Detecting possible fraudulent communication usage

• US 5,907,602 A
• Filed: 02/09/1998
• Issued: 05/25/1999
• Est. Priority Date: 03/30/1995
• Status: Expired due to Fees

• Current Assignee: Azure Solutions Ltd. (Subex Limited)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Scott, Michael, Woods, David John, Eaden, Russel, Gibbins, Christopher John, Regnault, John Christopher, Peel, Stephen John
• Primary Examiner(s): LOOMIS, PAUL A
• Application Number:
  US08/930,280
• Time in Patent Office: 470 Days
• Field of Search: 379/112, 379/113, 379/114, 379/115, 379/121, 379/127, 379/133, 379/134, 379/188, 379/189, 379/196, 379/197, 379/198
• US Class Current: 379/114.14
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64
• CPC Class Codes: H04M 3/4228 in networks
• CPC Class Codes: H04Q 2213/13057 Object-oriented software
• CPC Class Codes: H04Q 3/54533 Configuration data, translation, passwords, databases
• CPC Class Codes: H04Q 3/54583 Software development, e.g. procedural, object oriented, software generation, software testing
• CPC Class Codes: H04Q 3/54591 Supervision, e.g. fault localisation, traffic measurements, avoiding errors, failure recovery, monitoring, statistical analysis

Abstract

A method of, and a system for, detecting possible fraudulent use of a telecommunications network. Call event records, both call initiation and call completion records, are examined. A call record has a number of key fields, e.g. called number, calling number, calling card number, and for each field in turn the key is used to access a database containing an associated set of profiles. Each profile contains an algorithm defining a measurement process to be performed on the call data, e.g. determine the call duration. The respective process results are added to a respective set of stores associated with each profile, and an alarm response is generated when a threshold of a store is reached. An additional process for e.g. a call duration of e.g. called number card calling number key fields, convert the process results to penalty points which are added to a penalty points store associated with the calling card number key of the call event record under examination. Each response is recorded in a history file for that key.

Claims

1. A method of detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least one of the fields being designated a key field and containing a key relating to an entity as herein defined, the method comprising the steps of:

reading a first key field of a call event record and obtaining its key;

addressing a database by the combination of the first key field and the obtained key (referred to as the "first combination") to access a first combination-associated profile set comprising

(i) at least one profile identifying

(a) a respective call event data processing algorithm defining a process to be performed upon call event data to obtain a process result,

(b) at least one first combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each said first combination-associated first store,

(c) a respective predetermined outcome to be generated when the contents of a said first combination-associated first store reaches a threshold, at least one said predetermined outcome comprising a fraud risk indicator,

(ii) a further profile identifying

(d) a first combination-associated second store to be incremented by a fraud risk indicator,

(e) at least one respective threshold for said first combination-associated second store, and

(f) a further respective predetermined outcome to be generated when the contents of said first combination-associated second store reaches a threshold;

processing the call event data of the call event record in accordance with said first combination-associated profile set, thereby

obtaining one or more respective process results,

incrementing the corresponding identified first combination-associated first store or stores by the respective process result, and, if a threshold is reached,

generating the corresponding respective predetermined outcome, and, if a fraud risk indicator is generated,

incrementing said first combination-associated second store by that fraud risk indicator, and, if a threshold is reached,

generating the corresponding further respective predetermined outcome.

2. A method as claimed in claim 1, wherein a second of the fields of the call event record is designated a key field and contains a key relating to an entity as herein defined, and the method comprises the further steps of:

reading the second key field of the call event record and obtaining its key;

addressing the database by the combination of the second key field and the obtained key (referred to as the "second combination") to access a respective second combination-associated profile set comprising,

(i) at least one profile identifying

(g) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result,

(h) at least one second combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each said second combination-associated first store,

(j) a respective predetermined outcome to be generated when the contents of a said second combination-associated first store reaches a threshold, at least one said predetermined outcome comprising a fraud risk indicator,

(ii) a yet further profile identifying

(k) the respective first combination-associated second store for the call event record being currently processed to be incremented by a fraud risk indicator generated by a profile of its own profile set;

processing the call event data of the call event record in accordance with said respective second combination-associated profile set, thereby

obtaining one or more respective process results,

incrementing the corresponding identified second combination-associated first store or stores by the respective process result, and, if a threshold is reached,

generating the corresponding respective predetermined outcome, and, if a fraud risk indicator is generated,

incrementing said first combination-associated second store by that fraud risk indicator, and, if a threshold of said first combination-associated second store is reached,

generating a further respective predetermined outcome in accordance with the further profile of said first combination-associated profile set.

5. A method as claimed in any one of claim 1, and including a step of presetting a said combination-associated profile set for a user to a default profile set, and a further step of modifying said preset combination-associated profile set in dependence upon network provided data relating to the user.

