Telephone fraud detection system

• US 5,805,686 A
• Filed: 12/22/1995
• Issued: 09/08/1998
• Est. Priority Date: 12/22/1995
• Status: Expired due to Term

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: MCI Incorporated (Verizon Communications Inc.)
• Inventors: Mai, Trung, Curtis, Terrill J., Galetti, Matthew L., Moller, Jens L.
• Primary Examiner(s): Zele, Krista
• Assistant Examiner(s): Hunter, Daniel S.
• Application Number:
  US08/577,888
• Time in Patent Office: 991 Days
• Field of Search: 379/111, 379/112, 379/113, 379/114, 379/118, 379/121, 379/122, 379/188, 379/189, 379/196, 379/197, 379/198, 379/133, 379/134, 379/136
• US Class Current: 379/198
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks
• CPC Class Codes: H04Q 2213/13512 800 - freefone
• CPC Class Codes: H04Q 2213/13515 authentication, authorisation - fraud prevention
• CPC Class Codes: H04Q 2213/13545 monitoring of signaling messages, intelligent network
• CPC Class Codes: H04Q 3/0029 Provisions for intelligent networking

Abstract

A fraud detection system is disclosed for telephone PBX calls. The system includes a fraud data server for buffering the call detail records relating to inbound 800 number calls and outbound international calls. A threshold manager is connected at its input to an output of the fraud data server for detecting numerical counts exceeding preselected threshold values, in predetermined fields of the call detail records, and generates an alarm. The output of the threshold manager is connected to an input of the fraud data server for buffering the alarm incident to respective call detail records. A computer workstation is connected to the fraud data server for receiving packets of call detail records relating to alarm data, in a filtered preselected format. The workstation includes a monitor for displaying the alarm data on a graphical interface.

Claims

1. A fraud detection system for telephone PBX calls in a telephone network generating call detail records for the PBX calls, the system comprising:

a fraud data server for buffering the call detail records;

a threshold manager connected to an output of the fraud data server for keeping numerical counts of call data in predetermined fields of the call detail records, multiplying the numerical counts by predetermined risk factors to obtain risk-adjusted counts, detecting risk adjusted counts exceeding preselected threshold values, and generating an alarm in response thereto;

means connecting an output of the threshold manager to an input of the fraud data server for buffering the alarm incident to respective call detail records; and

a computer workstation connected to the fraud data server for receiving packets of call detail records relating to alarm data, in a filtered preselected format, the workstation including a monitor for displaying the alarm data on a graphical interface.

2. A fraud detection method for telephone PBX calls in a telephone network generating call detail records for the PBX calls, the method comprising the steps:

buffering the call detail records;

keeping numerical counts of call data in predetermined fields of the call detail records;

multiplying the numerical counts by predetermined risk factors to obtain risk adjusted counts;

detecting risk adjusted counts exceeding preselected threshold values, in predetermined fields of the call detail records;

generating an alarm in response thereto;

buffering the alarm incident to respective call detail records;

transmitting packets of call detail records relating to alarm data, in a filtered preselected format, to a computer workstation including a monitor, for displaying the alarm data on a graphical interface.

3. A fraud detection system for telephone PBX calls in a telephone network generating call detail records for the PBX calls, the system comprising:

a fraud data server having;

(a) communication gateway means for interfacing the server with the telephone network and filtering out unwanted call detail records;

(b) parsing means for reformatting call detail records to a preselected format;

(c) means for storing databases of current and archived call detail records; and

(d) communication distributing means for providing a communication path between the fraud data server and a computer workstation;

a threshold manager connected to an output of the fraud data server for accepting the call detail records from the parsing means and detecting numerical counts exceeding preselected threshold values, in predetermined fields of the call detail records, and generating an alarm in response thereto;

means connecting an output of the threshold manager to an input of the fraud data server for buffering the alarm incident to respective call detail records;

the computer workstation connected to the communication distributing means of the fraud data server for receiving packets of call detail records relating to alarm data, in a filtered preselected format, the workstation including a monitor for displaying the alarm data on a graphical interface.

