System and method for detecting fraudulent network usage patterns using real-time network monitoring

• US 5,627,886 A
• Filed: 09/15/1995
• Issued: 05/06/1997
• Est. Priority Date: 09/22/1994
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Electronic Data Systems Corporation (Perspecta, Inc.)
• Inventors: Bowman, William B.
• Primary Examiner(s): Chin, Stephen
• Assistant Examiner(s): Kim, Kevin
• Application Number:
  US08/528,746
• Time in Patent Office: 599 Days
• Field of Search: 379/144, 379/145, 379/188, 379/189, 379/111, 379/112, 379/113, 379/133
• US Class Current: 379/111
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/49 Connection to several service providers
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/46 Connection to several service providers
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks

Abstract

A computerized system and method for detecting fraudulent network usage patterns using real-time network monitoring of at least two disparate networks is shown which receives at least one event record from each of the disparate networks, analyzes each of the received event records to determine its type based on user-defined parameters, identifies predetermined fields in the analyzed event record to be used as keys, measures network usage associated with the key, summarizes usage statistics against at least of the keys, compares statistic totals to predefined thresholds, and responds with an alarm or the like when the thresholds are met or exceeded.

Claims

1. A computerized fraud detection system for detecting network usage patterns indicative of fraud from at least two disparate networks, each of said networks providing event records resulting from use of the respective network, comprising:

at least one data collector concurrently connected to each of said disparate networks for receiving at least one event record from each of said disparate networks, wherein said event record comprises a plurality of fields;

at least one interface for analyzing each of said at least one received event record to determine its type based on user-defined parameters; and

a fraud detection engine for identifying predetermined fields in said at least one analyzed event record to be used as keys, wherein said user pre-selects at least one of any field in said event record to be a key, for measuring usage associated with said key, for summarizing usage statistics against at least one of said keys in said at least one event record, for comparing statistic totals to predefined thresholds, and for responding when said thresholds are met or exceeded.

2. The computerized fraud detection system of claim 1, wherein said event record data is network utilization data.

3. The computerized fraud detecting system of claim 2, wherein said at least two disparate networks are wireline and wireless networks.

4. The computerized fraud detection system of claim 2, wherein said at least two of disparate networks are digital cellular and analog cellular networks.

5. The computerized fraud detection system of claim 2, wherein said at least two of disparate networks are analog cellular and wireline networks.

6. The computerized fraud detection system of claim 1, wherein said means for responding further comprises means for sending an alarm to a user.

7. The computerized fraud detection system of claim 1, wherein said event record data represents voice network utilization.

8. The computerized fraud detection system of claim 1, wherein said event record data represents data network utilization.

9. The computerized fraud detection system of claim 1, wherein said event record data represents video network utilization.

10. The computerized fraud detection system of claim 2, wherein said call detail data is obtained before a call event has completed.

11. The computerized fraud detection system of claim 1, further comprising a database which is consolidated across all of said disparate networks, said consolidated database for storing predetermined ones of said received event record, said measured usage and said summarized usage statistics.

12. A method performed by a computer for detecting network usage patterns indicative of fraud from at least two disparate networks, each of said networks providing event records resulting from use of the respective network, comprising the steps of:

receiving at least one event record from each of said disparate networks with which said computer is concurrently connected, wherein said event record comprises a plurality of fields;

analyzing each of said at least one received event record to determine its type based on user-defined parameters;

identifying predetermined fields in said at least one analyzed event record to be used as keys, wherein said user pre-selects at least one of any field in said event record to be a key;

measuring usage associated with said key;

summarizing usage statistics against at least one of said keys in said at least one event record;

comparing statistic totals to predefined thresholds; and

responding when said thresholds are met or exceeded.

13. The method for detecting network usage patterns of claim 12, wherein said step of summarizing occurs over varying periods of time.

14. A method for assisting in fraud analysis, which method is performed by a computer for detecting network usage patterns indicative of fraud from at least two disparate networks, each of said networks providing event records resulting from use of the respective network, comprising the steps of:

receiving at least one event record from each of said disparate networks with which said computer is concurrently connected, wherein said event record comprises a plurality of fields;

analysing each of said at least one received event record to determine its type based on user-defined parameters;

identifying predetermined fields in said at least one analyzed event record to be used as keys, wherein said user pre-selects at least one of any field in said event record to be a key;

measuring usage associated with said key;

summarizing usage statistics against at least one of said keys in said at least one event record;

storing said record, said measured usage, and said summarized usage statistics in a database; and

responding to ad hoc queries from a fraud analyst.

15. The method for assisting in fraud analysis of claim 14, further comprising the steps of retrieving a selected event record of network usage, said measured usage or said summarized usage statistics from said database upon request of said fraud analyst;

and

assigning said retrieved event record of network usage, said measured usage or said summarized usage statistics to a case based on criteria provided by said fraud analyst.

16. The method for assisting in fraud analysis of claim 14, further comprising a step of providing an audit trail.

17. The method for assisting in fraud analysis of claim 14, wherein said database is consolidated across all of said disparate networks.