SYSTEMS AND METHODS FOR DETECTING CALL PROVENANCE FROM CALL AUDIO

• US 20200137222A1
• Filed: 12/30/2019
• Published: 04/30/2020
• Est. Priority Date: 06/29/2010
• Status: Active Grant

• Current Assignee: Georgia Tech Research Corporation (University System of Georgia)
• Original Assignee: Georgia Tech Research Corporation (University System of Georgia)
• Inventors: BALASUBRAMANIYAN, Vijay, AHAMAD, Mustaque, TRAYNOR, Patrick Gerard, HUNTER, Michael Thomas, POONAWALLA, Aamir
• Granted Patent: US 11,050,876 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 65/1076 Screening of IP real time communications, e.g. spam over Internet telephony [SPIT]
• CPC Class Codes: H04M 1/68 Circuit arrangements for preventing eavesdropping
• CPC Class Codes: H04M 2203/558 Databases
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2203/6045 Identity confirmation
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

Various embodiments of the invention are detection systems and methods for detecting call provenance based on call audio. An exemplary embodiment of the detection system can comprise a characterization unit, a labeling unit, and an identification unit. The characterization unit can extract various characteristics of networks through which a call traversed, based on call audio. The labeling unit can be trained on prior call data and can identify one or more codecs used to encode the call, based on the call audio. The identification unit can utilize the characteristics of traversed networks and the identified codecs, and based on this information, the identification unit can provide a provenance fingerprint for the call. Based on the call provenance fingerprint, the detection system can identify, verify, or provide forensic information about a call audio source.

Claims

1-52. -52. (canceled)

53. A method comprising:

receiving, by a computing-device, call audio of a first call between a first device and a second device;

extracting, by the computing-device, one or more characteristics from the first call, wherein the one or more characteristics exclude metadata;

identifying, by the computing-device, at least a portion of a transmission path of the first call based on the one or more characteristics extracted from the call audio of the first call; and

identifying, by the computing-device, a geography associated with the first call based on the one or more characteristics extracted from the call audio of the first call.

54. The method of claim 53, further comprising identifying, by the computing-device, one or more networks of a transmission path based on the one or more characteristics.

55. The method of claim 54, further comprising identifying, by the computing-device, one or more codecs used to encode the first call based on the one or more characteristics, wherein the computing-device identifies a network of the one or more networks of the transmission path based on a codec.

56. The method of claim 53, wherein the geography associated with the first call includes a geographical location of an origin of the first call.

57. The method of claim 53, further comprising identifying, by the computing-device, a unique telecommunications device involved in the first call based on the one or more characteristics, wherein the unique telecommunications device is one of the first device or the second device.

58. The method of claim 53, further comprising determining, by the computing-device, a first provenance fingerprint for the first call based on the one or more characteristics.

59. The method of claim 58, further comprising comparing, by the computing-device, the first provenance fingerprint against one or more provenance fingerprints stored in a database configured to store a plurality of provenance fingerprints for a plurality of calls.

60. The method of claim 59, further comprising determining, by the computing-device, that the first provenance fingerprint satisfies a matching threshold to a second provenance fingerprint of a second call based on comparing the first provenance fingerprint against at least one provenance fingerprint stored in the database.

61. The method of claim 59, further comprising identifying, by the computing-device, a common geography associated with the first call and associated with a second call based on the computing-device comparing the first provenance fingerprint for the first call against a second provenance fingerprint for the second call stored in the database.

62. The method of claim 59, wherein the computing-device is configured to receive respective call audio of the plurality of calls, and wherein the method further comprises:

for each respective call audio received by the computing-device;

determining, by the computing-device, a provenance fingerprint of a call based on the one or more characteristics extracted from the call audio of the call; and

storing, by the computing-device, the provenance fingerprint into the database.

63. A system comprising:

one or more computing devices, including a computing device configured to;

identify at least a portion of a transmission path of a first call between a first device and a second device based on one or more characteristics extracted from call audio of the first call, wherein the one or more characteristics exclude metadata; and

identify a geography associated with the first call based on the one or more characteristics extracted from the call audio from the first call.

64. The system of claim 63, the one or more computing devices further including at least one computing device configured to:

receive the call audio of the first call between the first device and the second device; and

extract the one or more characteristics from the first call.

65. The system of claim 63, wherein the computing device is further configured to identify one or more networks of a transmission path based on the one or more characteristics.

66. The system of claim 65, wherein the computing device is further configured to identify one or more codecs used to encode the first call based on the one or more characteristics, and wherein the computing device identifies a network of the one or more networks of the transmission path based on a codec.

67. The system of claim 63, wherein the geography associated with the first call includes a geographical location of an origin of the first call.

68. The system of claim 63, wherein the computing device is further configured to identify a unique telecommunications device involved in the first call based on the one or more characteristics, and wherein the unique telecommunications device is one of the first device or the second device.

69. The system of claim 63, wherein the computing device is further configured to determine a first provenance fingerprint for the first call based on the one or more characteristics.

70. The system of claim 69, further comprising a database configured to store a plurality of provenance fingerprints for a plurality of calls;

and

wherein the computing device is further configured to compare the first provenance fingerprint against one or more provenance fingerprints stored in the database.

71. The system of claim 70, wherein the computing device is further configured to determine that the first provenance fingerprint satisfies a matching threshold to a second provenance fingerprint of a second call based on comparing the first provenance fingerprint against at least one provenance fingerprint stored in the database.

72. The system of claim 70, wherein the computing device is further configured to identify a common geography associated with the first call and associated with a second call based on the computing device comparing the first provenance fingerprint for the first call against a second provenance fingerprint for the second call stored in the database.