Fraud prevention apparatus and method for performing policing functions for telephone services

• US 5,949,864 A
• Filed: 05/08/1997
• Issued: 09/07/1999
• Est. Priority Date: 05/08/1997
• Status: Expired due to Fees

• Current Assignee: Sentry Telecom Systems Incorporated (Wescorp Energy, Inc.)
• Original Assignee: Sentry Telecom Systems Incorporated (Wescorp Energy, Inc.)
• Inventors: Cox, Neil B.
• Primary Examiner(s): Wolinsky, Scott
• Application Number:
  US08/848,431
• Time in Patent Office: 852 Days
• Field of Search: 379/188, 379/189, 379/196, 379/197, 379/198, 379/199, 379/200, 379/219, 379/220, 379/221, 379/242, 379/243, 379/283, 379/377, 379/386, 370/230, 370/231, 370/232, 370/235
• US Class Current: 379/189
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks

Abstract

An apparatus and method is disclosed for performing policing functions for specialized telephone services, and for mitigating fraudulent usage of such services in ubiquitous telephone networks that carry voice, facsimile or voice-band-data traffic. Signal processing is used to determine the properties of traffic present on a channel at a given point in time, and actions are conditionally imposed based on such traffic properties. A first embodiment of the invention can be applied to prevent fraudulent use of telephone services through suppression of an answer supervision response. A second embodiment of the invention can also be applied for regulation of access to specialized telephone services which depend on the manner of customers'"'"' use of such services.

Claims

1. An apparatus for performing policing functions for telephone services in a telephone network, wherein prescribed actions are conditionally imposed based on the properties of traffic on a communications channel, comprising:

(a) a channel state detector coupled to said communications channel and operative to enable and disable the policing functions;

(b) a traffic classifier coupled to said communications channel operative to classify traffic on said communications channel into a traffic class;

(c) a source classifier coupled to said communications channel operative to determine which end of the communications channel is the dominant source of traffic; and

(d) a regulator device coupled to said traffic and source classifiers and to said communications channel and operative to initiate conditional imposition of prescribed actions if the policing functions are enabled, the conditional imposition being based on the traffic class and the determination of the source classifier.

2. An apparatus according to claim 1 wherein said communications channel is a ubiquitous channel for carrying voice, facsimile or voice-band-data traffic.

3. An apparatus according to claim 1, wherein said channel state detector includes an enabling and disabling device operative to enable and disable the policing functions based on an apparent on-hook and off-hook state of each end of said communications channel, the apparent on-hook and off-hook state being determined by signals received from the telephone network.

4. An apparatus according to claim 1 wherein said traffic classifier comprises a first stage which classifies a signal on each side of said communications channel to provide derived signal classifications, and a second stage having respective inputs thereto coupled to outputs from said first stage and providing an output traffic class based on the derived signal classifications for each side of said communications channel.

5. An apparatus according to claim 4 wherein said first stage has two identical signal classification devices, one coupled to each side of said communications channel, each of said signal classification devices comprising:

(a) a line length compensator coupled to a corresponding side of said communications channel and operative to derive a compensated signal which compensates for high-frequency attenuation caused by the effects of long telephone lines;

(b) a spectrum classifier coupled to said line length compensator operative to analyze the spectral characteristics and determine the likely signal classification of the compensated signal;

(c) a handshaking detector and a tone detector each coupled to said line length compensator operative to detect tones and handshaking signals of telephone network traffic; and

(d) a signal classifier coupled to said spectrum classifier, said handshaking detector and said tone detector and operative to derive an output signal class.

6. An apparatus according to claim 5, including an audible signaling detector having an input coupled to an output of said line length compensator and an output coupled to said signaling classifier, said audible signaling detector operative to supply said signal classifier with indications of the presence of audible network signaling on the compensated signal, where the indications are considered in the signal classifier in deriving the output signal class.

7. An apparatus according to claim 5 wherein said second stage is comprised of:

(a) a pair of signal class mappers coupled to respective outputs of said signal classification devices and operative to derive a pair of intermediate classifications; and

(b) a traffic class determiner coupled to an output of each of said signal class mappers and operative to determine an output traffic class based on the intermediate classifications and prior samples of the output traffic class.

8. An apparatus according to claim 7 wherein said signal class mappers are modified in response to the presence of predetermined signal classes.

9. An apparatus according to claim 4 wherein said derived signal classifications and said output traffic class each include classes selected from a group consisting of Voice, Facsimile, Voice-Band-Data, Audible Network Signaling, Facsimile Handshaking, Voice-Band-Data Handshaking, Silence and Unknown.

10. An apparatus according to claim 1 wherein said source classifier comprises a first stage which derives an amplitude estimate for each side of said communications channel, and a second stage having respective inputs thereto coupled to outputs from said first stage and providing an output source class based upon the derived amplitude estimates for each side of said communications channel.

