System and method for detection of fraud in a wireless telephone system

• US 5,940,751 A
• Filed: 06/27/1996
• Issued: 08/17/1999
• Est. Priority Date: 06/27/1996
• Status: Expired due to Fees

• Current Assignee: Cellular Technical Services Co., Inc. (Asensus Surgical, Inc.)
• Original Assignee: Cellular Technical Services Co., Inc. (Asensus Surgical, Inc.)
• Inventors: Sharma, Chetan, Kaplan, Dmitry
• Primary Examiner(s): Chin, Wellington
• Assistant Examiner(s): Kibreab, Senai
• Application Number:
  US08/669,773
• Time in Patent Office: 1,146 Days
• Field of Search: 455/411, 455/410, 455/408, 455/405
• US Class Current: 455/411
• CPC Class Codes: G06F 18/00 Pattern recognition
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

A system for the detection of fraudulent use of a wireless telephone system includes a signature analyzer to analyze the transmission characteristic of an unauthenticated transmitter. If the system authenticates the transmitter, based on stored records, the system establishes a customer call profile, based on the geographical location of the wireless telephone at the time of the calls, as well as a time period in which the communication occurs. The system uses these records to establish a customer call profile. The system analyzes a subsequent call and the customer call profile to designate the subsequent call as valid or invalid. The system overrides the decision of the signature analyzer that a particular unauthenticated wireless telephone is fraudulent if the values for call parameters of the subsequent call are sufficiently close to the corresponding parameter values in the customer call profile. The system is adaptive in that old call data records are periodically deleted, thus allowing their replacement with newer call data records.

Claims

1. A system for the detection of wireless telephone fraud, the system comprising:

a signature analyzer to classify an unauthenticated wireless telephone as authorized or fraudulent based on a transmission characteristic of said unauthenticated wireless telephone in a communication with said unauthenticated wireless telephone;

an origin data storage area to store data related to a place of origin of a particular wireless telephone for each of a plurality of different communications with said particular wireless telephone classified by said signature analyzer as said authorized wireless telephone;

a timer to determine a time period associated with each of said plurality of different communications with said authorized wireless telephone;

a time storage area to store said time period in association with each of said plurality of different communications; and

a decision engine to analyze a communication with an unauthenticated wireless telephone classified by said signature analyzer as said fraudulent wireless telephone at a time subsequent to said plurality of different communications with said authorized wireless telephone, said decision engine designating said subsequent communication as valid regardless of whether said signature analyzer identified said unauthenticated wireless telephone as said fraudulent wireless telephone if a place of origin of said subsequent communication matches one of said places of origin in said origin data storage area and if a time period of said subsequent communication matches one of said time periods in said time storage area.

2. A system for the processing of wireless telephone communications, the system comprising:

a signature analyzer to classify an unauthenticated wireless telephone as authorized or fraudulent based on a transmission characteristic associated with said unauthenticated wireless telephone;

a parameter data storage area to store data for one or more parameters which are unrelated to transmission characteristics and which are associated with each of a plurality of different communications with a particular wireless telephone classified by said signature analyzer as an authorized wireless telephone;

a data storage area to store data for one or more corresponding parameters associated with a subsequent communication with an unauthenticated wireless telephone at a time subsequent to said plurality of different communications with said authorized wireless telephone; and

a decision engine to analyze said subsequent communication with said unauthenticated wireless telephone classified by said signature analyzer as fraudulent, said decision engine designating said subsequent communication as valid based on said data for one or more stored parameters and said data for one or more corresponding parameters irrespective of the classification by said signature analyzer to thereby reduce false rejections by said signature analyzer.

3. A system for the processing of wireless telephone communications, the system comprising:

a signature analyzer to classify an unauthenticated wireless telephone as authorized or fraudulent based on a transmission characteristic of said unauthenticated wireless telephone in a communication with said unauthenticated wireless telephone;

a parameter data storage area to store data for one or more parameters associated with each of a plurality of different communications with a particular wireless telephone classified by said signature analyzer as an authorized wireless telephone, said parameter data storage area also storing data for one or more corresponding parameters associated with a communication with an unauthenticated wireless telephone at a time subsequent to said plurality of different communications with said authorized wireless telephone; and

a decision engine to analyze said subsequent communication with said unauthenticated wireless telephone classified by said signature analyzer as fraudulent, said decision engine designating said subsequent communication as valid based on said signature analyzer classification, said data for one or more parameters, and said data for one or more corresponding parameters.

