Telecommunications system for generating a three-level customer behavior profile and for detecting deviation from the profile to identify fraud

• US 6,526,389 B1
• Filed: 04/20/1999
• Issued: 02/25/2003
• Est. Priority Date: 04/20/1999
• Status: Active Grant

• Current Assignee: Amdocs Development Limited (Amdocs Ltd.), Amdocs Software Systems Limited (Amdocs Ltd.)
• Original Assignee: Amdocs Software Systems Limited (Amdocs Ltd.)
• Inventors: Pinkas, Gadi, Murad, Uzi
• Primary Examiner(s): Choi, Kyle J.
• Assistant Examiner(s): Jeanty, Romain
• Application Number:
  US09/294,567
• Time in Patent Office: 1,407 Days
• Field of Search: 705/1, 705/10, 705/44, 705/39, 379/189, 379/198, 379/91.01, 710/200, 455/67.1, 455/410, 235/380
• US Class Current: 705/7.29
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0201 Market modelling; Market analysis; Collecting market data
• CPC Class Codes: G06Q 30/0202 Market predictions or forecasting for commercial activities
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number

Abstract

Telecommunications apparatus and method for detecting any unusual activity in customer behavior. A comprehensive behavior profile of a customer is generated on the basis of customer transactions. The profile includes a short-term customer behavior obtained from all of the customer'"'"'s transactions, and further includes a long-term customer behavior obtained on the basis of the generated short-term behavior. Any behavior deviation from the profile is detected and identified as fraudulent or unusual.

Claims

1. A computer implemented method for determining a normal customer behavior profile that includes a plurality of transactions pertaining to an activity, each transaction being defined by a plurality of attributes which are measures of the transaction, and said normal behavior profile being used to alert of an unusual activity, said method comprising the steps of:

selecting a number of prototypical transactions from said plurality of transactions;

arranging the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile;

obtaining a plurality of first behavior profiles during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals, wherein each first behavior profile includes a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval, each dimension of the multi-dimensional probability distribution corresponding to one of the plurality of attributes and having a corresponding cumulative distribution;

arranging the first behavior profiles obtained during said second predetermined time interval into a number of clusters;

determining a prototypical first behavior profile for each cluster; and

arranging the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile;

wherein said steps of arranging the first behavior profiles and determining said prototypical first behavior profile comprise;

designating a number of first behavior profiles as respective centers for the clusters;

finding a closest center to each remaining first behavior profile;

assigning said each remaining first behavior profile to said closest center;

recalculating each center for a corresponding cluster according to said step of assigning; and

repeating said steps of designating, finding, assigning and recalculating until a membership of each cluster does not change;

wherein said step of finding includes the step of weighted summing the squared differences between the cumulative distribution of the first behavior profile designated as a closest center and the cumulative distribution of each remaining first behavior profile at each attribute.

2. The method according to claim 1, wherein each transaction is defined by non-numerical and numerical attributes which are qualitative and quantitative measures of the transaction, respectively.

3. The method according to claim 2, wherein said step of selecting the prototypical transactions includes dividing the numerical attributes into a predetermined number of values and associating the values with the non-numerical attributes.

4. The method according to claim 1, wherein each prototypical first behavior profile is located at a respective center of each cluster.

5. The method according to claim 1, wherein said first behavior profile includes a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval.

6. The method according to claim 1, wherein said first behavior profile includes the number of transactions.

7. The method according to claim 6, wherein each record includes the number of times a respective prototypical first behavior profile has been observed during said second predetermined time interval, also includes a total number of transactions carried out during said second predetermined time interval, and further includes a sum of squared number of transactions during said first predetermined time interval within said second predetermined time interval.

8. The method according to claim 1, wherein said second behavior profile is separately maintained for each customer for each type of said first predetermined time interval.

9. A computer implemented method for detecting a deviation from a normal customer behavior profile that includes a plurality of transactions, said method comprising the steps of:

generating said normal behavior profile by;

selecting a number of prototypical transactions from said plurality of transactions;

arranging the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile, said first behavior profile including a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval;

obtaining a plurality of first behavior profiles during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals;

arranging the first behavior profiles obtained during said second predetermined time interval into a number of clusters;

determining a prototypical first behavior profile for each cluster; and

arranging the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile determined over said second predetermined time interval; and

comparing a new first behavior profile with each record to identify said deviation from said normal behavior profile if none of the records substantially matches said new first behavior profile, said step of comparing including determining whether a difference between said vector of said new first behavior profile and said vector of said prototypical first behavior profile is less than a first predetermined threshold.

10. The method according to claim 9, wherein said deviation is designated as fraudulent in behalf of a customer.

11. The method according to claim 9, wherein said first behavior profile includes the number of transactions.

12. The method according to claim 11, wherein each record includes the number of times a respective prototypical first behavior profile has been observed during said second predetermined time interval, also includes a total number of transactions carried out during said second predetermined time interval, and further includes a sum of squared number of transactions during said first predetermined time interval within said second predetermined time interval.

13. The method according to claim 9, wherein said second behavior profile is separately maintained for each customer for each type of said first predetermined time interval.

14. The method according to claim 9, wherein each first behavior profile includes a quantitative measure of the number of transactions which have been arranged into it, and

wherein said step of comparing further includes comparing an expression with a second predetermined threshold if said first predetermined threshold is not exceeded, said expression being a function of said quantitative measure, of a mean of the first behavior profiles closest to said prototypical first behavior profile, and of a standard deviation of the first behavior profiles closest to said prototypical first behavior profile.