6. A method as claimed in claim 5, wherein said network provided data is account-related data.

7. A method as claimed in claim 6, wherein said modifying step is performed automatically in response to provision of said account-related data.

8. A method as claimed in any one of claim 5, wherein said modifying step comprises replacing a profile which identifies a first respective threshold for a said first combination-associated first store by a profile which identifies a second respective threshold for the same said first combination-associated first store, said second respective threshold having a higher value than said first respective threshold.

9. A method as claimed in any one of claim 1, wherein a said generated outcome is or includes entries in a log of the next n call event records occurring which have the same value of key in the first field as that of the call event record which resulted in that response.

3. A method of detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least one of the fields being designated a key field and containing a key relating to an entity as herein defined, the method comprising the steps of:

reading a first key field of a call event record and obtaining its key;

addressing a database by the combination of the first key field and the obtained key (referred to as the "first combination") to access a first combination-associated profile set comprising

(i) at least one profile identifying

(a) a respective call event data processing algorithm defining a process to be performed upon call event data to obtain a process result,

(b) a respective function to be applied to the process result to generate a fraud risk indicator,

(c) at least one first combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each said first combination-associated first store,

(d) a respective predetermined outcome to be generated when the contents of a said first combination-associated first store reaches a threshold,

(ii) a further profile identifying

(e) a first combination-associated second store to be incremented by a fraud risk indicator,

(f) at least one respective threshold for said first combination-associated second store, and

(g) a further respective predetermined outcome to be generated when the contents of said first combination-associated second store reaches a threshold;

processing the call event data of the call event record in accordance with said first combination-associated profile set, thereby

obtaining at least one respective process result and associated fraud risk indicator,

incrementing the corresponding identified first combination-associated first store or stores by the respective process result, and, if a threshold is reached,

generating the corresponding respective predetermined outcome,

incrementing said first combination-associated second store by the associated fraud risk indicator, and, if a threshold is reached,

generating the corresponding further respective predetermined outcome.

4. A method as claimed in claim 3, wherein a second of the fields of the call event record is designated a key field and contains a key relating to an entity as herein defined, and the method comprises the further steps of:

reading the second key field of the call event record and obtaining its key;

addressing the database by the combination of the second key field and the obtained key (referred to as the "second combination") to access a respective second combination-associated profile set comprising,

(i) at least one profile identifying

(h) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result,

(j) a respective function to be applied to the process result to generate a fraud risk indicator,

(k) at least one second combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each said second combination-associated first store,

(l) a respective predetermined outcome to be generated when the contents of a said second combination-associated first store reaches a threshold,

(ii) a yet further profile identifying

(m) the respective first combination-associated second store for the call event record being currently processed to be incremented by a fraud risk indicator generated by a profile of its own profile set;

processing the call event data of the call event record in accordance with said respective second combination-associated profile set, thereby

obtaining at least one respective process result and associated fraud risk indicator,

incrementing the corresponding identified second combination-associated first store or stores by the respective process result, and, if a threshold is reached,

generating the corresponding respective predetermined outcome,

incrementing said first combination-associated second store by the associated fraud risk indicator, and, if a threshold of said first combination-associated second store is reached,

generating a further respective predetermined outcome in accordance with the further profile of said first combination-associated profile set.

10. A fraud detection system for detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least a first of the fields being designated a key field and containing a key relating to an entity as herein defined, the system comprising:

means for reading a key field of a call event record and obtaining its key and for addressing a database by the combination of said key field and the obtained key (referred to as a "combination");

a database addressable by a said combination and storing a plurality of respective profile sets associated with a first key field and a plurality of keys (referred to as "first combination-associated profile sets"),

each first combination-associated profile set comprising

(i) at least one profile identifying

(a) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result,

(b) at least one first combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store,

(c) a respective predetermined outcome to be generated when the contents of a said first combination-associated first store reaches a threshold, at least one said predetermined outcome comprising a fraud risk indicator,

(ii) a further profile identifying

(d) a first combination-associated second store to be incremented by a fraud risk indicator,

(e) at least one respective threshold for said first combination-associated second store

(f) a further respective predetermined outcome to be generated when the contents of said first combination-associated second store reaches a threshold;

means for processing the call event data of the call event record in accordance with said first combination-associated profile set, thereby

obtaining one or more respective process results,

incrementing the corresponding identified first combination-associated first store or stores by the respective process result, and, if a threshold is reached,

generating a said respective predetermined outcome, and, if a fraud risk indicator is generated,

incrementing said first combination-associated second store by the fraud risk indicator, and, if a threshold is reached,

generating the corresponding further respective predetermined outcome.

