Systems, methods, and media for generating hierarchical fused risk scores

• US 8,903,859 B2
• Filed: 03/08/2012
• Issued: 12/02/2014
• Est. Priority Date: 04/21/2005
• Status: Active Grant

• Current Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Original Assignee: Verint Americas Incorporated (Verint Systems Incorporated)
• Inventors: Zeppenfeld, Torsten, Mirghafori, N. Nikki, Guerra, Lisa, Gutierrez, Richard, Rajakumar, Anthony
• Primary Examiner(s): Nguyen, Duc
• Assistant Examiner(s): Laekemariam, Yosef K
• Application Number:
  US13/415,816
• Publication Number:
  US 20120254243A1
• Time in Patent Office: 999 Days
• Field of Search: 379/88.02, 379/114.14, 379/144.03, 379/145, 379/189, 705/38, 707/778, 707/776, 707/780, 707/E17.041, 707/E17.102
• US Class Current: 707/780
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G10L 17/00 Speaker identification or verification techniques
• CPC Class Codes: G10L 17/02 Preprocessing operations, e.g. segment selection; Pattern representation or modelling, e.g. based on linear discriminant analysis [LDA] or principal components; Feature selection or extraction
• CPC Class Codes: G10L 17/04 Training, enrolment or model building
• CPC Class Codes: G10L 17/06 Decision making techniques; Pattern matching strategies
• CPC Class Codes: G10L 17/26 Recognition of special voice characteristics, e.g. for use in lie detectors; Recognition of animal voices
• CPC Class Codes: G10L 25/48 specially adapted for particular use
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2201/18 Comparators
• CPC Class Codes: H04M 2201/41 using speaker recognition speaker recognition per se G10L17/00
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2203/6054 Biometric subscriber identification
• CPC Class Codes: H04M 3/436 Arrangements for screening incoming calls , i.e. evaluating the characteristics of a call before deciding whether to answer it based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

Systems, methods, and media for generating fused risk scores for determining fraud in call data are provided herein. Some exemplary methods include generating a fused risk score used to determine fraud from call data by generating a fused risk score for a leg of call data, via a fuser module of an analysis system, the fused risk score being generated by fusing together two or more uniquely calculated fraud risk scores, each of the uniquely calculated fraud risk scores being generated by a sub-module of the analysis system; and storing the fused risk score in a storage device that is communicatively couplable with the fuser module.

Claims

1. A method for generating a fused risk score used to determine a likelihood of fraud from call data, the method comprising:

receiving a first leg of call data;

generating a first audio component match score for the first leg of the call data based on a comparison of audio data in the first leg with a first voice model in a fraudster database using a first component of a first sub-module;

generating a first non-audio component match score for the first leg of the call data based on a comparison of non-audio data in the first leg with a first non-audio data in the fraudster database using a second component of the first sub-module;

fusing together the first audio component match score and the first nonaudio component match score using a first fuser component to generate a first fused component match score;

determining the fused risk score based on the first fused component matchscore using a risk score fuser module;

determining the likelihood of fraud from the fused risk score;

fusing together the first sub-module match score and a second sub-module match score using a first fuser sub-module to generate a first module risk score for the first leg of the call data; and

receiving a second leg of call data and fusing together the first module risk score and a second module risk score from the second leg of the call data using the risk score fuser module to generate a call fused risk score.

2. The method according to claim 1, further comprising:

generating a second audio component match score for the first leg of the call data based on a comparison of the audio data in the first leg with a second voice model in the fraudster database using the first component of a first sub-module;

generating a second non-audio component match score for the first leg of the call data based on a comparison of the non-audio data in the first leg with a second non-audio data in the fraudster database using the second component of the first sub-module; and

fusing together the second audio component match score and the second non-audio component match score using the first fuser component to generate a second fused component match score.

3. The method according to claim 2, further comprising fusing together the first fused component match score and the second fused component match score using the first fuser component to generate a first sub-module match score.

4. The method according to claim 3, wherein fusing together the first fused component match score and the second fused component match score comprises selecting the maximum value.

5. The method according to claim 1, wherein fusing together the first submodule match score and the second sub-module match score comprises calculating a weighted sum including the first sub-module match score and the second sub-module match score.

6. The method according to claim 1, wherein fusing together the first audio component match score and the first non-audio component match score comprises calculating a weighted average value.

7. The method according to claim 1, further comprising comparing the fused risk score to a threshold value and generating a likelihood of fraud based upon the comparison.

8. The method according to claim 7, further comprising fusing together each of the fused risk scores for each leg to generate a fused risk score for the call data.

9. The method according to claim 1, further comprising comparing the fused risk score to a threshold value and generating an output based upon the comparison.

10. The method according to claim 9, wherein the output comprises any of an alert message, a reason code, the fused risk score, one or more uniquely calculated fraud risk scores generated by one or more sub-modules, one or more legs of call data, a diarization score, and combinations thereof.

