Method and system for preventing illicit use of a telephony platform

• US 9,614,972 B2
• Filed: 01/13/2016
• Issued: 04/04/2017
• Est. Priority Date: 07/24/2012
• Status: Active Grant

• Current Assignee: Twilio, Inc.
• Original Assignee: Twilio, Inc.
• Inventors: Hagemann, III, Robert C., Ballai, Adam, Zarick, Daniel
• Primary Examiner(s): CAI, WAYNE HUU
• Application Number:
  US14/995,015
• Publication Number:
  US 20160134757A1
• Time in Patent Office: 447 Days
• Field of Search: 455405, 455406, 455411, 379189, 37912702, 705 1426, 705 1447, 705 2635
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A system and method for preventing illicit use of a telephony platform that includes enrolling a plurality of accounts on a telecommunications platform, wherein an account includes account configuration; at a fraud detection system of the telecommunications platform, receiving account usage data, wherein the usage data includes at least communication configuration data and billing configuration data of account configuration and further includes communication history of the plurality of accounts; calculating fraud scores of a set of fraud rules from the usage data, wherein at least a sub-set of the fraud rules include conditions of usage data patterns between at least two accounts; detecting when the fraud scores of an account satisfy a fraud threshold; and initiating an action response when a fraud score satisfies the fraud threshold.

Claims

1. A method comprising:

at a hardware fraud detection system;

responsive to sub-account usage data of at least one sub-account of a telecommunication platform, controlling the fraud detection system to calculate at least a first fraud score of a first sub-account from the sub-account usage data, the sub-account usage data including at least sub-account configuration data and communication history data, the first sub-account being managed by a first parent account in the telecommunication platform, wherein the sub-account usage data includes application media configuration of the first sub-account and application media configuration of a second sub-account, and wherein controlling the fraud detection system to calculate at least a first fraud score comprises determining whether the first sub-account uses application media files identical to media files used by at least the second sub-account;

responsive to a determination by the fraud detection system that at least the first fraud score of the first sub-account satisfies a fraud threshold, controlling the fraud detection system to provide an external service provider system of the first parent account with a notification of illicit behavior of the first sub-account, the fraud detection system providing the notification via the telecommunication platform,

wherein the first sub-account is a telecommunication platform account of an external system that uses a service of the external service provider system and a service of the telecommunication platform.

2. The method of claim 1, wherein illicit behavior includes at least one of toll fraud, spamming, terms of service violations, denial of service attacks, credit card fraud, suspicious behavior, and phishing attacks.

3. The method of claim 1, wherein determining whether the first sub-account uses application media files identical to media files used by at least the second sub-account comprises:

calculating fingerprints of media files encountered during a communication session; and

identifying corresponding media file fingerprints in the first sub-account and the second sub-account.

4. The method of claim 1, wherein the communication history data includes communication history data of the first sub-account.

5. The method of claim 1, wherein the communication history data includes communication history data of the second sub-account.

6. The method of claim 1, wherein the communication history data includes communication history data of the first sub-account and communication history data of the second sub-account.

7. A hardware fraud detection system comprising:

a fraud score calculator constructed to, responsive to sub-account usage data of at least one sub-account of a telecommunication platform, calculate at least a first fraud score of a first sub-account from the sub-account usage data, the sub-account usage data including at least sub-account configuration data and communication history data, the first sub-account being managed by a first parent account in the telecommunication platform;

a fraud score database constructed to store the first fraud score; and

a fraud rule set constructed to;

determine whether at least the first fraud score stored by the fraud score database satisfies a fraud threshold; and

responsive to a determination that at least the first fraud score of the first sub-account satisfies the fraud threshold, provide an external service provider system of the first parent account with a notification of illicit behavior of the first sub-account, the fraud rule set providing the notification via the telecommunication platform,

wherein the first sub-account is a telecommunication platform account of an external system that uses a service of the external service provider system and a service of the telecommunication platform,

wherein the sub-account configuration data includes configuration data of the first account and configuration data of a second sub-account,

wherein the sub-account usage data includes at least one of;

application media configuration of the first sub-account and application media configuration of the second sub-account,

application uniform resource identifiers (URIs) mapped to communication endpoints of the first sub-account and application URIs mapped to communication endpoints of the second sub-account, and

wherein in a case where the sub-account usage data includes application media configuration of the first sub-account and application media configuration of the second sub-account, the fraud score calculator is constructed to calculate at least the first fraud score of the first sub-account from the sub-account usage data by determining whether the first sub-account uses application media files identical to media files used by at least the second sub-account, and

wherein in a case where the sub-account usage data includes application URIs mapped to communication endpoints of the first sub-account and application URIs mapped to communication endpoints of the second sub-account, the fraud score calculator is constructed to calculate at least the first fraud score of the first sub-account from the sub-account usage data by determining whether corresponding application URIs are configured in at least the first sub-account and the second sub-account.

8. The system of claim 7, wherein illicit behavior includes at least one of toll fraud, spamming, terms of service violations, denial of service attacks, credit card fraud, suspicious behavior, and phishing attacks.

9. The system of claim 7, wherein determining whether the first sub-account uses application media files identical to media files used by at least the second sub-account comprises:

calculating fingerprints of media files encountered during a communication session; and

identifying corresponding media file fingerprints in the first sub-account and the second sub-account.

10. A method comprising:

at a hardware fraud detection system;

responsive to sub-account usage data of a plurality of sub-accounts of a telecommunication platform, controlling the fraud detection system to calculate a first fraud score of a first sub-account of the plurality of sub-accounts from the sub-account usage data,

the sub-account usage data of the plurality of sub-accounts including at least sub-account configuration data, a credit card number, and communication history data for each sub-account,

each sub-account of the plurality of sub-accounts being managed by a first parent account in the telecommunication platform,

wherein controlling the fraud detection system to calculate the first fraud score comprises determining a number of sub-accounts that share a same credit card number;

responsive to a determination by the fraud detection system that the determined number of sub-accounts that share a same credit card number satisfies a fraud threshold, controlling the fraud detection system to provide an external service provider system of the first parent account with a notification of illicit behavior of the first sub-account, the fraud detection system providing the notification via the telecommunication platform,

wherein the first sub-account is a telecommunication platform account of an external system that uses a service of the external service provider system and a service of the telecommunication platform.

11. The method of claim 10, wherein payment mechanism configuration of the first sub-account includes a credit card number for the first sub-account and payment mechanism configuration of the second sub-account includes a credit card number for the second sub-account.

12. A method comprising:

at a hardware fraud detection system;

responsive to sub-account usage data of at least one sub-account of a telecommunication platform, controlling the fraud detection system to calculate at least a first fraud score of a first sub-account from the sub-account usage data, the sub-account usage data including at least sub-account configuration data and communication history data, the first sub-account being managed by a first parent account in the telecommunication platform,

wherein the sub-account usage data includes application uniform resource identifiers (URIs) mapped to communication endpoints of the first sub-account and application URIs mapped to communication endpoints of a second sub-account, and

wherein controlling the fraud detection system to calculate at least a first fraud score comprises determining whether corresponding application URIs are configured in at least the first sub-account and the second sub-account;

responsive to a determination by the fraud detection system that at least the first fraud score of the first sub-account satisfies a fraud threshold, controlling the fraud detection system to provide an external service provider system of the first parent account with a notification of illicit behavior of the first sub-account, the fraud detection system providing the notification via the telecommunication platform,

wherein the first sub-account is a telecommunication platform account of an external system that uses a service of the external service provider system and a service of the telecommunication platform.