Telecommunications system for generating a three-level customer behavior profile and for detecting deviation from the profile to identify fraud

• US 7,035,823 B2
• Filed: 12/11/2001
• Issued: 04/25/2006
• Est. Priority Date: 04/20/1999
• Status: Expired due to Term

• Current Assignee: Amdocs Development Limited (Amdocs Ltd.), Amdocs Software Systems Limited (Amdocs Ltd.)
• Original Assignee: Amdocs Software Systems Limited (Amdocs Ltd.)
• Inventors: Pinkas, Gadi, Murad, Uzi
• Primary Examiner(s): Jeanty, Romain
• Application Number:
  US10/013,558
• Publication Number:
  US 20020184080A1
• Time in Patent Office: 1,596 Days
• Field of Search: 705/10, 705/39, 705/44, 705/27
• US Class Current: 705/39
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0201 Market modelling; Market analysis; Collecting market data
• CPC Class Codes: G06Q 30/0202 Market predictions or forecasting for commercial activities
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number

Abstract

Telecommunications apparatus and method for detecting any unusual activity in customer behavior. A comprehensive behavior profile of a customer is generated on the basis of customer transactions. The profile includes a short-term customer behavior obtained from all of the customer'"'"'s transactions, and further includes a long-term customer behavior obtained on the basis of the generated short-term behavior. Any behavior deviation from the profile is detected and identified as fraudulent or unusual.

Claims

1. A computer implemented method for determining a normal customer behavior profile that includes a plurality of transactions pertaining to an activity, said normal behavior profile being used to alert of an unusual activity, said method comprising the steps of:

selecting, at a computer, a number of prototypical transactions from said plurality of transactions;

arranging, at the computer, the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile;

obtaining, at the computer, a plurality of first behavior profiles during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals;

arranging, at the computer, the first behavior profiles obtained during said second predetermined time interval into a number of clusters;

determining, at the computer, a prototypical first behavior profile for each cluster; and

arranging, at the computer, the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile;

wherein said steps of arranging the first behavior profiles and determining said prototypical first behavior profile comprise;

designating, at the computer, a number of first behavior profiles as respective centers for the clusters;

finding, at the computer, a closest center to each remaining first behavior profile;

assigning, at the computer, each remaining first behavior profile to said closest center;

recalculating, at the computer, each center for a corresponding cluster according to said step of assigning; and

repeating, at the computer, said steps of designating, finding, assigning and recalculating until a membership of each cluster does not change.

2. A computer implemented method for determining a normal customer behavior profile that includes a plurality of transactions pertaining to an activity, the normal customer behavior profile being used to alert of an unusual activity, the method comprising the steps of:

selecting, at a computer, a number of prototypical transactions from the plurality of transactions;

arranging, at the computer, the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile;

obtaining, at the computer, a plurality of first behavior profiles during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals;

arranging, at the computer, the first behavior profiles obtained during the second predetermined time interval into a number of clusters;

determining, at the computer, a prototypical first behavior profile for each cluster; and

arranging, at the computer, the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile;

wherein said first behavior profile includes the number of transactions; and

wherein each record includes the number of times a respective prototypical first behavior profile has been observed during said second predetermined time interval, also includes a total number of transactions carried out during said second predetermined time interval, and further includes a sum of squared number of transactions during said first predetermined time interval within said second predetermined time interval.

3. The method according to claim 2, wherein each transaction is defined by non-numerical and numerical attributes which are qualitative and quantitative measures of the transaction, respectively.

4. The method according to claim 3, wherein said step of selecting the prototypical transactions includes dividing the numerical attributes into a predetermined number of values and associating the values with the non-numerical attributes.

5. The method according to claim 2, wherein each prototypical first behavior profile is located at a respective center of each cluster.

6. The method according to claim 2, wherein said first behavior profile includes a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval.

7. The method according to claim 2, wherein said second behavior profile is separately maintained for each customer for each type of said first predetermined time interval.

8. A computer implemented method for detecting a deviation from a customer behavior profile that includes a plurality of transactions, the method comprising the steps of:

selecting, at the computer, a number of prototypical transactions from a plurality of transactions of a customer;

arranging, at the computer, the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile of the customer;

obtaining, at the computer, a plurality of first behavior profiles of the customer during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals;

arranging, at the computer, the first behavior profiles obtained during the second predetermined time interval into a number of clusters;

determining, at the computer, a prototypical first behavior profile for each cluster;

arranging, at the computer, the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile of the customer determined over the second predetermined time interval; and

comparing, at the computer, a new first behavior profile representing transactions of the customer with each record of the second behavior profile to identify a deviation from the second behavior profile if none of the records of the second behavior profile substantially matches the new first behavior profile;

wherein said first behavior profile includes the number of transactions; and

wherein each record includes the number of times a respective prototypical first behavior profile has been observed during said second predetermined time interval, also includes a total number of transactions carried out during said second predetermined time interval, and further includes a sum of squared number of transactions during said first predetermined time interval within said second predetermined time interval.

