Method and system for preventing illicit use of a telephony platform

• US 9,270,833 B2
• Filed: 04/15/2014
• Issued: 02/23/2016
• Est. Priority Date: 07/24/2012
• Status: Active Grant

• Current Assignee: Twilio, Inc.
• Original Assignee: Twilio, Inc.
• Inventors: Ballai, Adam, Hagemann, Robert C. III, Zarick, Daniel
• Primary Examiner(s): Cai, Wayne
• Application Number:
  US14/253,316
• Publication Number:
  US 20140226803A1
• Time in Patent Office: 679 Days
• Field of Search: 455/410, 455/411, 455/405, 455/406, 705/14.47, 705/14.26, 705/26.35, 379/189, 379/127.02
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A system and method for preventing illicit use of a telephony platform that includes enrolling a plurality of accounts on a telecommunications platform, wherein an account includes account configuration; at a fraud detection system of the telecommunications platform, receiving account usage data, wherein the usage data includes at least communication configuration data and billing configuration data of account configuration and further includes communication history of the plurality of accounts; calculating fraud scores of a set of fraud rules from the usage data, wherein at least a sub-set of the fraud rules include conditions of usage data patterns between at least two accounts; detecting when the fraud scores of an account satisfy a fraud threshold; and initiating an action response when a fraud score satisfies the fraud threshold.

Claims

1. A method comprising:

at a telecommunication platform;

enrolling a plurality of parent accounts in the telecommunication platform;

within a first enrolled account, enrolling at least one sub-account that is managed by the first account;

at a fraud detection system of the telecommunication platform, receiving sub-account usage data of a plurality of sub-accounts of the telecommunication platform, wherein the sub-account usage data of each of the plurality of sub-accounts includes at least configuration data of the sub-account and communication history data;

calculating fraud scores of a set of fraud scores from the sub-account usage data; and

when the set of fraud scores of a sub-account satisfy a fraud threshold, programmatically notifying the corresponding parent account through the telecommunication platform,

wherein receiving sub-account usage data comprises collecting application media configuration; and

wherein for a first fraud rule, detecting a sub-account using application media files identical to media files used by at least a second sub-account.

2. The method of claim 1, wherein detecting a sub-account using application media files identical to media files used by at least a second sub-account comprises:

calculating fingerprints of media files encountered during a communication session; and

identifying corresponding media file fingerprints in two sub-accounts.

3. A method comprising:

at a telecommunication platform;

enrolling a plurality of parent accounts in the telecommunication platform;

within a first enrolled account, enrolling at least one sub-account that is managed by the first account;

at a fraud detection system of the telecommunication platform, receiving sub-account usage data of a plurality of sub-accounts of the telecommunication platform, wherein the sub-account usage data of each of the plurality of sub-accounts includes at least configuration data of the sub-account and communication history data;

calculating fraud scores of a set of fraud scores from the sub-account usage data; and

when the set of fraud scores of a sub-account satisfy a fraud threshold, programmatically notifying the corresponding parent account through the telecommunication platform,

wherein receiving sub-account usage data comprises collecting application uniform resource identifiers (URIs) mapped to communication endpoints of a sub-account; and

wherein for a first fraud rule, detecting corresponding application URIs configured in at least two sub-accounts.

4. A method comprising:

at a telecommunication platform;

enrolling a plurality of parent accounts in the telecommunication platform;

within a first enrolled account, enrolling at least one sub-account that is managed by the first account;

at a fraud detection system of the telecommunication platform, receiving sub-account usage data of at least one sub-account of the telecommunication platform, wherein the sub-account usage data of each sub-account includes at least configuration data of the sub-account and communication history data;

calculating fraud scores of a set of fraud scores from the sub-account usage data; and

when the set of fraud scores of a sub-account satisfy a fraud threshold, programmatically notifying the corresponding parent account through the telecommunication platform,

wherein receiving sub-account usage data of a sub-account comprises collecting payment mechanism configuration of the sub-account; and

wherein in response to a first fraud rule, detecting diversity of payment mechanism in a sub-account.

5. A method comprising:

at a telecommunication platform;

enrolling a plurality of parent accounts in the telecommunication platform;

within a first enrolled account, enrolling at least one sub-account that is managed by the first account;

at a fraud detection system of the telecommunication platform, receiving sub-account usage data of a plurality of sub-accounts of the telecommunication platform, wherein the sub-account usage data of each of the plurality of sub-accounts includes at least configuration data of the sub-account and communication history data;

calculating fraud scores of a set of fraud scores from the sub-account usage data;

in a case where the set of fraud scores of a sub-account satisfy a fraud threshold, programmatically notifying the corresponding parent account of illicit behavior of the sub-account, the notification being provided via the telecommunication platform,

wherein illicit behavior includes at least one of toll fraud, spamming, terms of service violations, denial of service attacks, credit card fraud, suspicious behavior, and phishing attacks,

wherein the parent account is an account of an external service provider system, and

wherein each sub-account is an account of a system that uses a service of the external service provider system.

6. The method of claim 5, wherein receiving sub-account usage data comprises collecting application media configuration;

and wherein for a first fraud rule, detecting a sub-account using application media files identical to media files used by at least a second sub-account.

7. The method of claim 6, wherein detecting a sub-account using application media files identical to media files used by at least a second sub-account comprises:

calculating fingerprints of media files encountered during a communication session;

and identifying corresponding media file fingerprints in two sub-accounts.

8. The method of claim 5, wherein receiving sub-account usage data comprises collecting application uniform resource identifiers (URIs) mapped to communication endpoints of a sub-account;

and wherein for a first fraud rule, detecting corresponding application URIs configured in at least two sub-accounts.

9. The method of claim 5, wherein receiving sub-account usage data of a sub-account comprises collecting payment mechanism configuration of the sub-account;

and wherein in response to a first fraud rule, detecting diversity of payment mechanism in a sub-account.