Abnormality detecting apparatus for communication terminal and abnormality detecting method for communication terminal

• US 8,521,132 B2
• Filed: 07/13/2010
• Issued: 08/27/2013
• Est. Priority Date: 07/15/2009
• Status: Expired due to Fees

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Washio, Nobuyuki
• Primary Examiner(s): SIVJI, NIZAR N
• Application Number:
  US12/835,222
• Publication Number:
  US 20110016363A1
• Time in Patent Office: 1,141 Days
• Field of Search: 379/37, 379/45, 379/102, 379/106, 455/404.1, 455/410, 455/411, 345/173, 714/57
• US Class Current: 455/411
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks

Abstract

An abnormality detection apparatus for communication terminal that detects an abnormality based on terminal information regarding operations and callings on the communication terminal, and an abnormality detection method are provided to prevent frauds using communication terminals such as a telephone set. A abnormality detection apparatus for communication terminal, including: a pattern model storage unit configured to store behavior pattern models as a probabilistic model of transition relations of events relevant to operations and calls on a communication terminal; a terminal information obtaining unit configured to detect terminal information about the operations and the calls on the communication terminal; a pattern determination unit configured to determine whether or not a current behavior pattern is a normal behavior pattern by comparing the terminal information detected by the terminal information obtaining unit with the behavior pattern models stored in the pattern model storage unit; and a warning generation unit configured to output predetermined warning information when the pattern determination unit determines that the terminal information detected by the terminal information obtaining unit is not within a normal behavior pattern.

Claims

1. An abnormality detection apparatus for communication terminal, comprising:

a pattern model storage unit configured to store behavior pattern models as a probabilistic model of transition relations of events relevant to operations and calls on a communication terminal, the behavior pattern models include a normal behavior pattern model that represents normal behavior of a user, and an abnormal behavior pattern model that is constructed with events extracted from the normal behavior pattern as factors of a higher degree of abnormality;

a terminal information obtaining unit configured to detect terminal information about the operations and the calls on the communication terminal;

a pattern determination unit configured to determine whether or not a current behavior pattern is a normal behavior pattern by comparing the terminal information detected by the terminal information obtaining unit with the behavior pattern models stored in the pattern model storage unit, wherein the abnormal behavior pattern model is used when the communication terminal is engaged with a call; and

a warning generation unit configured to output predetermined warning information to the communication terminal when the pattern determination unit determines that the terminal information detected by the terminal information obtaining unit is not within a normal behavior pattern.

2. The abnormality detection apparatus for communication terminal according to claim 1, wherein the behavior pattern models stored in the pattern model storage unit are represented by probabilistic automata with event occurrence probabilities, and

wherein the pattern determination unit calculates a degree of abnormality of the current behavior pattern based on a cumulative probability that is a product of occurrence probabilities of the events in a behavior pattern model to which the current behavior pattern is applied.

3. The abnormality detection apparatus for communication terminal according to claim 1, wherein the terminal information obtaining unit obtains one or a plurality of pieces of information as the terminal information, the information including a start time of a call, an end time of a call, a time length of a call, a ratio between speaking times on the recipient side and the source side, an operation history of an address book, locational information of the terminal, a keyword detected from voice data.

4. The abnormality detection apparatus for communication terminal according to claim 1, further comprising:

a pattern update unit configured to update an event occurrence probability of each of the behavior pattern models based on the terminal information detected by the terminal information obtaining unit.

5. The abnormality detection apparatus for communication terminal according to claim 4, wherein the pattern update unit updates the behavior pattern models stored in the pattern model storage unit based on behavior patterns collected at a plurality of communication terminals, behavior patterns collected through survey, or behavior patterns collected by global pattern collector that collects behavior pattern models.

6. The abnormality detection apparatus for communication terminal according to claim 1, wherein the warning generation unit outputs the warning information to at least one of predetermined destinations that are registered in a predetermined storage area in the communication terminal.

7. The abnormality detection apparatus for communication terminal according to claim 6, wherein the warning generation unit superimposes the warning information to voice data of a current call on the communication terminal.

9. The abnormality detection apparatus for communication terminal according to claim 7, wherein the terminal information obtaining unit stores the terminal information in a predetermined storage area while the communication terminal is engaged with a call, and when the communication terminal is disengaged from the call, the pattern determination unit make a determination on the behavior pattern based on the terminal information stored in the predetermined storage area.

8. An abnormality detection method for communication terminal for causing a computer and a cell-phone to function as an abnormality detection apparatus, the method comprising:

storing behavior pattern models as a probabilistic model of transition relations of events relevant to operations and calls on a communication terminal into a predetermined storage area, the behavior pattern models include a normal behavior pattern model that represents normal behavior of a user, and an abnormal behavior pattern model that is constructed with events extracted from the normal behavior pattern as factors of a higher degree of abnormality;

detecting terminal information about the operations and the calls on the communication terminal;

determining whether or not a current behavior pattern is a normal behavior pattern by comparing the detected terminal information with the behavior pattern models stored in the storage area, wherein the abnormal behavior pattern model is used when the communication terminal is engaged with a call; and

outputting warning information to the communication terminal when the terminal information is not within a normal behavior pattern.

10. The abnormality detection method for communication terminal according to claim 8, wherein the warning information is superimposed to voice data of a current call on the communication terminal.

11. The abnormality detection method for communication terminal according to claim 8, wherein the determination whether or not a current behavior pattern is a normal behavior pattern is made only based on an abnormal behavior pattern model when the communication terminal is engaged with a call.