9. The method according to claim 8, wherein said deviation is designated as fraudulent on behalf of a customer.

10. The method according to claim 8, wherein said first behavior profile includes a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval.

11. The method according to claim 8, wherein said second behavior profile is separately maintained for each customer for each type of said first predetermined time interval.

12. Apparatus comprising a programmable controller for determining a normal customer behavior profile that includes a plurality of transactions pertaining to an activity, said normal behavior profile being used to alert of an unusual activity, the apparatus comprising:

means for selecting a number of prototypical transactions from said plurality of transactions;

means for arranging the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile;

means for obtaining a plurality of first behavior profiles during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals;

means for arranging the first behavior profiles obtained during the second predetermined time interval into a number of clusters;

means for determining a prototypical first behavior profile for each cluster; and

means for arranging the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile determined over the second predetermined time interval;

wherein said means for arranging the first behavior profiles and means for determining said prototypical first behavior profile comprise;

means for designating a number of first behavior profiles as respective centers for the clusters;

means for finding a closest center to each remaining first behavior profile;

means for assigning said each remaining first behavior profile to said closest center;

means for recalculating each center for a corresponding cluster according to said step of assigning; and

means for repeating the operations of designating, finding, assigning and recalculating until a membership of each cluster does not change.

13. Apparatus comprising a programmable controller for determining a normal customer behavior profile that includes a plurality of transactions pertaining to an activity, said normal behavior profile being used to alert of an unusual activity, said apparatus comprising:

means for selecting a number of prototypical transactions from said plurality of transactions;

means for arranging the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile;

means for obtaining a plurality of first behavior profiles during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals;

means for arranging the first behavior profiles obtained during said second predetermined time interval into a number of clusters;

means for determining a prototypical first behavior profile for each cluster; and

means for arranging the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile determined over said second predetermined time interval;

wherein said first behavior profile includes the number of transactions; and

wherein each record includes the number of times a respective prototypical first behavior profile has been observed during said second predetermined time interval, also includes a total number of transactions carried out during said second predetermined time interval, and further includes a sum of squared number of transactions during said first predetermined time interval within said second predetermined time interval.

14. The apparatus according to claim 13, wherein each transaction is defined by non-numerical and numerical attributes which are qualitative and quantitative measures of the transaction, respectively.

15. The apparatus according to claim 13, wherein said means for selecting includes means for dividing said one numerical attribute into a predetermined number of values and for associating the values with the non-numerical attributes.

16. The apparatus according to claim 13, wherein each prototypical first behavior profile is located at a respective center of each cluster.

17. The apparatus according to claim 13, wherein said first behavior profile includes a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval.

18. The apparatus according to claim 13, wherein said second behavior profile is separately maintained for each customer for each type of said first predetermined time interval.

19. Apparatus comprising a programmable controller for detecting a deviation from a customer behavior profile that includes a plurality of transactions, the apparatus comprising:

means for selecting a number of prototypical transactions from a plurality of transactions of a customer;

means for arranging the selected prototypical transactions collected during a first predetermined time interval into a first behavior profile of the customer;

means for obtaining a plurality of first behavior profiles of the customer during a second predetermined time interval that is comprised of a plurality of first predetermined time intervals;

means for arranging the first behavior profiles obtained during said second predetermined time interval into a number of clusters;

means for determining a prototypical first behavior profile for each cluster;

means for arranging the determined prototypical first behavior profiles into a plurality of records for representing a second behavior profile of the customer determined over the second predetermined time interval; and

means for comparing a new first behavior profile representing transactions of the customer with each record of the second behavior profile to identify a deviation from the second behavior profile if none of the records of the second behavior profile substantially matches the new first behavior profile;

wherein said first behavior profile includes the number of transactions; and

wherein each record includes the number of times a respective prototypical first behavior profile has been observed during said second predetermined time interval, also includes a total number of transactions carried out during said second predetermined time interval, and further includes a sum of squared number of transactions during said first predetermined time interval within said second predetermined time interval.

20. The apparatus according to claim 19, wherein said deviation is designated as fraudulent on behalf of a customer.

21. The apparatus according to claim 19, wherein said first behavior profile includes a vector representing a multi-dimensional probability distribution of the transactions carried out during said first predetermined time interval.

22. The apparatus according to claim 19, wherein said second behavior profile is separately maintained for each customer for each type of said first predetermined time interval.