Location fraud detection

• US 9,635,504 B2
• Filed: 04/17/2015
• Issued: 04/25/2017
• Est. Priority Date: 04/17/2015
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Pamarthy, Kalyan, Das, Santanu, Kudrimoti, Abhijit, Aon, Projit
• Primary Examiner(s): Cumming, William D
• Application Number:
  US14/690,084
• Publication Number:
  US 20160309296A1
• Time in Patent Office: 739 Days
• Field of Search: 379 16, 4554561
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A method includes receiving, at a fraud management device, at least one BSID associated with communication data from at least one MTC device. The fraud management device determines a location associated with the at least one BSID. Relevant data elements are selected from the communication data. The fraud management device applies known domain rules to the communication data and identifies a connectivity pattern for the at least one MTC device based on the communication data. An anomaly detection model is applied to particular communication data associated with a particular MTC device based on the connectivity pattern, and at least one anomaly from the identified connection pattern is detected based on the anomaly detection model.

Claims

1. A computer-implemented method comprising:

receiving, at a fraud management device, at least one base station identifier (BSID) associated with communication data from at least one machine type communication (MTC) device;

determining a location associated with the at least one BSID;

selecting data elements from the communication data;

applying known domain rules to the communication data;

identifying a connectivity pattern for the at least one MTC device based on the communication data;

applying an anomaly detection model to particular communication data associated with a particular MTC device based on the connectivity pattern; and

detecting at least one anomaly from the identified connectivity pattern based on the anomaly detection model.

2. The computer-implemented method of claim 1, further comprising:

providing, to at least one device associated with a supervisor associated with the at least one MTC device, an alert indicating that probable location fraud is detected.

3. The computer-implemented method of claim 1, wherein applying the known domain rules to the communication data further comprises applying a rule based on at least one of a number of base stations, a frequency of connection to base stations, and a length of time of communication at the base station.

4. The computer-implemented method of claim 1, wherein identifying the connectivity pattern further comprises:

applying at least one filter and at least one normalization process to the communication data.

5. The computer-implemented method of claim 1, wherein applying the anomaly detection model further comprises:

applying at least one of statistical, clustering, or time series analysis to the particular communication data.

6. The computer-implemented method of claim 1, further comprising:

mitigating probable location fraud based on the detected at least one anomaly.

7. The computer-implemented method of claim 1, wherein detecting the at least one anomaly from the identified connectivity pattern further comprises:

detecting a historical pattern of location fraud.

8. The computer-implemented method of claim 1, further comprising:

providing a graphical user interface (GUI) for managing location fraud associated with the particular MTC device, wherein the GUI includes one or more of alarms, analytics, and mitigation tools associated with location fraud for the particular MTC device.

9. The computer-implemented method of claim 1, wherein the MTC device includes one of a device for industrial automation, logistics, retail, Smart Grid, Smart Cities, health, or defense.

10. The computer-implemented method of claim 1, wherein determining the location associated with the at least one BSID further comprises:

receiving a signal strength associated with the BSID and the particular MTC device;

receiving a location almanac for a plurality of base stations that includes the at least one BSID; and

determining a location of the MTC device based on the signal strength and the location associated with the at least one BSID.

11. The computer-implemented method of claim 1, further comprising:

monitoring the particular MTC device based on detected location fraud.

12. A device, comprising:

a memory to store a plurality of instructions; and

a processor configured to execute instructions in the memory to;

receive at least one base station identifier (BSID) associated with communication data from at least one machine type communication (MTC) device;

determine a location associated with the at least one BSID;

select data elements from the communication data;

apply known domain rules to the communication data;

identify a connectivity pattern for the at least one MTC device based on the communication data;

apply an anomaly detection model to particular communication data associated with a particular MTC device based on the connectivity pattern; and

detect at least one anomaly from the identified connectivity pattern based on the anomaly detection model.

13. The device of claim 12, wherein the processor is further configured to:

provide, to at least one device associated with a supervisor associated with the at least one MTC device, an instruction to issue an alert that probable location fraud is detected.

14. The device of claim 12, wherein, when applying the known domain rules to the communication data, the processor is further configured to:

apply a rule based on at least one of a number of base stations, a frequency of connection to base stations, and a length of time of communication at the base station.

15. The device of claim 12, wherein, when identifying the connectivity pattern, the processor is further configured to:

apply at least one filter and at least one normalization process to the communication data.

16. The device of claim 12, wherein, when applying the anomaly detection model, the processor is further configured to:

apply at least one of statistical, clustering, or time series analysis to the particular communication data.

17. The device of claim 12, wherein the processor is further configured to:

mitigate probable location fraud based on the detected at least one anomaly.

18. The device of claim 12, wherein the processor is further configured to:

provide an instruction to output a graphical user interface (GUI) for managing location fraud associated with the particular MTC device, wherein the GUI includes one or more of alarms, analytics, and mitigation tools associated with location fraud for the particular MTC device.

19. A non-transitory computer-readable medium including instructions to be executed by a processor, the instructions including one or more instructions, when executed by the processor, for causing the processor to:

receive at least one base station identifier (BSID) associated with communication data from at least one machine type communication (MTC) device;

determine a location associated with the at least one BSID;

select data elements from the communication data;

apply known domain rules to the communication data;

identify a connectivity pattern for the at least one MTC device based on the communication data;

apply an anomaly detection model to particular communication data associated with a particular MTC device based on the connectivity pattern; and

detect at least one anomaly from the identified connectivity pattern based on the anomaly detection model.

20. The non-transitory computer-readable medium of claim 19, wherein the one or more instructions further include instructions to:

provide an instruction to output a graphical user interface (GUI) for managing location fraud associated with the particular MTC device, wherein the GUI includes one or more of alarms, analytics, and mitigation tools associated with location fraud for the particular MTC device.