4. The system set forth in claim 3 further comprising means connected to the telephone network for storing call detail records generated by the network;

and means for connecting the call detail records to the communication gateway means of the fraud data server.

5. A fraud detection method for telephone PBX calls in a telephone network generating call detail records for the PBX calls, the method comprising the steps:

providing a communication gateway for interfacing the server with the telephone network;

filtering out unwanted call detail records;

parsing the filtered call detail records for reformatting them to a preselected format;

storing databases of current and archived call detail records;

providing a communication path for the current and archived call detail records to a computer workstation;

accepting the parsed call detail records for detecting numerical counts exceeding preselected threshold values, in predetermined fields of the call detail records;

generating an alarm in response thereto;

buffering the alarm incident to respective call detail records;

the computer workstation receiving packets of call detail records relating to alarm data, along the communication path, in a filtered preselected format.

6. The method of claim 5 further comprising the step of selectively graphically displaying data processed by the workstation.

7. The method of claim 5 further comprising the steps of storing call detail records generated by the network;

and connecting the call detail records to the communication gateway.

8. A fraud detection system for telephone PBX calls in a telephone network generating call detail records for the PBX calls, the system comprising:

a fraud data server for buffering the call detail records;

a threshold manager connected to an output of the fraud data server for detecting numerical counts exceeding preselected threshold values, in predetermined fields of the call detail records, generating an alarm in response thereto and prioritizing the alarm according to how many times the threshold has been exceeded;

means connecting an output of the threshold manager to an input of the fraud data server for buffering the alarm incident to respective call detail records; and

a computer workstation connected to the fraud data server for receiving packets of call detail records relating to alarm data, in a filtered preselected format, the workstation including a monitor for displaying the alarm data on a graphical interface.

9. A fraud detection method for telephone PBX calls in a telephone network generating call detail records for the PBX calls, the method comprising the steps:

buffering the call detail records;

detecting numerical counts exceeding preselected threshold values, in predetermined fields of the call detail records;

generating an alarm in response thereto;

prioritizing the alarm according to how many times the threshold has been exceeded;

buffering the alarm incident to respective call detail records;

transmitting packets of call detail records relating to alarm data, in a filtered preselected format, to a computer workstation including a monitor, for displaying the alarm data on a graphical interface.

10. A fraud detection system for telephone PBX calls in a telephone network generating call detail records for the PBX calls, the system comprising:

a fraud data server for buffering the call detail records;

a threshold manager connected to an output of the fraud data server for keeping numerical counts of call data in predetermined fields of the call detail records, multiplying the numerical counts by predetermined risk factors to obtain risk-adjusted counts, detecting risk adjusted counts exceeding preselected threshold values, and generating an alarm in response thereto and prioritizing the alarm according to how many times the threshold has been exceeded;

means connecting an output of the threshold manager to an input of the fraud data server for buffering the alarm incident to respective call detail records; and

a computer workstation connected to the fraud data server for receiving packets of call detail records relating to alarm data, in a filtered preselected format, the workstation including a monitor for displaying the alarm data on a graphical interface.

11. A fraud detection method for telephone PBX calls in a telephone network generating call detail records for the PBX calls, the method comprising the steps:

buffering the call detail records;

keeping numerical counts of call data in predetermined fields of the call detail records;

multiplying the numerical counts by predetermined risk factors to obtain risk adjusted counts;

detecting risk adjusted counts exceeding preselected threshold values, in predetermined fields of the call detail records;

generating an alarm in response thereto;

prioritizing the alarm according to how many times the threshold has been exceeded;

buffering the alarm incident to respective call detail records;

transmitting packets of call detail records relating to alarm data, in a filtered preselected format, to a computer workstation including a monitor, for displaying the alarm data on a graphical interface.