Method And System For Identifying Aberrant Wireless Behavior

• US 20130346420A1
• Filed: 06/22/2012
• Published: 12/26/2013
• Est. Priority Date: 06/22/2012
• Status: Abandoned Application

• Current Assignee: Polaris Wireless Incorporated
• Original Assignee: Polaris Wireless Incorporated
• Inventors: Gordon, Scot Douglas, Kaplan, Dmitry, Vera, Raul
• Application Number:
  US13/531,028
• Publication Number:
  US 20130346420A1
• Time in Patent Office: Days
• US Class Current: 707/748
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 50/40 Business processes related to the transportation industry shipping G06Q10/083
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

A behavior analysis system analyzes large volumes of records that report on telecommunications events associated with wireless terminals. The behavior analysis system filters the large volume of available records based on investigation-specific rules, resulting in a set of candidate wireless terminals. The illustrative embodiment determines a pattern of behavior for each candidate. Each candidate is measured for how precisely it satisfies the investigation-specific rules. Each candidate is further analyzed for aberrations, if any, relative to the established pattern of behavior. An aberration tends to prove or disprove whether a candidate is more likely to be a true suspect in the given investigation. The illustrative embodiment ranks the set of candidates based on (i) a measure of how precisely each candidate wireless terminal satisfies the investigation-specific rule(s), and (ii) a measure of the aberration in behavior of each candidate wireless terminal relative to the respective pattern of behavior thereof.

Claims

1. A method that is associated with a wireless network, the method comprising:

receiving, by a data-processing system, a plurality of records that report on telecommunications events associated with wireless terminals in the wireless network;

filtering the plurality of records, based on a rule, thereby resulting in a corresponding set of candidate wireless terminals, wherein the filtering is performed by the data-processing system;

for each candidate in the set, generating, by the data-processing system, a pattern of behavior that is based on records that are associated with the candidate;

ranking, by the data-processing system, the set of candidates relative to each other based on;

(a) a measure of aberration in behavior of each candidate wireless terminal relative to the respective pattern of behavior thereof; and

transmitting, by the data-processing system, the ranked set of candidate wireless terminals.

2. The method of claim 1 wherein the rule is one of a plurality of rules, and wherein the ranking is further based on:

(b) a measure of how precisely each candidate wireless terminal satisfies the plurality of rules.

3. The method of claim 1 wherein the aberration in behavior of each candidate wireless terminal is probative of whether the aberrant behavior indicates a likely true suspect.

4. The method of claim 1 wherein the measure of aberration is based on at least one parameter of the rule.

5. The method of claim 1 wherein the rank of a candidate rises, relative to other candidates, with an increase in at least one of:

(i) the measure of aberration in behavior of the candidate wireless terminal, and

(ii) a measure of how precisely the candidate wireless terminal satisfies the rule.

6. The method of claim 1 wherein at least one record comprises a location datum that is associated with the reported-on telecommunications event, and further wherein the pattern of behavior is based at least in part on the location datum.

7. The method of claim 1 wherein at least one record comprises a location datum that is associated with the reported-on telecommunications event, and further wherein the measure of aberration is based at least in part on the location datum.

8. The method of claim 1 wherein:

the pattern of behavior is based at least in part on a first location parameter, and

the measure of aberration is based at least in part on a second location parameter.

9. The method of claim 1 wherein the rule comprises at least one of:

(i) a location parameter,

(ii) a time parameter,

(iii) a duration parameter,

(iv) a telephonic parameter,

(v) a data communication parameter, and

(vi) a telecommunications relationship parameter.

10. The method of claim 1 wherein the resulting set of candidate wireless terminals corresponds only to those records that satisfy the rule.

11. The method of claim 1 further comprising:

measuring the aberration in behavior of each candidate wireless terminal based on records that (i) are different from the records on which the pattern of behavior is based, and (ii) are based on at least one parameter of the rule.

12. The method of claim 1 wherein the measure of aberration in behavior of a candidate wireless terminal is based on at least one of:

(i) a location that is absent from the records on which the pattern of behavior is based,

(ii) a time that is absent from the records on which the pattern of behavior is based,

(iii) a duration that is absent from the records on which the pattern of behavior is based,

(iv) a telephonic parameter that is absent from the records on which the pattern of behavior is based, and

(v) a data communication parameter that is absent from the records on which the pattern of behavior is based.

13. The method of claim 1 wherein the measure of aberration in behavior of a candidate wireless terminal is based on at least one of:

(i) a location parameter,

(ii) a time parameter,

(iii) a duration parameter,

(iv) a telephonic parameter,

(v) a data communication parameter, and

(vi) a telecommunications relationship parameter.

14. A method that is associated with a wireless network, the method comprising:

receiving, by a data-processing system, a plurality of records that report on telecommunications events associated with wireless terminals in the wireless network;

filtering the plurality of records, based on a plurality of rules, thereby resulting in a corresponding set of candidate wireless terminals, wherein the filtering is performed by the data-processing system;

for each candidate in the set, generating, by the data-processing system, a pattern of behavior that is based on records associated with the candidate;

ranking, by the data-processing system, the set of candidates relative to each other based on;

(a) a measure of how precisely each candidate wireless terminal satisfies the plurality of rules; and

transmitting, by the data-processing system, the ranked set of candidate wireless terminals.

15. The method of claim 14 wherein the ranking is further based on:

(b) a measure of aberration in behavior of each candidate wireless terminal relative to the respective pattern of behavior thereof;

wherein the measure of how precisely each candidate wireless terminal satisfies the rule is indicative of the likelihood that a given candidate is of higher interest relative to the other candidates; and

wherein the measure of aberration is also indicative of the likelihood.

16. The method of claim 14 wherein the measure of aberration in behavior of a candidate wireless terminal relative to the pattern of behavior thereof is based on at least one of:

(i) a location parameter,

(ii) a time parameter,

(iii) a duration parameter,

(iv) a telephonic parameter,

(v) a data communication parameter, and

(vi) a telecommunications relationship parameter.

17. A method that is associated with a wireless network, the method comprising:

receiving, by a data-processing system, a plurality of records that report on telecommunications events associated with wireless terminals in the wireless network;

filtering the plurality of records, based on a plurality of rules, thereby resulting in a set of candidate wireless terminals corresponding to those records that satisfy at least one rule in the plurality of rules, wherein the filtering is performed by the data-processing system;

for each candidate in the set, generating, by the data-processing system, a pattern of behavior that is based on records associated with the candidate over a period of time;

ranking, by the data-processing system, the set of candidates relative to each other based on;

(a) a measure of aberration in behavior of each candidate wireless terminal relative to the respective pattern of behavior thereof, and

(b) a measure of how precisely each candidate wireless terminal satisfies the plurality of rules; and

transmitting, by the data-processing system, the ranked set of candidate wireless terminals.

18. The method of claim 17 wherein the rank of a candidate wireless terminal rises with an increase in the measure of aberration in behavior thereof.

19. The method of claim 17 wherein the rank of a candidate wireless terminal rises with an increase in the measure of how precisely the candidate wireless terminal satisfies the plurality of rules.

20. The method of claim 17 wherein the measure of aberration in behavior of a candidate wireless terminal relative to the pattern of behavior thereof is based on:

(A) a location parameter and

(B) at least one of;

(i) a time parameter,

(ii) a duration parameter,

(iii) a telephonic parameter,

(iv) a data communication parameter, and

(v) a telecommunications relationship parameter.