Methods and apparatus for reducing data capture and storage requirements for call and transaction related message monitoring and fraud detection

• US 7,003,080 B1
• Filed: 09/23/2004
• Issued: 02/21/2006
• Est. Priority Date: 09/23/2004
• Status: Expired due to Fees

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Services Corporation (Verizon Communications Inc.)
• Inventors: Vecchioli, Joseph, Hasenauer, George Robert, Doskow, Arthur, Gebhardt, Erik George, Hetz, Harry A.
• Primary Examiner(s): BARNIE, REXFORD N
• Application Number:
  US10/948,515
• Time in Patent Office: 516 Days
• Field of Search: 379/112.01, 379/32.01, 379/32.03, 379/32.04, 379/1.01, 379/15.02, 379/111, 379/112.06, 379/112.07, 379/112.08, 379/112.09, 379/112.1, 379/133, 379/134, 379/136, 379/137, 379/138, 379/139
• US Class Current: 379/32.03
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/70 Administration or customization aspects; Counter-checking correct charges
• CPC Class Codes: H04M 15/73 Validating charges
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2215/0164 Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 2215/70 Administration aspects, modify settings or limits or counter-check correct charges
• CPC Class Codes: H04M 2215/7072 Validate charges
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/06 using auxiliary connections for control or supervision , e.g. where the auxiliary connection is a signalling system number 7 link
• CPC Class Codes: H04M 7/12 for working between exchanges having different types of switching equipment, e.g. power-driven and step by step or decimal and non-decimal
• CPC Class Codes: H04Q 2213/1307 Call setup
• CPC Class Codes: H04Q 2213/13091 CLI, identification of calling line
• CPC Class Codes: H04Q 2213/13103 Memory
• CPC Class Codes: H04Q 2213/1313 Metering, billing
• CPC Class Codes: H04Q 2213/13176 Common channel signaling, CCS7
• CPC Class Codes: H04Q 2213/13213 Counting, timing circuits
• CPC Class Codes: H04Q 2213/13216 Code signals, frame structure
• CPC Class Codes: H04Q 2213/13339 : Ciphering, encryption, security
• CPC Class Codes: H04Q 2213/13352 : Self-routing networks, real-time routing
• CPC Class Codes: H04Q 2213/13383 : Hierarchy of switches, main and subexchange, e.g. satellite exchange

Abstract

Systems for monitoring, storage, and analysis of information in signaling messages, communicated from originating networks to a destination network through one or more intermediate networks are described. Correlation and comparison between signaling messages of interest sent from an origination network to signaling messages received by the destination network allows for the detection of inconsistent information, e.g., information fields in a communicated message that have been altered, either intentionally or unintentionally, by an intermediate carrier. The introduction of an additional communications path over which notification messages are forwarded from signaling monitoring equipment in the origination network to signaling monitoring equipment in the destination network allows for a significant reduction in the memory storage requirements at the destination network and in the amount of processing required to match, compare, and evaluate signaling messages. In addition, the reduction in stored messages and processing time allows the monitoring system to operate in near-real time allowing for fraud detection while a call is still in progress.

Claims

1. A method of monitoring at least one telephone call-related signaling message in a communications system including a source network and a destination network coupled together by an intermediate network, first and second communications paths extending between said source and destination network, the first and second communications paths being different, the method comprising:

monitoring a first telephone call-related signaling message originating from said source network that is directed to said destination network via the second communications path;

creating a copy of at least a portion of said first telephone call-related signaling message;

sending a notification message from said source network to said destination network using said first communications path, indicating to the destination network that a message of interest, containing information supplied by the source network, is being communicated to said destination network;

sending said first telephone call-related signaling message to said destination network through said intermediate network using said second communications path;

operating said destination network to receive said notification message;

receiving from said intermediate network a telephone call-related signaling message corresponding to the first telephone call-related signaling message; and

in response to said received notification message sending at least a portion of said received telephone call-related signaling message corresponding to the first telephone call-related signaling message to a long-term storage device.

2. The method of claim 1, further comprising:

operating the source network to send said copy of at least a portion of said first telephone call-related signaling message to a processing device; and

operating the processing device to compare at least a portion of said copy of at least a portion of said first telephone call-related signaling message to a corresponding portion of said received telephone call-related signaling message to determine if the compared message portions are inconsistent.

3. The method of claim 2, wherein said processing device determines if the compared message portions are inconsistent while a call to which the message portions relate is ongoing.

4. The method of claim 2, wherein said processing device generates a fraud warning when it is determined that the compared message portions are inconsistent.

5. The method of claim 2, wherein said first telephone call-related signaling message is an SS7 message related to a telephone call that originates from said source network and terminates in said destination network.