11. A system as claimed in claim 10, for use when a second of said fields is designated a key field and contains a key relating to an entity as herein defined, and wherein the database stores a plurality of respective second combination-associated profile sets comprising

(i) at least one profile identifying

(g) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result,

(h) at least one second combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store,

(j) a respective predetermined outcome to be generated when the contents of a said second combination-associated first store reaches a threshold, at least one said predetermined outcome comprising a fraud risk indicator,

(ii) a yet further profile identifying

(k) the respective first combination-associated second store for the call event record being currently processed to be incremented

by a fraud risk indicator generated by a profile of its own profile set,

and wherein said processing means is arranged to process the call event data of the call event record in accordance with said respective second combination-associated profile set, thereby

obtaining one or more respective process results,

incrementing the corresponding identified second combination-associated first store or stores by the respective process result, and, if a threshold is reached,

generating a said respective predetermined outcome, and, if a fraud risk indicator is generated,

incrementing said first combination-associated second store by that fraud risk indicator, and, if a threshold is reached,

generating the corresponding further respective predetermined outcome.

14. A system as claimed in any one of claim 10, and including means responsive to receipt of network provided data relating to a particular user for modifying a profile set associated with that particular user.

15. A system as claimed in claim 14, wherein said modifying means is responsive to account-related data for modifying said profile set.

16. A system as claimed in any one of claim 10, and including means for accessing an accounts function of a communications network and retrieving account-related data associated with a particular user, and modifying means responsive to account-related data retrieved by said accessing and retrieving means to modify a profile set associated with that particular user in dependence upon the retrieved account-related data.

17. A system as claimed in any one of claim 10, wherein said modifying means is arranged to replace a profile which identifies a first respective threshold for a said first combination-associated first store by a profile which identifies a second respective threshold for the same said first combination-associated first store, said second respective threshold having a higher value than said first respective threshold.

18. A system as claimed in any one of claim 10, wherein the outcome generating means is arranged to generate as an outcome, or part of an outcome, entries in a log of the next n call event records occurring which have the same value of key in the first key field as that of the call event record which resulted in that outcome.

19. A communications network incorporating a fraud detection system as claimed in any one of claim 10.

20. A communications network as claimed in claim 19, wherein the network is an intelligent network.

21. A communications network as claimed in claim 20, wherein the fraud detection system forms part of the network intelligence of the intelligent network.

12. A fraud detection system for detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least a first of the fields being designated a key field and containing a key relating to an entity as herein defined, the system comprising:

means for reading a key field of a call event record and obtaining its key and for addressing a database by the combination of said key field and the obtained key (referred to as a "combination");

a database addressable by a said combination and storing a plurality of respective profile sets associated with a first key field and a plurality of keys (referred to as "first combination-associated profile sets"),

each first combination-associated profile set comprising

(i) at least one profile identifying

(a) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result,

(b) a respective function to be applied to the process result to generate a fraud risk indicator,

(c) at least one first combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store,

(d) a respective predetermined outcome to be generated when the contents of a said first combination-associated first store reaches a threshold,

(ii) a further profile identifying

(e) a first combination-associated second store to be incremented by a fraud risk indicator,

(f) at least one respective threshold for said first combination-associated second store

(g) a further respective predetermined outcome to be generated when the contents of said first combination-associated second store reaches a threshold;

means for processing the call event data of the call event record in accordance with said first combination-associated profile set, thereby

obtaining at least one respective process result and associated fraud risk indicator,

incrementing the corresponding identified first combination-associated first store or stores by the respective process result, and, if a threshold is reached,

generating the corresponding respective predetermined outcome,

incrementing said first combination-associated second store by the fraud risk indicator, and, if a threshold is reached,

generating the corresponding further respective predetermined outcome.

13. A system as claimed in claim 12, for use when a second of said fields is designated a key field and contains a key relating to an entity as herein defined, and wherein the database stores a plurality of respective second combination-associated profile sets comprising

(i) at least one profile identifying

(h) a respective call event data processing algorithm defining a process to be performed upon call event data of a call event record to obtain a process result,

(j) a respective function to be applied to the process result to generate a fraud risk indicator,

(k) at least one second combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each store,

(l) a respective predetermined outcome to be generated when the contents of a said second combination-associated first store reaches a threshold,

(ii) a yet further profile identifying

(m) the respective first combination-associated second store for the call event record being currently processed to be incremented by a fraud risk indicator generated by a profile of its own profile set,

and wherein said processing means is arranged to process the call event data of the call event record in accordance with said respective second combination-associated profile set, thereby

obtaining at least one respective process result and associated fraud risk indicator,

incrementing the corresponding identified second combination-associated first store or stores by the respective process result, and, if a threshold is reached,

generating the corresponding respective predetermined outcome, and, if a fraud risk indicator is generated,

incrementing said first combination-associated second store by that fraud risk indicator, and, if a threshold is reached,

generating the corresponding further respective predetermined outcome.