11. An apparatus according to claim 10 wherein said first stage is comprised of two identical amplitude estimation devices coupled to respective sides of said communications channel, each amplitude estimation device comprising:

(a) a block segmenter coupled to one side of said communications channel operative to isolate blocks of signal samples;

(b) a block amplitude estimator coupled to an output of said block segmenter operative to produce periodic estimates of the amplitude of the signal for successive blocks of signal samples; and

(c) an averager coupled to an output of said block amplitude estimator operative to produce an output amplitude estimate for signals on said one side of said communications channel.

12. An apparatus according to claim 11 wherein said block amplitude estimator is based on the average of the square of signal samples within a block.

13. An apparatus according to claim 11 wherein said averager acts to rapidly increase the output amplitude estimate when its current value is lower than the output of the block amplitude estimator, and to slowly decrease the output amplitude estimate when its current value is higher than the output of the block amplitude estimator.

14. An apparatus according to claim 10 wherein said second stage produces an output source class based on identification of the largest of the two amplitude estimates output from said first stage.

15. An apparatus according to claim 1 wherein said regulator device imposes prescribed actions on said communications channel when specified combinations of traffic classes and source classes occur, and when different specified combinations of traffic classes and source classes fail to occur within a specified period of time.

16. An apparatus according to claim 15 wherein said specified combinations are modified during the course of policing on said communications channel, said modification being a consequence of the passage of time and the observance of specific combinations of traffic classes and source classes.

17. An apparatus according to claim 15 wherein the prescribed actions of said regulator device include imposition of a voice message on said communications channel.

18. An apparatus according to claim 15 wherein said prescribed actions include forcing of both sides of said communications channel to an on-hook state, thereby causing calls and call setup attempts to be terminated by switches in the telephone network.

19. An apparatus according to claim 15 wherein said prescribed actions include forcing of both sides of said communications channel to an off-hook state, thereby ensuring that switches within the telephone network receive an answer supervision response.

20. An apparatus according to claim 1 wherein said channel state detector and said regulator device are each couplable with controlling devices of the telephone network to obtain control, management and data collection functions.

21. An apparatus according to claim 20 wherein said controlling devices coordinate system configuration, reporting of alarms, detection of system failures, execution of periodic system integrity checks, and the gathering and storage of reports on the policing functions.

22. An apparatus according to claim 20 wherein said controlling devices supply signaling information to said channel state detector when such signaling information is not available from said communications channel.

23. An apparatus according to claim 20 wherein said controlling devices coordinate the performance of said prescribed actions when such actions are not limited to manipulation of the signal on said communications channel.

24. An apparatus according to claim 1 wherein said policing functions comprise voice message imposition and call termination when:

(a) network signaling indicates that both sides of said communications channel are in an off-hook state;

(b) a specified period of grace has elapsed since the both sides of the channel went off-rook; and

(c) the properties of traffic observed on the channel are not consistent with the predetermined set of traffic properties that the network service provider wishes to allow on said communications channel.

25. An apparatus according to claim 1 wherein said policing functions comprise forcing of both sides of the communications channel to an off-hook state when:

(a) network signaling indicates that only one side or said communications channel is in an off-hook state;

(b) a specified period of grace has elapsed since entering a state where only one side of the channel is off-hook;

(c) the source class indicates that the traffic is emerging from the side of the channel that is apparently on-hook; and

(d) the traffic class for the side of the channel that is apparently on-hook is not consistent with traffic generated by the network service provider.

26. An apparatus according to claim 1 wherein said policing functions include unconditional imposition of prescribed actions a specified period of time after the onset of policing.

27. An apparatus according to claim 1 wherein said prescribed actions are disabled, thereby making it operative for collection of data on the degree to which said prescribed actions would be imposed if they were activated.

28. A method for performing policing functions for telephone services in a telephone network having network controlling devices and a communications channel so as to conditionally impose prescribed actions on the communications channel based upon the properties of traffic thereon, comprising the steps of:

(a) determining whether said communications channel is in a state that warrants activation of said policing functions;

(b) classifying the traffic into a traffic class;

(c) determining which end of the communications channel is the dominant source of traffic; and

(d) initiating conditional imposition of prescribed actions if the policing functions are enabled, the conditional imposition being based upon the traffic class and the determination in step (c).

29. A method according to claim 28, including enabling and disabling of the policing functions in response to signals corresponding to apparent on-hook and off-hook states of each end of said communications channel.

30. A method according to claim 28, including classifying a signal on each side of said communications channel to provide derived signal classifications and generating an output traffic class based upon the derived signal classifications.

31. A method according to claim 28, wherein said classifying step (b) includes:

(b1) deriving a compensated signal which compensates for the effects of long telephone lines;

(b2) analyzing the spectral characteristics and determining the likely signal classification of the compensated signal;

(b3) detecting tones and handshaking signals of telephone network traffic; and

(b4) deriving an output signal class based on the results of steps (b1), (b2), and (b3).

32. A method according to claim 28, wherein said communications channel is an ubiquitous channel for carrying voice, facsimile or voice-band-data traffic.