6. The method of claim 5, wherein said call notification message is communicated to said destination network over a management network which provides at least a portion of said first communications path.

7. The method of claim 5, said first telephone call-related signaling message is communicated over an inter-carrier network that forms part of the second communications path.

8. The method of claim 7, wherein said processing device is located in said destination network.

9. The method of claim 7 wherein said processing device is located in a processing center, said processing center including said long-term storage device, the method further comprising:

operating the processing center to receive said at least a portion of said received telephone call-related signaling message corresponding to the first telephone call-related signaling message sent by the source network; and

operating the processing center to receive said copy of at least a portion of said received first telephone call-related signaling message.

10. The method of claim 9 wherein said processing center is collocated with equipment comprising part of said management network.

11. The method of claim 9 wherein said processing center is controlled by an operator that operates said destination network.

12. The method of claim 9, wherein the source network, destination network and intermediate network are operated by different telephone service providers.

13. The method of claim 9, wherein the source network, and destination network are operated by the same telephone service provider and the intermediate network is operated by a different telephone service provider.

14. The method of claim 7 wherein at least a portion of said inter-carrier network over which said first telephone call-related signaling message is communicated is an IP network which uses IP packets to communicate said telephone call-related signaling message.

15. The method of claim 2, wherein said comparison indicates that the compared message portions are inconsistent when the compared message portions are not the same.

16. The method of claim 15, further comprising:

when said compared message portions are inconsistent further determining if the received telephone call-related signaling message portion is missing information or includes valid information which changed from corresponding valid information included in the transmitted first telephone call-related signaling message.

17. The method of claim 2, further comprising:

temporarily storing received telephone call-related signaling messages in a buffer in said destination network; and

wherein said step of sending at least a portion of said received telephone call-related signaling message corresponding to the transmitted first telephone call-related signaling message to a long-term storage device includes processing the contents of the buffer in response to said call notification message.

18. The method of claim 17, wherein said processing the contents of the buffer include:

transferring the contents of at least a portion of said buffer including multiple call-related messages to said long-term storage.

19. The method of claim 18,

wherein said call notification message includes message identification information which can be used to identify a call-related signaling message of interest sent from said source network;

and

wherein said step of transferring the contents of at least a portion of said buffer include;

identifying said received telephone call-related signaling message corresponding to the first telephone call-related signaling message in said buffer contents using said message identification information; and

wherein said contents of at least a portion of said buffer transmitted to said long-term storage in response to said call notification message include said identified received telephone call-related signaling message.

20. The method of claim 1, wherein the first and second communications paths are independent communications paths.

21. A communication system comprising:

a source network; and

a destination network including a second message monitoring device, the source network being coupled to said destination network by first and second communications paths extending between said source and destination networks, the first and second communications paths being different, said second communications path traversing at least a portion of an intermediate communications network which is included in at least a portion of said second communications path;

wherein the source network includes;

i) a first message monitoring device for monitoring at least a first telephone call-related signaling message originating from said source network that is directed towards said destination network;

ii) a means for creating a copy of at least a portion of said first telephone call-related signaling message; and

iii) means for sending a notification message from said source network to said destination network using said first communications path, indicating to the destination network that a corresponding call-related signaling message of interest is being communicated to said destination network based on a call-related signaling message sent from said source network; and

iv) means for communicating at least a portion of said first telephone call-related signaling message to said destination network through said intermediate network using said second communications path; and

wherein the destination network includes;

i) means for receiving said notification message;

ii) means for receiving from said intermediate network a telephone call-related signaling message corresponding to the first telephone call-related signaling message originated by said source network; and

iii) message storage control means, responsive to said received notification message, for copying and sending at least a portion of said received telephone call-related signaling message corresponding to the first telephone call-related signaling message to a long-term storage device.

22. The system of claim 21, further comprising:

a message verification device coupled to said source and destination networks, said message verification device receiving said copy of at least a portion of said first telephone call-related signaling message and comparing at least a portion of said copy of at least a portion of said first telephone call-related message to a corresponding portion of said received telephone call-related signaling message to determine if the compared message portions are inconsistent.

23. The system of claim 22, wherein said message verification device operates in real time to determine if the compared signaling message portions are inconsistent while a call to which the message portions relate is still ongoing.

24. The method of claim 23, wherein said message verification device is located in said destination network.

25. The method of claim 23, wherein said destination network further includes:

a buffer for temporarily storing received telephone call-related signaling messages; and

means for identifying said received telephone call-related signaling message corresponding to the first telephone call-related signaling message in said buffer contents using said message identification information.