Determining usage predictions and detecting anomalous user activity through traffic patterns

• US 9,467,572 B2
• Filed: 05/05/2015
• Issued: 10/11/2016
• Est. Priority Date: 07/17/2009
• Status: Active Grant

• Current Assignee: Tangoe Canada Incorporated (Tangoe Incorporated)
• Original Assignee: Tangoe Canada Incorporated (Tangoe Incorporated)
• Inventors: Leemet, Jaan, Rudich, Daniel
• Primary Examiner(s): EBRAHIM, ANEZ C
• Application Number:
  US14/704,547
• Publication Number:
  US 20150237215A1
• Time in Patent Office: 525 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 12/1485 Tariff-related aspects
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04W 4/24 Accounting or billing

Abstract

A system for selecting and monitoring data plans for telecommunications systems, and methods of determining, learning and estimating usage patterns in-order to predict usage and tie this to cost and the overlaying of plan selection for cost optimization. Further, additional methods are applied to determine anomalous user behaviors and raise security and data leakage related events.

Claims

1. A method of using a computer to detect data traffic of a mobile device, the computer performing the steps of:

collecting usage data from the mobile device for a time period;

setting threshold values based on a mobile device data plan and an amount of data used by the mobile device within the time period and on historical usage data of the mobile device;

comparing the usage data against the threshold values;

identifying an anomaly if a statistic of the usage data exceeds a corresponding threshold of the threshold values;

generating a graphical user interface including at least one statistic of the usage data;

overlaying at least one statistic of the existing usage data or predicted data or both onto the at least one statistic of the usage data;

updating the threshold values based on a running average of each statistic of the usage data.

2. The method of claim 1, wherein the weighting afforded the historical usage data is related to the amount of stored history.

3. The method of claim 1, wherein the weighting afforded the historical usage data increases as the amount of stored history increases up to a maximum weighted percentage for the historical usage data.

4. The method of claim 1, wherein the time period corresponds to a data plan period.

5. The method of claim 1, wherein the collecting step comprises:

reading, at a first interval, data traffic statistics from a network interface on the mobile device;

adding the data traffic statistics to running totals on the mobile device.

6. The method of claim 5, wherein the collecting step further comprises:

when the running totals exceed a delivery threshold,

sending the running totals to the server; and

adjusting the running totals.

7. The method of claim 1, wherein the collecting step further comprises:

when a delivery timer expires,

sending the running totals to the server; and

adjusting the running totals.

8. The method of claim 1, wherein threshold values include a data limit for the given time period.

9. The method of claim 1, the computer further performing the steps of:

extrapolating data traffic statistics to the end of the given time period;

if a statistic of the extrapolated data traffic statistics exceeds a corresponding threshold value of the threshold values, flagging an anomaly.

10. A method of using a computer to detect data traffic of a mobile device, the computer performing the steps of:

collecting from the mobile device, usage data relating to data usage for the mobile device for a given time period;

setting threshold values based at least in part on a mobile device data plan and an amount of data used by the mobile device within a set time period;

comparing the usage data against the threshold values;

identifying a statistic of the usage data exceeding a corresponding threshold of the threshold values;

generating report based on the identified statistic wherein the report includes a comparison between historical usage data associated with a second given time period to the usage data, the second given time period prior to the given time period;

presenting the report on a Graphical User Interface (GUI) so that a user of the mobile device can assess changes in their data usage in order to avoid overages; and

updating the threshold values based on a running average of each statistic of the usage data.

11. The method of claim 10 wherein the threshold values are further set based on historical usage data of the mobile device, where weighting afforded the historical usage data in comparison to the amount of data used by the mobile device within the set time period is related to the amount of stored history.

12. The method of claim 11, wherein the weighting afforded the historical usage data increases as the amount of stored history increases up to a maximum weighted percentage for the historical usage data.

13. The method of claim 10 wherein the identified statistic is average data usage for the mobile device over more than one set time period.

14. The method of claim 10, wherein the updating of the threshold values is based on formula I,

15. The method of claim 10, wherein the given time period corresponds to a data plan period.

16. The method of claim 10, wherein the collecting step comprises:

reading, at a first interval, data traffic statistics from a network interface on the mobile device;

adding the data traffic statistics to running totals on the mobile device.

17. The method of claim 16, wherein the collecting step further comprises:

when a delivery timer expires,

sending running totals of data usage to a server wherein the collecting step is performed at the server; and

adjusting the running totals.

18. The method of claim 10, wherein the collecting step further comprises:

when a delivery timer expires,

sending the running totals to the server; and

adjusting the running totals.

19. The method of claim 10, wherein threshold values include a data limit for the given time period.

20. The method of claim 10, the computer further performing the steps of:

extrapolating data traffic statistics to the end of the given time period;

if a statistic of the extrapolated data traffic statistics exceeds a corresponding threshold value of the threshold values, flagging an anomaly and presenting the anomaly on the Graphical User Interface (GUI).