11. A system for generating a fused risk score from call data, the system comprising:

a memory for storing executable instructions;

a processor for executing the instructions;

a first blacklist sub-module configured to receive a first leg of call data, the first blacklist sub-module including;

a voice data component configured to generate a blacklist voice match score based on a comparison of voice call data and a speaker model in a fraudster database;

a non-audio data component configured to generate a blacklist nonaudio match score based on a comparison of non-audio call data and a fraudster non-audio model in the fraudster database, the fraudster non-audio model related to the fraudster speaker model;

a blacklist fuser component communicatively coupled to the voice data component and the non-audio data component and configured to fuse the blacklist voice match score and the

blacklist non-audio match score and output a blacklist match score;

a first whitelist sub-module configured to receive the first leg of the call data, the first whitelist sub-module including;

a voice data component configured to generate a whitelist voice match score based on a comparison of voice call data and a speaker model in a whitelist database;

a non-audio data component configured to generate a whitelist non-audio match score based on a comparison of non-audio call data and a whitelist non-audio model in a whitelist database the whitelist non-audio model related to the whitelist speaker model;

a whitelist fuser component communicatively coupled to the voice data component and the non-audio data component and configured to fuse the whitelist voice match score and the whitelist non-audio match score and output a whitelist match score;

a first fuser sub-module configured to fuse the blacklist match score and whitelist match score for the first leg of the call data and generate a first leg risk score;

a second blacklist sub-module configured to receive a second leg of call data, the second blacklist sub-module including;

a voice data component configured to generate a blacklist voice match score based on a comparison of voice call data and a speaker model in the fraudster database;

a non-audio data component configured to generate a blacklist nonaudio match score based on a comparison of non-audio call data and fraudster non-audio model in the fraudster database, the fraudster non-audio model related to the fraudster speaker model;

a blacklist fuser component communicatively coupled to the voice data component and the non-audio data component and configured to fuse the blacklist voice match score and the blacklist non-audio match score and output a blacklist match score;

a second whitelist sub-module configured to receive the second leg of the call data, the second whitelist sub-module including;

a voice data component configured to generate a whitelist voice match score based on a comparison of voice call data and a speaker model in a whitelist database;

a non-audio data component configured to generate a non-audio match score based on a comparison of non-audio call data and a whitelist non-audio model in a whitelist database the whitelist non-audio model related to the whitelist speaker model;

a whitelist fuser component communicatively coupled to the voice data component and the non-audio data component and configured to fuse the whitelist voice match score and the whitelist non-audio match score and output a whitelist match score;

a second fuser sub-module configured to fuse the blacklist match score and whitelist match score for the second leg of the call data and generate a second leg risk score; and

a risk score fuser module configured to fuse the first leg risk score and the second leg risk score.

12. The system according to claim 11, further comprising a general fraud submodule configured to compare the call data to speaker agnostic fraud data and generate a general fraud match score based upon the comparison.

13. The system according to claim 11, wherein the blacklist voice match score is an array.

14. The system according to claim 11, wherein the blacklist non-audio match score is an array.

15. The system according to claim 11, further comprising a diarization module configured to separate the first leg of call data and the second leg of call data.

16. The system according to claim 11, further comprising;

a first general fraud sub-module including;

a call duration component configured to compare a duration of the first leg of call data to a model of call durations associated with fraudsters and generate a call duration match score based upon the comparison;

a call queue component configured to compare the first leg of call data to a model of call queue behavior associated with fraudsters and generate a call queue match score based upon the comparison; and

a general fraud fuser component configured to fuse the call duration match score and the call queue match score and generate the first leg general fraud risk score, the first fuser sub-module further configured to fuse the first leg general fraud; and

a second general fraud sub-module including;

a call duration component configured to compare a duration of the second leg of call data to a model of call duration behavior associated with fraud and generate a call duration match score based upon the comparison;

a call queue component configured to compare the second leg of call data to a model of call queue behavior associated with fraud and generate a call queue match score based upon the comparison; and

a general fraud fuser component configured to fuse the call duration match score and the call queue match score and generate the second leg general fraud risk score, the second fuser module further configured to fuse the second leg general fraud.

17. The system according to claim 11, further comprising a first general fraud sub-module including:

a call duration component configured to compare a duration of the first leg of call data to a model of call durations associated with fraudsters and generate a call duration match score based upon the comparison;

a call queue component configured to compare the first leg of call data to a model of call queue behavior associated with fraudsters and generate a call queue match score based upon the comparison; and

a general fraud fuser component configured to fuse the call duration match score and the call queue match score and generate the first leg general fraud risk score, the first fuser module further configured to fuse the first leg general fraud.

18. The system according to claim 11, further comprising a risk score analysis module that compares the fused risk score to a threshold value and generates an output based upon the comparison.

19. The system according to claim 18, wherein the output comprises any of an alert message, a reason code, the fused risk score, one or more uniquely calculated fraud risk scores generated by one or more sub-modules, the leg of call data, a diarization score, and combinations thereof.