Determining usage predictions and detecting anomalous user activity through traffic patterns

• US 8,582,457 B2
• Filed: 07/14/2010
• Issued: 11/12/2013
• Est. Priority Date: 07/17/2009
• Status: Active Grant

• Current Assignee: Tangoe Canada Incorporated (Tangoe Incorporated)
• Original Assignee: Tangoe Canada Incorporated (Tangoe Incorporated)
• Inventors: Leemet, Jaan, Rudich, Daniel
• Primary Examiner(s): EBRAHIM, ANEZ C
• Application Number:
  US12/836,094
• Publication Number:
  US 20110019566A1
• Time in Patent Office: 1,217 Days
• Field of Search: None
• US Class Current: 370/252
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 12/1485 Tariff-related aspects
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04W 4/24 Accounting or billing

Abstract

The present invention concerns a system for selecting and monitoring data plans for telecommunications systems, and methods of determining, learning and estimating usage patterns in-order to predict usage and tie this to cost and the overlaying of plan selection for cost optimization. Further, additional methods are applied to determine anomalous user behaviors and raise security and data leakage related events.

Claims

1. A method of detecting anomalies in the data traffic of a mobile device, comprising the steps of:

collecting at a server and from the mobile device, data traffic statistics for a given time period;

comparing the data traffic statistics against threshold values;

if a statistic of the data traffic statistic exceeds a corresponding threshold of the threshold values, flagging an anomaly;

updating the threshold values based on a running average of each statistic of the data traffic statistics based on formula I,

2. The method of claim 1, wherein the collecting step comprises:

reading, at a first interval, data traffic statistics from a network interface on the mobile device;

adding the data traffic statistics to running totals on the mobile device.

3. The method of claim 1, wherein the given time period corresponds to a data plan period.

4. The method of claim 2, wherein the collecting step further comprises:

when the running totals exceed a delivery threshold,

sending the running totals to the server; and

resetting the running totals.

5. The method of claim 1, wherein the collecting step further comprises:

when a delivery timer expires,

sending the running totals to the server; and

resetting the running totals.

6. The method of claim 1, wherein threshold values include a data size limit for the given time period.

7. The method of claim 1, wherein the mobile device is configured to identify office-related data traffic and non-office-related data traffic.

8. The method of claim 7, wherein threshold values include a data size limit for non-office data traffic.

9. The method of claim 7, wherein threshold values include a minimum time of day for office data traffic.

10. The method of claim 1, wherein threshold values include a maximum time of day for office data traffic.

11. The method of claim 1, further comprising the steps of:

extrapolating data traffic statistics to the end of the given time period;

if a statistic of the extrapolated data traffic statistics exceeds a corresponding threshold value of the threshold values, flagging an anomaly.

12. The method of claim 1, wherein Δ

_max is 10 and N is 12.

13. The method of claim 1, further comprising the steps of:

maintaining a list of every flagged anomaly, each anomaly being associated to a type of anomaly, a day of the week, and a week of the month;

if the list of every flagged anomaly includes more than a threshold of known anomalies, wherein known anomalies have the same of at least one of the type of anomaly, the day of the week and the week of the month,

preventing known anomalies from being flagged.

14. The method of claim 1, wherein the collecting step comprises the step of:

sending, from the mobile device, at least one of a machine name, a user name, and a mobile device identifier.