Call classification through analysis of DTMF events

• US 10,257,591 B2
• Filed: 05/19/2017
• Issued: 04/09/2019
• Est. Priority Date: 08/02/2016
• Status: Active Grant

• Current Assignee: Pindrop Security, Inc.
• Original Assignee: Pindrop Security, Inc.
• Inventors: Gaubitch, Nick, Strong, Scott, Cornwell, John, Kingravi, Hassan, Dewey, David
• Primary Examiner(s): Tran, Quoc D
• Application Number:
  US15/600,625
• Publication Number:
  US 20180041823A1
• Time in Patent Office: 690 Days
• Field of Search: 37914201, 37926501
• CPC Class Codes: G10L 25/51 for comparison or discrimination
• CPC Class Codes: H04L 25/0202 Channel estimation
• CPC Class Codes: H04M 1/56 Arrangements for indicating or recording the called number at the calling subscriber's set
• CPC Class Codes: H04M 2201/18 Comparators
• CPC Class Codes: H04M 2203/60 related to security aspects in telephonic communication systems network architectures or network communication protocols for network security H04L63/00
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 3/493 Interactive information services, e.g. directory enquiries ; Arrangements therefor, e.g. interactive voice response [IVR] systems or voice portals
• CPC Class Codes: H04M 7/1295 Details of dual tone multiple frequency signalling
• CPC Class Codes: H04Q 1/45 using multi-frequency signalling H04Q1/46 takes precedence
• CPC Class Codes: H04Q 2213/13139 Fraud detection/prevention
• CPC Class Codes: H04Q 2213/13405 Dual frequency signaling, DTMF
• CPC Class Codes: H04Q 2213/13515 authentication, authorisation - fraud prevention
• CPC Class Codes: H04Q 3/70 Identification of class of calling subscriber

Abstract

Systems, methods, and computer-readable media for call classification and for training a model for call classification, an example method comprising: receiving DTMF information from a plurality of calls; determining, for each of the calls, a feature vector including statistics based on DTMF information such as DTMF residual signal comprising channel noise and additive noise; training a model for classification; comparing a new call feature vector to the model; predicting a device type and geographic location based on the comparison of the new call feature vector to the model; classifying the call as spoofed or genuine; and authenticating a call or altering an IVR call flow.

Claims

1. A computer-implemented method to classify a call, the computer-implemented method comprising:

receiving dual-tone multifrequency (DTMF) information from a call;

determining a DTMF residual signal of the call based on the DTMF information;

determining a feature vector based on the DTMF information, wherein at least one feature in the feature vector is based on the DTMF residual signal;

comparing the feature vector to a model; and

classifying the call based on the comparison of the feature vector to the model.

2. computer-implemented method of claim 1, further comprising:

prompting, by an Interactive Voice Response (IVR) system, entry of the DTMF information.

3. The computer-implemented method of claim 1, further comprising:

determining an ideal DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the ideal DTMF tone.

4. The computer-implemented method of claim 1, further comprising:

estimating channel noise in a DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the channel noise.

5. The computer-implemented method of claim 1, further comprising:

estimating additive noise in a DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the additive noise.

6. The computer-implemented method of claim 1, wherein the feature vector is a vector of features including at least one feature, and wherein the at least one feature is based on at least one of a mean, a median, a variance, a standard deviation, a frequency, a wavelength, a duration, a coefficient of variation, or a percentile of DTMF information.

7. The computer-implemented method of claim 1, further comprising:

receiving DTMF information from a far end of the call.

8. The computer-implemented method of claim 7, wherein the receiving DTMF information from the call is done by an Interactive Voice Response (IVR) system at a near end of the call.

9. The computer-implemented method of claim 1, wherein the classifying the call based on the comparison of the feature vector to the model includes predicting, based on the comparison of the feature vector to the model, a device type of a device that provides the DTMF information, wherein the computer-implemented method further comprises:

comparing the predicted device type to an expected device type associated with a phone number of the call.

10. The computer-implemented method of claim 9, further comprising:

classifying the call as spoofed based on the comparison of the predicted device type to the expected device type.

11. The computer-implemented method of claim 9, further comprising:

authenticating at least one of the call or a party to the call based on the comparison of the predicted device type to the expected device type.

12. The computer-implemented method of claim 1, wherein the classifying the call based on the comparison of the feature vector to the model includes predicting, based on the comparison of the feature vector to the model, a relative geographic location of a party to the call, wherein the computer-implemented method further comprises:

comparing the predicted relative geographic location of the party to the call to an expected geographic location associated with a phone number of the call.

13. The computer-implemented method of claim 12, further comprising:

classifying the call as spoofed based on the comparison of the relative geographic location of the party to the call to the expected geographic location.

