NETWORK TELEPHONY ANOMALY DETECTION IMAGES

• US 20180131710A1
• Filed: 11/07/2016
• Published: 05/10/2018
• Est. Priority Date: 11/07/2016
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Hassan, Amer, Lickorish, David Anthony, Gilbert, Michael Travis, Clark, Bradford R., Jenkins, Joshua Calvin
• Application Number:
  US15/345,491
• Publication Number:
  US 20180131710A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04M 2201/42 Graphical user interfaces
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04M 7/0084 Network monitoring; Error detection; Error recovery; Network testing

Abstract

Network telephony anomaly detection systems are provided herein. In one example, a method of operating a network telephony anomaly service includes monitoring endpoint identities associated with communication sessions occurring between user endpoints in a network telephony platform, and processing the endpoint identities to generate a digital image that distributes indicators of the endpoint identities into the digital image according to at least spatial relationships established among the endpoint identities. The method also includes detecting anomalies among the communication sessions according to at least the spatial relationships rendered in the digital image.

Claims

1. A method of operating a network telephony anomaly service, comprising:

monitoring endpoint identities associated with communication sessions occurring between user endpoints in a network telephony platform;

processing the endpoint identities to generate a digital image that distributes indicators of the endpoint identities into the digital image according to at least spatial relationships established among the endpoint identities;

detecting anomalies among the communication sessions according to at least the spatial relationships rendered in the digital image.

2. The method of claim 1, wherein the endpoint identities comprise telephone numbers associated with the user endpoints.

3. The method of claim 1, further comprising:

determining the spatial relationships based at least on determining geographic distances among the endpoints and translating the geographic distances to a pixel distance applied to the indicators of the endpoint identities in the digital image.

4. The method of claim 3, further comprising:

determining the geographic distances by at least processing area codes associated with telephone numbers comprising the endpoint identities.

5. The method of claim 1, further comprising:

distributing the indicators in the digital image by at least selecting indicator pixels in the digital image to represent each of the communication sessions, wherein the indicator pixels are distributed according to geographic distances translated to pixel distances in the digital image from an origin.

6. The method of claim 5, further comprising:

based at least on one or more of the communication sessions corresponding to a target pixel in the digital image, selecting a pixel property for the target pixel that corresponds to a quantity of the communication sessions that are indicated by the target pixel.

7. The method of claim 6, wherein the pixel property comprises at least one of a pixel saturation, pixel hue, or pixel brightness.

8. The method of claim 1, further comprising:

detecting the anomalies among the communication sessions by at least processing the digital image to determine domains within the digital image and identifying when one or more of the communication sessions comprise outliers from the domains.

9. The method of claim 1, further comprising:

detecting the anomalies among the communication sessions by at least processing the digital image against at least one further digital image produced to cover a different timeframe than the digital image, and identifying discontinuities between the digital image and the at least one further digital image.

10. A network telephony anomaly service, comprising:

one or more computer readable storage media;

a processing system operatively coupled with the one or more computer readable storage media; and

an anomaly detection service comprising program instructions stored on the one or more computer readable storage media that, based on being read and executed by the processing system, direct the processing system to at least;

monitor endpoint identities associated with communication sessions occurring between user endpoints in a network telephony platform;

process the endpoint identities to generate a digital image that distributes indicators of the endpoint identities into the digital image according to at least spatial relationships established among the endpoint identities;

detect anomalies among the communication sessions according to at least the spatial relationships rendered in the digital image.

11. The display output control apparatus of claim 10, wherein the endpoint identities comprise telephone numbers associated with the user endpoints.

12. The display output control apparatus of claim 10, comprising further program instructions, based on being executed by the processing system, direct the processing system to at least:

determine the spatial relationships based at least on determining geographic distances among the endpoints and translating the geographic distances to a pixel distance applied to the indicators of the endpoint identities in the digital image.

13. The display output control apparatus of claim 12, comprising further program instructions, based on being executed by the processing system, direct the processing system to at least:

determine the geographic distances by at least processing area codes associated with telephone numbers comprising the endpoint identities.

14. The display output control apparatus of claim 10, comprising further program instructions, based on being executed by the processing system, direct the processing system to at least:

distribute the indicators in the digital image by at least selecting indicator pixels in the digital image to represent each of the communication sessions, wherein the indicator pixels are distributed according to geographic distances translated to pixel distances in the digital image from an origin.

15. The display output control apparatus of claim 14, comprising further program instructions, based on being executed by the processing system, direct the processing system to at least:

based at least on one or more of the communication sessions corresponding to a target pixel in the digital image, select a pixel property for the target pixel that corresponds to a quantity of the communication sessions that are indicated by the target pixel.

16. The display output control apparatus of claim 15, wherein the pixel property comprises at least one of a pixel saturation, pixel hue, or pixel brightness.

17. The display output control apparatus of claim 10, comprising further program instructions, based on being executed by the processing system, direct the processing system to at least:

detect the anomalies among the communication sessions by at least processing the digital image to determine domains within the digital image and identifying when one or more of the communication sessions comprise outliers from the domains.

18. The display output control apparatus of claim 10, comprising further program instructions, based on being executed by the processing system, direct the processing system to at least:

detect the anomalies among the communication sessions by at least processing the digital image against at least one further digital image produced to cover a different timeframe than the digital image, and identifying discontinuities between the digital image and the at least one further digital image.

19. A Voice over Internet Protocol (VoIP) network anomaly detection system, comprising:

a monitor service configured to monitor telephone numbers associated with communication sessions occurring between user endpoints of the VoIP network;

an anomaly service configured to process the telephone numbers to generate a digital image that distributes indicators of the telephone numbers into the digital image according to at least spatial relationships established among the telephone numbers;

the anomaly service configured to detect anomalies among the communication sessions according to at least the spatial relationships rendered in the digital image.

20. The VoIP network anomaly detection system of claim 19, comprising:

the anomaly service configured to determine the spatial relationships based at least on determining geographic distances among the endpoints corresponding to area codes associated with the telephone numbers, and translating the geographic distances to a pixel distances from an origin applied to the indicators in the digital image;

the anomaly service configured to detect the anomalies among the communication sessions by at least processing the digital image to determine domains within the digital image and identifying when one or more of the communication sessions comprise outliers from the domains.