Systems and methods for detecting call provenance from call audio

• US 9,516,497 B2
• Filed: 05/18/2015
• Issued: 12/06/2016
• Est. Priority Date: 06/29/2010
• Status: Active Grant

• Current Assignee: Georgia Tech Research Corporation (University System of Georgia)
• Original Assignee: Georgia Tech Research Corporation (University System of Georgia)
• Inventors: Balasubramaniyan, Vijay, Ahamad, Mustaque, Traynor, Patrick Gerard, Hunter, Michael Thomas, Poonawalla, Aamir
• Primary Examiner(s): Gelin, Jean
• Application Number:
  US14/715,549
• Publication Number:
  US 20150257001A1
• Time in Patent Office: 568 Days
• Field of Search: 455/403, 455/410, 455/411, 455/412.1, 455/450, 455/451
• US Class Current: 1/1
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 65/1076 Screening of IP real time communications, e.g. spam over Internet telephony [SPIT]
• CPC Class Codes: H04M 1/68 Circuit arrangements for preventing eavesdropping
• CPC Class Codes: H04M 2203/558 Databases
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2203/6045 Identity confirmation
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 12/79 Radio fingerprint
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

Various embodiments of the invention are detection systems and methods for detecting call provenance based on call audio. An exemplary embodiment of the detection system can comprise a characterization unit, a labeling unit, and an identification unit. The characterization unit can extract various characteristics of networks through which a call traversed, based on call audio. The labeling unit can be trained on prior call data and can identify one or more codecs used to encode the call, based on the call audio. The identification unit can utilize the characteristics of traversed networks and the identified codecs, and based on this information, the identification unit can provide a provenance fingerprint for the call. Based on the call provenance fingerprint, the detection system can identify, verify, or provide forensic information about a call audio source.

Claims

1. A method comprising:

receiving, at a computing device, for a first call, placed from a first party at a first communications device, to an intended second party at an address associated with a second communications device, data representing call audio received at the first communications device during the first call;

determining, by the computing device, based on the data representing the call audio received at the first communications device, a first provenance fingerprint indicative of one or more communications devices participating in the first call with the first communications device;

determining, by the computing device, based on the first provenance fingerprint, that a third communications device is likely participating in the first call from the first party at the first communications device, the third communications device being a different communications device from the first and second communication devices; and

responsive to the determining that the third communications device is likely participating in the first call, outputting an indication that a different communications device from the first and second communications devices is likely participating in the first call.

2. The method of claim 1, wherein the determining that the third communications device is likely participating in the first call comprises determining that the first provenance fingerprint does not match a previous provenance fingerprint associated with the second communications device.

3. The method of claim 2, wherein the previous provenance fingerprint is determined based on call audio from a previous call to the address associated with the second communications device.

4. The method of claim 1, further comprising determining, by the computing device, based on the first provenance fingerprint, that the second communications device is likely not participating in the first call.

5. The method of claim 1, wherein the indication that a different communications device from the first and second communications devices is likely participating in the first call is output for presentation to the first party.

6. The method of claim 1, wherein the indication that a different communications device from the first and second communications devices is likely participating in the first call is output for presentation to the second party.

7. The method of claim 1, wherein the indication that a different communications device from the first and second communications devices is likely participating in the first call is output during the first call.

8. The method of claim 1, wherein the indication that a different communications device from the first and second communications devices is likely participating in the first call comprises a risk score associated with the first call.

9. The method of claim 1, wherein the first party and second party are a financial institution and a client of the financial institution.

10. The method of claim 1, wherein the first call is conducted as part of an authentication scheme.

11. The method of claim 1, wherein the first call is conducted to gain authorization for a financial transaction.

12. The method of claim 1, wherein the determining of the first provenance fingerprint is based on analyzing one or more of a noise profile, packet loss characteristics, and speaker-independent artifacts associated with the call audio received at the first communications device during the first call.

13. The method of claim 1, wherein the determining that the third communications device is likely participating in the first call is absent consideration of call metadata received at the first communications device with the first call.

14. A method comprising:

receiving, at a computing device, for a first call, placed from a first party at a first communications device, to an intended second party at an address associated with a second communications device, data representing call audio received at the first communications device during the first call;

determining, by the computing device, based on the data representing the call audio received at the first communications device, a first provenance fingerprint indicative of one or more communications devices participating in the first call with the first communications device;

determining, by the computing device, based on the first provenance fingerprint, that a third communications device is unlikely to be participating in the first call from the first party at the first communications device, the third communications device being a different communications device from the first and second communication devices; and

responsive to the determining that the third communications device is unlikely to be participating in the first call, outputting an indication that a different communications device from the first and second communications devices is unlikely to be participating in the first call.

15. A method comprising:

receiving, at a computing device, for a first call, between a first communications device and a second communications device, data representing call audio received at the first communications device during the first call, wherein the first call is associated with an expected network path between the first and second communication devices;

determining, by the computing device, based on the data representing the call audio received at the first communications device, a first provenance fingerprint indicative of one or more networks traversed by the first call;

determining, by the computing device, based on the first provenance fingerprint, that an unexpected network path is likely being traversed by the first call, the unexpected network path comprising a different sequence of networks from the expected network path; and

responsive to the determining that the unexpected communications network path is likely being traversed by the first call, outputting an indication that a different network path from the expected network path is likely being traversed by the first call.

16. The method of claim 15, wherein the determining that the unexpected network path is likely being traversed by the first call comprises determining that the first provenance fingerprint does not match a previous provenance fingerprint associated with the expected network path.

17. The method of claim 16, wherein the previous provenance fingerprint is determined based on call audio from a previous call between the first communications device and the second communications device over the expected network path.

18. The method of claim 15, wherein the determining that the unexpected network path is likely being traversed by the first call comprises determining that a type of network not in the expected network path is being traversed by the first call.

19. The method of claim 18, wherein the type of network not in the expected network path is a voice-over-IP network.

20. The method of claim 18, wherein the type of network not in the expected network path is a cellular network.

21. The method of claim 18, wherein the type of network not in the expected network path is a PSTN network.

22. The method of claim 15, wherein the expected network path is associated with a communications provider, and wherein the indication that a different network path is likely being traversed by the first call is output for presentation to the communications provider.

23. The method of claim 15, wherein the indication that a different network path is likely being traversed by the first call is output during the first call.

24. The method of claim 15, wherein the indication that a different network path is likely being traversed by the first call comprises a risk score associated with the first call.

25. The method of claim 15, wherein the first party and second party are a financial institution and a client of the financial institution.

26. The method of claim 15, wherein the first call is conducted as part of an authentication scheme.

27. The method of claim 15, wherein the first call is conducted to gain authorization for a financial transaction.

28. The method of claim 15, wherein the determining of first provenance fingerprint is based on analyzing one or more of a noise profile, packet loss characteristics, and speaker-independent artifacts associated with the call audio received at the first communications device during the first call.

29. The method of claim 15, wherein the determining that the unexpected communications network path is likely being traversed by the first call is absent consideration of call metadata received at the first communications device with the first call.

30. A method comprising:

receiving, at a computing device, for a first call, between a first communications device and a second communications device, data representing call audio received at the first communications device during the first call, wherein the first call is associated with an expected network path between the first and second communication devices;

determining, by the computing device, based on the data representing the call audio received at the first communications device, a first provenance fingerprint indicative of one or more networks traversed by the first call;

determining, by the computing device, based on the first provenance fingerprint, that one or more networks in the expected network path are likely being traversed by the first call; and

responsive to the determining that one or more networks in the expected network path are likely being traversed, outputting an indication that the expected network path is likely being traversed by the first call.