15. The method according to claim 9, wherein each transaction is defined by a plurality of attributes which are measures of the transaction,

wherein each dimension of the multi-dimensional probability distribution represented by said vector corresponds to one of the plurality of attributes,

wherein each dimension of the multi-dimensional probability distribution represented by said vector has a corresponding cumulative distribution,

wherein the distance between two cumulative distributions is their difference, and

wherein said step of determining said distance includes the step of weighted summing the squared distances between the cumulative distribution of said new first behavior profile and the cumulative distribution of said prototypical first behavior profile at each attribute.

16. An apparatus comprising a programmable controller for determining a normal customer behavior profile that includes a plurality of transactions pertaining to an activity, each transaction being defined by a plurality of attributes which are measures of the transaction, and said normal behavior profile being used to alert of an unusual activity, said apparatus comprising:

means for selecting a number of prototypical transactions from said plurality of transactions;

means for arranging the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile;

means for obtaining a plurality of first behavior profiles during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals, wherein each first behavior profile includes a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval, each dimension of the multi-dimensional probability distribution corresponding to one of the plurality of attributes and having a corresponding cumulative distribution;

means for arranging the first behavior profiles obtained during said second predetermined time interval into a number of clusters;

means for determining a prototypical first behavior profile for each cluster; and

means for arranging the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile determined over said second predetermined time interval;

wherein said means for arranging the first behavior profiles and means for determining said prototypical first behavior profile comprise;

means for designating a number of first behavior profiles as respective centers for the clusters;

means for finding a closest center to each remaining first behavior profile;

means for assigning said each remaining first behavior profile to said closest center;

means for recalculating each center for a corresponding cluster according to said step of assigning; and

means for repeating the operations of designating, finding, assigning and recalculating until a membership of each cluster does not change;

wherein said means for finding includes means for weighted summing the squared differences between the cumulative distribution of the first behavior profile designated as a closest center and the cumulative distribution of each remaining first behavior profile at each attribute.

17. The apparatus according to claims 16, wherein each transaction is defined by non-numerical and numerical attributes which are qualitative and quantitative measures of the transaction, respectively.

18. The apparatus according to claim 16, wherein said means for selecting includes means for dividing said one numerical attribute into a predetermined number of values and for associating the values with the non-numerical attributes.

19. The apparatus according to claim 16, wherein each prototypical first behavior profile is located at a respective center of each cluster.

20. The apparatus according to claim 16, wherein said first behavior profile includes a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval.

21. The apparatus according to claim 16, wherein said first behavior profile includes the number of transactions.

22. The apparatus according to claim 21, wherein each record includes the number of times a respective prototypical first behavior profile has been observed during said second predetermined time interval, also includes a total number of transactions carried out during said second predetermined time interval, and further includes a sum of squared number of transactions during said first predetermined time interval within said second predetermined time interval.

23. The apparatus according to claim 16, wherein said second behavior profile is separately maintained for each customer for each type of said first predetermined time interval.

24. An apparatus comprising a programmable controller for detecting a deviation from a normal customer behavior profile that includes a plurality of transactions, said apparatus comprising:

means for generating said normal behavior profile comprising;

means for selecting a number of prototypical transactions from said plurality of transactions;

means for arranging the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile, said first behavior profile including a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval;

means for obtaining a plurality of first behavior profiles during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals;

means for arranging the first behavior profiles obtained during said second predetermined time interval into a number of clusters; and

means for determining a prototypical first behavior profile for each cluster; and

means for arranging the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile determined over said second predetermined time interval, said apparatus further comprising means for comparing a new first behavior profile with each record to identify said deviation from said normal behavior profile if none of the records substantially matches said new first behavior profile, wherein said means for comparing determines whether a difference between said vector of said new first behavior profile and said vector of said prototypical first behavior profile is less than a first predetermined threshold.

25. The apparatus according to claim 24, wherein said deviation is designated as fraudulent on behalf of a customer.

26. The apparatus according to claim 24, wherein said first behavior profile includes the number of transactions.

27. The apparatus according to claim 26, wherein each record includes the number of times a respective prototypical first behavior profile has been observed during said second predetermined time interval, also includes a total number of transactions carried out during said second predetermined time interval, and further includes a sum of squared number of transactions during said first predetermined time interval within said second predetermined time interval.

28. The apparatus according to claim 24, wherein said second behavior profile is separately maintained for each customer for each type of said first predetermined time interval.

29. The apparatus according to claim 24, wherein each first behavior profile includes a quantitative measure of the number of transactions which have been arranged into it, and

wherein said means for comparing further includes comparing an expression with a second predetermined threshold if said first predetermined threshold is not exceeded, said expression being a function of said quantitative measure, of a mean of the first behavior profiles closest to said prototypical first behavior profile, and of a standard deviation of the first behavior profiles closest to said prototypical first behavior profile.

30. The apparatus according to claim 24, wherein each transaction is defined by a plurality of attributes which are measures of the transaction,

wherein each dimension of the multi-dimensional probability distribution represented by said vector corresponds to one of the plurality of attributes,

wherein each dimension of the multi-dimensional probability distribution represented by said vector has a corresponding cumulative distribution,

wherein the distance between two cumulative distributions is their difference, and

wherein said means for comparing includes means for weighted summing the squared distances between the cumulative distribution of said new first behavior profile and the cumulative distribution of said prototypical first behavior profile at each attribute.