System and method for an automated system for continuous observation, audit and control of user activities as they occur within a mobile network

• US 10,700,976 B2
• Filed: 05/25/2018
• Issued: 06/30/2020
• Est. Priority Date: 09/13/2013
• Status: Active Grant

• Current Assignee: Network Kinetix, Llc
• Original Assignee: Network Kinetix, Llc
• Inventors: Richards, Carissa, Richards, Peter, Ramachandran, Hariharan
• Primary Examiner(s): Katsikis, Kostas J
• Application Number:
  US15/989,962
• Publication Number:
  US 20180279126A1
• Time in Patent Office: 767 Days
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/3263 characterised by activation or deactivation of payment capabilities
• CPC Class Codes: G06Q 20/3265 characterised by personalisation for use
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0248 Avoiding fraud
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/121 : Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
• CPC Class Codes: H04W 12/122 : Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 : Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/128 : Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic

Abstract

A method for detecting a fraudulent attempt to activate a new PIN, SIM Card or mobile device includes monitoring, at a first processing node associated with a network interconnecting a first network point and a second network point, a mirrored live-data flow of a live data flow passing through the first processing node in a non-intrusive manner that does not affect the first live-data flow passing through the first processing node. The live-data flow comprises data that is in active transmission between the first network point and the second network point and prior to storage of the data in a database. The first processing node detects that a transaction within the monitored live-data flow relates to an activation of the new PIN, SIM card or mobile device and compares the detected transaction to a list of known fraud situations stored in the first processing node to determine if the detected transaction relates to a known fraud situation. The first processing node generates an alert indication responsive to a determination the detected data relates to one of a plurality of known fraud situations. The first processing node identifies the detected transaction as a potential fraud situation responsive to a determination the detected data does not relate to one of the plurality known fraud situations. An automatically generated dialog verification with a party requesting the new PIN, SIM Card or mobile device is performed to verify identity of the party requesting the new PIN, SIM Card or mobile device for the detected transaction identified as the potential fraud situation.

Claims

1. A method for detecting a fraudulent attempt to activate a new PIN, SIM Card or mobile device comprising:

monitoring, at a first processing node associated with a network interconnecting a first network point and a second network point, a mirrored live-data flow of a live data flow passing through the first processing node in a non-intrusive manner that does not affect the first live-data flow passing through the first processing node, wherein the live-data flow comprises data that is in active transmission between the first network point and the second network point and prior to storage of the data in a database;

detecting that a transaction within the monitored live-data flow relates to an activation of the new PIN, SIM card or mobile device;

comparing the detected transaction to a list of known fraud situations stored in the first processing node to determine if the detected transaction relates to a known fraud situation;

generating an alert indication responsive to a determination the detected data relates to one of a plurality of known fraud situations;

identifying the detected transaction as a potential fraud situation responsive to a determination the detected data does not relate to one of the plurality of known fraud situations; and

performing an automatically generated dialog verification with a party requesting the new PIN, SIM Card or mobile device to verify identity of the party requesting the new PIN, SIM Card or mobile device for the detected transaction identified as the potential fraud situation.

2. The method of claim 1 further including storing within the first processing node the detected data relating to the activation of the new PIN, SIM card or mobile device.

3. The method of claim 2 wherein the stored information comprises at least one of agent identity, sender ID, recipient ID, sender location, recipient location and amount of money involved in the transaction.

4. The method of claim 1, wherein the known fraud situation comprises a known fraud number.

5. The method of claim 1, wherein the known fraud situation comprises a known fraud scenario.

6. The method of claim 1, wherein generating the alert indication further comprises:

setting a flag indicating a suspected fraud situation responsive to the determination; and

transmitting an alert message indicating the potential fraud situation responsive to the determination.

7. The method of claim 1, wherein the performing the automatically generated dialog verification further comprises determining a manner for contacting the party requesting the new PIN, SIM Card or mobile device.

8. The method of claim 1, wherein the performing the automatically generated dialog verification further comprises forwarding the data associated with the detected transaction from the first processing node to a second processing node.

