Communications system with fraud monitoring

• US 7,197,560 B2
• Filed: 03/20/2002
• Issued: 03/27/2007
• Est. Priority Date: 03/20/2001
• Status: Expired due to Fees

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: MCI Incorporated (Verizon Communications Inc.)
• Inventors: Van Arkel, John Hans, Springer, Arthur Lance, Caslin, Michael
• Primary Examiner(s): Tran; Philip B.
• Application Number:
  US10/103,279
• Publication Number:
  US 20020188712A1
• Time in Patent Office: 1,833 Days
• Field of Search: 709/224, 709/227, 709/230, 709/246, 379/189, 379/114.14
• US Class Current: 709/224
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 12/1446 inter-operator billing
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 47/19 at layers above the network layer network arrangements for networked applications for scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04L 47/2408 for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/4523 using lightweight directory access protocol [LDAP]
• CPC Class Codes: H04L 61/4535 using an address exchange platform which sets up a session between two nodes, e.g. rendezvous servers, session initiation protocols [SIP] registrars or H.323 gatekeepers
• CPC Class Codes: H04L 61/4557 : Directories for hybrid networks, e.g. including telephone numbers
• CPC Class Codes: H04L 63/0272 : Virtual private networks
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 65/103 : in the network
• CPC Class Codes: H04L 65/104 : in the network
• CPC Class Codes: H04L 65/1043 : Gateway controllers, e.g. media gateway control protocol [MGCP] controllers
• CPC Class Codes: H04L 65/1069 : Session establishment or de-establishment
• CPC Class Codes: H04L 65/1094 : Inter-user-equipment sessions transfer or sharing
• CPC Class Codes: H04L 65/1096 : Supplementary features, e.g. call forwarding or call holding systems providing special services or facilities to telephony subscribers H04M3/42
• CPC Class Codes: H04L 65/1101 : Session protocols
• CPC Class Codes: H04L 65/1104 : Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/401 : wherein the services involve a main real-time session and one or more additional parallel real-time or time sensitive sessions, e.g. white board sharing or spawning of a subconference
• CPC Class Codes: H04L 65/612 : for unicast
• CPC Class Codes: H04L 65/762 : at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 67/06 : specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/52 : specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/563 : Data redirection of data network streams
• CPC Class Codes: H04L 67/61 : taking into account QoS or priority requirements
• CPC Class Codes: H04L 69/08 : Protocols for interworking; Protocol conversion
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/06 : Recording class or number of calling , i.e. A-party or called party , i.e. B-party
• CPC Class Codes: H04M 15/41 : Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/43 : Billing software details
• CPC Class Codes: H04M 15/44 : Augmented, consolidated or itemized billing statement or bill presentation
• CPC Class Codes: H04M 15/47 : Fraud detection or prevention means
• CPC Class Codes: H04M 15/49 : Connection to several service providers
• CPC Class Codes: H04M 15/51 : for resellers, retailers or service providers
• CPC Class Codes: H04M 15/52 : for operator independent billing system
• CPC Class Codes: H04M 15/53 : using mediation
• CPC Class Codes: H04M 15/55 : for hybrid networks
• CPC Class Codes: H04M 15/56 : for VoIP communications
• CPC Class Codes: H04M 15/58 : based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/63 : based on the content carried by the session initiation protocol [SIP] messages
• CPC Class Codes: H04M 15/745 : Customizing according to wishes of subscriber, e.g. friends or family
• CPC Class Codes: H04M 15/80 : Rating or billing plans; Tariff determination aspects
• CPC Class Codes: H04M 15/8207 : Time based data metric aspects, e.g. VoIP or circuit switched packet data
• CPC Class Codes: H04M 15/8214 : Data or packet based
• CPC Class Codes: H04M 15/8292 : Charging for signaling or unsuccessful connection
• CPC Class Codes: H04M 2207/203 : composed of PSTN and data network, e.g. the Internet
• CPC Class Codes: H04M 2215/0104 : Augmented, consolidated or itemised billing statement, e.g. additional billing information, bill presentation, layout, format, e-mail, fax, printout, itemised bill per service or per account, cumulative billing, consolidated billing
• CPC Class Codes: H04M 2215/0108 : Customization according to wishes of subscriber, e.g. customer preferences, friends and family, selecting services or billing options, Personal Communication Systems [PCS]
• CPC Class Codes: H04M 2215/0148 : Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0152 : General billing plans, rate plans, e.g. charge rates, numbering plans, rate centers, customer accounts
• CPC Class Codes: H04M 2215/0164 : Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/0168 : On line or real-time flexible customization or negotiation according to wishes of subscriber
• CPC Class Codes: H04M 2215/0172 : Mediation, i.e. device or program to reformat CDRS from one or more switches in order to adapt to one or more billing programs formats
• CPC Class Codes: H04M 2215/0176 : Billing arrangements using internet
• CPC Class Codes: H04M 2215/0188 : Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 2215/2013 : Fixed data network, e.g. PDN, ATM, B-ISDN
• CPC Class Codes: H04M 2215/202 : VoIP; Packet switched telephony
• CPC Class Codes: H04M 2215/2046 : Hybrid network
• CPC Class Codes: H04M 2215/22 : Bandwidth or usage-sensitve billing
• CPC Class Codes: H04M 2215/44 : Charging/billing arrangements for connection made over different networks, e.g. wireless and PSTN, ISDN, etc.
• CPC Class Codes: H04M 2215/46 : Connection to several service providers
• CPC Class Codes: H04M 2215/54 : Resellers-retail or service providers billing, e.g. agreements with telephone service operator, activation, charging/recharging of accounts
• CPC Class Codes: H04M 2215/7813 : Time based data, e.g. VoIP or circuit switched packet data
• CPC Class Codes: H04M 2215/782 : Data or packet based
• CPC Class Codes: H04M 3/2218 : Call detail recording
• CPC Class Codes: H04M 3/42229 : Personal communication services, i.e. services related to one subscriber independent of his terminal and/or location diverting calls from one subscriber to another subscriber, i.e. two different subscriptions H04M3/54; selecting arrangements in intelligent networks H04Q3/005
• CPC Class Codes: H04M 3/46 : Arrangements for calling a number of substations in a predetermined sequence until an answer is obtained
• CPC Class Codes: H04M 3/465 : Arrangements for simultaneously calling a number of substations until an answer is obtained
• CPC Class Codes: H04M 7/006 : Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04M 7/0075 : Details of addressing, directories or routing tables
• CPC Class Codes: H04M 7/0078 : Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04M 7/1205 : where the types of switching equipement comprises PSTN/ISDN equipment and switching equipment of networks other than PSTN/ISDN, e.g. Internet Protocol networks
• CPC Class Codes: H04M 7/128 : Details of addressing, directories or routing tables
• CPC Class Codes: H04Q 3/0029 : Provisions for intelligent networking
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/029 : Location-based management or tracking services
• CPC Class Codes: H04W 4/20 : Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel

