Internet service provider (ISP) finder

• US 6,351,453 B1
• Filed: 11/10/1998
• Issued: 02/26/2002
• Est. Priority Date: 03/26/1998
• Status: Expired due to Term

• Current Assignee: OL Security LLC (Intellectual Ventures LLC)
• Original Assignee: Bell Atlantic Network Services, Inc. (Verizon Communications Inc.)
• Inventors: Nolting, Thomas A., Dion, Karen, LaPearl, Richard, Noonan, Sheila
• Primary Examiner(s): Kuntz, Curtis
• Assistant Examiner(s): Barnie, Rexford N
• Application Number:
  US09/188,679
• Time in Patent Office: 1,204 Days
• Field of Search: 379/112, 379/113, 379/133, 379/134, 379/135, 379/34, 379/265, 379/266, 379/309, 379/111, 370/229, 370/230, 370/231, 370/232, 370/233, 370/237, 370/235, 370/236, 370/234
• US Class Current: 370/234
• CPC Class Codes: H04M 2207/12 intelligent networks
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls

Abstract

Specialized telecom network users who burden the network, such as Internet Service Providers (ISPs), are identified by analysis of network traffic data to identify addresses (e.g. telephone numbers) for destinations receiving unique patterns of incoming traffic. For an ISP, in particular, the analysis involves identifying telephone, numbers of destinations receiving a high volume of calls and having connections exhibiting a long average hold time. To further enhance the ISP finder analysis, the call data may be examined to confirm that there is no outgoing call traffic from any station associated with the candidate ISP numbers. When numbers are identified by the call data analysis, a technician can call each number and listen for a modem tone, as a confirmation that each candidate number actually is of a data service, such as an ISP. Similar methodologies can identify destination numbers for other unique service providers, such as credit card verification services. The preferred embodiments utilize automated systems to compile and analyze call records from standard messages of a telephone network, such as interoffice signaling messages or automated accounting messages.

Claims

1. A method comprising the steps of:

analyzing data records of calls through a telecommunication network to identify destination telephone numbers receiving a high volume of incoming traffic from a plurality of users;

for the identified destination numbers, analyzing data records for calls to those numbers to determine number of calls from users made to each of the identified telephone numbers and total amount of connect time for the calls from users to each of the identified numbers; and

collecting a subset of the identified telephone numbers as candidate numbers, wherein each one of the identified telephone numbers is included in the subset as a candidate number if the number of the calls from users and the total amount of connect time for the calls from users to the one identified telephone number satisfy criteria indicating a target traffic pattern.

2. A method as in claim 1, wherein:

the criteria comprises a relationship between the number of calls and the total connect time for calls to the one identified telephone number signifying a long average hold time; and

the target traffic pattern relates to data calls through the telecommunication network.

3. A method as in claim 1, wherein the criteria comprises a relationship between the number of calls and the total connect time for calls to the one identified telephone number signifying a short average hold time.

4. A method as in claim 1, wherein the step of analyzing data records to identify destination telephone numbers receiving a high volume of incoming traffic comprises:

analyzing number of incoming calls to each destination telephone number within a predetermined interval; and

identifying destination numbers having a number of incoming calls exceeding a threshold value.

5. A method as in claim 1, wherein the step of analyzing data records to identify destination telephone numbers receiving a high volume of incoming traffic comprises selecting a predetermined number of destination telephone numbers receiving the highest number of incoming calls.

7. A method as in claim 1, further comprising:

accessing reference data; and

using the reference data to translate an item of information from a data record of a call to each respective candidate number in the subset into descriptive information.

8. A method as in claim 7, wherein the descriptive information identifies an office of the telecommunication network assigned to provide switching services relating to the respective candidate number in the subset.

9. A method as in claim 7, wherein the descriptive information identifies a subscriber that has been assigned the respective candidate number in the subset.