14. The computer-implemented method of claim 12, further comprising:

authenticating at least one of the call or a party to the call based on the comparison of the relative geographic location of the party to the call to the expected geographic location.

31. A system that trains a model for call classification, the system comprising:

at least one processor; and

a non-transitory computer readable medium coupled to the at least one processor having instructions stored thereon that, when executed by the at least one processor, cause the at least one processor to perform the method of claim 1.

32. One or more non-transitory computer readable media storing the model of claim 1.

15. A computer-implemented method to train a model for call classification, the computer-implemented method comprising:

receiving dual-tone multifrequency (DTMF) information from a plurality of calls;

determining, for each of the calls, a DTMF residual signal of the call based on the DTMF information of the call;

determining, for each of the calls, a feature vector based on the DTMF residual signal of the call; and

training a model on the feature vectors.

16. The computer-implemented method of claim 15, wherein the DTMF information from each of the calls is from a same phone number, the method further comprising:

receiving DTMF information from a new call;

determining a new call feature vector based on the DTMF information from the new call;

comparing the new call feature vector to the model; and

predicting, based on the comparison of the new call feature vector to the model, the new call as having a same device type as a device type of the plurality of calls.

17. The computer-implemented method of claim 15, wherein the plurality of calls includes genuine calls and spoofed calls, the method further comprising:

receiving DTMF information from a new call;

determining a new call feature vector based on the DTMF information from the new call;

comparing the new call feature vector to the model; and

predicting, based on the comparison of the new call feature vector to the model, the new call as genuine or spoofed.

18. The computer-implemented method of claim 15, wherein the feature vector is a vector of features including at least one feature, and wherein the at least one feature is based on at least one of a mean, a median, a variance, a standard deviation, a frequency, a wavelength, an amount of time, a coefficient of variation, or a percentile of DTMF information.

19. The computer-implemented method of claim 15, wherein the plurality of calls are each from a same device type, the method further comprising:

receiving DTMF information from a new call;

determining a new call feature vector based on the DTMF information from the new call;

comparing the new call feature vector to the model; and

predicting, based on the comparison of the new call feature vector to the model, the new call as having the same device type as the device type of the plurality of calls.

20. The computer-implemented method of claim 19, wherein the predicting, based on the comparison of the new call feature vector to the model, the new call as having the same device type as the device type of the plurality of calls includes:

estimating a probability that the new call has the same device type as the device type of the plurality of calls.

21. The computer-implemented method of claim 15, wherein the plurality of calls are from a same device, the method further comprising:

receiving DTMF information from a new call;

determining a new call feature vector based on the DTMF information from the new call;

comparing the new call feature vector to the model; and

predicting, based on the comparison of the new call feature vector to the model, a device of the new call is the same device.

22. The computer-implemented method of claim 21, wherein at least one of the device of the plurality of calls or a party to the plurality of calls is authenticated before providing DTMF information.

23. The computer-implemented method of claim 22, wherein at least one of the device of the new call or a party to the new call is authenticated based on the comparison of the new call feature vector to the model.

24. The computer-implemented method of claim 15, wherein the DTMF residual signal includes at least one of channel noise or additive noise, and wherein the at least one feature is based on at least one of channel noise or additive noise.

25. The computer-implemented method of claim 24, further comprising:

determining an estimate of the channel noise; and

determining an estimate of the additive noise, wherein the at least one feature is based on at least one of the estimate of the channel noise or the estimate of the additive noise.

26. The computer-implemented method of claim 15, wherein the DTMF information from each of the calls is from a same phone number.

27. The computer-implemented method of claim 26, further comprising:

receiving DTMF information from a new call from the same phone number;

determining a new call feature vector based on the DTMF information from the new call;

comparing the new call feature vector to the model; and

at least one of the following;

classifying the new call as from a same device as a device of each of the plurality of calls;

or

classifying the new call as from a different device as a device of each of the plurality of calls.

28. The computer-implemented method of claim 26, further comprising at least one of the following:

authenticating at least one of the new call or a party to the new call based on the comparison of the new call feature vector to the model;

or

classifying the call as spoofed based on the comparison of the new call feature vector to the model.

29. The computer-implemented method of claim 15, wherein the model is a classifier for device type and geographic location, the method further comprising:

determining, for a new call, a new call feature vector based on the new call;

comparing the new call feature vector to the model; and

predicting, based on the comparison of the new call feature vector to the model, a device type and geographic location.

30. The computer-implemented method of claim 29, further comprising:

comparing the predicted device type to an expected device type associated with a phone number of the new call;

comparing the predicted geographic location to an expected geographic location associated with the phone number of the new call; and

classifying the call as spoofed if the predicted device type does not match the expected device type and the predicted geographic location does not match the expected geographic location.