Abstract

A fraud monitoring system is disclosed for a communications system. The fraud monitoring system analyzes records of usage activity in the system and applies fraud pattern detection algorithms to detect patterns indicative of fraud. The fraud monitoring system advantageously accommodates transaction both records resulting from control of a packet-switched network and those from a circuit-switched network gateway.

Claims

1. A method for monitoring activity in a communications system comprising the steps of:

obtaining at least one first record relating to a first transport network, wherein the first transport network is a circuit-switched network;

obtaining at least one second record relating to a second transport network, wherein the second transport network is a data network;

determining that the first record and second record are both associated with a communication session;

determining at least one aspect of the communications session based upon content of both the first record and the second record; and

generating a fraud alert based on the determined aspect of the communication session.

2. The method of claim 1 wherein the first record is formatted differently than the second record.

3. The method of claim 1 wherein at least one of the first record and the second record pertains to the action of a gateway coupling the first transport and the second transport network.

4. The method of claim 1 further comprising the step of combining the first record with the second record to form a composite record of activity.

5. The method of claim 4 further comprising the step of converting the first record into the format of the second record.

6. The method of claim 4 further comprising the step of translating both the first record and second record into a common format.

7. The method of claim 4 further comprising the step of adding to the first record additional information related to at least one aspect of the second transport network.

8. The method of claim 7 wherein the additional information is an address in an address space of the second transport network.

9. The method of claim 1 wherein the communications session is a voice call supported by the first transport network and the second transport network.

10. The method of claim 9 wherein the first record is based on a Call Detail Record (CDR)-type format, and the second record is based on an eXtensible Mark-up Language (XML)-type format.

11. A method for supporting fraud monitoring, the method comprising the steps of:

collecting a first transaction record associated with a circuit-switched network;

collecting a second transaction record associated with a packet-switched network, wherein the first transaction record and the second transaction record correspond to a common communication session transported by the circuit-switched network and the packet-switched network;

generating a third transaction record from the first transaction record and the second transaction record; and

generating a fraud alert based on the third transaction record associated with the common communication session.

12. A method according to claim 11, further comprising the steps of:

determining an identifier corresponding to the first transaction record and the second transaction record; and

augmenting the third transaction record with the determined identifier.

13. A method according to claim 11, wherein the third transaction record is based on an eXtensible Mark-up Language (XML)-type format.

14. A system for supporting fraud monitoring, the system comprising:

a first receiver configured to collect a first transaction record associated with a circuit-switched network;

a second receiver configured collect a second transaction record associated with a packet-switched network, wherein the first transaction record and the second transaction record correspond to a common communication session transported by the circuit-switched network and the packet-switched network; and

a record converter configured to generate a third transaction record from the first transaction record and the second transaction record, wherein a fraud alert is generated based on the third transaction record associated with the common communication session.

15. A system according to claim 14, further comprising:

means for determining an identifier corresponding to the first transaction record and the second transaction record; and

means for augmenting the third transaction record with the determined identifier.

16. A system according to claim 14, wherein the third transaction record is based on an eXtensible Mark-up Language (XML)-type format.