4. The system of claim 3 wherein a place of origin of said authorized wireless telephone during each of said plurality of different communications is stored in said parameter data storage area as said data for one of said one or more parameters associated with said authorized wireless telephone, said decision engine designating said subsequent communication as valid based on a place of origin of said unauthenticated wireless telephone during said subsequent communication matching said stored place of origin data.

5. The system of claim 4 for use with a cellular telephone system having a plurality of cells, said place of origin of said plurality of different communications with said authorized wireless telephone in said parameter data storage area being cell identifiers of cells within said cellular telephone system, said decision engine designating said subsequent communication as valid based on a place of origin of said unauthenticated wireless telephone in a cell during said subsequent communication matching one of said cell identifiers in said origin data storage area.

6. The system of claim 3, further including a timer to determine a time period associated with each of said plurality of different communications with said authorized wireless telephone, said time period of each of said plurality of different communications being stored in said parameter data storage area as said data for one of said one or more parameters associated with said authorized wireless telephone, said decision engine designating said subsequent communication as valid based on a time period of said subsequent communication matching said stored time periods.

7. The system of claim 6 wherein each of said time periods corresponds to a prescribed portion of a day, said time period associated with each of a plurality of different communications and said time period of said subsequent communication being ones of said apportioned time periods.

8. The system of claim 3 wherein said decision engine calculates a confidence value for said subsequent communication with said unauthenticated wireless telephone and designates said subsequent communication as valid based on said signature analyzer classification and said confidence value.

9. The system of claim 8 wherein said decision engine designates said subsequent communication as valid if said calculated confidence values exceeds a predetermined threshold value.

10. The system of claim 9 wherein said signature analyzer calculates a confidence value indicative of a confidence with which said unauthenticated wireless telephone has been classified as said fraudulent wireless telephone, said predetermined threshold value being based on said signature analyzer confidence value.

11. The system of claim 10 wherein said predetermined threshold value varies in an inverse manner with said signature analyzer confidence value.

12. The system of claim 8 wherein said confidence value is calculated by determining a frequency with which said data for one or more parameters matches said corresponding data for said one or more parameters.

13. The system of claim 8 wherein said confidence value is based on a statistical analysis of said data for said stored parameters associated with said authorized wireless telephone and said corresponding data associated with said unauthenticated wireless telephone.

14. The system of claim 3 wherein said data associated with said authorized wireless telephone are at least partially periodically updated to store new data for said one or more parameters associated with said authorized wireless telephone, said decision engine also designating said subsequent communication as valid based on said new data for said one or more parameters.

15. The system of claim 14 wherein said decision engine can designate said subsequent communication as valid only if said parameter data storage area has a predetermined minimum number of stored values for said one or more parameters associated with said authorized wireless telephone.

16. The system of claim 14 wherein said parameter data storage area has a predetermined maximum number of data values and a predetermined number less than said maximum number of data values are periodically deleted from said parameter data storage area to periodically update said parameter data storage area with said new data for said one or more parameters associated with said authorized wireless telephone.

17. The system of claim 16 wherein said data associated with each of a plurality of different communications are sequentially stored in said parameter data storage area according to a time of each of said plurality of communications and said deleted data values are the oldest values based on said sequential data storage.

18. A system for the processing of wireless telephone communications, the system comprising:

a signature analyzer to classify an unauthenticated wireless telephone as authorized or fraudulent based on a transmission characteristic of said unauthenticated wireless telephone in a communication with said unauthenticated wireless telephone;

a data storage area to store customer profile data associated with a plurality of different communications with a particular wireless telephone classified by said signature analyzer as an authorized wireless telephone; and

a decision engine to analyze a subsequent communication with an unauthenticated wireless telephone at a time subsequent to said plurality of different communications with said authorized wireless telephone when said unauthenticated wireless telephone in said subsequent communication has been classified as fraudulent by said signature analyzer, said decision engine alternatively designating said subsequent communication as valid or invalid based on said customer profile data.

