System and method for real-time fraud detection within a telecommunication network

• US 7,570,751 B2
• Filed: 06/23/2008
• Issued: 08/04/2009
• Est. Priority Date: 02/24/1997
• Status: Expired due to Fees

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: McGuire, Michael Joseph, Hatlak, Michael Joseph, Betts, Judy Lynn
• Primary Examiner(s): Hong; Harry S
• Application Number:
  US12/215,026
• Publication Number:
  US 20080267375A1
• Time in Patent Office: 407 Days
• Field of Search: 379/111, 37911201-1121, 37911401-11429, 37911501-11503, 379/188, 379/189, 379/192, 379/196, 379/197, 379/207.04
• US Class Current: 379/189
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks

Abstract

Real time detection of the fraudulent use of a telecommunications network is accomplished by analyzing data for each call that is occurring within the network. A signal protocol receiver is used to collect signaling protocol for each call that is occurring within the network. The signaling protocol data is collected, decoded and formatted into call information records (CIRs). The CIRs contain various operator specified parameters for each call that is occurring within the network. The CIRs are compared to operator defined thresholds. If any of the CIRs exceeds the thresholds, an alert is generated. The alerts are stored in a database where the operator can analyze them and take the appropriate corresponding action to resolve the alert. The alerts and the CIRs are archived in a database so that trends of fraudulent use can be detected and prevented. This method of fraud detection provides for the effective analysis of every call that is occurring within the network. Accordingly, no call goes unanalyzed and ideally no fraud goes undetected. Additionally, the method does not impose an additional load on the network switching equipment and therefore results in a better quality of transmissions.

Claims

1. A system for detecting fraudulent access to a telecommunications network comprising a plurality of switches, the system comprising:

a signal protocol receiver in data communication with one or more of the plurality of switches and operable to collect signaling protocol data at the one or more of the plurality of switches;

a decoder in data communication with the signal protocol receiver and operable to decode the signaling protocol data and produce call information records based on the signaling protocol data during the duration of the call; and

a processor in data communication with the decoder and operable to analyze the call information records during the duration of the call in order to detect fraudulent use of the telecommunications network.

2. The system of claim 1 wherein the processor comprises:

a pre-processor in data communication with the decoder and operable to classify the call information records; and

a watch point processor in data communication with the pre-processor and operable to compare the call information records to operator defined thresholds.

3. The system of claim 2 wherein the watch point processor is further operable to:

receive information defining a threshold for a parameter;

compare content of a call information record with the information defining the threshold; and

generate an alert when a threshold is satisfied or exceeded.

4. The system of claim 2 wherein the watch point processor is further operable to:

compare the call information records to one another on a singular or a group basis; and

generate an alert when fraudulent usage is detected.

5. The system of claim 2 wherein the processor further comprises:

a fraud analysis processor in data communication with the watch point processor and operable to store the alerts and the call information records in a database.

6. The system of claim 2 wherein the processor further comprises:

a fraud analysis processor in data communication with the watch point processor and operable to detect successive calls exceeding a threshold number and charged to a common customer.

7. The system of claim 2 wherein the processor further comprises:

a fraud analysis processor in data communication with the watch point processor and operable to detect calls with durations exceeding a long threshold and charged to a common customer.

8. The system of claim 1 wherein the signal protocol receiver is operable to collect both in-band signaling protocol data and our of band signaling protocol data.

9. Apparatus to detect a fraudulent telephone call in a telecommunications system, the apparatus comprising:

means for collecting signaling protocol data for a telephone call that is independent from a switch of the telecommunications system;

means for correlating the signaling protocol data into a call information record during the duration of the telephone call; and

means for determining that the telephone call is fraudulent during the duration of the call by analyzing the call information record.

10. The apparatus of claim 9 further comprising means for canceling the call in response to determining that the telephone call is fraudulent.

11. The apparatus of claim 9 further comprising means for generating an alert in response to determining that the telephone call is fraudulent.

12. The apparatus of claim 11 wherein the means for generating the alert comprises means for generating an audio notification, means for generating a visual notification, or means for generating a remote notification.

13. The apparatus of claim 11 further comprising:

means for storing the alert for a predetermined period of time.

14. The apparatus of claim 9 further comprising:

means for storing the call information record for a predetermined period of time.

15. The apparatus of claim 9 wherein the means fur correlating the signaling protocol data into a call information record comprises:

means for forming the call information record with at least one of the following parameters;

originating telephone number, terminating telephone number, billing type, using duration, aggregate duration, and call volume.

16. The apparatus of claim 9 wherein means fur determining that the telephone call is fraudulent comprises means for comparing the call information record to a pre-established threshold.

17. The apparatus of claim 9 wherein the means for determining that the telephone call is fraudulent comprises mean for comparing the call information record to another call information record.

18. The apparatus of claim 9 wherein the means for collecting signaling protocol data comprises means for collecting in-band signaling protocol data from the switch.

19. The apparatus of claim 9 wherein the means for collecting signaling protocol data further comprises means for collecting out-of-band signaling protocol data from at least one signal transfer point within the telecommunications network.