6. A method comprising the steps of:

analyzing data records of calls through a telecommunication network to identify destination telephone numbers receiving a high volume of incoming traffic;

for the identified destination numbers, analyzing data records for calls to those numbers to determine number of calls made to each of the identified telephone numbers and total amount of connect time for calls to each of the identified numbers;

collecting a subset of the identified telephone numbers as candidate numbers, wherein each one of the identified telephone numbers is included in the subset as a candidate number if the number of calls and the total amount of connect time for calls to the one identified telephone number satisfy criteria indicating a target traffic pattern;

for each candidate number in the subset, analyzing data records of calls through the telecommunication network to determine if there were any outgoing calls from a station associated with the candidate number; and

deleting any candidate numbers from the subset if there were any outgoing calls from a station associated therewith.

10. A method for identifying destination telephone numbers as candidate numbers believed to be associated with a particular type of business, comprising the steps of:

compiling records of calls through a portion of a telecommunication network from management data of the network, the records comprising data identifying start time, duration, and destination number of each call; and

analyzing the records of calls to identify each destination number satisfying predetermined criteria as a candidate telephone number, the predetermined criteria comprising;

a high volume of incoming calls to the destination number during a predetermined interval, and

calls to the destination number exhibit an average hold time bearing a predetermined relationship to a threshold value of duration.

11. A method as in claim 10, wherein the predetermined criteria further comprises a requirement that substantially all calls for the destination number were incoming calls, such that there were substantially no calls from a station associated with the destination number to another number.

12. A method as in claim 10, further comprising:

accessing a list of known destination numbers associated with the particular type of business; and

eliminating any candidate number found on the list of known destination numbers.

13. A method as in claim 10, wherein the management data comprises interoffice signaling messages, and the step of compiling records of calls comprises:

monitoring signaling messages regarding call processing exchanged between offices of the telecommunication network; and

processing a plurality of the signaling messages regarding each call through the portion of the telecommunications network to form a call detail record of significant data regarding each call.

14. A method as in claim 10, wherein:

the management data comprises accounting messages regarding calls processed through offices of the telecommunication network generated by the offices; and

the step of compiling records of calls comprises processing a plurality of the accounting messages regarding each call through the portion of the telecommunication network to form a call detail record of significant data regarding each call.

15. A method as in claim 10, further comprising the step of initiating a call to each candiate telephone number to determine if an answer condition satisfies a predetermined characteristic.

16. A method as in claim 15, wherein the predetermined characteristic comprises an answer by a modem.

17. A method as in claim 10, wherein the predetermined relationship of the average hold time is that the average hold time meets or exceeds the threshold value of duration.

18. A method as in claim 17, wherein the particular type of business comprises an Internet Service Provider.

19. A method as in claim 18, further comprising the step of initiating a call to one candidate telephone number to detect answering by a modem as a confirmation that the one candidate telephone number serves an Information Service Provider.

20. A method as in claim 10, wherein the predetermined relationship of the average hold time is that the average hold time is less than or equal to the threshold value of duration.

21. A method as in claim 10, wherein the step of compiling comprises forming the records of call from management data of the telecommunication network and loading the records of call management data into a database.

22. A method as in claim 21, wherein the step of analyzing comprises:

enhancing the records of call management data in the database;

loading the enhanced data into an on-line analytical processing system; and

running an application on the on-line analytical processing system to present an analysis of the enhanced data identifying destination telephone numbers as candidate numbers believed to be associated with a particular type of business.

23. A method as in claim 22, wherein the enhancing step comprises, for any calls processed by the telecommunication network extending over two or more predetermined time intervals, binning usage data from the records for those calls in accord with actual usage within each interval.

24. A method as in claim 10, wherein the analysis of the records of calls to identify each destination number having a high volume of calls during the predetermined interval comprises:

analyzing the records of calls through the portion of the telecommunication network to identify a peak busy hour; and

analyzing the records of calls to identify each destination number having more incoming calls than a threshold value during the peak busy hour.