19. The system of claim 18, further including a timer to determine a time period associated with each of said plurality of different communications with said authorized wireless telephone, said customer profile data including said time period and a place of origin of said authorized wireless telephone during each of said plurality of different communications.

20. The system of claim 18 wherein said decision engine uses said customer profile data to calculate a confidence value for said subsequent communication with said unauthenticated wireless telephone and designates said subsequent communication as valid or invalid based on said signature analyzer classification and said confidence value.

21. The system of claim 20 wherein said decision engine designates said subsequent communication as valid if said calculated confidence values exceeds a predetermined threshold value.

22. The system of claim 21 wherein said signature analyzer calculates a confidence value indicative of a confidence with which said unauthenticated wireless telephone has been classified as authorized or fraudulent, said predetermined threshold value being based on said signature analyzer confidence value.

23. The system of claim 22 wherein said predetermined threshold value varies in an inverse manner with said signature analyzer confidence value.

24. The system of claim 20 wherein said confidence value is calculated by determining a frequency with which said subsequent communication matches said customer profile data.

25. A method for the processing of wireless telephone communications, the method comprising:

classifying an unauthenticated wireless telephone as authorized or fraudulent based on a transmission characteristic of said unauthenticated wireless telephone;

storing customer profile data associated with a plurality of different communications with a particular wireless telephone classified as an authorized wireless telephone;

classifying a subsequent communication with an unauthenticated wireless telephone at a time subsequent to said plurality of different communications with said authorized wireless telephone to designate said unauthenticated wireless telephone as fraudulent based on said transmission characteristic of said unauthenticated wireless telephone during said subsequent communication; and

analyzing said subsequent communication and designating said subsequent communication with said unauthenticated wireless telephone as valid or invalid based on said customer profile data irrespective of said classification of said wireless telephone as fraudulent based on said transmission characteristic of said wireless telephone during said subsequent communication.

26. The method of claim 25, further including the steps of determining a time period associated with each of said plurality of different communications with said authorized wireless telephone and determining a place of origin of said authorized wireless telephone during each of said plurality of different communications, said customer profile data including said time period and said place of origin for each of said plurality of different communications.

27. The method of claim 25 wherein said step of analyzing uses said customer profile data to calculate a confidence value for said subsequent communication with said unauthenticated wireless telephone and designates said subsequent communication as valid or invalid based on said classification and said confidence value.

28. The method of claim 27 wherein said step of analyzing designates said subsequent communication as valid if said calculated confidence values exceeds a predetermined threshold value.

29. The method of claim 27 wherein said step of classifying calculates a confidence value indicative of a confidence with which said unauthenticated wireless telephone has been classified as authorized or fraudulent, said predetermined threshold value being based on said confidence value calculated by said step of classifing.

30. The method of claim 29 wherein said predetermined threshold value varies in an inverse manner with said confidence value calculated by said step of classifying.

31. The method of claim 27 wherein said confidence value is calculated by determining a frequency with which said subsequent communication matches said customer profile data.

32. A method for the processing of wireless telephone calls, the method comprising:

storing customer profile data associated with a plurality of different calls with a particular wireless telephone that has been classified as an authorized wireless telephone in each of said plurality of different calls based on a transmission characteristic of said particular wireless telephone in each of said plurality of different calls;

classifying a subsequent call with an unauthenticated wireless telephone at a time subsequent to said plurality of different calls with said authorized wireless telephone to designate said unauthenticated wireless telephone as fraudulent based on said transmission characteristic of said unauthenticated wireless telephone during said subsequent call; and

analyzing said subsequent call with respect to said customer profile data and overriding said fraudulent classification to classify said unauthenticated wireless telephone as said authorized wireless telephone irrespective of said classification of said wireless telephone as fraudulent based on said transmission characteristic of said wireless telephone during said subsequent communication.