SYSTEM AND METHOD FOR DETECTING AND MANAGING FRAUD

• US 20090129573A1
• Filed: 08/18/2008
• Published: 05/21/2009
• Est. Priority Date: 04/21/1995
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: MCI Communications Corporation (Verizon Communications Inc.)
• Inventors: Wagner, James J., Paul, Kevin, Gavan, John, Mahone, Saralyn, Arkel, Hans Van, Curtis, Terrill J., Dallas, Charles A., Richards, Jim, Herrington, Cheryl
• Granted Patent: US 9,390,418 B2
• Time in Patent Office: Days
• US Class Current: 379/189
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: H04J 3/175 Speech activity or inactivity detectors echo suppressors H04B3/20
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/08 Metering calls to called party , i.e. B-party charged for the communication
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/62 Called party billing, e.g. reverse billing, freephone, collect call, 0800 or 0900
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks
• CPC Class Codes: H04Q 3/0062 Provisions for network management

Abstract

A system, method and computer program product for processing event records. The present invention includes a detection layer, an analysis layer, an expert systems layer and a presentation layer. The layered system includes a core infrastructure and a configurable, domain-specific implementation. The detection layer employs one or more detection engines, such as, for example, a rules-based thresholding engine and a profiling engine. The detection layer can include an AI-based pattern recognition engine for analyzing data records, for detecting new and interesting patterns and for updating the detection engines to insure that the detection engines can detect the new patterns. In one embodiment, the present invention is implemented as a telecommunications fraud detection system. When fraud is detected, the detection layer generates alarms which are sent to the analysis layer. The analysis layer filters and consolidates the alarms to generate fraud cases. The analysis layer preferably generates a probability of fraud for each fraud case. The expert systems layer receives fraud cases and automatically initiates actions for certain fraud cases. The presentation layer also receives fraud cases for presentation to human analysts. The presentation layer permits the human analysts to initiate additional actions.

Claims

1. (canceled)

2. A method performed by one or more servers, the method comprising:

generating a first fraud alarm upon detection of suspected fraud by a first fraud detection test, the first fraud detection test applying a first fraud detection rule of a plurality of fraud detection rules to a first network event record;

generating a second, different fraud alarm upon detection of suspected fraud by a second fraud detection test, the second fraud detection test applying a second, different fraud detection rule of the plurality of fraud detection rules to a second network event record, the plurality of fraud detection rules being dynamically reconfigured in accordance with changing patterns of fraud;

correlating the generated first fraud alarm with the generated second, different fraud alarm into a fraud case; and

performing a fraud prevention action on the fraud case.

3. The method of claim 2, where the correlating includes:

correlating the first fraud alarm with the second, different fraud alarm based on common aspects of the first fraud alarm and the second, different fraud alarm.

4. The method of claim 2, where the generating a first fraud alarm includes:

normalizing the first network event record such that the first network event record conforms to a predetermined format.

5. The method of claim 2, where the generating a first fraud alarm includes:

enhancing the first network event record to include data obtained from at least one external source.

6. The method of claim 2, where the generating a first fraud alarm includes:

comparing at least a portion of the first network event record to a profile detection rule, and

generating the first fraud alarm when the first network event record violates the profile detection rule.

7. The method of claim 6, where the profile detection rule includes at least one of:

a normal usage profile, or

a fraudulent usage profile.

8. The method of claim 6, where the profile detection rule is based on historical network event records.

9. The method of claim 2, further comprising:

assigning a priority to the fraud case, and

where the fraud prevention action is based on the assigned priority.

10. A system comprising:

one or more servers to implement;

a detection element to;

generate a first fraud alarm when a first network event record is in violation of a first fraud detection rule of a plurality of fraud detection rules,

generate a second different fraud alarm when a second network event record is in violation of a second fraud detection rule of the plurality of fraud detection rules, and

dynamically adjust the plurality of fraud detection rules in accordance with changing patterns of fraud;

an analysis element to;

correlate the first fraud alarm and the second different fraud alarm to form a fraud case; and

an expert element to;

perform a fraud prevention action on the fraud case.

11. The system of claim 10, where the expert element is further to:

assign a priority to the fraud case based on a severity of at least one of the first fraud alarm or the second different fraud alarm, and

when performing the fraud prevention action, the expert element is to;

perform the fraud prevention action based on the assigned priority.

12. The system of claim 10, where the one or more servers are further to implement:

a rules based thresholding engine to

read the first network event record, and

compare data in the first network event record to a predetermined threshold.

13. The system of claim 12, where the rules based thresholding engine includes:

at least one rules database,

a normalizer to;

place the first network event record into a standardized format,

an enhancer component to;

insert additional data in the first network event record, and

a threshold detector to;

compare the first network event record to at least one threshold rule obtained from the at least one rules database, where the detection element generates the first fraud alarm when the first network event record violates the at least one threshold rule.

14. The system of claim 13, where the additional data includes data received from an external system.

15. The system of claim 10, where the first network event record includes an event key and at least one feature, the event key identifying a network event and the at least one feature including event measurement data.

16. The system of claim 15, where the event measurement data includes one of:

a count of a number of occurrences of an event during a time period,

a count of a number of like events occurring simultaneously, or

geographic velocity data.

17. The system of claim 10, where the detection element includes:

a pattern recognition engine to;

identify at least one of normal or fraudulent patterns of usage by comparing the first network event record or the second network event record to history data obtained from a history database.

18. The system of claim 17, where the pattern recognition engine includes one of:

a neural network to identify fraudulent patterns of usage,

tree-based algorithms, or

statistical based algorithms that employ iterative numerical processing techniques.

19. A method performed by one or more servers, the method comprising:

receiving network event records relating to use of calling cards in a network;

analyzing the network event records to identify a fraudulent pattern;

dynamically modifying at least one threshold detection rule based on the identified fraudulent pattern; and

generating a fraud alarm for a new network event record using the modified at least one threshold detection rule.

20. The method of claim 19, further comprising:

correlating the fraud alarm with other fraud alarms to form a fraud case, the correlating being based on common aspects of the fraud alarm and the other fraud alarms.

21. The method of claim 19, further comprising:

assigning a priority to the fraud case; and

performing a fraud prevention action based on the assigned priority.