published: 02/15/2007
• Est. Priority Date: 06/01/2005
• Status: Active Grant

• Current Assignee: Fair Isaac Corporation
• Original Assignee: Fair Isaac Corporation
• Inventors: Zoldi, Scott, Balon, Michael
• Granted Patent: US 7,961,857 B2
• Time in Patent Office: Days
• US Class Current: 379/114.140
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0164 Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 3/22 Arrangements for supervision, monitoring or testing
• CPC Class Codes: H04Q 2213/13091 CLI, identification of calling line
• CPC Class Codes: H04Q 2213/13103 Memory
• CPC Class Codes: H04Q 2213/13139 Fraud detection/prevention
• CPC Class Codes: H04Q 2213/13345 Intelligent networks, SCP
• CPC Class Codes: H04Q 2213/13349 Network management
• CPC Class Codes: H04Q 3/0029 Provisions for intelligent networking
• CPC Class Codes: H04Q 3/0087 Network testing or monitoring arrangements

Abstract

A network assurance analytics (NAA) system and method is disclosed. The NAA can be part of a risk analytic for telecom (RAFT) program. The NAA system is configured to monitor telecommunications networks, detect errors or fraud in those telecommunications networks, and provide solutions to resolve the errors or reduce the fraud. Traffic of a telecommunications network is electronically monitored for at least one pattern that is indicative of a telecommunications anomaly. Based on a set of a set of telecommunications profiles stored in a database, a model score representing a value of the telecommunications anomaly is generated. A solution for the telecommunications network to reduce the model score associated with the telecommunications anomaly is then generated for execution on the telecommunications network.

Claims

1. A computer-implemented method comprising:

electronically monitoring traffic of a telecommunications network for at least one pattern that is indicative of a telecommunications anomaly;

based on a set of a set of telecommunications profiles stored in a database, generating a model score representing a value of the telecommunications anomaly; and

generating a solution for the telecommunications network to reduce the model score associated with the telecommunications anomaly.

2. A method in accordance with claim 1, further comprising generating one or more reason codes based on the telecommunications profiles, each reason code representing a relationship between the value of the telecommunications anomaly and at least one pattern.

3. A method in accordance with claim 1, wherein the set of telecommunications profiles includes data representing exponentially-decayed recursive variables that represent a history of traffic behavior.

4. A method in accordance with claim 1, wherein the set of telecommunications profiles include a calling line identity (CLI) profile, a point code (PC) profile, a route (RT) profile, and a terminating number (TN) profile.

5. A method in accordance with claim 4, further comprising:

parsing a call record of the traffic to determine a calling line identity (CLI);

determining a point code (PC) and a route (RT) associated with the CLI and call record; and

retrieving from the database the CLI profile, PC profile and the RT profile that correspond to the determined CLI, PC and RT.

6. A method in accordance with claim 5, further comprising determining a terminating number (TN) of the call record.

7. A method in accordance with claim 5, further comprising:

computing new values for the CLI profile, the PC profile, and the RT profile based on the determined CLI, PC and RT; and

updating the database with the new values for the CLI profile, and PC profile, and the RT profile.

8. A computer-implemented method comprising:

detecting from telecommunications traffic at least one pattern that is indicative of a telecommunications anomaly;

generating a model score representing a value of the telecommunications anomaly; and

generating one or more reason codes based on the telecommunications profiles, each reason code representing a relationship between the value of the telecommunications anomaly and the at least one pattern.

9. A method in accordance with claim 8, further comprising generating a solution based on the one or more reason codes to reduce the model score associated with the telecommunications anomaly.

10. A method in accordance with claim 8, wherein the set of telecommunications profiles include a calling line identity (CLI) profile, a point code (PC) profile, a route (RT) profile, and a terminating number (TN) profile.

11. A method in accordance with claim 10, further comprising:

parsing a call record of the traffic to determine a calling line identity (CLI);

determining a point code (PC) and a route (RT) associated with the CLI and call record; and

retrieving from the database the CLI profile, PC profile and the RT profile that correspond to the determined CLI, PC and RT.

12. A method in accordance with claim 11, further comprising determining a terminating number (TN) of the call record.

13. A method in accordance with claim 11, further comprising:

computing new values for the CLI profile, the PC profile, and the RT profile based on the determined CLI, PC and RT; and

updating the database with the new values for the CLI profile, and PC profile, and the RT profile.

14. A method in accordance with claim 9, further comprising executing the solution on the telecommunications network.

15. A network assurance analytic system comprising:

a monitor that captures call records from traffic of a telecommunications network;

a profile retriever that parses a call record to determine a calling line identity (CLI), a point code (PC) and a route (RT) associated with the call record;

a database that stores a CLI profile, a PC profile, and an RT profile of the traffic; and

a processor that compares the CLI, PC and RT with the respective CLI profile, PC profile and RT profile to determine whether a telecommunications anomaly exists in the traffic.

16. A system in accordance with claim 15, further comprising a plurality of updaters configured to update the CLI profile, the PC profile, and the RT profile based on the determined CLI, PC and RT.

17. A system in accordance with claim 15, wherein the processor uses a hash table to determine whether the telecommunications anomaly exists in the traffic.

18. A system in accordance with claim 15, wherein the processor is configured to generate a model score representing a value of the telecommunications anomaly.

19. A system in accordance with claim 18, wherein the processor is further configured to generate one or more reason codes based on the telecommunications profiles, each reason code representing a relationship between the value of the telecommunications anomaly and the at least one pattern.

20. A system in accordance with claim 18, wherein the processor is further configured to generate a solution for the telecommunications network to reduce the model score associated with the telecommunications anomaly.

21. A method of detecting revenue leakage in a telecommunications system, the method comprising:

detecting characteristics of non-reconciled SS7/C7 service detail records for calling line identities across point codes and routes of the telecommunications system; and

reporting the detected characteristics in a hierarchal summarization.

22. A method in accordance with claim 21, wherein the characteristics include a route identifier of the telecommunications system.

23. A method in accordance with claim 21, wherein the characteristics include at least one serving/destination point code of the telecommunications system.

24. A method in accordance with claim 21, wherein the characteristics include an international/domestic designator.

25. A method in accordance with claim 21, wherein the characteristics include a destination country.

26. A method in accordance with claim 21, wherein the characteristics include a premium rate designator.

27. A method in accordance with claim 21, wherein the characteristics include a mobile number.

28. A method in accordance with claim 21, wherein the characteristics include a dial around access code.

29. A method in accordance with claim 21, wherein the hierarchal summarization includes absolute values, frequency and proportion of the detected characteristics.

30. A method of detecting revenue leakage in a telecommunications system, the method comprising:

detecting characteristics of non-reconciled SS7/C7 service detail records for calling line identities across point codes and routes of the telecommunications system; and

generating an absolute value, frequency and proportion for at least one of the detected characteristics.

31. A method in accordance with claim 30, further comprising generating a hierarchical summary report of the absolute value, frequency and proportion for the at least one detected characteristic.

32. A method in accordance with claim 31, further comprising displaying the hierarchical summary report in a computer display.