25. A method as in claim 10, wherein analysis of the records of calls with respect to average hold time of calls to a predetermined number comprises:

counting number of calls initiated through the telecommunication network to the predetermined number;

determining the total usage time for calls completed to the predetermined number; and

calculating the average hold time for calls to the predetermined number by dividing the total usage time by the counted number of calls.

26. A method as in claim 10, further comprising the step of:

obtaining one item of information from a record of a call to one of the candidate telephone numbers;

accessing reference data; and

using the reference data, translating the one item of information into descriptive information.

27. A method as in claim 26, wherein the one item of information is the one candidate telephone number, and the descriptive information is the name of a subscriber associated with the one candidate telephone number.

28. A system, for use with a telephone network, for identifying destination telephone numbers as candidate numbers believed to be associated with a particular type of business, comprising:

means in communication with elements of the network for compiling detailed records for calls processed through a portion of the telephone network; and

a server system, in communication with the means for compiling, for receiving and analyzing the detailed records to identify each destination telephone number satisfying predetermined criteria as a candidate telephone number, the predetermined criteria comprising;

calls to the destination number during a predetermined interval exceed a threshold, and

calls to the destination number exhibit an average hold time bearing a predetermined relationship to a threshold value of duration.

29. A system as in claim 28, wherein the predetermined criteria further comprises a requirement that substantially all calls for the destination number were incoming calls, such that there were substantially no calls from a station associated with the destination number to another number.

30. A system as in claim 28, wherein the server system comprises:

1) a landing zone routine;

2) a relational database, wherein the landing zone routine loads the detailed records for calls into files in the relational database;

3) a data preparation routine for processing the files in the relational database to enrich the information of the detailed records for calls in a manner facilitating the analysis;

4) an on-line analytical processing routine receiving the enriched information; and

5) at least one application running in the on-line analytical processing routine, for presenting results of the analysis based on the enriched information.

31. A system as in claim 30, wherein:

the database comprises a relational database; and

the on-line analytical processing routine comprises a multi-dimensional database.

32. A system as in claim 28, wherein the means for compiling comprises:

monitors coupled to interoffice signaling links of the telephone network for trapping messages from the links; and

a least one processor receiving the trapped messages and compiling data therefrom to form the detailed records for calls processed through the portion of the telephone network.

33. A system as in claim 28, wherein the means for compiling comprises a system for processing a plurality of the accounting messages regarding each call through the portion of the telephone network to form one of the detailed records.

34. A system as in claim 33, wherein the system for processing comprises a billing system of the telephone network.

35. A system as in claim 34, wherein the system for processing further includes switching offices of the telephone network for transmitting automatic message accounting information regarding calls processed through the portion of the telephone network to the billing system.

36. A method comprising the steps of:

analyzing data records of calls through a telecommunication network to identify destination telephone numbers receiving a high volume of incoming traffic;

for the identified destination numbers, analyzing data records for calls to those numbers to determine number of calls to each of the identified telephone numbers and amount of connect time for the calls to each of the identified telephone numbers;

for each respective one of the identified telephone numbers, determining an average hold time from the number of calls to the respective identified telephone number and the amount of connect time for the calls to the respective identified telephone number; and

collecting a subset of the identified telephone numbers as candidate numbers, wherein each one of the identified telephone numbers is included in the subset as a candidate number if the average hold time satisfies criteria indicating a target traffic pattern.

37. A method as in claim 36, wherein the criteria comprises a predetermined relationship of the average hold time to a threshold value of duration.

38. A method as in claim 37, wherein:

the predetermined relationship of the average hold time to a threshold value of duration is that the average hold time meets or exceeds the threshold value, and

the target traffic pattern relates to data calls through the telecommunication network to a data network service provider.

39. A method as in claim 38, further comprising the step of initiating a call to one candidate telephone number to detect answering by a modem as a confirmation that the one candidate telephone number serves a data network service provider.

40. A method as in claim 37, wherein the predetermined relationship of the average hold time to a threshold value of duration is that the average hold time is less than or equal to the threshold value.