9. A system for detecting a fraudulent attempt to activate a new PIN, SIM Card or mobile device comprising:

a first processor associated with a network for implementing a first processing node, the first processing node configured to;

monitor, at the first processing node associated with a network interconnecting a first network point and a second network point, a mirrored live-data flow of a live data flow passing through the first processing node in a non-intrusive manner that does not affect the first live-data flow passing through the first processing node, wherein the live-data flow comprises data that is in active transmission between the first network point and the second network point and prior to storage of the data in a database;

detect that a transaction within the monitored live-data flow relates to an activation of the new PIN, SIM card or mobile device;

compare the detected transaction to a list of known fraud situations stored in the first processing node to determine if the detected transaction relates to a known fraud situation;

generate an alert indication responsive to a determination the detected data relates to one of a plurality of known fraud situations;

identify the detected transaction as a potential fraud situation responsive to a determination the detected data does not relate to one of the plurality of known fraud situations; and

perform an automatically generated dialog verification with a party requesting the new PIN, SIM Card or mobile device to verify identity of the party requesting the new PIN, SIM Card or mobile device, for the detected transaction identified as the potential fraud situation.

10. The system of claim 9, wherein the first processing node is further configured to store at a location associated with the first processing node the detected data relating to the activation of the new PIN, SIM card or mobile device.

11. The system of claim 10, wherein the stored information comprises at least one of agent identity, sender ID, recipient ID, sender location, recipient location and amount of money involved in the transaction.

12. The system of claim 9, wherein the known fraud situation comprises a known fraud number.

13. The system of claim 9, wherein the known fraud situation comprises a known fraud scenario.

14. The system of claim 9, wherein the first processing node is further configured to:

set a flag indicating a suspected fraud situation responsive to the determination; and

transmit an alert message indicating the potential fraud situation responsive to the determination.

15. The system of claim 9, wherein the first processing node is further configured to perform the automatically generated dialog verification by determining a manner for contacting the party requesting the new PIN, SIM Card or mobile device.

16. The system of claim 9, wherein the first processing node is further configure to perform the automatically generated dialog verification by forwarding the data associated with the detected transaction from the first processing node to the second processing node.

17. A method for detecting a fraudulent attempt to activate a new PIN, SIM Card or mobile device comprising:

monitoring, at a first processing node associated with a network interconnecting a first network point and a second network point, a mirrored live-data flow of a live data flow passing through the first processing node in a non-intrusive manner that does not affect the first live-data flow passing through the first processing node, wherein the live-data flow comprises data that is in active transmission between the first network point and the second network point and prior to storage of the data in a database;

detecting that a transaction within the monitored live-data flow relates to an activation of the new PIN, SIM card or mobile device;

comparing the detected transaction to a list of a known fraud numbers or known fraud scenarios stored in the first processing node to determine if the detected transaction relates to a known fraud number or known fraud scenario;

generating an alert indication responsive to a determination the detected data relates to one of a plurality of known fraud situations;

identifying the detected transaction as a potential fraud situation responsive to a determination the detected data does not relate to a known fraud number or known fraud scenario;

determining a manner for contacting the party requesting the new PIN, SIM Card or mobile device;

forwarding the data associated with the detected transaction from the first processing node to a second processing node; and

performing an automatically generated dialog verification with a party requesting the new PIN, SIM Card or mobile device to verify identity of the party requesting the new PIN, SIM Card or mobile device from the second processing node, for the detected transaction identified as the potential fraud situation.

18. The method of claim 17, wherein generating the alert indication further comprises:

setting a flag indicating a suspected fraud situation responsive to the determination; and

transmitting an alert message indicating the potential fraud situation responsive to the determination.

19. The method of claim 17 further including storing within the first processing node the detected data relating to the activation of the new PIN, SIM card or mobile device.

20. The method of claim 19 wherein the stored information comprises at least one of agent identity, sender ID, recipient ID, sender location, recipient location and amount of money involved in transaction.